China Just Blocked Thousands of Websites - <AUTHOR> https://zh.greatfire.org/blog/2014/nov/china-just-blocked-thousands-websites <comment><USER2> Speaking entirely divorced from my opinion on China politically (as someone with strong US and TW ties, FWIW), I think the Great Firewall has been a brilliant economic move in retrospect. While it may have been an accidental side-effect, blocking so many foreign sites has enabled a flourishing of domestic internet companies of the likes that nobody but the US has seen unless I'm mistaken.

And for a "middle class" of blocked sites, while not technically blocked, the packet delay is so great most people (except a dedicated few) will just shrug and figure that cross-continent internet connections must be too slow to be practical. Accessible, but only if you're willing to wait a minute. A brilliant political play, because it's hard to pin a charge oppression on anyone, since the information is technically there, but so slow nobody will access it.

<comment><USER3> The side-effect was definitely not accidental. China has blocked the major company in every internet industry (social networks, search engines, video streaming, etc.), and as a result domestic products are booming. Now these domestic products are starting to expand internationally with the revenue they get from the artificial Chinese market.

Korea did something something similar with its Chaebols' (Hyundai, Samsung, or other large Korean companies in countless industries) in the 80s. It had protectionist policies that let the Korean companies charge outrageous prices domestically, and used that revenue to become very competitive internationally. And it worked.

<comment> Al-Khwarizmi Actually, all the major economic powers got there by means of protectionism. Economic liberalism is nice when you're already at the top.

<comment><USER4> Is that true? I got the impression the US and UK mostly became major economic powers by being ahead on tech in their day and China mostly by undercutting everyone on price through low wages and low environmental protection. OK China is protectionist but iPhones are made there because it costs less, not because of restrictions on importing phones to China. Dunno if you've got a source? I'll give you protectionism seems to have worked for S Korea though I'm not sure I'd call it a major economic power. Also what I'd think of as the most similar competitor in the area, Taiwan, has a higher gdp/captita without all the Chaebol protecting stuff.

<comment><USER5> The US became an economic power in large part because of slavery [1]. And I don't mean to say that in a snarky or condescending manner. The US is hardly the only country to give itself advantages. As you say, China's taking advantage of the environment. Protectionism is extremely active (subsidies and import tariffs). Wages are kept low.

Comfort and suffering seem to go hand in hand. Subsidized rice creates a surplus, which floods the market, which [seemingly paradoxically, but not really] results in famine in Haiti.

[1] - [http://www.salon.com/2014/09/07/we_still_lie_about_slavery_h...](http://www.salon.com/2014/09/07/we_still_lie_about_slavery_heres_the_truth_about_how_the_american_economy_and_power_were_built_on_forced_migration_and_torture/)

<comment><USER4> I can believe you on the slavery thing but that's not really protectionism. Without being moralistic about anything I'm still skeptical that protectionism, as in restricting imports, works particularly well for a country as a whole.

<comment><USER6> Well, let's do the standard mathematical thing and take the extreme case. Imagine that some country sucks so much that all its industries are less efficient than those in other countries. Since capital is free to move between countries nowadays, Ricardian comparative advantage doesn't apply, and the end result is that no one ever invests in the country's industries, so it just stays poor forever. You might try to use government investment to prop up domestic industries, but the government doesn't have too much money because the country is poor to begin with.

It seems like protectionism would help in this case, by creating a market that can only be satisfied by domestic industries. And since there's a spectrum from this case to more realistic cases, there's also a spectrum of usefulness for protectionism. Does that make sense?

<comment><USER7> > Since capital is free to move between countries nowadays, Ricardian > comparative advantage doesn't apply

Ricardian comparative advantage always applies when ignoring transaction costs; reducing transaction costs for any given set of transactions (e.g., by eliminating formal restrictions on capital movement) increases (rather than reduces) the likelihood that Ricardian comparative advantage applies.

(If you want an extreme case in which Ricardian comparative advantage to fails to apply, you need to assume extreme transaction costs -- one of the canonical hypothetical examples where this is argued to the case is an interstellar civilization without FTL travel.)

<comment><USER6> I don't see how that's true. Let's run through the standard example from Wikipedia.

1) England can produce a unit of cloth for 100 units of labor, and a unit of wine for 120 units of labor. Portugal can produce a unit of cloth for 90 units of labor, and a unit of wine for 80 units of labor. Portugal has absolute advantage in both goods, but England has a comparative advantage in cloth. By the standard Ricardian argument, we get lots of trade and happiness.

2) Now let's change the situation slightly. Replace all occurrences of "units of labor" with "units of capital", and assume that capital can move freely between countries. We've lost the key component of comparative advantage, the idea that producing a good forces you to "forgo" producing some other good. Everyone just produces everything in Portugal, and England dies. Whoops!

3) Now allow England to set up protectionism, so that all wine consumed in England must be locally produced. This way it can survive. Not very nicely, but between (2) and (3) I'd choose (3) every time.

Am I missing something?

<comment><USER7> You are missing that for capital in England to move to Portugal, something has to move the other way.

If you look at actual neoliberal trade, a lot of production of goods (and even services, to the extent that they can be provided remotely) moves to the peripheries, but the core's comparative advantage becomes in _renting out surplus capital_ (which produces even more surplus capital to rent out). That is, the developed world in actual neoliberal trade with free capital movement are the countries that are like _England_ in your example.

<comment><USER6> > _You are missing that for capital in England to move to Portugal, something > has to move the other way._

Why? Because nature abhors a vacuum? :-)

As far as I can tell, production doesn't really move to the poorest countries like the one in my example. It seems that it moves to countries that have an absolute (not just comparative) advantage in manufacturing costs.

<comment><USER7> > Why? Because nature abhors a vacuum?

Well, because "England" and "Portugal", on the level that Ricardian comparative advantage really works, aren't really _countries_ , but sets of people (and, really, the comparative advantage really exists on the individual level, its existence between sets of people is simply an aggregate of its individual existence.)

Absent an external actor using force to compel an involuntary transfer, productive capital moving from person E to person P requires some item(s) of value moving to E such that the value to E justifies surrendering the capital.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> "We have acknowledged all along that our method of unblocking websites using "collateral freedom" hinges on the gamble that the Chinese authorities will not block access to global CDNs because they understand the value of China being integrated with the global internet."

If they "understood the value" of that, these shenanigans wouldn't have been necessary in the first place.

<comment><USER9> If you think about it from a purely practical standpoint, it would make sense for all countries to block the any CDN that isn't on their soil. Local companies make more money hosting websites, less traffic on the pipes coming into the country, and better control over what is censored.

<comment><USER10> ...and higher prices for consumers in those countries.

<comment><USER11> Sending money overseas only benefits the single buyer in the short term. Keeping it within the country increases the wealth of that society leading to better services for all citizens.

<comment><USER12> Here's a counter example:

A island nation with highly accessible fisheries populated by 100 people in the middle of the ocean could spend their labor on building a CDN or fishing.

If they use other's CDNs, the money they sent would be used by foreigners to buy their fish, which could be produced very cheaply. Building their CDN means forgoing their fishing opportunity. Building a CDN means they can now sell their CDN services cheaper than it would have cost them to run a website to sell their fish, but the benefit is marginal compared to the income they would have received by focusing their labor in an industry where they have comparative advantage.

They must choose only one because they have limited labor.

...Land, labor, capital and technology is wealth, and money only represent a claim on that wealth.

<comment><USER13> I'm not sure if this really addresses your argument, but China certainly doesn't have a limited labor supply... Quite the opposite

<comment><USER14> The comment being replied to specifies that blocking and building would be a beneficial activity for all countries to participate in.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> I'm currently in China. VPNs are very common and popular here. Many work very poorly unfortunately (Private Internet Access included). Astrill appears to be the most popular and best performing. A few high-end hotels that I've stayed at route all traffic through a VPN to cater to their Western audience.

Many, many people with little technical ability use a VPN, especially in businesses dealing with the West.

<comment><USER16> There are better VPNs for China: [http://www.greycoder.com/openvpn- china/](http://www.greycoder.com/openvpn-china/)

</comment></comment><comment><USER17> China does a good job in what it intends to do.

Most non-Chinese IP websites are not blocked but traffic gets slowed down by factor 40. I have an offshore webserver. A ping suggests a 50% packet loss.

Often you can access foreign websites. At least sometimes. Some days even gmail does work. Everything works sometimes or a little bit and or is unbelievable slow.

What I never understood with my self build SSH proxy VPN: China seems to be able to sniff on it. Facebook and Google were most of the time not working, even with the proxy. Maybe the 50% packet loss makes their websites non functional.

I just bought Astill VPN and for now I must say they are doing a tremendous job.

<comment><USER18> > A ping suggests a 50% packet loss.

This likely caused by the limited peering arrangements of your host. I rent ~10 virtual private servers outside China, and ping times vary between 90ms ('best' provider) to 500ms ('worst' provider). Packet loss varies over time, but has never been an issue with > half of the providers.

> What I never understood with my self build SSH proxy VPN: China seems to be > able to sniff on it.

Were you using an HTTP proxy (e.g. forwarding a local port to squid running on your VPS) or a SOCKS proxy (just using the SSH command to act as a socks proxy)? If the latter, then your DNS queries would still be resolved locally (probably by your ISP's DNS server and, even if using an external DNS server, subject to MITM).

<comment><USER17> No. I use DNS via my SSH proxy

##Preference Name Status Type Value

network.proxy.socks_remote_dns user set boolean true

<comment><USER18> Hmm... perhaps malware on the client? I can't imagine your SSH connection is being MITM'd.

</comment></comment></comment></comment><comment><USER19> There are a number of ways to help people in China gain access to the open Internet. One easy way to help is to setup an obfsproxy bridge to alleviate the shortage.[1] The quickest and easiest way is to setup your free Amazon EC2 account with the Instructions at the Tor Cloud Project page[2]. It took me just a couple of minutes to install my free EC2 account. Another option is to donate money to pay for the bandwidth that Tor relay and exit nodes require.[3]

NOTE: A bridge is not the same as an exit node. Only exit nodes could possibly attract attention from authorities. If you are just running a bridge, you are only helping people circumvent government firewalls to join the Tor network. The default EC2 Tor Cloud images only run as a bridge.

[1] [http://arstechnica.com/information-technology/2013/04/tor- ca...](http://arstechnica.com/information-technology/2013/04/tor-calls-for- help-as-its-supply-of-bridges-falters/)

[2] [https://cloud.torproject.org/](https://cloud.torproject.org/)

[3] [https://blog.torproject.org/blog/support-tor-network- donate-...](https://blog.torproject.org/blog/support-tor-network-donate-exit- node-providers)

</comment><comment><USER20> Inevitable. As people start using other services to get around the wall, those services will be blocked no matter how popular they are. Given what we've seen of Xi so far, I guess Chinese internet will probably be mostly cutoff from the rest of the world by the end of his term.

<comment><USER21> Yes. But I think it could be way sooner than most of Chinese can be aware of. Consensus among average people in China seems in favor of Xi now. Someone is just picking up the organization's old-fashion tricks and copying them and hoping all of them work as expected since those are all that they know. When the energy begins to loose, everything could turn up-side-down shortly. It has not started yet. Everybody needs a huge stable market now. Perhaps leader can get what he wants in the end.

<comment><USER22> Too me it'll be the end of the world...

</comment></comment></comment><comment><USER23> When I was living in Beijing some month ago the bad Internet really upset me. Almost every international connection was quite slow. A lot of pages took minutes to load because so many sites use Google hosted fonts, js libraries or API. These requests took about a minute to timeout and finally the browser could start to render the page (e.g using a default font). Most vpns are like described often slow, so also no solution. I then wrote a chrome plugin to filter all requests to Google hosted libraries and rerouted them to a Chinese service which mirrors Google hosted libraries. This really improved my surfing experience.

</comment><comment><USER24> I'm really surprised that so many people are still just talking about it in an economic prospective. I'm not talking about Human Rights or Freedom because the government don't event accept them. I just want to surf the Internet.

Currently it works well because we get more and more tools to deal with GFW, but do you know how frustrating it is in the early days of the Internet in China that you spent nearly half of your life just to solve "networking issues"?

Put yourself in others' shoes for a moment please.

</comment><comment><USER25> I've often thought one could make an economic argument against filtering. But for that to work, those in charge need to care about the losses. I think of it like those Mastercard ads [https://www.youtube.com/watch?v=GofscoXnpDw](https://www.youtube.com/watch?v=GofscoXnpDw)

"Losses due to filtering: X yuan. The illusion of control: Priceless. Some sites we like, for everything else there's the GFW."

<comment><USER26> You could also make an economic argument _for_ filtering: the infant industry argument.

Protection from the west by the great firewall has made Chinese services flourish.

Compare this to say, Japan, where the native social network Mixi has been practically destroyed by foreign competitors.

<comment><USER27> > Compare this to say, Japan, where the native social network Mixi has been > practically destroyed by foreign competitors.

Or, maybe it was that Mixi had been lagging behind for ages and deservingly died off. You might also want to add that Line [1], a domestic company (well, subsidiary of a South Korean company, but still...), is now pretty much dominating the market.

[1]: [http://en.wikipedia.org/wiki/Line_(application)](http://en.wikipedia.org/wiki/Line_\(application\))

<comment><USER28> In fact it's so good that it's now making inroads in Europe and North America. If you play internet games many of the guilds require members to use LINE. I picked it up to chat with friends in Japan and love it, I'm now trying to get my friends to switch over.

</comment></comment></comment></comment><comment><USER29> tl;dr Greatfire.org hosted content mirrors on edgecastcdn.net , China bans *.edgecastcdn.net altogether.

<comment><USER30> How helpful of them. Maybe they can throw a mirror up on Akamai and CloudFlare next.

<comment><USER29> They already did. See their wiki [https://github.com/greatfire/wiki](https://github.com/greatfire/wiki)

They are hosting mirrors on Akamai, Azure, Cloudfront.

They previously hosted on Amazon S3 and Cloudflare, they were blocked in China already

<comment><USER31> oh god, Greatfire.org, stop trying to make every cdn service being blocked!

<comment><USER32> China is trying to make every CDN blocked, not Greatfire.org. Stop blaming the victims.

</comment></comment></comment></comment></comment><comment><USER33> China should block itself from the internet instead. I am running several servers and getting the most useless/annoying bot/malware traffic from China. Even that I had to block everything that comes from them.

<comment><USER34> You mean we should filter our connection based on what IP it is coming from. Yeah, that's a good idea...

</comment></comment><comment><USER35> I legitimately want to know why the "Great Firewall" doesn't block spamming botnets that post to wp-comment.php hundreds of times per hour.

<comment><USER36> I think that the firewall is predominantly one way. Restricting access to external information rather than prevention of hackers going out.

But, I agree. I'd also like to see them stop. I now use a geo-IP filter and whitelist the few countries that actually don't appear to spam that much. Needless to say, China is not on that list.

Out of interest Brazil, Ukraine and Russia are also banned for this reason. Does anyone else have loads of comment spam originating from Brazil?

</comment></comment><comment><USER37> I was about to ask, "Anyone know the significance of the part-way filled red- links?"

Did an inspect element/hover over the links and it shows the percentage that the site is blocked, which seems to be the same as the proportion of the link background that is red. Pretty neat use of styling.

</comment><comment><USER38> My former room mates were from China and I was really surprised to learn that they supported the Great Firewall. They didn't seem to have any issues with it and even thought it was for the greater good.

<comment><USER32> Foreign students from China know they'll have a very good chance at becoming one the oligarchs ruling the country, and as such likely think any tool as keeping the people subservient is a good thing.

I find it unlikely that Chinese rulers would want to send abroad anyone but its loyal opposers of democracy.

<comment><USER39> Are you seriously suggesting that Chinese students are all vetted by the government to make sure they are Pro-Communist and Anti-Democratic? AND they are all from the "ruling class".

wow. I don't even...

<comment><USER40> Chinese students who study abroad are "oriented" in official programs before they go abroad. Some may be more influenced by those orientations than others, but that's a much more comprehensive program in China than anything like that elsewhere. When I left the United States to study abroad, I had no government- sponsored program to get me ready for that experience at all.

<comment><USER41> I have no idea where you got that impression, but based on my personal experience as an International student from China, most of the Chinese undergrad students get financial aids from relatives and post-graduate degree students live on university funding. It is extremely rare to have students who are "sent" by the Chinese government and few people actually have strong preference of returning to China after they complete their study over getting a job abroad.

</comment></comment></comment></comment></comment><comment><USER42> I think the easiest way to undermine China right now is to trick them into further limiting it's own connectivity with the global internet by banking on their zeal for censorship and their itchy trigger finger.

Not that I'm advocating this as a strategy, it's more of a warning. China has enemies, and those enemies can do a lot of damage feeding the fire that drives it's governments oppressive policies. And they can do it practically for free.

</comment><comment><USER43> I think websites should be re-developed as torrents

<comment><USER44> I think Freenet is the closest thing to a distributed, encrypted network like the one you speak of.

[https://freenetproject.org/whatis.html](https://freenetproject.org/whatis.html)

</comment></comment><comment><USER45> Does anyone know if Cache Databases are blocked? I made a chrome extension called WebCache that views the cached version of a webpage which would be helpful if Google Cache, Wayback Machine, or Coral CDN isn't blocked. Here is the source: [https://github.com/Dbz/WebCache](https://github.com/Dbz/WebCache)

<comment><USER46> The first two are definitely blocked (without the Greatfire mirrors). I'm not sure about Coral CDN.

</comment></comment><comment><USER29> Apparently Greatfire.org think this caused "significant economic loss as many businesses will be impacted".

I think this only cause problems for edgecast customers, and China doesn't give the slightest fuck.

And for those people who does want to see those "collateral freedom" mirrored content, they already have their own private circumventing methods.

<comment><USER47> Edgecast customers include some very popular websites, which are certainly used by consumers and businesses in China. So it's definitely a problem for China. Now, whether the Chinese _government_ gives a fuck is indeed another matter. I'm sure they can browse whatever they want.

<comment><USER48> After living in China for a few years, I understood something: the __only __thing chinese government cares about is its longevity. The whole system is designed to keep the party in the control seat. Economic growth was a way, now that 's is slowing down, the party is finding other ways, but it would be a mistake to think chinese economy is more important than power for the party.

</comment></comment></comment><comment><USER49> Personally I have to thank the great firewall for blocking Facebook and Twitter so that I would not waste my time on these nonsenses. For serious problems I do not mind find a way to access google, but I would not do it to try to access Facebook especially when none of my friends are there.

<comment><USER50> There are other methods like discipline, that don't obliterate your personal freedoms.

</comment></comment><comment><USER51> May sound opportunistic but there are some great opportunities here to create domestic companies that mimic those companies that have been blocked.

</comment><comment><USER52> Yes, and this article itself has been blocked too.

<comment><USER53> Is there any way I can buy a Chinese VPS to see the impacts of the blocks myself?

<comment><USER54> There's a bunch of providers listed on [https://www.exoticvps.com/](https://www.exoticvps.com/) .</comment></comment></comment>


Machine-generated husband chatter - <AUTHOR> https://medium.com/@sharanvkaur/visakanv-rnn-machine-generated-husband-chatter-c2b431bf0ac2 <comment><USER2> Ah, this brings back memories. I tried something like that about 12 years ago, with a homebrewn half-hardcoded, half-neural thing and a large set of Jules Verne books.

The giddy excitement of being on the verge of unlocking the power of language slowly turned into confusion and then decayed into disappointment as i slowly realized that the task was maybe a bucket of orders of magnitude harder than i thought. I think it produced some coherent phrases every now and then, but mostly it was a random words generator.

...I miss these amplified feelings of cluelessly diving into an impossible project...

<comment><AUTHOR> > The giddy excitement of being on the verge of unlocking the power of > language slowly turned into confusion and then decayed into disappointment > as i slowly realized that the task was maybe a bucket of orders of magnitude > harder than i thought

This was very wonderfully articulated! Do you have a blog or something?

<comment><USER2> Well, Orbital Designs [http://orbides.org](http://orbides.org) certainly qualifies as "something", but i'm not sure how much of a "blog" it really is since all of the content is indexed. :)

<comment><AUTHOR> I like it! Very nice.

</comment></comment></comment></comment><comment><USER3> Strangely enough, I find the output of Markov Chain - type text generators much more readable and coherent than the output of those RNNs. A Marov Chain text generator is also easy to implement and understand.

<comment><AUTHOR> Interesting. Why do you think that is? (More readable, that is)

<comment><USER4> If I were going to guess (not the parent), it's because human parsing is quite localised, and Markov models tend to optimise well for localised coherence.

Their failure mode is long sentences which don't go anywhere (or mean anything), but that's less grating than a blatant parse failure, especially if you're skim reading.

<comment><AUTHOR> That actually makes a lot of sense, great point.

</comment></comment></comment></comment><comment><USER5> I came up with similar results by just tracking word probabilities and then regenerating text based on those probabilities.

Feeding it Edgar Allen Poe produced the best results:

twelve vibrations of purple air. vortex of its absolute hurricane. monck flying footsteps of the picture all the police are concerned. silence on a year in an identity. materiality escaping the city was their white spot of printing apparatus all things only one supposes it were its mere duration that it in baltimore monument to its luxuriant nature asserts her person whom i not hesitate about five hundred paces to have not the principia of idiotic thought of curvature or metamorphosis these friends were in an earthquake and the then i felt my chair so rigidly of interest could not summon courage

Here's the TED version I just generated using the input.txt from one of the linked articles: [https://github.com/samim23/TED- RNN/](https://github.com/samim23/TED-RNN/)

educationists made around in our modern medicine. gq did make perfect mankind which the blue pill every week had infinite instant messaging that sucks when your food day that previous background is about being foreign interventions. psychopharmaceutical arsenal. attached to tail but a distribution units in our traditional estimates that men engineers who negotiate my whole province of long awkward to call it came back go deep conversations you grow fast when there been around the long lever systems.

entertaining anyway, and occasionally amazing

<comment><USER6> Holy shit, that's awesome. Do you have the code used to generate this available somewhere?

<comment><USER5> Thanks for noticing! :) I will tidy it up and put it out there soon. I'll let you know after I've done that. :)

</comment></comment></comment><comment><USER7> I've also did this a few months ago with a dump of all my telegram messages. I thought it could be a nice chatbot. I was wrong. :-(

<comment><AUTHOR> Haha yeah it's a little disappointing (yet interesting) how it comes close but misses the mark. I wonder how far away we are to having machine-generated output that's tough to distinguish from the input you put into it.

<comment><USER8> The Obama one is much better, but the thing is none of these are even remotely close. They sort of seem close on the surface if you simply don't engage any critical parts of your brain, or try to extract any meaning, but if you do the semblance of meaning that's inherent in the words melts away into nothing.

To generate output that contained meaning that you could actually engage with, you'd have to first generate the meaning and then turn that into text. That's a fundamentally different process to what is going on here. This is also why 'Turing Test' competitions involving chat bots are never going to give us artificial intelligence.

This sort of text generation is like a magician's trick where he appears to saw the woman in half and put her together again. I don't care how good the magician is at the trick, he's not going to be any help at all to a surgeon that's actually cutting someone in half and then stitching them back together again.

<comment><AUTHOR> > This sort of text generation is like a magician's trick where he appears to > saw the woman in half and put her together again.

That's a really good analogy!

</comment></comment></comment></comment><comment><USER9> Does that include starting sentences with "so"? Is anyone else annoyed by this?

<comment><USER10> Trained a neural net to write like me: poorly.

<comment><AUTHOR> Hahaha! Yeah, maybe that's part of what makes the output distinctive. Do you have any good recommendations for a person looking to improve their shoddy writing?

</comment></comment></comment><comment><USER11> I really want to try this on small refactoring git commits to reproduce a simple ml-based code optimization engine.

<comment><AUTHOR> You should totally do it! Would love to see what happens.

</comment></comment><comment><USER12> Reminds me somehow of SCIgen ([https://pdos.csail.mit.edu/archive/scigen/](https://pdos.csail.mit.edu/archive/scigen/)), a funny 'scientific paper generator'.

<comment><USER13> In a similar vein, [http://git-man-page-generator.lokaltog.net/](http://git- man-page-generator.lokaltog.net/) creates plausible-sounding man pages for git internals.

</comment></comment><comment><USER14> The title is from the perspective of the submitter (being the husband in the original title), it should be "visakanv-RNN — machine-generated husband chatter". Which is a lot less catchy.

</comment><comment><USER15> Wasn't expecting the image at the end, wtf?

<comment><USER16> I believe all technical articles are now required to include at least one Impact font meme. I'll see if I can dig up the RFC.

</comment></comment><comment><USER17> She should call this the HusBot.

<comment><USER18> this is clearly way better than visakanv-rnn. thanks!

<comment><USER17> :-)</comment></comment></comment>


Canada's 'secret spy agency' is releasing a malware-fighting tool to the public - <AUTHOR> http://www.cbc.ca/news/technology/cse-canada-cyber-spy-malware-assemblyline-open-source-1.4361728 <comment><USER2> The main repo seems to be here:

[https://bitbucket.org/cse- assemblyline/assemblyline/src](https://bitbucket.org/cse- assemblyline/assemblyline/src)

Released under the MIT license with crown copyright. Looks like a plain ol' Flask application. I don't know what I was expecting from the government. Maybe more Microsoft and more Oracle, more "enterprise". And the git history goes back ten months with an initial commit of December 21, 2016.

I'm actually surprised to learn that CSE would be in charge of such a thing. I would have thought that this fell under the role of Canadian Security Intelligence Services. We definitely don't hear a lot about CSIS or CSE in the news to the point that I think most Canadians might have a hard time expanding those acronyms or know what they mean. It's good to see a little more transparency from them and to not have to wait for NSA leaks to figure out what their Canadian counterparts are up to.

<comment> 52-6F-62 CSE is comparable to America's NSA in general function and scope. While CSIS does intelligence work with computers and hires a lot of programmers and analysts, CSE is traditionally the more technologically-focused of the two. You also hear _significantly_ less about it than even CSIS.

They're good at their jobs.

edit: Spelling. They changed it from CSEC to CSE

<comment><USER3> More like they changed it "back" to CSE. :)

</comment></comment></comment><comment><USER4> > _Assemblyline is described by CSE as akin to a conveyor belt: files go in, > and a handful of small helper applications automatically comb through each > one in search of malicious clues. On the way out, every file is given a > score..._

This sounds like it could sit nicely between Github and CI (Jenkins/Travis/Circle/etc), and be a pre-integration security scan. Can we name it Sherlock?

<comment><USER5> Mountie might be better.

<comment><USER6> How about Canadian Shield? CanShield?

<comment> 52-6F-62 Chad Kroeger. Nobody would ever come near it again.

<comment><USER7> Rude.

</comment></comment></comment></comment></comment><comment><USER8> Is it just me, or is it amazing that they're releasing this for free? Even Canadian SPY organizations are friendly!

<comment><USER9> A cynic, and, perhaps, a realist could consider their motivation to be fairly similar to that of a private blackhat attempting to purge _foreign_ malware on hosts that they own, or may want to own. Exclusive control being always preferable to competing control.

I'd be far more impressed and grateful if these state services released disclosures and actual patches for complex zero-day vulns, particularly in unmaintained, widely deployed closed-source products such as WinXP. 8-Ball says that is 'Unlikely' though.

<comment><USER10> I don't think I trust foreign intelligence agencies enough to install their software on my devices.

Sure, they probably also release stuff not under their name and not open, but still.

</comment></comment></comment><comment><USER11> I don't find my answer, I just have one question: does it send any "usage stats" or "unknown files" back to them? If your computer establishes any kind of connection with their center it wouldn't be only something for the public, they'd also benefit.

That isn't necessarily a bad thing but seems important enough to be discussed.

<comment><USER12> Doubt it. That'd be too obvious.

</comment></comment><comment><USER13> Interesting, Kaspersky is constantly maligned for simply being USED by Russian spy agencies, or "having associations with" them. Russia and China now demand audits of security software from the USA. Countries build their own national Linuxes now that Windows phones home all your passwords, for the CIA and NSA to easily backdoor or get via an order.

So, why would anyone trust a spy agency's software? Only if it's all open source.

<comment><USER14> It's MIT license, and the repo seems to have full history.

<comment><USER15> That doesn't mean that the binaries match the repo content.

<comment><USER16> Does it even have binaries? It's a Python app, isn't it?

</comment></comment></comment></comment><comment><USER17> Looks like they use Binary Ninja too.

[https://bitbucket.org/cse- assemblyline/alsvc_binja](https://bitbucket.org/cse-assemblyline/alsvc_binja)

</comment><comment><USER18> Is this just a pond or do they have an actual moat around the building?

<comment><USER19> Just a pond and wide angle:

[https://email@example.com,-75.6175154,97a,35y,1...](https://firstname.lastname@example.com,-75.6175154,97a,35y,13.51h,67.75t/data=!3m1!1e3)

</comment></comment><comment><USER20> What does it actually do?

<comment><USER21> The article says:

> … files go in, and a handful of small helper applications automatically comb > through each one in search of malicious clues. On the way out, every file is > given a score, which lets analysts sort old, familiar threats from the new > and novel attacks that typically require a closer, more manual approach to > analysis.

</comment></comment><comment><USER22> This is the first major commit where they pulled in the existing codebase almost a year ago:

[https://bitbucket.org/cse- assemblyline/assemblyline/commits/...](https://bitbucket.org/cse- assemblyline/assemblyline/commits/ef004b6bd7d24ee5a2664e62251092817db7eec2?at=master#chg- al/common/security.py)

Couple interesting bits:

1\. Bcrypt looks trusted. I guessed as much given that I've seen it used in other GC projects that were "Protected B" (think Revenue Canada / similar).

2\. It doesn't look like they enabled HSTS by default until a couple months later in the repo:

[https://bitbucket.org/cse- assemblyline/assemblyline/commits/...](https://bitbucket.org/cse- assemblyline/assemblyline/commits/d874f39dd46185bc61680076e226acd555c1ffbd)

Again, unsurprising since the CSE / CST main page doesn't have HSTS.

3\. This part of the original version of the README is interesting:

<README SNIPPET>

#### License (or lack thereof) and Conditions of use

As is fairly evident, we haven't selected a license for this project as of yet. As discussed when members were first granted read access to the repository, dissemination is based on the premise of originator controlled. If you feel there are other partners that would benefit from an early view and would be able to contribute, please contact the project leads and we should be able to sort it out.

We will soon be splitting the platform and services into two separate repo's, so please treat the services as slightly more sensitive than the platform itself, ie: release it and perish!!! ... but seriously, we do not grant anyone the right to do anything other than deploy the platform and use it. No sharing, presenting, etc without our knowledge.

We hope to have a clear release plan soon.

</README SNIPPET>

So it looks like they passed it around a bit either internally in the CSE or to a wider audience that may have included other departments. Probably getting more eyes on it to stop something stupid from going out.

4\. There are some fun little commits like this:

[https://bitbucket.org/cse- assemblyline/assemblyline/commits/...](https://bitbucket.org/cse- assemblyline/assemblyline/commits/7907b5c217cfea5627d9dcf69d1080b7c2d66c30?at=master)

Or this (adding the French version is always one of the last steps before something goes public):

[https://bitbucket.org/cse- assemblyline/assemblyline/commits/...](https://bitbucket.org/cse- assemblyline/assemblyline/commits/f51059f010bb2a87682112ea7d6817e957bcf029)

Or this (we've all been there):

[https://bitbucket.org/cse- assemblyline/assemblyline/commits/...](https://bitbucket.org/cse- assemblyline/assemblyline/commits/fe8d98795939aaa29fe60aad9aa1bcb4dc3ad957)

<comment> 52-6F-62 Lol. I don't know if you clicked the username, but it's appropriate: [https://bitbucket.org/sgaron-cse/](https://bitbucket.org/sgaron-cse/)

<comment><USER22> Yeah, of course, haha :)

</comment></comment></comment><comment><USER12> Chances are there's some really really obscure security hole in the app that they hope to exploit sometime in the far future. I'm telling you.

<comment><USER23> Or hoping someone will fix and submit a pull request.

</comment></comment><comment><USER24> First OpenBSD and then this, Canada is like the promised land for security minded people!

</comment><comment><USER25> How's this compare with things like Laika BOSS or mitre's multiscanner?

</comment><comment><USER26> Billangual README!

<comment><USER27> Its a Canadian government rule that even URLs have to be bilingual. eg You can't have [http://host.ca/news](http://host.ca/news) (with bilingual text on the page) it has to be [http://host.ca/news_nouvelles](http://host.ca/news_nouvelles) This is only for fed government sites.

<comment><USER28> I'm surprised there isn't a separate copy of all the code in French, or at least the code comments

<comment> 52-6F-62

        // En français, s'il vous plaît

        fonction commencer(état) {
          si (état !== nonDéfini) {
            laisser nouveauChaîne = `Bonjour, ${état}`;
            faire {
               console.journal(nouveauChaîne);
               piraterTousLesSystèmes();
            } tandisQue (systèmesSontDébloqués())
          } autre {
            merde(`partout`);
          }
        }

        // Commencer!

        commencer(`L'état du Brésil`);

        // Bon.

<comment><USER29> I'd like to see the code for `piraterTousLesSystèmes`

</comment></comment></comment></comment></comment><comment><USER30> We're sorry we didn't come up with it sooner, eh?</comment>


RPi Cases - <AUTHOR> https://elinux.org/RPi_Cases <comment><USER2> Reassuring, old skool simple web page. It does exactly what it said in the label.

Where did this kind of informative lightweight fast to load web go? I miss it.

Thanks for posting this.</comment>


Microsoft Makes Major Changes to Windows 10 Updating - <AUTHOR> https://www.thurrott.com/windows/windows-10/204359/microsoft-makes-major-changes-to-windows-10-updating <comment><USER2> > "We have heard clear feedback that the Windows update process itself can be > disruptive, particularly that Windows users would like more control over > when updates happen."

That only took several years of complaining.

> "All customers will now have the ability to explicitly choose if they want > to update their device when they check for updates or to pause updates for > up to 35 days."

...and they didn't actually listen. This is still user-hostile bullshit and some people at Microsoft really need to be beaten with a rubber hose until they get it through their heads that they don't own our devices.

Even as a vocal critic of Linux Desktop I feel that Microsoft is doing its best to push me there. Hell, most of the computers I own have already been transitioned to Lubuntu[0] because otherwise I'm faced with forced update garbage every time I turn them on.

> Microsoft is also working to ensure the quality of this feature update, > which is important given the disastrous two feature updates that Microsoft > and its users experienced in 2018.

Maybe actually having QA or at least listening to the Insiders you've conned into doing QA for you for free would have helped prevent these things, but I doubt it because you seem so determined to copy the worst aspects of web and OSS development culture. User hostility, change for the sake of it, users are QA, ads (in a paid product!) etc.

[0]Lubuntu still prompts me to update it literally every time I turn it on too, but at least I can just say no.

<comment><USER3> There are all sorts of reasonable options here:

\- prompt to install updates when shutting down/rebooting \- prompt when locking the screen \- prompt when updates are available

The point is, _ask_ to install updates. Users will update if you remind them when it's convenient for them, but you don't know when that might be, so have some kind of non-intrusive prompt at any point where a user might be ready to do an update. Maybe make it more annoying if there's a critical security patch pending, but don't ever force it.

So yeah, Microsoft didn't listen, they just did the bare minimum to make it look like they're doing something.

</comment></comment><comment><USER4> Allowing non-technical users to arbitrarily postpone updates for such a long time seems like a step backwards and a potential recipe for trouble. This isn't the "major change" I was hoping for when I saw the article title. Why not work towards making the updates themselves less disruptive?

<comment><USER2> Yes, how dare those peasants actually have control over their tools.

<comment><USER5> They won't have control over their tools. The owner of the botnet will, though. That's the point.

</comment></comment></comment><comment><USER6> Long article to say users on Windows Home can delay updates up to 35 days.

</comment><comment><USER7> They're headlessly trying everything possible, how to let user schedule "restart after update". But they really should work on file locking mechanism instead. It dates back to MS-DOS 3.3 era. Make any process not to lock accessed file by default. Then they can serve more updates more often, as restarts would be very scarce (like on unix or linux).

</comment><comment><USER8> _" Microsoft is also going to offer a new dashboard so that the status of the feature update can be more easily ascertained. […] The new dashboard should make it much easier to discover what known issues and incompatibilities exist, along with the remedial action that can be taken (e.g. upgrading a particular piece of software) to unblock the update."_

[https://arstechnica.com/gadgets/2019/04/microsoft-going- to-e...](https://arstechnica.com/gadgets/2019/04/microsoft-going-to-extreme- lengths-to-ensure-may-update-avoids-mistakes-of-1809/)

</comment><comment><USER9> How about they let (all) users on certain, long-term-support designated versions of Windows 10 postpone feature updates _permanently_? That would actually be listening to customers. It's okay to force security updates (within reason), but it's not okay to forcibly upend everything else as well.

If this seems like an unreasonable maintenance burden on Microsoft, remember that the Long Term Support Branch/Channel already exists for enterprises. Microsoft supplies security-only updates to Windows 10 1607 and 1809, and will continue to do so for ten years after each versions's release.

There is no reason for Microsoft to not make this available more broadly, they've just decided not to.

<comment><USER10> Yep, everyone still running IE6 with security holes you can drive a bus through... that'll be great for everyone concerned.

</comment></comment><comment><USER6> This website disabled the rubber band scrolling on iPhone. Thank goodness Apple applied rubber band scrolling to the iPhone interface, reading without it is a frustration I never thought existed.

<comment><USER9> Momentum scrolling works fine on my 12.1.1 iPhone 6S.</comment></comment>