Inside Snapchat's war against porn - <AUTHOR> http://www.dailydot.com/technology/snapchat-porn-banned/

<comment><USER2> Moxie, if you're reading this, can you add ephemeral messages to Signal so we can start sexting there, too? It seems like it's a rather popular use of "privacy" apps, which may boost Signal's popularity, too.</comment>


A chart of Facebook's revenues - <AUTHOR> http://valleywag.com/tech/stats/a-chart-of-facebooks-revenues-282344.php

<comment><USER2> This is what they said about Google before it went public, though.

I'd really like to see that S-1, though. For a company with $100M in _revenue_ to be asking for a $10B market valuation takes a lot of chutzpah. Typically, growth stocks will trade at something like 4x revenue. That would give FaceBook a market cap of around $400-600M.

<comment><USER3> Google actually was making a ton pre-IPO (on the order of a billion in revenue). Facebook isn't (yet).

<comment><USER2> Right, it's just that nobody knew about it. When Google's S-1 came out, everybody was astonished by how much money they were making.

<comment><USER3> The question to ask is not what Facebook claims it's worth, but what Facebook thinks it's worth. As in, what's the internal valuation being used for setting employee option strike prices? Methinks nowhere near $10 billion.

<comment><USER2> Aren't they required by law to set them at the price of the last investment? IIRC, that was how it worked the last time I got ISOs. It sucked when the company got a new round of funding, because it meant all new ISOs needed to have a strike price that was roughly double what the old ones were.

FaceBook's Series-A had a pre-money valuation of like $78M, which is nearly unheard of in VC circles. If they've done further rounds, it'll be even higher.</comment></comment></comment></comment></comment>


Chrome Extension Development, By Practical Example - <AUTHOR> https://github.com/bcoe/DoloresLabsTechTalk

<comment><USER2> The problem with extension development is that each browser does it differently.

If you abstract away the browser-specific API, it's not too hard to write a cross-browser extension. Here's one that runs on both Chrome and Safari:

[http://code.google.com/p/marking-menu- js/source/browse/#svn%...](http://code.google.com/p/marking-menu- js/source/browse/#svn%2Ftrunk)

Notice how it implements the important bits of Chrome's extension API in terms of Safari's:

[http://code.google.com/p/marking-menu- js/source/browse/trunk...](http://code.google.com/p/marking-menu- js/source/browse/trunk/safari/hostAPI.js)

That allows you to easily port Chrome extensions over.

<comment><USER3> It seems to me there is a need for a browser extension framework/polyfill that allows you to write code once, deploy to any browser. Would that even be possible?

</comment></comment><comment><USER4> Hey, cool! The source code for my Chrome extension is also on GitHub:

[https://github.com/atdt/chrome-force-media- type/blob/master/...](https://github.com/atdt/chrome-force-media- type/blob/master/Makefile)

The Makefile might be interesting to you. It's very simple, but it automates an annoying part of the development cycle.

<comment><USER5> Throwing mine out there, too--for spoofing your user-agent string:

<https://github.com/jugglinmike/chrome-user-agent>

<comment><USER6> Hey Mike, just FYI this is now available in DevTools: <http://cache.gyazo.com/1c4bc26914b409a85884147d6f9fec03.png>

</comment></comment></comment><comment><USER7> "Why Create a Chrome Extension?

        It's a great way to integrate seamlessly with a third-party site like Gmail.
            It in turn solves the "other site" problem, i.e., your customers don't want to go to yet another website.
        The Chrome Web Store is a wonderful source of traffic.
        All your friends are doing it.

"

i find the readme scary. it encourages closing the web.

the rest's good - but - the intention's bad.

<comment><AUTHOR> I agree in principal -- I'm not advocating that the whole internet be centralized to a few major websites. Having said that, integrating with a site like Gmail can be a good way for a small fish to get some traction.</comment></comment>


UN Report Says Small-Scale Organic Farming Only Way to Feed the World - <AUTHOR> http://www.technologywater.com/post/69995394390/un-report-says-small-scale-organic-farming-only-way-to

<comment><AUTHOR> Key messages in the report:

* The 2008 food crisis was an important catalyst for realizing the need for a fundamental transformation and questioning some of the assumptions that had driven food, agricultural and trade policy in recent decades.

* The fundamental transformation of agriculture may well turn out to be one of the biggest challenges, including for international security, of the 21st century.

* The world needs a paradigm shift in agricultural development: from a "green revolution" to an "ecological intensification" approach.

* The required transformation is much more profound than simply tweaking the existing industrial agricultural system.</comment>


Nokia's flexible user interface prototype demo [video] - <AUTHOR> http://www.youtube.com/watch?v=QsbZOKahdMw

<comment><USER2> Firt all the buzz about Lumia 800 and then this crazy prototype, is Nokia on its way back?</comment>


Fastnetmon DDoS analyzer now available as an official Debian package - <AUTHOR> https://packages.debian.org/sid/fastnetmon <comment><USER2> [https://github.com/pavel- odintsov/fastnetmon#readme](https://github.com/pavel- odintsov/fastnetmon#readme)

"What can we do? We can detect hosts in our networks sending or receiving large volumes of packets/bytes/flows per second. We can call an external script to notify you, switch off a server, or blackhole the client.

…

Why did we write this? Because we can't find any software for solving this problem in the open source world!

What is a "flow" in FastNetMon terms? It's one or multiple UDP, TCP, or ICMP connections with unique src IP, dst IP, src port, dst port, and protocol."

<comment><USER3> That's a flow in general, and isn't specific to FastNetMon.

<comment><USER4> A flow is defined as a unidirectional sequence of packets with some common properties that pass through a network device. [...] for example, flow records include details such as IP addresses, packet and byte counts, timestamps, Type of Service (ToS), application ports, input and output interfaces, etc.

From here: [https://tools.ietf.org/html/rfc3954](https://tools.ietf.org/html/rfc3954)

</comment></comment></comment><comment><USER5> And if you're on a FreeBSD box, just pkg install fastnetmon

Glad to see this software exists. Had to help build a poor man's version of it at a previous job and it was half baked due to lack of time.

<comment><AUTHOR> Yes, thanks for highlighting it! :) FreeBSD port exists for ~2 years: [https://www.freshports.org/net- mgmt/fastnetmon/](https://www.freshports.org/net-mgmt/fastnetmon/)

</comment></comment><comment><USER6> Is there any documentation how to set this up fast and reliably on an existing Debian server? The only thing I could find was this: [https://fastnetmon.com/wp- content/uploads/2017/03/FastNetMon...](https://fastnetmon.com/wp- content/uploads/2017/03/FastNetMon-Advanced-install-guide-v1.pdf)

<comment><USER7> [https://github.com/pavel- odintsov/fastnetmon/blob/master/doc...](https://github.com/pavel- odintsov/fastnetmon/blob/master/docs/INSTALL.md)

<comment><AUTHOR> Thanks :)

</comment></comment></comment><comment><USER8> Hi. I have a doubt regarding the license[0].

Aren't GPLv2 and Apache v2 licenses incompatible. How can they co-exist in the same project? (The copyright file says GPLv2, or is it GPLv2+?)

[0] [http://metadata.ftp- master.debian.org/changelogs/main/f/fast...](http://metadata.ftp- master.debian.org/changelogs/main/f/fastnetmon/fastnetmon_1.1.3+dfsg-1_copyright)

<comment><AUTHOR> I think that we do not have Apache licensed code in project, it's just protocol description for protobuf: [https://github.com/pavel- odintsov/fastnetmon/blob/2005b4e94e...](https://github.com/pavel- odintsov/fastnetmon/blob/2005b4e94e5af628b95d3102384c2a792da34046/src/actions/gobgp_api_client.proto)

And it's not used by version available in Debian repositories at all (just some experiments).

The project itself licensed strictly in terms of GPLv2 (not GPLv2+).

<comment><AUTHOR> After short conversation with GoBGP project they re-lcienses this file in BSD terms: [https://github.com/osrg/gobgp/issues/1384](https://github.com/osrg/gobgp/issues/1384)

We will update proto file to this version in FastNetMon soon! :)

</comment></comment></comment><comment><USER9> I wonder if [https://fastnetmon.com/](https://fastnetmon.com/) and DOTS [1] are roughly the same thing?

[1] [https://datatracker.ietf.org/wg/dots/about/](https://datatracker.ietf.org/wg/dots/about/)

<comment><AUTHOR> FastNetMon does not implement DOTS yet. Instead, we support API for scrubbing centres/boxes directly.

<comment><USER10> Are there some good open source scrubbing center projects you might be able to recommend?

Also might you have any resources or links to how these scrubbing services are implemented, what heuristics they use etc?

I understand the front end of DDOS mitigation i.e netflows, BGP communities and RTBH, and GRE tunnels to the scrubbing centers. However the details of how the scrubbing centers works is something of a mystery to me.

When looking at any of the big DDOS provider's literature, the scrubbing centers are mostly just opaque boxes with little documentation on how they actually work.

<comment><AUTHOR> You could consider this thing [https://github.com/luigirizzo/netmap- ipfw](https://github.com/luigirizzo/netmap-ipfw)

<comment><USER10> Thanks, unfortunately the documentation about the project is rather scant.

<comment><AUTHOR> You could read my blog post about it instead: [https://translate.google.com/translate?hl=en&sl=ru&tl=en&u=h...](https://translate.google.com/translate?hl=en&sl=ru&tl=en&u=https%3A%2F%2Fwww.stableit.ru%2F2015%2F03%2Flinux- netmap-ipfw.html)

It's in russian but Google trsnalate crashes language baarriers! :)

<comment><USER10> Thanks! This is helpful. I like your blog name, I'm assuming that translation is correct :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> What's generally the state of the art in open source home/small office network monitoring? I would like to know and query/audit communication patterns of my devices. While maintaining privacy -> no cloud based commercial products.

<comment><USER12> check out pfsense ([https://www.pfsense.org/](https://www.pfsense.org/)) along with the following books:

Practice of Network Security Monitoring - [https://www.nostarch.com/nsm](https://www.nostarch.com/nsm)

& Tao of Network Security - [http://www.informit.com/store/tao-of-network- security-monito...](http://www.informit.com/store/tao-of-network-security- monitoring-beyond-intrusion-9780321246776)

<comment><USER11> Thanks. Sounds pretty hard if you're not a networking expert, and just have a cable modem plus wifi box. There's definitely a space for an easy to install solution here. Raspberry Pi based perhaps?

</comment></comment></comment><comment><AUTHOR> Btw, we have the channel at Freenode! Join us: #fastnetmon at irc.freenode.net! :)

</comment><comment><USER13> I'm looking for the same solution for syscalls. Therefore, we can detect malicious processes. Isn't that cool ?

<comment><AUTHOR> I tried to play with slightly similar idea previously: [https://github.com/FastVPSEestiOu/Antidoto](https://github.com/FastVPSEestiOu/Antidoto) but decided to keep my eyes on DDoS mitigation only.</comment></comment>


How'd golf get to be a businessman's sport? - <AUTHOR> http://www.slate.com/id/2267675/

<comment><AUTHOR> Funny conclusion of the paper linked at the bottom of the article: "Although we find no relation between handicap and corporate performance, we do find a relation between handicap and CEO compensation. In short, golfers earn more than non-golfers and pay increases with golfing ability."

<http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1374239>

<http://en.wikipedia.org/wiki/Illusory_correlation></comment>


How to kill a dragon with various programming languages - <AUTHOR> https://blogs.oracle.com/roumen/entry/how_to_kill_a_dragon

<comment><USER2> Hahaha, very funny! Thought i miss Haskell.</comment>


Productivity of New PhDs in Economics: The High Non-Success of the Successful - <AUTHOR> https://www.aeaweb.org/articles?id=10.1257/jep.28.3.205 <comment><USER2> They found that MIT, Harvard, and Princeton grads publish the most. Those are the most fashionable departments so this is not surprising. I think they proved that the top 30 rankings they are benchmarking against doesn't conform to prejudices within the profession.</comment>


Website which makes fundamental attributes of cryptocurrencies accessible - <AUTHOR> https://coindecide.com <comment><AUTHOR> E.g. to filter for eco friendliness [https://coindecide.com/?Transaction+Eco- Friendliness=10,000+...](https://coindecide.com/?Transaction+Eco- Friendliness=10,000+-+100,000+Wh) or for comparing coins [https://coindecide.com/compare/btc-bitcoin-vs-nano- nano](https://coindecide.com/compare/btc-bitcoin-vs-nano-nano)

</comment><comment><USER2> Can't even select for PoW coins, let alone fairly launched coins (no premine or instamine). I prefer the controls offered by messari. E.g. [https://messari.io/screener/fair- coins-9E7A9337](https://messari.io/screener/fair-coins-9E7A9337)

<comment><USER3> Our service tries to give access to the fundamental values which make up the potential and intrinsic value of a cryptocurrency.

<comment><USER2> A fair launch is one of the most fundamental values of a cryptocurrency.</comment></comment></comment>


In the Human Brain, Size Really Isn't Everything - <AUTHOR> http://www.nytimes.com/2013/12/26/science/in-the-human-brain-size-really-isnt-everything.html <comment><USER2> One interesting aspect is that it assumes the animal brain is great for some things but less good for logic-based flexibility. One might argue that human intelligence is animal intelligence "virtualized" by language and consciousness.

The idea is appealing but I have no idea if its true.

</comment><comment><USER3> The title seems a bit odd, seeing as the hypothesis described seems to be describing a way that expanding brains _can_ (or did) lead to higher intelligence. No, it isn't "just scale everything up", but it still has size as a major controlling factor.

<comment><USER4> There is good evidence that size is most things if not everything. We have big brains, hence we have more intelligence than chimps. We cook our food, so we don't spend all day feeding our big brains.

<comment><USER5> Brain size is correlated to intelligence in humans by 0.35.

Cooking food is an adaptive behavior that reduces disease and alters nutrition. It was the gradual exploitation of nature for the domestication of monocultural, industrial agriculture with supply chain processing that makes for most food modern people eat including "convenience" foods. This division of labor, whether organic farmer or pseudo-family megafarm, is what renders individual hunter-gathering a waste of time. From this over-abundance of calories and protein, it could support more robust bodies and larger brains, but it's a moot point considering obesity and the inevitability of the technological singularity.

</comment></comment></comment><comment><USER6> Regarding brain size, there is a very nice TED talk:

[http://www.ted.com/talks/suzana_herculano_houzel_what_is_so_...](http://www.ted.com/talks/suzana_herculano_houzel_what_is_so_special_about_the_human_brain.html)

The speaker argues that while there are animals with brains bigger than ours, their neuron density is lower; overall, humans have the highest number of neurons. She goes on by noting that the energy that the brain consumes depends only on the number of neurons, not the size, thus making humans the species that has the most energy-hungry brain. This leads to some interesting theories on how the evolution of our brain is related to our nutrition habits, which I found quite mindblowing.

</comment><comment><USER7> A way to test this hypothesis: elephants and certain whales have bigger brains than us. By the article's reasoning we should find mechanisms in these animals' brain which prevents neurons from "untethering".

<comment><USER8> I like your gist of putting the hypothesis to test, but there are serious practical factors that would prevent your proposed experiments. Small- and medium-sized mammals (e.g., rodents and primates, respectively) are somewhat convenient for experimenting in that they can be housed/fed humanely and fit into an fMRI machine whose aperture is ~0.5 meters in diameter. I do not see how one could reasonably do the same for elephants and whales.

But let's do a thought experiment and see if we can reasonably dispense with the need for experiment itself. The article (via the researchers' statements) zoomed past a detail: cortical surface area is much more indicative of neural processing capability than gross brain volume. In many contexts, a neuroscientist might use "brain size" as shorthand for cortical surface area. Also consider that more "advanced" mammals tend to have more convoluted cortexes, thus larger cortical surface areas. So it's quite possible for a large mammal's (whale's or elephant's) brain to be volumetrically larger than a human's, but to have relatively smaller surface area because it is less convoluted.

In the event that we could actually accomplish such a comparative study as you propose, we'd probably find that "tethering" does not monotonically increase with surface area. Then we'd determine that the authors' hypothesis is overly simplified.

</comment></comment><comment><USER9> For those of you comparing animal brains to human brains and how it relates to consciousness and intelligence take a look at the "Cambridge Declaration on Consciousness." (signed on July 7, 2012)

</comment><comment><USER10> ... it's just how you use it</comment>


NordVPN confirms it was hacked - <AUTHOR> https://techcrunch.com/2019/10/21/nordvpn-confirms-it-was-hacked/ <comment><USER2> > _The attacker gained access to the server — which had been active for about > a month — by exploiting an insecure remote management system left by the > datacenter provider, which NordVPN said it was unaware that such a system > existed._

This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to worry about my own infrastructure security but also worry that my IaaS provider hasn't installed some backdoor to my servers?

<comment><USER3> Sounds like an iDRAC exploit (assuming Dell servers).

But, yes, remote management is pretty common in datacenters. The fact that NordVPN wasn't aware of them just shows incompetence.

<comment><USER2> How the hell do you pwn a server with iDRAC?

<comment><USER4> Oh, IPMI and friends are a total mess. Some implementations allow one to take control of a running server remotely especially if they use a shared ethernet for management ( popular in supermicros ). I once had our security geek demonstrate it by taking over the running server, rebooting it using network emulated USB stick, adding a file into /etc and rebooting the server again.

In secure environments one pulls IPMI module from the server or only uses the modules that have their own dedicated NICs that have to be wired to their own management network.

<comment><USER5> The first time I booted a server using a virtual CD-ROM (iso on my laptop shows up as a hardware CD-ROM on the server) over IPMI I was simultaneously relieved (because I could fix the machine remotely) and absolutely totally horrified.

</comment></comment></comment></comment></comment><comment><USER6> If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your own VPN on something like DigitalOcean. And it uses WireGuard!

[0] [https://github.com/trailofbits/algo](https://github.com/trailofbits/algo)

<comment><USER7> If you already have a DigitalOcean droplet up and running and you have ssh access, you can use sshuttle [0].

e.g. run this from the command line:

      sshuttle -r example.com 0/0 -x example.com --dns

[0] [https://github.com/sshuttle/sshuttle](https://github.com/sshuttle/sshuttle)

<comment><USER8> OpenSSH also includes a SOCKS proxy which you can use with no additional software: [https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content- fil...](https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-filters/)

Whether it grants you any significant anonymity is debatable, but it works well for evading content filters and tunneling your traffic onto a more trustworthy network.

<comment><USER9> Speaking from experience, sshuttle is way easier and more robust than using OpenSSH's built-in SOCKS proxy.

</comment></comment></comment></comment><comment> safeplanet-fesa What about the data-mining and selling infrastructure of NordVPN, known as Tesonet? Are those intact? Also interesting to know how their legal departments are doing, such as the Panamanian shell and the Lithuanian headquarters.

[http://vpnscam.com/wp- content/uploads/2018/08/2018-08-24-09_...](http://vpnscam.com/wp- content/uploads/2018/08/2018-08-24-09_09_14-Window.png)

[http://vpnscam.com/hola-vpn-and-nordvpn-partners-in-data- min...](http://vpnscam.com/hola-vpn-and-nordvpn-partners-in-data-mining-bot- network/)

[http://vpnscam.com/nordvpn-protonvpn-proton-mail-owned-by- te...](http://vpnscam.com/nordvpn-protonvpn-proton-mail-owned-by-tesonet-ceo- darius-bereika/)

<comment><USER10> Thanks for sharing these. I was familiar with the Protonmail business but did not know this all connected to a bigger picture. I never trusted NordVPN... they spent way too much money on advertising and snake oil advertising at that, focusing on meaningless numbers and distractions.

Hopefully you don't have similar news to share about Mullvad...

<comment><USER11> The claims about ProtonVPN have been disproven.

<comment><USER12> I would like to hear more about this. Could you share some information?

<comment><USER13> Just search for proton in this thread. They've explained what happened themselves.

Besides, the argumentation from that vpnscam website and its followers reminds you of the typical conspiracy retards that follow Trump.

<comment><USER10> In no world is it excusable to have your ostensible competitor sign your binaries or certificates. They can make all the excuses they want, but it doesn't dissolve their incompetence, and shows they are unfit for running such a user-critical business.

<comment><USER13> No third party signed their certificates. Just a contracted employee who worked for Tesonet typed in his company name instead of ProtonVPN. That's just the Android keystore, nothing else. Google supports keystore rotation only starting with Android 9.

<comment><USER14> It's actually not even a contracted employee actually. It was a Proton employee who in 2016 was getting payroll through another company before we had our own corporate entity. Keystore rotation is still not yet available yet in Android, so the old key (which we solely control) can't be changed or modified. Android actually also hashes with the certificate metadata so even that can't be edited separately.

<comment><USER10> On principle I am not impressed with what happened and I think it's very sloppy. After the Lavabit fiasco we have to be extra scrutinuous about the leadership in privacy-oriented companies. That said, I still have a few accounts with Protonmail and I think the service itself is pretty good.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> NordVPN just posted this a few minutes ago: [https://nordvpn.com/blog/official-response-datacenter- breach...](https://nordvpn.com/blog/official-response-datacenter-breach/)

<comment><USER16> They wrote:

> _We […] started creating a process to move all of our servers to RAM, which > is to be completed next year._

What does "RAM" mean here?

<comment><USER17> I guess that all decryption keys are on ram. If the power is disconnected, then it would need a manual intervention to re-decrypt the data

</comment></comment></comment><comment><USER18> What this article is missing is that the hackers had root access and had NordVPNs private key for their HTTPS cert for several months in 2018. This went undetected for months and they're only now publically admitting what happened due to press attention. Their public response seems to be "it's not a big deal guys, mitm is hard".

 _> The key wasn't set to expire until October 2018, some seven months after the March 2018 breach_

[https://crt.sh/?id=10031443](https://crt.sh/?id=10031443)

And here's a dump of their logs: [https://share.dmca.gripe/hZYMaB8oF96FvArZ.txt](https://share.dmca.gripe/hZYMaB8oF96FvArZ.txt)

<comment><USER19> Why isn't anybody in journalism publishing this? Really, they're scammers!

</comment></comment><comment><USER20> Someone is probably going to ask what other HN users recommend as an alternative. Personally, I use Private Internet Access because they're the only provider I've found with a track record of demonstrably not being able to turn your records over to someone asking for them [1].

[1] [https://torrentfreak.com/private-internet-access-no- logging-...](https://torrentfreak.com/private-internet-access-no-logging- claims-proven-true-again-in-court-180606/)

<comment><USER21> I am surprised why isn't anyone suggesting Cloudflare's Warp VPN? Genuinely curious what is the difference. I guess Clodflare one is only for mobile?

<comment><USER22> Cloudflare's Warp is not an anonymising VPN as far as I know. It is just a way to speed up Internet speeds, especially in poorly connected areas. They make no effort to hide the origin IP. So it is not in the same class as other VPN providers.

<comment><USER23> This is interesting to read that Cloudfare is suggested here... shows that the term VPN is still thought of as private. (I know it is Virtual Private Network - but the termination is almost never private).

</comment></comment></comment></comment><comment><USER24> _> NordVPN said it found out about the breach a "few months ago," but the spokesperson said the breach was not disclosed until today because the company wanted to be "100% sure that each component within our infrastructure is secure."_

So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully contained.

I wonder when that sort of thing will become a criminal offence.

<comment><USER25> Sorry for posting under top comment, but I think it is very important.

Official response hides fact OpenVPN CA keys also leaked, so attacker could impersonate any other NordVPN server: [https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa...](https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa36f16059a629eea/raw/e4e4af26e4c411d32bbc6bd3ba26301c2ae074bd/nordvpn.txt)

RADIUS secret key also leaked, so propably it is possible to break into EAP session which infers session secret key for StrongSwan.

<comment><USER26> Also allowing historical sessions to be decrypted.

<comment><USER27> Also looks like NordVPN has been misleading customers about the number of servers they have (or didn't make clear they were VM/containers).

<comment><USER28> I don't think they ever wrote anywhere that they have 6,000+ physical servers. Calling a VM (like an EC2 instance) a server is not unusual. For the customers it was important that the resources, bandwidth and different IPs were available. For that it doesn't matter if it's a physical server.

</comment></comment></comment></comment></comment><comment><USER3> This is always topical: Don't use VPN Services

[https://gist.github.com/joepie91/5a9909939e6ce7d09e29](https://gist.github.com/joepie91/5a9909939e6ce7d09e29)

<comment><USER29> > Your IP address is a largely irrelevant metric in modern tracking systems.

I don't believe this for one second.

Your IP address on its own is not sufficient to identify you. That doesn't mean your IP address is not _helpful_ in identifying you.

If you have Javascript disabled, it is a heck of a lot easier to identify you with a combination of an IP address, user agent, and OS than it is to identify you without the IP address cutting down the pool of potential visitors.

On top of that, if you're targeting me and do a geo-location of my IP address, it will get you within 5 miles of my house. That's close enough that you'll know which county I'm in, which with a few other easily-obtained pieces of information will let you pull up my voter registration, which will give you my exact street address.

Of course, you could mitigate this by setting up your own VPN on something like Linode, but unless you're regularly rotating IP addresses, you've just traded a pseudo-identifier that multiple people/devices share for a persistent identifier.

This argument comes up all the time, and I have never heard anyone explain it in a way that passes my sniff test. If you want me to stop using a VPN, you need to do a lot better than just claiming that IP addresses don't matter -- you need to show some kind of evidence to back that up.

<comment> orbital-decay If you have Javascript disabled, it is a heck of a lot easier to identify you because you're one of the very few who disabled Javascript.

<comment><USER29> Eh. If you're enabling JS because you think it's going to help you blend into the crowd, I am skeptical that you understand how powerful JS fingerprinting actually is, particularly around cache abuse and super-cookies.

You don't need to go all the way, but the very least I would advise turning on the resist-fingerprinting config in Firefox. At a minimum, block things like canvas/webGL. You're making yourself more identifiable by doing so, but the alternative is worse.

Now, if you're not using a VPN, and you're in a rural area, and you're on Linux/Firefox with Javascript disabled -- sure, I definitely buy that I could do some pretty decent correlation with that info. That's why VPNs (for all their flaws) still matter.

<comment> orbital-decay Sure, I do understand that, and yes IP hiding does matter. I'm merely pointing out that disabling Javascript (and eventually enabling some set unique to you, to un-break a broken site) is just another way to leak some bits one might want to be aware of. Faking the common fingerprinting vectors known to expose you uniquely is possibly a better way... until the new ones are found. I don't know. The leaking bits need to be carefully accounted for, and you don't know the site userbase for sure to blend into the largest cluster possible. I don't think that fingerprinting is something that can be fought by the end user efficiently, besides the very obvious things like blocking the major vectors.

<comment><USER29> That's a good point.

> Faking the common fingerprinting vectors known to expose you uniquely is > possibly a better way...

I wish there was more research being done around this. I appreciate what Firefox is doing, and I assume there are good reasons for their fingerprinting strategies. They know more than me about this stuff. But... it still sets off some alarm bells in my head. It seems like it would be strictly better to spoof location/canvas/microphone data instead of only blocking it.

</comment></comment></comment></comment></comment></comment><comment> _-___________-_ I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers.

<comment><USER30> Well, you're funneling your traffic through a single entity in almost _all cases_ , right? So I view it more as, who do I distrust more? My ISP or a VPN?

I don't use a VPN provider, but it's tempting as I don't trust my ISP at all.

<comment><USER31> One very explicit reason to not trust your ISP with your internet traffic is that since 2017 [1], they are allowed by Congress to sell your internet history.

As a cherry on top, they were also the ones that successfully lobbied the government to allow that in the first place [2].

[1] [https://www.privateinternetaccess.com/blog/2017/03/house- rep...](https://www.privateinternetaccess.com/blog/2017/03/house- representatives-votes-215-205-away-broadband-privacy-allow-isps-sell-private- internet-history/) [2] [https://www.privateinternetaccess.com/blog/2017/02/internet-...](https://www.privateinternetaccess.com/blog/2017/02/internet- service-provider-isp-lobbied-fcc-permission-spy/)

<comment> _-___________-_ To be fair, they can't actually see more than hostnames & IP addresses (assuming the use of TLS, which is becoming ubiquitous), so implying that they sell your "Internet history" makes it sound worse than it is.

I've always assumed VPN providers sell whatever data they can too.

<comment><USER32> I'm not a network expert, but doesn't TLS just cover your connection with a specific website? Since your IPS is often also your DNS, can't they still see which specific websites you're trying to connect to? Wouldn't TLS just obfuscate what you're specifically sending to and receiving from that site? I'm under the impression that my ISP can (and probably does) see every website I visit, which is in the least browsing history.

I also remember that Comcast did (and might still do) inject code onto websites to display a "pop-up" indicating that you're reaching or have reached your datacap. It would even pop up on Steam because most of Steam is really just a webview. I'm not sure exactly how they did/do that.

Again, I'm not a network or security expert, so I'm not really sure of how TLS protects your internet history, which I take to mean a list of websites you visit and when.

<comment><USER33> That's what the parent said: they can still see "hostnames and IP addresses."

But, for most people, that means that the ISP will just see:

• google.com

• facebook.com

• reddit.com

• somebignewspaper.example.com

Etc.

And there's really nothing much too valuable about that. They won't even be able to figure out if you're shopping for something (unlike every other nosy channel provider), because most shopping traffic today just looks like Google + Amazon.

<comment><USER34> Please don't underestimate the value of metadata.

While it's true that the big platforms dominate web use today, don't forget that the concept of metadata includes _when_ you actively surf on the information superhighway. That's valuable information for advertisers.

So is every DNS lookup related to the API backends of specific apps you use. And every random website outside the massive platforms.

These might reveal tons of information about you. Like:

Are you doing research on politics (and which flavor)? Do you worry about health? When do you access online banking? Which banks? Any tax filing software? Invoicing apps? Do you use shitty payday loans? Are you looking for dates? Are you gay? Which games do you play? Which car dealerships do you consider? Do you gamble? And of course, any particularly.. specific porn sites? Do you access banking, travel/flight booking, investment, shitcoin trading, adult or gambling sites in a specific pattern that might indicate mania or other mental health issues?

With metadata alone, your ISP has a thick dossier on your habits, with stuff therapists don't know about their clients.

</comment></comment></comment></comment></comment></comment></comment><comment><USER35> Nord (and perhaps others) seem to have been compromised for months/years - lifetime accounts have been available on the DN for significantly cheaper than other VPNs: [https://news.ycombinator.com/item?id=20094946](https://news.ycombinator.com/item?id=20094946)

Doesn't seem like a smear - glad this is coming to light.

<comment><USER36> Nord specifically has a retailer system, I wonder if accounts can be created 3rd party and sold greymarket like that without any nefarious hacking scandals?

</comment></comment><comment><USER37> Maybe they should spend more money on security than throw at people like PewDiePie to advertise them ... by also giving false claims like protecting you from hackers and making you magically "secure", whatever that's supposed to mean. Doesn't give the impression they know what a VPN actually is. Considering that most likely the phrasing comes from NordVPN themselves I always questioned them as a whole. Good to have some positive feedback (from my point of view) on that now.

</comment><comment><USER38> It's odd that NordVPN, VikingVPN and Torguard all got their private keys leaked here.

\- Did the hackers use an SSH or a VPN service vulnerability?

\- Or maybe even a previously unknown vulnerability?

\- Was SSH access firewalled? If not, why?

\- Do they still have root access?

<comment><USER39> A lot of them shared physical infrastructure definitely less odd that multiple were breached at same time.

<comment><USER40> I was just thinking yesterday that people might be overly paranoid about that, I've always agreed that if security were important you shouldn't share space but lately I've begun to question it since a lot of these data centers are pretty carefully controlled.

I'm glad I didn't speak my mind on that I guess since I was wrong.

</comment></comment></comment><comment><USER41> This is so well timed, I just bought a 3-year subscription to NordVPN and they have a 30 day refund policy.

<comment><USER42> You should probably ask for a refund, then set up your own VPN.

Commerical VPNs are, for the vast majority of cases, simply not a good bet for your privacy. You're changing your network traffic path from a diffuse and byzantine series of paths to once centralized collection point. The payoff for an attack on a VPN rises very quickly. Meanwhile, you're also conditioning yourself to say, "My traffic is secure while my VPN is on."

It's not a great combo.

<comment><USER41> I thinking about spinning up a Digital Ocean droplet and rolling my own right now

<comment><USER43> I'd keep in mind that cloud providers have well-known IP blocks that can sometimes be rate-limited by various internet sites/services, primarily to combat botting. You might inadvertently get caught in the IP range that's being actively rate limited by e.g. Instagram. YMMV.

</comment></comment></comment></comment><comment><USER44> I can't help but notice that NordVPN is one of the most heavily advertised VPNs from what I've seen (which raises the question, as one researcher pointed out in the article - are they not spending enough money on their security and infrastructure to protect their users?). They are claiming that: "no-one could know about an undisclosed remote management system left by the [data center] provider".

Apparently the hacker was able to find out - so while it may be unknown, it's not an impossibility to detect it. Beyond whether or not sensitive information was accessed, what will NordVPN do in the future to eliminate or mitigate the possibility that this will occur again?

<comment><USER34> I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide.

While I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data, I think NordVPN really overplays the role of changing IP addresses in the age of browser fingerprinting.

<comment><USER45> > I find NordVPN's marketing reprehensible.

A claim that really, really bothered me was something along the lines of "use us and no one will be able to read your email!" Every mainstream email provider (Google, Yahoo, Microsoft, Apple) now require HTTPS for emails. No one was ever going to be able to read your emails.

<comment><USER34> I normally don't mind YouTube ads all that much, and I don't see them on desktop browsers anyway.

However, I was bombarded with ads for NordVPN and their crap made me so angry it pretty much sold me a paid YouTube membership.

Hard to relax with some _totally not weird_ ASMR when my blood pressure is through the roof because some chirpy ad agency dude wants to show me how much a VPN is like an umbrella or whatever.

<comment><USER46> > However, I was bombarded with ads for NordVPN and their crap made me so > angry it pretty much sold me a paid YouTube membership.

For me it was those incessant Grammarly ads. A service, by the way, that has its own serious security and privacy concerns[0].

(I feel like YouTube Premium ($18/mo for up to 6 people) is a better deal than Spotify Premium ($15/mo for up to 6 people) for a household like mine where we listen to a lot of music _and_ use YouTube a lot. I don't know how YouTube compares to Spotify when it comes to music selection however.)

[0] [https://news.ycombinator.com/item?id=16315684](https://news.ycombinator.com/item?id=16315684)

<comment><USER47> I'm torn for this reason: I want to avoid ads, but I don't want to give Google any more money. It's unfortunate that YouTube is really the only one of it's kind.

For the moment, I get around this conundrum using a combination of uBlock Origin[0] (Firefox) and NewPipe[1] on Android. Not 100% sure what I'll do about the latter when I switch to iOS.

[0] [https://github.com/gorhill/uBlock](https://github.com/gorhill/uBlock) [1] [https://newpipe.schabi.org/](https://newpipe.schabi.org/)

<comment><USER48> You don't have ad-blockers on all devices or for their app. I'm on iOS and I like using the app since Premium allows for playing stuff in the background, plus downloading stuff for offline viewing. You can't get that in Firefox with uBlock.

I find some of the anti-Google arguments to be really, really weird and I've been speaking against Google on this website countless of times.

If you don't want to be tracked, you're going to be tracked for as long as you're a free user. uBlock Origin will not save you, since you're on their website and you can't block "youtube.com".

Also Google is a big target and subject to laws such as GDPR. I actually trust Google more than I trust any startup advertised on HN, because Google is a big target with a lot of eyes watching. When you go to your profile and turn off the data collection, you can probably trust Google more than you can trust DuckDuckGo.

This isn't to say that you should trust Google. Not what I'm saying.

But paying a membership is voting with your wallet against ads. By not paying you're simply encouraging them to serve more ads. And the break you're getting via uBlock Origin is only temporary. If the audience using ad-blockers on Android grows, I expect them to simply block browser access, problem solved. And because you used YouTube anyway, it means you haven't payed for their competition either, which means you directly contributed to YouTube's monopoly, without encouraging them to give up on ads in favor of Premium memberships.

It's basically how software piracy used to work. Piracy was never a problem for the big companies like Microsoft, piracy being responsible in part for Microsoft's monopoly. And when piracy became a problem, software companies simply moved to online subscriptions. There's always a solution for milking free loaders later.

<comment><USER49> > I like using the app since Premium allows for playing stuff in the > background

I remember vividly the day (sometime in 2013?) when they removed that feature from the base app. I had been streaming music or casts from YouTube in the background since day 1 of my iPhone 4, and suddenly it became a paid feature.

 _" Bastards"_, I thought with a smile, _" but hey, fair enough! Ok, now where do I pay?..."_

Except that outside of the US, premium wasn't available. So they had removed background play but offered no alternative. It lasted until 2017!! Took them 4 years to bring the premium offer to Europe... what a shame. That fueled some resentment, as a wannabe customer. Any gave more than enough time to find better alternatives (Spotify, youtube-dl...) and never look back.

When they finally introduced premium in my country, I took the free 3 months offer and cancelled immediately thereafter. They don't want my money, 4 years made that emphatically clear.

I may reconsider after 2021, on the condition that management has changed at YouTube and Google. Right now, I'm just not feeling it.

Google is just awful at marketing stuff and customer service. They plain and simple don't care. That's monopoly for us: customers lose, always. So I find it both logical and "the right thing to do" to spend my money to directly support creators and alternative platforms whenever I can.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER50> NordVPN is being recommended a lot to people who don't know better by influencers on social media, especially on YouTube. This kind of endorsement is recklessly negligent and needs to stop.

[https://drewdevault.com/2019/04/19/Your-VPN-is-a-serious- cho...](https://drewdevault.com/2019/04/19/Your-VPN-is-a-serious-choice.html)

Edit: note that I don't blame these influencers for their ignorance on the risks of using a VPN; rather I blame the shady VPN providers for overselling the security value of their product and leading users into a false sense of security.

<comment><USER51> I'm pretty sure they're "recommending" it because they're getting paid for it - it's a sponsor segment. After demonetization became common YouTubers looked for other sources of revenue and there are rather few companies that try to contact them directly for ads, so you see them appear over and over again.

<comment><USER52> Yeah it's diffidently not being recommended, it is being advertised. I wonder how many money they have spend. Every freaking channel mention them at some point.

<comment><USER53> You start to wonder where their money is coming from - their retail prices are already cheap, the discounts the influencers offer make it basically free. How's that sustainable?

<comment><USER51> But do they even have to pay much to youtubers for those ads? If you get 50k to 100k views per video then you'll likely make around the range of $50-$150 for the video. Paying the youtuber $50-$100 per video would already have a significant impact on their income, so they'd probably consider it. That would be 50k-100k people who will see the ad, because adblock can't block it.

<comment><USER54> If somebody is getting $50-$150 per video, they're probably doing it for the passion of making videos, not for the income, and they probably have another source of income that dwarfs what they're getting from youtube.

<comment><USER51> Not necessarily. If they put up a video every day then that's $1500 a month minimum. That's decent income in most countries, even in many EU ones. Now imagine if sponsor segments doubled that for you - now it's $3000 a month, which is already on the lower end of decent even in the richest countries.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Two days ago I deleted my old Digital Ocean VPN (built using the OpenVPN tutorial I found somewhere), then opted for a discounted 3-year NordVPN plan. Looks like I'm going to have to ask for a refund. _facepalm_.

</comment><comment><USER55> "On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connection that tried to access NordVPN."

If I had root, can't I just find out what crypto libraries are in use? and trigger an uprobe to decrypt the traffic on that crypto library ?

Every user connection handled by that vpn server would have been plain text for me.

I think they are downplaying the importance of this hack

</comment><comment><USER56> "no-one could know about an undisclosed remote management system left by the [data center] provider"

Why not? I'm generally familiar with the services offered by dedicated- server/co-lo/vps providers, and remote management systems are very common. This includes out-of-band (OOB) access when using dedicated systems. Seems like the sort of thing that solid due diligence would pick up. Even if it's completely undocumented, designing a robust security checklist to be completed by the vendor should find this sort of thing.

This excuse also makes NordVPN look extremely bad for future use: If you say "nobody could have known" then you're also saying "it could happen again" because if you can't know about it, you can't know if other vendors do the same. If you can stop it from happening in the future by implementing additional measures, that means those additional measures could have been used to prevent it the first time. So either you're inherently unsecure, or the issue was preventable.

</comment><comment><USER57> Did NordVPN know about this hack when they were offering their deal for something like $88 for 3 years? I went back and looked at their prices from 2017 and it was something like $69 to $83.99 billed annually ([https://www.pcworld.com/article/3200777/nordvpn-vpn- review.h...](https://www.pcworld.com/article/3200777/nordvpn-vpn- review.html)). I've been a NordVPN customer for a while but have been thinking of switching due to some articles touching on nefarious marketing practices and/or questionable data practices. Then I see this deal for $88 for 3 years and it was tempting to re-up. Coincidentally, when the deal ran out the news broke several days later about the hack. I for one will be finding a new VPN provider, but I can't help to think they were trying to rope in as many existing customers as possible before news of the hack broke. Suspect at best.

</comment><comment><USER58> There's a bittersweet irony with this story. They were recently pushing ads claiming that "Ain't no hacker can steal your online life. (If you use VPN)."

The ad has since been deleted :D

</comment><comment><USER59> Lots of talk here from highly technical folks but not one person brings up the fact that these are expired keys - as in not usable?

I understand that the fact that these keys were obtained is concerning but the security of nord and etc prevailed at the end of the day.

The question is: were they leaked before they expired or long after?

<comment><USER60> They were leaked on March 2018 [0][1], and they expired on October 2018 [2].

[0] [https://web.archive.org/web/20180504001844/https://8ch.net/b...](https://web.archive.org/web/20180504001844/https://8ch.net/b/res/7948898.html)

[1] [https://nordvpn.com/fr/blog/official-response-datacenter- bre...](https://nordvpn.com/fr/blog/official-response-datacenter-breach/)

[2] [https://crt.sh/?id=10031443](https://crt.sh/?id=10031443)

<comment><USER59> > However, the key couldn't possibly have been used to decrypt the VPN traffic > of any other server. On the same note, the only possible way to abuse > website traffic was by performing a personalized and complicated MiTM attack > to intercept a single connection that tried to access nordvpn.com.

However crt.sh shows

> Validity > Not Before: Oct 6 12:53:38 2015 GMT > Not After : Oct 6 12:53:38 > 2018 GMT

What exactly were these keys for if they were only usable in such a manner according to nord?

<comment><USER61> Nord has a couple thousand severs, and each has their own key. In order to decrypt traffic, you'd have to intercept some traffic to decrypt, which would require a MitM attack unless you're an ISP/state actor.

</comment></comment></comment></comment><comment><USER62> [https://twitter.com/hexdefined/status/1186214904132300800](https://twitter.com/hexdefined/status/1186214904132300800)

The thread indicates that VikingVPN and Torguard were also compromised at some point. Highly concerning.

</comment><comment><USER63> I guess it depends what you want from your VPN.

When I want to secure a shady connection in a coffee house, I have a raspberry 3 at home that I use only for that purpose with an openVpn setup with [https://www.pivpn.io/](https://www.pivpn.io/) \- super easy to use. Downside, I rely on my isp not to spy on me. Upside, it's mine and unless I'm specifically targeted it's unlikely someone will mitm me.

To hide my location for various purposes, I have used TigerVPN. They have been reliable so far, but I wouldn't trust entirely any third party when it comes to privacy. Upside - somewhat reliable and not my isp. Downside - for all I know someone in Czech Republic is watching what I stream with a bucket of popcorn

</comment><comment><USER64> [https://nordvpn.com/blog/official-response-datacenter- breach...](https://nordvpn.com/blog/official-response-datacenter-breach/)

</comment><comment><USER65> More worrisome is that this may allow old cptures to be decrypted, anyone know of VPN providers that use PFS?

<comment><USER27> Private Internet Access is PFS (using DHE - Diffie Hellman Ephemeral).

</comment></comment><comment><USER66> A while ago I read that there was a potential smear war going on between some of the larger VPN providers. Is there any chance that this is related? (I'd prefer more than just a tweet)

</comment><comment><USER67> This sounds suspiciously like the Supermicro BMC bug reported here a while back[1], and while it actually can be hard to make sure the IPMI stuff doesn't take over a NIC you don't want it to[2], there are things you can do to prevent that, such as explicitly setting IPMI interface and address information so it won't use "smart" behavior to negate all your security.

As to whether "no-one could know", well, _I_ knew after I read that HN submission, and at work we made sure to double check all our configs. This ended up being mostly a known problem, but the extra context helped us find another edge case I believe.

It's not great that you have to be aware of the latest security problems _and how they may interact in obscure ways with system configs_ , but that's the nature of security and state of the industry right. Not much to do except buckle down and pay attention. To everything.

1: [https://news.ycombinator.com/item?id=20870686](https://news.ycombinator.com/item?id=20870686)

2: [https://news.ycombinator.com/item?id=20872084](https://news.ycombinator.com/item?id=20872084)

</comment><comment><USER68> Apart from deanonymizing customers and potentially reading the traffic of customers they sent over the VPN what are other risks for customers?

What I'm thinking about is that the VPN essentially tunnels through my firewall so a malicious VPN provider may possibly be able to do things that, for example, an arbitrary web server cannot.

</comment><comment><USER69> This is difficult to track, as it is really just a sentence attached to some screenshots, with some commentary but no technical detail... but this seem to be a website key, not an OpenVPN key?

(edit: And, in fact, this is confirmed by NordVPN's statements on the matter: "The expired TLS key was taken at the same time the datacenter was exploited. However, the key couldn't possibly have been used to decrypt the VPN traffic of any other server. On the same note, the only possible way to abuse website traffic was by performing a personalized and complicated MiTM attack to intercept a single connection that tried to access nordvpn.com.")

</comment><comment><USER70> I remember last week's episode on Darknet Diaries where NordVPN was offering 3y plans for a hefty discount. My first reaction was "Are they going out of business ?"

This week's news lets me make sense of that ad.

</comment><comment><USER71> So what does this mean for an every day consumer? I had been debating using the 30-day money back guarantee as I realised I didn't use it as much as I thought I would. I want to stay protected on public Wifi. Added anonymity occasionally would be good too, as well as accessing US Netflix from here in the UK.

Now my 30 days is up. What would be the best course of action? Should I email and say that I'm not comfortable being their customer any more, and asked to be reimbursed? Carry on, for my use case? I'd never connected to a Finnish server.

<comment><USER72> It's so hard to understand what is correct (I'm aware this is a problem with every news story) between the people telling me that they're almost certainly evil, keeping logs and selling data and those that are telling me that it's a smear campaign by the competing VPN providers.

My gut tells me that the level of advertising and incredibly low prices is too good to be true...

Now with this hack it's the same problem, how bad is it, does it affect me and should i be concerned?

</comment></comment><comment><USER73> Why would their website's SSL certificate be on one of their VPN servers? Do all of their current 3000 servers have the private key for their website right now?

<comment><USER25> OpenVPN CA key also leaked: [https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa...](https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa36f16059a629eea/raw/e4e4af26e4c411d32bbc6bd3ba26301c2ae074bd/nordvpn.txt)

<comment><USER74> oof

</comment></comment></comment><comment><USER16> See also: [https://news.ycombinator.com/item?id=21311475](https://news.ycombinator.com/item?id=21311475)

</comment><comment><USER75> I'm frankly blown away that the comments I'm seeing here don't suggest to just roll your own.

$5/mo is the typical price nowadays for a 1 GB VPS with 1TB upload. Cancel at any time. Save image, redeploy monthly/weekly/daily to protect from longer term IP address tracking. Use scheme of your choice (e.g., SOCKS proxy, VPN, standard HTTP port for everything, etc.)

</comment><comment><USER76> I like Mullvad

<comment><USER77> I'll second this. They also allow you to pay in cash which I think is an aspect of privacy that a lot of VPNs overlook.

</comment></comment><comment><USER78> People have been talking about using VPN's because of "dangerous" public wifi, but I have to admit, I don't understand the risks.

Let's say you go to a coffee house and sign-in to their wifi with their password and use it browse https websites, like gmail or you favorite social media... what's the main risk? What can happen? What _does_ happen?

<comment><USER74> The primary concern is MITM attacks I'd presume.

<comment><USER79> OP specified HTTPS, so MITM is a non-issue.

DNS leakage maybe?

</comment></comment></comment><comment> pickle-wizard I only use NordVPN to get around GeoIP blocks on a couple of streaming apps. So I'm not too worried about my data being compromised, but I don't like the way they handled this. Think I'll start looking for another provider?

Looks like you can side load OpenVPN onto a FireTV. Maybe I'll go the roll my own this time.

</comment><comment><USER80> Wasn't NordVPN the one that was created by a marketeer? I wouldn't be suprised if this was just cover for them to sell their customer's data indirectly. If anybody finds a dump of the data they sold they could just claim it was from the breach.

</comment><comment><USER81> Wow. Just switch per advice of lihkg! How serious? Seems all tech talk but not impact talk

<comment><USER82> > How serious?

From my understanding, that really depends what you're using it for. My friends mostly use Nord to get around region locks for Netflix etc. I think impact for them is minimal.

If you were using NordVPN in Hong Kong, to cover your involvement in the protests, then it could be a lot more serious. I wouldn't use Nord (or any comparable provider) for that anyway, since their holdings tend to be pretty opaque. That doesn't mean nobody did use it for stuff like that though.

<comment><USER83> I see the Twitter thread mentions:

> _And someone just mentioned to me that past encrypted sessions may be able > to be decrypted, which is a much bigger issue!...I haven 't researched > enough about OpenVPN to know if it's using forward secrecy, though you'd > hope so_

Any idea where that claim is coming from? Nord's site mentions having forward secrecy in place, so presumably _most_ historical stuff is safe unless they botched that. Of course, somebody in e.g. Hong Kong could still have gotten a MitM attack if they were active while these keys were being used, which is reason enough to worry about exposure.

</comment></comment></comment><comment> ga-vu NordVPN blog post, and the source: [https://nordvpn.com/blog/official- response-datacenter-breach...](https://nordvpn.com/blog/official-response- datacenter-breach/)

</comment><comment><USER84> This is a feature in my eyes. Just stack a bunch of these hacked by different people who don't cooperate with each other. Now any user has plausible deniability over anything that happens on these networks. No?

</comment><comment><USER85> Get a VPS and run your own VPN. It doesn't have to be complicated: [https://github.com/jedisct1/dsvpn](https://github.com/jedisct1/dsvpn)

</comment><comment><USER86> The interesting thing about OOB on most modern servers is that its a separate, physical NIC. Not only is that easily VLAN able, a more security conscious datacenter could even air-gap the out of band LAN!

<comment><USER87> > The interesting thing about OOB on most modern servers is that its a > separate, physical NIC. Not only is that easily VLAN able

On lower grade servers OOB is using main NIC. It's still possible (in all implementation I have seen, which is not too many) to have OOB in VLAN.

> a more security conscious datacenter could even air-gap the out of band LAN!

1\. If you air-gap remote management, you take away it's function.

2\. It's not possible to truly air-gap OOB if servers with OOB are not air- gapped (it's theoretically possible to use server to get into OOB network by exploiting/flashing custom OOB from OS).

</comment></comment><comment><USER88> From the amazing service providing "Double VPN" (yes, really) for extra privacy and "Onion VPN" (with the Tor bit being behind NordVPN, not the other way around) for ultra extra privacy!

<comment><USER79> > with the Tor bit being behind NordVPN, not the other way around

This is so dumb that I'm not sure if it's an inside joke or not.

(Looking at you, ProtonVPN.)

<comment><USER14> We are pretty clear though that Tor over VPN is for convenience and not necessarily more security or privacy, depending on your threat model.

</comment></comment></comment><comment><USER89> Any comments about Encrypt.me as a NordVPN alternative?

It looks _much_ more reliable. (from their website; the team's CV's; etc -> i.e.: no hard evidence)

</comment><comment><USER90> Any one knows WHICH server provider in Finland caused this?

Just following the chain because NordVPN says it was this provider who does not told about their security leak?

<comment><USER91> Oy Creanova Hosting Solutions Ltd.

</comment></comment><comment><USER92> Should be ok, after all they dont keep any logs right ?

<comment><USER93> NordVPN doesn't (or so they claim), but the hacker may have been logging activity.

</comment></comment><comment><USER94> This is called karma. People have been using their services to run cyberattacks and NordVPN people do NOTHING to stop them.

This news brings me joy.

</comment><comment><USER95> Just use Cloudflare WARP since it's finally out. You're never really anymous unless it's a lifestyle anyways.

</comment><comment><USER96> NordVPN runs a desktop app with escalated local privileges.

Surely if they were compromised that would be the attack vector for a bad actor.

</comment><comment><USER97> Off topic a bit, what what other VPNs are people using. I have been using ExpressVPN and am very happy with it.

<comment><USER98> Torguard for me, relatively happy with it. Also hideMe was very good too.

<comment><USER99> Per OP article Torguard was hacked to

<comment><USER98> Torguard is contesting the extent of their breach: [https://torguard.net/blog/why-torguards-network-is-secure- af...](https://torguard.net/blog/why-torguards-network-is-secure-after-an- isolated-2017-server-breach/)

</comment></comment></comment></comment><comment><USER100> "It's an older code, but it checks out." :D Sorry, I just couldn't help myself!

</comment><comment><USER101> can't get hacked if you don't use a VPN.

I use sshuttle ([https://www.terminalbytes.com/sshuttle-vpn-over-ssh-vpn- alte...](https://www.terminalbytes.com/sshuttle-vpn-over-ssh-vpn- alternative/)).

</comment><comment><USER102> This is troublesome.

I was planning to eke out $85/ annum and go for NordVPN, but now even this is unreliable

<comment><USER103> Buy a $5/month VPS and run your own VPN on that (popular setup script: [https://github.com/StreisandEffect/streisand](https://github.com/StreisandEffect/streisand)). It'll cost you a little bit of time in setup and maintenance (mostly just upgrading packages), but it has many benefits:

\- Cheaper than most VPN providers

\- You won't be using a known VPN IP

\- VPN providers are more likely to snoop on your traffic or be targeted by snoopers (such as the government), specifically because they seek out traffic from people trying to hide

\- You get to pick the port/protocol/software you use, rather than being forced to accept the provider's ones

\- You can run other small servers you may need on the VPS as well

<comment><USER30> But then your security rests on your ability to manage a server. I mostly agree with you, but, I don't run one because I'm not a seasoned Ops. At least, not enough that I want to put my security on the line.

In all but the most hostile networks I trust another VPN or my ISP more than I trust my ability to keep a server secure.

Thoughts?

<comment><USER104> Some thoughts:

1\. You have to keep _two_ ports locked down. If you can secure your own laptop, you can secure a cloud instance. The cloud instance you're basically just using as a proxy is a lot less important than what's on your phone or computer.

2\. Only you are using the system, and you're not logging. Have an issue? Tear it down and start another. Automated scripts out there generate unique keys every time.

3\. A commercial VPN is a honeypot in a way -- it's a ripe target. Many people are tunneling through it, doing sketchy things that certain parties want to track -- and your traffic could get caught in a dragnet (this, of course, depends on your use case: you may _want_ to blend in).

4\. Your ISP tracks and sells your data. I mean, the entire reason I use a VPN is because I was sick of my ISP routing my searches through their servers before my intended search destination, snagging my Netflix info and using it to create advertising profiles. Why would you trust them?

5\. It literally takes less than 10 minutes (5:59 from an _iPhone_ , the last time I launched one) to launch and connect to your own VPN instance to play with ([https://github.com/jenh/sevenminutevpn](https://github.com/jenh/sevenminutevpn) is mine, but there are others, like Streisand or Algo) -- if nothing else, you become a more educated consumer and can better understand your threat model AND what to look for in a paid provider.

<comment><USER105> > You have to keep two ports locked down

That's what NordVPN thought as well

<comment><USER104> I would hope that isn't what they thought and I'm _sure_ it's not what they thought.

Launching a personal-use ephemeral cloud instance running OpenVPN to hide your personal traffic from your ISP _is absolutely nowhere the same_ as running a paid VPN service for millions of users across the world.

</comment></comment></comment></comment></comment></comment><comment><USER106> There are quite a lot of anti NordVPN and VPN in general experts pontificating here. A quick scroll down through all comments and I note a distinct _lack_ of green handles.

This is a 500+ comment article with hardly any near null comment commentards. My analysis is not very rigorous.

</comment><comment><USER107> >trusting companies outside of EU jurisdiction Literally your own fault

<comment> ju-st Or trusting companies only known because of extensive marketing.

</comment></comment><comment><USER108> Security has never been priority for any of these public VPN providers.

</comment><comment><USER109> ProtonVPN uses Nord servers infrastructure right? Were they affected?

<comment><USER14> No, that is not true. We run our own infrastructure for ProtonVPN and also own the hardware for our core servers: [https://protonvpn.com/support/secure-core- vpn/](https://protonvpn.com/support/secure-core-vpn/) This can be verified by inspecting our VPN endpoints which are all public.

We have no connection with Nord or any other VPN. ProtonVPN is however owned and operated by ProtonMail, with some support from the European Union.

<comment><USER109> Cheers, glad you cleared that up. I must have gotten bad info. Love all your services!

<comment><USER14> No worries. Transparency is important to us so we're always happy to answer questions.

</comment></comment></comment></comment><comment><USER110> NordVPN subscriber here, I just use DSVPN now. Simple and works.

</comment><comment><USER111> Could this be another marketing trick to lure more customers? Last time I checked, companies are actually favourable when they "get slightly hacked". They get front page from top tech websites, magazines, forums...

</comment><comment><USER112> How feasible is to run and administer your own VPN in cloud ?

</comment><comment><USER113> Wonder if there will be a class action.

</comment><comment><USER114> what can a paid vpn service provide that you couldn't get with free / open source tools?

</comment><comment><USER115> ROFL at the ads

</comment><comment><USER116> The best thing NordVPN can do right now is make a statement that clearly and honestly describes how its users are affected. No bullshit marketing language, no trying to hide facts, just a short and simple explanation of what this means for users and what they should do next.

<comment><USER117> Truth is - if hackers did a MIM attack and collected a bunch user traffic (for how long?) they could have everything.. banking info, emails, logins...

at this point if i was a user of that VPN service - i'd be replacing all of my sensitive passwords, secret questions/answers to key accounts.

<comment><USER118> MitM-ing a VPN does not break HTTPS. Hence, any passwords send over HTTPS are still safe. You could speculate that a VPN MitM is a nice way to get an MitM position for a further attack on TLS. But that requires a lot more speculation.

What isn't safe is your browsing history. True, any HTTP data isn't safe, but trusting that to be safe is baaaaad anyway.

In short. This leaked browser behavior, and _could_ be a single step in getting a MitM possition on users.

<comment><USER54> NordVPN's advertising has deliberately downplayed the significance of HTTPS, as part of their fear mongering campaign about public wifi and residential ISP connections, so it's not really surprising to see such misconceptions raise their heads when NordVPN screws the pooch like this.

</comment></comment></comment></comment><comment> yjftsjthsd-h @dang or mods - I'm surprised that this isn't merged with [https://news.ycombinator.com/item?id=21311475](https://news.ycombinator.com/item?id=21311475) ; is there some special value in keeping them separate?

<comment><USER119> No, we just hadn't seen it yet. They're merged now.

If you want to let us know about something, it's best to email firstname.lastname@example.com. We don't see all the comments—I only saw this one by accident—but we do see all the emails. (Well, except possibly a few that go into spam. We comb through the spam folder and rescue most, but a few with unfortunate subject lines probably get missed.)

<comment> yjftsjthsd-h Thanks and noted. I sorta assumed that you had an alert on "@dang" or "@mods" or so, but I will keep that in mind in the future.

</comment></comment></comment><comment><USER120> This is the last time I trust a product endorsement from the Angry Videogame Nerd.

</comment><comment><USER121> If you're reading this and wondering which VPN service you should use to stay safe, start reading here: [https://faq.dhol.es/@Soatok/cryptography/which-vpn- service-w...](https://faq.dhol.es/@Soatok/cryptography/which-vpn-service-will- protect-me-from-hackers)

(Spoiler: You're asking yourself the wrong question.)

<comment><USER122> Why does the linked suggestion say "Don't use an Android phone, use an iPhone instead."

<comment><USER121> Ask tptacek and idlewords?</comment></comment></comment>


One Minute Reads for Writers – 30 Posts in 30 Days - <AUTHOR> https://medium.com/1-one-infinity/one-minute-reads-for-writers-30-posts-in-30-days-6b781fb9cf22 <comment><USER2> "These are all friend links — because I love you — so you will be able to read them whether you're a member of Medium or not."

Promptly got told off by Medium for not having an account and that I'd hit my quota of "Member Previews"

<comment><AUTHOR> No idea why that happened. All links are friend links. This should be the friend link for the post: [https://medium.com/1-one-infinity/one-minute-reads- for-write...](https://medium.com/1-one-infinity/one-minute-reads-for- writers-30-posts- in-30-days-6b781fb9cf22?source=friends_link&sk=168034b96f94610f532a2f7786e9152c)</comment></comment>


2048 in bash - <AUTHOR> https://github.com/dlthomas/bash2048

<comment><AUTHOR> Had the idea for the sed-based collapsing and wanted to see if it would work. Apparently so.

</comment><comment><USER2> just prints "you lose" :-(.

A shame, I was excited about this.

<comment><AUTHOR> It works for me - where are you running it? I've heard it breaks on OS X, but don't have access to the platform to experiment.

<comment><USER2> Ubuntu 12.04

<comment><AUTHOR> Oh, does it print a board and die when you hit a key? Or does it not even start up? Keys are hjkl, not arrow keys (which, it seems, lead to loss). That might be worth documenting...

<comment><AUTHOR> Confirmed that this was the issue on OS X.

I added a line to the readme...</comment></comment></comment></comment></comment>


Currently, IO.js is faster than Node.js - <AUTHOR> http://www.quora.com/Is-IO-js-faster-than-Node-js?__snids__=814256500%2C814236812%2C814227287%2C814224455&__nsrc__=2&share=1

<comment><USER2> TL;DR: IO.js is faster because it is running an up-to-date version of V8, not because of any optimisations or code contributions that Node does not currently have.

<comment><USER3> Thanks for saving me from reading through that entire article. I spend too much time gleaning lessons from articles and too little time actually making mistakes!</comment></comment>


Australians lead efforts to move space junk with lasers - <AUTHOR> http://www.bbc.com/news/world-australia-29847830 <comment><USER2> Could somebody explain to me (non-physicist) what the principles at play are?

Is it "simply" that they fire a strong laser at the front of the object to slow it down, so that orbital mechanics do the rest and make it burn up?

Do lasers really allow you to "push" things?

<comment><USER3> not a physicist, but an electrical engineer.

At least 2 principles that I know allow a laser to push things:

1) photons do have impulse, given by its energy divides by the speed of light. This causes Radiation pressure (see [https://en.wikipedia.org/wiki/Radiation_pressure](https://en.wikipedia.org/wiki/Radiation_pressure) ) 2) if a laser vaporises part of a structure, the resultant gas will push against the structure, delivering momentum

<comment><USER4> Both principles have an impact, and in this case, I think the second one is the one that causes most of the impulse.

</comment></comment></comment><comment><USER5> Wikipedia tells me that lasers have been considered before to fight off the [https://en.wikipedia.org/wiki/Kessler_syndrome](https://en.wikipedia.org/wiki/Kessler_syndrome)

</comment><comment><USER6> Nice press release- this is all old news. If you know where something is well enough to hit it with a laser, you're probably better off leaving it where it is and tracking it.

</comment><comment><USER7> why don't somebody build a net and a parachute to pull it down with high velocity ?

<comment><USER8> What could work might be a purpose-built spacecraft with a low-power but efficient engine (e.g. ion drive). This spacecraft would align velocities, then touch and bind every piece of space debris along its orbit. Eventually it would snowball enough to just let smaller pieces of debris hit it and stick. After it has become too heavy to maneuver, or when the propellant is depleted, the spacecraft would go down and burn in the atmosphere.

The problem is the way to properly bind the pieces of debris.

<comment><USER9> Sounds a bit like rain formation: nucleation and aggregation. But space is big, and the spacecraft is not attracting anything (too small for gravity to matter). Not sure even a big snowball is going to collect much debris. A solar sail perhaps? Cross-section has to be key.

</comment></comment></comment><comment><USER10> And nothing was heard from this ever again.

<comment><USER11> For those who don't get it see -

[http://content.time.com/time/specials/packages/article/0,288...](http://content.time.com/time/specials/packages/article/0,28804,1934259_1934610_1934634,00.html)

<comment><USER12> Their website would seem to indicate that they're still in business: [http://www.enviromission.com.au/EVM/content/home.html](http://www.enviromission.com.au/EVM/content/home.html)

But I couldn't find any information about the solar tower they were building.

</comment></comment></comment><comment><USER13> Australian sharks with frickin laser beams

</comment><comment><USER14> Feel like playing with laz0rz and shit? How about using your own money to arrange for that? Don't wanna? Well, good thing you can just use shitloads of money that's been forcefully taken from people!

<comment><USER15> I'd totally and completely voluntarily pay extra taxes if I knew it was going to be spent _blasting junk out of orbit with giant lasers_. Hell, I'd buy tickets just to watch.</comment></comment>


Announcing the New GitHub Developer Program – GitHub Developer Guide - <AUTHOR> https://developer.github.com/changes/2017-04-17-gdp-relaunch/ <comment><USER2> What are the levels and benefits for each level

</comment><comment><USER3> So their gamifying using their API's???</comment>


Remote Procedure Calls in TypeScript Made Simple - <AUTHOR> https://aiden.github.io/rpc_ts/ <comment><USER2> Thanks for finding / posting. We've been using this framework in production at Aiden.ai for 6 months now. It's been a big productivity boost. Being able to strongly type your APIs is great ;). Really excited to open source this. Hope it can help others too!</comment>


Show HN: New release of my startup, Interstate (http://interstateapp.com) - <AUTHOR>

My startup, Interstate (http://interstateapp.com) has just launched a new version (v4). The new version has brought a lot of new features and tons of UI/code/existing feature improvements (a full rundown of all the major changes can be found on our blog: http://blog.interstateapp.com/post/4416998498/major-roadworks-on-interstate).
For those who have never heard of us before, Interstate provides developers and businesses alike a way to plan and share their development progress using roadmaps.
If anyone has any feedback or would just like an invite then please do post! :) <comment><AUTHOR> Just found out we've got a Y Combinator interview :)

</comment><comment><USER2> Big tip of the cap on design. It looks very, very nice. Signed up for the beta as well.

<comment><AUTHOR> Thanks! I've just sent out a load of invites so you should have received one :)

</comment></comment><comment><AUTHOR> Lazy link: <http://interstateapp.com/>

</comment><comment><USER3> Invite please, signed up for one; my twitter is bbhoss.

<comment><AUTHOR> Thanks! Sent you an invite.

</comment></comment><comment><USER4> This looks pretty cool; I'd love to try it out.

<comment><AUTHOR> Thanks. If you've applied for an invite then check your inbox as I just sent all the new invite requests an invite code :)

<comment><USER5> Would love an invite! firstname.lastname@example.com

</comment></comment></comment><comment><USER6> Looks cool! Nice chatting to you yesterday

<comment><AUTHOR> Same! Thanks for the nice comments :)

</comment></comment><comment><USER7> OH remove that heavy background image.

</comment><comment><USER4> FYI, it looks like your SSL is broken.

<comment><AUTHOR> Ah, my apologies. Was this related to <http://bakedcode.com>? If so, we've just fixed an issue with our SSL cert on that domain when using Firefox (FF wasn't recognising our CA).

<comment><USER4> <https://interstateapp.com/join>

Calomel, the plugin I'm basing this on, doesn't seem to have any complaints about the cert. It claims, however, that the connection is either partially encrypted or completely broken and ought not be trusted.

<comment><AUTHOR> Thanks for letting me know about Calomel, it looks like a very handy plugin! I tracked down the issue (a missing CSS file 302 redirecting to a non-HTTPS page) and it should show the site as being secure now :)

<comment><USER4> Looks tiptop on my end, too! Calomel is pretty cool. There may be a similar plugin getting released out of UCSC in the next year or two, but that's only if the research team gets their shit together. ;)</comment></comment></comment></comment></comment>


Show HN: Createresu.me – Client-Side PDF Resume Maker - <AUTHOR> http://createresu.me/app <comment><USER2> Kudos for an all-around outstanding effort. Really beautiful. One thing to think about, from a professional perspective, is the million dollar problem for all these resume editors--providing an MS Word version. I prefer to do my reports generation in rmarkdown/latex but am forced to use MS Word for my resume clients. There are word templates you can use with rmarkdown and markdown (pandoc) but they take time to setup.

As a noob on Gatsby, I really look forward to studying this code!

 __ _throwaway account_ __

</comment><comment><AUTHOR> Hi author here,

I made this project because although there are a lot of resume makers online, they generally require giving your data to somebody.

This project runs completely client side so no personal data is collected (also no ads or tracking). Resumes can also be re uploaded to continue editing.

Code is here: [https://github.com/sschandi/create- resume/](https://github.com/sschandi/create-resume/)

<comment><USER3> Hi Chandi,

The design is slick, I like it. I run [https://notyce.me](https://notyce.me) which I believe might complement your app or vice-versa. If you feel the collaboration can make things better, can you drop me an email mentioned on my profile. Thanks

</comment></comment><comment><USER4> Wow this design is amazing!

Have you thought about allowed uploading of JSON Resume ([https://jsonresume.org/](https://jsonresume.org/)) format?

<comment><AUTHOR> Thanks, it would be possible to allow uploading a JSON resume, but unfortunately it wouldn't be easy to allow downloading back to JSON Resume format, because I structured the project as more generic (users can have any number of skills, lists, text, ect.) vs JSON Resume scheme being very concrete.

Will look into adding the uploader part though.</comment></comment>


Strange imagery found in Java String.class binary - <AUTHOR> http://blog.catchpole.net/2008/04/strange-imagery-found-in-java-class.html

<comment><USER2> This is getting really old, really quick.

<comment><USER3> Heh heh. For some reason I can't stop laughing at this post. Maybe it's because it's 1 am and I'm punchy or maybe it's because somebody took the time to draw Christ in Ascii.

</comment></comment><comment><USER4> Posted by a man named Christian.

<comment><AUTHOR> Ha - I just thought I saw a female. And then I thought your comment was doubly witty - april fools == pagan festival.</comment></comment>


Lambdaphant | Interview With Tom Preston Werner From Github - <AUTHOR> http://lambdaphant.com/blog/interview-with-tom-preston-werner-from-github <comment><USER2> Great interview, thanks for this.</comment>


Math as Code - <AUTHOR> https://github.com/Jam3/math-as-code/blob/master/README.md <comment><USER2> Julia allows you to be a little closer to the math and use a lot of the math symbols directly. For example, you can write `if 6 ∈ A` ([https://docs.julialang.org/en/release-0.4/stdlib/collections...](https://docs.julialang.org/en/release-0.4/stdlib/collections/)), and you can use greek symbols for variable names.

Probably more useful for mathematicians implementing their papers than the other way around, but I find it kind of a nifty language feature and makes it easier to verify that your program matches the math.

<comment><USER3> JS allows unicode symbols too.

<comment><USER4> Most languages with first-class support for Unicode strings do. But usually they don't let you define custom operators.

Haskell has this feature. While it is easily abused, it lets you write functions like:

      a ∈ [] = False
      a ∈ (x:xs) = a == x || a ∈ xs

(some might consider this abuse)

</comment></comment></comment><comment><USER5> i like the direction of this writeup a lot an am trying to go for a more symbolic style in my notes

[https://github.com/ransomw/samizdat](https://github.com/ransomw/samizdat)</comment>


Ask HN: Why are we pushing so hard for more women in tech? - <AUTHOR>

Before you attack me for being sexist and/or misogynistic, hear me out. I am honestly curios about this and it is not my intention to offend anyone. If there is something I do not understand, please enlighten me.
I just read another article this morning claiming that we "need more women in leadership roles" and, frankly, I don't understand why.
Women make up a small percentage of the tech work force. Whether we agree with that or not, it is true. If 5% (I don't know if this number is even close to reality) of engineers are women, then why should we strive for engineering teams that are 50/50 (a goal at multiple companies I've worked for)? Shouldn't women make up 5% of the engineering team? Shouldn't women make up 5% of the leadership team?
That sounds like women are being hired because they are women, not because they are necessarily the best candidate for the gig. It follows that the whole gender equality argument goes out the window if we are hiring women because they are women. That's the same thing as NOT hiring women because they are women.
With that said, I understand that there is a lot of sexism and misogyny in our industry and I agree that is a massive problem. <comment><USER2> I think the issue is that a lot of women get pushed out or pursue other options because they're harassed or etc. If you're not sure if 5% of engineers are women, why would you use that as your starting point for discussion? Why not do a little research first?

</comment><comment><USER3> I believe that gender diversity contributes so much to a tech company's working environment, that I would prefer taking a female candidate with similar qualifications over any other male candidates. That being said, she will still need to qualify!</comment>


The Real Reason Frameworks Get Adopted - <AUTHOR> https://blog.begin.com/the-real-reason-frameworks-get-adopted-1a6893051686 <comment><AUTHOR> Happy to discuss if anyone has thoughts or opinions!</comment>


Adafruit's Read-Only Raspberry Pi - <AUTHOR> https://www.raspberrypi.org/blog/adafruits-read-only/ <comment><USER2> I'm operating a digital signage service for the Raspberry Pi ([https://info- beamer.com/hosted](https://info-beamer.com/hosted)). When we started designing our Linux based custom operating system we also decided to go with the read- only approach. So far we haven't had a single device go offline due to SD card/file system problems. It was really the only sensible way to do this as you never know when/if devices get turned off.

We also handle system updates by using a A/B partitioning scheme, so you can even turn off a device in the middle of an update without breaking it. The additional benefit from that is that all system updates are atomic and self- contained, so you always have the newest version without any potential leftovers from the previous version (or the previous version if the update got interrupted). Customers that have installed our first version 3 years ago now run the exact same OS that we released today. It makes it really easy to provide support.

For obvious reasons we also need a read/write partition to store downloaded assets. We treat this partition as volatile and have an easy way to automatically verify and repair content if anything gets corrupted for whatever reason.

If you want anything running reliably on a Pi, I feel this is the only way to do this.

<comment><USER3> Have you tested unexpected powerdowns durring writes? Unless SD card is specifically designed to survive this, I would guess you might get corruption anywhere on the card, despite writing to specific area of the card, due to wear leveling algorithms. It might only become an issue when the card was used for a while, so that all flash blocks were provisioned at least once.

<comment><USER2> Not 100% of course, but so far we haven't encountered any problem. We also checksum both the operating system and all downloaded data periodically so we can catch and repair any corruption. Of course this won't help if the system doesn't boot any more. So far we haven't had this problem.

In addition to the system part being read-only, we also try to minimized writes to the data partition. We're using some of the ext4 settings to make sure writes happen less frequently as we're perfectly capable of recovering from lost data after a reboot.

<comment><USER4> I actually implemented pretty much the same layout (custom kernel, A/B partitions, but one each for the OS and the player software) for a similar use case (background music player). We used AUFS for partition layering. In particular, our setup was as such:

OS: SquashFS file system (ro) -> Config partition (ro/rw) -> tmpfs partition (rw)

Player software: SquashFS file system (ro) -> Data partition (ro/rw) -> tmpfs partition (rw)

The config partition is mounted read-only, all changes are written to the tmpfs partition. We then use a script to bulk write desired files to the Config partition (i.e. remount rw, copy files, remount ro). This limits the write time to a fraction of a second (these are only small text files).

As for the data partition, we remount the partition rw when we're updating the music files and check for filesystem consistency on bootup.

We hadn't had a single system fail because of the SD card in over 2 years.

<comment><USER2> Neat! We're also using a SquashFS root file system. It's only 30MB total at the moment.

Right now there isn't a way to do remote system configuration changes (through a UI, it's doable from a command line). Most changes happen through the "apps" deployed on those devices and those configuration is treated as volatile and might get lost during power outages (but then repaired later). If we decide to allow modification of the few system settings we have, I might treat them as a new A/B cycle and recreate the complete system with the changed settings on the other partition. That way I also get automated fallback if anything is misconfigured and (for example) the device fails to connect to the new WiFi.

</comment></comment></comment></comment></comment><comment><USER5> That doesn't help against corruption on the SD card itself from unexpected power down or cheap power supplies... especially the latter has bitten me more often than I can count.

<comment><USER6> I'm a bit confused. The article says "They've shared a script which forces the Raspberry Pi to run in read-only mode, so that powering it down via a plug pull will not corrupt the SD card." \- Is that not the same as an unexpected power down?

<comment><USER5> That's two different sources of corruption. The shared script prevents that the SD card is being written to - which means that the filesystem won't get corrupted due to half-written or inconsistently written data. The other source of corruption is the SD card's microcontroller which does not know that the SD card is being used in readonly mode and may do stuff like housekeeping, garbage collection etc. nevertheless - which might be interrupted by a power- out.

<comment><USER7> If you have the OS level setup for read-only access, can't you also flip a physical write-protect switch on the media at that point to defend against even that?

<comment><USER8> The write-protect switch on SD cards is not a physical break of a write line. It's merely a signal to the host saying not to write. A malicious or badly written driver can disobey it.

<comment><USER7> I would have guessed a signal to the local microprocessor to stop any writes as well. Oh well.

So would the solution be for the host, or some SD adapter, to provide a super- cap to ensure smooth shutdown of the SD unit as a whole?

<comment><USER5> Hmm. A supercap combined with a diode on 5V and a line to a GPIO from Vcc to provide enough time for the OS to shut down... like this

        (RPi GPIO)        <</comment></comment></comment></comment></comment></comment></comment><comment>-----(resistor to 3v3)-|
        (RPi microUSB in) <</comment><comment></comment><comment>-(diode <-)</comment><comment>+---- Vcc
                           | Supercap
        (RPi GND)         </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----- GND

When the supercap is huge enough (or, for what its worth, use a powerbank with passthrough capability!), this should work - when the GPIO goes low, the system can initiate a safe shutdown, and especially it can signal a "shutdown" signal to the microSD.

</comment><comment><USER9> A proper button to trigger the 'shut-down' sequence would be better.

<comment><USER2> You can't rely on users to actually do this every time. The more robust you make your system the better.

<comment><USER9> On the contrary, a sudden power loss is an exceptional case. Not having a button is just Raspberry Pi's (generally poor) hardware design decision, along with countless others relating to the power system and usability. Making your system entirely read-only _for this particular purpose_ is a hack, not a solution.

<comment><USER2> Of course it's a solution. It solve (among other things) the problem of unexpected power loss. You can't design your system for the happy path and hope for the best.

<comment><USER3> Do you turn off your computer by pulling the plug? Anyway, I was just reminded of 90's. The times before ATX.

<comment><USER2> Of course not. Because my OS isn't specifically designed for that. If it was (like my router): Of course.

</comment></comment></comment></comment></comment></comment><comment><USER10> It's good to see a nice easy script to do this. I can confirm that mounting the SD card as read-only works great. For a couple years, I used a Raspberry Pi as an AirPlay receiver hooked to a set of speakers, and whenever I was done listening, simply turned off the power. I had / mounted read-only and never had SD card corruption.

</comment><comment><USER11> Reminds me of the "IPE" project, Industrial Perennial Environment. I've successfully used that for a few things, some of which is still running without corruption for years now.

<comment><USER12> Good recovery from power fail ought to be the normal case. It is for just about everything else. What's wrong? Does the thing need better shutdown management hardware? Is it powering down without going into reset before the hardware starts malfunctioning? (The Motorola 68HC11 was notorious for that.) Or what?

BeagleBoard has this problem, too.[1] They have a power managment IC and shouldn't have the problem, but it's not working right.

[1] [https://elinux.org/Beagleboard:BeagleBoneBlack#Improper_Powe...](https://elinux.org/Beagleboard:BeagleBoneBlack#Improper_Power_Down....All_Revisions)

</comment></comment><comment><USER13> Isn't this how Alpine Linux [1] normally works?

[1]: [http://alpinelinux.org](http://alpinelinux.org)

<comment><USER14> You can write changes to the card with a special command.

<comment><USER13> yes, but running from RAM is the default and thus safe to unplug at any time IIRC...

</comment></comment></comment><comment><USER15> > _The only fix? Wipe the SD card clean and start over, waving goodbye to all > files you didn't back up._

> _making your Pi read-only is irreversible_

I understand the article is intended for people not very experienced with computing and hardware, but come on. The only fix? Irreversible? Scaring the readers bit too much, IMO.

</comment><comment><USER16> Would it be possible to have a laptop or desktop that spends most of its time operating in such a Read-Only mode?

<comment><USER17> From what I've seen, the systemd developers are interested in going into this direction. They established /run/ as a tmpfs that is available very early during boot, and built systemd such that it never needs to write to a persistent filesystem during its operation. (It does, by default, write logs to /var/log/journal, but you can switch it to non-persistent storage at /run/log/journal instead.)

Many programs can be made to work the same way. There are still plenty of programs that need to write longterm state to /var/lib, but you will probably need a writable partition anyway for /home, so you can just reuse that partition for /var/lib as well.

OS updates would then be handled via an A/B partitioning scheme, where you have two copies of the system partition, and when an OS update is ready to be installed, the inactive one is mounted read-write and the update written onto it.

</comment></comment><comment><USER18> OpenELEC has it by default, nothing new or revolutionary.</comment>


Researchers propose a new approach for dismantling online hate networks - <AUTHOR> https://www.theverge.com/interface/2019/8/22/20827509/online-hate-networks-neil-johnson-george-washington-miami-facebook-vkontakte <comment><USER2> Academic study of trolling, round two: now with new vocabulary!

When people we don't like are safely removed from the internet, will we waffle about the possibility of them traveling to meet and talk in person? Shouldn't we be considering ways to prevent that?

</comment><comment><USER3> A group proposes a new way to disinfranchise another group, because they discuss disinfranchising a third. Do these idiots never step back to think about their actions?</comment>