Fixing bufferbloat on your home network with OpenBSD 6.2 or newer - <AUTHOR> https://pauladamsmith.com/blog/2018/07/fixing-bufferbloat-on-your-home-network-with-openbsd-6.2-or-newer.html <comment><USER2> It's discouraging to me that, 33 years after I first identified this problem [1], there are no good solutions in wide use.

Informally, the basic problem is that pure datagram networks with no backpressure, which describes the Internet, handle congestion badly. A big first-in, first-out queue at a choke point works especially badly. That's "bufferbloat".

Back in 1985, I proposed "fair queuing" (a term I coined) as a step to a solution. Fair queuing is simply identifying "flows" (packets with the same endpoints, which may be IP addresses or TCP/UDP ports), giving them individual queues, and servicing the queues fairly. I also proposed making TCP congestion-aware, a new idea at the time.[2] That was enough to deal with the problems of the 1980s and 1990s. I did not forsee a future where people would be trying to run Netflix, Fortnite, and VoIP on the same cable modem connection at the same time.

The Internet works only because most of the congestion is at the edges, where the user's LAN feeds an ISP connection with less bandwidth than LAN. Most packets are lost there. If they're lost further upstream (say at the cable headend), the problems are much worse. We still can't deal with congestion in the middle of the network. Fortunately, fiber optic bulk bandwidth is cheap enough to prevent that from being the big bottleneck.

Most of the "bufferbloat" aftermarket fixes work by assuming the ISP connection has a fixed data capacity. So the user-side gear does rate- limiting, reordering, and dropping packets to handle congestion locally, to prevent the dumb FIFO queue in the ISP's edge router from building up. This can work if the ISP connection has constant outgoing bandwidth. If that varies, as on an overloaded cable segment, there's going to be trouble. And, of course, the ISP connection doesn't tell the user side nodes it's congested. So there's a lot of guessing and tweaking involved, which is why none of these fixes Just Work.

There are two levels of troublesome FIFO queue - within each host on the LAN, and at the router that connects to the ISP link. Each host has to decide what to send first. The default is FIFO, which, as noted, sucks. Then the router has to decide which packets from which local nodes to send up the ISP link first. Most ISP-provided routers are still FIFO, although some are more intelligent. A basic property of FIFO queues is that the one who sends the most wins. The nice guys who aren't blasting stuff up the pipe get squeezed out. This is why your VoIP stutters.

So there's a trend towards front-ending the ISP's router with another box to do traffic-shaping, which means reordering and dropping packets. That's what this article is about. There are commercial "gamer routers" which do this, and firmware for various routers.

Now, with the ability to shape the traffic, the question is what to do. Basic fair queuing prevents a big stream from squeezing out a small stream. That's step one, and that's what the parent article is talking about. He's stopped Speed Test from squeezing out his pings.

But that may not be enough. If one node is frantically making large numbers of short HTTP connections, the usual case for an ad-heavy and tracker heavy web page, those may all look like separate flows to the router and get a big fraction of the bandwidth. That's no good. Now you have to start defining policy rules, which is a huge pain.

Some of the "gamer routers" come with policy rules that know too much about specific games. Move and shoot packets get priority over texture updates. It's often enough to prioritize UDP packets over TCP until a UDP flow hits some relatively low bandwidth limit. If you can give a game low latency for the most important 5% of its traffic, it will often play well.

Arguably, each host on the local network should prioritize its own outgoing traffic, leaving the next router upstream to deal with prioritization between nodes. But that requires each node to know something about what the next router upstream is doing. There's no mechanism for this. All players are guessing what the other players are doing by observing round trip time and latency. They don't talk to each other about this.

And that is why this area is still a mess.

John Nagle

[1] [https://tools.ietf.org/html/rfc970](https://tools.ietf.org/html/rfc970) [2] [https://tools.ietf.org/html/rfc896](https://tools.ietf.org/html/rfc896)

<comment><USER3> Would you opine on algorithms to control queues (e.g. RED, CoDel), and to respond to congestion (e.g. CUBIC, BBR- at TCP level, correct?)? Will they get anywhere? Or is a totally new approach needed?

[https://cloudplatform.googleblog.com/2017/07/TCP-BBR- congest...](https://cloudplatform.googleblog.com/2017/07/TCP-BBR-congestion- control-comes-to-GCP-your-Internet-just-got-faster.html)

<comment><USER4> I don't think a totally new approach is needed. We already have what we need to completely solve bufferbloat. What we're missing is universal deployment.

If we could get fq_codel on every router, modem and switch, then the problem would be gone and we wouldn't need any of the fancier TCP congestion control algorithms (but ECN-capable TCPs would still be nice to have).

If we could get BBR on every server and client device, then that would mostly solve bufferbloat (for TCP traffic), but probably wouldn't be as good as having fq_codel throughout the network.

Having partial deployments of both is sub-optimal, but even the potential negative interactions between delay-based TCP congestion control and delay- eliminating AQM should still be better than not having either and suffering the full effects of bufferbloat.

<comment><USER5> How do you handle CoDel at multigigabit transfer rates on limited hardware?

<comment><USER4> The ideal solution is to put CoDel in hardware where it can be cheap. FQ-CoDel would be better, but would require many times more silicon. It's probably worth it, but it's a harder proposition to sell to the ASIC designers.

Even on current hardware, anything that's currently handling packets with a CPU instead of fixed-function hardware should be able to add CoDel without sacrificing too much throughput. Home routers running SQM-style QoS run into performance problems not because of CoDel or fq_codel but because of the traffic shaping. When everything has AQM, you no longer need a traffic shaper on your home gateway router, just AQM, and the CPU requirements for that are vastly lower.

</comment></comment></comment></comment></comment><comment><USER6> Fix it on Linux by enabling BBR TCP congestion control.

      cat << EOF >> /etc/sysctl.conf
      net.core.default_qdisc=fq
      net.ipv4.tcp_congestion_control=bbr
      EOF
      sudo sysctl -p

1\. You will need a recent kernel.

2\. net.ipv4.tcp_congestion_control=bbr applies to IPv6 too.

3\. You must set the queuing discipline to fq or it won't work.

<comment><USER7> Running 30mbps fibre and getting marginally better results (upload especially) with these settings:

        net.core.default_qdisc = fq_model
        net.ipv4.tcp_congestion_control = cubic

<comment><USER8> Guessing you meant fq_codel instead of fq_model?

<comment><USER7> Yeah, good catch.

</comment></comment></comment></comment><comment><USER9> I'm quite aware that I have bad bufferbloat problems. Unfortunately suggestions like these are kind of useless to me, and I'm surprised that they're not useless for more people. My (cable) residential internet averages about 110mbps. However, sometimes during the day it will go down to 85mbps or so, and later at night it's usually about 120mbps, and I've seen up to 135.

The way these congestion algorithms work, you've got to let the algorithm limit your bandwidth to ~95% of what's actually available. If I always got _exactly_ 110mbps, I'd be okay with that. The problem is that I've got to limit it to 80 mbps or so for it to be useful during the day. And there's no way I'm going to do that and lose 40-50 mbps of my bandwidth every night.

Widely varying connection speeds are common enough that I'm surprised many people have found these algorithms useful. I wish there was one intelligent enough to respond dynamically to however much bandwidth is available.

<comment><USER10> My cable is very asymmetric 150/5 nominal, 170/6 best case.

I just now experimented with creating _only_ the outgoing queue on my external interface. That's the slow direction. I went from a D in bufferbloat to an A, with just that one line addition.

Can you live with reducing just your upload speed? I sure can, I rarely upload much. But even if I were doing large amounts of cloud backup, it might not matter. If I go from 5000K to 4500K, is that really such a loss? Am I going to cry over 10%?

And if there is congestion such that my actual upload speed falls below 4500K, it's possible, maybe even likely, that I'm no worse off than before I created my upload queue.

Unfortunately the DSL Reports speedtest only tests one direction at a time. So maybe my fix doesn't work well if there is significant bidirectional simultaneous traffic?

Fortunately I'm running OpenBSD on my firewall, so it was very easy to experiment with this.

<comment><USER9> I'm running OPNsense here, so it's also fairly easy to manage. If I interpreted the DSL Reports test correctly, it looks like I see bufferbloat (median ~1.5 seconds) when downloading, but not a significant amount when uploading. So I don't think shaping only the outgoing traffic would help me. But maybe I'm misunderstanding.

</comment></comment></comment><comment><USER11> Great article. OpenBSD makes it so simple to do this.

Anyone using Ubiquiti Edge X routers can apply this too (Linux under the hood) in almost the exact same fashion. Works great even on slow DSL links.

<comment><USER12> what exactly would you do in EdgerouterX ? Do you mind sharing the commands or point to some link?

<comment><USER13> Just enable smart queue QoS in the web interface. The ER-X should be able to handle links up to about 150-180Mbit with Smart Queue QoS enabled.

</comment></comment></comment><comment><USER14> Didn't know about this issue until I saw this article.

With 2 lines added to conf, I managed to go from C, D grades to A almost instantly.

<comment><USER15> Same, why haven't the defaults changed after all these years?

<comment><USER16> Because you need to specify the bandwidth, which the router maker cannot know?

<comment><USER5> Not really, fq_codel + bbr can work based on RTT changes alone.

</comment></comment></comment></comment><comment><USER17> I have 1000/1000 fiber and I can't make a video call over Slack. People claim my video is freezing and they're only getting every other word. I wonder if bufferbloat could be an explanation.

<comment><USER18> Unlikely unless another host on your LAN is saturating all 1000Mbit. My first guess would be poor wifi then funky shaping on the ISP side. Try it wired and if that doesn't help try it over a VPN.

</comment></comment><comment><USER19> The first question which came to my mind was if OpenBSD already supports fast enough WiFi devices to work as a proper access point – looks like last time I tried was quite a while ago: [https://undeadly.org/cgi?action=article&sid=20101216231634](https://undeadly.org/cgi?action=article&sid=20101216231634)

It supports Realtek USB adapters and I remember how easy it was to enable traffic shaping with pf and always have lag free ssh-consoles!

</comment><comment><USER20> Many more ISP are giving Router / Modem / ONT as default. One of the reason Apple exited the Router Market. The problem is their WiFi Sucks, they do not have any incentive to provide you better WiFi, or some sort of QoS.

So for many consumers, it doesn't seems buffer bloat will be fixed anytime soon.

One thing we could do is to educate the customer and hope Speedtest, Fast.com from Netflix includes buffer bloat as listing like the one in DSLReprot.

</comment><comment><USER21> I got a B in bufferbloat and 512 mbit down and 517 mbit up on my 500/500 fiber link. It seems that I could do better when downloading though, the bufferbloat on that graph is 50 ms.

I'm going to experiment a bit with my openbsd firewall.</comment>


How would you confirm if what you're doing is actually your Passion? - <AUTHOR>

After being an ordinary developer for 6 years, at age 30, I started Masters By Research. For those 6 years, I always wanted to check if research is really what I love to do.
I'm really struggling in the University courses. But I try hard these days and things are slowly making sense. I may not be getting better marks yet but my inner voice says "I want to try again and again and again". Almost all of the time I think of the problems in class, about ways to get better at it. Instead of being lazy and sleeping in free time when I was developer, these days I wake up suddenly at night and start looking at the algorithms.
However, research has consequences. I don't think I will be a very good researcher and would be able to secure grants in future as others do because I do not have good academic record. But I have to make money because I started my life from scratch and have gone through a lot of financial hardship to get here.
Now, I'm not sure if research is really my passion and if I should go ahead or should I fall back to developer to live financially better life.
Has anyone gone through this situation? <comment><USER2> You could find out what motivates you. Look at the SIMA method, or find something similar. And realize this method may not work 100%, but it should give you good directions.

[http://www.amazon.com/Power-Uniqueness-The-Arthur- Miller/dp/...](http://www.amazon.com/Power-Uniqueness-The-Arthur- Miller/dp/0310242886)

Based on the idea that every person is endowed from birth with a unique pattern of competencies and motivations, or giftedness, this book describes your Motivated Abilities Pattern (MAP), which indicates your personal giftedness and encourages you to pursue your unique calling and live a purposeful life that is highly productive and richly satisfying. Formerly titled Why You Can't Be Anything You Want to Be.

<comment><USER3> That sounds like BS, but I haven't read the book.

Was Knuth 'endowed from birth' with the motivation to work in computer science? If so, what happened to all of the similarly endowed people from the 1100?

In '20000 Leagues Under the Seas', Ned Land was 'King of the Harpooners', with no equal to his trade. Stubb, from 'Moby Dick' was a gifted whaler. They are of course fictional, but here's a real-life reference, [http://www.jstor.org/discover/10.2307/40316513?uid=3738984&u...](http://www.jstor.org/discover/10.2307/40316513?uid=3738984&uid=2129&uid=2&uid=70&uid=4&sid=21106825288173) , quoted through Google as:

> Tessuin, a uniquely gifted whaler who was actively sought by competing > companies that wanted him to work for them ..

The actual book uses the lines "expert harpooner" and "renowned harpooner" to describe Tessuin.

What are all those people born in land-locked Oklahoma in the last 50 years, who are endowed from birth with competencies in whale harpooning, supposed to do?

Based on the reviews, it appears that Miller believes that some sort of supernatural force is at work to prevent this from happening. If one is willing to believe in supernatural forces that intervene in the natural world, than can't that be used to justify any action in this best of all possible worlds?

</comment></comment><comment><USER3> Passion is overrated. I've done passion. Passion doesn't care about you. Sometimes the 'fire in the belly' is heartburn.

You do realize there are commercial developer positions where algorithms development is important, yes? You don't need to return to the same job you left.

And even inside of academic research programs, there are research programmers. This is part of the support staff, and not in charge of securing grants; though they may help with writing the grants.

Is there a graduate student adviser you can talk with about post-graduation career plans?

</comment><comment><USER4> I've accidentally stumbled on this line of thought. Ask yourself a hypothetical. If you had to sacrifice your life and well-being for it would you still do it? If the price was unreasonable and ridiculas would you still want it?

<comment><AUTHOR> I can feel that it makes me happy but makes my wife sad because I'm thinking only about academic stuffs and not giving her time. I wouldn't want research career at the cost of relationship.</comment></comment>


Prosecutors Are Shaping Privacy Law - <AUTHOR> https://www.nytimes.com/2019/06/13/opinion/privacy-law-enforcment-congress.html <comment><USER3> I'm surprised, but glad, that a federal magistrate judge would take the time to write out an article like this. It feels odd to me that a judge - <USER2> who is supposed to be neutral - would openly take a stance that prosecutors are overstepping their boundaries within matters of policy. (Of course, one of the functions of a judge is to say when a prosecutor has crossed the line as a matter of law.)

I saw a video ([https://www.youtube.com/watch?v=eXAkXyysfFU](https://www.youtube.com/watch?v=eXAkXyysfFU)) discussing one of this judge's recent opinions regarding a series of copyright infringement lawsuits. Orenstein dismissed 13 suits from one single copyright holder against numerous "John Doe" defendants, in which the rights holder conflated people who subscribed to internet service as being the same people who actually committed copyright infringement. Since the plaintiff had no evidence to show that the subscriber and infringer were the same person, Orenstein dismissed the suit without the defendant even knowing he or she was being sued - but Orenstein's basic knowledge, allowing him to make such a ruling unprompted, is the exception, not the rule.

We can't depend on having judges like Orenstein or William Alsup or even the Supreme Court to enact good privacy policy. Policymaking is the job of Congress, and while I am happy to see recent Congressional oversight hearings regarding facial recognition, TSA, and the like, I wish that Congress would take bolder stances against police and prosecutorial overreach.

<comment><USER4> It's been obvious for years that prosecutors are pushing surveillance laws to the breaking limit and often go beyond that in ways that defense attorneys and judges don't even realize.

Like it took judges 10-15 years to figure out what the prosecutors/FBI/police were doing with Stingrays. Once they started to understand how that stuff works they started requiring warrants for its use.

But there are dozens of other tools and loopholes like it that prosecutors are exploiting because judges don't have a clue about new tech advances.

For instance, most defense attorneys and judges probably don't even realize that a lot of prosecutors use tainted data through illegal surveillance and parallel construction. Since this sort of action is hardly ever punished there's little wonder that they keep doing stuff like this.

<comment><USER5> Some may not appreciate the depth of the issue, others may simply recognize that there's little that can be done. Common law courts already have relatively strong _procedural_ protections. In some countries like the U.S. these procedural protections are at least in principal inviolable by the legislature, even when they're not explicit in the written constitution.

But courts neither have the duty nor the capacity (legally or otherwise) to police everything that occurs outside their court. If the evidence presented is proper on its face, what else can they do? Judges have an independent duty to pursue the truth of the substantive legal matter, but that's distinct from actively ferreting out ancillary illegality and falsehoods.

We also have an adversarial system, so there are alternatives to direct judicial oversight of the executive branch: the legislature _and_ the defendant. Indeed, much of the evidence for illegal surveillance has come from defendants, sometimes relying on the court's subpoena powers to discover, which is a form of procedural protection. So not only are there strong procedural protections, there's someone in the court room with the duty, the motivation, and at least in principle the power to see that they're enforced.

IMO, it's right and proper for courts to be sources of legal change, just don't expect it to be swift or comprehensive. The upshot is that when it _does_ happen, it's often far more considered and secure. And this is precisely because it's slow, incremental, supported by well-vetted evidence, and spurred by manifest, not conjectured, injustice and suffering.

The fact that courts only react to injustice, rather than prevent it, is something of a feature, not a bug.

The fact that it's the poor that suffer injustice the most isn't something that courts can fix. Look at the right for counsel to be afforded the indigent[1]: how successful was that remedy? Not particularly so as in many places it's not only useless but used to excuse bad outcomes--"well, he _did_ have an attorney". In jurisdictions where it works well it would have, if it hadn't already, been provided. Wealth inequality is particularly far outside the court's wheelhouse.

[1] The traditional right to counsel is merely a right to hire legal representation. The right to publicly funded counsel for the indigent is a prospective remedy required by SCOTUS in 1963. Prospective remedies have poor track records. The good protections, the ones that make up traditional procedural protections, exhibit survival bias and have slowly accreted over nearly a millennia. This is why the Common Law is considered to have the strongest procedural protections--the length of time it's had to refine that aspect of the legal system. Most other Western systems were re-invented de novo in the late 18th and 19th centuries by, basically, philosophers and revolutionaries. Theory only gets you so far, and often takes you _way_ off course.

<comment><USER6> > Judges have an independent duty to pursue the truth of the substantive legal > matter

Do they? That sounds pretty inquisitorial, rather than adversarial, to me.

<comment><USER5> Yes, they do: [http://25thandclement.com/~william/Evidence/614.pdf](http://25thandclement.com/~william/Evidence/614.pdf)

My Evidence professor was a Virginia judge and after I submitted the above assignment[1] he actually pulled me aside before class and asked if it was original; that is, he asked me to vouch that I hadn't copied it or cheated. He seemed particularly impressed with my historical research, presumably my citations at footnotes 1 and 2. The concept wasn't new to him or even controversial--it's well established, at least as a background principle in legal procedure--but the history is esoteric.

I told him that he really screwed me. Yes, it was my own research.[2] But by implying that I did such a great job he took away my motivation to keep doing that kind of research and putting in the study time. I have ADHD--though only diagnosed years later--and there are an infinite number of things I could immerse myself in. I think I ended up getting a low B or C in that class. :( Imposter syndrome is a powerful motivator and he temporarily cured me of it.

[1] Every student was assigned to write a note for one or two of the Federal Rules of Civil Procedure, and they'd be published online as study aids for everyone else in the class.

[2] I was up for like 16 hours powering through Westlaw and Google Books. Google Books had at the time, but for some reason no longer, an incredibly rich archive of old legal treatises and other material, like 17th and 18th century reporters from England and Ireland.[3] I'm pretty sure I kept a copy of the Wigmore treatise pdf as I later bought the domain name lextex.org with the idea to typeset it using TeX. In fact, I _still_ want to do that and have kept renewing the domain name. I thought I had uploaded it somewhere under public_html/ but I can't find it now....

[3] On one or two occasions I found original reporters that _contradicted_ the case reports used in legal treatises and historic judgments, including our textbooks. In several more I found potentially substantive discrepancies. In the age where judges orally recited their judgments and commercial reporters transcribed and published them, errors were to be expected. It's interesting, though, that sometimes reporters published outright contradictory legal reasoning and judgments. Legal scholars don't seem to even consider this as a possibility. It's kinda irrelevant for judges and lawyers, though, because all that matters is what the most recent authoritative court says, regardless of any inaccuracies in the cited material.

<comment><USER6> Thank you for the citation. I was not familiar with the Burke quote, or any other support for the view that common law judges have an "independent _duty_ to pursue the truth." I still think this proposition goes too far, as you seem to recognise in footnote 13 of your paper, but I accept that in exceptional cases common law judges can call witnesses.

McCormick § 8 (cited in the notes [1] to the FRE) observes that "it is sometimes said that the judge may have a duty to _question_ witnesses, although the exercise of such a duty does not appear to have been enforced by any appellate court decisions." I am not sure there is any support for a duty to _call_ witnesses, except as a device to permit cross-examination by both parties. Even in 1904, Wigmore [2] noted the "strong but subtle tendency to force" judicial questioning "into the background" and referred to Burke's 1794 speech as a "defensive utterance."

In the UK and Canada, the courts have explicitly rejected the view of a trial as "a scientific exploration with the presiding Judge assuming the role of a research director," urging a cautious approach to the calling and questioning of witnesses which Wigmore regarded as unduly restrictive [3]. I still think that the absence of a judicial duty to pursue the truth is a key feature of the adversary system, but the justice system as a whole does have a truth- seeking purpose, and exceptional cases may call for exceptional judicial powers.

[1] [https://www.law.cornell.edu/rules/fre/rule_614](https://www.law.cornell.edu/rules/fre/rule_614)

[2] [https://archive.org/details/cihm_73411/page/n963](https://archive.org/details/cihm_73411/page/n963)

[3] [https://www.albertalawreview.com/index.php/ALR/article/downl...](https://www.albertalawreview.com/index.php/ALR/article/download/2406/2395)

</comment></comment></comment></comment></comment></comment><comment><USER7> >And ultimately, that's the problem: A Congress that has failed to keep pace with the times, not prosecutors aggressively using new technological tools.

The title is a bit confusing as the article really hits the problem area, congress.

At least in my curious amateur tech legal guy reading the news role I do feel like we're seeing judges recognizing that "If we allow X, Y constitutional right really doesn't matter anymore....".

Things like the third party doctrine in the US is not aging well and has been passed by with technology raising questions about if there is any expectation of privacy, anywhere.

You can be entirely off the gird and be a mountain man, but the moment someone decides to note something about you on you're phone, it's out there.

</comment><comment><USER8> Orenstein was also the judge that ruled against the DoJ/FBI during the iPhone backdoor case.

[https://www.nytimes.com/2016/03/01/technology/apple-wins- rul...](https://www.nytimes.com/2016/03/01/technology/apple-wins-ruling-in- new-york-iphone-hacking-order.html)

</comment><comment><USER9> It's all going to come down to what is considered a "reasonable" search which isn't clearly defined in the Constitution. What's unreasonable before a massive terrorist attack is unquestionably reasonable after. Benjamin Franklin has various attributed quotes about the inverse relationship between safety and freedom; it will be interesting to see what the courts decide as reasonable and what sense of permanence will be present in their opinions.

<comment><USER10> It's worth pointing out that, as with many writings from the eighteenth century, the meanings of words has shifted over time and the original meaning of the phrase is different what it would appear to modern eyes.

The current definition of "reasonable" has a strong connotation of "proportionate," which was not part of the intended meaning. "Reasonable" means something more like "rational." It kind of carries this reference to Enlightenment ideals where Reason is one of the Virtues that demonstrates the nobility of man. And the law is supposed to also be a demonstration of this same Virtue of Reason. I know that's a lot of highfalutin' words, but the point is this: A search being "reasonable" is based on whether it can be justified from abstract principles of law, not whether it can be justified from the circumstances.

So, for example: A few weeks ago, it was ruled that parking cops marking your tires with chalk violates the Constitution. That is an "unreasonable search." People had a hard time understanding this, because it's just a chalk mark, right? Well, that's not the point. "Unreasonable" does not mean that the chalk mark is a big deal. "Unreasonable" means that there was a physical trespass without individualized suspicion of wrongdoing. The thing that made the physical violation of private property "unreasonable" was not the proportionality of the trespass, but the fact that there was not an abstract legal principle that provides a justification for it.

There are emerging issues around the reasonableness of searches, but I think the bigger issue related to that is that "always-on" surveillance allows prosecutors to cherry-pick observations and construct "reasonable suspicion" out of completely innocuous behaviors. This is especially true when we start getting into profiling ("this person does things that criminals also do"). While it might be statistically valid, my personal opinion is that it starts getting outside the idea of "reasonable" suspicion, especially when there isn't a basis to suspect a specific crime.

Edit: Source for this is mostly a paper titled "The Original Fourth Amendment" by Laura K. Donohue, _The University of Chicago Law Review_ Vol 83 No 3, pages 1181-1328.

<comment><USER6> Thanks for providing a citation! When you say that profiling isn't "reasonable," are you still using the word in the sense of "rational"? That seems inconsistent with your concession that (potentially racist or otherwise unjust) profiling can still be "statistically valid."

<comment><USER10> I'm still using it to mean "consistent with a principle of law." The idea of "rational" is closer than "proportional," but it still loses a lot of nuance.

The issue with profiling is that the justification is "this person resembles a criminal," rather than "I have reason to believe a crime has been committed." Even if your methods have good precision and recall, this approach is not consistent with an existing principle of law.

</comment></comment></comment></comment><comment><USER11> "If Congress won't write laws for this century's technology, courts must craft rules that ensure a fair and orderly review of new investigative methods. For example, the Foreign Intelligence Surveillance Court (which also confronts the tension between effective investigations and privacy) has a system for bringing in independent lawyers called "amici curiae" to argue novel or significant legal issues that occasionally arise when the government asks for technology-based surveillance orders. Those amici can argue in favor of the target's presumed privacy interests but don't represent him and can't give him information about the investigation. Magistrate judges occasionally do the same on an ad hoc basis, but in those cases the amici don't have the same access to information as is allowed in the FISA court, and, like the FISA amici, they can't appeal a lower-court ruling. Giving these independent lawyers the information they need to argue about the legality of novel law enforcement requests, as well as the right to appeal, would at least provide for a more balanced assessment of new surveillance technologies and a quicker way for questions about them to be decided on a national basis."

Not making an analogy, totally different situation, but this reminded me of OUII staff attorneys in ITC patent cases. ITC decisions can have a broad effect on the public, on consumers, and the government can try to address this by naming a third party to the proceedings who is supposed to represent the public interest.

"ITC's Office of Unfair Import investigation (OUII) may take part in an investigation. The OUII acts as a neutral party _representing the public interest_ in the investigations. The OUII participates in the investigations through its staff attorneys, who file briefs, participate in discovery, offer opening statements, and examine witnesses, much like the private parties. The presence of the OUII in ITC investigations creates a unique dynamic when compared to federal district court litigation."

[https://www.venable.com/services/practices/section-337-inves...](https://www.venable.com/services/practices/section-337-investigations- at-the-international-tr)

I guess the reason I thought of this is because according to this judge, privacy law is being made and AFAICT _the public interest_ is not being represented in the process.

</comment><comment><USER12> If needed: [http://archive.is/eiekb](http://archive.is/eiekb)

</comment><comment><USER13> Oh my... Normally, I'd have an uninformed opinion on this; full of opinion and hyperbole.

However, _since this happened to me_ , my opinions are vastly different. There were paragraphs written below that I deleted, mainly because they would likely land me in prison, or at least (further) complicate my life.

The TLDR is: surveillance and search warrants are granted without true probable cause or appropriate knowledge. By "appropriate knowledge", I mean the judge is in no position to comprehend what he or she is authorizing, or the repercussions of granting it.

</comment><comment><USER14> The headline is kind of obvious, really.</comment>


Ban The Debugger - <AUTHOR> http://iancartwright.com/blog/2009/11/ban-debugger.html <comment><USER2> "Ban the Debugger" was an unfortunate name for this post, because obviously debuggers are useful. Having worked in support, I always opened up a bug when log/console output was insufficient to pin down the problem a customer was having. The notion of (temporarily) banning the debugger seems great. I've seen some logging standards that you could follow, but the output still wouldn't be enough to nail down the cause of an error. If the failure of one test in (A && B && C) results in a single error, how were you supposed to know which of A/B/C caused the problem?

So, yes please, have some failure cases setup ahead of time, and send the logs to the developers and see if they can figure out which failure mode it was without getting any live access to the program. But don't call it "banning their debugger." :-)

</comment><comment><USER3> If you can manage to ban the debugger, then you should rethink your entire debugging support strategy.

A debugger infrastructure can be a core and critical component within a non- trivial application. This whether the integrated debugging is used for classic application debugging, for call tracing and basic performance monitoring, for creating and then processing application dumps on severe errors, for associated tasks including crash notifications and restarts and failure- related statistics collection, or otherwise.

You build debugging in. From the onset.

One OS environment that I work with can launch the system's debugger entirely under program control, which means the application can detect an "unexpected" failure and can (barring cases of severe corruptions) invoke application- specific debugger command sequences which can access and display the core application context, and a debugger-readable dump then be generated, and (if appropriate) the application then restarted.

Logs never have enough data, and users (and programmers) don't always find and read logs. Better still, you don't have to switch techniques when you ship code; you're always using your primary tools. Bake debugging right into all non-trivial applications.

</comment><comment><USER4> There are some types of bugs that are hard to track down without a debugger. If you log a "Object reference not set to an instance of an object" message on a typical ASP.Net page it tells you nothing basically and you're stuck trying to figure out why it could have happened with little more information than what page it happened on. The debugger is your friend in that case.

It seems like there are other ways to achieve the same end that the author is seeking.

<comment><USER5> You've just stated the Contrapositive of his argument.

ASP has only gotten away with it's bizzaro architecture and shitty implementation _because_ it got such a full-fledged debugger for free.

<comment><USER6> Most of the typically criticized, "fucked up" aspects of ASP.Net (like the page life-cycle event model) has been cleaned up in ASP.Net MVC.

I still want my debugger though.

</comment></comment></comment><comment><USER7> I agree with cabacon that the title is poorly-chosen. I was expecting to read one of those inane "I have transcended the debugger" posts, but instead found something insightful.

How my team tries to fix the problem of log files being insufficient is to have debug builds log to the console as well as to the log file. If we have useful log statements in place, debugging a simple problem becomes trivially easy as we can see the problem unfolding in front of our eyes. This also helps solve the problem of logging too _much_ data, because the more we log the more console spew we have to deal with.

I do like the idea of banning the debugger right before a launch, though.

</comment><comment><USER8> I have never really understood the fascination with debuggers. A good log file will allow you to triage any error, even if it's not the one you were looking for. It seems to me that debuggers are mostly for spotting failed assumptions and won't find unreproducable or subtle systemic problems.

I consider the desire to use a debugger a bug in my logging and take corrective action.

Also, you can't grep an execution history in a debugger. I really have no idea how you would spot systemic errors without doing so.

Can anyone who lives by debuggers make a case to convince me to fire up the debugger more often?

<comment><USER9> I don't use debuggers often, but am glad they are available when I actually do.

If a running program is like a lab rat running through a maze in the dark, then using print statements is like placing bells on tripwires in select places in the maze. Using a debugger is like turning on the lights, and watching the rat.

<comment><USER8> I think this metaphor is somewhat wrong.

Log files are like attaching medical imagers to the maze and keeping a trace of it's physical and mental state as it executes the maze. Debuggers are like attaching medical imagers to the rat and being able to only see the immediate state only.

Obviously, debuggers are much faster to bootstrap than good logging, and in that category I can see them being a clear win. However, I still see them as providing less information.

PS: That said, there are a few situations I bust out a debugger too. Mostly when I'm too lost to get started.

</comment></comment></comment><comment><USER10> I think a lot of tools can really cripple programmers. One needs discipline to only use such tools as a convenience, once you already know what's going on under the surface - hence why I generally avoid IDE's, etc...

<comment><USER11> So you generally avoid using IDEs because you don't yet know what's going on under the surface? ;)

I've been on both sides of that particular fence. On the one hand, learning to use a fancy development tool effectively takes time and effort, and that's time and effort that often can't be used to understand what's going on under the covers. And then you're stuck learning about the inner workings anyway when something fails to build with some kind of vague error message.

But in the long run the automation provided by high-level development tools makes for more productive programming, and the time spent learning to use them is usually paid back handsomely.

My advice would be to do a few projects using little more than command-line tools (and no project templates), but then don't get stuck in a rut and _do_ take the time to learn how to automate things and generally make your life easier with higher-level tools.

With debuggers in particular there are classes of bugs where logging (or worse, Response.Write/echo/puts debugging) is pretty ineffective: if an integer is being interpreted as a string where you expected a number, printing out the value in a log file doesn't give you much insight into what's going wrong.

</comment></comment><comment><USER12> The only problem I see in the post's story is that the tech lead didn't create a logging standard and reviewed the code to make sure the team followed it. I don't see why we should blame debuggers.

<comment><USER13> He's not _blaming_ the debuggers. He's advocating a step in the build process somewhat akin to dogfooding: encourage he developers to use the tools they've written for support to help find those last few bugs.

<comment><USER12> You're right. As others said, the title doesn't match the text. Still, I don't think this ad hoc solution is the right one. If your logs are important to run your operations (and if you are processing transactions online, they are,) they should be included in your test plan. Thankfully, the most useful points to log are easy to instrument nowadays with listeners/interceptors/decorators, and sometimes it is just a configuration setting. I just wish it were easier to automate test assertions based on absence/presence of messages in the log.

</comment></comment></comment><comment><USER14> The point of this article seems to be that prior to release debuggers shouldn't be used in order force developers to output to logs that can be used in production.

I would say that developers should be logging anyway, and reading the logs in addition to using their debuggers.

</comment><comment><USER15> Ok... When I think logging I usually think "useful logging". Log what server- side calls were executed from a webapp, log what logical points were hit, what was the logical results. "In function foo" and "x = foo" is tracing stuff. Useless and is actually counter-productive noise. We want that turned on granularity only when we really care for this, maybe even remove those and use a debugger. Writing good logging is an art form, much like writing useful comments or clean code.

</comment><comment><USER16> Someone said it more succinctly in 1979

"The most effective debugging tool is still careful thought, coupled with judiciously placed print statements." -- Brian Kernighan

and followed it up with

"Everyone knows that debugging is twice as hard as writing a program in the first place. So if you're as clever as you can be when you write it, how will you ever debug it?"

</comment><comment><USER17> If your program cannot say you where is the problem, it is better to _invest_ your time into better code: add more self-diagnostic, constraints, asserts, and automated test cases.

If you waste your time on debugger, then you will have just bug fixed and nothing else.

If you invest your time into code, you will have bug fixed AND much better code.

Computers can catch bugs much faster than humans. Programming is invented for that. Think like you already have programmable debugger inside your program. Invest your time into useful tools, which you can use to trace and check your program.

</comment><comment><USER18> debuggers help joe blow ASP.NET coder implement his spec faster. it doesn't really matter if he understands what's going on under the surface, nor does it even matter if his code sucks, because he's just a monkey. processes have been implemented so his crap code isn't a project risk.

edit: I work at a place like this.

<comment><USER19> I think there's a little more to it than that when you are talking about frameworks like ASP.NET. It's simply not plausible or necessarily even possible to log every piece of information you might possibly need to debug a given problem. That said, I am all for people putting more thought into logging and tools that help troubleshoot in production.</comment></comment>


Rclone Support at Rsync.net - <AUTHOR> https://github.com/ncw/rclone/issues/3254 <comment><AUTHOR> rclone runs over plain old SFTP so in terms of transport, it's a no-brainer ...

The issue was that rclone requires a server-side binary to run and the rsync.net platform has an extremely simple, stripped down, jailed environment that we are extremely reluctant to add pieces to.

It was definitely worth the time to explore every command line option (there are a _lot of them_ ) and whitelist the ones we're comfortable with and put the binary in place - rclone is a swiss army knife for cloud storage and I am excited to start writing recipes for doing very interesting things with your rsync.net account.

<comment><USER2> Can you elaborate on how rclone interacts with the server? My understanding of "[it] runs over plain SFTP" and "[it] requires a server-side binary" would make them opposites, but since you just implemented it, I assume I'm missing something :D

Unless you're referring to the SFTP binary itself being required?

<comment><USER3> SFTP is the protocol, although in this case it appears to be done over ssh.

The binary itself is rclone. And rclone appears to be a pretty hairy beast, so it has taken a while to vet the arguments they want to allow and prohibit the rest that they don't.</comment></comment></comment>


Build-a-Baby gets patented by 23andMe. Cue outrage. - <AUTHOR> http://pandodaily.com/2013/10/02/build-a-baby-gets-patented-by-23andme-cue-outrage/

<comment><USER2> I think this is more gimmick than anything else, like most of the services personal genomics companies provide.

SNPs don't tell you much about a person's perceived "beauty" and probably tell you only little about disease risks, and there are myriads of problems in the current literature of SNP-associations. Many associations (which go into this baby predictor thing) turn out to be unreproducible once you check a more diverse, or a bigger set of humans for associations. If you search Google Scholar for "failure to replicate GWAS" you'll get 1940 results for 2013 alone.

The only predictions that work are the phenotypes you get from your population history: eye color, hair color, skin color etc. But to predict that you don't need SNPs, you only need eyes. That's also cheaper.

Edit: I'm not saying that GWAS are crap all in all - they're useful in science in identifying candidate regions which may harbor genes related to favorable traits like resistance to a certain disease etc. They're just not very useful overall for private customers.

</comment><comment><USER3> Reading this comments constitutes an NDA signature:

Wrap a dating service around this and we can finally bring back the eugenics movement.

OkSuperiorRace.com? PlentyofPerfects.com? eSuperhumanarmony.com?

With your special financial contribution, we can make this dream come true!</comment>


Show HN: Distill – Free HD videos for your website. 10 new videos every 10 days - <AUTHOR> http://www.wedistill.io/

<comment><USER2> Is this basically Unsplash for videos? That would be really cool.

       -When you say "Curated HD Video Free For Your Personal and Commercial Use" does that include the ability to cut the video apart?
       -When you get these videos from people, do you have some sort of agreement that they agree to distribute the videos under these terms?
       -It would be better if I could click to start/stop because I dont want my mouse in the way and I want to do other stuff while watching the videos.
       -Lastly, is it just me or is there no sound?

Sorry if I seem critical, it just looks really cool and I want it to work! Good job so far :)

<comment><AUTHOR> Hey, yea thanks for the comments. Essentially, it is like Unsplash but for video.

To answer your questions. The videos are submitted under the Creative Commons Zero license so you do have the ability to edit them.

Thanks for the critiques, this is our beta so we are trying to get as much feedback as possible to make Distill better!

About the video, some of the videos don't have audio and others have been muted. The problem was that contributors had edited videos with copyrighted audio, so we had a problem there. The videos that could have audio do have them.

Feel free to comment on your thoughts! Cheers.

</comment></comment><comment><USER3> Another Distill? There's an app by that name at [https://www.distill.io/](https://www.distill.io/) already.</comment>