The Clean Network – United States Department of State - <AUTHOR> https://www.state.gov/5g-clean-network/ <comment><USER2> I have the same feeling about this as I did the announcement of the "Department of Homeland Security". The name sounded Soviet in origin, with only the exchange of "Homeland" in place of "Motherland". It reminded me of things my family had taught me didn't happen in the United States.

"We call on all freedom-loving nations and companies to join the Clean Network." is a sentence straight out of an authoritarian playbook. Top-down imposition of standards is not what made America's melting pot great. Free and open discourse, with redundant structures designed to ensure that governance required the consent of the governed, did.

Furthermore, State is a decade or more behind the game. It is my impression that modern companies that care about security assume that all networks are compromised and act accordingly. See [https://cloud.google.com/beyondcorp](https://cloud.google.com/beyondcorp) as an example.

Balkanizing the Internet will not make us free; we will instead tie our own hands. This is not the same as banning the import of presumed-compromised hardware.

Vote.

<comment><USER3> Yes. It is ridiculous how closely the language sounds to that of a dictatorial regime. The language is just so.. cringy. When I first read, I genuinely could not believe it was not onion or some weird caricature.

<comment><USER4> The first sentence really stood out to me...

"The Clean Network program is the Trump Administration's comprehensive approach to..."

Isn't that a bit odd? Surely these things would be worded as 'is the United States Government approach..' It almost smacks of 'errr, don't blame us guys, it wasn't _our_ idea.

Love the low res images of the logos too.

<comment><USER5> Probably the same reason why every white house announcement has to say that whatever it is is way better than any previous administration did or could have done.

</comment></comment></comment></comment><comment><USER6> This really comes off as a hastily prepared political dig against China, when there are _in addition_ so many other actors and countries trying to take advantage of poor security. The JPEGed giant logo at the top doesn't help...

Other observations:

\-- "Remove untrusted applications from US mobile app stores": so, this would call for even tighter control by Apple, Google, over its app distribution and monopolies?

\-- Clean Apps: "Prevent untrusted PRC OEMs from installing trusted apps on their apps store... should remove apps to ensure they are not partnering with a human rights abuser." Umm, seriously, we're going to open this can of worms?

Edit to add a last thought:

I have yet to understand or read a coherent description about how we do not have the technical ability to protect against eavesdropping/etc regardless of who owns the physical hardware. Why is CCP-owned infrastructure uniquely susceptible to this? If we can't protect our transmissions with encryption, secure data storage techniques, what does it matter that the equipment is supplied by China? What unusual attack do they get access to by owning or manufacturing the equipment?

<comment><USER7> > The JPEGed giant logo

It's almost like they ran it through jpegify.me on purpose as a joke, but really it's just another sign of the US's government technical incompetence.

<comment><USER8> _it 's just another sign of the US's government technical incompetence._

Not "the government." "A person in the government."

The federal government has a very good design system. But for some reason, whoever built this page chose not to follow it.

[https://designsystem.digital.gov](https://designsystem.digital.gov)

<comment><USER9> > The federal government has a very good design system.

Having no knowledge of how the federal government works, but having worked for fairly large organizations, I would still guess that the design system exists and is used in many places but a significant fraction may not even know it exists much less that they are supposed to use it.

<comment> blaser-waffle Seconded. Plus many Fed'Gov orgs have explicitly different systems, requirements, and silos. The DOD or NSA would put out something flashy, but this is State...

</comment></comment></comment></comment></comment><comment><USER10> It looks like we are breaking the internet up along the lines of political boundaries. The US will have one internet, the EU another, China yet another... Hopefully the pendulum will swing back in the other direction soon...

<comment><USER11> Hopefully, none of this will be implemented and we can all forget Mike Pompeo exists in 6 months.

<comment><USER12> 84 more days till election... fingers & toes crossed

<comment><USER13> Many municipalities have no-justification-needed absentee voting (vote-by-mail by any other name) which can be dropped off often weeks before in-person voting occurs. Likewise many places have early in-person voting.

1\. Check your voter registration.

2\. Register to vote if you need to and it's still open for registration in your state.

3\. VOTE as soon as you can. If you're voting absentee then drop off your ballot early if possible. If you're voting in-person then look into early voting to avoid lines and keep everyone safe.

<comment><USER14> The key this year is to _personally drop off your ballot_ at an official drop point rather than mailing it in. USPS can and will deprioritize mail in ballots for the fall elections.

<comment><USER15> I do this anyways. Why would I pay postage to have something brought to a distribution center 20 miles away, wait a few days, then brought back to my town to get delivered to town hall when I can literally walk there and drop it off for free?

<comment><USER16> Because time is money? first class postage is only 55 cents, that's hard to beat from a dollars per hour spent perspective.

<comment><USER15> Time may be money to some, but my time is fresh air and not supporting wasteful transport systems if I can avoid it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> > Huawei, an arm of the PRC surveillance state, is trading on the innovations > and reputations of leading U.S. and foreign companies. These companies > should remove their apps from Huawei's app store to ensure they are not > partnering with a human rights abuser.

So should European Companies also pull apps from Google and Apple?

I'm all for standing up against the horrible human rights abuses of China, but it sounds unbelievably hollow from the US, which has a track record of putting their own interest before democracy and human rights abroad.

The whole website is pitched for other countries to join in, but I really don't see that happening except maybe the UK and Canada.

<comment><USER18> > except maybe ... Canada

Relations aren't great right now. Just last week Trump began yet another trade war with Canada. I don't really see Canada taking part in this.

</comment></comment><comment><USER19> Has anyone published the evidence of Huawei being an "arm of the PRC surveillance state"? I've seen a lot of claims and a lot of out-of-court- settled lawsuits, but nothing really showing that they're using their devices or software infrastructure for surveillance.

<comment><USER20> There's such a long list of this stuff from various companies. It's not hard to research this at all.

In terms of an anecdotal evidence... My father used to work for molex, one of his biggest complaints were fixing the molds after they were sent to Chinese factories. They would try to deconstruct them and couldn't put them back together (this was the 90's, early 2000's). So they would be shipped back to the US operations to fix.

Eventually, he ended up spending years training up Chinese to replace him (my father, in China). Molex moved much of its tool making shop to China and shut down most US tool and die making operations.

Anyway, China has people who are trained, on factory floors, who are there to reverse engineer processes.

This has been known for decades, companies don't really seem to care or know (I guess that's possible as they are outsourcing manufacturing).

I have no doubt this is designed across all their industries and systems. It's in their interest to do this.

EDIT: I want to point out, there's no longer a need for China to reverse engineer. US companies ship the designs straight to China. This is probably why we've seen China catch up so fast. We trained their workforce and now provide them all the IP before we build it.

<comment><USER21> This has been known for decades, companies knew, and the way they dealt with this was to only give China obsolete tech or tech about to get out of date, so they didn't care. That's no longer the case as China is catching up fast and really threatening the competitive advantage of truly innovative companies all around the world.

<comment><USER22> Recently, Like in the case of 5G. They are the innovators and others are the catchers. I think labeling every western company as truly innovator and the Chinese ones as copy-cats is the modus operandi in the US but that is clinging to the old stereotypes in fast changing times. They built up massive expertise and are putting it into use to gain more edge on other countries including the US.

<comment><USER21> Huawei's contribution to 5G is probably overstated. Looking at the 3GPP rapporteur roster, a lot of work is done by Qualcomm engineers with Chinese names. This is why immigration is so important to the US in order to attract the best talents to contribute to US IP.

[https://www.lightreading.com/5g/huaweis-patents-wont-save- it...](https://www.lightreading.com/5g/huaweis-patents-wont-save-it-says- leading-analyst/a/d-id/761569)

</comment></comment></comment></comment></comment><comment><USER23> Oh jeez. No good can come from this Balkanization of the net. This is how Russia started its control.

Same playbook.

<comment><USER21> China has already Balkanized their "Internet" for over 20 years now.

<comment><USER24> That was their loss. If China does something, does the US have to follow?

As it is, this just makes it seem like China was right this whole time and the US ideals of an open internet were a failure.

<comment><USER21> They view it as a success and have double down on it, while the rest of the world continued to feed them knowledge free minds across continents spent centuries to accumulate. In short, they only took the useful bits to strengthen the government's grip on the population while leaving out all those things that made the vast amount of knowledge possible. They are getting all human knowledge for free, while it it not the same for us.

Strategically, this position is untenable. The free world is defenseless until we demand reciprocity. Balkanization, be that as it may, it's not the end, but a means to an end, the end should be all open for every one.

<comment><USER25> > leaving out all those things that made the vast amount of knowledge possible

No. This is the conceit of the humanities to attribute the past few centuries of industrial and scientific progress to their work. The Soviets, the Nazis, and the Japanese Empire all managed to progress useful knowledge while believing in completely different ideologies. Your John Lockes and Thomas Paines made no real contribution to the discovery of Penicillin or the Transistor. The idea that censoring ideology will stunt technological growth is a fantasy believed in only by ideologues.

<comment><USER21> I strongly advise you to look into the Needham Question. China could have industrialized a millennium ago, and yet it hadn't until around 50 years ago. Insulating one from knowledge can have tremendous effect on growth for centuries. All Soviets, Nazi and Japanese progress are built on ideas and attitudes first found in Reformation Europe.

<comment><USER25> > All Soviets, Nazi and Japanese progress are built on ideas and attitudes > first found in Reformation Europe.

And yet they still managed to adopt all the useful ideas they needed despite heavy political censorship.

<comment><USER21> They also all lost.

<comment><USER25> So did the British Empire.

<comment><USER21> I like your tagline

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> If they weren't serious about this claptrap it would be downright hilarious. "Clean" means nothing, other than "Approved by us" which of course can mean anything they want, including shutting down anything they disagree with even internally, and changing day by day. In practicality there isn't much they can do legally to make any of this actually exist.

<comment><USER27> > there isn't much they can do legally to make any of this actually exist.

Please, let's stop the whole thing of "he doesn't have the power to do this". Maybe he cannot do everything, but the last four years have proved that he can do pretty much everything he wants with a few minor problems with justice that he will also disregard. Think about mass imprisonment of immigrants, travel bans, attacking protestors in major cities with unidentified military units, diverting money fro the military to build a wall against congress wishes, not allowing his co-conspirators to testify in Congress, affirm he will not accept the election results, etc. All of these things supposedly were not legal. But he doesn't care about the constitution, and the constitution only has any power if the government is willing to uphold it.

</comment></comment><comment><USER28> The intention of cutting out bad actors seems to be in the right place, but using "Clean" for the terminology is really unnecessarily inflammatory.

<comment> 52-6F-62 I'd add that the collection of telecom companies at the bottom of the page is grossly misleading. It makes them appear as signatories or as if they're following America's lead.

<comment><USER29> Probably true. At the same time, they may have no choice. This sort of thing is not elective.

There are a lot of people around me taking that as a list of companies not to do business with. As if this will save them from the global surveillance dragnet. But here's the thing, you either submit to american surveillance and tracking, or you submit to some other nation's surveillance and tracking. You will not be able to choose companies that don't partner with their national governments for surveillance and tracking. So people taking this as a list of cooperating companies, and asking how to avoid this system, are being a little naive. Thinking that somehow, not being on our network will save them from surveillance. It won't. Best case, it saves them from surveillance by us.

It is a sad future. I'll concede you that.

<comment> 52-6F-62 The point I was referring to is that is that companies are listed that have announced Ericcson as their network infrastructure hardware supplier for years, and the decision has nothing to do with Pompeo's "Clean Path".

However, they are listed as if they are following the directive rather than having been long in front of it. It's gross political posturing, useful or not.

</comment></comment></comment></comment><comment><USER30> The US is ran & staffed by the hyper-partisan "Z-team" right now.

This is tragic & dangerous bc we need shrewd & wise people to make decisions + build coalitions in the opening decades of 21st century, not hyper-partisan kooks.

Some of the worst actors in cyber space rn is the Russian gov't & their intelligence + "security" services —- it sure is funny (funny as in strange, not humorous) how difficult it is to get any of these apparatchiks to publicly acknowledge that

<comment><USER31> What is the Z-team?

<comment><USER32> I am _guessing_ they wanted to mean pollar opposite of A-Team.

(As non-native speaker) I always interpret A-Team as your most competent team for a given task.

<comment><USER31> Ah makes sense... thanks for the clarification!

</comment></comment></comment></comment><comment><USER33> Why the hell does any of this have to be China specific? Tomorrow the bugbear could be anyone else

Like, we want clean networks free of foreign influence and sruveillance, full stop. Or are they implying that Five Eyes surveillance is good and OK?

<comment><USER34> This is more about Huawei in general. Russia, for instance, doesn't have a technology provider of similar magnitude and influence.

<comment><USER24> I think the parent commenter's point is that making laws based on objective rules would make it more future-proof. Laws once passed usually stay for a long time. Huawei wasn't a big deal 15 years ago. 15 years from now someone else their place.

</comment></comment></comment><comment><USER35> Behold! The Clean World Wide Web will be known as Patriot One Web or pow.

</comment><comment><USER36> Are there any cybersecurity professionals on here who want to comment about the pros and cons of the network? I don't have the necessary expertise to ascertain the merits of it (actual threat vs. mitigated threat) but I don't like the "clean" verbiage. Nor do I like China's own longstanding protectionism and Great Firewall.

<comment><USER37> I can think of a couple,

1) There are too many in/out points and encrypted paths in and out of the network to actually make this worth spending time on. Think of walling off the entire country, yet there is still air above the wall, movable earth below the wall.

2) It creates a false sense of security if you're on the "clean network" and may make some developers less considerate of securing apps, websites, etc, and some consumers of questioning the security and privacy of the apps they install. I.e. it weakens those within the "clean" firewall.

</comment></comment><comment><USER38> only the NSA is allowed to backdoor US networking hardware

<comment> codemonkey-zeta I laughed, but also ... yes? As a lover of liberty I would much rather just my own government (by which I am ostensibly represented) have the ability to infringe on that liberty than 2 governments. I would want to support regulations that protect myself and neighbors from the influence of those other infringers, no?

<comment><USER24> Your own government also has more tools to use against you. You'll pass through your own border more frequently, you're more available to be arrested, harassed by LE, etc.

How about as a lover of liberty, _nobody_ snoops on our data?

<comment> codemonkey-zeta Of course you are correct, but the tools available to other governments still concern me greatly. Are we actually presently capable of making sure _nobody_ snoops on our data? If so then I agree it is a better solution. But is it not better to use an imperfect plan which is implementable than wait for a perfect plan (if such a thing exists for cyber-security) to become implementable when a threat is present?

<comment><USER24> Depends how paranoid you want to be, and to what degree of certainty (after all it's impossible to prove a negative).

But in general, backdoors for "the good guys" are just more surface area for "the bad guys", and developers of products which take security seriously lock themselves out too.

<comment> codemonkey-zeta Is this about installing backdoors? Or is it just about ensuring the network doesn't run on known-compromised hardware/software?

</comment></comment></comment></comment></comment></comment><comment><USER39> If you're not already familiar with the history of labeling immigrants (particularly non-European immigrants) as unclean or dirty, I'd urge you to read up. This article seems to be a good start: [https://journals.openedition.org/transtexts/1011](https://journals.openedition.org/transtexts/1011)

In short, calling this a "clean" network continues a long history of racist and xenophobic language in the U.S.

<comment><USER40> Europeans got it too, Irish, Italians, Germans (post WW1 and 2), pretty much the "last ones" to the party get crapped on.

<comment><USER39> Yes. I don't think its repeated usage in this way diminishes my point, however. In all of these contexts it's been used to put down foreigners or immigrants.

</comment></comment></comment><comment><USER41> What's up with the incredible low resolution jpeg at the top of the article? It really stands out from the other images ( which seem fine )

<comment><USER42> I was curious about that too.

The img tag has a "srcset" attribute with resolutions from 85x48 to 1920x1080, but the "sizes" attribute is "(max-width: 300px) 100vw, 300px".

</comment></comment><comment><USER43> Amazing how end-to-end encryption would solve all the problems they claim to care about here.

<comment><USER44> How do we accelerate this process?

</comment></comment><comment><USER45> Follow the link in "Digital Trust Standards" to the "Criteria for Security and Trust in Telecommunications Networks and Services" ([https://csis-website- prod.s3.amazonaws.com/s3fs-public/publi...](https://csis-website- prod.s3.amazonaws.com/s3fs-public/publication/200511_Lewis_5G_v3.pdf)). Political & Governance Criteria numbers 8 and 9 would seem to present problems for companies in the UK and US, both of which require suppliers to cooperate with the government in secret and unchallengeable ways.

</comment><comment><USER46> So the country whose national security and intelligence agencies have gathered the largest database of sensitive information in the world is proposing to "safeguard sensitive information from aggressive intrusions by malign actors"... If U.S. is some kind of role model / example for other countries to follow (in terms of freedoms, democracy, prosperity, etc) then other countries will also gather sensitive information to the largest extent possible... So this "we can, but you shouldn't" is just a shameless hypocrisy. What would the U.S. founding fathers say to all this? Is there any William Penn living in the U.S. today to give basic freedoms like privacy back to the people? Or will the "controlling party" take everything away - including the freedom to think and say?

<comment><USER47> We actually don't know that the US has gathered the largest database of sensitive information.

Only that it used to gather a lot before Snowden.

<comment><USER48> I'd bet a lot of money that the NSA didn't just turn off their servers and sit their twiddling their thumbs after the Snowden leaks.

<comment><USER49> That's an unfair caricature. The steelman version of that argument is that China has likely amassed a more robust global surveillance database (to the extent that that's even the right word to use) than the U.S.

<comment><USER50> I imagine they don't even need to. All they need to do is gain access to the American databases

<comment><USER49> I think it's just true in a literal sense that China has constructed it's own surveillance system that under any metric would be larger than that of the United States or any other nation.

</comment></comment></comment></comment></comment></comment><comment><USER51> Chinese government mandated pre-installed spyware on all phones made in China is certainly a huge problem.

But on the other hand, isn't it a violation of First Amendment protections if the US government can dictate certain apps aren't allowed to be distributed in the US?

Since software's subject to copyright, doesn't it logically follow that banning software is legally similar to banning a book?

<comment><USER52> Imported goods and services aren't protected by 1A.

Software is protected by 1A, so there's nothing the government could do to prevent China from publishing software or source code, and allowing people in the US to download it. But it can certainly prevent a Chinese entity from providing services to US customers.

</comment></comment><comment><USER53> We now have our own "Great Firewall"

<comment><USER54> > _We now have our own "Great Firewall"_

I don't see anything about content filtering. Just transport integrity.

The closest we come to that is the prohibition on apps, but that's still an ocean away from censoring text messages mentioning the Tiananmen massacre.

<comment><USER55> Or arresting a Hong Kong democratic leader for "uttering seditious words" (exact phrasing of the CCP today).

<comment><USER56> fyi in the "land of the free", people being mean to government agents are cited for sedition

[https://www.voiceofsandiego.org/topics/public-safety/sdpd- is...](https://www.voiceofsandiego.org/topics/public-safety/sdpd-is-punishing- speech-using-a-102-year-old-city-law/)

</comment></comment></comment></comment><comment><USER57> This writing is so Orwellian it seems like a parody

</comment><comment><USER58> Isn't it ridiculously easy to set up attacks from within a "clean" network? It probably does increase costs marginally (you have to fly people to "clean" countries, set up ISP access with third parties, etc) but are there any public estimates how much it does that vs the increased costs to run this network? I would think it's marginal.

Seeing the partner list this seems like more of a ploy by telecoms to attack tech companies than any legitimate attempt to secure networks.

> To prevent U.S. citizens' most sensitive personal information and our > businesses' most valuable intellectual property, including COVID-19 vaccine > research, from being stored and processed on cloud-based systems accessible > to our foreign adversaries through companies such as Alibaba, Baidu, China > Mobile, China Telecom, and Tencent.

Am I missing something?

<comment><USER59> There's a bunch of different measures discussed, but they all seem to remove some attack surface that we have seen exploited.

Securing the routers and network cables removes the means for man in the middle attacks (or at least makes them preventable with router security). Not connecting to telecos does the same (because of bgp highjacking and the like).

Removing chinese apps and not storing data on Chinese servers makes decreases the amount of data that can be extracted from large portions of the population by the CCP. E.g. preventing the "who knows who" graph from leaking wholesale (even if individual nodes can still be investigated via other means).

This doesn't fix all security problems, but it removes some of China's current advantages in cyberwarfare.

Not putting apps in Chinese app stores and devices looks to be an outlier in that it's a form of sanction (in response to human rights abuses) rather than a defensive measure.

<comment><USER60> What i don't get is why we should care about this _(care as in, advocate for)_. MITM is a great argument for distrusting the everyone in the middle, not trying to increase trust in the middle man - no?

This just feels like an attempt to control _who_ is the middleman spying on data, not actually securing Americans data. Which makes sense, coming from the government and whatnot - but i'm just trying to make sense of if there's an actual reason i should like this "Clean Network" _(which is to say, my comment is an honest question, not an attack on the proposal)_.

Perhaps i'm just biased because of my (pet) passion for distributed systems. I don't trust any MITM, so i think i struggle to understand the concern for _who_ is in the middle.

I'd be far more interested in this type of pitch if it came with heavy support for encryption, distribution, etc.

<comment><USER59> Look at the "great cannon" attack for an example of why securing the middle is important. Secure software obviously shouldn't trust the middle, but the middle being compromised means that insecure software can do orders of magnitude more damage.

Moreover the middle can just shut down. Especially for things like embassies it's not a good idea to give the adversaries an easy off switch.

I agree that "encrypt all the things" would be a very nice addition.

</comment></comment></comment></comment><comment><USER3> I am surprised it did not make bigger news. I am genuinely annoyed that US, of all places, is contributing to the splintering of the internet as we knew it.

But what surprises me more people are not up in arms about it. I mean, who would not love only government approved code floating around and only child appropriate messages being visible before 10PM.

If there is a real reason to dislike this administration, this is it.

</comment><comment><USER61> This is disgusting. Anybody working at an American firm that's supporting this initiative should be ashamed. Anybody working on this project is actively contributing to the destruction of international trust and cooperation.

I am beyond disgusted at my government. This Republican administration has been an unprecedented disaster on every front.

<comment><USER62> How would you suggest we limit the surveillance and active attacks on American infrastructure by the Chinese government? They show no signs of letting up and/or respecting how America works in the slightest.

<comment><USER63> Easy, USA can invest in open hardware/software. It would destroy Intel/AMD but who cares, national security is more important, no?

<comment><USER64> Ok that helps the issue in issue in 20-30+ years (develop the tech, start mass production, replace all old hardware with it) what can we do in this decade?

<comment><USER63> That is the government's problem, had they asked me 20 years ago, I would've told them moving all manufacturing operations to China just to enrich a small small percent of people would be disastrous for the nation.

Right now I don't care whether China or USA spies, they are identical countries in my mind.

Keep in mind that China can still spy on even with this Clean Network.

</comment></comment></comment></comment></comment><comment><USER65> The link is now returning 404.

[https://web.archive.org/web/20200808170849/https://www.state...](https://web.archive.org/web/20200808170849/https://www.state.gov/5g-clean- network/)

</comment><comment><USER66> Well, that's terrifying. I wouldn't be surprised if they get away with it though.

</comment><comment><USER67> I support the unity of all nations. The earth is but one country, and mankind its citizens.

</comment><comment><USER68> Can we get a clean government? Free from hyper-partisan politics, where there can be more than two sides and folks on other sides are still on the same overall team and not the enemy?

Together we stand, divided we fall.

<comment><USER27> The whole goal of trumpism is to create slaves to the ideology of white and western supremacy. It has so clear racial undertones that it's not a surprise they want to attack China: they see it more as a racial target, poorly disguised with "homeland security" excuses.

<comment><USER69> Actually Trump is just fighting for the interests of Americans. Interesting fan-fiction though!

<comment><USER27> Wrong, Trump only fights for himself. Americans will also suffer the consequences of a new irresponsible "Cold War". Trump, on the other hand, will continue lining his pockets.

<comment><USER69> Diagnosis: TDS

</comment></comment></comment></comment></comment><comment><USER70> Fuck. This is really terrifying. The internet has connected all of us, which has been mostly for the better, and these idiots want to ruin it. I really hope none of this shit sees the light of day.

</comment><comment><USER71> In case it's not obvious after you read the text in that page, the word "Clean" in the context of that text actually means:

* balkanized/siloed instead of globally standardized;

* permissioned instead of permissionless; and

* monitored via backdoors instead of optionally secure.

I'm reminded of this passage from George Orwell's classic piece, "Politics and the English Language" ([http://www.public- library.uk/ebooks/72/30.pdf](http://www.public-library.uk/ebooks/72/30.pdf)):

 _" In our time, political speech and writing are largely the defense of the indefensible. Things like the continuance of British rule in India, the Russian purges and deportations, the dropping of the atom bombs on Japan, can indeed be defended, but only by arguments which are too brutal for most people to face, and which do not square with the professed aims of political parties. Thus political language has to consist largely of euphemism, question−begging and sheer cloudy vagueness. Defenseless villages are bombarded from the air, the inhabitants driven out into the countryside, the cattle machine−gunned, the huts set on fire with incendiary bullets: this is called pacification. Millions of peasants are robbed of their farms and sent trudging along the roads with no more than they can carry: this is called transfer of population or rectification of frontiers. People are imprisoned for years without trial, or shot in the back of the neck or sent to die of scurvy in Arctic lumber camps: this is called elimination of unreliable elements. Such phraseology is needed if one wants to name things without calling up mental pictures of them."_

\--

EDITS: Simplified language, and removed quotes from OP as well as several paragraphs from the Orwell quote to make my comment shorter and easier to digest.

<comment><USER3> I am not sure why you got downvoted. This is absolutely the interpretation you can easily reach after reading it. Maybe readers perceive Orwell reference as too dramatic?

</comment></comment><comment><USER72> The question I think this is an answer to is how you can have a reasonable expectation of freedom and privacy while sharing an internet with a CCP who has militarized their technology sector as a means to facilitate colonial expansion.

I'm no fan of anyone involved, but we should accept that the Internet as we may have known it has been compromised by exogenous governance structures and their gatekeepers in service of non- and even anti-internet agendas, and it can no longer seriously be considered a free territory for divergence and innovation. The U.S. and their Clean network seems naive in a way, but in this case, I don't object because I think it is the devil we know.

<comment><USER73> Computer security does not operate around large sweeping claims of some party doing something bad, and so doing something bad in retaliation. And it's impossible for the "Internet" to be compromised - by definition it's an open network that gets packets from A to B while letting most anyone listen in. So then, what are the specific problems?

If the problem is that China is copying designs, then the solution is to stop moving sensitive production there.

If it is that Chinese manufacturers are putting remote backdoors in products, then the solution is to make _trustable_ designs with open firmware, and domestic production of sensitive parts to avoid hardware backdoors.

If the problem is apps with built in surveillance, then the solution is to secure mobile OSs to prevent data leakage.

If the problem is that Chinese groups are shitposting to manufacture political consent, the solution is better social media filters, reputation systems, and fixing our domestic institutions (eg the press) thus hindering the ability for anyone to manufacture consent.

None of these things are solved by top-down imposition of some blunt firewall, or whatever other misguided heavy handed ideas the politicians have in mind. From the perspective of network security, it's really no big deal if Internet addresses become 64 bits with the addition of a proxy.

<comment><USER72> This appears to be a rare example of a government providing a secure perimeter for its citizens to create and innovate without being subject to a foreign totalitarian machine's global spying operation. It's not a top down imposition.

Reality is, if the U.S. govt doesn't protect its networks, people and companies will have to protect themselves with encryption and hardware key management that keeps China out, which by extension means keeping US law enforcement out as well. It's a sovereignty issue.

</comment></comment></comment><comment><USER74> I wonder how this is feasible for US embassies in countries like Myanmar where basically all telecom and connections are ZTE/Huawei related.

<comment><USER75> Satellites perhaps?

</comment></comment><comment><USER76> The general wording of the proposal is way more US-vs-China centered to be a call to "all freedom-loving nations and companies".

</comment><comment><USER77> 1) This won't stop or significantly mitigate hacking from China. China is perfectly capable of hacking US software on US networks.

2) China has the intellectual capacity to meet the US technologically without stealing IP. Putting pressure on them will just encourage faster technological development.

3) At this point, it seems China will continue to expand control of South China Sea, or US will go to war with China to stop them. Any middle ground is fast disappearing. Hawks in US seem to have won control of strategy.

</comment><comment><USER4> Saw the headline and I assumed it was an international iniative to promote clean, sustainable energy. I should have known.

</comment><comment><USER78> Aside:

> _To prevent U.S. citizens' most sensitive personal information and our > businesses' most valuable intellectual property, including COVID-19 vaccine > research, from being stored and processed on cloud-based systems accessible > to our foreign adversaries_

I find it an interesting choice to specifically use COVID-19 vaccine research as an example of intellectual property.

What about all the talk that COVID-19 vaccines should be developed in global collaboration and that vaccines should become available to everyone worldwide?

<comment><USER79> Steelmanning the web page, maybe they meant protecting the research against tampering?

Regardless, I think the site mentioning COVID-19 is needlessly inflammatory.

</comment></comment><comment><USER80> I'm a bit skeptical that this will go anywhere.

Many reasons, which I won't go into, but...ya never know...

</comment><comment><USER81> > We know the risk of an adversary running comms because we did it for a while > with Crypto AG

</comment><comment><USER82> Is there where we start piling up books and burning them? The Sanitized Network. Looks bleak.

</comment><comment><USER83> I wonder how the recently announced 400 vulns in Qualcom mobile chips fits into all this?

</comment><comment><USER84> > our businesses' most valuable intellectual property, including COVID-19 > vaccine research

1\. If we have some valuable Covid-19 research, shouldn't we like, um, not keep that a secret?

2\. Also, if we're going to take this farcical notion of "IP" seriously, it's only right that we give up all our guns, since gunpowder was invented in China, and we are infringing on their "intellectual property".

</comment><comment><USER85> The Clean Network being the same network that Edward Snowden spoke out about?

</comment><comment><USER86> Is it really that big of a deal to try to cut china out of the internet?

</comment><comment><USER87> I should find this more mortifying, but with the EU Court of Justice's decision on the privacy shield, India's ban on Chinese apps, and the great firewall + other nationalized internets, the US just seems like a late mover on nationalizing the internet.

</comment><comment><USER88> It will be interesting to see how many telecoms in EU would join this.

</comment><comment><USER89> I guess I'm confused. I clicked the link and read through it really quick. I didn't really have a lot of strong opinions. This seems to be a response to how powerful China is becoming and that's scary for many reasons. This almost seems like a natural reaction of one government trying to abuse the internet and another government trying to protect it's citizens. It might even be irresponsible for the U.S. not to react. Obviously, there's no mention of Russia, but let's shelve that for now.

I wasn't totally alarmed by what I read. Maybe I'm misunderstanding something, but I take this as a sort of stamp of approval that a cloud/network/platform isn't compromised by China. It doesn't seem to say, "Only use the U.S. internet" as other commenters have mentioned. The stamp of approval seems to be global (if you look at the list that was mentioned it's worldwide, not just the US).

When I came back to look at the comments I was surprised to see a lot of noise. I feel like something must have flew over my head and maybe someone can explain it to me. I went ahead and read the link again but slower and I still don't understand the reaction I'm seeing on HN.

Maybe it's some sort of state of idealism. People want the internet to be a place that's free from tyranny or government, but that's not what's happening. China/Russia/US/whoever is abusing the internet to gain an upper-hand. The best solution is to reinvent the internet, which I know there are a quite a few projects going on that are trying to accomplish that, but in the meantime what is a government supposed to do? Let other governments siphon their citizen's data without a cost?

Again, I could use an explanation as I must have missed something that a lot of other people are finding very obvious. When a top level comment just says "Make sure you vote in November". I don't understand the context.

Disclaimer: I am definitely not voting for Trump and dislike pretty much everything the administration has done. Yet, I do try to look at everything in silos.

<comment><USER90> I'm not really sure what's going on here either. Reading the article, it looks like there will be a list of approved providers of telco equipment and all services to US govt facilities will be required to use the approved list of gear. Same for 5g networks. I don't see how that splits up the internet. The app store thing could be fishy or maybe is just leads to a disclaimer in the app store that an app is "clean" or not.

</comment></comment><comment><USER91> Robert C. Martin is thrilled.

</comment><comment><USER92> Almost the last people I would trust to keep my information safe.

And I live here.

</comment><comment><USER93> > Clean Cable: To ensure the undersea cables connecting our country to the > global internet are not subverted for intelligence gathering by the PRC at > hyper scale

What is hyper scale? Did Trump write the copy for this site?

</comment><comment><USER94> > The Clean Network program is the Trump Administration's comprehensive > approach to safeguarding the nation's assets including citizens' privacy and > companies' most sensitive information from aggressive intrusions by malign > actors, such as the Chinese Communist Party.

What bunkum. What about intrusion by parties such as Russian intelligence using legal methods, targeting ads using our "most sensitive information" on Facebook to benefit Trump? Trump wants to talk about the Chinese digging tunnels under the house while his cronies (domestic and Russian) walk right in the front door.

This is such an obvious ploy to change the conversation away from the now >160,000 Covid-19 deaths in the USA resulting from his disastrous management of the crisis.

</comment><comment><USER95> Election year. Instead of saying USA government's program its Trump program.

</comment><comment><USER96> >The Clean Network program is the Trump Administration's comprehensive approach to safeguarding the nation's assets including citizens' privacy and companies' most sensitive information from aggressive intrusions by malign actors, such as the Chinese Communist Party.

Straight up consent manufacturing.

</comment><comment><USER27> Welcome to the great firewall of the US. The trump regime seems to be adamant in copying the worst of digital surveillance and anti-competitive prohibitions from communist countries.

</comment><comment> 52-6F-62 _All run on clean, clean coal_

Kidding aside, this is so blatant I can hardly believe I'm seeing it happen.

</comment><comment><USER97> Vote.org

Make sure you're registered, and make sure you vote in November.

<comment><USER64> What would possible make you think Biden would change course on this? Neither party likes China and the whole idea that a new administration is going to roll back a hardline policy vs them is crazy.

</comment></comment><comment><USER27> Trump plans are the musings of a rambling idiot. He and his enablers don't know anything about technology and the impact this can have on American companies.

</comment><comment><USER98> What is a better way to prevent mass IP theft the CCP is doing?

<comment><USER99> Simple, stop outsourcing manufacturing to China. Companies regularly get contracts which require an IP transfer in return for cheap mass labor. Of course there's IP which is stolen, but that's the cost of doing business when manufacturing at home has been shuttered.

<comment> codemonkey-zeta But, wouldn't this need to be enforced by the government? How else are companies going to agree to stop outsourcing manufacturing to China? And if you agree that the correct solution involves government regulation, then what specifically about this plan doesn't accomplish your preferred outcome of "stop outsourcing manufacturing to China"? I may be naive but I also fail to see exactly how this plan is bad. Do you not feel the Chinese government is using technology to undermine the US, or that this isn't actually a legitimate and compelling issue of national defense?

<comment><USER99> My comment was intended to be descriptive, rather than prescriptive. IP theft isn't a new thing and American companies no doubt take it into account when manufacturing overseas.

Enforcing IP internationally is actually quite difficult anyways. Tariffs effectively restrict manufacturing overseas, as there's some breaking point in cost to produce.

I don't believe banning trade / manufacturing to China is a good idea, we depend on them for cheap consumer goods, and they depend on that revenue. We developed a dependency on Chinese manufacturing because it was cheap, and no with little to no manufacturing ability stateside, we're tied to their economy.

As someone who worked for the D.O.E for years, I can care less where consumer goods / technology is manufactured. The US government already has VERY strict rules about manufacturing for military / transportation equipment. "National Defense" isn't going to be decided by who owns TikTok or app-de-jour.

</comment></comment></comment></comment><comment><USER100> you would all be in love with the idea if it was proposed by the obama administration

</comment><comment><USER101> We should cautiously support this on the 1% chance that it's not a publicity stunt and actually could lead to some action on China.

</comment><comment><USER102> This particular administration has gone out of its way to gaslight everyone and thing it possibly can. It is to the point that everything they do is consider suspicious and/or a lie at face value. That they have the gall to name this "The Clean Network" and encourage the allies they have been bludgeoning for the past 4 years to join it is both laughable and insulting.

</comment><comment><USER103> > We call on all freedom-loving nations and companies to join the Clean > Network.

This makes me physically sick. The only freedom you have in the U.S. is being poor, controlled, and oh yea, you can Tweet whatever you want. While the U.S., both citizens and the government, have pointed fingers at Russia, China, and <name a country>, we've been under the assault of propaganda and control for decades, at increasing rates, all under the guise of so-called freedom and democracy. Instead of propelling us into the future, our government has dragged its feet to pull us back all in the name of pure greed and control, giving itself and corporations near limitless power by sacrificing the common people.

<comment> dane-pgp > oh yea, you can Tweet whatever you want.

I don't want to be the bearer of bad news, but:

[https://www.cracked.com/article_25266_6-totally-stupid- thing...](https://www.cracked.com/article_25266_6-totally-stupid-things- twitter-will-ban-you-doing.html)

<comment><USER103> Edge cases for an obvious hyperbole is not really bad news. Of course you can't Tweet whatever you want, and you can't even say whatever you want. That's obvious. The hyperbole was a jab at people, often commenters on this very site, justifying "freedom" in the U.S. as being able to Tweet the president whatever you want, within reason, as opposed to other authoritarian countries.</comment></comment></comment>


Raising severity to serious for some Python 2 leaf packages with no Python 3 - <AUTHOR> https://lists.debian.org/debian-python/2019/10/msg00043.html <comment><USER2> Historically, Debian hasn't particularly objected to packaging obsolete versions of programming languages without upstream support.

I doubt anyone is checking for potential security problems in the Algol 68 and Fortran 77 implementations that Debian ships, and I don't think the people using those packages are particularly inconvenienced by that.

It seems a shame that the social pressure to persuade people to port their code to Python 3 means that Debian is going to have weaker support for 10-year-old Python than 40-year-old Fortran.

In particular, there are ongoing efforts to try to make it the normal thing for scientists to make the programs they ran on their data available so that their results can be reproduced; aggressively dropping older programming language implementations rather gets in the way of that.

<comment><USER3> What? This isn't about "languages". It's about software!

Algol 68 and Fortran 77 may have stale (but maintained) compilers or interpreters in the package repository. Starting very soon - Python 2 will have an entire set of unmaintained runtime and libraries in the package repository. You know - actual, offically, unmaintained software! Unmaintained software that other packages, including Calibre in this example, further build on. Of course they're throwing this out.

If you're concerned about language support there are multiple solutions like:

* Port your stuff to Python 3 and enjoy first class support

* Running Debian Buster

* Running CentOS 8, which will probably profit from RHEL 8's Python 2 support-with-an-asterisk until 2029 [1].

* Installing it manually on your system

* Installing it manually in a container

This is how it feels to run legacy software - it's bloody inconvenient. But that's not a problem Debian needs to solve for anyone.

[1]: [https://developers.redhat.com/blog/2018/11/14/python-in- rhel...](https://developers.redhat.com/blog/2018/11/14/python-in-rhel-8/)

<comment><USER4> Python 2 is only unmaintained because the Python foundation is refusing to let anyone "officially" take over support. There are thousands of programs in Debian with less core developers than Python 2 working just fine.

<comment><USER5> It's understandable that the PSF wouldn't endorse a maintainer.

They can't stop someone from releasing something that runs just like Python 2 and has a different name.

<comment><USER4> That's true, but it might make packaging tricky -- lots of the old Python 2 software people want to run will have '#!/usr/bin/env python' hard-wired in, and having to fix those would be annoying.

<comment><USER6> Upgrading the OS is also annoying, so why not just stay in one place for next 5, 10, 50? years. If you don't upgrade your machine it probably will continue to work, python 2 won't disappear.

I wish PSF would pull the plug from python 2 much sooner so we wouldn't have to deal with whiners for 10 f...ing years. The problem with python 3 wasn't the incompatibility, the problem was keeping python 2 alive for so long. Other languages usually gave only 1 year and everyone moved, because they didn't want to stay behind.

<comment><USER4> Which other languages?

My C89 code, C++98 code and Fortran 77 code all still compile on a modern Ubuntu, and none of these are expected to break any time soon. The compilers just support multiple versions.

<comment><USER7> I'd strongly suggest watching "What is C++" [0] from this year's cppcon. There's a lot of good content, but the relevant bit is that c especially (remember, c++98 is younger than python2!) values backwards compatibility very highly. This is sometimes useful, but it has costs. Performance costs, safety costs, and especially ergonomic/complexity costs for future development (the kitchen-sink-ness of modern cpp).

People aren't wrong to make different tradeoffs than you. Especially given that strict backwards compatibility is impossible (especially in a language like c/++, people will rely on things that aren't intentionally public, because they can introspect your bytes).

Compiler changes break code all the time, it's just almost always semantic and not syntactic. I find this amusing, since the syntactic changes are usually easier to detect and fix.

And python2 still works, it just won't get new features.

[0]: [https://youtu.be/LJh5QCV4wDg](https://youtu.be/LJh5QCV4wDg)

<comment><USER8> > And python2 still works, it just won't get new features.

Probably more importantly, it wont get security fixes.

Yeah, Python 2 will still work. Ita not like there's a kill switch or anything. It just wont receive any official or supported updates. Effectively, Py2 will be abandonware.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I have seen multiple people post to Ycombinator claiming that porting to Python3 is always trivial and easily done. And, yeah, sure, for a 380-line script written after Python3 came out, porting the code so it runs the same both in Python2 and Python3 is trivial.

However, for an over 6000-line script written in the mid-2000s, before Python3 even existed, porting to Python3 is non trivial. Trust me, I tried.

First, the syntax sugar stuff was easy enough to fix: Do a simple search and replace so that all cases of stuff like

        print "foo"

Become

        print("foo")

I had to do something similar with the way this script calls raise(). Not to mention adding a hack so Python2 uses "xrange" while Python3 uses "range". After doing all of this, the code still does not run in Python3. As far as I can tell, the issue is that Python3 does implicit float-to-int conversions differently than Python2; the code will not raise an error in Python3, but it will silently run differently, until the state is different enough that the Python3 version raises an error while the Python2 version works as expected.

At this point, I just threw my hands in the air and gave up.

For reference, the offending code is here:

[https://github.com/samboy/misc- civ4-mapscripts/blob/master/T...](https://github.com/samboy/misc- civ4-mapscripts/blob/master/TotestraRG32.py)

<comment><USER10> Devil's advocate:

Many people aren't even bothered to _try_. The company I work for still writes new stuff in Python _2.7.3_ - not even a recent release of 2.7. Some of their stuff will be difficult to convert, but a lot of it really is trivial. They just don't care to put any effort into it until things start to break down.

I can understand why people get frustrated by situations like this and are tempted to call out programs still running Python 2 and those who advocate for keeping it.

I'm a huge fan of some of the features introduced by Python 3, so I switched and am not interested in going back. However, I think there is room for other interpreters to step in and continue supporting Python 2 even if the PSF wont.

<comment><USER11> > Python _2.7.3_

Familiar number.

Maybe they tried, and stuff broke in weird and unexpected ways, so they gave up. For example, the first time we upgraded from that to (I think) .8, lots of strange errors started coming in from our webapp. Apparently kombu, one of the dependencies of celery, was importing an underscore-function from the standard library, which no longer existed in the new version.

<comment><USER10> This is definitely the case for a few apps. It's why I raise hell anytime I see someone use a private attribute or function from a builtin module.

However, I'm painfully aware that it does not apply to _most_ of our apps and it does not justify using an outdated interpreter for writing _new_ apps.

<comment><USER9> There are occasional cases where, with some Python libraries, I need to use a "hidden" _function to do my job. The one time I had to do that, I made sure to contact the authors to let them know what I did and why:

[https://github.com/cobrateam/splinter/issues/591](https://github.com/cobrateam/splinter/issues/591)

</comment></comment></comment></comment></comment><comment><USER12> I'm running Calibre on Python 3 (via an Arch package provided by one of the people working on the port). It and mercurial/tortoisehg and the only remaining reasons Python 2 is on my system. All of these things will be on Python 3 soon enough.

Why doesn't Debian just ship the unreleased Python 3 port of Calibre? It's not like Debian restricts themselves to only formal upstream releases, they have never hesitated to backport patches to unreleased versions. If lacking Python 3 support is such a massive bug, wouldn't using patches that have not been officially released, that fix the bug, be acceptable? Debian testing isn't Debian stable, there is not a reasonable expectation that the code shipped is perfect.

Mercurial also works on Python 3, though it's only a beta. I could understand not shipping it because version control bugs can be serious, but hey, someone's gotta test the beta. I've used it and it not encountered any bugs, but went back to py2 because tortoisehg won't work with Python 3 mercurial yet (and then bitbucket dropped mercurial support so now I'm moving everything to git, grumble grumble, probably will sadly stop using mercurial altogether within the next year).

<comment><USER13> It's definitely possible for Debian to package unofficial releases out of the upstream VCS. You can sometimes tell that's what happened because it'll have something like ~git20191005.f8ab33 in the Debian package's version number.

In this particular case, the Debian maintainer seems to prefer to wait for upstream to release an official Python3-supporting version of Calibre though: [https://github.com/norbusan/calibre- debian/blob/master/debia...](https://github.com/norbusan/calibre- debian/blob/master/debian/NEWS)

It's basically up to the maintainer either way. The freeze for the next Debian release is at least months away (no date set yet), so it's not too urgent, and waiting for upstream is still reasonable at this point.

</comment></comment><comment><USER14> One can sense the frustration dripping from the thread. This feels like pretty aggressive communication ("frankly, I don't care", etc.)... it could've been a misunderstanding about what "removal from testing" means... In particular since the packages remain available in unstable, the argument raised about users paying the price isn't really valid.

<comment><USER15> I think you're overreading it. Wanting to remove python2 dependancy now with the next Debian release as target (probably 2 year from now) seem reasonable to me. The aggressivity you perceive is to me just being firm. Refuse and push back any exceptions. The work has to be done, end of story.

Personnally, I approve, otherwise it'll spiral down in nitpicking and special cases. Would not be the first time with Debian.

<comment><USER16> There's this part:

> If the package has still many users (popcon >= 300), or is needed to build > another package which cannot be removed, document that by adding the > "py2keep" user tag

So they are not even that firm. Overall, it seems very well handled.

<comment><USER17> I am impressed by the leadership. It needs to happen and it needs a firm leadership like this. No dilly-dallying. On with the job.

</comment></comment></comment></comment><comment><USER18> Can someone link the list of packages that needed to be ported? I get the impression from this thread that newly ported packages won't be included in the next testing release, but hey, there's always unstable.

<comment><USER19> Python 2 Removal (All): [http://bugs.debian.org/cgi- bin/pkgreport.cgi?tag=py2removal;...](http://bugs.debian.org/cgi- bin/pkgreport.cgi?tag=py2removal;firstname.lastname@example.com)

No Python 3 Port: [https://bugs.debian.org/cgi- bin/pkgreport.cgi?tag=py3noport;...](https://bugs.debian.org/cgi- bin/pkgreport.cgi?tag=py3noport;email@example.com)

</comment></comment><comment><USER20> Has anybody interest in forking the python project and continuing to maintain 2.7 until forever? And by "maintain" I mean no new features, just bug fixes and performance improvements. Maybe if we find enough volunteers we can pull that off.

There is still much useful and valuable legacy software out there that many people use which is getting abandoned for no other reason than some people (like the authors of calibre) are not very fond of the direction python is going. Others can't upgrade to 3.x because you have standard libraries especially in the academic sector that people literally put their whole phd into and that can not "easly" be upgraded just like that because of high complexity, lack of staff and time.

<comment><USER21> I plan to do exactly that.

 _It 's vaporware at the moment,_ but uh: [https://git.sr.ht/~sforman/Bladders](https://git.sr.ht/~sforman/Bladders)

> Maintenance-mode fork of the officially-deprecated Python 2 interpreter and > standard library. Bugs fixed, security holes patched, and maybe some > performance improvements, but no changes to the syntax or semantics (for > that see the Tauthon project, unaffiliated.)

\- - -

Sometime between now and the end of the year I'm going to fork Py2 and set up build jobs to run the test suites. (Maybe later today, it's not hard, it just takes a few spare hours.)

Going forward I plan to work on things like improvements to the docs, curating additional packages and libraries (additional to the standard lib), and language tooling (I'd like to keep things like Nuitka, Snakefood, etc. working.) I also want to run fuzzers and other code quality tools over it all.

<comment><USER22> Before it's too late, I'd like to humbly suggest a name change. Even as a Blackadder fan, the name sounds terrible at a glance, especially for such a (potentially) high profile project. Naming isn't everything, of course, but it has more significance than we consciously realize. It can subconsciously impact decisions in favour of or against the project, as irrational as that is.

<comment><USER21> I appreciate the sentiment but it's deliberate. I don't want to become high profile. The Python folks have made it pretty clear that they don't want continuity of Python 2 to "dilute the brand" of Python-as-Python-3, so I wanted to wave a big "Don't take this too seriously!" flag over this fork. (Also for the BBC, eh? It would be a little on the nose to call it "Blackadder". Or "Baldrick".)

</comment></comment></comment></comment><comment><USER23> This is turning out to be the py2k bug

</comment><comment><USER24> > No special pleading. No whining. No excuses. > No buts and no exceptions. No > "middle ground".

This sounds strong to me. Not to be provocative since I am not familiar with the mailing list, I would like to ask is it common to communicate this way in this Debian community? Is it effective to push things moving forward?

<comment><USER25> I think it's perfectly reasonable. Package maintainers are stomping their feet and huffing about making a change that is in everyone's best interest. Why shouldn't the distribution set strong guidelines and enforce them?

Too much is often sacrificed at the altar of backward compatibility. Move forward and leave the laggards behind.

</comment></comment><comment><USER26> How did a project like Babel not evolve to compile python2 into (horrific code) that runs with python2 compatible semantics on the python3 runtime ...? Is that not possible for some reason?

<comment><USER27> There's this: [https://docs.python.org/2/library/2to3.html](https://docs.python.org/2/library/2to3.html)

But the thing with Babel is that it only _adds_ features to JavaScript, it doesn't translate between two _disjoint_ languages. I'd assume that has an effect on its viability as a project.

<comment><USER28> 2to3 is such a small part of the solution. It only takes care of basic stuff, but to really get things right you need to know the types.

</comment></comment></comment><comment><USER29> This is why I continue to think that Python 3 being needlessly backwards incompatible was one of the dumber things to happen.

Think of the lost productivity that has resulted.

People complain about JS all the time, but JS hasn't broken existing code and has improved.

JS supports 'let' declarations and variables named 'let', python could have improved without breaking everything.

</comment><comment><USER30> gclient (necessary for building chromium, among other things) got an "early version" working with Python3 just a few weeks ago. Apparently this stuff is still being ported.

[https://groups.google.com/a/chromium.org/forum/#!topic/chrom...](https://groups.google.com/a/chromium.org/forum/#!topic/chromium- dev/Azd9hNkav6c)

</comment><comment><USER31> The last thing I expected to see in 'lists.debian.org' was emojis.

<comment><USER32> Do you mean the loupe magnifier? I wouldn't consider it an emoji.

<comment><USER33> [https://emojipedia.org/right-pointing-magnifying- glass/](https://emojipedia.org/right-pointing-magnifying-glass/) is part of Unicode Emoji 1.0 [https://unicode.org/Public/emoji/1.0/emoji- data.txt](https://unicode.org/Public/emoji/1.0/emoji-data.txt) as 1F50E and it's represented on the page not via an image embed, but as a character.

Why wouldn't you consider it an emoji?

<comment><USER34> It barely shows any emotion to put a magnifier down, maybe?

<comment><USER35> The word "emoji" does not come from "emotion", unlike "emoticon".

<comment><USER36> Had to look it up as a reminder:

> _Originally meaning pictograph, the word emoji comes from Japanese e (絵, > "picture") + moji (文字, "character"); the resemblance to the English words > emotion and emoticon is purely coincidental._ > [https://en.wikipedia.org/wiki/Emoji](https://en.wikipedia.org/wiki/Emoji)

</comment></comment></comment></comment></comment></comment><comment><USER37> Why is Debian removing support for Python 2 at all? It's not like there are new releases they need to test against or updates they need to merge.

<comment><USER38> A package with no active developer gets removed unless someone takes up the role of maintaining it.

Since python software foundation will stop developing it there is no upstream support after 2020. In theory a new upstream for python 2 could pop up, and there is speculation that Redhat might do it, but Debian do not want to become the new upstream for python 2. If they included python 2 in next release they would have to support it for as long as next release get support. What will happen instead is that they will keep supporting python 2 in older releases but when those support periods are over then its over.

<comment><USER39> > there is speculation that Redhat might do it

If they're going to do it, for the sake of the community they should announce that soon. Even if they don't plan on taking up the responsibility until the middle or end of 2020 it might be something that distros and companies would consider when making their plans.

<comment><USER40> They did and they have. I won't link to it because I strongly disagree with their decision to do so, but if you care about this you can find it.

</comment></comment></comment></comment><comment><USER41> Javascript: Hey you kids: quit doing cartwheels on the heads of 20 friends who are also all doing cartwheels twenty levels deep. No cartwheels more than 3 levels deep or someone's going to get hurt! You've been told over and over now.

Python: Hey you kids: sit in this cubicle for the entire summer and do 20,000 long division problems _just to keep the school 's lights on_. And don't get too encouraged because there's no way in hell we can finish all the long division before the beginning of the school year. Some of your classrooms will be dark. p.s. our principal got burned out and quit.

<comment><USER42> Can you explain the JavaScript comment? I don't follow that world.

<comment><USER43> [https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/](https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/)

<comment><USER44> I never actually read the whole story behind this. To me, it looks like the original author of leftpad was in the right - radically changing a package can break someone's build. Maybe he went a bit too far with his next action, but if NPM don't care about its end-users enough to ensure packages remain relatively stable (within the limited control they have), why should an individual contributor?</comment></comment></comment></comment>


Visual Studio 2010 Client Profile for Mono 2.8 - <AUTHOR> http://greghurlman.com/2010/10/23/visual-studio-2010-client-profile-for-mono-2-8/ <comment><AUTHOR> I feel a little weird linking my own blog here, and know that Visual Studio isn't exactly the IDE of choice on HN, but I figured that there might be some folks beyond me that would rather use VS to target Mono than MonoDevelop (since the VS license is already bought & paid for anyway).</comment>


Ask HN: What features would you want to have in your time tracker? - <AUTHOR> Hey. I'm working on my side project which is a tiny time tracker and doing some research.
My time tracker will be focused on tracking time for personal goals, e.g learning, building your own projects, etc.
1) What time tracker you use and? 2) What features you would want to have, but you don't? 3) Do you think the integrated Pomodoro technique would help you to boost your productivity?
Thanks, HN! <comment><USER2> It should have have reliable interface to AI managed video camera that watching 9-17 employee's workplace and analyse it's screen activity and at the end of the day to make smart decision how much "expensive" developer hours to count to that pity employee</comment>


We Just Found the Part of the Brain Responsible for Free Will - <AUTHOR> https://www.iflscience.com/brain/we-just-found-the-part-of-the-brain-responsible-for-free-will/ <comment><USER2> I think the article title is somewhat misleading. What they might found is not "part of the brain responsible for free will" but, rather, parts responsible for perception of volition will and agency.

Those are rather different things. The "free will" thing being a whole tougher nut to crack and, frankly, maybe even pointless to pursue at this stage of neuroscience development.

However, quest for neural correlates of volition and agency is extremely useful and better understanding could help managing catastrophic injuries.

</comment><comment><USER3> Caveat: this is not the free will you're probably looking for.

> The scientific definition, however, is far more specific. Essentially, it > comes down to two cognitive processes: volition and agency.

> Now, thanks to a study recently published in the Proceedings of the National > Academy of Sciences, scientists have identified the exact location in the > brain responsible for these processes and, therefore, our perception of free > will.

> Volition is "the desire to act", whereas agency is "the sense of > responsibility for our actions".

> [...]

> While the information is not going to stop moral philosophers and > sociologists debating the meaning (and very existence) of free will, the > researchers hope it will prove useful when it comes to helping patients with > volition and agency-inhibiting injuries.</comment>


Setup Diaspora on Ubuntu - <AUTHOR> http://www.h3manth.com/content/setup-diaspora-ubuntu A simple script to do a fresh setup of Diaspora with all the dependencies satisfied. <comment><USER2> > sudo apt-get install mongodb-stable

Unless you're doing this on your desktop - don't do that, the package in mongodb repos has broken dependencies and incorrectly depend on xulrunner-dev instead of xulrunner. This will install about 200MiB of completely unnecessary development packages and X11 stuff on your box which is not something you'd want for a headless server.

</comment><comment><USER2> Also, I'd suggest using rvm instead of apt-packaged ruby & gems, because otherwise you'd have to `sudo gem install bundler && sudo bundle install`, and I doubt you really want to make your ubuntu more slackware-ish. ;)

I did something like this (partially writing from memory):

      bash < <( curl http://rvm.beginrescueend.com/releases/rvm-install-head )
      rvm install 1.8.7
      rvm use 1.8.7@diaspora --create
      gem install bundler
      cd diaspora*
      bundle install</comment>


2017 Q3 Apache Cassandra User Survey - <AUTHOR> http://www.scylladb.com/2017/08/31/2017-q3-apache-cassandra-user-survey/ <comment><USER2> 70 expert Apache Cassandra users who actively use Apache Cassandra for in- production workloads. Their workloads represent more than 200 clusters running 600TB of combined data on Apache Cassandra. A few insights: * Cassandra Version 2.x (including DSE 4) is the most popular with more than 50% of deployments utilizing this version. * Performance, Tuning, and Administration accounted for 70% of total identified core Apache Cassandra challenges. * More than 30% of respondents don't run repair over their Cassandra cluster.</comment>


Show HN: Unicorn Platform – HTML landing page generator - <AUTHOR> https://unicornplatform.com <comment><AUTHOR> Hey!

I'm Alex. I've created a landing page generator for startups and side- projects. It produces HTML templates for export, so you can host it anywhere (GitHub Pages FTW). Unicorn Platform got 1050+ upvotes on Product Hunt btw.

The product contains 2 independent repositories:

1) Templates

2) The generator

1) Templates are crafted with SCSS, PUG, and jQuery. Some may say that jQuery is an anachronism. But hell nope. jQuery is still a big time-saver when it comes to DOM manipulations.

2) The generator is made with ReactJS. I'm so grateful to [https://github.com/facebook/create-react- app](https://github.com/facebook/create-react-app) for saving tons of time with configuring the building. Authentication runs on Google Firebase. And I must say it's a blast! Setting it up took just a few hours - and that includes time for creating the Facebook dev entity and the Twitter dev application. Google Firebase Auth takes care of duplicates as well. If your user signs up via email method using "email@example.com" and then tries to sign up with a Facebook account attached to the same "email@example.com" email, Google Firebase is smart enough to detect that and offer a user his initial method of authenticating. Pretty sweet.

I used Paddle for payments. Paddle has nice API. All I need to validate whether a user is upgraded to Pro is to send one tiny cURL request.

I tried to make the templates generation process as simple as I can. I have an independent .html file single component. When a user picks a component I just upload the .HTML file contents and inject it in the editor's DOM so user instantly sees what he will get after exporting. When a user wants to export a page I compose a single .HTML file which contains heading info, footer and the components HTML in between. I use vanilla PHP to compose the final .HTML file.

It's a commercial product but there are some components that will allow you to create a website for a pet project for free. Without even signin up.

I would appreciate any feedback.

<comment><USER2> I think the marketing copy is superb and I'm impressed that you already have nineteen paying users.</comment></comment>


How SaaS Companies Should Do Content Marketing - <AUTHOR> http://tomtunguz.com/content-marketing-lessons-learned/

<comment><USER2> Instead of creating your content for potential customers, create it for influencers who are already reaching them. This simple change gave to Buffer startup a big change in users by content marketing. I recommend you this article: [http://contently.com/strategist/2014/03/31/how-buffers- blog-...](http://contently.com/strategist/2014/03/31/how-buffers-blog-posts- get-shared-thousands-of-times/)</comment>


Show HN: SpaceBase – A Sass-based Responsive CSS Framework - <AUTHOR> http://spacebase.space150.com/

<comment><USER2> Thanks for the comments - spaceBase engineer here. We're currently working on building out the documentation and solid demo. We laid out some of the basics to get people up and running and work with the architecture. More to come soon though. Feel free to dig in further and send along feedback.

</comment><comment><USER3> Hmmm another grid that uses floats also can't seem to find any documentation for it?

Would suggest using something like [https://github.com/csswizardry/csswizardry- grids](https://github.com/csswizardry/csswizardry-grids) instead.

</comment><comment><USER4> Is there documentation that I am missing?

<comment><USER5> Second this. Looking for online vanilla demo.

<comment><USER6> Agreed. A single kitchen sink page would be enough for now, just to get a feel for the base styles.

<comment><USER7> Ditto. I would also love to know what support there is for things like modals, etc

</comment></comment></comment></comment><comment><USER8> really nice, well done and great job working with parsons on his!</comment>


Separate but unequal: Charts show growing rich-poor gap - <AUTHOR> http://news.yahoo.com/s/yblog_thelookout/20110223/ts_yblog_thelookout/separate-but-unequal-charts-show-growing-rich-poor-gap <comment><USER2> A friend of mine in the industry points out (referring to the original Mother Jones article) that he and his wife have a net worth at least 100 times greater than it was when they first married. Accumulation of wealth comes about just by working steadily (as they both have) while growing older. In his words, "We have 100x the net worth of our younger selves (because the starting number was so low). Is that horrible inequality or the desirable progression of life?"

<comment><USER3> I've done well by myself too, but two points do not make a trend. It's clear from looking at the numbers that most people are not doing better over time. Furthermore, I'm well aware that I'm probably one slip (e.g. a major health problem, a corporate cutback) away from a significant decline, but that's more or less out of my control, so I try not to worry about it.

</comment></comment><comment><USER4> Original Mother Jones article: [http://motherjones.com/politics/2011/02/income-inequality- in...](http://motherjones.com/politics/2011/02/income-inequality-in-america- chart-graph)

<comment><USER5> +1 brudgers, the original article has a lot more detail.

</comment></comment><comment><USER6> > According to this chart, most income groups have barely grown richer since > 1979.

It's worth pointing out that the primary way most professions get more buying power is by prices coming down, not wages going up.

This "barely grown richer" is just flat-out wrong. Everyone in countries with remotely decent governance are much better than people 33 years ago were. _Much_ better. That needs to be acknowledged before any handwringing starts.

<comment><USER7> That chart is already inflation adjusted. See on the bottom where it says "2007 Dollars".

</comment></comment><comment><USER8> Also relevant [http://www.stateofworkingamerica.org/pages/interactive#/?sta...](http://www.stateofworkingamerica.org/pages/interactive#/?start=1917&end=1918)</comment>


Mobile banking app asks for permission to scan all files - <AUTHOR> Mobile apps are increasingly asking for permissions they don't really need, presumably because most users grant these permissions without really thinking about it.
The latest installment of this is my bank's new mobile app asking for permission to read/write to all files on the device - allegedly just to "scan for malware".
If you refuse permission, the banking app just refuses to work. You cannot check a box saying that you'll accept liability if there is malware on your device that results in loss.
I feel that this behavior makes a mockery of the notion of giving "permission". Apps have far too much bargaining power - the app effectively holds a gun to your head and demands to see all your files. What does it do with them? Does it use the results to gain insight into your potential creditworthiness? Does it sell some kind of fingerprint of your device files as an extra income stream? I have no way of knowing.
This kind of thing is becoming more common and I wish Apple and Google would crack down on it - ban apps that won't work unless the user gives certain permissions. Alternatively I'd like to see "fake" permissions that give an app access to a fake filesystem or to a fake camera/microphone. <comment><USER2> This problem is even bigger in some countries.

Without a specific app on a mobile phone, doctors will not take appointments, pharmacy will not dispense medication, social services will not provide services.

A problem with the presumptions that

1) I have a device that is internet connected,

2) I have a device that is compatible with the apps,

3) I will grant excessive rights for the apps on the device.

<comment><USER3> In Sweden you can theoretically work around it using your ID card to identify yourself online [1], but many places don't support it or don't even try to.

Mobilt BankID is very popular app, technically it has a desktop companion that again is not widely supported or known [2].

[1] [https://www.skatteverket.se/servicelankar/otherlanguages/ine...](https://www.skatteverket.se/servicelankar/otherlanguages/inenglish/individualsandemployees/livinginsweden/idcard/electronicidentificationwiththeidcard.4.3810a01c150939e893f1dab6.html)

[2] [https://support.bankid.com/sv/bestalla-bankid/bestalla- banki...](https://support.bankid.com/sv/bestalla-bankid/bestalla-bankid)

</comment></comment><comment><USER4> Can't you just use the mobile browser to log in the bank web page?

I know it is not always possible, especially if you're in certain countries. Sometimes I think about having an extra phone that I never take outside home that just has these apps...

<comment><AUTHOR> You can, but their banking logon is really, really inconvenient and requires to to have a hardware token and enter 4 different long numbers/passwords and it logs you off automatically after 3 minutes of inactivity. The app means you can actually get banking done without a half-hour logon process.</comment></comment>


Dagoba: an in-memory graph database (2016) - <AUTHOR> http://aosabook.org/en/500L/dagoba-an-in-memory-graph-database.html <comment><USER2> This is a really, really great article. Shame it didn't get on HN 2 years ago.

For anyone interested in the history of databases, as the author eluded to, it began with graph databases first (called Navigational Databases), and then SQL came in and actually ruined the approach and performance (despite people thinking SQL databases were designed for storage constraints, that didn't come until later after the relational model had been more developed). If you want to learn more about this history, I did a talk out in Italy (later recorded on a web cast) about it here: [https://vimeo.com/208899228/b9bc9eaaa4](https://vimeo.com/208899228/b9bc9eaaa4)

<comment><USER3> "eluded" (escaped/avoided) -> "alluded [to]" (referenced)

</comment></comment><comment><USER4> Here's a link to this article with working source on GitHub: [https://github.com/dxnn/dagoba](https://github.com/dxnn/dagoba)

Really useful to see it all put together.

</comment><comment><USER5> This is an excellent article -- not just technically, but tonewise as well; kudos to the author.

</comment><comment><USER6> > Fortunately, we're building an in-memory database, so we don't have to worry > about any of that!

If I wanted to do something in memory, I'd just use data structures in my process. Not so much a database if there is no persistence.

<comment><USER7> Haven't read the article yet, about to, but that sounds a bit naive.

In-memory is not exactly to do with persistence, you can still have non- volatile data be in an "in-memory" DB and take snapshots of it, but even so, what about when you decide you need to scale your compute but not your RAM and move the data structure to a networked box, or when you need to have more than one local process read the same data structure, or when you want to ensure your architecture will always support such a thing _if_ you need to, or if your language doesn't have a decent implementation of a particular data structure, or etc.

<comment><USER6> It might make it convenient to do those things, but it doesn't make it a database really though does it? The article admits it doesn't have to handle the most complex problems associated with data persistence (getting transactional blocks of data to a storage medium).

Your examples become a problem if your graph can't fit in the RAM of one host. If not that, then you have then distinct graphs to handle, and so a paralellisable problem to be handled by multiple processes. All you have in that case is an abstraction which lets you have a unified interface to all of them. Notably that also isn't relevant as the one in the article doesn't do any of that. It is a graph library.</comment></comment></comment>


A&$hole driven development (ADD, CDD, CYAE, ... a more honest list of dev frameworks)  - <AUTHOR> http://www.scottberkun.com/blog/2007/asshole-driven-development/ <comment><USER2> A little breath of fresh narcissistic air... recommended :)</comment>


Whatsapp: Two-Step Verification - <AUTHOR> https://www.whatsapp.com/faq/en/general/26000021 <comment><USER2> Will they use email address to "improve advertising experience"?</comment>


Parenting from before conception: Babies' health doesn't 'start from scratch' - <AUTHOR> http://www.sciencedaily.com/releases/2014/08/140814191347.htm

<comment><USER2> We changed the URL from [1] so the thread can stop being about a sensationalized and off-topic title [2].

1\. [http://www.adelaidenow.com.au/news/south- australia/darwins-t...](http://www.adelaidenow.com.au/news/south- australia/darwins-theory-of-evolution-challenged-by-university-of-adelaide- genetic-memory-research-published-in-journal-science/story- fni6uo1m-1227024901078?nk=54810754a37a8dbcab3eafc6656a09b9)

2 "Darwin's theory of evolution challenged"

</comment><comment><USER3> It's called transgenerational epigenetics. It's been observed before. It's nowhere near what Lamark proposed. For that matter, we are already way beyond Darwin who never even conceived of DNA. This is just another nuance.

</comment><comment><USER4> Darwin's theory of evolution by natural selection is not challenged by this research. All Darwin's original theory requires is that traits vary, are passed down to offspring, and affect the reproductive success of those children.

Darwin published "On the Origin of Species" before the scientific community had recognized that such things as "genes" really existed. So on the face of it, it's absurd to propose that the idea that genes (as in, specific sequences of DNA base pairs at specific locations on specific chromosomes) are not the entirety of the mechanism by which organisms acquire their traits challenges the mechanism by which those traits are filtered.

Not to mention that there's never been any question that environmental input affects gene expression. All this paper is basically saying is that the health and lifestyle of the parents is an environmental factor in embryo development. If you smoke crack while pregnant, that does cause predictable affects on gene expression in the child. This paper may extend that to smoking crack before you get pregnant, which, unsurprisingly, likely also affects the child.

The idea that this effect is anything like Lemarckianism or that the existence of epigenetic effects refutes Darwin so greatly misunderstands both Lemarck and Darwin that I don't know where to begin. If there are actual scientists out there making these claims in such bold terms, they are either deluded or they are BSing for political reasons.

</comment><comment> vezzy-fnord Uh, if anything, this challenges _tabula rasa_. But I don't see how it's such a blow to Darwinian evolution. Or am I missing something?

</comment><comment><USER5> Silly sensational title. The theory has to be nuanced if anything, not challenged.

</comment><comment><USER6> I have not read the paper. But looks to me these bozos just rediscovered DNA methylation and the "grandmother-effect"</comment>