Show no mercy: The tragedy in Xinjiang - <AUTHOR> https://thecritic.co.uk/show-no-mercy-the-tragedy-in-xinjiang/ <comment><USER4> I would be interested to see how much western companies are involved in providing some of the tools of oppression described here, such as facial recognition and cell phone spyware.

<comment><USER5> Not XinJiang, but after British and American companies refused to sell weapons to Hong Kong Police , they turned to French and Swedish companies which happily sold them whatever they wanted [1][2].

[1] - [https://hongkongfp.com/2020/06/06/explainer-piexon- jpx6-the-...](https://hongkongfp.com/2020/06/06/explainer-piexon-jpx6-the-new- hi-tech-pepper-spray-tool-for-hong-kong-riot-police/)

<comment><USER6> That article mentions a Swiss company, but I don't see any mention of Sweden. Is this a mistake of yours or am I missing something? I guess a mistake since you seem to have forgotten a link.

<comment><USER5> My bad, I was looking for source of the second claim (French supplies) before getting interrupted. Now I'm unable to edit my comment. My claim that France supplied weapons to Hong Kong Police recently was not correct. The "Water Cannon" truck they use was Mercedes Benz made in France [1].

[1]: [https://www.scmp.com/news/hong-kong/law-and- crime/article/30...](https://www.scmp.com/news/hong-kong/law-and- crime/article/3020397/anti-riot-vehicles-equipped-water-cannons-begin-road)

</comment></comment></comment></comment><comment><AUTHOR> I have always wondered how could the world allow the genocide of the Jews during the Holocaust. Now I understand. It's all about financial gains. No one will speak out against such atrocities if it's against their financial interest. In today's world, no one will speak against China due to their selfish interests.

<comment><USER7> The Holocaust happened during WW2, and mostly towards the end. The biggest armies ever assembled were actually actively trying to stop the Nazis you'll remember.

And while persecutions against Jews were nothing new, the nature and extent of the actual genocide was definitely not publicized. It's well documented how the Nazis scrambled to hide their deeds, however late. Note how they summarily executed rural Jewish populations in Soviet territories, but deported those in urban or Western locations to remote camps.

The reason why you'd think otherwise is because of a desire to further blame the German population at large at the end of the war. Not that they didn't deserve plenty of blame and were largely complicit, but I believe it's now pretty clear Nazi leadership knew it would have been too controversial should the truth of what was going on had been widely known.

To wit, right after a concentration camp was liberated, the US general in charge forced the mayor of the nearby town to visit the camp ([https://www.scrapbookpages.com/DachauScrapbook/DachauLiberat...](https://www.scrapbookpages.com/DachauScrapbook/DachauLiberation/aftermath03.html)). He and his wife then promptly committed suicide. Hard square that with the nature of the genocide being public knowledge.

<comment><USER8> You should probably read the wikipedia article on this topic: there's far more evidence than I could give a concise introduction to, but the majority consensus is yes, the german people did know about the holocaust, because it was the german people (not just a secretive subset) that did it. The majority of the holocaust was carried out by ordinary german soldiers.

<comment><USER7> That it was carried out by "ordinary german soldiers," whatever that means, is irrelevant to the issue at hand, namely whether what was actually going on was widely known.

<comment><USER8> Do you have some kind of axe to grind on this topic? I just ask because, at that time, almost the entire male fighting age population were mobilized. So when it comes to the question 'is something generally known', it's obviously relevant that such a large portion of the population were actively involved in it.

<comment><USER7> There's a difference between what people can be made to do in the heat of the action (and it's frighteningly easy given the right circumstances) and what they will consent to when their rational, moral brain is engaged. (Though according to cognitive dissonance theory, the former influences the latter.)

The only axe I have to grind is that this drive to further demonize Nazism, as if it needed any outside help, is utterly counter-productive.

First it prevents us from drawing actual lessons from what happened. In this case, I posit that merely hiding the most gruesome details of the Holocaust was instrumental in allowing it to happen. "I should have known, I could have known, I didn't know" Albert Speer said. It was sneered at as being self- serving, but I think it reflects an important truth: it was rather easy to have people choose to ignore what was going on. They could simply choose to believe that the Jews had gone to live on a farm or something, so to speak, and avoid thinking too much about it at a time when they had plenty of other things to worry about.

Second, it gives credibility to denialists' arguments. For example, they point out that gas chambers look dodgy and extremely unsafe for operators. That's because the Final Solution was initially presented as a well orchestrated, industrial operation that would have required a larger population to have full knowledge. But the current historical consensus is that while it was indeed a massive operation, it was in fact committed with relatively limited resources using leftover supplies.

<comment><USER8> I don't think this question is really about Nazism. I think it's about the role of the German people in the Holocaust. One driving force in how Germans think about it is the 'clean hands Wehrmacht' idea - simply, that the really evil, anti-semetic and genocidal aspects of the Nazis were carried out by a small minority of fanatics, and the larger body of German society was unaware, unenthusiastic, and largely uninvolved. In this account, the Germans were among the victims of Nazism - it's a view really typified by the Reichstag Dome - where you can literally walk over, and look down on, the Bundestag. This dome was inaugurated as an expression of the idea that the german people should 'never again' be under the state.

Obviously, this kind of stuff is very comforting when you have to go to visit Grandfather Klaus, because he was (after all) a victim, rather than a perpetrator - and you can buy your good german products made by good german companies, and if they have a somewhat dark and disturbing past, you can remind yourself that they too were victims, in a sense.

Except, of course, it's not true. The Nazis were hugely popular with german voters. Anti-Semitism was, if anything, _more_ popular still. The Holocaust largely consisted of massacres by normal german soldiers, and the Germans had explicitly genocidal aims in major policies (e.g. operation Barbarossa + 'lebensraum').

I don't think denialist arguments need to be taken into consideration when thinking of the holocaust. They are obviously ridiculous. What does need to be taken into consideration is the way in which Germans, and German culture, aimed to shield itself from its own pathological underbelly, while keeping hold of the economic spoils. After the war, everybody who was anybody had been a Nazi. Many companies were literally founded by the Nazis (VW) or got their big breaks under the Nazis (addidas, for instance). Everybody who was in the film industry cut their teeth on propaganda films for the Nazis.

One of the most awful consequences of this is the fact that, after the Allies left, most of the Nazis who had escaped execution in the Nuremburg trials were released, and those who had not been caught yet, were generally not prosecuted. If you read through the list of administrative personnel in a concentration camp, the majority usually escaped prosecution, or received short sentences (I recommend checking out [https://en.wikipedia.org/wiki/Treblinka_trials](https://en.wikipedia.org/wiki/Treblinka_trials) \- three years! For operating a gas chamber! And remember, it takes many more than ten people to run a camp. Or [https://en.wikipedia.org/wiki/Belzec_trial](https://en.wikipedia.org/wiki/Belzec_trial) \- Of eight people they actually brought to trial, only one was sent to prison! Here you can actually see the 'clean hands wehrmacht' logic - <USER2> were all 'acting under duress!').

The West German unwillingness to find and prosecute the greatest criminals in history is the kind of thing any nation should be ashamed of, except instead, we just hear a lot of pretentious nonsense about 'remembrance culture'. The reality is, forget the average Wehrmacht soldier - if you were an SS officer employed at a concentration camp, and you avoided the soviets, and you didn't get hanged by the Allies, your chances of avoiding serious legal consequences were very good.

<comment><USER7> > The Nazis were hugely popular with german voters

They were not _that_ popular with voters, just popular enough. After that there were no more votes. But that's a nitpick.

In any case, there's nothing diminishing the importance of antisemitism in my argument. Rounding up the Jews in the first place clearly was a massive crime and done in plain sight, and with the complicity of the population. It's the ensuing extermination that I argue was hidden, lest it would have been too unpalatable for too many people.

<comment><USER8> >too unpalatable for too many people

And this is, I think, totally wrong. The soldiers in the Wehrmacht and SS are a representative section of the German population at the time. They are a far larger percentage of the population than you'd need for a representative poll. And, despite having no real consequences for refusal (no German soldier was never executed or severely punished for refusing to kill jews) most not only took part in the holocaust, but went above and beyond what was required of them, piling on cruelty above and beyond what their orders demanded.

I don't think Germans are the only ones to blame, that said. German soldiers were helped in the pogroms in Poland by ordinary citizens, for instance, many of whom took active parts in torturing and murdering their neighbors. I would imagine the only reason why this was not also common in Germany proper is that there were simply far less jews there, and most of them were already incarcerated by this point in the war.

I also think a lot of your argument rests on a dubious idea of what constitutes 'knowledge of the Holocaust'. If we're talking about specific knowledge of how operations at Auschwitz worked, I would imagine all the Nazis not directly involved (perhaps even Hitler!) would be 'innocent'. Knowledge of the camps existence was, on the other hand, commonplace[1]. Knowledge of the extermination program was explicit amongst superior officers, but equally, not at all uncommon amongst ordinary people, many of whom took a part in the project (doctors, for instance, with the euthanasia program). The link has some interesting reading about how the extermination policy did in polls - <USER3> was more popular than the CDU is today, for instance.

[1] [https://en.wikipedia.org/wiki/Responsibility_for_the_Holocau...](https://en.wikipedia.org/wiki/Responsibility_for_the_Holocaust#German_people)

<comment><USER7> I'm well aware of the crimes of the Wehrmacht, and I implied as much when I mentioned how they executed rural Jewish populations in Soviet territory.

As I said earlier, there is a big difference between what people can be made to do in the heat of the action compared to when people have time to think. There's intense peer pressure and training that stresses compliance. They had been under fire recently, which made them more willing to kill. There's the escalation of engagement, where you've been killing people for a while already, so murdering civilians is, in a way, merely an extension.

> I would imagine all the Nazis not directly involved (perhaps even Hitler!) > would be 'innocent'.

I'm not arguing in terms of guilt or innocence; it's a rather pointless exercise. But if I really must, then the Germans were certainly guilty of persecuting, despoiling and rounding up the Jews in concentration camps. As such, they were ultimately guilty for the extermination that this made possible.

<comment><USER8> > As such, they were ultimately guilty for the extermination that this made > possible.

The wording here is kind of insane. The germans did the extermination. They didn't make it possible for some other group to do it. Just because not everybody involved can literally be throwing the cans of gas through the trapdoor does not mean that all the masses people in all strata of society directly involved in its planning and execution were not culpable. Doctors who sent their patients to the gas chambers did not do so 'under fire'.

I think arguments like yours would hold much more weight if they hadn't tacitly legitimized the holocaust in the post-war era, by not prosecuting even the worst and most awful monsters of the system. If the German people were truly shocked and horrified about what had happened, then surely they would have made a bigger effort to make sure that the people who had done these shocking and awful things were recognized as the criminals they were, rather than just saying they were 'under duress', if they even bothered to bring them to trial.

The real thing that bothers me about the German reaction to the Holocaust is not the guilt or innocence of specific parties. It is this idea - 'under duress', under which the Germans have fashioned themselves this whole idea that they were unwittingly involved in monstrous acts, or terrified into submission by a small group of crazy people, so they don't have to confront the actual horror of what they did. If the Germans had been half so serious about dismantling the Nazi state as they were about dismantling the DDR, you can bet there would be no VW today, there would be no 'under duress', there would be no smooth transition from the Nazi party to west-german beamter (there certainly was no such transition for east german beamters). The whole German state would have had to be re-built from scratch, and it would have been better for it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> It's incredibly sad that this is not getting as much attention as it should. Lots of people in the world knows about them, but not many countries, even those that suffered WWII are turning a blind eye to this. XinJiang is practically a huge concentration camp, no better than the Nazi ones, and in fact might be worse.

Unfortunately the only way to save these people is to defeat CCP, but most governments are too busy earning RMB.

Now that the US government are taking on this issue, I hope the world follows.

</comment><comment><USER9> Sorry but Islam has problematic requirements for its adherants that mean the Chinese are right. It should be regarded as a virus. It is a form of modern day slavery, and compels its followers to subjugate, convert or depose of the Kafir and terrorise their fellow Muslim to be compliant.

I'm sorry it hurts your feelings, but if we're cancelling links to slavery in Britain. It's time to stop being tolerant towards the intolerant and stop accepting this Abrahamic religion that hates us so if we're going to have any kind of future.

The religion has caused more destruction and genocide, misery and despair than most other ideologies except communism and modern leftism. If you don't support China, you are missing the grass for the trees. They are well within their rights to remove such a malignent, subsistant and coersive demos.

If you doubt me, read the history of Islam, and learn about the lot of those they will subjegate eventually after theyve slowly improved their demographic whilst the rest of us are trying to earn a living.

I don't have a problem with Muslims, but I hate Islam. Hardly any mixing has occured in 60 years between them and non-muslims on my Isles, they have honor killed many that have attempted it and as an aethiest it is not acceptable how they treat apostates.

If you are going to bring your American Identity Politics to my Isles (where we are not equipped to deal with them) in order to cancel my countries links to slavery, it is time to cancel the modern day slavery that this man made religion represents.

Consider it justice for the over 30,000 of our girls that were raped, injected with heroin and cast aside.</comment>


The Future of MySQL - <AUTHOR> http://monty-says.blogspot.com/2009/07/helping-us-department-of-justice.html

<comment><USER2> Oracle owns a bit more than the name -- they have full copyright over the mainline source!

They are the only party that can sell commercial licenses to the mainline GPL code. All community forks will have to be GPL-only.

</comment><comment><USER3> It's free software, right? Why would Oracle be in any obligation to support and put money in it? And why would Oracle not supporting it be any kind of problem anyway?

<comment><USER4> Imagine any large software product, open source or otherwise, with 10+ years of history and a large team behind it. Now imagine that large team disbanded and assigned to other projects. That's the problem of Oracle not supporting it.

There is this myth of large open source projects being built collectively by thousands of individual developers in their bedrooms. It doesn't actually work that way. MySQL has a large onsite development team that until recently drew their salary from Sun. If their new bosses decided to pull the plug, that would be a big deal.

</comment></comment><comment><USER5> If you're a U.S. company dependant on MySQL to run your business, tell the DOJ about it so they "have a talk" with Oracle about not killing it.

 _For those that are worried about the future of OSS software as part of the Oracle / Sun deal, and the affect (both good and bad) it may have on their business, the US Department of Justice is encouraging companies that are dependent on MySQL / Java to contact them and tell them how the deal may affect their business. The more information the department gets, the better equipped they will be in deciding what their recommendation for the deal will be._

<comment><USER3> "If you're a U.S. company dependant on MySQL to run your business, tell the DOJ about it so they "have a talk" with Oracle about not killing it."

MySQL is free software (free as in freedom). Oracle can't kill it. They can try all they want, the codebase belongs to all its users.

<comment><USER6> "MySQL could be killed, but for Open Source that just means it would branch and be reborn a day or a week later mostly intact and protected by nerds who would by then be very, very angry." -- Cringely <http://www.cringely.com/2009/04/sunset/>

</comment></comment></comment><comment><USER7> Monty talked a little about Oracle at his talk at LinuxFest Northwest. Video can be found here - <http://www.ustream.tv/recorded/1431407>

Basically, he said Oracle owns MySQL in name only. Most of the brains behind it are already working with him on MariaDB or Brian Aker on Drizzle. He promised that MariaDB would remain binary compatible with MySQL.

<comment><USER8> i guess this is why i don't get the whole ruckus surrounding the oracle purchase of sun. Can't some other entity just takeover the responsibilities (under different branding) if oracle decides to let mysql flounder?

<comment><USER9> Yes. Although there would be some setbacks, the MySQL documentation for example is not under an open source license.

</comment></comment></comment><comment><USER10> I suppose that you should care if you use it and rely on it for production applications. But if you use a commercial database (or one of the other OSS databases -- is Postgres any good?) then this doesn't really affect you at all.

<comment><USER11> Postgres is _very_ good. So much so that many of us use it instead of Mysql in any case:-)

<comment><USER5> "$FOO is _very_ good. So much so that many of us use it instead of $BAR in any case."

Your usage of FOO for _some_ purposes is not a sufficient proof of its superiority to other solutions for _all_ purposes.

<comment><USER11> I think you have a parse error. I didn't write "Mysql sucks" or that Postgres is better for everything always.

Google for Postgres vs Mysql if you're interested in pursuing the topic further - it's been done to death here and elsewhere. I just wanted to say that Postgres is a very valid alternative.

<comment><USER9> Congratulations. In every discussion thread about MySQL there is always one guy who has to mention that PostgreSQL is a superior alternative to MySQL, thus reigniting yet another off-topic discussion of the relative merits of each. Today you are that guy. Today is your day to shine.

<comment><USER12> It was in response to a direct question. Sheesh.

</comment></comment></comment></comment></comment></comment><comment><USER13> but actually, I don't. Or rather, I do, in the negative sense.

I'd like it to die from a combination of owner neglect or malice from Oracle and death by a thousand forks.

<comment><USER5> Good on you having an alternative database for your business use-case. But just because _you_ don't use it doesn't mean you should wish for its demise and deny it to others.

</comment></comment><comment><USER14> No, I shouldn't care. If mysql dissappears there is postgresql and many other open source options.

All you should do is have an easy way to port all your data/code to the new database, which you should already have such backup plan, right?

Hosting providers should be aware and prepared to switch databases too.</comment>


Ask HN: Can an Electrical Graduate Pursue a Masters in Computer Science - <AUTHOR>

So i've completed my engineering in Electrical Engineering(in India).That's important becasue here they concentrate solely on Heavy Electricals with a minor influence of Electronics.As in most cases,I ended up wokring in the IT sector.But after joining I actually love my job and keep regretting not taking Computer Science as my under graduate. With that background,my question is: How hard is it for a person with my background to get into a Masters program for computer Science.And is there any way I could improve my chances.I am good at what I do and have also contributed to Open Source also.I'd like options and not answers which would end up on "If there is a will,there is a way" or something like that. <comment><USER2> Most Master's degrees in Computer Science, in the US, are awarded as part of 3 types of programs:

1) For people returning to school without a CS background. 2) As an "add on" to a Phd program. 3) As part of a combined 5 year BS/MS degree.

Very few are awarded to undergraduates with CS backgrounds that are going only for an MS.

That's a long way of saying, it is perfectly normal for people with all manner of backgrounds to receive Master's degrees in CS in the US and someone with an EE undergraduate probably has a leg up on most of the other candidates.

</comment><comment><USER3> Yes, almost all of my professors did the same. After having Electrical degree they continue with CS and finishes with PHD in it. Also if you have noticed in most of the universities Computer Science comes under Electrical Engineering department. So go ahead ..........

<comment><AUTHOR> Yes but that is because in other countries the electrical department includes Computer Science.In India the there is a massive difference.I was looking more in terms of avenues.Like things I cold possibly do to improve my chance</comment></comment>


Show HN: Play snake by moving your head - <AUTHOR> https://github.com/paruby/snake-face <comment><AUTHOR> Link to demo: [https://paruby.github.io/snake- face/](https://paruby.github.io/snake-face/)

</comment><comment><USER2> This is cool!

I appreciate the printed direction under the video of my face, but I feel like it might have been a little bit easier for me to learn to direct it if there was also a face mesh drawn on the displayed camera frame as debug info. This has seemed to allow me to adjust easier to facial controls in the past, and other people I polled about the helpfulness of displaying such debug info to the end user seemed to overwhelmingly agree (polls were of about 20 people, and super unscientific -- this is essentially still anecdotal advice to be taken with a grain of salt, but I got literally no negative reactions).

As an example of how this could help learning, I jumped straight to the demo without really reading the instructions (hurpadurpa), and I foolishly assumed that you were just detecting head position in the frame and using the coordinates, rather than the direction my face was pointing, to determine control direction. It wasn't until I looked at the code that I realised what I was doing wrong. I probably could have read more and picked up on this without diving into the code, but I also probably would have picked it up immediately if I saw a mesh of some facial landmarks (rather than assuming an invisible bounding box). I think smaller adjustments would be assisted as well -- the user can figure out how far off screen their face can go while still being a face way easier if you show them what you think looks like a face.

Another maybe-helpful-maybe-not thought: adding an additional direction indicator to the art in the main game screen might make it easier to get used to the controls as well, and let the user know exactly when they trigger a change in direction without drawing their eyes away from the action. This could be as simple as two pixels for eyes on the snake head.

<comment><AUTHOR> Thanks a lot for the detailed feedback, that's really helpful!

</comment></comment><comment><USER3> You should rename the title to 'snake game with free head streches'

</comment><comment><USER4> I did a similar thing, but used left / right head tilting for scrolling the page.

Reading and peeling oranges became easier.

</comment><comment><USER5> There is a tutorial about that [https://www.youtube.com/watch?v=UPgxnGC8oBU](https://www.youtube.com/watch?v=UPgxnGC8oBU)

<comment><AUTHOR> Very cool, but that video works by using normal supervised learning (to detect hand gestures) while mine detects the direction your face is pointing in using pose estimation.

Edit: I didn't train the pose estimation model myself, it's taken from a tensorflow.js example: [https://github.com/tensorflow/tfjs- models/tree/master/faceme...](https://github.com/tensorflow/tfjs- models/tree/master/facemesh)

<comment><USER6> How hard would it be to use these tools to detect someone touching their face and throwing a chime to help remind them not to? It could run in the background all day for laptop/webcam users. #covid etc.

<comment><USER7> Check this out: [https://news.ycombinator.com/item?id=22548708](https://news.ycombinator.com/item?id=22548708)

<comment><USER6> Yeah, that!

</comment></comment></comment></comment></comment><comment><USER8> Very impressive! Callibration took a fair minute or two but I didn't have to do anything complicated like show it all the different poses.

Fun couple of games. I had trouble getting it to recognise down but I think that's because I can't bend my neck forward and keep looking at the screen (glasses) to see the snake moving.

Also I am definitely team: Screen edge should wrap around!

<comment><AUTHOR> Thanks for the feedback, I will take it into account for v2!

</comment></comment><comment><USER9> Great way to discover muscles you didn't know you had

</comment><comment><USER10> I think I need a beard for this to work.

</comment><comment><USER11> Lots of fun, but my head hurts a bit :)

<comment><USER12> Yea, I had to stop after scoring 5

</comment></comment><comment><USER13> Keep making these things for me. :)

</comment><comment><USER14> Vero cool

</comment><comment><USER15> this is very nice and fun!</comment>


A Crash Course In Awk - <AUTHOR> http://blog.bignerdranch.com/3799-a-crash-course-in-awk/

<comment><USER2> Having used bash, awk, sed and a hodgepodge of utilities for twenty years, it was a revelation to finally spend some time learning perl. It's not a panacea but it does offer a much larger return for time invested in learning the basics. It is today as ubiquitous as sed & awk, and provides much more power and sophistication for no extra complexity.

$0.02

<comment><USER3> Perl is great, but today you can just as well (or easier) use ruby, python or even php for scripting one-liners and small tasks. However awk and sed are still fantastic option when you need just a quick processing on a command line. Pipe it in, do some transformations or replacements, pipe it out. Same goes for other unix power-tools like sort, unique, wc, head, tail, split, etc., they are all still very useful...

<comment><USER4> Good luck doing one liners with Python, as long as it use wspace indentation for e.g. loops and don't support {}:s as an option. :-(

I'd argue with most others, Perl is the single most useful command line tool. Not the only one, of course. But afaik, you can't e.g. load a JSON lib in awk as part of a pipeline. (I deserialize dumped data structures multiple times a week in [ad hoc testing with] pipelined cmds.)

Imho, if you know Ruby or PHP as the back of your hand, don't learn another scripting language for command line use. Learn some completely different language for some other use, instead.

<comment><USER5> No, you can't work with JSON very easily in awk. Any kind of hierarchical format like JSON and XML will give you a headache in awk, and CSV can be difficult as well.

<comment><USER6> While not as complete as a full CSV parsing lib, finding this made working with CSV in awk much easier: [http://www.gnu.org/software/gawk/manual/html_node/Splitting-...](http://www.gnu.org/software/gawk/manual/html_node/Splitting- By-Content.html)

      gawk -vFPAT='[^,]*|"[^"]*"'

[http://stackoverflow.com/questions/4205431/parse-a-csv- using...](http://stackoverflow.com/questions/4205431/parse-a-csv-using-awk- and-ignoring-commas-inside-a-field/17287068#17287068)

<comment><USER4> That regexp fails with fields containing '"':s, but I guess you can grep for embedded double quotes ("") first.

Are there multiple variants of coding '"' in CSV fields? I don't know -- but _some people who do know are those who write the CSV libs I use_!

Edit: And as your link notes, it fails for embedded \n:s. Imnsho, awk needs csv (and json, etc) builtin, preferable as a plugin architecture. But then, why not just use the Perl superset?

<comment><USER7> Man, seconded. I'm not sure if a CSV-ized awk is a sensible idea, but I'd love to have it if it were. CSV might be #1 on my list of "things that will cause problems for you because they are slightly harder than you think they are".

<comment><USER4> I hear you, re CSV.

Join the dar... cough, Perl side, we have cookies. :-) We have CSV parsers and everything else, all the way up to e.g. good web libraries and the best OO among the scripting languages (Moose, ~ like the Common Lisp OO environment; more or less std for new Perl projects today.)

 _And_ there is more! You can reuse most everything you know from awk! Write: perldoc perlrun

Check for -n, -p, -i, -E flags. And, as many have noted, there is a2p.

[http://perldoc.perl.org/5.16.2/perlrun.html](http://perldoc.perl.org/5.16.2/perlrun.html)

[http://perldoc.perl.org/5.16.2/a2p.html](http://perldoc.perl.org/5.16.2/a2p.html)

But the main reason is that we have fun. An insane programming language which throw all this "minimal mathematical notation" stuff out the window with some linguist inspirations, but still works wonderfully (do insist on keeping to the coding standards in your group. Seriously. At a minimum -- lie and say that you do that, when people interview for a job at your place. :-) )

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> A pretty good article. Events aren't a bad metaphor, but it's actually simpler than that. The whole program, except BEGIN and END blocks, is a big loop. Blocks with conditions in front are just if statements without having to type if. They're executed one after the other, and they can affect each other by setting variables. If it encounters a next statement, no further commands are executed and it starts over on the next line. The beauty of it is that it saves you from having to set up the loop and write I/O commands to loop through a text file.

<comment><USER8> The event / pattern-matching analogy was pretty great for me. I never really bothered much with awk, possibly out of sheer laziness, but with this small piece of knowledge, it somehow feels much more accessible and logical to use.

That said, the loop concept and using next is also very valuable piece of information. So thanks to both!

</comment></comment><comment><USER9> Nice article. awk is a fantastic tool to get quick insights into not so large data. This is my take which I wrote last tuesday incidentally [http://hkelkar.com/2013/10/15/rolling-up-data-with- awk/](http://hkelkar.com/2013/10/15/rolling-up-data-with-awk/)

<comment><USER2> Your post caught my eye. Since I mentioned earlier that learning perl was a good investment, thought i'd just show a quick equivalent to the awk script in your blog post.

This produces same output as your awk script (except it's sorted alphabetically):

      #!/usr/bin/perl -F, -an "$@"
      $wins{$F[0]} += $F[6];
      $losses{$F[0]} += $F[7];
      END {
        print "manager,total_wins,total_losses\n"
        for (sort keys %wins) {
          print "$_,$wins{$_},$losses{$_}\n";
        }
      }

EDIT: should also mention that you can automatically convert awk scripts to perl with the a2p utility which should already be installed along with perl.

<comment><USER5> Here is another awk version of that script that's a little more concise and sorts, like the above, using newer features that are in gawk:

      #!/usr/local/bin/gawk -E
      BEGIN{
      	FS=","
      }
      {
      	total_wins[$1]+=$7;
      	total_losses[$1]+=$8;
      }
      END{
      	print "manager,total_wins,total_losses"
      	n = asorti(total_wins, managers)
      	for (i=1; i<=n; i++){
      		m = managers[i]
      		print m "," total_wins[m] "," total_losses[m]
      	}
      }

(I recommend using gawk over mawk or nawk. You might need to install it over the awk that came with your OS.)

<comment><USER9> Thank you mtdewcmu, did not know about the built in sort in gawk, will make the switch.

<comment><USER5> Using gawk-only features means sacrificing portability, but gawk is so much more refined than the other awks. I don't know why it's not the default awk on a lot of OSes.

<comment><USER9> wouldn't installing gawk on all target machines take care of portability?

<comment><USER10> Portability usually means taking the machine as you find it. If you're pre- installing stuff then that is just configuring your environment.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> A correct FizzBuzz in awk (the version in the article doesn't print numbers in the general case):

        $ seq 1 100 | awk '!($1%3){printf "Fizz";p=1}!($1%5){printf "Buzz";p=1}!p{printf $1}{printf "\n";p=0}'

<comment><USER7> Argh. I should know what FizzBuzz is before I write one. I've updated the implementation in my post to be... not wrong. (It's a little different from yours, though.)

<comment><USER11> I hope it's shorter :) 60 chars:

        !($1%3){$2="Fizz"}!($1%5){$2=$2 "Buzz"}!$2{$2=$1}{print $2}

<comment><USER7> Nice. Using $2 as an auto-clearing global is a neat little hack!

</comment></comment></comment></comment><comment><USER12> crash course indeed. I just learned the basic concept of awk in just a few minutes. superb article!</comment>


Uber Competitor Cabify Closes $8M Series A To Accelerate In LatAm - <AUTHOR> http://techcrunch.com/2014/04/01/cabify-series-a/

<comment><USER2> Congrats. Even though many of these services started in "1st World" it seems like much of the growth is in taxi heavy 2nd and 3rd world countries.

</comment><comment><USER3> I would _not_ take a non-licensed taxi in Mexico.</comment>


Empower Surveillance Camera with AI/Deep Learning on Raspberry Pi - <AUTHOR> https://github.com/SharpAI/DeepCamera <comment><USER2> A few tips:

If this is your own work, you should post it as a Show HN (see [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html) and [https://news.ycombinator.com/show](https://news.ycombinator.com/show)).

Add a first comment to the thread giving the backstory of how you came to work on this, and explaining what's different about it. That tends to seed discussion in a good direction.

On HN it's a bit of an antipattern to have your username be the name of your company or project. It creates a feeling of using the site for promotion and of not really participating as yourself. Better to have a username that represents you as a human being, but of course it need not be your real name. If you want to change your username, email us at firstname.lastname@example.com and we'll help.

Good luck!

<comment> pi-deeplearning Thanks a lot for your tips, I'll follow 'Show HN' to show the project.</comment></comment>


New Map Offers a Global View of Health-Sapping Air Pollution - <AUTHOR> http://www.nasa.gov/topics/earth/features/health-sapping.html <comment><USER2> It's airborne pollution that the brains of the world should be working on. It's an immediate, proven, visible problem right in front of us. But the focus has been shifted to c02 pollution and climate change, a field with no proven deaths, an uncertain set of effects and a far-off problem horizon.

Even the development of electric cars is now done at the behest of 'zero carbon' instead of 'zero emission'. Instead of electric cars in LA to reduce smog, it's now to stop global warming.

I think this is the wrong way around. Changes should be made to decrease airborne pollution now. This is already proven to effect billions of people around the world, now, today. It already leads to premature deaths around the world, now, today. People are more likely to respond to a cause that effects their local lives than the globe as a whole, and it's a whole lot easier to bring in political solutions that affect a single area than global solutions.

It's my belief that changes in the transportation and electricity generation sectors should be concentrated on reducing air pollution. This has synergies with the reduce-co2 brigade, so there should be no problems there. But taxing and trading bits of paper should be scrapped in favour of increasingly stringent emissions control. If the CARB plan had been stuck to, how much cleaner would the world's air be today? We could be 10 years further along the path to the widespread use of zero emissions vehicles in large urban centres, with real and measurable positive health effects.

<comment><USER3> Clean air, clean water, especially at the most local level, matters a lot more to me than global and theoretical things like CO2, definitely. I think the environment is way too important to be left to people who use "environmentalism" as a religion; it needs to be given reasonable cost/benefit analysis.

Asia has come a long way in converting fleets of vehicles to LPG/CNG (taxis, buses, and other vehicles with really high miles and idle hours in downtown cores), which has improved air quality greatly.

I'd rather have affordable electricity and running water than huge declines in CO2 emissions, too, of course.

<comment><USER4> _Clean air, clean water, especially at the most local level, matters a lot more to me than global and theoretical things like CO2, definitely._

Over what time scale? The worst-case scenarios for excess CO2 are situations where the food supply is so disrupted that clean air and water would be low priorities.

That said, I certainly agree that there's a lot of low-hanging fruit, public- health–wise, in reducing particulates. Climate change amelioration shouldn't absorb all the money just because it's the bigger problem in the long term.

Stricter smoking bans would go a long way in the developed world, where smog is not Beijing-like anyway.

<comment><USER3> Strict smoking bans make a big difference for smokers, but not such a big deal for second-hand smoke. (I find it offensive if someone lights up a cigarette or cigar next to me without asking, and in some cases like at a sushi bar, I will cause this behavior to end, but casual infrequent exposure doesn't deliver that much incremental pollution to the lungs.)

I agree Asia is way more affected by this than most of the US; I'm actually looking forward to being in SF or Seattle for air/water quality and not in Asia where I am now. $100 would do more good for more people in the highest- pollution cities, but if someone is donating to charity, it is up to him if he values places he lives/people he is near/places he visits over the rest of the world.

<comment><USER4> _Strict smoking bans make a big difference for smokers, but not such a big deal for second-hand smoke._

On the contrary, the benefits for non-smokers are substantial.

For example, "Using 11 reports from 10 study locations, AMI risk decreased by 17% overall (IRR: 0.83, 95% CI: 0.75 to 0.92), with the greatest effect among younger individuals and nonsmokers." (<http://www.ncbi.nlm.nih.gov/pubmed/19778665>).

Or: "an overall 22% reduction in the AMI incidence within the first year after enactment of the new regulation. This reduction was driven by a significant decrease in the AMI incidence in men, nonsmokers, and individuals with established coronary artery disease" (<http://www.ncbi.nlm.nih.gov/pubmed/20069475>).

Or an 18% reduction in hospital admissions for childhood asthma (<http://www.ncbi.nlm.nih.gov/pubmed/20843248>).

Et, I think it's justifiable to say, cetera. Second-hand smoke is a really big problem that smoking bans address effectively. There may be a case that smoking bans are bad for personal liberty, but I think it's settled that they're good for pretty much everyone's health.

<comment><USER3> Wow. I didn't realize it was that big a risk factor. (I certainly wouldn't want a child care provider smoking around my hypothetical children; that seems like the biggest gain for the lowest loss of liberty.)</comment></comment></comment></comment></comment></comment>


Gmail push notification no longer works with Mail on new iOS devices - <AUTHOR> http://www.tuaw.com/2013/03/26/gmail-push-notification-no-longer-works-with-mail-on-new-ios-dev/ <comment> mike-cardwell I'm guessing iOS doesn't support the 16 year old and widely supported IMAP IDLE extension that provides push notifications? Because GMail does:

      mike@laptop:~$ openssl s_client -quiet -connect imap.gmail.com:993 -crlf
      depth=1 C = US, O = Google Inc, CN = Google Internet Authority
      verify error:num=20:unable to get local issuer certificate
      verify return:0
      * OK Gimap ready for requests from 126.96.36.199 iz11if3450779wic.18
      1 LOGIN ********@googlemail.com ******************
      * CAPABILITY IMAP4rev1 UNSELECT IDLE NAMESPACE QUOTA ID XLIST CHILDREN X-GM-EXT-1 UIDPLUS COMPRESS=DEFLATE ENABLE MOVE CONDSTORE ESEARCH
      1 OK ********@googlemail.com **** **** authenticated (Success)
      2 EXAMINE INBOX
      * FLAGS (\Answered \Flagged \Draft \Deleted \Seen $Forwarded $label1 $MDNSent JunkRecorded $NotJunk NonJunk $Junk Junk)
      * OK [PERMANENTFLAGS ()] Flags permitted.
      * OK [UIDVALIDITY 596417035] UIDs valid.
      * 44 EXISTS
      * 0 RECENT
      * OK [UIDNEXT 548] Predicted next UID.
      * OK [HIGHESTMODSEQ 25348]
      2 OK [READ-ONLY] INBOX selected. (Success)
      3 IDLE
      + idling

I'm pretty sure every desktop IMAP client supports it too. And K-9 Mail on my Android phone does too.

<comment><USER2> That requires a constant internet connection, which can be hard to come by on mobile devices.

Edit: Thanks folks. Looks like I was wrong about APN being pulled up over cellular messaging when there was data to transmit.

<comment> mike-cardwell Well, seeing as I can only download the emails when I have an Internet connection, I'm happy to only be notified that there are new emails waiting when I have an Internet connection too...

<comment><USER3> [1] indicates the battery loss may be significant:

 _if you are using server-side filtering to filter emails into different folders and you want 'push notifications' and instant downloads for all of those folders, then there needs to be a separate TCP connection for each of those folders being monitored. On a mobile device, this can cause excessive battery usage if more than a few folders are being monitored._

[1] [http://emailganizer.goodhumans.net/2012/10/01/activesync- pus...](http://emailganizer.goodhumans.net/2012/10/01/activesync-push-imap- idle-apple-push-notifications/)

</comment></comment></comment></comment><comment><USER4> Google could only provide push to iOS through Exchange, something they have to license from Microsoft. So, they're not doing that any more. As far as I can see, there actually aren't any license-free options available.

But you can use their Gmail app and still get push notifications.

<comment><USER5> Yes, I'm sure the license costs were killing them.

<comment><USER6> Wait wait, isn't Google an $80billion company with some of the top engineering talent on the planet?

Is this a patent issue or is it because no one else has figured out how to properly replicate that kind of functionality?

</ignorance>

<comment><USER4> Google has found out how to do it just fine on Android. But they don't control iOS. If you want a new system for e-mail pushing on iOS you need to be looking at Apple for innovation.

</comment></comment></comment></comment><comment><USER7> I would be happy to switch from Mail.app to the Gmail iPhone app if someone at Google would (pretty please) implement an actual Mail.app alternative. I'm beyond certain that I'm not the only one here that has multiple Gmail-based email accounts. And they all get emails all the time.

The Gmail app may technically support multiple email accounts, but in reality, it doesn't. Without a unified inbox view, checking email is a chore and a real headache.

I also don't think this has much to do with Exchange licensing; the fact of the matter is, IMAP IDLE has existed for the better part of 16 years, and is the perfect push solution for email. Mail.app for the iPhone and OS X, along with countless other IMAP clients, (fully?) support IDLE - Gmail just needs to step up their game.

<comment> mike-cardwell We don't need "Gmail apps". We need "IMAP clients"

</comment></comment><comment><USER8> This makes me sad. The notifications that the Gmail app provides also show up for mails that are filtered outside the inbox. For example "junk" mails or social media notifications also show up even though they never reach my inbox but are filtered into labels. Another awesome point of the native notifications is that they disappear if you read the mail somewhere else, for example on your laptop. This helps prevent cluttering of the lock screen on iOS.

<comment><USER9> At least with the new folder based filtering they recently added to GMail, you can set it so messages apparing in any folder besides the inbox won't count toward the unread message count. This gets rid of all the non-inbox notifications when I use the GMail app on my iPhone.

<comment><USER8> That's great, thanks for the pro tip!

</comment></comment></comment><comment><USER10> It should be noted that you can still get push notification support if you use Google's Gmail app on iOS.

</comment><comment><USER11> The Gmail iPhone app has very reliable push functionalities and is way more extensive than its apple general mail counterpart.

<comment><USER12> Push notifications from the GMail app and Mailbox are not the same as what you get with Mail.app. With Mail.app, mail is downloaded in the background and immediately available when you launch the app. With the others, you launch the app and then stare at the screen for 5 - 10 seconds while mail is downloaded.

iOS 7 is adding a feature that will allow downloading data in the background and hopefully Mailbox and the GMail app will take advantage of that. But in the meantime: fetch, get Google Apps for $5/mo, or deal with the annoying wait

</comment></comment><comment><USER13> This is an old news. Google announced[1] that a while back.

[1] [http://support.google.com/a/bin/answer.py?hl=en&answer=27169...](http://support.google.com/a/bin/answer.py?hl=en&answer=2716936)

</comment><comment><USER14> The logical way to implement these would be to have a single push channel in the mobile platform for all notifications. Messages send via this channel could then wake up an application on the mobile device to process the message and maybe perform some other actions. In order to save battery the incoming messages could be delayed a bit, grouped together and delivered in batch.

The push channel we already have on the platforms but I guess at least iOS and Windows Phone limit how it can be used for this kind of purposes.

</comment><comment><USER15> To me the article treads frightfully close to conflating "push email" (being notified immediately when a message hits the inbox instead of polling at regular intervals) and "push notifications" (the medium of the actual notification). Thankfully it looks like the comment section here is able to tell them apart, but calling Exchange ActiveSync "push notifications" seems like either ignorance or pageview fishing.

</comment><comment><USER16> Are there any alternative mail services that provide push notifications?

I've tried switching over to the Gmail app for a week and found it to be quite buggy. Badge counts would not be updated properly, emails would sometimes not load when you went into the detail view, etc. If it weren't for the clunkyness I wouldn't mind using it.

<comment><USER17> Mailbox.

[http://www.mailboxapp.com](http://www.mailboxapp.com)

<comment><USER18> I liked Mailbox but for some reason, I think it drains my battery, much more than the Gmail app from Google..

I know it does not make sense that it's at background, not working and using the same push notification service as Gmail app.

Is there any logical explanation? Or is it just psychological?

</comment></comment></comment><comment> wc- Does this affect Mailbox users? I've only started using mailbox but I love it so far, and it let's me combine 2 gmail accounts into one app (which I think you can't do in the iOS gmail app?).

<comment><USER19> You can connect a dozen Gmail accounts in the native iOS Mail app if you like, with combined Inbox view or separate Inbox view, whichever you prefer.

<comment> wc- From reading the other comments on here it seems like that option is broken because push doesn't work correctly with the iOS mail app? I'm just wondering if Mailbox's push works correctly, like the gmail app's push.

</comment></comment></comment><comment><USER20> Why on Earth would you want to be notified about email?

Letting other people choose when you can be interrupted sounds awful.

</comment><comment><USER21> Anyone know if this also affects syncing Calendars and Contacts?

</comment><comment><USER22> Great so now we're forced to use the Gmail app?

<comment><USER23> Or Mailbox, I've grown fond of it recently.</comment></comment>


How Google Could Rig the 2016 Election - <AUTHOR> http://www.politico.com/magazine/story/2015/08/how-google-could-rig-the-2016-election-121548.html?ml=m_t1_2h#.VdVGpXPLqvM

<comment><USER2> But why? Have they bought a candidate, too?</comment>


Things They Don't Teach You in School - <AUTHOR> https://www.netmeister.org/blog/semper-ubi-sub-ubi.html <comment><USER2> > Who here is a feminist? (Two, three hands go up, timidly.)

> Wait, let me ask another way around: who here thinks that all people, > regardless of gender, have the same rights and should be treated equally? > (All hands go up.)

> Congratulations, you are all feminists.

It's too bad that current feminism/SJW movement has so corrupted the feminism "brand" that I do not feel comfortable identifying as one and probably who more hands don't get raised. The definition given doesn't match what currently feminism is about.

<comment><USER3> > It's too bad that current feminism/SJW movement has so corrupted the > feminism "brand"

I've started to think of the SJ movement as analogous to the GNU/GPL movement. From a high level, it's easy to see it as extreme and difficult to identify with, but if you give it some time and thought, you start to see the merits of the argument.

Note, one does not always have to agree to think there are merits. Once I saw SJ advocates in this light, it also became much easier to see that much like the software license debates, there are a spectrum of beliefs; Not all GNU advocates are alike, just like not all SJWs are alike.

> The definition given doesn't match what currently feminism is about.

I have not seen evidence that this has changed. I have, however, seen opinions that I don't agree with, but ultimately stem from that working premise.

<comment><USER4> I think that all movements have to deal with the agent-provocateur problem, sooner or later - which is to say, any time you make an enemy, if you don't allow your enemy to become you properly, then you will become your enemy.

This is what happened with feminist movements: they became the very frothy- mouthed totalitarians they were resisting. Because they didn't do enough to deal with the totalitarians that were attracted to their platform of power, gained in the rising days of the feminist movement, and must now share that platform with a vast array of differing views, somehow aligned with feminism, but nevertheless diluting the goals of very subject and thwarting it in a direction not originally intended.

All movements have to deal with this factor, it seems. Its a social one.

</comment></comment></comment><comment><USER5> So I guess this was a comedy piece? Some more serious issues I've noticed:

#1. They don't teach you that teachers are paid to put up with you. Employers aren't paid to put up with you. They're paid to fire people who waste their time and interfere with the work that needs to get done.

#2. They don't teach you how to not waste people's time. Some of the group activities that force mingling are the worst. Most real work does not require communication, especially at entry level positions. Take instructions once, and just deliver what is being asked of you.

#3. They don't teach you what's being asked of you. Students show up at class, deliver homework and take exams, with the occasional project maybe. Work is all exams. It's about your constant output that is monetarily valued by your employer, which is always being examined. Homework and exams have no value. But the degree has value, right?

#4. They don't teach you the degree has little value.

The list can go much longer, but even if you're a Harvard PhD, until you get this, you're a fraud. And even if you're a high school dropout, if you get it, you're in business. Employers don't really care where you're from once you're in the building. They just need things to get done.

(The degree acquiring experience can be spectacular for you regardless of where you go actually, but degrees just aren't worth what they used to be, for sure.)

<comment><USER6> _#2. They don 't teach you how to not waste people's time. Some of the group activities that force mingling are the worst. Most real work does not require communication, especially at entry level positions. Take instructions once, and just deliver what is being asked of you._

That assumes some sort of weird universe where instructions are always perfect. I don't live in that universe. _Every_ person who does paid work of any sort should be questioning their instructions, communicating with their colleagues about the instructions, and giving their manager feedback if the instructions are incomplete or if the situation changes. That applies to everyone from people writing complex software to people paid to literally just dig holes.

The notion that communication skills are universally important across all jobs is entirely true.

<comment><USER5> Communication skills are important, but you need to know when to shut the fuck up. That's what's universally important and entirely true.

Instructions are never perfect. It's whether you can get the job done anyway, once you know what is being asked of you, which is mostly a one time initiation. Ever see someone repeatedly asking and questioning what is being asked of them? That's someone who is going to struggle for the rest of their lives in every professional environment someone accidentally put them in.

Supervisors don't want to hear about imperfections that you could have worked around yourself. You aren't being paid to call and talk and yap. You're being paid to deliver. Your approach is academic already, and goes to prove my point. Instructions only need to meet you half way. In fact, less the more for you. This is why it's completely academically backwards. The more you get done with fewer instructions, the more valuable you are because you cost less time.

Imagine a Postal Worker questioning the features on their mobile device (which clearly suck). They're being paid to work with it, not question it and talk about it.

Communication skills are important, but communication itself is an absolute bottleneck in any workflow (with emphasis on flow). Minimize communication volume, and maximize communication value. Work is no excuse to talk.

But that doesn't mean all work is anti-academic. Most of it is though. The best academic jobs will always be in academia.

<comment><USER6> _Work is no excuse to talk._

I understand that there are people who prefer to work in silence, concentrating on nothing but the task at hand, but the suggestion that everyone should be like that is idiotic. There is a wide variety of people in the workplace; we aren't all the same. The idea that office hours should be limited to work and nothing else betrays who we are: living, sociable human beings.

<comment><USER5> Right. You continue to exemplify my point.

Talkers truly underestimate the bandwidth it takes to engage someone properly, and if you're not engaging someone properly, your presence is just insulting.

If you're in an open office without walls or cubicles, and people kept talking to you, you wouldn't get anything done. Their excuse? That they're living, sociable, human beings. Well, tell that to your boss.

Think of a busy kitchen. People don't talk beyond the signals required to advance workflow. Of course, everyone can chat when they're not busy. But that's also when the business isn't making any money. Restaurants close to take you off the clock.

Think of all the jobs that require focus, like programming and writing. Think of all the jobs that are so much easier with focus, like almost every job.

Of course, if you like to talk, just get a job that requires it. Waiters get to talk while they wait for customers, and get to talk with customers. Journalists, teachers, lawyers, consultants, entertainers.

And my suggestion was to know when to shut up, not that everyone must work in silence. There is a time for communication, and for your presentation skills to shine. It just isn't "whenever I feel sociable because that's who I am, yo". But that's school! Get it?

And all this, they DO NOT TEACH IN SCHOOL.

<comment><USER7> Right, sure, knowing when to shut the fuck up is very important. But learning to be good at communication, and learning social skills is brutally important in life. Learning when to speak and when not to speak and how to speak to other people is so important: how are people supposed to learn this if you teach them to just shut up and take orders? If you learn good social skills, you do better in life, and you don't learn social skills by not interacting socially. Also, school is a point in life where there is literally no downside to constantly asking questions, all the time. You even say, teachers are paid to put up with you: well, in that case, make them work!

<comment><USER5> For the most part, they don't teach either. They don't teach good communication skills, nor do they teach you to shut up. Typically, students will talk, and get scolded when the teacher doesn't want them to talk. That's not a lesson. It's a power grab.

They don't teach how to ask questions either. They need to.

I know these things because I have had to teach them to every person that I hired. The modern system was suppose to create a smart and dependable work force by teaching students how to study, which is basically how to follow instructions and absorb anything handed to them. Except, that is only a small fraction of most work, and even the studying part they stop doing because it was never fun or important to them, or they never got good at it to begin with. Because, ironically, most schools don't teach you how to study. They just _make_ you study.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> An impressive collection of tips!

Highly relevant plug: for students / fresh grads wishing to bridge the academia-industry gap, we offer a free Incubator programme [1]. There we mentor talented students from partner universities on such practical matters.

We do specialise in machine learning, but most of the tips here apply 100%. Surprisingly -- at least to many ML students coming from academia -- even (especially?) the "be boring" bit of advice. People can get so hyped up about the latest ML fads that they miss the forest for the trees, so to speak.

[1] [http://rare-technologies.com/incubator/](http://rare- technologies.com/incubator/)

<comment><USER9> That looks pretty interesting; I might apply.

One question about the non-optional meetings: when are they? If I am in PST, will I have to skip sleep or work to attend?

<comment><USER8> Lev, our main community liaison, lives in London.

We've had students from all over the world though: from Brazil to Europe to India to Japan. So I wouldn't worry about this too much. If the will and the motivation is there, we'll find a time that makes everyone happy.

<comment><USER9> Alrighty. In that case, I will send in an app. Word2Vec looks both interesting and challenging.

</comment></comment></comment></comment><comment><USER10> >Black lives matter

So, how do we stop them from killing each other?

You're probably now going to tell me that cops are racist but copy in the USA are assholes no matter your race.

[https://www.fbi.gov/about-us/cjis/ucr/crime-in- the-u.s/2013/...](https://www.fbi.gov/about-us/cjis/ucr/crime-in- the-u.s/2013/crime-in-the-u.s.-2013/offenses-known-to-law- enforcement/expanded- homicide/expanded_homicide_data_table_6_murder_race_and_sex_of_vicitm_by_race_and_sex_of_offender_2013.xls)

<comment><USER11> Those statistics are eye opening. I wonder why they are never touched upon during the numerous debates during election season in the US.

</comment></comment><comment><USER12> Stop trying to be the smartest guy in the room and lighten up. Those are my tips.

</comment><comment><USER13> Scandinavian languages already have "programmering" for "computering" if you want to sound quaint.

</comment><comment><USER14> Leave Donald Trump alone bro.</comment>


MoviePass slashes the number of movies a user can see by 90 percent - <AUTHOR> https://www.washingtonpost.com/business/2018/08/06/moviepass-slashes-number-movies-user-can-see-by-percent/ <comment><AUTHOR> > MoviePass pays full price for each ticket a subscriber uses, meaning that > after a subscriber sees a second movie in a month, the company is operating > at a loss.

This is crazy.

<comment><USER2> I'm guessing you're too young to remember the dotcom boom.</comment></comment>


Found hooked up to my router - <AUTHOR> https://www.reddit.com/r/whatisthisthing/comments/9ixdh9/found_hooked_up_to_my_router/e6nh61r/ <comment><USER2> > I have a Raspberry Pi right now in my hands fron rentyouraccont.com, i have > it running diagnostics on an Air-Gapped pc. This thing is wild. Every second > it tries to connect to bot-net programs. It not only buys ads on facebook > (which btw i cannot find code that it actually does this) but it is creating > links to malware ridden embeds. It is part of a Botnet, i can say for sure. > Every second it tries to establish a connection to the botnet, its like a > bee thats lost its colony. Register for one and put it on an air-gap, you > wills see excatly what im talking about. It records EVERY KEYSTROKE sent of > the network, even SSL connection.

so this was a linked comment from a thread 3 years ago....

<comment><USER3> How is that even possible? How does it capture keystrokes (unless you mean Google searches where each key is sent for autocomplete). How does it break SSL?

<comment><USER4> It's probably not this attack but any WiFi device can probably be used to key log you.

[https://threatpost.com/keystroke-recognition-uses-wi-fi- sign...](https://threatpost.com/keystroke-recognition-uses-wi-fi-signals-to- snoop/120135/)

<comment><USER5> This is legitimately astonishing.

<comment><USER4> It's not great.

Some areas of IT are in guarded rooms, with walls of a certain thickness, filtered power, external RF signals killed, and airgapped except for specific patterns for transfering between external systems.

You probably just want to buy a yubikey and accept a lot of computing is built on a house of cards with respects to trust.

[https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...](https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf)

</comment></comment></comment></comment></comment><comment><USER6> One comment in that thread[1] gives a full explanation of what such a Raspberry Pi device hooked up to the router can do: forward all the network traffic, replace router's stock firmware with its own, install software on the network connected devices via known vulnerabilities, spoof websites by acting as custom DNS server. In my opinion, it looks like "a Pi-hole[2], but for phishing".

[1] [https://www.reddit.com/r/whatisthisthing/comments/9ixdh9/fou...](https://www.reddit.com/r/whatisthisthing/comments/9ixdh9/found_hooked_up_to_my_router/e6o4tun/)

[2] [https://pi-hole.net/](https://pi-hole.net/)

<comment><USER7> I still don't understand how this device could steal login details. Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Whenever I visit a website with an expired certificate, for example, Chrome gives me a big red warning banner before allowing me to continue to the site.

<comment><USER8> >Everything should be encrypted and authenticated through PKI when using any website that accepts login details.

Yes, everything SHOULD be like this. I should be able to trust my neighbors and leave my doors unlocked as well, and I should be able to have faith in my elected officials. And yet...

The other issue is that you can connect to a website that implements HTTPS correctly, and still be borked if that site doesn't implement HSTS properly - there are tools that implement HTTPS downgrading on Kali.

>I still don't understand how this device could steal login details...Whenever I visit a website with an expired certificate, for example, Chrome gives me a big red warning banner before allowing me to continue to the site.

The problem comes when your corrupted router messes with DNS and sends you to [https://evil.chase.com](https://evil.chase.com), which has a pixel perfect mock up of a chase bank login screen, and a perfectly valid cert.

<comment><USER9> I'm disappointed that's not a real website

<comment><USER10> It is a real website he just got the URL wrong. Its supposed to be [https://www.chase.com/](https://www.chase.com/)

<comment><USER11> I live for these kind of zingers!

</comment></comment></comment></comment></comment></comment><comment><USER12> Is a disk image of one of these available anywhere?

I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server.

Plugging a device into your network doesn't make it magically see all the traffic. It would have to be doing ARP spoofing, DHCP hijacking, or hacking the router config/firmware. Is it possible that it is doing some or all of those things -- sure. But why? That could all be done via a malicious client executable that would give you access to the network and much more and is much more discrete than a physical box, so why would someone go through the trouble of shipping out a box + paying the recipient? The more simple explanation is the sender of the device is doing nefarious actions on the internet and needs a bunch of IPs for cheap so when they get blocked they can just move on to the next IP.

Would I put one of these on my home network - hell no. But if one of my friends tells me they had one plugged into their network I wouldn't immediately assume that their entire digital life was compromised. I would tell them to unplug it though.

<comment><USER13> Well if they are willing to break TOS to sell ads on facebook how much further do you need to go to rationalize auth capture, rootkit injection or any other malicious activity.

"Plugging in the device on your network doesn't make it magically see all of the traffic" ... Assuming it has not been constructed to do all of the things you list (or more) does not magically make it not see all of your traffic either. There is no magic involved, it is either constructed to capture/inject or not -- the only way to know is to review the actual bits and firmware.

<comment><USER14> > Well if they are willing to break TOS to sell ads on facebook

What TOS? Facebooks? Why would they be bound by it?

</comment></comment></comment><comment><USER15> If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend to pay attention to viruses, etc.. but not physical security.

<comment><USER16> At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

<comment><USER17> So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution?

Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard, plus a whitelist of approved devices (e.g. fingerprint readers, Yubikeys). Inserting a USB mass storage device into a corporate workstation should result in nothing. Plug-and-play shouldn't be triggered. The mass storage driver should not load.

<comment><USER16> I don't think I've ever heard of a company that actually does this in practice. I suspect it ends up simply being more trouble than it's actually worth. I know at that company the list of approved device would probably end up being dozens of pages long... and yeah, thumb drives and USB hard drives were used a decent amount, especially outside of IT.

<comment><USER17> Maybe someone needs to invent a USB-based thumb drive reader that only allows generic mass storage devices to be attached but does not work as a hub, rather as a proxy device.

Bonus points: don't mount the drive directly, instead connect it to a centralised server on the corporate network that scans for threats and mounts a sanitised version of the drive's contents as a network share.

Triple word score: audit everything contained on every drive and everything that is copied on and off.

Sell that for $200 per unit to Fortune 500 companies and paranoid government agencies worldwide... and you'll retire early.

<comment><USER18> isnt that a NAS basically?

<comment><USER19> A consumer (i.e. workplace for people who don't know better) NAS is usually Linux with a few hard drives attached via a cheerful and brightly coloured web UI - occasionally useful, some way short of secure.

I expect someone sells hardened ultra-secure corporate NAS boxes, but I've never seen any in the wild.

<comment><USER20> The trouble is, the sort of people who would buy a pre-hardened NAS are also the sort of people who would be suspicious of a pre-built unit. I know for sure I wouldn't trust anything off the shelf, I'd take the base OS and build something around it.

Whoops, my tin-foil hat appears to have slipped.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> In the days when USB sticks were more common it was an easy tactic for someone to drop one in a company parking lot labeled "salary data" and with almost certainty that thing would get plugged into a device on the corporate network. The biggest security vulnerability in most cases is still users doing dumb things.

<comment><USER22> USB sticks are still pretty common.

<comment><USER23> As are USB stick attacks.

</comment></comment></comment><comment><USER24> I don't see how this 'man' in the middle could actually intercept passwords, except for http, but who runs auth over http anyway. For https, the 'man' would have to substitute its own certificate and then the browser / client software wouldn't trust the cert/domain combination without the end user being extremely stupid (and knowledgeable enough to achieve the stupidity).

<comment><USER6> What about DNS spoofing[1] at the local network level?

[1] [https://en.wikipedia.org/wiki/DNS_spoofing](https://en.wikipedia.org/wiki/DNS_spoofing)

<comment><USER24> it might redirect to a malicious web page, but https would still prevent a problem. perhaps read the article you posted.

<comment><USER6> The user can just be redirected to another similar looking site with a valid TLS certificate.

<comment><USER25> How?

<comment><USER26> [https://gmail.com.inbox-redirect.pro](https://gmail.com.inbox-redirect.pro)

This will seem like a valid website, especially if the phishing site is done well. Not just non-technical users, I'd wager some tech familiar users would be fooled too.

The focus always being on the lock icon might not always cover it.

Safari will prevent this though.

<comment><USER27> Isn't that why browsers visually distinguish the TLD and the part before it from the rest of the URL?

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> Whilst it's certainly a scam to do with advertising [0], I doesn't look like there's any evidence that the scam has anything to do with 'stealing' anything from network / network traffic:

> Facebook has several mechanisms in place to protect your account. We make > every attempt to work within the these constraints. In order to keep your > account from being locked we use a small device called a Raspberry Pi. This > device allows us to connect to Facebook advertising APIs from your home > network and avoids the hassle of your account being locked due to unfamiliar > activity. Learn more about the Raspberry Pi below.

[0] [https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour...](https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyouraccountdotcom/?st=jmilt3ow&sh=592d9a78)

<comment><USER29> >Why do you need my account? Why not use your own? We have plenty of our own accounts. We need you because no matter how many accounts we have internally, Facebook limits the amount we can spend per account. By working with people like you, we are able to scale our business.

Can somebody explain if this makes sense? Why are there limits on account spending?

<comment><USER30> Because the ad spends are fraudulent in nature? Just a guess.

</comment></comment></comment><comment><USER31> I wish he would not destroy it and send to a security researcher to identify what it really does and what information is collected.

</comment><comment><USER32> If I had to guess, it's providing VPN endpoint/relay services to scammers (CC fraud, etc) who need actual residential IPs to buy things from. Or to use to set up accounts/sockpuppet accounts for things like automated reddit vote manipulation.

It's obviously located "inside" the residential end user's router/NAT, on their wifi, so it'll have something like an openvpn or ipsec daemon on it that initiates a connection to an endpoint elsewhere on the internet, building a tunnel for the botnet operators to control it remotely. Or via tor to a tor hidden service somewhere, like many purely software trojan botnets for win32/win64, but in this case it will have the vpn or tor binaries running on its own dedicated raspberry-pi class device.

If you have a botnet of several thousand devices which can be made to look indistinguishable from legitimate "ordinary non technical user sitting at home on their comcast connection with their laptop or tablet", you can do all sorts of things. Relay http/https traffic for a click farm in Bangladesh where people are upvoting reddit comments en masse to promote a product, sockpuppet facebook account comments for political campaigns and pushing political agendas (russian internet research agency, anyone?), etc. The goal here is to make the traffic look like legit single end user residential internet traffic and _not_ traffic that's coming from netblocks of major colocation/dedicated server/VPS/VM hosting companies, whose ARIN/RIPE/APNIC space is all documented as such.

There's fraud detection systems which will trigger if you're trying to buy something like amazon gift cards from a /20 netblock of an ISP in Bulgaria, but are less "suspicious" if your traffic and useragent, etc, are all coming from a Frontier, Centurylink, Comcast etc netblock in a major American city. Stuff like the maxmind geolocation data correlating closely with the billing zipcode/shipping zip code of what you're trying to buy with a stolen credit card, or other identify theft type scams.

If you're doing some variation on a massive vote manipulation service, there's also fraud/botnet detection systems which will trigger on large volumes of upvotes (or similar manipulation) all coming from the same geographical location and netblocks. Your traffic look more like legitimate end users if it is geographically distributed across many states and provinces, many english- speaking countries (AU, NZ, CA, UK, etc), and across many ISPs and several different common end user browser useragents (edge, chrome, firefox, etc). Imagine if you threw 500 darts at a map of the USA on a wall and distributed all your botnet devices randomly around the map, vs having 300 devices all on the same network in the Chicago metro area, for instance.

<comment><USER33> There are companies out there that offer proxies from 'real' US resident IP addresses. I think these companies use tactics like this to be able to offer real residential IPs (and not IP ranges belonging to hosting companies)

This is the first one that came up on google - [https://stormproxies.com/](https://stormproxies.com/) \- I'm not saying that specific company is in any way related to this device or tactic (it is just the first on google for 'residential address ip proxy', but I think it is companies similar to this that will pay people for access to their routers and sell that access.

<comment><USER34> Luminati.io merely uses the Hola extension to power a massive residential IP network. Hardware is so 2000.

<comment><USER35> They've gone well beyond the extension now. These days you have no idea if that "free" app you've installed has made a deal with Luminati to sell your bandwidth to the highest bidder. They also have an Android SDK too. I've received several emails like the following:

> My name is Lior and I lead the SDK partnerships at Luminati. I assume your

> software earns money by charging users for a premium subscription or by > showing

> ads - both models do not pay out much and harm the user experience.

>

> We now offer you a third option.

>

> Luminati's monetization SDK for Windows desktop provides your users the > option

> to use the software for free, and in exchange we pay you $30,000 USD per > month,

> for every 1M daily active users.

> More information is available on > [http://luminati.io/sdk_win](http://luminati.io/sdk_win).

<comment><USER32> That is sketchy and unethical as fuck.

I would like to give them an A+ rating for whatever graphic artist drew their artwork and did the CSS/webpage layout, however.

<comment><USER36> I dunno, to me the icon is reminiscent of the Hades character from the Disney movie: [https://vignette.wikia.nocookie.net/disney/images/c/cf/Hercu...](https://vignette.wikia.nocookie.net/disney/images/c/cf/Hercules- disneyscreencaps.com-6022.jpg)

</comment></comment></comment></comment></comment></comment><comment><USER37> A somewhat dated reminder that "Social engineering is the best engineering." when it comes to getting around security blocks. As Natasha said to Boris, "I said system is 'Idiot proof' not 'Moose proof'!"

</comment><comment><USER38> Time for a new roommate.

<comment><USER39> For serious. the kind of idiot who would hand over facebook credentials, bank account info, and physical network access for fifteen bucks a month to a total rando is also the kind of idiot who will dig up their roommate's social security card to help them out when the nice person from the IRS calls about back taxes.

<comment><USER40> I'd quite happily pimp out my unused fake Facebook profile for $15.

Lock the 'device' into its own subnetted VLAN so it can't see any local traffic and it's easy money paid into a deposit-only savings account...

<comment><USER41> How do you know that your router doesn't have a 0day that allows them to escape the VLAN?

</comment></comment></comment></comment><comment><USER42> This just made me think of an interesting idea:

Imagine a small loop-back-like device which is plugged into all open network ports - if any of them are removed from a network port, an alert is generated stating "device from port 48 on switch 1 in closet 0 was removed"

<comment><USER32> In general it's best practice to leave unused ports on managed switches in an admin down/shut state until something you know is connected. Or live, but in a quarantine VLAN.

Your idea, however, is not totally uncommon to have a raspbery pi sized device at an offsite location, specifically _not_ plugged into any sort of UPS, which is monitored by various alerting systems. In addition to the alerts that one should get during a grid power failure event from managed UPS and automated generator transfer switch systems, the disappearance of your "UPS canary" can indicate that something is going on at an unattended site.

<comment><USER43> My college used to do similar. If you did not register your MAC address, you would be DHCP assigned into a walled-garden IP block.

We found we could run an IP scanner on the authorized subnet (from a computer with a whitelisted MAC), and find the unused IPs, and just set those statically for 'visitors'.

No need to register any more MAC addresses.

<comment><USER44> I doubt they were very concerned with you or your friends. 80/20 solutions.

<comment><USER43> Only had problems when a classmate was running routed.

Oh, and all authorized IPs were in a public address space.

</comment></comment></comment></comment></comment><comment><USER45> The board is Nano Pi NEO. It costs $15 and contains quad-core Cortex A7 along with two USB (2.0) ports and 100 Mbit Ethernet. It is about 25% of size of RaspberryPi.

By the way, the same Chinese company now offers a much more powerful board called Nano Pi M4 which is just a bomb with respect to RaspberryPi B+ if you look at its specifications.

</comment><comment><USER46> This is overblown, isn't it? That thing can't do anything that a public wifi couldn't, and yet everyone connects their laptops to those without hassle. SSL is nearly everywhere now...

<comment><USER47> Test how many SSL connections go the extra mile and secure themselves against Man in the Middle attacks. You'll be surprised.

<comment><USER48> All of them, since that's an explicit design goal of SSL/TLS?

<comment><USER49> If a user wants their free wifi enough they'll be happy to click through those pesky warnings that the root cert is not trusted. They'll probably not think anything of it if it loads as normal, even with a big angry red cross. The speed at which users rip though Windows UAC warnings is astonishing.

</comment></comment></comment></comment><comment><USER25> How is this thing intercepting all his Facebook and bank traffic?

<comment><USER50> I don't think it is.

Here's another thread which may be for the same thing or something similar. [https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour...](https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyouraccountdotcom/?st=jmilt3ow&sh=592d9a78)

It's apparently a "rent a Facebook account" scam. (The roommate apparently also provided his Facebook credentials.)

<comment><USER25> That is 10x more informative.

<comment><USER51> It's also three (!) years old, which is crazy to think someone has been mailing these out and running the same scam on FB without getting caught, particularly from 2016 on, with the scrutiny placed on FB's illegitimate political ads

<comment><USER41> Surely it would be fairly easy for FB to fingerprint the "browser" running on these device and see that it isn't a regular user? At the very least get them to jump through some hoops or enter a CAPTCHA or something?

</comment></comment></comment></comment></comment><comment><USER52> Strangely, Reddit cut off comment on the topic, before the device was clearly identified.

<comment><USER25> Yeah, I have no idea how it could accomplish what is alleged. Just lots of very bad no good end of world comments. Have none of these people ever used public wifi?

<comment><USER53> _Have none of these people ever used public wifi?_

This situation is totally totally unlike public wifi!

When I connect to public wifi, the attack surface into my laptop is the external interface of the latest MacOS, with firewall on. Perhaps there are exploits against that, but they're not common. The Mac does have pf, but I'm sure it's a way out of date version! :)

OTOH, "this thing" on the inside of a router/firewall has complete unrestricted access to the LAN. At my house I have (and I just checked) 35 active IPs behind my firewall. It's not hard to get to that number for 4 people: iPhones, TiVos, laptops, desktops, access points, printers, gaming consoles.

I confess I don't secure my LAN computers very well. I have, e.g. 3 letter passwords. That's simply to keep my kids from accidentally going where they shouldn't be.

I'm not alone in my lax security. I do occasionally peruse exit traffic and check firewall logs, which probably puts me somewhere in the most secure 1% of "typical" households.

And even if I were totally paranoid, what can I do about the Internet of shit? Am I supposed to strictly segment everything? At what point does prudence and caution drift into paranoia?

<comment><USER54> My rule of thumb is: if i have root on the device, it can go behind my private LAN firewall. If I don't have root, but the device requires Internet, it goes in the guest network which gets throttled and has no access to my LAN. I also scrutinize outbound more on this network. If I don't have root and it doesn't need Internet? It stays airgapped.

<comment><USER55> Decent rules of thumb, though even with root I'd base it more on whether the device really _needs_ general access or not. Speaking of which, a corollary I use is: if an IOT device _requires_ internet access it's automatically bad and I won't even consider it. If they want to offer some built-in but fully optional "access away from home" that wants to use their cloud that's fine, I can just block that anyway and use VPN. If it wants to access one specific address for updates (though you don't have to) or as an optional passive information feed I can see that. But anything IOT that depends on remote resources for its core functionality is right out.

That eliminates a surprising number of IOT devices, but given the flood of crap I think that's no bad thing. These days being able to have something be LAN only with zero service tie-ins seems a decent low pass filter to narrow down choices before diving any deeper.

</comment></comment></comment></comment></comment><comment><USER56> You will pay me to give you fake information and a free Raspberry Pi Nano?

<comment> King-Aaron Where do I sign up?!

</comment></comment><comment><USER57> Interesting that it is "worth" $15/month. Maybe they were never going to pay up. But if they were, that seems expensive when they could just use compromised PCs and devices for ... whatever they are going to do? Plus they had to buy and supply the dongle.

<comment><USER43> I wonder what the average time the user will disconnect it after they don't get paid?

It may be worth it to just sacrifice it after a month. I am sure it is profitable, but as people become more aware, it will be harder for them to do this.

</comment></comment><comment><USER58> It seems like they're fishing for gullible Facebook users on Craigslist. I found an example of a Craigslist posting that tries to "rent" your Facebook profile:

[https://image.ibb.co/dzT9j9/rent_facebook.png](https://image.ibb.co/dzT9j9/rent_facebook.png)

<comment><USER13> My guess would be either a MITM auth capture, rootkit inject or someone (even a nation state) trying to attribute sources of illicit facebook ads/posts to unsuspecting citizens.

I would not touch that with a 10 foot pole.

</comment></comment><comment><USER41> I'd understand why someone would be tempted to install something like this for $1500... Maybe even $150. But $15!? If you're that desperate why not get 3 friends to donate $5 each or something? I'm sure they'd understand if it was truly life-or-death.

</comment><comment><USER59> Here is the list of pinned domains [1] in Chrome:

Chrome Pinsets [https://cs.chromium.org/chromium/src/net/http/transport_secu...](https://cs.chromium.org/chromium/src/net/http/transport_security_state_static.json)

[1] [https://www.chromium.org/sts](https://www.chromium.org/sts)

[https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning](https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning)

<comment><USER60> Makes me happy seeing my domains in there.

</comment></comment><comment><USER61> Free pi!

<comment><USER62> Appears to be a nano pi neo [https://www.friendlyarm.com/index.php?route=product/product&...](https://www.friendlyarm.com/index.php?route=product/product&product_id=132)

</comment></comment><comment><USER63> Besides malicious intends and security disasters. These mini-servers could be used for all kind of cool _decentralized_ "self-hosted" services.

<comment><USER32> a completely legitimate and valuable network engineering resource is run by RIPE using small devices running openwrt:

[https://atlas.ripe.net/landing/probes-and- anchors/](https://atlas.ripe.net/landing/probes-and-anchors/)

a RIPE atlas probe is a small tp-link device that needs a LAN port on your network and USB power. It forms a vpn back to RIPE, and uses traffic outbound via the default gateway it gets via DHCP to reports metrics like uptime, latency to various destinations on the internet, what its external IP is outside your NAT, what ASN it's on, whether your ASN is having reachability issues to the "whole" internet, etc.

many medium and large sized ISPs host RIPE probes at different geographic locations in their networks.

<comment><USER64> I've had one of these running forever... I should go check and see what sorts of queries I'm allowed to run on the collected data at this point.

</comment></comment></comment><comment> King-Aaron I guess this touches on rules 1 & 3 of the Ten immutable laws of security. Maybe rule 4 to an extent as well.

[https://blogs.technet.microsoft.com/rhalbheer/2011/06/16/ten...](https://blogs.technet.microsoft.com/rhalbheer/2011/06/16/ten- immutable-laws-of-security-version-2-0/)

</comment><comment><USER65> They Might Be Giants: "What's that blue thing doing here?"

[https://www.youtube.com/watch?v=HXmBs1OppXw&t=91](https://www.youtube.com/watch?v=HXmBs1OppXw&t=91)

</comment><comment><USER64> Want to see what's in the initramfs. It almost certainly doesn't have his data on it (it looks to me like it never writes anything to the sdcard, at least not that partition)

</comment><comment><USER66> Most of whatever their router sees, their ISP sees as well.

So I understand they are upset, but the panic is not warranted.

</comment><comment><USER67> It could be doing viruses and all that but they'd be better off using it for proxying, scraping and ddos

</comment><comment><USER44> Being a privacy nightmare, I can see how this data can be quite useful for advertisers simply by sniffing DNS traffic:

* What sites do they visit?

* How long do they spend on each site?

* What apps do they use? (apps make http requests, after all)

* How long do they spend on these apps (providing it's making consistent http requests)

* What devices are they using to access these sites/apps?

Kind of like Neilson ratings but for the web.

</comment><comment><USER68> Can someone post the image here? I have blocked reddit on my phone.

<comment><USER69> [https://i.imgur.com/W30vAXk.jpg](https://i.imgur.com/W30vAXk.jpg)

</comment></comment><comment><USER70> The other roommate deliberately installed this for snooping!

</comment><comment><USER71> Two extremes as displayed on same day:

a. Gizmodo says Facebook Is Giving Advertisers Access to Your Shadow Contact Information and HNers are concerned

b. IRL, Roommate also gave them their Facebook email and password (for $15/mth)

<comment><USER72> So Facebook doesn't care about people's privacy and people themselves don't care about their own privacy. This is pretty demoralizing.

</comment></comment><comment><USER43> I am just curious of the age group here.

</comment><comment><USER73> TL;DR Roomate is dumb.

</comment><comment><USER74> My roommate received this device too.

Having observed its activity. It doesn't steal any data.

It simply setups a ssh dynamic tunnel and uses your network IP for accessing your Facebook account which you sold.

Why? Because Fb locks the account the moment it's accessed from a different network from a different device.

Can it steal your data? Absolutely yes! Does it steal? Probably no.

Afaik, all they want is your fb account for which they pay you.</comment>


LEVAN – Learning EVerything about ANything - <AUTHOR> http://levan.cs.washington.edu/

<comment><USER2> Extensive discussion from last week:

[https://news.ycombinator.com/item?id=7795621](https://news.ycombinator.com/item?id=7795621)</comment>