The Trouble with CloudFlare - <AUTHOR> https://blog.torproject.org/blog/trouble-cloudflare <comment><USER4> Tor has acknowledged their "botnet problem" since at least 2013:

[https://research.torproject.org/techreports/botnet- tr-2013-1...](https://research.torproject.org/techreports/botnet- tr-2013-11-20.pdf)

That same paper walks through the challenges of dealing with it and doesn't find any satisfactory solutions.

As I wrote in our post on the topic, there's a trade off between security, anonymity, and convenience. CloudFlare provides security to our customers. We believe in the importance of anonymously accessing the Internet. Unfortunately, that means we have to sacrifice some convenience. If you haven't read it, I encourage you to see the post I wrote on the topic:

[https://blog.cloudflare.com/the-trouble-with- tor/](https://blog.cloudflare.com/the-trouble-with-tor/)

The two long-term solutions we proposed — blinded tokens or CloudFlare supporting .onion addresses — we believe could reduce the inconvenience, but they'll require help from the Tor developers. While public posts like this are discouraging in terms of coming up with a better solution, I'm encouraged by private conversations we've had with Tor developers who acknowledge this is a hard problem and want to find solutions.

<comment><USER5> The post from the Tor project does not state anywhere that Tor is not used by botnets or that it's used for malicious purposes. They specifically question your specific assertion that 94% of Tor traffic is malicious. I'm not surprised, it's quite a statement and it calls for some supporting evidence.

Surely you can see how, given the amount of outreach they do to educate regular people about the positive uses of Tor, putting forth unfounded statements like that might be perceived negatively.

I am glad that CloudFlare has put effort into this problem and as a Tor user I appreciate it (though obviously, this problem goes far beyond Tor, as mentioned in the article - your systems will have the exact same problems with large-scale IPv4 NAT, so really it's not optional for a CDN provider).

But please, stick to facts when presenting the case.

<comment><USER6> The calculation must be based on their internal data. How exactly are they supposed to show the supporting evidence without compromising their users privacy?

You seem to be engaged in goalpost shifting. CloudFlare have no incentive to make this figure up. They aren't going to give random people on the internet root access to their servers to recalculate the figure themselves. By claiming they aren't "sticking to the facts" all you do is show a closed mind.

Tor proxies tons of bad stuff. Everyone who has run a big web site knows this. Remember you only need one or two bad guys with fast enough tools to generate a flood of malicious traffic that completely overwhelms thousands of legit web browsing users. It's just so trivial for a minority of bad actors to end up dominating traffic profiles. So, I believe Cloudflare.

Tor guys love to talk about journalists, whistleblowers etc. That must be a really tiny amount of their overall traffic compared to people who just want to torrent, be assholes on forums etc. Just because they love to "educate" anyone who disagrees with them doesn't mean they're right.

<comment><USER5> If the calculation is based on data, they should show it. Since they did not, the Tor project made a best-effort guess as to how they could have come up with this (obviously ridiculous) number of 94% of traffic being malicious.

I have run a Tor exit node, so I have some intuitive idea of the amount of malicious traffic. CloudFlare are full of shit.

The rest of your comment is engaging in the exact same goalpost shifting you accuse me of, suggesting that because there are one or two bad guys it's really no big issue that they block thousands of legitimate users.

Also you completely ignored the most important point of my comment, which is that this problem is _not_ _restricted_ _to_ _tor_!

If you wish to further the conversation, please actually respond to my points. Thank you.

</comment></comment></comment></comment><comment><USER7> Maybe I'm a cranky, old-school network operator, but this is a very cut and dry problem. Tor runs a network that is rife with abuse and fraud. Tor needs to clean up and police its network. If it doesn't, it will be put on blacklists and customers will take active measures to block traffic from it.

This is no different than a network or AS that is spammer friendly, botnet friendly, carder friendly, etc. All of those networks eventually end up on blacklists or Spamhaus lists and their efficacy goes down. Eventually, the network dies out and the criminals move somewhere else. Yes, it's a game of whack-a-mole, but it's proven to work well.

I know Tor doesn't want to be in the network regulation business, but they need to be if they want their product to thrive. Otherwise, good bye Tor.

<comment><USER8> The main point of Tor is that nobody knows where the traffic comes from. Realize you're asking them to break their own service.

Your premise seems to be that you can't be bothered to protect your networks so you want to put that responsibility on someone else. It's called intermediary liability and it's terrible because the intermediary has all the wrong incentives.

You demand that the intermediary eliminate malicious traffic but they suffer much less than individual users if they also eliminate non-malicious traffic, so they set up a system with a high rate of false positives and harm many honest people. YouTube does this with Content ID. Spam registries do this with innocent small mail servers. CloudFlare does this with Tor.

What you're doing is called externalizing costs. It's generally recognized as antisocial behavior. So if you're going to claim benefits to yourself at the expense of other people, at least recognize that you're doing it.

<comment><USER9> > What you're doing is called externalizing costs. It's generally recognized > as antisocial behavior. So if you're going to claim benefits to yourself at > the expense of other people, at least recognize that you're doing it.

Remember his preface - cranky old-school network operator.

Let's say you have a hundred networks all connected together into some sort of "inter-net" system. If one AS starts sending out malicious traffic, what makes more sense:

1\. That AS starts policing their users.

2\. The other 99 ASs have to deal with the malicious traffic.

You're expecting the other 99 groups that are being targeted by the one group to bear the cost of dealing with that group's malicious users. Who exactly is externalizing costs here?

In a system without any real rules or authority, I think "those adversely effected choosing to block the bad actor" is a fairly democratic solution to the problem. You either play nice or you get voted off of the island.

<comment><USER8> > In a system without any real rules or authority, I think "those adversely > effected choosing to block the bad actor" is a fairly democratic solution to > the problem.

That's the part which is adverse to the rest of your argument. You're not voting off the bad actor, you're voting off everyone in the bad actor's country.

We know how to deal with this problem. You go to a website, you sign up for an account, it can be pseudonymous but to get it you have to put up some collateral. Money/Bitcoin, proof of work, vouching by an existing member, whatever you like. Then if your account misbehaves you forfeit your collateral.

But this isn't a CloudFlare-level problem. They're trying to solve it at the wrong layer of abstraction. Identity isn't a global invariant, it's a relationship between individuals. Endpoints identify each other with persistent pseudonyms. The middle of the network should have nothing to do with it.

<comment><USER9> > That's the part which is adverse to the rest of your argument. You're not > voting off the bad actor, you're voting off everyone in the bad actor's > country.

The bad actor is the organization or person responsible for administering the network where the abuse is originating.

When I'm being attacked by someone's VPS, I report them to their host. After the fourth time I report them only to have their host pass along my report but take no further action, the host becomes, maybe not a bad actor but, a "bad citizen".

My choices are to allow them to externalize the costs of their lack of enforcement (or decision not to enforce) and attempt to find a way to block the specific actor under their purview, or just to block that host and accept whatever collateral damage that occurs. (And yes, sometimes that "bad citizen" may end up being most of a country - it doesn't change the equation for me.)

It's the only method I have to exert any pressure on the host to act responsibly. If enough people agree with me, then it quickly becomes "their problem" rather than "my problem" as they get blackholed from everywhere on the internet.

<comment><USER8> > The bad actor is the organization or person responsible for administering > the network where the abuse is originating.

The bad actor is the individual who acts bad. The Post Office is not a bad actor for delivering letters.

> allow them to externalize the costs of their lack of enforcement

Tor is not an enforcement agency. Neither is CloudFlare. The costs of bad actors are your costs. You have the technical ability to retaliate against common carriers for not allowing you to push those costs onto them, but that doesn't make you right to do it in any sense other than might makes right. And you should realize that in doing it you're knowingly hurting innocent people.

<comment><USER9> Of course they're not an enforcement agency, that's kind of the point - <USER2> is no enforcement agency. We all have to contribute by being good citizens.

I subscribe to the idea that it's an ISP's responsibility to police its own network for abuse and my responsibility to police mine.

You apparently subscribe to the idea that it's my responsibility to just accept whatever shit you fling at me and it's my problem to deal with and yet somehow I have a responsibility or moral obligation to still provide services to you and your customers.

I suspect I'm never going to agree with you.

<comment><USER8> There are two ways to deal with badness. The first is to try to identify bad people and then stop them from doing anything whatsoever. The second is to identify bad acts and stop anyone from doing bad acts.

The second one is the only one that works without massive collateral damage.

Identifying bad people is only an abstraction over identifying bad acts and it leaks like a sieve. A reformed thief is entirely capable of buying an apple without incident, because not all acts by bad people are bad acts. But a thief has no reputation as a thief until after they steal for the first time. The only way to stop bad things is to detect bad things.

But the true failure of reputation systems is that as soon as multiple people share an identity they disintegrate entirely. Innocent people get blamed for malicious acts of other people through no fault of their own and with no ability to prevent it. The only way reputation systems can work at all is if people can prevent other people from using their identities.

Which means that IPv4 addresses can't be identities, because we don't have enough of them for them not to be shared.

And forcing common carriers to stop doing business with anyone who has ever done anything bad has another problem. It imposes the death penalty for jaywalking. You send spam once -- or get falsely accused of sending spam -- and you're blacklisted. It puts too many innocent people into the same bucket as guilty people and then the innocent people fight you alongside the guilty. It creates the market for these VPN services because too many servers are wrongly using IP addresses as identities. Then the bad people also use the VPN services and bypass your "security" because it was never security to begin with, so you block the VPN services which destroys those and they're replaced with others you haven't blocked. Meanwhile the real bad people also use botnets which are unaffected, so you aren't actually blocking the bad people, you're only blocking the one IP address that they share with the good guys.

You don't want this fight. Most of the people you're fighting are innocent. People need to learn to detect bad acts, not "bad IP addresses."

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I think Cloudflare's blog post was incredibly nuanced, well thoughtout and (dare I say) pro-Tor. They implemented a way for their users to whitelist Tor traffic (bypassing all Captcha's), without allowing their users to blacklist Tor traffic.

This response seems a bit of a childish knee-jerk reaction from the Tor project, which could've been worded more maturely.

<comment><USER11> I didn't spot anything worded immaturely. What specifically do you think could be more maturely worded?

<comment> grey-area Instead of addressing the very real problems with usage of Tor, they try to pick holes in the 94% figure from cloudflare (which isn't actually very important), and go on to cite a study by cherry picking stats: [https://news.ycombinator.com/item?id=11405101](https://news.ycombinator.com/item?id=11405101). They don't mention that it explicitly states something which backs up cloudflare's position:

 _Tor exit nodes were far more likely to contain malicious requests_

and even:

 _Risk averse companies may wish to block all Tor traffic_

The article then goes on to suggest that it is perfectly reasonable to use the word 'block' to mean showing a captcha - in common usage block means _block_ \- deny requests, not attempt to determine if a user is human with a captcha or some other method - that's not blocking, it's annoying and potentially pointless, but it's certainly not simply blocking users and it's disingenuous to describe it as such.

All of that adds up to a response which seems to be more interested in scoring points than finding a solution for legitimate Tor users. I'm not sure I'd describe it as immature, but it's not a very constructive response, to an article which went out of its way to be Tor friendly and propose solutions. It would be much easier for cloudflare to really block Tor traffic, they would probably suffer very little from doing so.

<comment><USER12> They are being defensive.

> Tor exit nodes were far more likely to contain malicious requests

They also were far more likely to issue requests in general. This data point has no meaning. But that's statistics for you :)

</comment></comment></comment></comment><comment><USER13> I [I'm CloudFlare's CTO] have been engaging with the Tor folks through their Trac interface here for about 6 weeks: [https://trac.torproject.org/projects/tor/ticket/18361](https://trac.torproject.org/projects/tor/ticket/18361) and been very open about CloudFlare is addressing this.

My plan is to continue to do so through that ticket as I've made various commitments there (some of which, like whitelisting, we've already rolled out). It's worth reading the entire ticket to get a sense of the conversation. We are in no way finished improving the situation.

<comment><USER14> Hello, please also consider VPN usage. Unlike Tor, we even pay for this service, because we take it so seriously.

Despite using the most reputable VPN provider I could find with a serious privacy policy; I've seen a steady increase in Captcha requests from CloudFlare to simply view read-only pages. And all I can think is that the Captcha page often requires the same amount of bandwidth as the page I was requesting in the first place.

The net effect is that it's not saving you any CPU usage or bandwidth (if anything, it's costing you more as we still request the actual page after the Captcha system runs), it's making customers like me abandon your customer's sites out of frustration, and it's eroding the last line of defense we have against invasive tracking.

I'm sympathetic to the problem you're trying to solve, but surely there must be a better way for simple GET requests.

This doesn't just affect people like me as a user. Having experienced this, I would be averse to deploying or recommending CloudFlare in its current state.

<comment><USER13> Which VPN are you talking about?

<comment><USER14> It's happened to me with Astrill, ExpressVPN, and vpn.ac so far. Usually I can reconnect to get a new IP to avoid catpchas again, so it seems only certain IPs are being poisoned. And no doubt because they are doing things they shouldn't. Hence the sympathy part.

If anything, it's been surprising to me to learn just how many sites are using CloudFlare ;)

I don't have a site handy that's triggering it right this moment, but here's a somewhat recent screenshot I grabbed of the captcha wall hitting my VPN: [http://i.imgur.com/OnvK05l.png](http://i.imgur.com/OnvK05l.png) ; I received this for simply trying to view a product page with an ordinary GET request. Ironically, I couldn't solve the captcha, despite being human >_<

<comment><USER13> Thanks. I am hopeful that the solution we come up with for Tor will be applicable to situations like this.

<comment><USER14> Awesome news!! Thank you very much for taking the time to respond, and for looking into a solution for Tor/VPNs. It's very much appreciated :D

</comment></comment></comment></comment></comment></comment><comment><USER15> That's just flawed reasoning all around. I can't even find any e-commerce- specific data in their sources.

> A report by CloudFlare competitor Akamai found that the percentage of > legitimate e-commerce traffic originating from Tor IP addresses is nearly > identical to that originating from the Internet at large. (Specifically, > Akamai found that the "conversion rate" of Tor IP addresses clicking on ads > and performing commercial activity was "virtually equal" to that of non-Tor > IP addresses).

Actual data from the report:

      • Comparison of Tor and non-Tor Traffic:

      	Of legitimate requests, non-Tor IPs accounted for 99.96 percent of requests, while Tor exit nodes accounted for 0.04 percent

      	Of malicious requests, non-Tor IPs accounted for 98.74 percent of requests, while Tor exit nodes accounted for 1.26 percent

      • Tor exit nodes were far more likely to contain malicious requests:

      	1:11,500 non-Tor IPs contained malicious requests

      	1:380 Tor exit nodes contained malicious requests

      • However, traffic from Tor exit nodes yielded a conversion rate virtually equal to non-Tor IPs:

      	Conversion rate for non-Tor IPs was 1:834

      	Conversion rate for Tor exit nodes was 1:895

Source: slide 7 of the report they link in the article – [https://i.imgur.com/TcstnWD.jpg](https://i.imgur.com/TcstnWD.jpg)

<comment><USER16> _[IP addresses of] Tor exit nodes were far more likely to contain malicious requests_

 _However, traffic from Tor exit nodes yielded a conversion rate virtually equal to non-Tor IPs_

You just described every busy IP address: if you handle more requests, you are more likely to handle a malicious one. This is the problem with IP based reputation.

<comment><USER17> Yes, I think that the more revealing ratio would have been total malicious requests to all requests for each class of IP. If each Tor exit node is sending out 30x as much traffic, with an average of 30 unique users per IP, then the cited ratios are meaningless.

The only thing that can be drawn from that data is that Tor makes IP-based reputation tools ineffective. The thing is, for many people that may be enough to justify what Cloudflare is doing.

<comment><USER18> That's what CloudFlare did in their blog post:

> Based on data across the CloudFlare network, 94% of requests that we see > across the Tor network are per se malicious.

<comment><USER17> That number does not fit with the 1:380 ratio of Tor IPs that emitted malicious requests, though. That is, unless the vast majority of all Tor traffic is routed out of only a couple of exit nodes, which does not seem consistent with the way that Tor works.

How can Cloudflare assert that 94% of all requests over Tor are malicious, when Akamai seems to be saying that less than 1% of Tor IPs contain malicious requests?

</comment></comment></comment></comment></comment><comment><USER19> I don't know what the solution is here.

One of my sites enjoys a ridiculous number of fraudsters trying to make purchases, many - but very much not all - from the tor network.

The easy solution is to punish everyone and ban tor exit nodes from access, and woo, a significant reduction in my fraud rate.

The way I justify this to myself is that the site only accepts payment via PayPal and/or credit cards, and paying with those in itself gives up a good amount of privacy.

For sites that don't make a profit and have to use unpaid time to clean up the mess from some tor nodes, I really don't know what the solution is.

It definitely sucks for legitimate users.

Edit: one more difficulty is that I don't know if I was targeted by one or two lazy-yet-determined fraudsters who only use tor, and so make tor look worse than it is with their repeated attempts. No idea even where to begin with that one.

<comment><USER20> This is where 3D Secure truly shines; instead of completely refusing a transaction, you can request the issuing bank (= bank of the card used to pay with) to accept the liability in case of fraud (normally, it's the merchant who has to give the money back). Usually the issuing bank will then request the customer for additional challenge, e.g. a 2FA token, a code in SMS, or just their birthday. Some don't even require anything. To you as a merchant, though, that doesn't matter: if the person who bought your product was a fraudster, the money is still yours. Now it's the issuing bank on the hook for fraud, instead of the merchant.

The argument against 3DS is it kills conversion rates (meaning: lots of legitimate customers don't complete that extra challenge, who would otherwise have made the purchase). But for legitimate customers using TOR, I wouldn't be surprised if that number were very different :) I know I wouldn't mind whipping out a 2fa device every time I purchased something over TOR. I mean, fair play, right?

3DS is available today in Europe, Asia and Africa! :'( but not ubiquitously in the USA. Yet. It's getting there.

More info: [https://en.wikipedia.org/wiki/3-D_Secure](https://en.wikipedia.org/wiki/3-D_Secure)

<comment><USER21> 3D Secure is a complete disaster. It encourages users to put ridiculously sensitive information like social security numbers and bank credentials into an iframe in the merchant site. This trains users to be phished.

<comment><USER22> Social security numbers?! Who the hell implemented it like THAT?

3D Secure redirects to the bank's site (not in an iframe! a real window with a visible address bar) where you enter a one-time code from SMS!

<comment><USER21> I have worked with systems implementing 3D Secure and have multiple credit cards that trigger it. I can assure you that the standard deployment for US- based banks and merchants uses iframes and in the majority of cases will ask for enough personal information to steal your identity or drain your bank account.

<comment><USER23> I assume this is a US problem because in the US card fees are high enough that banks don't need to worry too much about fraud yet. Look at European banks if you want to see reasonable 3D Secure.

</comment></comment></comment></comment></comment></comment><comment><USER24> I feel like Tor is burying their head in the sand here.

I think Tor is great, but I don't find it at all surprising or unlikely that 94% of _traffic_ (not users) is malicious (spam, vulnerability scanning, scraping, etc) because it's likely that malicious traffic is automated while legitimate traffic is not.

That said, I'd also like to hear more about CloudFlare's methodology.

</comment><comment><USER25> Exchanged comments with Cloudflare's CEO on the topic and in my opinion it appears that they simply don't understand that their view of the situation is skewed.

Here's hoping that given they truly do appear to care about TOR users that they'll revisit the situation and find a better solution.

Here's a link to Cloudflare's blog post an the related comments on HN:

[https://news.ycombinator.com/item?id=11388560](https://news.ycombinator.com/item?id=11388560)

<comment><USER26> It's Cloudflare, not Cloudflair.

<comment><USER25> Thanks, fixed the typo!

<comment><USER26> :)

Actually, I got it wrong as well, because it's really CloudFlare.

</comment></comment></comment></comment><comment><USER18> > 5) A report by CloudFlare competitor Akamai found that the percentage of > legitimate e-commerce traffic originating from Tor IP addresses is nearly > identical to that originating from the Internet at large. (Specifically, > Akamai found that the "conversion rate" of Tor IP addresses clicking on ads > and performing commercial activity was "virtually equal" to that of non-Tor > IP addresses).

This point seems rather odd. I'm not following the connection between a large percentage of Tor requests being malicious and the fact that Tor users have almost the same conversion rate. Malicious requests are coming from botnets and/or fraudsters. They're, for the most part, not in the subset of Tor users which click ads or do anything else that would be tracked as part of a site's conversion rate. What's funny about this is that the linked report even confirms that requests from exit nodes are far more likely to be malicious:

        Tor exit nodes were far more likely to contain malicious requests:
          • 1:11,500 non-Tor IPs contained malicious requests
          • 1:380 Tor exit nodes contained malicious requests

I'm a huge supporter of Tor and have been running a relay node for years, but it seems their stance on this topic is quite fundamentalist and they chose to ignore any arguments or facts that they don't like while basically grasping at straws in their counterarguments.

It's okay to be concerned about CloudFlare having such a huge market share. They're a _huge_ target for nation states and others alike. Global passive¹ adversaries are a problem for things like Tor, and they might very well be forced to become one at some point. It's essential to have more competition in this area, and that's a fair argument to make. However, with regards to how they're handling Tor, I don't think there's anything wrong with what they're doing, and the explanations presented in their blog post seemed sound to me.

¹ Or, rather, possibly an active adversary too?

<comment><USER27> Is this a wording issue?

> Akamai found that the "conversion rate" of Tor IP addresses clicking on ads > and performing commercial activity was "virtually equal" to that of non-Tor > IP addresses

So when seeing actual web traffic things are identical. That only measures real web traffic. It doesn't measure all the SSH attacks, SPAM being sent, possibly checking for vulnerabilities and unpatched software/etc.

<comment><USER18> CloudFlare doesn't do anything other than web traffic. It's basically an nginx reverse proxy on steroids.

<comment><USER27> Oh, right. Well you still have automated scans for vulnerable servers on HTTP that don't try to really 'access' the website.

</comment></comment></comment></comment><comment><USER28> Original Cloudflare blog post that this is a response to: [https://blog.cloudflare.com/the-trouble-with- tor/](https://blog.cloudflare.com/the-trouble-with-tor/)

<comment><USER29> That post also suggests two things that Tor could do to improve the situation for their users:

* Support a stronger hashing algorithm to make it possible for CloudFlare to make .onion versions of all of their customers' sites. * Implement "client-side" CAPTCHAs.

I don't how feasible either of these are, but it seems strange (evasive?) that Tor Project's blog post does not discuss either.

<comment><USER18> I believe Tor is working on a new version of hidden services which would address the first concern.

</comment></comment></comment><comment><USER30> This is a tough situation. I don't know about 94% of TOR traffic being fraudulent but I'm sure it's high. But I'm one of the legit users that gets taken out by blacklisting. I use a VPN service pretty regularly and it makes accessing my Cloudflare account and sites using it incredibly annoying.

<comment><USER31> > I don't know about 94% of TOR traffic being fraudulent but I'm sure it's > high.

I was curious and ran a quick check on my servers. 5 servers, about 300 domains, checked my logs going back 1 week. I could find just ONE legitimate session. Everything else was something trying to break WordPress or PHPMyAdmin or something else. I'd love to support Tor but I feel like I can't fight this fight.

<comment><USER14> While still higher than regular ISP addresses, VPN abuse should be significantly lower than Tor abuse on account of these services costing real money. And nearly all of them not accepting anonymous forms of payment.

I expect my VPN use to keep me hidden amongst a crowd from various internet companies trying to track and profile me; but I don't expect for a minute that it offers protection against criminal activities (and I have no intention of engaging in such things.) Any intelligent criminal would likely feel the same way and not use a service with their real billing information to commit crimes. Especially with Tor available.

Yet despite this, I am constantly hit by CloudFlare captchas on sites that are very clearly not being hit by DoS traffic. Further, it seems site operators don't even realize this is happening. When I reported the captcha issue to Zotac's Twitter account, they had no idea CloudFlare was doing this.

Google is also a huge offender with the captchas. I'm _this close_ to switching to Duck Duck Go. Facebook is too, but I'm fine with not ever going there.

</comment></comment></comment><comment><USER32> The really questionable thing CloudFlare seems to be doing is that they captcha traffic depending on the overall reputation of only the source IP rather than whether the source IP is attacking that specific site or even whether the site is under attack.

What they should do instead is this:

1\. If the server is not overloaded, do not captcha any traffic at all

2\. If the server starts being overloaded, only captcha traffic from IPs that have been detected as attacking THAT specific site

3\. If the server is still overwhelmed, only then switch to captchaing all IPs with "bad reputation"

Most websites are probably almost never under attack, so this would make encountering CloudFlare captcha extremely rare in the wild while still providing DDOS protection.

They could even only do this for Tor exit nodes and other IPs that are known to be used by lots of people.

If a site is being DDOSsed a lot and the slower start up of this technique is a problem, then they can revert for those sites to the current behavior of using reputation.

</comment><comment><USER33> I find Cloudflare's argument analogous to that of cash - i'm sure some huge percentage of all illegal transactions are with cash, but that does not mean the solution is to ban cash...though some would probably disagree

<comment><USER34> But to be fair, in Cloudflare's case they aren't "banning" access, they are putting it behind a captcha.

Still far from ideal, but it's not banning.

<comment><USER35> When every .html resource requested is met with a captcha, access is effectively banned.

<comment><USER34> Well that's another problem. When you fill out the captcha you are given a cookie that can allow cloudflare to let you through next time.

If you are blocking that cookie for privacy reasons (which is not a bad thing!), then cloudflare has no way to verify you again (short of doing nefarious things). It's a bit of a self inflicted problem at that point.

That's not to say that the answer is "deal with it", but that we need to find a better way. A a way to verify that someone isn't a bad actor without having them take a pretty significant chunk of their time to answer captchas, or give up some of their privacy.

It's a tough problem, and i think the "proof of work" solution proposed in the original could work, but it would need participation and collaboration from "both sides" of the problem. And of course it won't happen overnight.

<comment><USER36> Any proof of work concept again is just a cookie – because the proof I present will be the same.

<comment><USER34> But you could possibly re-do the proof of work every page load without the cognitive load of multiple captchas.

It still isn't ideal for mobile or low-end clients, but its something.

</comment></comment></comment></comment></comment></comment><comment><USER37> I find the 94% figure believable (for requests, not source IP addresses), Tor is after all the obvious choice for low bandwidth DoS attacks and unwanted scraping (i.e. a few individuals will generate a large percentage of Tor- routed requests at any time).

The real issue with CF for me isn't the hassle with captchas, but the fact that CloudFlare can track users across all its sites, generate profiles and even read unencrypted traffic. It's a privacy hazard by design that makes Tor particularly attractive. But as long as Tor is used only by a small minority, it will be treated this way.

</comment><comment> ryan-c I would expect most of the malicious traffic coming out of Tor isn't using Tor browser. I wonder what the attack numbers look like for Tor browser vs not Tor browser. Cloudflare has client side checks already, which could be extended to check whether the browser is Tor browser, and if so, don't block it.

</comment><comment><USER38> I understand what CloudFlare is saying but I still think that the benefits of allowing legitimate TOR users access websites freely (without cumbersome captchas) outweighs the troubles malicious users might cause. Public computers such as in Libraries are also often used to do reprehensible things, but still, we understand the benefits of having them.

It is also worrying that CloudFlare has this much power. One of the greatest things about the internet is the openness of the platform and the non existence of gate keepers.

Also, here is an annotated version of the TOR paper for those who want to read more about it [http://fermatslibrary.com/s/tor-the-second-generation- onion-...](http://fermatslibrary.com/s/tor-the-second-generation-onion-router)

</comment><comment><USER39> Payments originating from TOR IP addresses absolutely are more likely to be fraudulent. Anyone running an online business could tell you that.

<comment><USER40> Hassling Tor users shouldn't become the Internet's default. If you're having trouble, consider informing Tor users checking out that you won't process the payment without their providing additional information. This raises the cost to carders a lot more than needing to rent a SOCKS proxy in a residential area.

<comment><USER41> It's not worth the development costs and extra verification costs to try to weed a small number of legitimate purchases from a sea of illegitimate ones though.

<comment><USER40> It isn't that there is a sea of illegitimate traffic so much that their methodology is incredibly flawed, and they have little financial incentive to fix it. As a society, we have to give them that incentive, or we will lose access to a shared resource.

We can have our Internet heavily censored or heavily censored with a ray of sunshine. Is that worth the engineering costs?

</comment></comment></comment></comment><comment><USER42> > Users are either blocked outright with CAPTCHA server failure messages, or > prevented from reaching websites with a long (and sometimes endless) loop of > CAPTCHAs

Is it really a loop or are users just failing to solve the CAPTCHAs? A loop would be obnoxious: Just tell the user they are blocked; giving them more than 2 or infinite CAPTCHAs is a passive aggressive way to communicate.

<comment><USER18> My best guess is that reCAPTCHA doesn't just have two states (pass/fail), but rather something like a confidence factor and a threshold you have to reach to continue to the site (which might depend on your reputation).

</comment></comment><comment><USER43> This is a terrible reply, it's basically say's "It's all your fault, we're all good over here."

They then either because they legitimately can't understand the problem, which would be scary, or because they're being stubborn fail to address the suggestions by cloudflare to address the issues.

</comment><comment><USER44> The trouble with Clouflare is that they receive disproportionate amount of attention on Hackernews. Sometimes HN feels like an extension of their marketing machine. I'm not so sure they every single blog post of their needs to be an item on HN. Anyway that's my .02 cents.

<comment><USER25> Do you use Tor?

</comment></comment><comment><USER45> I have a question that I'm hoping will spur some discussion and maybe I can learn some stuff.

"Is anonymity in Tor incompatible with low-latency?"

I ask this having read this: [http://freehaven.net/anonbib/cache/pets13-flow- fingerprints....](http://freehaven.net/anonbib/cache/pets13-flow- fingerprints.pdf)

I suspect that countermeasures to defeat deanonimization all have a negative impact on latency(e.g. inserting extra packets, pausing between sends).

If the answer to my question is yes, then maybe the best thing the Tor project can do is abandon its push for low latency, and instead focus on anonymity. If Tor we're a much higher latency network attackers would probably find it less interesting.

</comment><comment><USER46> To me personally all of this just seems like fluff. I can't be the only one that feels this way.

I don't want to 'prove I'm a human' to view your crappy site. I'll go and look at the other bits of the Internet instead.

As an individual browsing, the only contact I have with CloudFlare is a bouncer telling me 'no shoes no entry'.

Your entire company to me feels like a pointless gatekeeper because of these shenanigans (on and off of Tor).

To be perfectly clear - CloudFlare, as a brand, is tainted to me, and I expect to many others.

Fundamentally I don't think CloudFlare cares because their customers are not the viewers of websites - and if the viewers of websites come to think of CloudFlare as toxic - it still doesn't matter to them directly.

</comment><comment><USER47> That post doesn't really offer any solutions.

It would be interesting to find out how CF came to the 94% figure but a lot of the other claims made are not countered and presumably valid.

I doubt CF's (paying) customers are particularly saddened by Tor users being inconvenienced.

</comment><comment><USER48> CloudFlare looks for ways to justify doing less. First ANY queries, then "free" HTTPS stopping at the first CloudFlare hop, and now the stuff with Tor. I don't trust CloudFlare _at all_ , because they say they're holding a torch for the good of humanity, when actually, they're just making "cut costs" business decisions. If you want to do something becuase it costs less, I understand, then do that. But don't sit there and try to tell me that you're somehow doing it to make the world a better place. That, to me, is super scummy.

</comment><comment><USER49> The main problem with CloudFlare is how dumb their "protection" is.

It doesn't make sense at all to block Tor users from just accessing read-only content, like CloudFlare does today. Forms/login pages/comment boxes etc should be protected of course, and most people wouldn't have anything against solving a captcha for logging in, but preventing people from just reading stuff anonymously/securely is borderline evil from a user experience point of view.

However it's obviously much easier from an engineering standpoint though to just block people outright.

<comment><USER18> This was addressed in CloudFlare's blog post:

> One suggestion has been that we treat GET requests for static content > differently than we do more risky requests like POSTs. We actually already > do treat more dangerous requests differently than less risky requests. The > problem is Tor exit nodes often have very bad reputations due to all the > malicious requests they send, and you can do a lot of harm just with GETs. > Content scraping, ad click fraud, and vulnerability scanning are all threats > our customers ask us to protect them from and all only take GET requests.

<comment><USER36> That argument only holds true if the person operating the site has no idea at all about the HTTP standards.

* GET requests _have_ to be idempotent.

* Security by Obscurity is not Security.

* Content Scraping is nothing you have to protect against, or should protect against – DRM just does not work _._

<comment><USER18> Right, but this is about abuse and solutions for that. Obviously, blocking Tor is not going to prevent a determined attacker from scraping your site or trying some SQLi vectors. It might, however, prevent a large number of bots from scraping your site for emails, scanning for vulnerabilities, or doing click fraud. It's not a perfect solution, but those rarely exist. CloudFlare sees a lot of malicious traffic, so they probably have a better view of what works and what doesn't compared to everyone else.

<comment><USER36> I see a lot of fraud on my site as well, and I can say that there are some ISPs in Eastern Europe and Asia that are just as likely as Tor as being the origin for a malicious attack.

I don't block them either.

Instead, I use fail2ban with a 30min ban for the IP for all my servers, and have the rest of the system hardened. Also, I add an additional delay that's just below the timeout that browsers have for each request from an IP of that block for the next 30min.

Reduced my logs of "123.456.789.012 tried to authenticate as "root" with invalid password" from several gigabytes a day to a few kilobytes.

________________________

Sure, I don't host a large site, or get much traffic, but saying "Tor is the only issue" or even "Tor is the largest issue" isn't true.

And there are solutions for these cases. Solutions which allow legitimate users to continue using the services.

<comment><USER47> But Tor is not specifically treated differently... their exit IPs cross a threshold and CAPTCHA's are applied, just like with your fail2ban solution.

<comment><USER36> There is a difference: They ban each IP from _all_ their services. And eternally, not just for 30min.

</comment></comment></comment></comment></comment></comment></comment><comment><USER50> I think CloudFlare's security measures are insane. I use a VPN and I can tell which sites use CloudFlare because I consistently get a Error 520, where it claims the browser and CloudFlare are working, but the website is not responding. Yet I turn of the VPN and magically it works fine. That's dishonest. At least own that you are the one blocking my visit.

I'm also developing with Dwolla's API, and CloudFlare blocks all HTTP requests from my local IP, so I can't develop locally. Thanks CloudFlare.

<comment> throwaway-10439 Yeah, this is beyond just Tor - they're breaking VPN and carrier-grade NAT traffic too. Even if Tor bowed to their demands those would stay broken, and scammers would still fill out the captchas manually. But they seem very set on their chosen solution!

</comment></comment><comment><USER51> Someone with more knowledge of these thing, let me know:

Why does Tor not "charge" per request? i.e. Using some decentralized currency, to pay for requests.

1\. Make it cheep enough such that users don't care, however, financially disincentives spammers/malicious users.

2\. It would continue to be anonymous. - cycle through wallets - <USER3> transactions would also be proxied.

3\. It would incentivize proxying and exit nodes (exit nodes would effectively collect a bunch of virtual money to be resold to clients for USD).

<comment><USER52> If users don't care, spammers don't care; spammers will get a financial return.

</comment></comment><comment><USER40> Services like CloudFlare are responsible for more and more of the DNS. When they are poor net citizens, they are poor net citizens at a massive scale. Heuristics that end up being equivalent to "Tor users are guilty until proven innocent" can't become the default mode of the Internet. As customers, Tor users, and just people who have a stake in the Internet as a shared resource, we need to demand that they try harder than that.

</comment><comment><USER53> Anonymity ("privacy") and security are conflicting requirements. Tor users take a legit stance, and would be served an equally legit CAPTCHA (if lucky).

<comment><USER52> You're assuming anonymity and security belong on opposite sides. They don't.

</comment></comment><comment><USER54> How about this solution: (yes, it's only 5% serious)

From every publically available internet do something that appears malicious until cloudflare's servers annoy everyone. At that point they'll be forced to find a new solution.

This only occurred to be because I get their captchas on public wifi in Starbucks and other public wifi in Japan

</comment><comment><USER55> I'm getting

"Attackers might be trying to steal your information from blog.torproject.org (for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID"

When trying to visit this blog post.

<comment><USER25> >> Laaw: "But I don't want end to end encryption"

Sorry, but I thought you didn't want encryption. Bit puzzled, just click ignore error to fix the issue.

Clearly this advice is based on you not wanting end-to-end encryption; heads up, NSA flags users that visit Tor's website, though clearly, you've done nothing wrong.

(Yes, I'm making a point, hope it's clear.)

<comment><USER55> Since they use HSTS, I literally can't click "ignore" or I would have. I, and (I assume) anyone else who uses the latest version of Chrome cannot access this content right now. Or it might just be me, but I don't know what the solution is.

You also missed the point if you think what I said included the words "all the time" in the other thread we were talking in.

<comment><USER25> I'm on Tor and able to see the file, no idea why you're getting that error, or I'd try to help.

Assume you know this, but Google has a cached version as text if you Google...

[cache:http...]

^^ where you remove the open/close brackets and insert the full URL after "cache:"

<comment><USER55> I'll try that, thanks.

</comment></comment></comment></comment></comment><comment><USER56> CloudFlare uses a flawed algorithm that penalizes developing countries and anyone who uses 1 IP address for many users. And that means that it censors Tor users and impedes human rights.

</comment><comment><USER57> I dislike CloudFare adoption. More and more I come to sites and need to wait 5 seconds, caused by their DDoS protection. Such things make the less more and more aweful.

</comment><comment> throwaway-10439 The GET solution seems too lightly waved off considering that 90% of Tor requests will be nearly identical to those from trusted IP addresses.

</comment><comment><USER58> The trouble with cloudflare, the lawyers of the internet. Making money on other peoples problems but not really solving anything.

</comment><comment><USER59> Maybe I either missed this or forgot, but what percentage of overall internet traffic handled by Cloudflare is deemed malicious?

<comment><USER52> In fact, I'd like to see CloudFare segment out other populations and provide similar statistics. With carrier-grade NAT, corporate proxies, VPNs, ... Surely Tor is not the only segment that behaves similar. As I see it, CloudFare is taking one group and applying stereotypes to justify a draconian technique. I suspect they may be doing the same with other undeserving groups. Seems to be the way the world goes, when money gets involved.

</comment></comment><comment><USER60> We are free speech advocates, and yet we had to make a cron that downloads and adds Tor IPs to an ipset, due to botnets.

</comment><comment> das-boot >the site only accepts payment via PayPal >and/or credit cards, and paying with those in >itself gives up a good amount of privacy.

I think both methods areactually not private and have proven not te be private at all

</comment><comment><USER61> lol, CloudFlare vs Tor (hope its not disappointing like BvS)

</comment><comment><USER62> Cleary cloudflare's customers prefer this behavior, it's their website, they are free to block tor traffic if they like.

</comment><comment> das-boot >the site only accepts payment via PayPal >and/or credit cards, and paying with those in >itself gives up a good amount of privacy.

i think both methods have proven not to be private at all.</comment>


Humans are the highest energy apes, making us smarter but also fatter - <AUTHOR> http://www.sciencemag.org/news/2016/05/humans-are-highest-energy-apes-making-us-smarter-also-fatter <comment><USER2> The Science magazine article seemed to me scarce on a number of critical details which are made clear in the abstract: [http://www.nature.com/nature/journal/vaop/ncurrent/full/natu...](http://www.nature.com/nature/journal/vaop/ncurrent/full/nature17654.html)

Of particular interest is the fact that the study tries to account for the effects of activity, which is obviously widely variable across human societies and individuals (e.g. French professional cyclist versus Khomani San tracker versus Japanese Sumo wrestler). The abstract specifies that they found an elevated basal metabolic rate, which is activity independent. There is the important and interesting issue of variance. A closer look at Figure 1 one might help in this regard (alas, a paywall...).

<comment><USER3> I see in Table 1 that their average human female is 6 kg heavier than their average human male. Strange!

<comment><USER4> Might this be because of the higher % body fat in women?

<comment><USER3> I don't think so - men are heavier than women on average, e.g. [https://en.wikipedia.org/wiki/Human_body_weight](https://en.wikipedia.org/wiki/Human_body_weight) . Is it a mistake in the table or a weird sample?

<comment><USER5> They did select "relatively sedentary humans"; perhaps in that subset, women are heavier than men?

\- Men tend to do more muscle-increasing sport than women; meaning a sedentary man isn't gaining that muscle weight.

\- Women tend to do more cardio activities to burn fat; meaning an active women may be losing weight.

I suspect you're right about it being a misprint though.

<comment><USER6> >men aren't gaining that muscle weight they already have >Women tend to do more cardio activities to burn fat; meaning an active women may be losing weight.

The muscle weight is a metabolic load that requires constant caloric intake to support, sedentary women do more cardio to compensate for their otherwise low metabolism. May not be a misprint.

</comment></comment></comment></comment></comment></comment><comment><USER7> Does that mean we would live shorter lifespans than other apes without medicine, sanitation (and all the other stuff the Romans did for us)?

I remember something about the metabolic rate being tied to lifespan.

<comment><USER8> The question is whether that's cause or effect - and regardless, the correlation between metabolic rate and lifespan clearly isn't very strong (as in there are many other factors that probably matter).

In the big scheme of things, a mere 27% difference isn't all that great. I mean, heck, hummingbirds can live to be 10 which is more than twice as long as even record-breaking genetically engineered mice, despite hummingbirds having an unusually high metabolism.

The 27% difference more remarkable if you consider how similar we are to other apes. Regardless, I can't imagine that simplistically extrapolating lifespan from metabolism is particularly accurate, even if it gets you in the right ballpark.

</comment></comment><comment><USER9> The homo genus needs a new species: Homo Sapiens Corpulentus

</comment><comment><USER10> There are other factors impacting one's body composition not mentioned in the article - things like testosterone levels, growth hormone levels etc.

</comment><comment><USER11> higher energy use does not mean fatter, if you /use/ all of that energy.

<comment><USER12> Animals don't operate on the principle of "run the tank until it's empty". If they did, they would frequently die for no good reason by getting caught out at an inopportune moment. Imagine if, whenever a car ran out of gas, it exploded. You'd probably keep your car close to full, and that is what animals do too. In normal health, you can go several weeks without needing to eat.

Higher energy use means we store more energy than other animals need to. We _do_ balance energy intake against energy output, very precisely. But we still need greater reserves, and those reserves are fat.

<comment><USER13> As long as a some specific crowd doesn't use the article as another excuse for being morbidly overweight, I'm fine with that.

</comment></comment></comment><comment><USER14> Makes sense to me

<comment><USER15> Do you mean "it made sense to me" as in "I understood it, having read it" or "I knew that already, it's obvious"

If it's the former, then good for you, you understood the text

If it's the latter then good for you, you're a genius

Either way, your understanding of it is a great contribution to the discussion. Thanks.</comment></comment>


The iPad: It's about control systems, not eBook reading - <AUTHOR> http://lr.posterous.com/the-ipad-its-about-control-systems-not-ebook

<comment><USER2> I can believe the iPad will do well in this market, but I don't believe apple gave it more than a tiny amount of thought when designing the thing.

Apple are all about mass consumer markets, it'd be totally out of character for them to design a system for home automation, or even doctor's offices.

Not that they won't be happy that it'll do well there, but it'll be a pleasant side effect rather than a goal.

<comment><USER3> Yep. I remember a few years back seeing Jobs compare Apple to Chrysler (I think?) in this respect... something along the lines of: Chrysler makes minivans for families. They happen to also be really good for businesses that need to shuttle executives around, and Chrysler is happy to sell to them, but that's not who Chrysler is thinking about when they design them.

This was obviously a few years ago. :)

</comment></comment><comment><USER4> It's an interesting idea but I don't see how that would work. Apple is not an OEM -- you can't call them up and easily order 50,000 iPads to integrate into your own offerings. You would have no idea when a new iPad is coming out and what features it may have. The iPhone/iPad platform aren't super manageable. This is something I'm sure Apple will be working on but right now the idea of a hospital using the iPad in any large deployment would be really difficult. You can't even do something as simple as centralized LDAP authentication from an iPad. As far as I know there's no way to push applications to an iPad or remotely upgrade it's firmware or all these other small things you would have to consider. A dumber tablet makes more sense for something like home automation or control panels for other integrated systems. They might be more expensive right now but the iPad will definitely drive prices of large touchscreen tablets down. So if you were building something like a home automation system would you build an iPad app for it? Sure. Would you design your entire platform around relying on the iPad? Absolutely not.

<comment><USER5> <http://www.apple.com/support/iphone/enterprise/>

And in particular the iPhone Configuration Utility: <http://support.apple.com/kb/DL926>

</comment></comment><comment><USER6> This much seems clear: the iPad will change how mobile workers work. Cops, postal workers, meter readers, field technicians & scientists, doctors, you name it.

Furthermore, it will disrupt numerous markets: portable DVD players, GPS units, PDAs, laptops, industry-specific bespoke mobile platforms (what is that thingy the UPS guy uses?), control systems, newspapers, magazines, you get the idea. Anything less would not be worth Apple's time.

<comment><USER7> > This much seems clear: the iPad will change how mobile workers work. Cops, > postal workers, meter readers, field technicians & scientists, doctors, you > name it.

I'm afraid I haven't been paying attention: is there a brief, cogent argument for why the iPad will do this whereas the Tablet PC form factor did not?

<comment><USER8> I've been using a tablet for a few months now. (HP tc1100, which many feel is on a par with Apple industrial-design wise, though of a slightly different philosophy.)

I think styluses are for geeks only. Using handwriting recognition and gestures is _like_ writing on paper, only it's not really. It's also like using your desktop PC, but not really. Geeks like us can learn these new conventions and have fun coping with a stylus. To most people it's a terrible pain in the *ss.

Taking up a pen tablet also involves taking up the stylus. That's 100% more overhead than something like the iPad. A paper reference book can be looked at, browsed, indexed, flipped through just by putting your hands on it. Install software to allow that on a pen tablet, and you still have to pick up that stylus in addition to going to the tablet.

In short, it's more immediate. It's immediate enough to reach a mainstream audience. Pen tablets were not.

</comment></comment></comment><comment><USER9> Reviewing the discussion here, I think his important point is being missed: Due to the supply chain Apple has built through iPod then iPhone/iPod Touch, the iPad is an extremely cost competitive multitouch interface. In fact it's so cost competitive that you might want to use it _mounted_. Forget carrying and maybe even rotating. It's a (relatively) cheap multitouch interface with great usability and a health programming community breeding future professionals.

Your heart might be crying out that this is not cool or sexy, and therefore incompatible with Apple, but it's a very interesting proposal. I can foresee a potential future where 50% of iPad hardware sold gets nailed down and screwed in.

<comment><USER10> ^This.

I sure hope someone comes out with a detachable wall mount+charger for the iPad.

</comment></comment><comment><USER11> This is what I believe also. I think the iPad will be useful as a mobile touch panel for a larger device behind it like a home, factory, machine or internet based thingy.

<comment><USER8> I think something like this will be a mobile touch panel for everything that will have a computer in it, which will be more and more things as time goes on.

</comment></comment><comment><USER12> It could be good for both eBooks and control systems.

</comment><comment><USER13> Good read; rather than a hand-wavy "things we haven't imagined yet", he spells out, with details, something that the iPad would be good for.

<comment><USER14> The question is though, why will it be better than all the previous tablet PCs?

Technically, the iPad is still 'meh'. When it has a holographic display or you can wear it as a watch with a flip out screen, or control it by thought alone, then I could understand the hype.

<comment><USER15> I just don't understand why it's supposed to better than anything else already on the market - tablet or not. Am I just getting old? What makes it Special besides the brand?

<comment><USER16> HP Compaq Tablet PC Tc4200 vs. iPad

• 1.3" thick vs. 0.5" thick

• 4.6 lbs vs. 1.5 lbs

You could duct-tape three iPads together and you'd have roughly the size and weight of one Windows Tablet PC. This matters a _lot_ carrying one around a hospital. And this is to say nothing of the fact that all the exposed ports and vents on the PC prohibits its use in a number of contexts, while the iPad could easily be fitted with a sealed silicone case.

• Full desktop OS vs. specialized mobile OS

Yes, Apple's platform is tightly controlled. But if you're building a web- based application, why not deploy it on a low-maintenance, streamlined device instead of something with enough complexity to run Crysis while spreading Conficker in the background?

</comment></comment></comment></comment><comment><USER17> This seems to me like an example of a particular kind of myopia: because the author has been involved in the control-panel industry, he perceives that industry to be a more important part of the world than it really is.

 _the touch screen on the iPad is remarkably sensitive. Do you really think they did that just for gaming?_

Well, no, I think they did it for the user experience of the device as a whole, but even if it _was_ just for gaming: Videogames take in $10 billion a year. Crestron and AMX together make about $0.7 billion.

</comment><comment><USER18> I interviewed at Savant once and got an offer. They seemed like a pretty cool place, but they were way out on Cape Cod and I figured I'd go insane out there.

</comment><comment><USER19> It is funny to read an article saying the iPad will be about X, when there are so many X's out there. The iPad represents the refinement of a platform (tablets) that has a shot at transcending the models of computing we have had so far. Just look at where the iPhone is at as a platform now with 3 revisions under it's glassy screen. The iPad a few generations down the road (30 inch, Multitasking) will change the computing landscape.

In the 1990's (Thanks Jeron) we were all expecting VR to be the next step away from the 2D windowed computing environment. For some reason that didn't take off. At the same time there was a lot of academic hype around the idea of ubiquitous computing. I think the iPhone/iPod Touch was the first tentative step into this direction, but without the real estate for effective daily work. I think the iPad will solve a lot of these issues and therefor go way beyond anyone's expectations.</comment>


IRC client in 135 lines of code - <AUTHOR> https://github.com/huytd/nodirc <comment><USER2> The headline is a bit misleading. The wrote a client sure but it uses someone else's library to communicate with the IRC Server.

<comment><USER3> Welcome to basically every "do x in y lines of code" post.</comment></comment>


Show HN: Sharing Excerpts from 10 HN Discussions Each Day - <AUTHOR> https://hn.icymi.email/ <comment><USER2> Pretty cool. Would you be interested in transforming this into an email newsletter? I figure if people miss these discussions on here they'll appreciate getting summaries in their inboxes.

<comment><AUTHOR> Great recommendation. There is actually a newsletter. I need to improve when the Subscribe CTA is displayed.

Here is the link to subscribe [http://eepurl.com/b0Q9p5](http://eepurl.com/b0Q9p5)</comment></comment>


JPEG 2000: The Better Alternative to JPEG That Never Made It Big - <AUTHOR> https://petapixel.com/2015/09/12/jpeg-2000-the-better-alternative-to-jpeg-that-never-made-it-big/ <comment><USER2> Other commenters are right, licensing was a big factor, because the 1990s were marred by a few high-profile events where patents on popular formats were suddenly enforced [1]. These events led to the PNG format being developed as an alternative to GIF, and Vorbis developed as an alternative to MP3.

By the time JPEG 2000 rolled around, wariness of patents was well-established.

On the technical side, JP2 produced unsightly ringing distortions much more noticeably at medium compression ratios than JPEG did while also blurring detail, while JPEG would only experience ringing around sharp transitions, and would get blocking artifacts elsewhere. For some people, JPEG's blocking would impact a sort of 'fake sharpness' in the image, while JP2 would produce a blurry smudge. Dark Shikari, longtime dev on x264, wrote about this phenomenon [3], which also adversely affected early H.264 encoders and made them look worse compared to ASP (like Xvid), despite former being an objectively better format.

[1] [https://en.wikipedia.org/wiki/GIF#Unisys_and_LZW_patent_enfo...](https://en.wikipedia.org/wiki/GIF#Unisys_and_LZW_patent_enforcement) [2] [https://en.wikipedia.org/wiki/MP3#Licensing.2C_ownership_and...](https://en.wikipedia.org/wiki/MP3#Licensing.2C_ownership_and_legislation) [3] [http://web.archive.org/web/20141124213159/http://x264dev.mul...](http://web.archive.org/web/20141124213159/http://x264dev.multimedia.cx/archives/317#more-317)

</comment><comment><USER3> jpeg2k is far far more complex, hard to implement, is far more computationally complex. The quality of the results arguably aren't that much better. Revisiting the encoding of the DCT coefficients shows tremendous gains can be had there. After digging into jpeg2k I was never a big fan.

IMHO for image compression there's a balance between algorithmic simplicity, computational efficiency and image quality.

I'm looking for an article some months back about DCT coding sans huffman, but here's a quick page on how using arithmetic coding in the JPEG standard cuts jpeg file sizes down 5-12% [http://www.rw- designer.com/entry/1311](http://www.rw-designer.com/entry/1311)

Okay one DCT based recompressor is "lepton" which is 20% smaller than jpeg with the identical DCT quality: [https://blogs.dropbox.com/tech/2016/07/lepton-image- compress...](https://blogs.dropbox.com/tech/2016/07/lepton-image-compression- saving-22-losslessly-from-images-at-15mbs/)

</comment><comment><USER4> I think this is a bad article. I was expecting a more technical piece, but it only gives a few high level reasons why it never got used widely. And wasn't legal requirements a big reason?

It mentions that backwards incompatibility was a big reason. Why would you design an obviously better media format, then ruin it by a burdensome needless requirement? Has any widely used media format been backwards compatible? (I can't think of any)

</comment><comment><USER5> Missing main reason: licensing

</comment><comment><USER6> When can we expect the same article about WebP?

<comment><USER7> I made a good slice of mobile app ads use webp, it provides significant bw savings over jpeg, and i am not sure if it is going anywhere.

Ps: i work for google.</comment></comment>


Thefuck: Magnificent app which corrects your previous console command - <AUTHOR> https://github.com/nvbn/thefuck <comment><USER2> Although old, but here's the last discussion on this: [https://news.ycombinator.com/item?id=9396116](https://news.ycombinator.com/item?id=9396116)

</comment><comment><USER3> It has a swear word in the name, it must be hard core.

</comment><comment><USER4> Awesome!!</comment>


Ask YC: If you could create the ultimate tech news site what would it look like? - <AUTHOR>

People bag on some of the News sites for being to fluffy, too gossip filled, etc...
I've just started a site to cover technology and startups in the Midwest: http://windywire.com and I'm looking for feedback to create the type of site we'd all like to see.
So I'm coming to you guys for feedback, what features, what style of writing, what mashups would you like to see in a tech news site? <comment><USER2> I'd like to see a quality over quantity site.

Today, technology news has a problem: people who might know what they're talking about don't write. Blogs are somewhat better but the blogger doesn't have an incentive to collect opposing points of view or do boring fact- checking or tedious testing.

I see a lot of people saying that the comments are the best part of the article. This is wrong. You only feel this way because tech reporting is so degraded.

What I would _like_ : a news site that figures out some way to make money off rare information and insightful reporting. One half Consumer Reports, one half the Marc Andressen blog. Even if this resulted in there being just a few posts per day, I think I would read it. Plus, on the web, quality information can rake in pageviews over a long period of time, so this strategy isn't economic suicide. It does take a longer time to pay off.

Maybe there are a few sites like this today, such as Tom's Hardware or Ars Technica, but I am not much of a hardware guy. I deal with web software, and the writing around that topic seems to be decidedly fluffy.

</comment><comment><USER3> One of the most important aspects of a news site is having a good community. A lot of the value of sites like news.yc aren't the links themselves, it's the comments provided by the technially adept community. That's not to say that the links are unimporant, it's that they aren't unique - most of the links come from a a small subset of tech news sites.

One thing I don't like is articles that are purely about business cycles. Company A raised 10 million dollars, or is dead, or is running out of money, or is being acquired. Somtimes that can be interesting, but I'm partial to writers that have a sense of humor, and are good at putting things into perspective. I like writing from guys like Zed Shaw, or Matt Maroon -- they're enterntaining.

<comment><USER4> I'd go further and say that the links are only discussion fodder. they get people started, the comments that arise from the ensuing discussion are the reason i come to HN. I could easily (?) set up a feed that approximates the kind articles I actually click on HN, that's obviously not why we come here.

</comment></comment><comment><USER5> News can be too much like popcorn: unsatisfying one by one, bad for you en mass, and usually consumed while procrastinating.

If the articles instead brought difficult epiphanies, and challenging tasks, one might find it in them to attend to one's work first, and tackle some of the 'new articles' (say, a new fascicle from Knuth) later.

</comment><comment><USER4> I think niche'd social news sites are part of the future of the web. Reddit's create your own reddit is a step in the right direction but it remains to be seen if people prefer starting upa group on an existing network or trying to start one from scratch (the difference between the programming reddit and HN).

AFAIK no one has done white label social news yet. startup?

<comment><AUTHOR> I guess my question would be more in line with: What would you like to see in a location-centric tech news site that provides the content for the social news sites we love.

</comment></comment><comment><USER6> Here's something that nobody talks about: people writing articles from different points of view.

We don't get this often. We dont' have one person talking about a product's design and another person about its performance and a third person about the sort of community it's developed. We get one or another, and it's never organized.

I love reading about design, less so about pure opinion on subjects. Having multiple takes on tech would be a very cool feature that I've never seen on a site before.

</comment><comment><USER7> I'd like the New Yorker of tech news. Not so much information, but articles that really open my eyes to new stuff.

</comment><comment><USER8> Apple has taught us that good taste is everything. I'd like to see a build- your-own news site that allows individuals or small groups to maintain their own mini-reddit in a more moderatorship-style. Make the front page showcase the most popular feeds and feed-artists.

</comment><comment><USER9> I see you are having big aspirations. ;-) Regarding the style of writing, I personally like two styles: one is a temperate, sensible, normal writing (something like Robert Scoble or kottke), another style I like is the Gizmodo/Engadget type.

</comment><comment><AUTHOR> <http://windywire.com>

</comment><comment><USER10> it'd look like yc. now upvote me plz.

<comment><USER4> I'd say it would resemble HN to a higher degree than it would resemble any other news site that currently exists.

<comment><USER10> why do you think i'm here?</comment></comment></comment>


Made the fastest Golang JSON logger thanks to a pooling optimisation - <AUTHOR> https://github.com/francoispqt/onelog <comment><AUTHOR> Hey guys, wanted to share my experience.

I just updated onelog, my zero alloc JSON logger, and made it the fastest JSON logger out there by far, thanks to a simple `pooling optimisation` in gojay (the underlying JSON encoder).

Previously, I was using buffered channel in Gojay to pool encoders in memory. My logger was fast already, but zerolog or zap was a bit faster in some cases. I noticed through profiling, that sometime, it took time to acquire from channels and increasing the buffer size didnt chang.

Then I disabled pooling and noticed a good performance increase but more allocations. so I tried with sync.Pool, made a safe usage of it and performance of the logger have jumped 2x to 3x.

It is now by far the fastest JSON logger out there.</comment>


It Pays to Have Pals in Silicon Valley - <AUTHOR> http://www.nytimes.com/2006/10/17/technology/17paypal.html <comment><USER2> A [2006] tag may be appropriate.</comment>


The punishment was death by stoning. The crime? Having a mobile phone - <AUTHOR> http://www.independent.co.uk/news/world/politics/special-report-the-punishment-was-death-by-stoning-the-crime-having-a-mobile-phone-8846585.html

<comment><USER2> "They are using Twitter and other social media..."

And it will never lead to anything.</comment>


Show HN: A shortlist for year-end giving - <AUTHOR> http://charitysuperhero.org <comment><AUTHOR> Creator here.

This was mainly driven by the idea that we need to strengthen the organizations that are championing causes such as women's rights, climate change etc -- causes that are under increasing political attack. People who have good intentions still need to be shown the way, and a simple list might go a long way towards pointing people in the right direction.

I would love to get feedback on the effectiveness of such a list, and also on the causes and charities that should be listed. To keep things simple, I only listed a max of 4 charities, and would love to keep it that way, so coming up with a really effective shortlist would be great.</comment>


Ask HN: Mailing Newsletters - <AUTHOR>

I need to send out e-mail newsletters every week to my website users. I am looking for cheap email marketing/newsletter manager solutions. Any recommendations ?<p>Do you recommend downloading open-source newsletter manager like PHPList and installing it on the server ?  Or would you recommend using a hosted newsletter manager like campaignmonitor.com, icontact.com etc. <comment><USER2> An _opt-in_ mailing list system such as GNU mailman would reach the people who want to be reached and give them plenty of options (e.g. individual mails versus digest form, the ability to turn it off temporarily for vacation, etc.).

I would _strongly_ recommend you not automatically E-mail your users on a weekly frequency! If you must do this, make it infrequent (monthly, no sooner) and make sure you include genuinely useful information. A good example is LinkedIn, which includes information that I can definitely use (new developments among my directly connected peers), and they only send it if I haven't visited the site in about a month.

<comment><AUTHOR> I will take your advise and mail the newsletter every month.

<comment><USER3> The best advice about newsletters I've heard is: send them out when there is news. News the recipients will want to know about - not marketing spiel, that'll quickly cause it never to be read again. (c.f. crying wolf)

</comment></comment></comment><comment><USER4> <http://www.aweber.com/> (not that I've used it)</comment>


Mod Function and Negative Numbers (2000) - <AUTHOR> http://mathforum.org/library/drmath/view/52343.html <comment><USER2> Julia goes the ADA way, supporting both. There's

        div(x,y)   # truncated division; quotient rounded towards zero
        fld(x,y)   # floored division; quotient rounded towards -Inf

and correspondingly

        rem(x,y)   # remainder; satisfies x == div(x,y)*y + rem(x,y); sign matches x
        mod(x,y)   # modulus; satisfies x == fld(x,y)*y + mod(x,y); sign matches y

and the convenience functions

        divrem(x,y) # returns (div(x,y),rem(x,y))  ## Lotus 123 convention
        fldmod(x,y)	# returns (fld(x,y),mod(x,y))  ## Excel convention

(There's also mod1 and fld1, and there's mod2pi(x) which is more precise than mod(x, 2pi).)

</comment><comment><USER3> I run into this issue in javascript all the time. I want a number to basically act like pacman leaving the left or right side of a screen. pure sawtooth function. unfortunately js's % operator mirrors at zero. so i always end up having to search for this:

        Number.prototype.mod = function(n) {
          return ((this % n) + n) % n;
        }

<comment><USER4> Agreed. In my experience, people want to use _this_ modulo operator (e.g. for implementing a ring buffer or wrap-around as you mentioned), but many languages use the _other_ modulo which leads to all sorts of bugs. It doesn't make sense to me since this modulo is more natural from both a mathematical and an engineering perspective.

<comment><USER5> It's because that's the way CPUs / C do it. Many other language implementors are too lazy to fix it.

I have often been thankful that Python does the right thing, and often frustrated that Javascript does not.

</comment></comment></comment><comment><USER6> Haskell supports both. The documentation explains the two pretty clearly, IMO:

        quot :: a -> a -> a

          integer division truncated toward zero

        rem :: a -> a -> a

          integer remainder, satisfying

            (x `quot` y)*y + (x `rem` y) == x

        div :: a -> a -> a

          integer division truncated toward negative infinity

        mod :: a -> a -> a

          integer modulus, satisfying

           (x `div` y)*y + (x `mod` y) == x

Here's an example

        ghci> (-340) `divMod` 60
        (-6,20)
        ghci> (-340) `quotRem` 60
        (-5,-40)

<comment><USER7> > integer division truncated toward negative infinity

Truncated?

</comment></comment><comment><USER8> See also "Mod and remainder are not the same" discussed here recently:

[https://news.ycombinator.com/item?id=17817758](https://news.ycombinator.com/item?id=17817758)

</comment><comment><USER9> I find true module to be an insanely useful operator. Python negative indexing (array[-1]) is essentially that. I've proposed it to swift but people didn't see the point [https://forums.swift.org/t/double-modulo- operator/2718](https://forums.swift.org/t/double-modulo-operator/2718)

<comment><USER10> Python negative indexing isn't modulo. It's just shorthand for array[len(array)-i].

      >>> a = [1, 2, 3]
      >>> a[-1]
      3
      >>> a[-2]
      2
      >>> a[-3]
      1
      >>> a[-4]
      Traceback (most recent call last):
      File "<stdin>", line 1, in <module>
      IndexError: list index out of range

<comment><USER9> The problem is that you need to have a conditional to figure out if I is negative or not. With modulo it's all the same.

</comment></comment></comment><comment><USER11> It is a sad thing but there is no standard: [https://en.wikipedia.org/wiki/Modulo_operation](https://en.wikipedia.org/wiki/Modulo_operation).</comment>


Ask HN: Where can I find theoretic background on analytics reporting? - <AUTHOR> There are many questions when facing the decision of how to create your data scheme for events, whether you're using Elastic Search, Google's Big Query, Amazon's Redshift, Splunk and others.
For example: 1.Metrics vs Dimensions - what is truly the difference between those definitions?
2.Should all my data be in a single flat event and have multiple values or should each event have only 1 value or maybe a mix of those approaches? <comment><USER2> My free opinion on theory: the data scheme should reflect the underlying business logic, then the tool should be selected to support the business logic and the data scheme.

My free meta opinion: Most projects don't require tools designed for the scale that the listed tools are designed for and because most organizations lack the institutional knowledge necessary to sort through the diverse failure modes in a tool chain built around these technologies these organizations will be better served by something simpler until such time as they grow to the point where experienced technical expertise in the technology can be hired...i.e. the knowledge dependency chain of tools designed to serve Google scale businesses are likely to be a rabbit hole for an individual developer.

Good luck.</comment>


There's a Relational Database in Your Unix CLI - <AUTHOR> https://spin.atomicobject.com/2019/06/16/unix-cli-relational-database/ <comment><USER2> Calling `join` a relational database is a bit "click-baity". Yes it's a cool command, but you don't get any type of constraints or indexing or atomic updates or any of the important things that people expect from databases.

<comment><USER3> Well, you have to add sort, cut, paste, and uniq for a full system.

</comment></comment><comment><USER4> > sum == SUM()

I don't think so. From sum(1):

> sum - checksum and count the blocks in a file

      $ seq 1 3 | sum
      26670     1

I guess 26670 is the checksum and the 6 bytes in the output of seq fit into 1 block...

For a SUM() equivalent, I can't think of anything shorter or more convenient than the following while using only standard utils:

      $ seq 1 3 | awk '{a+=$1}END{print a}'
      6</comment>


Why Firefox Mobile OS Is An Actual Game Changer - <AUTHOR> http://tuts.pinehead.tv/2012/07/03/why-firefox-mobile-os-is-an-actual-game-changer/

<comment><USER2> While I agree with most of the points in this article, I'm not sure why HTML5 can't be beautiful in user experience. HTML5 doesn't come with a UI toolkit, but plenty of beautiful toolkits already exist, the most popular of which is probably JQuery Mobile. HTML has traditionally been weak when it comes to UI flourishes such as animations, but in principle CSS animations can be just as robust as animations implemented in native code. Additionally, both hardware and JavaScript JITs have come a long way since the release of the initial iPhone and Android devices. I expect the main issue will be lack of consistency among apps.</comment>


Becoming a Code Mighty - <AUTHOR> http://vangav.com/ <comment><AUTHOR> As a software engineer developing decision making algorithms (e.g.: ranking, autonomous drone control, … etc), one has the potential to impact the experience of hundreds of millions. Ranking Facebook's news feed stories, deciding which Google results show first, controlling Tesla's autopilot, … etc.

At university one enjoys the freedom to implement complex algorithms delivering a great user experience but misses having impact. At companies one enjoys having impact but lacks the freedom of implementing complex algorithms since code must be super simple for ease of maintenance and must be performant as it runs billions of times every day to deliver real-time experience where +1 millisecond is too much time.

So I developed Vangav M (vangav.com). I thought "let's abstract the problem and make the solution as simple as plotting the solution's idea on paper while delivering maximum performance".

Any decision making algorithm is: a set of inputs, a set of outputs and relations connecting inputs with outputs. As the solution size grows it's still pretty easy to explain on paper but it becomes exponentially complicated to write the algorithm and maintain it as more numbers and mathematical operators come into play.

Vangav M replaces the coding part with a simple json form that describes the solution. With the push of a button Vangav M takes care of implementing the most performant solution in any programming language, and provides a solution's API with set, process and get functions.

"compressing hours of development and maintenance time into minutes while delivering a maximum performance solution"

Check out the website for interactive examples, web client, open source desktop client, ...

www.vangav.com</comment>


High Performance Ornithopter Drone Is Quiet, Efficient, and Safe - <AUTHOR> https://spectrum.ieee.org/automaton/robotics/drones/high-performance-ornithopter-drone <comment><AUTHOR> > "Its thrust exceeds its 26-gram mass by 40 percent, which is where much of > the aerobatic capability comes from. ... flapping-wing robots can actually > be more efficient than propeller-based aircraft."</comment>


Impressive iOS Icon Sketch - <AUTHOR> http://dribbble.com/shots/541393-ios-door-video

<comment><AUTHOR> Make sure to checkout the video of it being sketched: <http://vimeo.com/41411609></comment>


Ask HN: Idea Sunday - <AUTHOR>

Didn't see one created and found the thread quite valuable, so moving the series along!<p>From the previous one: "A small HN experiment. Every Sunday, a thread will be started to share product ideas. Why? Because many people have ideas they will simply not have the time to implement, and many need product ideas to work on." -- https://news.ycombinator.com/item?id=7616910 <comment><USER3> it has been killed.

[https://news.ycombinator.com/item?id=7693640](https://news.ycombinator.com/item?id=7693640)

<comment><USER4> Ironically, killed because it was popular, and popular threads are apparently a sign that the community is jumping the shark.

<comment><USER5> Popular is not the same as good. (a lesson that the internet learns repeatedly)

<comment><USER4> It's not the same as bad, either. It means users are engaged with the site and want to share their ideas, projects and experiences on a regular basis. It should be encouraged. Not killed because it might make the site superficially too much like Reddit.

<comment><USER6> When `dang made his post, my thought was that the activity was harmless and made trying to game Show HN less likely. Thinking about if two weeks later I realize how lame that is as an argument for keeping it.

For better or worse HN is run to meet YC's objectives. YC does not appear to value engagement for the sake of engagement very highly. People can disagree with that, But it remains a fact.

<comment><USER4> I would argue that it wasn't so much 'engagement for the sake of engagement', as the content was at least relevant, and more engaging (at least to me) than a repost of whatever Techcrunch published that day. Or another political argument which inevitably devolves into whether capitalism is the problem or anarchy is the solution. Or bikeshedding over languages, or paranoid conspiracies about the American Racist Surveillance Hegemony. Or sexism in tech. Or why if you're not y, then you're x.

Most of the reasons dang put forth as to why he killed those particular threads could be applied to almost every thread on this site - <USER2> entirely on the opinion of whomever happens to be reading them at the time.

Granted, you're right - it's YC's sandbox and they get to set the rules. But reading dang's post I can't help but wonder whether he's confusing diversion for intellectual quality.

<comment><USER6> I too argued "It's not that bad" as a reason for keeping it two weeks ago. On the other hand I was not arguing with you at all today since we are in agreement that it's YC's football and it would be absurd to assume that you would argue that I don't hold the beliefs that I had asserted that I hold.

My opinion regarding what beliefs`dang holds is that the 'Idea Sunday' was _consistently_ earning karma disproportionately to it's contribution to the quality of HN and that this was creating a genre of similar high reward high noise threads [e.g. Screenshot Saturday, Tweet Tuesday etc].

My guess is that he looked at the threads closely before pulling the plug, not only because his post implies it but because it was allowed to run for several weeks before he stepped in and moderated. By the time action was taken a fairly detailed picture of who was looking at and participating in the threads was available.

Is it the call I would have made? I don't know because I'm not charged with that, (though I did flag this thread because of its poor quality) and I haven't seen all the facts.

<comment><USER4> Sorry, I wasn't arguing with you, I didn't mean to give that impression.

<comment><USER6> No need to apologize. I know you were just writing what you needed to write...expressing your disagreement with the decision 'dang made. My post was just an excuse to write (and think since writing is thinking) and these are good activities and perhaps you were to some degree even writing simply to get better at writing.

Of course I may be just projecting what I do, and anyway this response is largely driven by my need to think.

Your post fell into the form of argument because that's sort of what the internet trains us to do. It's the path of least resistance when we want an excuse to write another post after the one we are currently writing. It's the primary game of internet fora.

One of the observations of 'dang and PG before him was that a problem which is particularly salient in political threads is people arguing rabidly when they agree...and those 'arguments' turning heated and nasty. In other words the comments devolve to look like the rest of the internet. That's sort of the reason why the Idea thread was problematic: the conversation could have been happening anywhere. There were none of the elements that make HN HN.

And that's just what I used the opportunity provided by the reply button under your post to write because I felt like writing, i.e. I was just indulging my thinking habit...and working to improve my writing in more or less a free writing exercise with writing as the topic.

[http://en.wikipedia.org/wiki/Free_writing](http://en.wikipedia.org/wiki/Free_writing)</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Indie Booksellers Sue Amazon, Big Six over E-book DRM - <AUTHOR> http://publishersweekly.com/pw/by-topic/digital/content-and-e-books/article/56042-indie-booksellers-sue-amazon-big-six-over-e-book-drm.html#path/pw/by-topic/digital/content-and-e-books/article/56042-indie-booksellers-sue-amazon-big-six-over-e-book-drm.html <comment><USER2> I doubt it will get anywhere this late in the game unless they also wake up the DoJ and get on the case of Apple, Google, B&N, and Kobo in regards to DRM. And DRM is only half the issue. Kindle books can only be read on Amazon- offered hardware and software, unlike ePub which can be used by Sony Reader, Kobo's devices, and B&N's devices. So it's not just DRM, it's file format too. And I've railed for years about Amazon not going with ePub but have accepted they've basically won, although now with iOS devices in the half billion, they have some actual potential competition. (And I say potential because iBooks is an optional download, made that way by Apple to thwart EU regulators who otherwise would have quickly awakened to a Windows-MSIE type bundling restraint of trade issue.)

<comment><USER3> I've had good luck using Calibre[1] to convert EPUB to MOBI for use on Kindle. In particular, I had a subscription to the digital edition of "Analog" from B&N for a couple of years, and Calibre got all of those issues nicely onto my new Kindle Paperwhite. ("Analog", at least from B&N, does not have DRM).

[1] <http://calibre-ebook.com>

<comment><USER4> I think I heard the Amazon-supplied ePub converter can work better sometimes, but I haven't tried it. It may be the one on this page: [http://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000...](http://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000234621)</comment></comment></comment>


Ask HN: Can you name 3 cities in Afghanistan or Iraq off the top of your head? - <AUTHOR>

<comment><USER2> Afghanistan: Kandahar & Kabul

Iraq: Baghdad, Fallujah, & Basrah.

Honestly for the life of me can't name a third Afghan city

</comment><comment><USER3> Baghdad Bahrain Kabul

I had surgery yesterday and on some good pain meds, otherwise I think I could come up with two or more cities.

</comment><comment><AUTHOR> Asked this question on separate american forums and social media websites. The results were surprisingly low.

<comment><AUTHOR> I'm hoping that HN will score exponentially higher.

<comment><USER4> The problem you'll find when asking this question is how little emphasis is placed on the location of an event rather than the event itself. Most people don't pay particular attention to the location of a foreign event because it holds no substantial significance to them.

Ask this question to a forum of military veterans that have deployed to these locations and you will most definitely see the response in which you were searching. As a veteran, I can say that most people will neglect these details until faced directly with the necessity of remembering.</comment></comment></comment>