Why Baidu Has Been Hijacked to Attack GitHub - <AUTHOR> https://archive.today/KtgpS <comment><USER2> Hmm, I wonder if this could backfire. If it's an <iframe>, couldn't GitHub insert code that framebusts? If it's some other mechanism, couldn't they block by referrer? If it's CORS, couldn't GitHub deny CORS requests? If it's a <script> tag, couldn't GitHub do some nasty XSS?

Edit: ooh, take a look at the more detailed look from insight-labs: [http://insight-labs.org/?p=1682](http://insight-labs.org/?p=1682)

It's XMLHttpRequest ($.ajax), but with dataType: "script". Looking at the jQuery docs ([http://api.jquery.com/jquery.ajax/](http://api.jquery.com/jquery.ajax/)):

 _" script": Evaluates the response as JavaScript and returns it as plain text. Disables caching by appending a query string parameter, "_=[TIMESTAMP]", to the URL unless the cache option is set to true. Note: This will turn POSTs into GETs for remote-domain requests._

Oh dear. If GitHub can detect this, GitHub can basically XSS all sites using Baidu's analytics.

Edit 2: Oh, the insight-labs article says the attack has stopped.

<comment> Pirate-of-SV That's exactly what they did! At the moment of this writing they are sending back:

        alert("WARNING: malicious javascript detected on this domain")

when you're trying to reach: [https://github.com/greatfire/](https://github.com/greatfire/) or [https://github.com/cn-nytimes/](https://github.com/cn-nytimes/) That's why other people have started to notice it (as the article describes).

Timeline of the attack looks something like this:

1\. The Chinese firewall hijacks requests to [http://hm.baidu.com/h.js](http://hm.baidu.com/h.js) and sends back a script that attacks GH instead.

2\. Github notices that a huge amount of people are trying to reach [https://github.com/greatfire/](https://github.com/greatfire/) and [https://github.com/cn-nytimes/](https://github.com/cn-nytimes/)

3\. GH figures out what's happening and starts replying with the alert javascript snippet.

4\. Users are now getting noticed by the alert every time their browser runs the hijacked javascript.

5\. The person that wrote this article writes this article after investigating what the alert message is about.

<comment><USER3> If I were Github I would redirect the attacker back at one of their own resources.

A attack reflection of sort.

Edit: You're technically not attacking you're reflecting if the attack stops there's nothing to reflect.

Just like in martial arts you don't just take a beating you defend and return the opponents attack back at them. Seems fair to me.

<comment><USER4> Who should they "reflect" the attack back at? Baidu, who seem to be a victim of HTTP hijacking in this case? Or the Chinese government? If the latter, then where exactly do you focus the counter-attack?

<comment><USER5> Baidu == Chinese Government

<comment><USER6> I don't know. If I were a private company, I'd go out of my way to avoid antagonizing nation-state level governments.

</comment></comment></comment></comment></comment></comment><comment><USER2> Does anyone have a mirror of the original article? "Error establishing a database connection"

Edit: Google cached it here: [http://webcache.googleusercontent.com/search?q=cache:CeVJaTq...](http://webcache.googleusercontent.com/search?q=cache:CeVJaTqfuZkJ:https://iyouport.com/archives/25775+&cd=1&hl=en&ct=clnk)

Edit 2: Here's an archive.today of Google's cache: [https://archive.today/KtgpS](https://archive.today/KtgpS)

<comment><USER7> Thanks. Since your second link works while [http://translate.google.ca/translate?hl=en&sl=zh- CN&u=https:...](http://translate.google.ca/translate?hl=en&sl=zh- CN&u=https://iyouport.com/archives/25775&prev=search) doesn't, and neither is an original source anyhow, we've swapped the URLs.

</comment></comment><comment><USER8> Assuming this is the Chinese government, what's their end game here? They must believe that GitHub will bow to their will and remove Greatfire or block it from China. Permanently? That seems incredibly naive. Also, have they not considered the Streisand effect? Also, assuming they see Baidu as effectively a state asset, why poison that brand for such a temporary gain? It doesn't make sense.

<comment><USER9>
      They must believe that GitHub will bow to their will
      [...] That seems incredibly naive.

Plenty of technology companies would. Of course, they would call it "complying with local laws in all countries in which we operate".

The only way to find out if Github is such a company is a few months of successful attacks.

<comment><USER8> That's true. I remember being incredibly disappointed in Google when they agreed to censor search results for China. Here's to hoping that GitHub is willing to stand up to this bully.

<comment><USER10> Censor but supply notice that they were censoring. And when China hacked into gmail, they left the country rather than continue to comply with their laws.

</comment></comment></comment></comment><comment><USER11> The US government should prohibit US companies from complying with censorship demands from China. It already does something like that to prevent US companies from complying with the Arab League boycott of Israel.[1]

[1] [https://www.bis.doc.gov/index.php/enforcement/oac#whatsprohi...](https://www.bis.doc.gov/index.php/enforcement/oac#whatsprohibited)

</comment><comment><USER12> Very interesting to look at the original content of [https://github.com/greatfire/](https://github.com/greatfire/) and [https://github.com/cn-nytimes](https://github.com/cn-nytimes). One appears to be a collection of resources for proxying around the Great Firewall [1] and the other has a number of clones of the New York Times translated in Mandarin [2][3].

[1]: [http://webcache.googleusercontent.com/search?q=cache:X_4LmyL...](http://webcache.googleusercontent.com/search?q=cache:X_4LmyL2jBsJ:https://github.com/greatfire+&cd=1&hl=en&ct=clnk&gl=us)

[2]: [https://github.com/cn-nytimes/mirrors](https://github.com/cn- nytimes/mirrors) [3]: [https://dtl1al4e74u07.cloudfront.net/](https://dtl1al4e74u07.cloudfront.net/)

<comment><USER13> I didn't realize until now that part of the NYT's strategy in having a Mandarin version may be due in part to it's being blocked in China -- a reply to China's censors, of sorts.

</comment></comment><comment><USER14> I think GitHub should have added a more descriptive error message (since they control it thanks to how the attack vector works).

        alert(
          "The site you are visiting contains malicious JavaScript.\n" +
          "Your computer is currently being used to attack Github.com."
        )

or something...

<comment><USER15> The only thing the average web user would take away from such a popup is that github.com is annoying or spying on them, and then proceed to bombard github with messages to knock it off (reminds me of when a blog temporarily became the #1 search term for "facebook login", oh the hate that blog received for "breaking my Facebooks")

<comment><USER2> The average web user _has no idea GitHub is behind the popup_. You need to be a web expert and look at the Network tab to know this.

<comment><USER15> OP suggested adding "github.com" to the popup's message. That would be a Bad Idea.

<comment><USER2> Oh, right, silly me for not reading the context.

</comment></comment></comment></comment></comment><comment><USER16> Everone keeps saying "Chinese Governement", this has no accountability. The actual person in charge is Ji Xinping. Start naming names people.

[https://www.google.com/search?q=xi%20jinping](https://www.google.com/search?q=xi%20jinping)

<comment><USER17> From what I've read about Chinese leadership, it's incorrect to label Xi as "in charge", at least if you mean in a dictatorial fashion. The CCP seems to run by the consensus of top party leaders. Xi certainly has more authority/sway than the rest, but I doubt he's making all of the decisions alone.

<comment><USER18> Like every organization there is a need to maintain good relationship with others. This means you have to make compromise and make deal. This means people aren't always 100% in charge. You can choose to do things against the will of some powerful enemy, and you will face the consequence. So Xi can make all the decisions here. He can say "I want this to be done" and his officials will carry out. At this very moment, Xi is absolutely in charge of everything, especially given his popularity.

</comment></comment></comment><comment><USER19> This is a very clever attack. I wonder if the same attack can be used on other sites or if it exploits something about Github.

Github's data is difficult to cache and many pages load piecemeal using turbolinks which itself creates lots of un-cacheable requests (cacheable only until someone pushes a new commit).

So it would appear to be next to impossible to stop a distributed attack.

<comment><USER2> > I wonder if the same attack can be used on other sites or if it exploits > something about Github.

It doesn't exploit anything GitHub-specific! The way it's done is applicable to any site. The reason is that it uses the <script> loophole around the Same Origin Policy (<script> can be loaded cross-domain, thanks Eich...). They basically just inject this every two seconds:

      <script src="http://github.com/greatfire/"></script>

The browser will request that page expecting a script. And it'll get HTML, but that's not valid JS and just ignore it, but the DDOS is successful.

However, this also makes all sites with the malicious JS vulnerable to an XSS attack _by GitHub_ , like GitHub is currently doing. If you visit that URL, you get this:

        alert("WARNING: malicious javascript detected on this domain")

Though I think the same trick could be done with, say, <img> or <style>, and those wouldn't allow XSS (though <style> could fuck with the page, certainly). Sloppy coding, Chinese Government employee...

<comment><USER20> I was wondering if you can prevent this by looking at the "Accept" header in the request but it seems accept is " _/_ " for scripts. I'd expect the browsers rather to send "application/javascript".

Then the answer from my server will be 400 because I don't have a javascript representation of this url.

<comment><USER2> Well, you're still spammed with requests.

<comment><USER20> Yes, but it is not the same if I can reply with 400 directly without further inspection.

I imagine github can do this at the reverse proxy level, instead of doing 20 queries to mysql and overload the ruby application.

<comment><USER2> Well, GitHub is already returning a special response for those URLs.

</comment></comment></comment></comment></comment></comment><comment><USER21> This actually only says _how_ GitHub was attacked, which was already clear this morning. It doesn't say why.

<comment><USER22> > It appears to be an attempt to pressure Github, a non-news organization, to > censor content that China objects to.

</comment></comment><comment><USER23> At what point will the US stop tolerating Chinese attacks on US companies?

<comment><USER2> What do you mean by "stop tolerating"? Declare war?

<comment><USER23> There are other diplomatic avenues besides declaring war.

<comment><USER2> What, sanctions? The US is totally reliant on China for manufacturing. You'd grind the West, and China, to a halt.

<comment><USER23> We can start with the US publicly blaming China for the attacks. Public consciousness does a lot by itself.

</comment></comment></comment></comment></comment><comment><USER24> GitHub should cut China off from all services until the attack stops. It is clearly something the Chinese government doesn't want, or they'd just block GitHub in the Great Firewall themselves.

<comment><USER25> You seem to think China (or the folks running the great firewall) would be unhappy losing GitHub. I don't think they'd care as long as those two repos were effectively invisible to users.

<comment><USER26> Redirect all visitors subjected to the GFC to one of those two repositories. China loses all of GitHub _except_ the projects it hates the most.

<comment><USER27> The childish part of me says to alter the redirect code to be a bit more...shocking. I think the attack would stop a lot more quickly if baidu users were subjected to, say, goatse or 2g1c.

</comment></comment></comment></comment><comment><USER28> Is google translate from Chinese (Mandarin presumably) always this good? I'm pretty shocked by how coherent the resulting article is.

<comment><USER29> In this case the original article is in English. [https://iyouport.com/archives/25775](https://iyouport.com/archives/25775) Not sure why OP put it through Google Translate ...

<comment><USER30> Google Translate has actually mangled the (English) text a bit by going from English to English.

</comment></comment></comment><comment><USER31> Here is the original article: [https://thenanfang.com/why-baidu-was-hijacked- to-attack-gith...](https://thenanfang.com/why-baidu-was-hijacked-to-attack- github/) (the one on iyouport links to this one)

</comment><comment><USER32> If I understand correctly, there is almost no way to stop this attack because it uses client side JavaScript code. If Baidu doesn't remove this malicious js from its http response, github will continue to suffer.

<comment> Pirate-of-SV Baidu is not doing anything wrong. The HTTP requests/responses are hijacked.

Baidu could make a switch to only support HTTPS though. That would require a more elaborate attack.

</comment></comment><comment><USER33> In hindsight, GitHub moving away from GitHub Pages from the github.com domain to github.io makes this whole situation less severe. Imagine all the GitHub- Pages-powered sites that would have been down at the moment.

[https://github.com/blog/1452-new-github-pages-domain- github-...](https://github.com/blog/1452-new-github-pages-domain-github-io)

Obviously the link above might not work at the moment.

<comment><USER33> I think I spoke too soon ... latest update:

"19:23 UTC The on-going DDoS attack now includes GitHub Pages. We are working to mitigate any service disruption."

[https://status.github.com/messages](https://status.github.com/messages)

<comment><USER34> It would be exceptionally epic if you didn't "speak too soon" but instead "gave them the idea" ;P.

</comment></comment></comment><comment><USER35> Why wouldn't they make the pages in question serve window.top.location = "somewhere";?

<comment><USER36> Their solution stops the reloads for each browser and has the benefit of alerting the user that something's wrong, without hammering "somewhere".

<comment><USER35> But if users just click OK multiple times it still means more requests (since it was happening every 2secs).

</comment></comment></comment><comment> Dorian-Marie They seem to push the DDoS from multiple fronts, for instance this repo has 100k random numbers commits: [https://github.com/greatfire/z](https://github.com/greatfire/z)

<comment><USER2> I don't think that's DDoS. It's probably the authors of the project frequently changing it to evade Chinese censorship.

</comment></comment><comment><USER37> Because they can't just seize the servers the way the US does.

</comment><comment><USER38> Would it be possible to use this and the CSS link color hack as a way to see which users had visited those Github URLs?

Could that be the real aim here?

</comment><comment><USER39> That's why websites should stop including javascript from third party sources. For my analytics, I use liveinternet.ru because it runs the javascript locally on my website but passes the browser information via an image embed. Liveinternet has no ability to execute malicious code and yet I can still use them as a fully functioning analytics.

<comment><USER27> How much more difficult is using liveinternet.ru, out of curiosity? Google analytics got popular because all you had to do was paste a single line to the bottom of your site and google would handle the rest.

<comment><USER39> It's just as easy, it's a small snippet of code you paste at the bottom of your site. However, the site doesn't have a pretty design like Google but that's why I prefer it - it's simple and works with NoScript.

</comment></comment></comment><comment><USER40> Is the best way to currently prevent this is via full ssl?

Additionally, how can a site like Amazon.com run non-ssl protected pages and prevent mitm-ing? (e.g. [http://www.amazon.com/dp/B00TYBBNAW/](http://www.amazon.com/dp/B00TYBBNAW/) doesn't redirect to https, but only when ordering, etc.)

</comment><comment><USER41> Chinese govt is telling the world with this attack that: (1) GFW can interfere with incoming traffic. (2) GFW can f __* with people all around the world. (3) You can 't block a Chinese cyber attack simply by cutting off Chinese users. (4) The Chinese govt is a d __*head.

<comment><USER42> Well, no.

The Chinese government is telling the world with this attack that, if you choose to interfere with Chinese sovereignty by means of the Internet, or to enable those who would do that, then there's a cost.

Note the way the attack is targeted. It's not just an indiscriminate DDoS of Github, although that's been the effect — instead, they're aiming specifically at two repos whose content, being designed and built with the aim of circumventing the technical means by which are implemented a significant goal of China's domestic policy, enables no more or less than a direct attack on the sovereignty of the Chinese government.

To use that content is to say: "You may not run your country in the fashion you choose, because it does not suit me that you should do so."

To host that content is to say: "In this matter, we take the side of those attacking the sovereignty of the Chinese government, by making it easy for them to share and improve the tools with which they do so."

What you're seeing, then, is the quite reasonable response of the Chinese government to these statements. Yes, it's annoying for those of us who use Github, and no doubt it's much worse than merely annoying for those who administer Github. _That is the point._ Github is being encouraged to consider how much it's worth to them to maintain the stance they've implicitly taken in this matter. I'm looking forward to seeing how they respond.

<comment><USER41> Wow. That was just a jokey comment about how angry I was about the Chinese govt.

As one of the billion people who live inside the Intranet "protected" by the GFW, I guess I can say I'm quite aware about how and why this happened. Let's start from the beginning.

For those who host things Chinese govt doesn't like, it usually just block the website altogether (Twitter, FB, and recently Google). But it had tried to block Github, twice. Each time there is a _huge_ response from the Chinese webizens (mainly programmers) calling to unblock it.

Another way to block certain content from a website is to filter by keyword (like Wikipedia). But GH is encrypted so that's a no. The govt even tried to use some fake SSL certificates to MITM it. So some "smart" guys exploited this feature and created the repo greatfire/wiki and things like this.

Then some evil guys from GFW thought of this way, directing the attack at these user accounts, to warn GH to remove these accounts.

What I don't agree with you is the word "reasonable" (and the "no"). First, it's _never_ "reasonable" to DDoS attack a website. Second, if you can't block the content, you have a choice to block the website and take the bitter from every single webizen against you. Finally, I believe it's the website owner's choice to choose who / what they want to use their website. Since GH is a U.S. company (I guess), it doesn't _have_ to listen to a sh*t from the Chinese govt.

<comment><USER43> I totally agree with you - the Chinese government has some right to protect their sovereignty, but if github or the American way of life is so offensive, then block the website and tools outright. I live here too, and it's kind of offensive when (speaking generally now) Chinese people want cherry-picked access to Western technology, science, design, creativity etc. but then aggressively reject the culture that produced them.

</comment></comment></comment></comment><comment> iso8859-1 Why did GitHub not just put a Bitcoin miner or a BOINC client instead of the alert? The Chinese is not going to care about the warning anyway, it would be more educational to peg their CPU to 100% usage and make some spare change while you're at it.

<comment><USER44> This DDoS is mainly punishing people who are using VPN to skirt The Great Firewall (and people who use GitHub). What is the point of 'punishing' people who aren't doing this on purpose?

</comment></comment><comment><USER45> That's a fairly neat attack, to be fair to them. I don't see why Github, upon receiving these requests, wouldn't just do the same back to China and absolutely hammer some of their resources in return?

<comment><USER46> Github generates no where near the amount of traffic that Baidu does.

<comment><USER47> While Github is receiving a fair percentage of Baidu's traffic, though...

<comment><USER45> >While Github is receiving a fair percentage of Baidu's traffic, though...

Yeah that's my thinking on it. They're being handed traffic, or more correctly having it thrown at them maliciously, which they could in turn redirect back at some point in the Chinese infrastructure.

<comment><USER48> Who do they reflect the attack to though? Baidu? They might not even know this is happening (well they probably do now, but not sure what they can do). The GFW infrastructure itself certainly isn't publicly addressable.

</comment></comment></comment></comment></comment><comment><USER49> They could just mirror all the git repos minus what they find objectionable. github isn't immune to pressure. They would probably like to sell a lot of github enterprise and whatnot in China.

</comment><comment><USER50> Its not lab grade testing, but there is the old standby [https://dancesafe.org/](https://dancesafe.org/)

</comment><comment><USER51> I'm bored of Chinese hackers attacking Western companies... Let's mix it up a bit and hear about some Western hackers attacking Chinese organizations.

<comment><USER52> Well there is plenty to read about western governments hacking chinese organizations. Google edward snowden china for starters :)

</comment></comment><comment><USER53> >" _Requests to Baidu's content data network are being intercepted and sending back some javascript code instead of the original requested file. The javascript code instructs visitors browsers to request the Github pages of anti-censorship group Greatfire andthe Chinese language edition of the New York Times._ "

I must be misunderstanding - is there a salient piece of info missing?

It makes no sense for the Chinese government to attempt to foil censor bypassing by sending all users of Baidu a link to a project on GitHub that enable censor bypassing.

As an outcome is to inform all affected Baidu users of bypass tools and a non- government controlled newspaper this looks more likely to be a rogue element to me.

It doesn't even look like what I'd call DDoS - sending genuine users to your site who might be interested in your product, isn't that an unpaid affiliate scheme?!?

<comment><USER54> This was worded misleadingly. This is indeed a DDoS: code has been injected to load the Github pages in the background using XHR without the user's knowledge. The host page itself is not redirected (or visibly affected in any way[1]).

Furthermore, only people _outside_ of China are affected by this -- Chinese citizens don't have this code injected.

[1]: Actually there is a mistake in the injected code that causes the result of the XHR request to be interpreted as JavaScript, and then executed. Hence GitHub has tried to mitigate the attack by replying 'alert("WARNING: malicious javascript detected on this domain")' to notify the user that this is happening.

<comment><USER2> > Actually there is a mistake in the injected code that causes the result of > the XHR request to be interpreted as JavaScript, and then executed

That's not a mistake. GitHub, like 99.99% of the Internet, doesn't allow cross-origin XHR for their pages (that's a security vulnerability). So they have to use _< script>_ which doesn't follow the Same Origin Policy.

Though that's a bit silly, given they could've also used _< img>_ which wouldn't be vulnerable to XSS.

<comment><USER54> Ah, that clears things up. Thanks for the info.</comment></comment></comment></comment>


God in the machine: my strange journey into transhumanism - <AUTHOR> https://www.theguardian.com/technology/2017/apr/18/god-in-the-machine-my-strange-journey-into-transhumanism <comment><USER2> _In the late 19th century, a Russian Orthodox ascetic named Nikolai Fedorov was inspired by Darwinism to argue that humans could direct their own evolution to bring about the resurrection. Up to this point, natural selection had been a random phenomenon, but now, thanks to technology, humans could intervene in this process. Calling on biblical prophecies, he wrote: "This day will be divine, awesome, but not miraculous, for resurrection will be a task not of miracle but of knowledge and common labour."

This theory was carried into the 20th century by Pierre Teilhard de Chardin, a French Jesuit priest and palaeontologist who, like Fedorov, believed that evolution would lead to the Kingdom of God. In 1949, Teilhard proposed that in the future all machines would be linked to a vast global network that would allow human minds to merge. Over time, this unification of consciousness would lead to an intelligence explosion – the "Omega Point" – enabling humanity to "break through the material framework of Time and Space" and merge seamlessly with the divine. The Omega Point is an obvious precursor to Kurzweil's Singularity, but in Teilhard's mind, it was how the biblical resurrection would take place. Christ was guiding evolution toward a state of glorification so that humanity could finally merge with God in eternal perfection.

Transhumanists have acknowledged Teilhard and Fedorov as forerunners of their movement, but the religious context of their ideas is rarely mentioned. Most histories of the movement attribute the first use of the term transhumanism to Julian Huxley, the British eugenicist and close friend of Teilhard's who, in the 1950s, expanded on many of the priest's ideas in his own writings – with one key exception. Huxley, a secular humanist, believed that Teilhard's visions need not be grounded in any larger religious narrative._

It's been a while since I read _Singularity_ , but does Kurzweil mention Teilhard or Huxley?</comment>


Pirate Bay Founder Arrest Followed By $59m Swedish Aid Package For Cambodia - <AUTHOR> http://torrentfreak.com/pirate-bay-founder-arrest-followed-by-59m-swedish-aid-package-for-cambodia-120905/ <comment><USER2> Am I the only one tired over how TorrentFreak will say anything, related or not, to try to confirm their bias? This aid was decided on for over 5 months ago, in march 2012 (<http://www.sweden.gov.se/sb/d/574/a/94013>), and it is obviously not the result of Sweden trying to get at Svartholm. But if you want to be believe it then please do...

<comment><USER3> I didn't know Sweeden gave money to Cambodia and I am glad that TorrentFreak informed me of this. Foreign aid from rich to poor countries is used in general to keep diplomatic cooperation flowing smoothly in matters of interest to the giver country.

<comment><USER4> It's "Sweden," not "Sweeden." I see a lot of people making that mistake on HN[1].

[1] [http://www.google.com/search?q=site:news.ycombinator.com+swe...](http://www.google.com/search?q=site:news.ycombinator.com+sweeden)

<comment><USER5> Looks like HN strips out the quotes needed to make this query work. Here: <http://goo.gl/zMUQY>

</comment></comment></comment></comment><comment><USER6> An aid package of 60 million dollars would be _three times_ the amount they spent yearly on Cambodia in the last decade (with little variance). See [1].

[1]: <http://www.openaid.se/en/countries/kambodja?year=2012>

<comment><USER7> Except the 60 million dollars are for two years, as described in the article linked from Torrentfreak.

[http://news.xinhuanet.com/english/world/2012-09/05/c_1318292...](http://news.xinhuanet.com/english/world/2012-09/05/c_131829212.htm)

<comment><USER8> So "only" 150% of the average yearly state expenses instead of 300%. Was there a point you were trying to make or you're just being pedantic?

<comment><USER9> I think the point he's trying to _imply_ (and you're trying to _ignore_ ) is that Sweden effectively paid Cambodia $20 million to arrest this person.

<comment><USER8> I'm not really following your math, the point is that _it's a shit-ton of money for Cambodia_ , whether we're talking about $60M or $30M per year.

</comment></comment></comment></comment></comment><comment><USER10> This is nonsense.

It is _easy_ to make up a conspiricy, and very hard to disprove it. Nevertheless...

Sweden's foreign aid policies are well respected internationally[1].

For TorrentFreak to try and imply that aid to Cambodia - one of the poorest countries in the world - was in any way linked to their coincidental arrest of a person with an international warrant out for his arrest is shameful.

If nothing else, the foreign aid was announced prior to his arrest[2] and is part of a long running aid program[3].

Not only is it entirely made up, but it puts an unnecessary taint of corruption on a program that saves lives. As anyone scanning thread can attest, the last thing a foreign aid program needs is any kind of association with corruption - especially one that is made up.

It is well known that shoddy journalists can use their pulpit to smear anything they want and there is little that the target can do (eg, questions like "Tell me when you stopped beating your wife"). That is what is going on here, and people who are falling for it should be ashamed of themselves.

[1] <http://www.thelocal.se/16158/20081205/>

[2] <http://www.sweden.gov.se/sb/d/574/a/94013>

[3] [http://www.swedenabroad.com/en-GB/Embassies/Phnom- Penh/Devel...](http://www.swedenabroad.com/en-GB/Embassies/Phnom- Penh/Development-Cooperation/Swedens-Development-Cooperation-with-Cambodia/)

<comment><USER11> Viewed through Bayesian lens, the problem with this article is pretty obvious. You could almost define "speculative" as "giving an observation for which the priors are unclear and only vaguely gestured at".

Here, we have the observation that Sweden gave $60 million foreign aid to Cambodia, but we are given no clear idea of the prior probability that Sweden would give this much and at this time (but we are given the _implication_ that the evidence is significant). We don't need a hard probability estimate (few of us are actually going to rigorously apply Bayes' rule), but we do need enough information to come to a basic idea of the probability on our own. What does Sweden usually give to Cambodia? When is this usually announced? If this is an unusual amount of money, are there other good explanations for this besides corruption?

The problem is that the data in the article leaves us to use a relatively uninformed prior. $60 million is not that much money for a nation with Sweden's economy. It seems fairly likely that some kind of diplomatic news mention would happen regarding Sweden and Cambodia within any given two week period (close enough to appear associated with any given event), and since Sweden and Cambodia are on friendly terms, that mention is likely to be positive. Supposing that this is an unusually large amount of aid, there are plenty of possible reasons that Cambodia, often plagued with both droughts and floods, might have been hit particularly hard in the last year and needed more, so even if this is an unusual amount of aid. This all puts the prior for the observation pretty high, which cuts its evidential weight down very very low. As you illustrated, that prior gets _higher_ as we add information, further weakening the evidence.

</comment></comment><comment><USER12> Here's hoping that some real, investigative journalist (i.e. not someone from Torrentfreak) will start digging into these events. Currently it's just an unfounded insinuation.

<comment><USER11> It doesn't matter who does the investigation, so long as the evidence they find is reasonably easy to validate.

<comment><USER12> Agreed. It will however take original research, which costs time and money. I reckon that's a bit of an issue for most blog writers (and of course that applies for lots of people that write for traditional publications as well).

<comment><USER13> This would be a good time for an experienced enough investigating journalist to set up a Kickstarter project on it. I'd chip in at least..

<comment><USER12> Now that Peer has refuted the gossip[1], perhaps this topic can be considered settled.

It's an interesting idea though. Some subjects are interesting enough that it actually might work.

[1] <https://news.ycombinator.com/item?id=4480830>

<comment><USER14> I'm on no side, but what did he refute? That no strings were attached? That noone threatened to hold payments back?

</comment></comment></comment></comment></comment></comment><comment><USER15> This is not a story.

Sweden have in the past (since 1979) sent aid to Cambodia.

In 2011 we sent 168 million SEK and in 2012 and 2013 we will send 200 million (a total of 400 million for 2 years) and this was decided a long time ago.

Do you really think Sweden will pay 400 million to get one person back and have him serve ONE year in prison?

[http://www.swedenabroad.com/sv-SE/Ambassader/Phnom- Penh/Utve...](http://www.swedenabroad.com/sv-SE/Ambassader/Phnom- Penh/Utvecklingssamarbete/Sveriges-utvecklingssamarbete-med-Kambodja/)

<comment><USER14> For sure not. But if I'd pay 400M SEK and had a little wish, I'm sure I'd let the other side know about my wishes.

It's not my argument, but the interesting argument is not that Sweden paid 400M SEK to get a prisoner - that cause and effect are working this way. But it's interesting that he is arrested after quite some time in Cambodia and Sweden is paying 400M SEK aid.

</comment></comment><comment><USER16> It's honestly a shame that TF's propaganda has found a home here on HN.

<comment><USER17> That's an interesting use of the word "propaganda".

<comment><USER16> It's quite literally exactly what propaganda is, according to dictionaries, wikipedia, etc... it doesn't stop being propaganda just because you _like_ what they have to say, that just makes it _successful_ propaganda. Also in the literal sense.

<comment><USER17> It also carries a lot of unspoken subtext, commonly used by opponents of a position to denigrate the argument without ever responding to it. "Oh it's just propaganda, it can be ignored"

What exactly is misleading about TF's posting?

<comment><USER16> Propaganda doesn't have to be "misleading", it's pushing the same narrow viewpoint over and over again to further some agenda. The agenda's called "making money off ads".

This article's a great example since this money is only a small increase on the annual aid Sweden has been giving Cambodia _for years_ , as pointed out in comments.

Or in TorrentFreak speak, "Sweden bribing Cambodia for Pirate Bay arrest since 1979!".

<comment><USER17> _Propaganda doesn't have to be "misleading"_

It does according to the dictionary definitions I'm reading. Going by your definition, any viewpoint can be "propaganda" as long as it's repeated often enough for an agenda. Civil rights comes to mind, where the agenda is equality, but you don't hear anyone but far-right wingnuts calling the repeated insistence that discrimination is wrong propaganda.

It's a loaded term, best avoided.

 _The agenda's called "making money off people who want to believe they're the hero in this story for pirating X"_

And there's the denigration. That didn't take long.

 _This article's a great example since this money is only a small increase on the annual aid Sweden has been giving Cambodia for years_

50% is a small increase?!

<comment><USER16> From 189 million SEK in 2009 to 200 million in 2012. _Yawn_.

[http://www.swedenabroad.com/en-GB/Embassies/Phnom- Penh/Devel...](http://www.swedenabroad.com/en-GB/Embassies/Phnom- Penh/Development-Cooperation/Swedens-Development-Cooperation-with-Cambodia/)

<comment><USER18> That seems at odds with the numbers others here have quoted from openaid.se, but that site gives me nothing but 'Application Error' when I try to figure out the reason for the disagreement between the two sources and I can't seem to get a Google cache for that page.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Ah, so the folks who were inexplicably sure that it had nothing to do with his Pirate Bay association were completely wrong.

The good news, I guess, is that Swedish prison will likely be a less heinous experience.

<comment><USER20> > Ah, so the folks who were inexplicably sure that it had nothing to do with > his Pirate Bay association were completely wrong.

I know that was probably an emotional response and the phrase "correlation does not imply causation" ( [http://en.wikipedia.org/wiki/Correlation_does_not_imply_caus...](http://en.wikipedia.org/wiki/Correlation_does_not_imply_causation) ) gets thrown around here alot more than it should but that's a very strong statement to make.

Is it possible that it's true, yes. Is there evidence that makes it appear likely, not that I've seen. Maybe there will be more evidence coming up to help prove the swedes bribed the Cambodians to arrest him, but so far it looks like its way to soon to say this is definitely what happened.

<comment><USER19> Yes, plausible deniability is present... the Swedish may have a soft spot for Cambodia's challenges. A list of Swedish foreign aid amounts and recipients would be interesting to compare this $59M with.

<comment><USER20> as someone else pointed out. The $59M is over 2 years, and the foreign aid was decided on 6 months previous to this.

<http://news.ycombinator.com/item?id=4480754>

<comment><USER19> Ah. I wonder how long he's been in Cambodia...

</comment></comment></comment></comment></comment><comment><USER21> A more interesting question is, who is paying the Swedes, and how? They really don't have a dog in this fight, so whatever motivation they have, it hasn't been made public. Yet.

<comment><USER12> Uhm, we do pay taxes here you know :)

As for the motives... IF the arrest of Anakata was a paid job, what other reasons than keeping good relations with the U.S. do we (or rather, the Swedish state) need?

<comment><USER21> A fair statement, but I'm not sure that nebulous 'good relations' are enough to explain the amount of time and money the Swedish government is pouring into what would seem, at least from a Swedish perspective, to be petty crime at best. I suspect there are much more specific gains being had, maybe officially through some kind of US concessions or accommodations, or unofficially. Certainly the RIAA and MPAA can open (and close) lucrative doors to Swedish media, for example.

</comment></comment></comment><comment><USER22> It's sad the trolls seem to have gotten hold of this.

Torrent Freak has not even gone close to saying Sweden has bought him.

When countries give foreign aid, it is often, at least in part, for power plays.

Japan regularly does this in the pacific islands and uses their support to continue whaling. To argue the amount of money they give (quite large) is so they can continue whaling is also ridiculous. In fact most Japanese don't even eat whale or care about the issue. It's mostly political.

Sweden is owed a few favours and it seems they have called one in. The story here is why they have chosen this as one of them.

<comment><USER23> > The story here is why they have chosen this as one of them.

I suppose they would have preferred to obtain Assange, but he wasn't in Cambodia? ;-)

</comment></comment><comment><USER24> Maybe he will get bail and make it to the Ecuador embassy.

<comment><USER25> In this case, he's actually been convicted of a crime. (Though one significantly less serious than rape.)

<comment><USER26> I wonder which would actually net more jail time?

</comment></comment></comment><comment><USER27> Well at least he was not sold cheaply.

</comment><comment><USER28> Is there actually a scandal here? An extradition treaty would allow Sweden to remove criminals from Cambodia. Just because there is no treaty, that doesn't mean that Cambodia can't hand criminals over, does it?

</comment><comment><USER23> It would have been nice if TorrentFreak would've quoted a few of the references made in the discussion here, namely:

1) how much of an increase this is compared to the regular yearly foreign aid of Sweden to Cambodia (I understand it's 150%, so "just" 20M extra, and that the yearly foreign aid to Cambodia has very little variance.

2) when this increase was decided upon.

3) since when Svartholm was wanted, and known/expected to flee to Cambodia.

Those answers still don't quite rule out the two events are connected, but it would definitely make TorrentFreak's article quite a lot more balanced. Besides, it's easy enough to expose the big entertainment lobbies and their copyright watchdogs without making things up.

It also shows that HN is better at doing proper journalistic research ;-)

</comment><comment><USER29> It seems these guys running shady businesses on internet have never heard about Brazil.

[http://en.wikipedia.org/wiki/Great_Train_Robbery_%281963%29#...](http://en.wikipedia.org/wiki/Great_Train_Robbery_%281963%29#Ronnie_Biggs)

<http://en.wikipedia.org/wiki/Cesare_Battisti_%28born_1954%29>

</comment><comment><USER30> I'm surprised people assume the arrest has anything to do with TPB at all. It's anakata we're talking about.

</comment><comment><USER31> Since this is such a serious claim, it would be good with an original source. This site (torrentfreak) is not unbiased.

</comment><comment><USER32> I knew this had to be about "foreign aid" somehow.

</comment><comment><USER33> Don't aid in the transportation/distribution of stolen goods and you won't be arrested for it!!!</comment>


A new marketing medium and receipt for the transaction - <AUTHOR>

Hey all,
We built some technology that gives businesses the ability to reach unreachable existing customers through ads/coupons (without the need for their permission, or email, phone or address) and a detailed receipt through the online bank or credit card account.
In essence, imagine a consumer buying something (online or off), go to their online account (debit or credit card), and be able to get a non-invasive coupon and the receipt of the transaction without ever giving their email address or having to opt-in for marketing.
Check demo gif for how it works. https://rct.co/img/demo.gif
We think it's a new advertising channel that didn't exist before, helping merchants get to unreachable customers in a new way.
It's also a way for customers to get a receipt of the transaction that is connected to the transaction itself, and not a paper or email of it which is lost or misplaced, while giving customers a coupon to buy from the business again (through an ad or coupon).
What's your take/feedback? Email me at email@example.com if you want the receipt capability for your company (free) or want a way to put an ad/coupon in every credit/debit card sale (this is paid:-)
Thanks. <comment><USER2> This would make more sense for offline sales, where you are more likely to get customers paying, but not collect contact information like email address. Online it's pretty standard to get an email address to send a receipt (if customers aren't already logged in).

The next question is how many people look through their credit card statements and click on links. I know I don't...I use Mint and look mainly at the breakdown by category more than the individual transactions.

<comment><AUTHOR> Thanks for the feedback byoung2. We are leaning in the same direction you note. Is your suggestion coming from having experience in online or offline sales?

<comment><USER2> I work at a startup where we help local businesses reply to reviews, update their info, and run promotions. One technique we use is requiring email to redeem a coupon, so the business can grow an email list.</comment></comment></comment>


I Only Have 7 Trips Left. On Managing Work / Life Balance, Love and Family - <AUTHOR> https://bothsidesofthetable.com/i-only-have-7-trips-left-on-managing-work-life-balance-love-family-1c48737a3471 <comment><USER2> Sure must be nice to have enough money in the bank to run off on a "great trip" with your family twice a year to some far-flung place. One wonders if the employees at the sold companies and the founders at in the portfolio have the same luxury.</comment>


For the freelancers out there: Pricing a Project - <AUTHOR> http://www.blueflavor.com/blog/tips_tricks/pricing_a_project.php <comment><USER2> How to price a project. Hmmmm. As a project strategist-manager, recommend the books Software Estimation: Demystifying the Black Art (2006) and Software Project Survival Guide (1998). Used the SPSG templates as the basis of my pricing process. SPSG book is one of the few books that still sits in my bookshelf</comment>


SC rejects challenge to Trai's power to cap cost of TV channels - <AUTHOR> https://timesofindia.indiatimes.com/india/sc-rejects-challenge-to-trais-power-to-cap-cost-of-tv-channels-bouquets/articleshow/66438193.cms <comment><AUTHOR> India's Telecom regulator had mandated the following:

1\. Each TV channel in a bouquet of channels will have a fixed & uniform, maximum, retail price. 2\. Any channel that was priced above the fixed price could not be included in a bouquet and could only be offered on an individual/a la carte/standalone basis. 3\. Pay channels and free to air channels, as also HD and standard channels, could not be in the same bouquet.

The satellite TV/cable broadcasters went all the way up to the Supreme Court but have lost the war!</comment>


Daily Code Drills - <AUTHOR> http://drills.learncodethehardway.org/

<comment><USER2> So I had a go. It's interesting, it seems like it could be useful but it's not really going "Here's some Ruby stuff that's useful on a daily basis" and it's more copy this line as well as you can in 10 minutes. It might help with muscle memory learning, but I didn't feel it helped get my brain anymore Ruby geared. YMMV.

<comment><USER3> I had a similar experience with actual push-ups: I did a few one day, didn't feel like it helped, and dismissed the whole idea.

<comment><USER2> Ah notice how I'm carefully saying I didn't think it helped _my_ learning, not that it was useless. Some people probably wouldn't find pushups as useful in their exercise routines as others ;)

</comment></comment></comment><comment><USER4> I get a blank page here: <http://drills.learncodethehardway.org/python/> in Safari 5.1.5 on OS X 10.7.3</comment>


Mapping CraigsList Housing Ads - <AUTHOR> http://www.trailbehind.com/housing_map

<comment><USER2> I hate to be a wet blanket, but didn't <http://www.housingmaps.com/> do that like years ago?

<comment><AUTHOR> Read my blog post above. I acknowledge them and talk about the improvements we made.

For example, HousingMaps.com maps a couple dozen cities, and we map all 326 US cities.

<comment><USER3> I thought I read somewhere that housingmaps had a special agreement with craigslist... But I hope you stick around because the lack of cities on hm is really annoying.

Craigslist really needs an API... and global search. PLEASE.

</comment></comment></comment><comment><USER4> First, cool. Next, can you share your crawler code?

Lastly, this violates craiglist's usage policy right? Did you research the implications and what did you find?

<comment><USER5> This does violate craigslist's usage policy.

 _craigslist permits you to display on your website, or create a hyperlink on your website to, individual postings on the Service so long as such use is for noncommercial and/or news reporting purposes only (e.g., for use in personal web blogs or personal online media). If the total number of such postings displayed or linked to on your website exceeds one hundred (100) postings, your use will be presumed to be in violation of the TOU, absent express permission granted by craigslist to do so._

</comment></comment><comment><AUTHOR> For those interested in the project, I also wrote up a short blog post about it at: <http://www.trailbehind.com/trips/view_report/115>

Any feedback or bug reports you have are much appreciated.

</comment><comment><USER6> Good job, I'll be looking for a place soon! I have a few question/comments:

\- Open links in a new window. \- Have a date picker or a dropdown with 1 day ago, 2 days ago, etc. \- Where are the nearby photos near? \- Show photos button, why is it different than the checkbox for dogs/cats? Its kind of confusing. \- Change it so when you click from list of adds, the map moves to the ad's location on the map. \- When you click on an ad on the map you place a pin on the map. What can you do with this? I'd rather see pics/summary information and then I would decide whether I want to save this ad.

<comment><AUTHOR> All good suggestions

1\. I implemented open in new window 5 minutes ago

2\. I'll add my calendar widget to replace the data selector

3\. I'll overlay the polygon of the photo search area.

4\. Good idea for images for cats/dogs.

5\. I had it set up to pan to the point originally, but now I just open a new window, so I'm not sure that's useful anymore.

</comment></comment><comment><USER7> This is good stuff.I like how the list of ads changes as I pan around the map. What else does Trailbehind do?

</comment><comment><USER8> Suggestion: Open ads up in a new window, when I click back after viewing an ad I have to re-select city, etc.

<comment><AUTHOR> Thanks for the suggestion! I implemented it :)

</comment></comment><comment><USER9> It seems like your site is not showing the majority of the adds. If I look at my neighborhood (El Cerrito, CA) there are hundreds of listings in the last week on craigslist but setting the cutoff date to 2/20 on your site only displays 3 or 4 results in the same area.

<comment><AUTHOR> Sorry, in the future we'll have ads going back further, but we didn't start crawling CraigsList until the 20th.

Each day the bot runs is another day we have stored.

<comment><USER9> I think you're missing what I'm saying. If you look at San Francisco/East Bay/Albany:El Cerrito on craigslist there are 30 listings for 2/27. If I look in that area on your map I see only 2 listings.

<comment><USER10> Same here for my neighborhood. For me, this warrants not using the product at all... why use something that has an incomplete dataset? I could be missing out on that perfect listing!

Another thing is that some postings don't contain sufficient information for a machine to know its location... such as "near the Xyz subway station" or other atypical types of addresses that the project's parser might miss.

It's a cool mash-up, but I'll pass.

<comment><AUTHOR> Ok, I see your point.

For some ads, there is no geo-data. To fix that for the next release, we'll list ALL ads, not just the mappable ones, in the Ad Widget. And we'll indicate in the table if the ad is on the map.

One good side effect though is the ads on the map tend to be less spammy than the non-mapped ads. I assume this is because the spam ads often embed their spam in HTML and don't use CraigsList's structure well. A good landlord is going to make sure their ad links to a Google Map on CraigsList, which also means we will index them.

</comment></comment></comment></comment></comment><comment><USER10> Not allowing me to enter my location, and instead having me zoom/wait-to-load several times makes me wish that closing the tab somehow inflicted pain on the software.

</comment><comment><USER11> how come half the kansas and half of nevada is missing?

<comment><USER12> Nobody lives there? There probably isnt a craigslist to cover those areas.</comment></comment>


Google+ Introduces Automatic Face Recognition To Photo Tagging - <AUTHOR> http://techcrunch.com/2011/12/08/google-introduces-automatic-face-recognition-to-photo-tagging-but-its-completely-opt-in/

<comment><USER2> I was thinking about this just today: I assume that the only reason we are better at uniquely identifying humans by their faces than at identifying other animals is that we either learn to do it or are so hard-wired by evolution: not because individual humans are more distinguishable than individuals of other species.

So if that's true ... Google could just as easily introduce automatic face recognition for photos of your cats. Or your goat, or whatever. I see a whole new market here!

</comment><comment><USER3> Maybe I'm misremembering, but I thought this was default when G+ initially launched? I seemed to recall tagging photos and it "suggested" people (usually correctly) for the tags I was making.

I admit I don't recall exactly, however; I was never one to tag photos.

<comment><USER4> It provides suggested geometry for tags, but not actual names for the tags.

</comment></comment><comment><USER5> This has been a feature in Picasa since 2008 - [http://techcrunch.com/2008/09/02/picasa-refresh-brings- facia...](http://techcrunch.com/2008/09/02/picasa-refresh-brings-facial- recognition/)

</comment><comment><USER6> Didn't Facebook get in trouble in Europe for this?

<comment><USER7> Google has (wisely) made this feature opt-in, rather than opt-out, so I suspect that should solve most of these types of concerns.

<comment><USER8> Never used photo tagging in G+ or FB, opt-in for who btw? For the one being tagged or the user who uploaded the photo?

<comment><USER9> The subjects of photos can choose to find and tag themselves in photos visible to them.</comment></comment></comment></comment>


Ask HN: Web Scraping with Node.js - <AUTHOR> Anyone out there have a cachet of good Node web scraping libs, and/or other resources? Opinions?<p>I have the intuition that my Google searches are a bit inadequate. Thank you! <comment><USER2> Check out [https://github.com/cheeriojs/cheerio](https://github.com/cheeriojs/cheerio)

</comment><comment><USER3> I found [https://github.com/cgiffard/node- simplecrawler](https://github.com/cgiffard/node-simplecrawler) to be good, I used it for [https://github.com/tmpfs/linkdown](https://github.com/tmpfs/linkdown) \- a cli for validating web pages etc.

</comment><comment><USER4> I haven't used this for web scraping, but have you tried out [http://phantomjs.org/](http://phantomjs.org/). It's a great tool that lets your process webpages; I don't think it would be that difficult to set it up to scrape sites.

</comment><comment><USER5> Here is a place to start: [https://github.com/lorien/awesome-web- scraping/blob/master/j...](https://github.com/lorien/awesome-web- scraping/blob/master/javascript.md)

You might want to check out the Nightmare project ([https://github.com/segmentio/nightmare](https://github.com/segmentio/nightmare)) which makes automating an Electron instance pretty simple.

</comment><comment><USER6> Should it be necessarily with Node.js? I've tried to find a good toolset in JS, but it seems other languages (e.g. Python and Java) are a lot more mature in scraping.

</comment><comment><USER7> Try this out [https://github.com/IonicaBizau/scrape- it](https://github.com/IonicaBizau/scrape-it)</comment>


Even More Brainfuck Optimisations - <AUTHOR> http://www.wilfred.me.uk/blog/2015/10/18/even-more-bf-optimisations/ <comment><USER2> I read "Even More BoyFriend Optimisations". a little disappointed ;-)

<comment><USER3> Ok, we s/BF/Brainfuck/'d the title. No need for bowdlerisms.</comment></comment>


Color Scheme: Decode the Encrypted Message (puzzle) - <AUTHOR> http://www.wired.com/gaming/virtualworlds/magazine/17-05/puzzle9

<comment><AUTHOR> What the heck. I had nothing better to do today.</comment>


EmacsConf in London on March 30 - <AUTHOR> http://emacsconf.org/

<comment><USER2> I've been super excited about Steve Yegge's Grok ever since I first read about it. I hope it's getting closer to some kind of (open source) release.

<http://bsumm.net/2012/08/11/steve-yegge-and-grok.html></comment>


Guide to Rustc Development - <AUTHOR> https://rustc-dev-guide.rust-lang.org/ <comment><USER2> One thing I really like about the Rust compiler is that it gives a lot of helpful hints to compiler errors.

I'm currently trying to learn the language, and I don't feel like I'm "Fighting the borrow checker" as many people used to complain. I suspect it's because the compiler developers really thought through how to give useful and helpful error messages. The messages really guide me into managing my memory correctly!

</comment><comment><USER3> rustc was the first (and currently only) compiler I ever contributed to. I think many people in the Rust community are that way. IMO the way they introduce new people to compiler development is top notch. Yes, some algorithms are extremely complicated, like how match statements are translated, but for most changes, you don't need to touch these areas. A lot of compiler engineering is "just" straightforward implementations of papers (like rustc's float parsing bases on a paper), or even simpler, shoveling data from one place to another, and doing that in a multi hundred kloc codebase. It's not trivial, but certainly not magic either.

For the future I hope that some of the custom things that the compiler requires (x.py build system, nightly RUSTC_BOOTSTRAP hack, etc) will be reduced to the needed minimum to make it easier for people from the wider rust community to jump into development, but they have already adjusted many things to rust customs, like introducing Cargo.toml, linking between compiler crates through Cargo.toml instead of just doing extern crate, gradually replacing rustc_serialize with more standard things, etc.

</comment><comment><AUTHOR> Here's the github link [https://github.com/rust-lang/rustc-dev- guide](https://github.com/rust-lang/rustc-dev-guide)

</comment><comment><USER4> Is it just me or is the monospace text formatting really difficult to read: dark fg over a dark bg with a dark backing color to the whole page.

<comment><USER5> It has a theme picker at the top. You're probably operating in dark mode, so the theme picker is matching with its dark theme. Use one of the lighter themes for better readability.

<comment><USER4> I was not aware that was possible with browsers and I'm more than a little disturbed. This kind of thing makes users easier to fingerprint.

<comment><USER6> It's just CSS with a little JS. Define your colours in some css variables, use the variables in your styling, then update the variables based on which selection was chosen.

Duckduckgo has themes and they're pretty privacy oriented. I don't think it will contribute to fingerprinting. The media prefers-color-scheme browser setting might contribute to that though, which let's you have different theme defaults depending on browser preference</comment></comment></comment></comment>


Jashkenas and Brendan Eich talking about the future of Javascript at JSConf '11 - <AUTHOR> http://blip.tv/jsconf/jsconf2011-jeremy-ashkenas-5258082

<comment><USER2> As a quick note, some of the things that Brendan mentioned in the talk didn't end up making it in to Harmony. Here's a link to the meeting minutes:

[https://mail.mozilla.org/pipermail/es- discuss/2011-May/01474...](https://mail.mozilla.org/pipermail/es- discuss/2011-May/014748.html)

Notably, arrow functions and paren-free blocks of code didn't make it in ... classes and comprehensions did.

<comment><AUTHOR> Hey Jeremy, i know that there's been a lot of discussion on the es-discussion list that decided how that all shaped up, but i can barely keep up with the flood of mail that comes through. How do you manage it? Do you actually keep up with all the messages that come through?

<comment><USER2> Shamefully, I don't subscribe to es-discuss. I just visit the archive pages every once in a while, and read the threads that look interesting.

<comment><AUTHOR> Hah, i'd actually just unsubscribed from es-discuss earlier this week. I couldn't handle the deluge. I'll consider doing something similar.

</comment></comment></comment></comment><comment><USER3> Man, I'm sure I've watched Python conference videos at offline, downloaded from some button or link in the blip.tv web-page, but I sure can't find it now.

If you want to download the video without waiting for network buffering, or on a device without an Internet connection (or without a Flash plugin), the RSS feed has links to downloadable MPEG4 files:

<http://blip.tv/jsconf/rss>

</comment><comment><USER4> Very inspiring stuff from Jeremy Ashkenas. Also, he's made talking-with-ones- hands into an art.

</comment><comment><USER5> This just in: jashkenas is a great speaker too.

</comment><comment><USER6> I'm not a huge fan of CoffeeScript in general, but one big plus in its favour would be the ability to write one set of CoffeeScript that compiles to JavaScript AND ES.next. That way you could serve the regular JS to older browsers, and the newer JS to browsers that support it.

<comment><USER7> It's an interesting idea, but how much of a benefit would there really be to serving ES.next code to people with modern browsers? I'd love to see benchmarks / realistic code size comparisons.</comment></comment>


Corkboard.me introduces embedding and read-only corks. - <AUTHOR> http://blog.corkboard.me/2011/03/21/more-sharing-options-come-to-corkboard-me/

<comment><USER2> The ability to embed this into your own site is a big effin deal.

<comment><AUTHOR> Agreed. Kind of boss.</comment></comment>


Former Blackwater Guards Convicted in Iraq Shooting - <AUTHOR> http://www.nytimes.com/2014/10/23/us/blackwater-verdict.html?hp&action=click&pgtype=Homepage&version=HpSum&module=first-column-region&region=top-news&WT.nav=top-news&_r=0 <comment><USER2> These guys pulled the trigger, but how this unhindered and highly profitably mercenary force wound up in Iraq is the bigger crime.</comment>


Bump Technologies (YC S09) Confirms Sequoia Funding, Reveals Roster Of Angels - <AUTHOR> http://www.techcrunch.com/2009/10/26/bump-technologies-confirms-sequoia-funding-reveals-roster-of-angels/

<comment><USER2> I didn't get it at first (the bump seemed arbitrary), but the first answer on the FAQ made me realize bump is pretty cool (they definitely need to highlight that this isn't just wireless with an arbitrary motion sensor to start the transfer):

 _Q: How does BumpTM work?_

A: There are two parts to BumpTM: the app running on your device and a smart matching algorithm running on our servers in the cloud. The app on your phone uses the phone's sensors to literally "feel" the bump, and it sends that info up to the cloud. The matching algorithm listens to the bumps from phones around the world and pairs up phones that felt the same bump. Then we just route the contact information between the two phones in each pair.

<comment><USER3> _they definitely need to highlight that this isn't just wireless with an arbitrary motion sensor to start the transfer_

why? end users don't care how it works as long as its effortless.

<comment><USER2> That's a good point. However, I wonder if users might start feeling as if the bump is pointless and they just want to transfer the data right away, but get frustrated that they have to bump the phones and they aren't sure why.

<comment><USER4> Look at how bluetooth connectivity is handled and then tell me that the bump isn't an improvement.

It's a logical action for the result.

I do think it's funny that it requires a net connection and geo-data, though. Very clever on their part to become middleman and privy to all this data. Where's the version that runs over wifi or bluetooth?

<comment><USER5> we have been amazed how much people love the bump interaction. lots of people bump just to see it work and then don't transfer anything.

most mobile wlan chipsets (including the iphone's) don't support adhoc (so would need router) and bluetooth sucks, it is inconsistent and unreliable (even between identical phones).

</comment></comment></comment></comment></comment><comment><USER6> Is it just me, or wasn't this sort of quick point and shoot data transfer extremely common back in the days of PalmOS, thanks to IrDA?

</comment><comment><USER7> Does LinkedIn have a mobile application yet?

<comment><USER8> it has a decent iPhone app

</comment></comment><comment><USER9> Awesome, congrats to Bump!</comment>


Ethereum is not a security? - <AUTHOR> https://prestonbyrne.com/2018/06/14/ether-is-not-a-security/ <comment><USER2> One of the issues with this semi-official statement has been that everyone in the media is reporting it as SEC's official position. Example [1]

Even though the print on SEC.gov[2] clearly states:

 _This speech expresses the author's views and does not necessarily reflect those of the Commission, the Commissioners or other members of the staff._

And hence, the absurdity follows.

On the question of the word - decentralization. Time and again it has been proven that major blockchain's hashing/voting powers are in hands of select few. Example ghash.io has crossed more than 51% hashing on bitcoin network couple of times. So, it is going to be interesting on what exactly is decentralization and how many people does it take before a blockchain is truly decentralized.

[1]: [https://finance.yahoo.com/news/sec-announces-ether-not- secur...](https://finance.yahoo.com/news/sec-announces-ether-not- security-162658147.html)

[2]: [https://www.sec.gov/news/speech/speech- hinman-061418](https://www.sec.gov/news/speech/speech-hinman-061418)

<comment><USER3> >Time and again it has been proven that major blockchain's hashing/voting powers are in hands of select few.

Incorrect, miners produce blocks that follow users' consensus rules. Users _do not_ follow miners' blocks. No amount of bitcoin hashing can get bcash users to run bitcoin and vice versa.

<comment><USER2> Pray tell - who are these users and how are they different from miners? And how do these users vote?

<comment><USER3> >how do these users vote?

Simple, by running which ever client that has the consensus rule set they want.

>how are they different from miners?

Miners use hashing power to produce blocks that meet users' consensus rules. Users verify these blocks meet their own consensus rules.

e.g. HashingCo uses their miners to produce a block with a blockreward of 12.5 bitcoin. In that block they include a transaction to their power supplier. The power supplier receives the block over the p2p network, checks if it is valid for their consensus rules, and then settles their bill. If HashingCo produces a block with a 100 bitcoin coinbase reward, sent that block to their power supplier, no amount of hashing will get their supplier to accept it as valid

</comment></comment></comment></comment><comment><USER3> The SEC spokesperson probably doesn't understand that Ethereum nodes are so centralized that no end users run them and it's even arduous for production environments to keep them up. Given that Ethereum miners can vote for themselves whether or not they increase the Ethereum blocksize, that reduces their competitors which centralizes nodes+miners even more.

You can make a case that, before Ethereum was built, it is was classifiable as a security under the Howey Test. You can also make the case that, after Ethereum was launched, that the ether _produce while mining_ are not securities. But what you cannot deny is that the Ethereum Foundations 70 _million_ ether that they premined(spun ether from straw) are definitely securities.

The number of people who don't understand that there's a centralized 'foundation' holding >~65% of ethereum and the ethereum devs are trying to shift their ecosystem to rewarding and voting on Ethereum blocks with ether is astounding.

<comment><USER4> BTC or BCH ?</comment></comment>


A California Type Foundry Is Keeping Vintage Printing Alive - <AUTHOR> https://www.atlasobscura.com/articles/m-h-type-foundry-san-francisco <comment><USER2> The center for the book ([https://sfcb.org](https://sfcb.org)) in San Francisco offers intro to letterpress classes, which I cannot recommend enough.

Being able to go from layout to printed paper so directly and viscerally is fantastic. If you've ever raged at InDesign or Microsoft Word, the physical embodiment of type, spacers, etc. feels like getting a glass of cold water in hell.

Of course it comes with its own tedium (can't Cmd + Z, can't just download new fonts, etc.), and I wouldn't advocate that anyone but specialty shops do a majority of their work on a letterpress; but having poured many frustrated hours into InDesign and its buggy features, it felt like a liberation to be able to control things physically.

To a degree, I feel like introduction to typography should be taught on a letterpress. You develop a much stronger feel for what's going on, and you physically grok what a baseline, em, en, etc. are. In my typography classes, students got confused by these notions because the definitions got muddied by the various software interpretation and implementations of it over the years (and the professor didn't do a great job at clearing it up either).

Having used the original thing first, the software implementations (and the liberties they took) became much easier to understand for me.

<comment><USER3> I used to hand-set type at my own letterpress company as a kid. What you say is true; there's nothing like being able to see and feel 3D letterforms when you're learning typography. Plus you have to learn to compose words upside down and backwards, which means you become an excellent speller with no need of spell checkers.

OTOH you might get lead poisoning. But I was probably in more danger from all the solvents we used back then.

<comment><USER4> You can get Bismuth and Aluminum type for some fonts. I've never used bismuth, but Aluminum was fine, it just lacked the heft.

Speaking of lead poisoning though, A pet peeve of mine is when people upcycle old california job cases in their homes. They look cool, but really should not be kept around in a home, especially one with kids. ([https://www.google.com/search?q=california+job+case](https://www.google.com/search?q=california+job+case))

<comment><USER3> They bug me because usually the type just gets thrown away and the case sold to hold knickknacks. But I hadn't thought about the lead dust they contain. Excellent point.

</comment></comment></comment></comment><comment> 52-6F-62 See also in Toronto: [https://chbooks.com/About-Us](https://chbooks.com/About- Us)

[https://en.wikipedia.org/wiki/Coach_House_Books](https://en.wikipedia.org/wiki/Coach_House_Books)

They have an open house once or twice a year where you have the chance to run a print with their old flywheel platen press and see a demonstration of Linotype typesetting. They'll also show you around their refurbished Heidelbergs.

Here's a photo of Stan with the Challenge Gordon press (used to share a drink [too many] with him at the old James Joyce pub on Bloor where he was a regular when I was at U of T):

[https://quillandquire.com/events/2015/08/28/happy-50th- coach...](https://quillandquire.com/events/2015/08/28/happy-50th-coach-house- books/)

The Wayzgoose is real soon, actually! And beer/wine/hotdogs:

[https://www.facebook.com/events/863612030704140/](https://www.facebook.com/events/863612030704140/)

(Funny enough they even had early inroads in the digital publishing space with: [https://en.wikipedia.org/wiki/SoftQuad_Software](https://en.wikipedia.org/wiki/SoftQuad_Software))</comment>


Ask HN: Best Markdown editor for OS X? - <AUTHOR>

I'm spending a fair amount of time drafting out reports and papers lately and Markdown is the simplest, cleanest way to write with as few distractions as possible. Any recommendations for Markdown editors on OS X?<p>I'm personally using Mou at the moment, but I'd prefer to use something open-source. <comment><USER3> Open Source:

MacDown [1] is a pretty decent MIT licensed editor. It's probably one of most well known open source Markdown editors for OS X.

Haroopad [2] is GPLv3 licensed and does pretty much everything that MacDown can. It is also cross platform (Windows, Linux, and OS X) which is an advantage to some.

Both offer the ability to change their look via themes and support various Markdown flavors.

Paid:

Byword [3] and iA Writer [4] are both very nice minimalist editors. They both have 'focus' modes which dim all the lines and/or paragraphs in the document except the one you are on to help you concentrate while writing, etc.

[1] [http://macdown.uranusjr.com/](http://macdown.uranusjr.com/)

[2] [http://pad.haroopress.com/](http://pad.haroopress.com/)

[3] [http://bywordapp.com/](http://bywordapp.com/)

[4] [https://ia.net/writer/ios/](https://ia.net/writer/ios/)

</comment><comment><USER4> MacDown. Stay away from Mou. Very sketchy author. He did an Indiegogo campaign after essentially abandoning the project and failing to sell it and hasn't updated in 6 months after taking $25,000 from backers[0][1][2][3] He also raised the price of the product because "There're too many pre-orders. We decide to raise price to reduce the sale."[4]

[0] [https://www.indiegogo.com/projects/mou-1-0-markdown- editor-o...](https://www.indiegogo.com/projects/mou-1-0-markdown-editor-on-os- x-for-you)

[1] [https://news.ycombinator.com/item?id=8404034](https://news.ycombinator.com/item?id=8404034)

[2] [http://weblog.masukomi.org/2014/10/09/why-i-wont-be- backing-...](http://weblog.masukomi.org/2014/10/09/why-i-wont-be-backing-mous- crowdfunding-campaign)

[3] [http://larryhynes.net/2014/09/mou-against-the- world.html](http://larryhynes.net/2014/09/mou-against-the-world.html)

[4] [https://twitter.com/25io/status/557039037995679744](https://twitter.com/25io/status/557039037995679744)

<comment><AUTHOR> Brilliant post, thanks for the information. I had no idea that Mou was so sketchy! As it turns out, I've stopped using Mou because some of the functionality is quite buggy (e.g. it appears that the "save" function executes in the control thread and uses a blocking save operation - <USER2> the application freezes for several seconds when saving).

On your advice, I've now switched to MacDown and I'm really very pleased with it indeed.

Thanks again!

</comment></comment><comment><USER5> MacDown [1] is quite good, and it's OSS too so the chances of a Mou-esque "this is abandoned. who wants to buy it. oh wait now its un-abandoned, please buy it." type affair is pretty remote.

LightPaper [2] takes a more "project" approach (i.e. with a directory navigation sidebar) and is still free but doesn't _appear_ to be OpenSource, so it's unknown what might happen if the author decides to abandon it. It does appear to have extensive support for (and a range of existing) plugins/extensions to add extra functionality, too.

[1] [http://macdown.uranusjr.com](http://macdown.uranusjr.com)

[2] [http://www.ashokgelal.com/lightpaper-for- mac/](http://www.ashokgelal.com/lightpaper-for-mac/)

</comment><comment><USER6> I just started using MacDown a few days ago. So far I am impressed. It has a very simple UI and it's side by side editor/renderer is very handy. It might replace Notes as the my notepad.

</comment><comment><USER7> Typora ([http://typora.io](http://typora.io)). with beautiful design and powerful functionalities

</comment><comment><USER8> Atom? I am using it everyday for markdown.

</comment><comment><USER9> I like Byword, but often end up using stackedit because I like the side by side rendering.

</comment><comment><USER10> Emacs?

vim?

</comment><comment><USER11> I'm a fan of MacDown</comment>


Shadow deletion of comments? - <AUTHOR> Is anyone here annoyed by the mods?  I've been on this site a long time, and in the past, mods who seemed insecure in their life retaliated by shadow banning people who disagreed or poked light fun at their comments.  Then this went away, and now it's clearly back.
We are here to read content, they are presenting us with content only they approve.  I have 2 accounts just for this - I have to use this one in time I'm replying to a mod, just in case.
Now, if these were professional people, with good taste, secure in their masculinity - I would love for them to filter content for me so I could see more quality discussion.  These guys now, however, seem like very insecure losers, using this site to make themselves feel better about their poor personal life.  For example, there are some shadow-deleted comments on this account, but some show.  A whole bunch of deleted ones simply give dry information contradicting the OP mod.  I can see the shadow deleted ones by running a 5-line ksh script, and there are plenty - but I can only see my deleted ones. I wonder how much quality content I'm missing - and I definitely don't want my information filtered by an insecure incel.
Things like this kill a site, and I'm almost at that point of just leaving.  If I wanted reddit, I'd go to reddit - at least they have a an actual interface not written by a high school student. <comment><USER2> You don't need an special script to see the dead coments. Just go to your profile [https://news.ycombinator.com/user?id=a11595](https://news.ycombinator.com/user?id=a11595) and enable "showdead" in both of your accounts. For example I see [https://news.ycombinator.com/item?id=18895559](https://news.ycombinator.com/item?id=18895559)

Personal attacks (like your whole third paragraph) against the moderator will make normal users flag this post until it is killed by the flags.

I actually like the HN interface. It works even when your internet collection is very bad. (The problem is that with a very bad connection you can continue using HN, but it's almost imposible to visit the links.)</comment>