A dark web tycoon pleads guilty, but how was he caught? - <AUTHOR> https://www.technologyreview.com/s/615163/a-dark-web-tycoon-pleads-guilty-but-how-was-he-caught/ <comment><USER2> This sounds fishy. He probably pleaded guilty as part of a plea deal, so law enforcement has a scapegoat and some meaningless "media success" in exchange for him getting a drastically reduced sentencing. They always do that, threaten people with insane penalties if they don't accept so shitty plea deal and if you are not super certain that you can win, you will likely accept that one, just because it seems "safer".

There are a LOT of cases like this, just most of them don't gain this publicity. Actually, 95% of court cases never reach court because of this. Innocent people plead guilty because they don't have the wealth and resources to win in court. USA is a shithole when it comes to law enforcement. Medieval and sad. Land of the free (as long as you are rich, that is).

<comment><USER3> As a side note:

Promise (YC startup) was also saying that 70% of people in jails are waiting for judgement or are in for a technical violation (ex: did not show up to a hearing). And being in jails they end up losing their job, eventually they lose their house etc.

This is a space with a lot of low hanging fruits. And minor fixes may end up doing a lot of good.

<comment><USER4> It's not so simple.

Why do we have education?

Firstly, because there's needed some way to filter people. If you get 100 applicants, you can't make a detailed consideration. But if only 30 have degrees, it's much easier. So there is a signalling effect.

But secondly, and more importantly, because you need somewhere to have these kids. If there's ten million jobs and ten million two hundred thousand jobs, you'll get problems. This is also why many countries had military service, to further improve on the unemployment figures.

"We didn't raise [the school leaving age] to enable them to learn more! We raised it to keep teenagers off the job market and hold down the unemployment figures."

Prison is just a logical extension of this. If they weren't in prison, they would be unemployed and causing all sorts of trouble.

<comment><USER5> You might be responding to the wrong post.

<comment><USER4> No, I was responding to this: "minor fixes may end up doing a lot of good".

They won't, since the purpose is just to have somewhere to store people. The actual crime isn't very interesting, the thing of importance is that they have somewhere to store them.

<comment><USER6> We need to stop dehumanizing prisoners. Prisoners are people and they shouldn't be "stored" anywhere. They're humans. They _live_ places.

<comment><USER4> Something has to be done. It's either the case that they are productive members of society, in which case they are rarely imprisoned, or that they are not, in which case they often are.

Children aren't productive members of society, therefore we store them in schools until they've grown up. Same principle - I'm not dehumanizing kids, for the record.

The reason there are more prisoners in America is because there's a larger underclass who are forced out of employment for structural reasons. As long as these issues persist (and indeed, they will get far worse), we have to keep the unemployment rate down somehow. Prisons are just the end effect of this requirement.

The important thing to remember is that the alleged crime doesn't actually matter. This is also why corrupt Wall Street bankers rarely get harsh prison sentences. Why would they, when they're going to be able to find a job without much trouble anyway?

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> If you're wondering why a web host, who could potentially be immune to prosecution under CDA 230, was charged with the distribution of child pornography, according to the warrant [1] an admin of one of the pedo sites claimed that Freedom Hosting had "full control" over the websites (well, he had root access to the servers, but so did OVH), was patching the websites, that the pedo site hosting was free, and that he assumed that Marques covered the hosting costs as a service to the "pedo community". Technically the prosecutors might have had to prove that he knew what the sites were hosting, but he did plead guilty. Hopefully the actual operators of the pedo sites are found and prosecuted, and not just this sysadmin.

[1] [https://www.courtlistener.com/recap/gov.uscourts.mdd.247657/...](https://www.courtlistener.com/recap/gov.uscourts.mdd.247657/gov.uscourts.mdd.247657.13.1.pdf)

<comment><USER8> "According to the warrant". Take that with a grain of salt.

<comment><USER9> "but he did plead guilty". Also take that with a grain of salt. Often plea deals create quite an incentive to plead guilt even when innocent. "Go to trial, risk 20 years in prison branded as a child porn purveyor. Or plead guilty, cooperate as a witness, we'll charge you with a lesser crime that will have you out of prison in 3 years"

</comment></comment></comment><comment><USER10> Running a hosting server for onion services, as was done in this case, is a terrible idea. It greatly increases the risk of deanonymization. The question is less how this hosting service was discovered and more how it ever stayed up long enough to become so notorious. Here's why:

1\. Each hidden service chooses a "guard" relay to serve as the first hop for all connections.

2\. A server running multiple hidden services has a guard for each of them. Each new guard is another chance to choose a guard run by the adversary.

3\. An adversary running a fraction p of the guards (by bandwidth) has a probability p of being chosen by a given hidden service. A hosting service with k hidden services is exposed to k guards and thus has ~kp probability of chosen an adversary's guard. With, say, 50 hidden services, an adversary with only 2% of guards has nearly 100% chance of being chosen by one of those 50 hidden services.

4\. The adversary can tell when it is chosen as a guard by connecting to the hidden service as a client and looking for a circuit with the same pattern of communication as observed at the client. Bauer at el. [0] showed a long time ago this worked even using only the circuit construction times.

5\. The adversary's guard can observe the hidden service's IP directly.

The risk of deanonymization with onion services in general (i.e. even not using an onion hosting service) is significant against an adversary with some resources and time. Getting 1% of guard bandwidth probably costs <$500/month using IP transit providers (e.g. relay 8ac97a37 currently has 0.3% guard probability with only ~750Mbps [1]). And every month or so a new guard is chosen, yielding another chance to choose an adversarial guard. Not to mention the risk of choosing a guard that isn't inherently malicious but is subject to legal compulsion in a given jurisdiction (discovering the guard of a hidden service has always been and remains quite feasible with little time or money, as demonstrated by Øverlier and Syverson [2]).

[0] "Low-Resource Routing Attacks Against Tor" by Kevin Bauer, Damon McCoy, Dirk Grunwald, Tadayoshi Kohno, and Douglas Sicker. In the Proceedings of the Workshop on Privacy in the Electronic Society (WPES 2007), Washington, DC, USA, October 2007.

[1] <[https://metrics.torproject.org/rs.html#details/014E24C0CD21D...](https://metrics.torproject.org/rs.html#details/014E24C0CD21D2B9829E841D5EC1D3C415F866BF>)

[2] "Locating Hidden Servers" by Lasse Øverlier and Paul Syverson. In the Proceedings of the 2006 IEEE Symposium on Security and Privacy, May 2006.

<comment><USER11> Interesting. Looking for more info on what you were talking about (with regard to "guards"), I dug up this post[1] which has some info too.

[1]: [https://blog.torproject.org/announcing-vanguards-add- onion-s...](https://blog.torproject.org/announcing-vanguards-add-onion- services)

<comment><USER10> The page you link describes "vanguards" which apply the guard logic to positions beyond the first hop. They are only available as a plug-in that you must separately download and configure. My understanding is that no plans currently exist to integrate vanguards into Tor due to cost of engineering challenges that appear if everybody were to use them (including especially how they would affect load balancing).

<comment><USER11> Thanks for the follow up info and additional explanation!

</comment></comment></comment></comment><comment><USER12> This report came out only a few months before he was caught: [https://www.reddit.com/r/onions/comments/1guiav/we_have_anal...](https://www.reddit.com/r/onions/comments/1guiav/we_have_analyzed_tor_hidden_services_and_shown/)

He was likely de-anonymized through this technique or similar. The issue was that he trusted the Tor network to keep him anonymous and paid for the servers with his real identity.

<comment><USER13> Just to be clear: The v3 onion services fix that weakness, right?

<comment><USER14> I am merely give my opinion, but a service created by the US government/Military is going to have undocumented "issues". I would not trust it one shred.

<comment><USER15> Tor is open source:

[https://www.torproject.org/download/tor/](https://www.torproject.org/download/tor/)

So, no undocumented issues.

<comment><USER16> I believe tor was researched designed and developed by the government

<comment><USER17> NRL (Naval Research Lab)

</comment></comment></comment></comment></comment></comment><comment><USER16> Isn't it rather trivial to find who is accessing a website if you can manage to monitor tor nodes? Just do some heuristic, to see when traffic happens, and over time, narrow down users.

If you're the FBI and have the authority to monitor the whole internet, isn't it trivial to catch any tor user?

Tor is still secure, but of course if you are the government and have skilled engineers, time and admin access to the internet infrastructure (by legit or covert means, I'm pretty sure the US can monitor traffic outside his jurisdiction), tor is not safe. But tor is still safe from countries other than the US, unless the US government have a problem with what you're doing.

I would still be curious to see if tor does counter this problem by passively sending traffic to avoid this. Anyway I stand that there are 2 kinds of security: security against small bad actors, and security against competent, resourceful, big actors. The latter is usually impossible to get because it becomes extremely fastidious and complicated.

<comment> safety-third This would be more NSA jurisdiction and they do. The problem is most people's assumption is that if one part of the government has it, then everyone gets it. This is wildly false. Even within the FBI itself, different departments and cases get different tiers of access.

Even when the case agents get access, policy dictates what evidence is allowed to be taken to a public trial. Otherwise you get repeats of the FBI/4chan/8chan debacle. This is especially true for legal "grey areas" like mass surveillance. This means that agents will often get evidence they won't use in order to guide active surveillance using more legal means in order to collect evidence they feel comfortable admitting in public court.

<comment><USER18> This is not accurate. The NSA launders evidence that would otherwise violate the 4th amendment through its "special operations division" using "parallel construction".

</comment></comment></comment><comment><USER19> The central premise of the article is that there is no disclosure regarding the vulnerability used, suggesting the existence of some unknown zero-day exploit..

Various well documented analysis have linked this incident to "EgotisticalGiraffe", a well known -- and since fixed vulnerability.

FUD or lazy journalism? I mean, at least read the subjects Wikipedia page before publishing something..

<comment><USER7> The article explicitly does mention "EgotisticalGiraffe" (the Firefox TBB exploit). But the point is that the exploit was dropped on all websites that Freedom Hosting was running, which raises the question that the article is really about, "how did they know where the hidden services were?"

<comment><USER20> Could they not purchase some "Freedom hosting" and upload a website with backdoor?

<comment><USER21> This seems like the easiest way to do it, so I would speculate that this is how it was done. All you have to do is put a website up and make the server phone home, revealing the hidden IP address. Some more speculation: the government is hiding this fact in order to deter criminal use of Tor.

Of course, I would still assume that other ways of discovering the location of hidden services have been found. I'm not convinced that onions can be hidden from an adversary with the resources of a US government agency, particularly in light of some of the posts that appeared on Hacker Factor recently.

</comment></comment></comment></comment><comment><USER22> Mirror: [https://outline.com/L8ebnZ](https://outline.com/L8ebnZ)

</comment><comment><USER23> I mean, it's not like he's just some TOR user they were after, he ran a huge dark web hosting service. There's so much traffic and data to work with, it was just a matter of time.

</comment><comment><USER24> It's strange to me that people who make a habit of doing fantastically illegal things on the internet are always so sloppy about it. Even if they don't have the technical ability to break into their neighbor's wifi or set up a long range antenna to connect to an open access point they can still get a burner smartphone and drive to a Starbucks. Back when I used to torrent my TV shows I didn't even let my piracy laptop touch my home network and I never used that machine for anything other than downloading.

<comment><USER25> > drive to a Starbucks

Didn't help Ross. It's a bad idea to do illegal stuff in public.

<comment><USER26> Ross was dumb enough to get fake passports/ids shipped directly to his home address

<comment><USER27> While Ross did do some bad things, I do not think it is enough to warrant a double life sentence plus forty years without the possibility of parole.

El Chapo, an actual drug cartel member who is directly responsible for thousands of deaths, only got a single life sentence.

Ross got screwed on his sentencing and it is totally unjustified.

Free Ross!

<comment><USER28> You're insane. His site facilitated numerous drug deals for profit. He also paid bitcoin in what he thought was a hit-job (he was duped). This dumbass can rot in prison. Screw him.

<comment><USER29> There is nothing wrong with facilitating drug deals and there is not a shred of evidence to support the other allegation. An allegation from the US government means absolutely nothing to me.

It's also quite ironic that an organization that has assassinated numerous people are attempting to destroy the reputation of one of their enemies by claiming that he attempted to assassinate somebody.

<comment><USER28> > It's also quite ironic that an organization that has assassinated numerous > people are attempting to destroy the reputation of one of their enemies by > claiming that he attempted to assassinate somebody.

The United States Government (USG) enjoys a monopoly of violence (consent of the governed). However, a citizen (or group of them -- org/corp) does not enjoy such rights. Your comparison is invalidated.

<comment><USER29> Ignoring the fact that many of the people assassinated by the US government where not US citizens and never set foot on anything the US government claimed as territory...

Who exactly is consenting to be governed? I know I'm not consenting but I also know that some other people support the government that purports to govern them. Is it enough for one person to consent or does something magic happen at a particular number or portion?

<comment><USER28> > Is it enough for one person to consent or does something magic happen at a > particular number or portion?

Nah. We have these things called elections (and representational democracy). In general that mechanism decides how society will progress forward from a political perspective.

<comment><USER29> Imagine this hypothetical scenario:

The US government, acting in accordance with its constitution invades and occupies Canada. Congress creates 13 new states corresponding to the previous provinces and territories and elections are held. Almost all of the elected members from the newly annexed areas are opposed to the annexation and introduce a bill to allow the 13 new states to secede from the US but the bill is overwhelmingly defeated by members of Congress from the other 50 states.

Does the US government in this scenario enjoy the consent of the governed?

If they do, imagine that the original US population was more split on the issue so that the secession bill would have passed with Canada divided into 13 states. However the pre-annexation Congress anticipated this and resolved to make Canada a single state that would consequently not have sufficient representation to pass the bill even with the support of opponents from some of the other 50 states.

Does the US government still enjoy the consent of the governed in the second scenario?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> OTOH if these techniques and vulnerabilities were made public it would benefit cybercriminals as they could defend themselves better.

<comment><USER31> >if these techniques and vulnerabilities were made public[...]

Should the government prove that it followed the law when investigating a criminal? Did they obtain the proper warrants that people recognize preserve stable law and order?

It's unreasonable to assume that the vulnerability, that brought this case to justice, is the last one that could ever be used. More so, if you assume that most people are good and a healthy society needs privacy, we now know that there is a vulnerability that will affect more good people than bad and we are duty bound to protect good people's privacy.

Checks on the government's power aren't there to let 'bad people' go free, there there because we know if we let the government's power reign free, more good people will be hurt than the few 'bad people' we punish.

<comment><USER32> >> _Should the government prove that it followed the law when investigating a criminal? Did they obtain the proper warrants that people recognize preserve stable law and order?_

That is the concern. A lot of people say "you either did it or not" but the Fourth Amendment disagrees...any evidence must be obtained by following the law.

<comment><USER33> In theory, maybe. As in, I agree with you on principle, but if you do even a cursory read about recent abuses that include parallel construction, PATRIOT act and BSA, you may find that it is no longer the case.

Hell, during my last attended CAMS conference, FBI guy outright said said that if the new lawyer doesn't know how to play ball with those ( informatikn gathered by SARs ), he gets pulled to the side and told whats what.

Chilling. And no one questioned it. Including me.

</comment></comment></comment></comment><comment><USER34> afaicr the bug used was the one reported as MFSA 2013-53 aka CVE-2013-1690[1] but someone correct me if m wrong.

[1] [https://www.mozilla.org/en- US/security/advisories/mfsa2013-5...](https://www.mozilla.org/en- US/security/advisories/mfsa2013-53/)

<comment><USER35> No, that was used after they had seized the site, to unmask its users.

</comment></comment><comment><USER36> Hacker Factor has a series of articles about various attacks on Tor: [https://www.hackerfactor.com/blog/index.php?/archives/868-De...](https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing- Tor-Circuits.html)

The tor daemon really needs to be re-written and audited. Apparently the codebase right now is a huge mess.

<comment><USER25> You can make a mistake in your code and end up causing someone to go to prison. What a time to be alive.

<comment><USER35> In the 80s,it was already possible to make a mistake in your code which would cause someone to die horribly.

[https://en.m.wikipedia.org/wiki/Therac-25](https://en.m.wikipedia.org/wiki/Therac-25)

</comment></comment></comment><comment><USER37> The military needs, or needed, Tor to be functioning and anonymous for their own use, correct?

<comment><USER38> Tor was created to help dissidents of other nations communicate. The military does not run on Tor.

<comment><USER39> > Tor was created to help dissidents of other nations communicate [1]

Why would the US Navy develop something to help dissidents in other nations?

[1] [https://en.wikipedia.org/wiki/Tor_(anonymity_network)#Histor...](https://en.wikipedia.org/wiki/Tor_\(anonymity_network\)#History)

> The core principle of Tor, "onion routing", was developed in the mid-1990s > by United States Naval Research Laboratory employees, mathematician Paul > Syverson, and computer scientists Michael G. Reed and David Goldschlag, with > the purpose of protecting U.S. intelligence communications online. Onion > routing was further developed by DARPA in 1997

<comment><USER40> > Why would the US Navy develop something to help dissidents in other nations?

From their website: "The [Naval Research Laboratory] works closely with the National Security Agency (NSA), Space and Naval Warfare Systems Command (SPAWAR), Defense Advanced Research Projects Agency (DARPA), and Defense Information Systems Agency (DISA)."

<comment><USER39> Those are US gov't agencies, not "dissidents in other nations."</comment></comment></comment></comment></comment>


The Stanford Multi-Camera Array - <AUTHOR> http://graphics.stanford.edu/projects/array/ <comment><AUTHOR> There's links to a paper here. [http://graphics.stanford.edu/papers/CameraArray/](http://graphics.stanford.edu/papers/CameraArray/)

And there's an Instructables page here: [http://www.instructables.com/id/DIY- Camera-Array-1-Computati...](http://www.instructables.com/id/DIY-Camera- Array-1-Computational-Photography-Prim/) (and that author kindly links PDFs in other places, so you don't need to register to get the PDFs)

</comment><comment><USER2> IIRC, this is the same underlying technology being currently employed in the "bugs eye" lens system that underlies Lytro -- I.e. this is the lab group that spawned Lytro.

<comment><USER3> Very different applications -- Lytro does use a lens array, but behind a traditional lens; the lens array is a microlens array covering the pixels on the sensor. This allows the recovery of the plenoptic function ([https://en.wikipedia.org/wiki/Light_field](https://en.wikipedia.org/wiki/Light_field)) from within the camera, which allows things like refocusing.

A large-scale array, with no front objective lens, like the one shown here -- that allows recovery of the plenoptic function _outside_ of any lens environment, which means you can do different fancy stuff. Synthetic aperture is one (not that interesting); holographic reconstruction is one much more interesting possibility, though.

With holographic reconstruction, you could serve any possible perspective behind the array to a VR headset, say, or even create a 'hologram' of the scene incident on the array. Seriously, it's pretty cool.

I wrote at length about it here:

[http://uploadvr.com/light-fields-are-dead-long-live- holograp...](http://uploadvr.com/light-fields-are-dead-long-live-holography/)

Awesome. And yes, the professor responsible for that group was the thesis advisor to Ren Ng (Lytro founder), and now works at Google. His name is Marc Levoy, and he's done amazing stuff.

<comment><USER2> I know Marc. We worked together in Google[x] for a while. ;)

</comment></comment></comment><comment><USER3> This dates back to 2005; headline should reflect this.</comment>


PDF – How to steal PDFs by injecting JavaScript (October 23, 2016) - <AUTHOR> http://insert-script.blogspot.com/2016/10/pdf-how-to-steal-pdfs-by-injecting.html <comment><AUTHOR> [https://www.reddit.com/r/netsec/comments/5nysk4/how_to_steal...](https://www.reddit.com/r/netsec/comments/5nysk4/how_to_steal_pdfs_by_injecting_javascript/)</comment>


Which hybrid app framework for iOS and Android? - <AUTHOR> Hi folks, I have an app that I'm trying to develop, but I'm finding difficulty selecting an app development framework. The app basically requires users to create a profile, and store encrypted data on a cloud. I'd like to use AWS.
I've tried Phonegap - but it doesn't seem supported by their dev team. I can't even launch the desktop app on Windows 10.
Tried React Native with Amazon Amplify and AWS. There are too many errors and deprecated dependencies in their sample projects (with the tutorials I tried). Only seems to be 1 developer advocate at AWS who is contributing to React Native + Amplify tutorials.
I had a look at Xamarin Forms. The samples on Github were updated between 2 and 5 years ago: https://github.com/awslabs/aws-sdk-net-samples/tree/master/XamarinSamples
I would appreciate any advise or links to sample code repositories (with authentication functions) to get me started, on a framework that is supported. Ideally on AWS. <comment><USER2> regarding xamarin, ,have a look at [https://github.com/jsuarezruiz/awesome- xamarin-forms](https://github.com/jsuarezruiz/awesome-xamarin-forms)

</comment><comment><USER3> I would take a look at Flutter. [https://flutter.dev/](https://flutter.dev/)</comment>


Colonizing other planets is not a good plan - <AUTHOR> https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/modeledbehavior/2017/05/06/sorry-nerds-but-colonizing-other-planets-is-not-a-good-plan/amp/ <comment><USER2> The HN title is missing the rest of the actual title...

"Sorry Nerds, But Colonizing Other Planets Is Not A Good Plan"

Man, this article isn't even long enough to be considered a decent middle school book report.

In response: We're not trying to "evacuate" Earth for Mars within 100 years, obviously. Human life is important (which is clearly subjective, but doesn't seem that controversial) regardless of the Drake equation.

Pure clickbait.

Addendum: I find his frequent use of Wikipedia links very amusing.

</comment><comment><USER3> Maybe there's an error in the authors assumption that we'd seriously try to evacuate the planet. I've always assumed that the point of colonizing Mars is just to have an off-world colony that's also like an ark. At least at first.

<comment><USER4> Agreed. I read a lot of science fiction and I can't even think of a novel for adults where they would insinuate that something so stupid was possible.

<comment><USER5> In Neal Stephenson's 'Seveneves' they actually do evacuate Earth and live in space for thousands of years until Earth becomes habitable again ⌘ [https://en.wikipedia.org/wiki/Seveneves](https://en.wikipedia.org/wiki/Seveneves)

</comment></comment></comment><comment><USER6> The article is so wrong that I don't know where to start...

First there is a whole spectrum of people interested on adventure, breaking frontiers, understanding science from outside the conditions on Earth, not just N-E-R-D-S.

It reminds me when I was in the US and two very prominent politicians were arguing on TV against each other about who was less of a nerd, have no relationship with them, like they were a pest or something.

It was like the stereotype of empty brain US football player who gets all the chicks by downplaying all people smarter than them and caring only about looks.

The challenges and adventure of not having water, facing problems like living on Venus clouds, etc.. are exactly the main reasons to go there. Doing what no other person has done ever has lots of advantages for the individuals doing it and human society as a hole.

For example when the first vehicles were sent to the moon we were able to discover that most rocks or sand were not affected by erosion or air pressure so they had properties not seen on Earth.

<comment><USER7> > First there is a whole spectrum of people interested on adventure, breaking > frontiers, understanding science from outside the conditions on Earth

That's also not what colonizing is about. Rocket energy costs mean we'll never, ever lift more than at most a few thousand people out of earth gravity. Never. Not even with reusable rockets. 99.99% of the human population, at minimum, can never leave the earth.

> The challenges and adventure of not having water, facing problems like > living on Venus clouds, etc.. are exactly the main reasons to go there. > Doing what no other person has done ever has lots of advantages for the > individuals doing it and human society as a hole.

The whole point of colonization is never coming back. It won't be about science for at least a couple generations. It'll be about babies, food and building extremely basic structures.

Those babies, incidentally, will be thoroughly fucked compared with babies on earth : They'll be locked in a small structure that they can never leave. And of course the project is dependent on them having at least 5-6 babies per couple, preferably more. They can never go to earth, ever. Hell, they can't ever so much as talk to anyone outside of their society that will be tens of people for a generation (because of the delay).

> For example when the first vehicles were sent to the moon we were able to > discover that most rocks or sand were not affected by erosion or air > pressure so they had properties not seen on Earth.

We knew those properties long before humans ever set foot on the moon.

</comment></comment><comment><USER4> The more I read this the stupider it sounds.

"under almost no circumstances does is colonizing another planet the best way to adapt to a problem on earth...

...Even if an asteroid were to strike earth it would remain more habitable than mars. For example, consider the asteroid that struck the earth 66 million years ago creating the Chicxulub crater and wiping out 75% of plant and animal species on earth, including the dinosaurs. Well that disaster still left 25% of species that survived, all of whom would die instantly on the surface of Mars."

This insinuates that surviving the aftermath of a Chicxulub event is what threatens us - but it isn't the aftermath, it is the event itself.

Best quote: "Even though I am not an expert on space, physical sciences, or basically any relevant field, I can tell that this is obviously true. Maybe just it takes an economist to see through the nerd fantasies."

LOL!

<comment><USER7> > This insinuates that surviving the aftermath of a Chicxulub event is what > threatens us - but it isn't the aftermath, it is the event itself.

We have plenty of ways that a small group of humans could be isolated and fed for the time it would take to make humans survive. Humans would not go extinct due to an asteroid impact, rest assured.

There's even a few places that would have natural protection from most of the phenomena. And of course, there'd be a few weeks where, starting 500km from the impact site or so, there would be essentially nothing wrong on other than a stripe in the sky. That time can be used to prepare for what's coming, and as long as you only try to save 0.1% of the population, you could do that just fine.

And there's plenty of calamities that would affect mars just as much as they'd affect earth. A supernova within 50 lightyears or so of earth (depending on size can be a bit more) is not survivable. That would destroy the atmosphere in a matter of seconds and kill the power grid, and there would be no warning at all (it's like an earthquake, we would "know it's coming" give or take 100000 years or so, and yes, there's one "ready to blow" within that range). Within 20 light years or so and we'd see wind speeds on the surface would go absolutely insane within a few minutes, lasting a few hours (there'd be a VERY hot wind with speeds that'll probably exceed the speed of sound for a few minutes). Anything above the surface is gone. Hell, this will erode the himalayas by several hundred meters at least, maybe kilometers. Ocean water levels will drop dozens of meters and there'll be zero water left on land.

But, on earth, some installations would probably survive even this. It won't be pleasant, because life on earth will take decades to centuries to come back to the point that the planet is covered in green (depending on what it does to the soil, might even be hundreds of thousands of years).

For all these calamities, the same thing keeps coming back. What you need is

a) a huge, huge mass surrounding you (the earth counts as "surrounding" us since there's always 50% of the surface that's protected by the mass of the earth), preferably with lots of metal inside of it.

b) an energy source that isn't dependent on anything (which means: a nuclear reactor). Obviously solar panels won't do.

c) a way to grow food and scrub co2 directly using just energy.

d) we'll need to do this using extremely well established technology. For instance, we can probably use computers from, say, a 50nm process, but we can't really go higher than that as we wouldn't be able to replace them. Because these events would wipe industry from the earth that means we can only depend on technology that can be made within whatever base we use.

That will let us have large amounts of survivors on our planet. The biggest problem seems to me to be C. We can do it, sort of, but not very efficiently.

Also, once we leave earth, we shouldn't go to Mars. Once we escape Earth's gravity we'd be wise never to dive into a gravity well again. We should migrate populations into asteroids and use them with ion engines as spaceships. With the people living deep into the interior. They will be far, far safer than Mars or any planet.

</comment></comment><comment><USER8> That whole thing will wane like that electricity fad did. You will see - in a 100 years, nobody will have a use for all that modern hokus-pokus.

</comment><comment><USER9> The real title is « Sorry Nerds, But Colonizing Other Planets Is Not A Good Plan ».

I don't know what the article deals with because the first two words put me off.

</comment><comment><USER10> Three minutes we won't get back.

</comment><comment><USER11> Gamma Rays

<comment><USER12> What about them? A GRB that takes out Earth would cook Mars even more thoroughly due to its smaller size.

I think in practice we will colonise mas but no more than we are colonising Antarctica. The ITS will make going to a Mars affordable and there are good scientific reasons for wanting to do so. But my most optimistic scenario is that we'll have small bases on Mars for at least a generation testing out technology before well even begin to be able to dream about making such a station in any way self sustaining, even just in food, air and water let alone anything more complex.

<comment><USER13> Yes, but what percentage of human life on earth is under 2 meters or more of soil?

Human life on mars is likely to be underground to avoid the extreme cold, vacuum, and radiation. So I could see a GRB taking out a hugely larger fraction of life on earth (with no warning) than mars (assuming a colony there).</comment></comment></comment>


OpenBSD disables Heartbeat in libssl, questions IETF - <AUTHOR> http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/ssl/Makefile?rev=1.29;content-type=text%2Fx-cvsweb-markup <comment><USER4> This patch is setting OPENSSL_NO_HEARTBEAT, but openssl actually only disables heartbeats when you set OPENSSL_NO_HEARTBEATS (note trailing S).

Someone should make a thing which does sentiment analysis on commit messages, and flags vitriolic or angry commits as possibly containing more typos than usual.

<comment><USER5> That's almost too funny.

Edit: Does that last "ok" line mean that two other committers reviewed and OK'ed this patch as well? Three openbsd committers approved a one-line change that didn't fix a single thing? (And people wonder how the OpenSSL bug could live on for two years =) )

<comment><USER6> It is but we should have a dose of humility in mocking them since many, many people [including everyone on this site that is a dev] make stupid mistakes from time to time. Such is the nature of the profession. None of us commit perfect code the first time, every time.

<comment><USER5> Exactly.

I'll just leave this here. [http://article.gmane.org/gmane.os.openbsd.misc/211963](http://article.gmane.org/gmane.os.openbsd.misc/211963)

<comment><USER7> Wha-what? That's pretty crazy. At the very least, if OpenSSL goes through this trouble, why doesn't it just implement its own malloc and friends that are both fast and secure? In fact, shouldn't it include something like scurb_and_free() so that sensitive bits would actually be erased when not needed. That seems like a much better solution than the approach described in this link.

<comment><USER8> It gets worse, see [http://www.tedunangst.com/flak/post/analysis-of-openssl- free...](http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist- reuse)

Essentially the code mistakenly relies on the freelist being LIFO and not being scrubbed.

<comment><USER9> Whoever said that OpenSSL was written by monkeys continues to be proven right.

<comment><USER10> That's a fairly rude thing to say. Would you say that to their faces? This is a pretty large site, and a lot of people stop by here, possibly including some of the "monkeys" .

By all means, call the code what you want, but separate that from the people.

<comment><USER11> something tells me a similar snafu made by a CS student would get "fairly rude" comments in reply by any competent instructor or advisor.

<comment><USER12> you say that and yet I have had to teach people coming from several fairly top institutions that "no your lecturer was wrong, it is inappropriate to directly memcpy() from the network into a struct"

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> There are smart people working in the TLS WG, but there are also people there that shouldn't be governing the development of the Internet's most important encrypted transport.

More importantly, the working group appears to be geared towards saying "yes" to new features, when exactly the opposite posture is needed. The Heartbeat feature is just the most obvious example, because its reference implementation was so slapdash.

The weirder thing here is that it would even be controversial or newsworthy to disable TCP TLS heartbeats, a feature nobody needs or really ever asked for. Why was it enabled by default in the first place? What sense did that decision ever make?

<comment><USER14> Would you please link to this supposedly slapdash reference implementation? Taking RFC6520 at face value, it seems fairly reasonable and not out of line with other existing heartbeat protocols.

I've not read as much as I would like on the IETF's involvement in this but as I read the situation, Theo has just hurled vitriol at them for specifying a completely reasonable feature that the openSSL team implemented incredibly poorly.

<comment><USER13> It's _not_ a completely reasonable feature.

It's a feature that had a sensible use case in DTLS (datagram TLS, TLS not run over TCP). It's unclear as to whether the use case was best addressed at the TLS layer, whether it could have been specified as something run alongside TLS, or whether it was something that applications that cared about path MTU could have handled for themselves.

The TLS WG actively discussed whether Heartbeat had reasonable use cases in TCP TLS. Some people agreed, some disagreed. Nobody threatened a temper tantrum if the feature was added to TCP TLS. Therefore: the extension was specified for both TCP TLS --- which does not need extra path MTU discovery, and which already has a (somewhat crappy) keepalive feature --- and DTLS.

The larger problem is in treating TLS like a grab-bag of features for corner- case applications.

<comment><USER14> Okay, I definitely agree regarding crufty specs. The decision to include heartbeats could easily have left left it as a variant feature rather than core spec.

I still don't agree with the OpenSSL implementation being reference spec if you were refering to that as pygy_ pointed out. Unless the IETF released that code as an institution, I would consider it the same as any other 3rd party implementation - ie. not necessarily correct. How am I to know that the RFCs author wrote it unless I go digging? Why should I trust anything they wrote which may or may not have gone through any rigorous checking?

This isn't so much directed at you, tptacek (since your pedigree is well known), as it is the others bashing the IETF for implementation flaws - <USER2> them for what they actually did and perhaps instead of getting angsty at the powers that be, try getting involved in projects like this if you believe they are so important.

</comment></comment></comment></comment><comment><USER15> I stopped trusting IETF since this:

[http://arstechnica.com/security/2014/01/nsa-employee-will- co...](http://arstechnica.com/security/2014/01/nsa-employee-will-continue-to- co-chair-influential-crypto-standards-group/)

When after all the Snowden and RSA revelations they're not willing to get rid of the putrid influence of NSA inside of IETF, well then...not much trust left there.

</comment><comment><USER16> I was confused what RFC 520 ("A Proposed File Access Protocol Specification") had to do with any of this. It looks like Theo meant to refer to RFC 6520: [https://tools.ietf.org/html/rfc6520](https://tools.ietf.org/html/rfc6520).

<comment><USER17> Thanks, I was going crazy trying to figure out the connection!

</comment></comment><comment><USER18> Why does a heartbeat acknowledgement need a variable sized payload embedded in the reply? Can someone explain this in a way that is accessible to a programmer without much security experience.

Thanks!

<comment><USER19>
      1) You send a heartbeat at time t0;
      2) You wait until time t1;
      3) You send another heartbeat at time t2;
      4) You receive a heartbeat reply at time t3;

Was your t3 receipt the result of your t0 heartbeat, or your t2 heartbeat?

That is the purpose of the payload, to distinguish which reply matches with which transmission.

Now, why variable sized with a max of 64k vs. say an 8-byte integer? The variable sized with max of 64k was most likely intended to support the second purpose in the RFC, path MTU discovery. To discover the path MTU, you need to be able to send a "too big packet", as well as adjust the packet size until you find the proper MTU value.

[edit, formatting]

<comment><USER18> I understand needing a unique identifier to distinguish between heartbeats ... but why conflate the heartbeat with Path MTU, which is an orthogonal process.

Is it really that much less efficient to do Path MTU with a different message/system/module? Why absorb this function into the OpenSSL pacakge?

I feel I am still missing something about the way this system works. Perhaps I just need to educate myself more on security and networking.

<comment><USER19> > I understand needing a unique identifier to distinguish between heartbeats > ... but why conflate the heartbeat with Path MTU, which is an orthogonal > process.

The only people who can accurately answer that are the author of the RFC/code, and the TLS committee members who discussed the changes.

From a security standpoint, it is more dangerous to commingle the two, because a bug in one side (path MTU) will also effect the other half (heartbeat). And that is exactly what happened.

> Why absorb this function into the OpenSSL pacakge?

Unknown. Path MTU discovery is supposed to be handled at a low layer in the OSI network stack abstraction (closer to the physical hardware) such that higher level layers/apps should not need to care. Putting it into TLS the protocol is a blatant layering violation.

</comment></comment></comment></comment><comment><USER20> Maybe OT, but are the OpenSSL project and OpenBSD project related in any way? For some reason I was thinking it was like the OpenSSH project.

<comment><USER21> No, they aren't related at all. OpenSSH is everyone's poster child for a good, open implementation of a security protocol.

<comment><USER22> For some values of "everyone"

Rob Pike Responds - <USER3>

18 Oct 2004 ... ... but when ssh is the foundation of your security architecture, you know things aren't working as they should

[http://slashdot.org/story/50858](http://slashdot.org/story/50858)

<comment><USER23> I don't think he was impugning SSH's _security record_ at all: just the perceived abuse of the protocol.

The entire quote, in context:

 _10) Biggest problem with Unix - by akaina

Recently on the Google Labs Aptitude Test there was a question: "What's broken with Unix? How would you fix it?"

What would you have put?

Pike:

Ken Thompson and I started Plan 9 as an answer to that question. The major things we saw wrong with Unix when we started talking about what would become Plan 9, back around 1985, all stemmed from the appearance of a network. As a stand-alone system, Unix was pretty good. But when you networked Unix machines together, you got a network of stand-alone systems instead of a seamless, integrated networked system. Instead of one big file system, one user community, one secure setup uniting your network of machines, you had a hodgepodge of workarounds to Unix's fundamental design decision that each machine is self-sufficient.

Nothing's really changed today. The workarounds have become smoother and some of the things we can do with networks of Unix machines are pretty impressive, but when ssh is the foundation of your security architecture, you know things aren't working as they should._

<comment><USER22> He just didn't say so in that interview, however :

From: email@example.com (rob pike)

Date: Mon, 1 Jan 2001 09:37:12 -0500

Subject: [9fans] Re: The problem with SSH2

Message-ID: <firstname.lastname@example.com>

My disagreement with SSH is more specific. It is a securitymonger's plaything, so has been stuffed with every authentication and encryption technology known, yet those that are configured when it is installed is a random variable. Therefore both sides must negotiate like crazy to figure how to talk, and one often finds that there is no shared language. This is idiocy. The complexity is silly, but much worse is that there isn't at least one guaranteed protocol for authentication and encryption that both ends always have and can use as a fallback. I would argue that that would always be sufficient, but I know I'm in the minority there. I do argue that it's demonstrably necessary.

Algorithms everywhere, and not a byte to send.

By making the thing too complicated, they defeat the very purpose of security. Difficult administration results in incorrect or inadequate installation. There are cases when I can't use ssh, a direct consequence.

-rob

Russ Cox chimes in

we're stuck with ssh, but let's not delude ourselves into thinking it's a good protocol.

(i'm talking about ssh1; ssh2 looks worse.)

russ

<comment><USER23> Thanks, that makes more sense.

</comment></comment></comment></comment></comment></comment><comment><USER24> This strikes me as 100% backwards, isn't the entire point of the IETF RFC process to memorialize existing practice, not be a design studio for new protocols? Wasn't it followed here (RFC6520 existing to document the OpenSSL implementation of heartbeat)?

If the IETF is the only thing standing between us and any jackass introducing vulnerabilities into everyone's network stack we're in bigger trouble than I thought.

<comment><USER25> RFC stands for "Request For Comments", which I always thought meant new stuff up for peer review. Wikipedia also describes them as:

 _An RFC is authored by engineers and computer scientists in the form of a memorandum describing methods, behaviours, research, or innovations applicable to the working of the Internet and Internet-connected systems. It is submitted either for peer review or simply to convey new concepts, information, or (occasionally) engineering humour. The IETF adopts some of the proposals published as RFCs as Internet standards._

</comment></comment><comment><USER26> Is the IETF the implementors of OpenSSL? If not, this is pure crazy. The heartbeat feature seems useful to me. I mean, keep alive at TCP level leaks information. Even when this information is that there is no transmission. Transmitting a heartbeat tells the other side is alive and is not distinguishable from normal traffic to a passive attacker.

<comment><USER27> Heartbeats are used for UDP and other connectionless protocols. TCP doesn't need heartbeats to tell if the connection went down.

<comment><USER5> I think it can be useful when the TCP connection is going through NAT which may drop the rule and stop passing packets after idling, no?

<comment><USER28> In retrospect, I think using TCP_KEEPALIVE would be a better solution to this specific use case. Are TLS heartbeats truly indistinguishable from normal traffic?

<comment><USER29> TCP Keepalive is a much better solution for this problem.

Nearly all bitcoin pools utilize TCP keepalive to maintain connections with miners.

These are systems in which performance and DoS resistance are paramount.

</comment></comment></comment></comment></comment><comment><USER30> Is there any argument in defense of the TLS heartbeat extension? It seems completely inappropriate thing to stick into TLS (wrong level of abstraction), and the idea of sending any kind of payload as part of heartbeat seems completely redundant (what does this achieve over just basic fields "this is heartbeen #17" \-- "this is response to heartbeat #17"?

</comment><comment><USER31> The commit message contains a rather succinct, albeit drastic description-cum- definition of Heartbleed:

> [A] 64K Covert Channel in a critical protocol.

</comment><comment><USER32> How can we get developers to keep it simple, and stop introducing new "features"? [This applies to OPENSSL as well as most software out there that has a new "release" all the time]

</comment><comment><USER33> Sharp guy.

</comment><comment><USER34> Oh, and they're using CVS because it's so secure!

</comment><comment><USER35> CVS is still in use by anyone?

<comment><USER36> Feigned surprise! I read about this today!

<comment><USER35> Certainly wasn't feigned, though I understand your reference. Absolutely no offense meant.

I'm genuinely surprised. Just as I would also be surprised if Windows 3.1 or magnetic tapes or punch cards were still in use. I thought these technologies were supplanted long ago.

<comment><USER37> CVS is in use _many_ places, especially in decades old source trees where migration would result in the loss of to much metadata or to much build automation is dependent on CVS. I personally know of several instances of this.

Windows 3.1? I run into it occasionally in places like manufacturing where upgrade cycles are decades long (was recently at a client who's most critical machine was built in 1905). FWIW, DOS can still be found everywhere.

Magnetic tape? Really? LTO-6 is up to 2.5TB uncompressed and LTO-7 is imminent.

Punch cards? See: Scantron.

Just because there's a cool new replacement for something, doesn't mean you should jump on it, or that the old tech is now worthless.</comment></comment></comment></comment>


The Long Death of CGI.pm - <AUTHOR> http://perlhacks.com/2015/12/long-death-cgi-pm/ <comment><USER2> What's the strange bad-mouthing of Red Hat in this article? Upstream Perl comes with dozens of modules in the base tarball, and the packaging just splits that into separate RPMs so you can have more minimal installs. If you really want to install all the modules from the upstream tarball, you install _perl-core_ which is a meta-package that pulls in everything. You can install CGI.pm either by:

        yum install 'perl(CGI)'

or by:

        yum install perl-core

and this works on Fedora and RHEL (I just checked).

The article claims it's _not really what you would recognise as Perl_ and Red Hat _[strips] out many parts of Perl that they consider non-essential_ both of which are plainly untrue.

<comment><AUTHOR> Yes. And I mention both of those commands in the article.

The point is that the standard perl RPM does not contain everything that you would expect to see in a Perl installation. And whilst I agree that it is simple enough to fix that situation, many people running low-end web hosting services don't realise that the standard Perl installation is stripped back and don't do anything to rectify this - as demonstrated by the example in my article.

I really don't mind Red Hat providing a standard stripped-down Perl RPM. I just wish they had called it "perl-minimal" or something like that, saving the name "perl" for the full Perl RPM.

<comment><USER2> Well file a bug, I guess. The problem IMO is with the upstream Perl tarball which contains an ever increasing set of modules. The RPM packaging is (also IMHO) more rational.

The problem with dumb hosting providers is dumb hosting providers. I'm sure they'll find other ways to screw things up even if the package name was changed. Who uses web hosting these days anyway, when you can fire up a cloud instance and install whatever you like?

<comment><AUTHOR> > Well file a bug, I guess.

That's not going to fix Centos 6 and 7 - both of which are mainstream in the web hosting industry right now.

And I've had this conversation with the Red Hat Perl packagers. They can't see the problem.

> The RPM packaging is (also IMHO) more rational.

To be clear, I also like the way that Red Hat splits the Perl RPM into individual RPMs for each module. My argument is only with the set of these RPMs that are installed alongside the main perl RPM.

> Who uses web hosting these days anyway, when you can fire up a cloud > instance and install whatever you like?

Not you and me, of course. But I'm talking about people with no technical knowledge who rent some cheap web space and run a CGI guestbook program.

We could just ignore them. I suppose. Let them all switch to PHP. To be honest, I think most of them have already gone down that route.

</comment></comment></comment></comment><comment><USER3> TFA bad-mouths CGI, so let me ask: The only server-side technologies widely available on shared-hosting providers seem to be CGI and mod_php. What else are people supposed to use? Are you simply not worthy anymore unless you're willing to spring for a VPS?

<comment><USER4> Honestly, for low end stuff, mod_php is fine. I've just spent the day beating some circa y2k perl code into submission on a modern shared hosting platform too. That's sort of fine too (helps that I'm an expert and know how to make debugging the PoS easy).

Wordpress is an OK product. On the other hand I reckon php is a bad technology to stake your career on. Perl less so, bear in mind it's been around for several waves of the latest greatest thing and is still going strong. Still I quite enjoy javascript sometimes, it's like a syntactically crippled perl with good vendor support. Perl6 looks cool, I hope I get the opportunity to mess with its async stuff.

<comment><USER5> > Honestly, for low end stuff, mod_php is fine.

Then again, so's GCI.

<comment><USER6> Though all the forking of standard CGI makes it far less efficient, which is quite a concern to a cheap shared hosting provider in a saturated market: they need to cram as many accounts as possible on as few machines as possible to have any hope of not running the business at a loss.

Fast_CGI helps here of course, but then you have your users needing to be able to create long lived processes which moves the problem to one of memory use and process cycling & other management.

<comment><USER4> fwiw I'm currently working on tools to port a fastcgi perl cgi script to a more modern infrastructure, for money. I'll try and work up the fun bits into an article in due course.

</comment></comment></comment></comment></comment><comment><USER7> "At some point Perl 5.22 or one of its successors will make it into Red Hat Enterprise Linux. And at that point we have a problem."

This made me laugh this morning, version 5.22 will probably be included in the 8.0 release? So we have a few years to go. RedHat 6.* is still running Perl 5.10 so no worries about anything breaking in the next 5> years.

Edit: formatting

<comment><USER8> Further on, the article mentions that Red Hat actually already removed CGI.pm from the default installation of RHEL 6, because they install a stripped-down version of Perl.

<comment><USER2> Which is nonsense. Red Hat split up the perl package so you can install the modules separately.

<comment><AUTHOR> It's not nonsense. That is what they do.

And, yes, it's easy enough to fix that (pointing that out was one of the main points of my article). But we're talking about low-end web hosting services where the web site owners don't have the root access to do that and the service providers either don't know what is missing or don't care about Perl enough to bother fixing it.

</comment></comment></comment></comment><comment><USER9> As long as CGI is still available from CPAN, I don't really mind.

But I still think CGI scripts have their place, and I have written a bunch over the last two years at our company. I get that CGI has a number of problems, but for simple tasks I think it's a completely acceptable solution.

(Just to be clear, I am talking of CGI as in "web server calling an external program through a defined interface", not the HTML-generating stuff in Perl's CGI module - my scripts use Template::Toolkit for generating HTML.)

</comment><comment><USER10> > There are good technical reasons for this. CGI is a dying technology. In > 2015, there are far better ways to write web applications in Perl. We don't > want to be seen to encourage the use of a technology which no-one should be > using.

I don't see the harm in including it. I would think it was enough to document the disadvantages.

<comment><AUTHOR> That was a conversation that was finished 18 months ago. I'm not sure that anything can be gained by rehashing it. The best we can do is deal with the consequences.

The discussion is at [http://www.nntp.perl.org/group/perl.perl5.porters/2013/05/ms...](http://www.nntp.perl.org/group/perl.perl5.porters/2013/05/msg202130.html) if you want the full details. But ultimately, I think they decided that having the module in the core was tantamount to a recommendation for its use.

</comment></comment><comment><USER11> I suppose you might want to use CGI.pm for some low level stuff but I find I can still get most of what I need by copy and pasting stuff from Matt's CGI scripts ([http://www.scriptarchive.com/](http://www.scriptarchive.com/)).

<comment><USER12> Consider using the "Not Matt's Script" versions ([http://nms- cgi.sourceforge.net/news.html](http://nms-cgi.sourceforge.net/news.html)), but even that was last updated 2004. MSA was notorious for very bad examples of old-style perl, and there are much better ways of doing perl nowadays.

For a much more modern approach, use Plack/PSGI, and one of the many frameworks built using it.

<comment><AUTHOR> The really galling thing is that Matt's scripts will continue to work find in this post-CGI world. The nms versions were written to the best practices of 2000 and therefore need CGI.pm.

<comment><USER13> Actually Matt's stuff DOESN'T use CGI.pm (at least what I'm familiar with). That was the thing - even when CGI.pm was the Better Practice, Matt didn't use it.

No one should use Matt's stuff, unless you want huge security exploits.

<comment><AUTHOR> > Actually Matt's stuff DOESN'T use CGI.pm

Yes. That's the point I was making.

</comment></comment></comment></comment></comment><comment><USER14> Is there anything I can't do in Swift? Perl is super cool, but Swift seems like it can now be used on most of your text parsing and big data crunching needs (DNA, lab R&D, etc) now.

And it was everyone's first web language in the day. I was super impressed when ran my first perl script. I was hooked. :-)

<comment><USER15> > Is there anything I can't do in Swift?

You can't do nostalgia for the good ol' days in Swift.

<comment><USER16> Ahhh, do you remember back in May, before Swift 2 came out? Good times man!

(I remember when my first eCommerce site broke when my webhost upgraded from Perl 4...)</comment></comment></comment>


DevBattles – Which framework wins today? - <AUTHOR> https://battles.dev <comment><USER2> fun site.. any plans for future development?

<comment><AUTHOR> Open sourcing it actually so folks can contribute if they find it interesting enough!</comment></comment>


Ask HN: How do you start a bank? - <AUTHOR>

Theoretically, if one wanted to, how would one start a bank?<p>Also, are there any conceivable reasons for a startup to be a bank startup? <comment><USER2> If you were in Australia I'd suggest you look into creating a credit union, or some other mutual/member based banking group.

Banks are highly regulated (so they don't fall over). A secondary group of bank-like organizations, eg finance companies/credit unions/mutual funds exist that have a much lower bar to register and if you are lucky one of these lighter structures might be more suitable to your purposes.

Credit unions for example ([https://en.m.wikipedia.org/wiki/Credit_union](https://en.m.wikipedia.org/wiki/Credit_union))

"A credit union is a member-owned financial cooperative, democratically controlled by its members, and operated for the purpose of promoting thrift, providing credit at competitive rates, and providing other financial services to its members.[1][2][3] Many credit unions also provide services intended to support community development[4] or sustainable international development on a local level.[5]"

</comment><comment><USER3> In the USA the first step is to get a large amount of cash. The bank needs money to even start, a lot of money. Then you need lawyers. In addition to general business things you must also file state and federal charters. You will need to then connect to many payment networks and the "fed" for funds settlement. Your Risk Officer will make a policy plan for lending and investing assets. Things get crazy based on the type of banking. Commercial vs Consumer, Construction lending, mortgage, auto, escrow and so forth. So pick a narrow place to start (commercial lending) and expand slowly (think years per product). There are many existing software solutions to manage these accounts, building your own is quite expensive. Your business will be audited by the FDIC every 6mo and you'll need plenty of documentation. Hire a firm like PWC in the off quarters to audit as well.

Look around for your smaller local banks, small ones can operate with only 400M in assets and still service home lending and consumer checking, savings and CDs.

The growth curve for banks is not like a tech-startup at all. Prepare for a multi-decade process.

<comment><USER4> You seem to have knowledge here, I have always had some of these same questions about "new" banks. What is the minimum liquid holdings that is required by the Fed to open a bank, and what is the leverage you can use against those assets (I'd assume it grows with the total liquidity values)? How does it work, is a smaller bank getting loans only from the Fed or from larger banks at "wholesale" rates? How does the Fed evaluate the risk profile of a small bank? Is it based on the leveraged assets or something more?

Ironically, I have done work for financial institutions but we worked on front line software and on basic web applications around peoples accounts, never the backend and no one I ran into understood how it really functions behind the scenes. Or maybe they just didn't want to take the time to explain to me.

</comment></comment><comment><USER5> It's hard to see a conventional bank achieving startup like hockey stick growth in any jurisdiction with moderate enforcement of conventional banking regulations. It might make sense for a company focused on serving banking to own a bank or two as a means of testing systems and perhaps marketing its products to new customers based on glowing testimonials from said banks.

While such an arrangement of banks as affiliated companies would require substantial upfront capital, it is feasible that such banks could be operated revenue neutral with regard to burn rate for the core startup while providing a somewhat liquid asset should the core startup go bust (which is technobabble for "a bank could be run to break even and sold when the underlying startup folds with the proceeds returned to the investors who funded its creation/purchase").

That said, a lot of high return capital is going into more predatory financial institutions such as payday and title loans because of the higher interest rates and lower regulatory burden and the fact that the rich people banks are designed to serve tend to have many good options while the customers who tend to use payday and title loans have few options and usually none of them are good.

Good luck.

</comment><comment><USER6> First thoughts are offshore microstates, unregulated virtual currency banks, or be extremely well connected to financial and political figures. I'd be drawn towards an autonomous, low cost, high volume virtual operation. A traditional brick and mortar bank would seem an odd thing to start at this point in time, unless your operation could be mostly automated in some way.

What are you thinking?

<comment><AUTHOR> I was thinking banks seem antiquated and cumbersome entities, surely there is a better solution?

But now it makes sense given the amount of legal work they must deal with.

</comment></comment><comment><USER7> This is called a de novo bank. The trouble is that states issue few to no de novo bank licenses since the 2008 crash. So if you want to do a banking startup expect to pay for an existing banking license or to buy an existing bank.

<comment><AUTHOR> That seems pretty unfeasible for a startup unless it already has significant traction. So it seems like bank startups are out of the question.

<comment><USER8> You could always do what Simple.com did, and partner with an existing bank for just the money storage part. They see their value add as their interface and customer service (both of which they do extremely well). The money storage part is just an implementation detail to them.

<comment><USER9> Bancorp is who'd OP would partner with. They have a platform built for integrations.

</comment></comment></comment></comment><comment><USER10> The most practically feasible way likely is partnering with an existing bank and using their license. NUMBER26 does this and from what I hear they're quite successful so far.

</comment><comment><USER11> I am currently exploring the same topic - starting a bank in the EU. E-Mail me if you want to chat! My address can be found in my profile.</comment>


We Are Coming for You, Tesla, and You, Too, Google, Says Hacker George Hotz - <AUTHOR> http://www.barrons.com/articles/BL-TB-50981 <comment><USER2> "In jeans and a black tee with the design of a white apostrophe on it,"

Not an apostrophe, its a comma.

I love how Geohot has immediately distilled autonomous driving down to 2 numbers: acceleration and steering. I also love his apparent crazy persona, but of course there is some brilliance in there somewhere. He's trying to solve a difficult problem but can come across as rather flippant.</comment>


Richard Stallman: "I Wished I Had Killed Myself" - <AUTHOR> http://opendotdotdot.blogspot.com/2010/04/richard-stallman-i-wished-i-had-killed.html <comment><USER2> The comments in the blog talk about arrogance and how someone else would have done what RMS did if he didn't exist. They also complain that him being a "nutjob" has actually done harm to freedom. This line of thinking is dead wrong. It takes someone precisely like RMS to stand for his ideal and dedicate his life to what he believes. I, personally, feel a great debt to the man.

<comment><USER3> The "someone else would have done it" seems particularly unlikely to me, at least at the time. If you were to list significant bodies of free software that were released between the FSF's founding in 1983 and the Linux kernel's release in 1991, they're almost all GNU projects. The one significant exception I can think of is the X consortium's decision in 1986 to freely license X. And the stuff that started to be released starting in the early-90s pretty much without exception built on GNU stuff (even all the free BSDs still grudgingly include GNU code, despite 10 years of actively reducing their reliance on it).

<comment><USER4> "Good enough" is the enemy of "perfect".

What do you think would happen to FreeBSD if GCC vanished tomorrow? Hint: It would probably suddenly finish incorporating some other, more freely licensed, compiler into its base system.

<comment><USER5> The question is not what would happen tomorrow...the question is what would have happened has RMS never existed. I think there's a pretty compelling case to be made that FreeBSD would have never happened; or at least, it would be a very different beastie.

I don't agree with RMS on all things, but he was absolutely instrumental in making our free software world what it is today, and just because you have differing beliefs about what a "free" license really is doesn't mean you should discount what he did for _your_ favorite OS.

<comment><USER6> _The question is not what would happen tomorrow...the question is what would have happened has RMS never existed._

My hope is that if RMS hadn't existed, somebody who wasn't a creepy, bearded hippy would have been the spokesperson for free software.. Hopefully somebody more balanced who didn't work himself into a tizzy over whether to call it "GNU/Linux or Linux" ..

<comment> loup-vaillant The creepy, bearded, unbalanced hippy is what you see when you judge Stallman with a glance. His words, on the other hand, are unusually balanced and reasonable. In his essays and conferences, he wields them with extreme care, showing he fully understand their power.

Hence his insistence over GNU/Linux. It boils down to being aware of the origins of the system you are using: how it came into existence, and why. The answer, of course lies in the mouth of the original author. In the case of GNU/Linux, the name of the system directly influences which guru we are going to listen to (Linus or Richard). This is very important, because the two men have very different political opinions.

Plus, as far as I know, GNU is bigger than Linux, in probably everything. Especially at the beginning of Linux. So the legitimate name of the entire system may well be "GNU". Unfortunately, the GNU system became popular largely thanks to the Linux kernel, and people started to use the wrong name for the entire system. Really, "GNU/Linux" is a reasonable compromise.

<comment><USER5> One doesn't even have to agree to use the term "GNU/Linux", in order to have some respect for the man who made a huge impact on a community and culture we all benefit from. We owe him a great deal of respect. That doesn't mean we have to use the exact same language he uses. I don't call Linux "GNU/Linux", for example, but I would never hurl insults at the man who made so much of this possible. Humans have a strong sense of "other" and since RMS has decided to be so other-ly from mainstream society, he gets a lot of flack. That judging is a failing of the people doing the judging; weak egos attack others to try to make themselves feel better. RMS is following his beliefs, completely and without reservation, which is something few of us have the guts or gumption to do. I respect him for that, even while disagreeing with him on a few things (like the name GNU/Linux).

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> An appropriate quote from George Bernard Shaw: "The reasonable man adapts himself to the conditions that surround him... The unreasonable man adapts surrounding conditions to himself... All progress depends on the unreasonable man."

</comment><comment><USER8> I don't see Stallman's statement as to whether his birth had a good impact on the world or not as necessarily arrogant. Arguably, that's a question everybody needs to or ends up asking themselves: on balance, has my existence been a positive one?

While there might've been an open software advocate without Stallman, it can't be seriously said that the world would've been better off without Stallman's advocacy. And thus, on balance, the world's better off with Stallman than without.

</comment><comment><USER9> I'm glad he lived, and I'm thankful for his contributions. But holy shit, he makes me sad everytime I see him or read about him.

This guy needs to cheer up.

<comment><USER10> He's about the worst PR possible for free software. I like his code & I mostly drink the kool aid, I do, but he really needs to let Eben Moglen do the talking..

</comment></comment><comment><USER11> He needs to get married and have a kid.

He doesn't want to because he thinks it's too easy, but he's still a human.

<comment><USER12> He is on record as not wanting to have a kid because in his view the planet is over-populated. Also, I don't fully understand (due to lack of inquiry into it) his view of marriage but I'm fairly certain that "thinks it's too easy" is not accurate.

<comment><USER13> <http://www.craigslist.org/about/best/bos/533096562.html>

I'm not 100% sure if that was put up by him, but I've been told that it was.

<comment><USER14> Let's assume that's his post.

I'd think Stallman would have no problem finding an interested woman, provided he emphasized his fame rather than a self-described lack of "success".

All the people grabbing cheap cool points by dumping on the man are ultimately making it harder for him to get a date, and that's just needlessly cruel.

<comment><USER15> His fame is very subjective. He's not famous in a way that is attractive to the average woman, hence his difficulty in finding an ideal mate.

I would presume that _if_ Stallman has romantic troubles, it's due to something other than people dumping on him.

<comment><USER16> You think he's not finding a woman because he's not famous in a way that's attractive to women?

Hilarious.

How about this: he has a very arrogant personality, the ego the size of a blimp and it's just impossible to have a conversation with him unless you agree with every single word he says.

<comment><USER15> I don't think that at all. I was responding to a post that claimed RMS should use his fame to attract women. I doubt that will work for a number of obvious reasons.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Seems to me that without the programmers who went the commercial route (Gates et al), computers wouldn't be as widely used and his impact wouldn't be as big. Or that someone else wouldn't have stepped up in his absence. And statements like those quoted in the article seem just a wee bit overdramatic.

<comment><USER18> > programmers who went the commercial route (Gates et al)

It's a false dichotomy. There is no need to imprison (as Stallman would say) the user and disrespect his rights (at least to use, understand, improve) in order to be commercial. What "Gates et al" have done is to bind their users through the software they use to manage their lives and jobs, ensuring long- term prosperity through technological dependency.

The folks at Red Hat, Canonical and MindTouch (just to name a few I have in my head right now) are every bit as serious as Microsoft when it comes to be commercial and to be paid for their work.

The main difference being they show much more consideration towards their users and customers.

<comment><USER19> Red Hat, Canonical and MindTouch combined have not had as much impact on computing as Apple or Microsoft alone. I was going to qualify that, but no, I think it's pretty unequivocal.

Also, your selection of companies seems a bit deceptive. These companies' profit strategies are very narrowly focused on the one market where it's possible to make money with free software — and even that isn't really making money from the software. You have to be in a market where people will pay through the nose for support contracts, because the software itself isn't making much money.

The one real exception I can think of is Mozilla, which makes decent money off of Firefox. Otherwise, unfortunately, it does generally seem to be necessary to bind the users enough to make them pay you for the software. (That's not a sarcastic "unfortunately" — I do think it would be great if I could reasonably sell free software as profitably as non-free software, but I don't see any evidence that it's feasible.)

<comment><USER18> > Red Hat, Canonical and MindTouch combined have not had as much impact on > computing as Apple or Microsoft alone.

Wouldn't that be a question of time and business model? Apple is a hardware company and both were around when the PC (not the IBM one) was invented.

> isn't really making money from the software

It's very hard to directly make money from software sales if you grant your customers the right to share it. Software companies make money out of the scarcity of software ("You want Windows? Ask Microsoft"). Free software is naturally abundant. It's possible, but not easy, to make your users pay directly for it.

And Mozilla can't ask users to pay for it. Not only because it's infinitely abundant (anyone can give you one) but Microsoft's IE comes bundled in the OS most Firefox users run. Opera does that and look at their market share.

<comment><USER19> And that is why it is generally necessary to "imprison" (as Stallman would say) the user. Otherwise you're making a product that won't make money. There are a few markets where you might find a connected business to recoup the money you spent on software, but it's not a general business model for development.

That's what I was getting at: It's hard to be rewarded for free software, so there really is a dichotomy between free and commercial software. It's not just Jobs and friends being dicks and restricting customers.

<comment><USER18> > you're making a product that won't make money

No. You are only making software that doesn't usually get sold. Most of it isn't, but you can custom-develop - building upon piles of other free software - and then license it under a free license to your client who chooses whether to share it (always under a free license) or not. Free software can be sold. I know this because I did it a lot.

> It's hard to be rewarded for free software

OTOH, it's much cheaper and easier to develop it. With closed software, you have to invent your own wheels. With free and open-source software, you are free to use the ramjet engines other people have developed.

<comment><USER19> Again, you're outlining a highly specialized business plan for custom development — not a general principle for making money with FOSS. If I freely license my next game, I'll lose my shirt. If I create an awesome, game- changing productivity suite and GPL it, I'll lose my shirt. If I do anything outside of some very tiny niches, I'll lose my shirt.

There are a few small areas where FOSS is as commercially viable as anything else, and you'll notice those are also generally the areas where it seems to be most mature. You can't generalize those tiny areas and say that making open-source software in general is a reliable income source.

<comment><USER18> It's not possible to make a business out of selling goods that are infinitely abundant. Free software is one such thing.

Making open-source is not a direct income driver and, apart from very limited niches, will never be, but, nevertheless, it allows a business to have full control of its technology stack.

Company A builds a great game using a closed-source library built by company B and company C builds another great game using, say, an LGPL library. When the underlying platform changes, breaking both libraries, company C is not subject to whatever the strategy of company B is and, therefore, can be first to market with a new, compatible, version.

This is a hypothetical situation, of course, but illustrates one important thing about free software - most people don't really make it: they use it and, from time to time, and, if and when the need arises, add a little improvement here or a fix there. Its strength lies in the sheer number of people that give a little hand, scratching one another's itch.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> I for one am very glad RMS existed to write emacs and save us all from vi.

<comment><USER21> I'm glad RMS existed to write emacs and give vi users someone to look down on ;-)

<comment><USER20> Something that emacs and vi users can agree about then - we're both glad that RMS wrote emacs!

<comment><USER22> you have a point ;)

<comment><USER4> Is this where we all sing kumbayah together?

</comment></comment></comment></comment></comment><comment><USER23> Either computers would be useless novelties or they would be mainstream and lose the hacker/counterculture status. Those are the only two options. There is no way that every person on earth was going to care about source code. Progress is still progress even if it's not what you want.

There is plenty of fun to be had still in technology, just don't get married to a philosophy. I learned that the hardway.

In the early days I ran a BBS. When the Internet became mainstream I remember thinking "how do I compete?" I redoubled my efforts: upgrading modems, adding drives/door games, increasing my software library, etc.... All the time thinking "where's the 'community feel' on the Inet?" By the late 90s I realized the problem was me and not the world.

<comment><USER24> _Either computers would be useless novelties or they would be mainstream and lose the hacker/counterculture status. Those are the only two options._

Maybe you don't look at your cell phone or nintendoDS and think "hmm, there must be some way to run irc on this thing". Maybe you don't care anymore, but there are huge communities who do. Maybe the spirit of openness is fundamental to the tools themselves?

</comment></comment><comment><USER25> _Sure, in his absence others may have stepped up to the job, but in this world, he did. We can sit and imagine all we want that with a different leader, FOSS would be better. But, that doesn't change the fact that we have him to thank for so very much._

From the comments on the OP's blog. :)

</comment><comment><USER26> I know very little about Stallman beyond his role in the GNU Project. What pain is he referring to that makes him wish that he had never been born? The loss of hacker culture?

<comment><USER27> I'm wondering too. He has a kind of "Woe is me" attitude, but all I know of him is that he eats his toe skin in front of his audience.

I also don't know if his existence has had a net positive effect. Free software he advocates is used to power robots, missiles, and other weapons that kill many people. It has also taken money from developers who write good software and shifted it to middlemen who sell services for free code, which limits the viability of writing code and the financial options for hackers to put a roof over their heads and food in their mouths.

If you really want to help hackers and keep the hacker culture alive, teach the world that software has value and is worth paying for.

</comment></comment><comment><USER4> Stallman's hubris is shocking -- and I'm not talking about his claim that the world is a better place for him having lived. I'm talking about this line of shit:

> I'm the last survivor of a dead culture.

<comment><USER28> That quote makes a lot more sense when taken in context. It's from the 1983 epilogue to Hackers.

In 1983, there was no "free software" as we have today. No FSF, no EFF, no Creative Commons.

Additionally, Stallman's interview is at the end of a book about the guys who started "hacker culture". These guys did some amazing stuff: they physically modified one of their computers to add new machine instructions, wrote editors, compilers and games from scratch, etc, etc. Then they made their code available for free.

When I read that quote in the book, I interpreted it as Stallman expressing sadness over the loss of hacker culture.

<comment><USER29> I think that is what apotheon means! Hacker culture is far from dead; it is alive and well, just different.

It's just him being stuck in the "glorious past" (nothing really wrong with that) and assuming that hackers should be working with computers on that sort of level.

Things move on; if we still had to do all that computing wouldn't have moved on very fast :P

I heartily disagree that the culture is materially different - it's just spread out a bit more (instead of being on the university campus' etc.)

<comment><USER4> Hacker culture not only _is_ alive and well -- it _was_ alive and well through those years, too. It was just less visible, and since Stallman was moving through different circles, it wouldn't have felt as much to him like it was all clustered around his immediate vicinity.

It is to some extent in human nature to assume that what's happening around someone is what's happening everywhere -- but that's really no excuse for declaring himself the last of his breed as he did. In fact, I'd say that the rise of the cypherpunks was a stronger resurgence in the hacker culture tide than Stallman's generation, and actually far more committed to freedom in an essential sense.

The fact things change doesn't mean the good stuff has all died off. I think we're a lot better off for the modern state of hacker culture than if there was still the kind of hacker culture that existed Way Back When. Concepts of freedom, inquiry, and improvement that are central to a hacker culture have become more refined and encompassing than they were in those early days, which is pretty much what happens with everything that sees long-term success; it starts out less well-defined, and feeling more "special" because of its rarefied nature, then grows more widespread, better defined, and more generally applicable, thanks to the efforts of people who pick up where a previous generation left off to add their own efforts to the continuing evolution of the movement.

Far from being the last of his breed, he went from being an early visionary to a late relic, from what I can see. I might not have used such harsh terms for it, but his own statements about being the last of his kind pretty much completes the picture of Stallman as a dinosaur who has died and is too stubbornly attached to his own illusions to realize it.

Yeah, the culture isn't materially different. It has simply continued developing. If it had remained exactly the same as it was for Stallman's early peers, that wouldn't have been success. It would have been stagnation.

He should learn to take a cue from people like Ken Thompson, who has managed to remain relevant and continue to contribute fresh new ideas to the state of general purpose operating system design all these years. Yes, advocates for freedom in our software development model are of critical importance; I'm not arguing otherwise. I think, though, that Stallman's apparent idea that such advocacy should focus on trying to recapture a communal sharing model that worked for a very small number of people who mostly knew each other, at least peripherally, is naive at best. Furthermore, the way Thompson and his spiritual descendants lead by example does almost as much for effective advocacy as the actual advocates (e.g., Bruce Perens and Theo de Raadt, to name a couple out of many -- who are, unlike Stallman, well-known for being currently contributing developers as well as advocates, thus lending credence to their statements even when they're abrasive in the extreme as de Raadt can sometimes be).

Looking at things with a critical eye, Stallman is the only guy I can think of who is granted so much relevance as both a developer and an advocate for freedom in software use and development whose achievements are always described in the past tense.

</comment></comment></comment></comment><comment><USER30> The linked article [1] is worth reading.

1\. <http://www.wired.com/magazine/2010/04/ff_hackers/all/1>

</comment><comment><USER31> "This "pain" that Stallman says he has endured makes his decision to champion tirelessly freedom and free software for all these decades all the more remarkable."

Alright, I realize this might be a bad statement to make on this subject... but seriously? He's a free software advocate. It's not like he's Ghandi going on a hunger strike or Martin Luther King Jr going to jail over his beliefs.

<comment><USER32> Stallman agrees with you:

 _"I hesitate to exaggerate the importance of this little puddle of freedom," he says. "Because the more well known and conventional areas of working for freedom and a better society are tremendously important. I wouldn't say that free software is as important as they are. It's the responsibility I undertook, because it dropped in my lap and I saw a way I could do something about it. But, for example, to end police brutality, to end the war on drugs, to end the kinds of racism we still have, to help everyone have a comfortable life, to protect the rights of people who do abortions, to protect us from theocracy, these are tremendously important issues, far more important than what I do. I just wish I knew how to do something about them."_ \- Free As In Freedom by Sam Williams (p66 or p73 depending on version).

</comment></comment><comment><USER16> I think that a great free open source leader has already been born but he committed suicide, so instead, now we have Stallman.

</comment><comment><USER33> After reading this I felt a deep sense of pity for RMS.

Even if he was only referring to his perceived lack of belonging, openly fantasizing about suicide is not the sign of someone in a healthy emotional state.

I hope very much that he has grown past this point his life.

</comment><comment><USER34> It's a real shame that inventor of the time machine, Leo Schultz, travelled back in time from 2042 and killed himself as a child. We'll never have a time machine now :-(</comment>