Critical Windows Vulnerability in TCP/IP Stack Could Allow Remote Code Execution - <AUTHOR> https://technet.microsoft.com/en-us/security/bulletin/ms11-083

<comment><USER2> it looks like someone forgot to decrement a reference count where they should have.

in microsofts defense, these kinds of bugs are extremely difficult to reason about and I'm not aware of any product, service or technique that you can buy, train in, or subscribe to to enable your developers to accurately reason about reference counting and concurrency. microsoft spends more $ per loc on security than any other organization on Earth so if this slipped through their process, similar bugs probably slip through your processes too.

there are countermeasures in place especially in windows 7 and forward that would make exploitation of this extremely difficult (aslr, safe unlinking in the kernel heap, etc).

<comment><USER3> > microsoft spends more $ per loc on security than any other organization on > Earth so if this slipped through their process, similar bugs probably slip > through your processes too

I agree in principle, but this is hardly the most accurate way to measure this

<comment><USER2> it isn't no, but ask yourself, "what more can I do?" fund academic research? fund industrial research? hire security consultants to do independent audits and assessments? develop a secure software development methodology? hire security professionals and have them interface with both my product developers and the security community? have professionals interface with the global security community and develop strong working relationships with "well known hackers", possibly even hiring some of them? invest in lots of applied research on making exploiting bugs in your software harder? invest in actually building the systems that the previously mentioned academic research theorized about to identify bugs in software that you write?

oh, you did _all_ of that? and more? and there are still bugs in your code? somehow I think this says more about the craft of developing software than it does about your company and culture ...

<comment><USER4> It's not a secret that Microsoft's hiring practices are somewhat subpar and their internal organization is a mess.

Am I surprised that a product got rushed out with major issues? Of course not, they do it every day.

<comment><USER5> Where is the evidence that it was rushed out?

</comment></comment></comment></comment></comment><comment><USER6> Does anybody have PoC on this one?

<comment><USER7> It's said to be a 32 bit refcounter bug, making it near impossible to predict the triggering packet over WAN.

<comment><USER8> If so, would require hundreds of GB of UDP packets.

But you may not need to predict which one is the one that wraps the counter. It may be that all your packets could be the same.

</comment></comment></comment><comment><USER9> I've been tearing through this one and I have a very basic question:

Because it's in the IP stack, would a software firewall offer any sort of defense here?

<comment><USER2> thinking about it, yes and no.

yes, because in windows traditionally third party firewalls are sandwiched between the tcp/ip stack and the network card driver. the firewall will see packets before the TCP/IP stack does and it can make a decision then.

but probably no, because since this is a refcounter bug there isn't anything specific about the packets that you are interested in blocking. you can probably try and apply some kind of ratelimiting action or something else, but what you're working around a failure in object life-cycle management on the part of the OS so you'll be guessing. it isn't like there's a "bad pattern" that you can match and drop to make everything OK.

</comment></comment><comment><USER10> Is this the alleged fifth 0-day in Stuxnet that was allegedly suppressed?

<comment><USER11> Probably not.

It was previously known as MS11-064, a Denial of Service bug. Someone expanded on the vulnerability and got remote code execution out of it.

<comment><USER12> DDoSes and exploits in the TCP/IP stack, whoa... This brings back memories of Winnuke (<http://en.wikipedia.org/wiki/WinNuke>), Teardrop and follow-ups, when it was easy to crash any windows computer with just the IP.

</comment></comment></comment><comment><USER13> Thank god am using XP :))

<comment><USER14> "I don't have to worry about hackers - I keep all of _my_ life savings in a pickle jar hidden in the trunk of my car!"

<comment><USER15> so those wherent pickles in that car i stole?:(</comment></comment></comment>


Greenspan "shocked" at credit system breakdown - <AUTHOR> http://news.yahoo.com/s/nm/20081023/bs_nm/us_financial_greenspan <comment><USER2> It was Greenspan who got us into this situation in the first place. I don't know why the media listens to him. Research it. Its Greenspans fault and everyone thinks his advice is golden. What a crock. Sorry, I want him taken in and put into jail.</comment>


Where does email sent to *example.com go? - <AUTHOR> http://stackoverflow.com/questions/8221381/where-does-email-sent-to-example-com-go

<comment><USER2> The answer is incomplete. It has no MX record but it does have an A record which is used as a fallback. The A record for example.com/net/org resolves to the private IP address 192.168.43.10, which is where your MTA will attempt to deliver it.

So if you want to receive incoming emails without changing the DNS resolution for the example domains, setup a mail server on your local network using that IP address and you'll be RFC compliant and still get the email.

<comment><USER3> It actually resolves to a public IP: 192. _0_.43.10, which is why putting <http://www.example.com> into a browser will give you a redirect to <http://www.iana.org/domains/example/>

<comment><USER2> Thank you... I must've read into that IP address what I wanted to see.

</comment></comment></comment><comment><USER4> Someone wondered about this in another HN thread (which is what led to this question being asked), and personally I find it astonishing that there's a bunch of hackers here that don't know how email works or what an MX record is.

I guess in this age of Amazon this and cloud that, nobody bothers to learn how these things work as long as they can run their webscale node app written in CoffeeScript on their cloud servers.

</comment><comment><USER5> The top-voted answer is wrong. If there's no MX record, mail servers will attempt deliver to the A record.

example.com's servers don't listen on port 25, so the mail server won't establish a TCP connection and won't even begin delivery.

I tried to amend the answer on stackoverflow but I don't have an account and it needs to be "peer reviewed" or something.

</comment><comment><USER6> example.com is protected by RFC 2606 ("Reserved Top Level DNS Names") for special use (with example.org and example.net - along the same lines as the reservation for 127/24, 192.168/16, etc).

The domain is owned by ICANN and has no MX record. Where the mail goes depends on your site-local MTA configuration. On the public internet it goes (or should go) nowhere and bounce back immediately with an appropriate status code from your provider's MTA.</comment>


What does your company use for instant messaging? - <AUTHOR>

My company uses Skype, but nobody is happy with it.  Does HN have any recommendations?  Unless we find something better, we're going to host our own jabber server. <comment><USER2> We use Skype. In the old days (before I joined), IRC was used but it seems to have fallen out of favour. In my opinion, IRC was better because:

\- it was entirely internal

\- things can be automated easily with bots

\- we have logs of everything

</comment><comment><USER3> We used Skype before and weren't happy, but we just changed to <https://www.flowdock.com/>. It does also other useful things (gathers all feeds into one "inbox"). Works very well for development teams, but our whole team has been happy with it. Should work well for bigger organizations too.

Btw, it has also IRC-integration, so people familiar with that (like me) should be alright.

</comment><comment><USER4> We use Prosody.IM, which is a jabber server powered by LUA. Before that we used the Java-based openfire/wildfire jabber server.

Clients are left open to personal preference, but the chat-server itself is Jabber.

</comment><comment><USER5> I've got clients who use Jabber + Google Hangouts, others who use HipChat + Google Hangouts. G+ Hangouts seem better than Skype in my experience.

Hipchat's logging + API hooks are really handy

</comment><comment><USER6> We use Campfire for group discussion and Jabber for IM.

</comment><comment><USER7> <http://Lync.com> – IM/audio/video/screen sharing/keyboard access

</comment><comment><USER8> I can't imagine having to have Skype open.. my computer is bogged down enough without Skype

</comment><comment><USER9> We are using Hipchat/Skype and its been working great for communication within our team

</comment><comment><AUTHOR> Thank you all for the recommendations. I'm going to check out each of them.

</comment><comment><USER10> Try <http://hipchat.com>

</comment><comment><USER11> Just the built-in Google Chat (we use Gmail to power our email).

</comment><comment><USER12> office communicator</comment>


Adventures in Self Publishing - <AUTHOR> https://www.petekeen.net/adventures-in-self-publishing <comment><USER2> A writer pointed out to me that writing a book is very similar to building a tech startup. The hours are long, it's critical to build a strong platform and there are the same swings from despair to elation.

Additional data points are always very much appreciated and it's very good of the author to release his tools and methods for others to learn from. Of course, the $5k in 2 weeks doesn't account for the time it took him to write the book or the opportunity cost of not taking other work, so this still might not have been a financially worthwhile venture, but hopefully it will keep selling and he'll publish more about it.

<comment><AUTHOR> Yeah, definitely the $5k in two weeks doesn't include the development time. I figure I broke even on the writing when it hit $7k, but it's definitely not any kind of substitute for a full time salary.

<comment><USER2> Would you mind telling us how long it took you to write? The impression I get is that people routinely underestimate how long good writing takes by orders of magnitude.

Thanks again for publishing this.

<comment><USER3> Having written a Ruby book I would definitely agree, even though my book was very modest in size it took an order of magnitude more work than I had expected. Coming up with code examples, editing, creating a book cover, not to mention how grueling it can be to write especially after a long day of coding.

<comment><USER4> All that and not even a single link to it? Where's the shameless self- promotion slash example?

<comment><USER3> Here is a link to the book. Yeah, I'm pretty shameless but haven't done much promotion yet :-)

[http://www.amazon.com/The-Rapid-Rubyist- ebook/dp/B00DPQ5P24](http://www.amazon.com/The-Rapid-Rubyist- ebook/dp/B00DPQ5P24)

</comment></comment></comment></comment></comment></comment><comment><USER5> I self-published a programming book a while ago, and it brings in about $700 per month. I didn't see the big initial spike the OP did (shame), but the money has been consistent, and I would expect it to continue for several years.

Total start-up costs: $150 (proof copies etc.)

We're lucky as programmers that we tend to be able to wrangle LaTeX, and some of us have taste in typography and an ability to write decent prose. This means that the up-front cost of editors, typesetters, cover designers and so on is gone.

The disadvantages compared with my previous (real) publisher are a) no advance and b) no marketing and c) paying for translations to be done. Everything else has been an advantage.

When someone buys my book on Amazon for $35 I get $21. No traditional publisher can beat that.

<comment><AUTHOR> That's awesome, congratulations!

> no marketing

That's definitely been the biggest learning component of this project. Having to do all of the marketing myself has been eye opening and very instructional.

<comment><USER5> You know that it's very easy to get your book on Amazon through their subsidiary CreateSpace, right? You already have the PDF... Also getting it into the kindle store is free and easy. If you're just selling the ebook on your website, you're missing a trick.

I haven't really done any marketing except for the initial announcements. Most people find it directly on Amazon, or find the website by searching for "<language> book".

<comment><AUTHOR> I've briefly looked into it, sounds like I should probably look into it more. I was thinking about doing a limited print run through Lulu but that wouldn't really help with the marketing.

Thanks!

</comment></comment></comment></comment><comment><USER6> That's fantastic! Good job executing and congratulations on the success! It's well deserved.

Thanks for being so open with the numbers. That same openness is what got me to start over a year ago. Glad I could serve as an inspiration as well.

For those making revenue/hours comparisons: Yes, a book will often make less money then consulting in the short term.

If you always focus on the next week or month then you won't be able to move beyond those consulting numbers.

Real success requires long-term thinking. Pete has started something that—at a minimum—will allow him to significantly increase a consulting rate. But more likely he can turn the beginnings of his list and book into screencasts, speaking engagements, more books, etc.

High quality instruction is always in demand. Given enough time and work you can make $250k+ a year doing it.

</comment><comment><USER7> _The second biggest driver was a link in Ruby Weekly. [..] Not to mention, the amount of money I would get from direct sales is vastly more than I would get from the same number of sales if I were getting royalties._

I'm always happy to link to good stuff, but I must admit, if I'm not making any money out of it, I never push anything particularly hard.

This makes me wonder if I partnered with or acted as a publisher to indie writers like this, I could quite easily offer a 50-75% "royalty" yet push it more frequently and heavily to my audience and everyone wins. Indeed, I believe this is what Pragmatic Bookshelf does when it takes on previously written indie books(?)

<comment><AUTHOR> That sounds kind of like an affiliate program. I bet you could make it work with the kind of niche audiences you've got.

<comment><USER7> Sort of. I've done affiliate stuff before but I don't like the vibe it gives off. Selling the products directly in a more publisher-esque way feels more honest, although I'm not entirely sure why.

<comment><USER6> I think "affiliates" may have a bad vibe, but you could message it in a way that wouldn't. I know Gumroad is coming out with some functionality along those lines and they call it "tastemakers" or something similar.

I bet you could significantly increase your revenue by working directly with authors—though if you try to republish their books it would be more work for them.

Just work with one author a month, whose book you have carefully vetted, and promote it to your lists for a commission.

<comment><USER8> I'm planning on releasing a book soon and have been strongly considering gumroad. I couldn't find anything about an affiliate program (now or coming soon). Do you have a link for this, or is it just from your talks with them?

</comment></comment></comment></comment></comment><comment><USER9> Nice article and great to read some additional validation of the Patio11/Nathan Barry playbook. A few things I'm interested to know:

\- How many sales you got from this HN post?

\- Have you received any consulting gigs from the book?

\- How big did your mailing list get?

\- Why aren't you collecting signups to your list from this blog post?!?!

<comment><AUTHOR> Only a few sales from this post thus far today. I have gotten a few inquiries about consulting but I haven't had any available bandwidth to take them on. The mailing list stands right now at a little over 300.

There's a signup button at the bottom of the sales landing page, but you're right it should definitely be on the blog post too. I'll fix that shortly.

</comment></comment><comment><USER10> I love the way you choose your niche. There is a very large number of niches to be had by combining two or more things you know well and that have paying markets.

</comment><comment><USER11> I do not know if you are from USA, but I am from Canada and I never been able to fill up the form to get a itin number (to not have to have extra tax to paid when you get royalty). I even paid 50$ at the US embassy to have the paper stamped and it has been rejected without any indication. Does any one has better experience?

</comment><comment><USER12> Very timely, congrats, and thanks for the insights! It's quite hard core to go all the way _self_ -published with self-built architecture.

I keep churning a couple of book ideas over in my head, and probably should put them out for testing, to see which one would work in practice. One about physics in the "Learn X the Hard Way" style, one about Facebook page/group management since that's what I was doing with a bunch of side projects, but it's a very quicksand topic. [https://leanpub.com/u/imrehg](https://leanpub.com/u/imrehg)

In the meantime, trying to help a friend to turn his paper-book into ebook, which comes with its own can of worms. How to Start a Business in Taiwan [https://leanpub.com/startabusinessintaiwan](https://leanpub.com/startabusinessintaiwan)

</comment><comment><USER3> That's pretty impressive. I wrote one of the better selling Ruby books on Amazon and it would take over a year to make 5k for sure.

<comment><USER6> That's why self-publishing is awesome. Control of pricing and owning the customer list can make a huge difference.

<comment><USER3> Yeah I agree. Exposure though is the issue, you'd presumably have to do a lot of self promotion otherwise. Or maybe posting to HN and reddit is enough. Not sure.

<comment><USER6> Did Amazon really give you that much exposure? I haven't sold on there, but my friends who have drove the entire audience. They didn't get a lot of sales from Amazon directly.

<comment><USER3> I think it has yeah. I haven't driven any traffic there, nor have I promoted the book much at all and it moved up the charts to where it's generally in the top 5 books in it's category, sometimes higher.

Over time it seems to be selling more and more. The first month was pretty slow in sales though.

</comment></comment></comment></comment></comment><comment><USER13> Interesting to see the tools used to make the book. It wouldn't come to my mind using anything but LaTeX.

</comment><comment><USER14> This was a great read. Funny timing in that I just announced that I've been writing a book earlier today: [http://spencerfry.com/i-m-writing-a- book](http://spencerfry.com/i-m-writing-a-book)

</comment><comment><USER15> An old friend wrote a book on Cisco technology. He said it was a great experience, and helped his non-writing career along, but unlike a startup you shouldn't plan on a financial return on the investment.

</comment><comment><USER16> For my technical book, I was getting frustrated with the page breaks interrupting the code sections in weird places.

There's a bit of a hack you can do to create a continuous single-page PDF if you're generating your book from html/css:

        @page {
          size: 216mm 17600mm;
        }

That tells the PDF printer to make the page 8.5 inches wide and really really long.

It's dirty, but it works!

Derek Sivers said this about it when I sent him a copy:

"I love that continuous-page PDF format. Never seen that before, but it's so much handier than artificial pages."

For my upcoming book, I'm releasing both a page-breaks and a continuous version of the PDF.

[http://devopsu.com/books/taste-test-puppet-chef-salt- stack-a...](http://devopsu.com/books/taste-test-puppet-chef-salt-stack- ansible.html)

The continuous PDF doesn't work well in some PDF readers, so unfortunately I have to also provide a version with page breaks.

## Full Setup

For the curious, here's the rest of my setup:

I'm using Jekyll so I can just do everything in markdown/html/css. It uses pygments for the syntax highlighting and I'm using my own customized syntax coloring styles. Then I use PrinceXML for generating the pdf.

It makes for a nice workflow...

First I start the jekyll server with the --watch flag so it will auto- recompile the html:

        jekyll serve --watch

Then I use PrinceXML to generate the pdf:

        prince http://0.0.0.0:4000/breaks-no.html -o breaks-no.pdf

If I want to have the pdf auto-generated too, I use fswatch (OSX utility similar to inotifywatch):

        fswatch dir_to_watch_for_changes "prince http://0.0.0.0:4000/breaks-no.html -o breaks-no.pdf"

Jekyll is handy since I can have multiple versions of the book, but still keep things DRY via includes. For example, I have the book version with page breaks (breaks-yes.html) and a continuous page version (breaks-no.html).

I tried several other pdf generation utilities, but none came close to the quality and consistency of PrinceXML.

The pro license for the server version of PrinceXML is pricey - $495 ( [http://www.princexml.com/purchase/](http://www.princexml.com/purchase/) ). So, I'm only using the pro version for development and for the final versions, I'll be using their SaaS product which is only $15/mo: [http://docraptor.com/plans](http://docraptor.com/plans)

Anyway, that's the process so far!

## Book Launch Tomorrow

Manage servers? One of the biggest wins for making your systems more awesome is to use a configuration management tool like Puppet, Chef, Salt, or Ansible.

If you want to make sure your systems are fast, scalable, and secure, the first step is having full control and power over them.

Tomorrow, Sept 4th, I'm launching my book "Taste Test: Puppet, Chef, Salt, Ansible" which is designed to save you the days or weeks of research when picking one of these tools.

In the book, I implement an identical project with each tool so you can see what each one is like to work with. You may be surprised at which ones were super easy and which ones were really difficult to work with.

To get a discount for the book release, just sign up on the mailing list: [http://devopsu.com/books/taste-test-puppet-chef-salt- stack-a...](http://devopsu.com/books/taste-test-puppet-chef-salt-stack- ansible.html)

<comment><AUTHOR> I hadn't ever thought about a continuous PDF, that's a good idea, and should be a snap with Docverter.

Looks like a good book, good luck on your launch!

<comment><USER16> Thanks :) Docverter is new to me, I'll definitely check it out!

</comment></comment></comment><comment><USER17> hmmm,

2 weeks => 8 work hrs. per day. 5000$:80hrs. = 62,50$

1 $ = 0,7592$ = 47,4479€ = 47,45€ \</comment><comment></comment><comment>---- total: 3796€ in two weeks.

50€ per hr. is a german student designer/programmer (first uni year) price. nothing special. the most work for 70-120,00€ p. hour.

<comment><USER18> > 50€ per hr. is a german student designer/programmer (first uni year) price.

I've definitely doubts about that price for a german first semester student. As a student in first semester you'll be a non payed trainee in germany.

<comment><USER19> I'm glad I'm not the only one who thought that was stupidly high for a college student...</comment></comment></comment>


Extracting SSH Private Keys from Windows 10 ssh-agent - <AUTHOR> https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/ <comment><USER2> The author of this blog must have uploaded an image without the big red block to mask the private key, realized their error, and replaced it with an image of it blocked. However they didn't remove the unblocked image first. Ghost (the blog engine here) just appends a number to the image when you replace it without changing the filename, so it's easy to find. See the two URLs below:

[https://blog.ropnop.com/content/images/2018/05/base64_decode...](https://blog.ropnop.com/content/images/2018/05/base64_decode_openssh.png)

[https://blog.ropnop.com/content/images/2018/05/base64_decode...](https://blog.ropnop.com/content/images/2018/05/base64_decode_openssh-1.png)

This is probably a good reason to use burner keys for proof of concepts.

<comment><USER3> Author here...heh nice find.

All keys used were burner keys anyway.

The only reason I blurred and obfuscated where I could was just for "best practice" not for real security. I knew if I didn't people would comment that I should've ;)

<comment><USER4> _> I knew if I didn't people would comment that I should've ;)_

That and following good practise even when not actually necessary due to other mitigations, you obviously hint to less experienced readers what good practise is.

</comment></comment></comment><comment><USER5> Just a heads-up - the pixelation used to hide the keys in the final screenshot is not safe! There aren't that many possible characters in each of those 10x10px blocks, and ~256 levels of average brightness is enough to distinguish between them. (Here's a simplistic demo: [https://dheera.net/projects/blur](https://dheera.net/projects/blur))

Stick to the block-of-constant-colour method used in the first few screenshots. It's ugly but safer!

<comment><USER6> As I read the article I thought it was more silly they didn't simply use burner keys as PoC.

<comment><USER7> They are burner keys. The red boxes are pointless.

</comment></comment></comment><comment><USER8> Am I correct in thinking that this is working as intended, and not actually a vulnerability? Many people seem to be sharing this as "look at Microsoft screwing up ssh-agent security", but I can't actually see any evidence of this in the article.

<comment><USER9> You are correct. There is no "vulnerability" here. The plaintext of the user's private keys must be accessible to the CPU performing the cryptographic operations. DPAPI is a reasonable method to keep the keys encrypted "at rest" while allowing the keys to be decrypted w/o the requiring password entry each time the keys are used.

It is helpful for post-exploitation toolkits to have this functionality.

<comment><USER10> AFAIK the whole point of ssh-agent is that the private keys are _NOT_ extractable by other processes.

[https://man.openbsd.org/ssh-agent](https://man.openbsd.org/ssh-agent):

> The agent will never send a private key over its request channel. Instead, > operations that require a private key will be performed by the agent, and > the result will be returned to the requester. This way, private keys are not > exposed to clients using the agent.

This sounds like a pretty gaping security hole by Microsoft. I would not assume loading private keys to an "ssh-agent" means giving any process (browser, email client etc.) running on the same machine access to the unencrypted values!

<comment><USER9> The SSH agent isn't divulging the keys. The OP is decrypting the keys from the underlying storage. The API used to protect the keys allows the keys to be decrypted without explicit password entry. The OP has the necessary password to decrypt the keys, so the API allows it. The SSH agent isn't involved.

<comment><USER11> > _The SSH agent isn 't divulging the keys. The OP is decrypting the keys from > the underlying storage._

But can't just any program do that as soon as you're logged in? (Since your login password basically unlocks the DP-API which is protected at rest.)

<comment><USER12> A program would need the appropriate level of access (which isn't actually that high a bar), but at the end of the day the fact of the matter remains: other processes can potentially access private keys that would otherwise remain password protected.

</comment></comment></comment></comment></comment></comment><comment><USER13> > I have no idea how the original author soleblaze figured out the correct > format of the binary data, but I am so thankful he did and shared.

Good time to point out that we open sourced [0] all of this so I have some guesses as to how soleblaze might have "reverse engineered" it :-)

0\. [https://github.com/PowerShell/openssh- portable](https://github.com/PowerShell/openssh-portable)

</comment><comment><USER14> From [1], cited and linked to in TFA:

> To do that, we simply start the ssh-agent service (as Administrator) and use > ssh-add to store our private key.

Did Microsoft do some major surgery on the ssh-agent program or am I missing something else? If the agent is started as Administrator, why can I connect to it with my user privileges? And if I do, can other users on the same system do so, too, accessing the same set of keys?

[1] [https://blogs.msdn.microsoft.com/powershell/2017/12/15/using...](https://blogs.msdn.microsoft.com/powershell/2017/12/15/using- the-openssh-beta-in-windows-10-fall-creators-update-and-windows-server-1709/)

<comment><USER15> Unprivileged processes can communicate with privileged services.

The service itself sometimes controls which user can access which data, but in this case since the encrypted keys are stored in the Current User Registry Hive (NTUSER.DAT) it likely doesn't need to, filesystem permissions handle that.

Plus even if another user gained access to your registry hive, the data is encrypted with your context via the Data Protection APIs.

<comment><USER16> I'm sure they have a good reason to do it that way but why run a privileged process when per-user processes could do the job just fine? You'd reduce the surface of attack tremendously that way.

If somebody finds a flaw in their admin ssh-agent process they potentially have a way to access other people's key or maybe even escalate their privileges.

<comment><USER15> > I'm sure they have a good reason to do it that way but why run a privileged > process when per-user processes could do the job just fine?

I actually don't know. I was thinking the same thing. Hopefully they have a good reason, because you're right about the attack surface issue.

</comment></comment></comment></comment><comment><USER17> So basically the article is saying Windows protects the keys much better than linux, where the key sits unencrypted in ~/.ssh folder?

<comment><USER18> No:

1\. You can choose to have the keys encrypted with a password (same for Windows as for Linux)

2\. The key, whether encrypted or unencrypted, are for both platforms stored on disk in the user profile (see first screenshot)

3\. This talks about ssh-agent, which you can use to cache the the unencrypted key so that you don't have to type the encryption password every time you want to use the key. On Linux, this is just stored in memory, whereas in Windows, it's stored (encrypted) in the registry as well.

</comment></comment><comment><USER19> With Linux if I'm a program running under target user, I can use unlocked ssh- agent to perform crypto operations with private key, but I can't extract the key itself. With Windows I can just steal the key itself. I think Windows is worse here. Am I misunderstanding something? What's the point of password protection if key is stored unprotected by this password in the registry?

<comment><USER9> The private key _is_ stored password-protected in the registry. DPAPI, the API used to protect the private key, encrypted based on the user's Windows account password, and allows decryption without further password entry by the already- logged-on user. There isn't an equivalent API in the Unix world that I'm aware of. When you fire-up the Windows SSH agent no password entry is necessary, because the password used to logon to Windows is also used to decrypt the stored private key. In a Unix environment you'd need to enter a passphrase to allow the SSH agent to decrypt the key.

<comment><USER20> The equavilent in the unix world is gnome keyring (or any other Secret Service spec implementation) unlocked by a PAM module on login.

</comment></comment></comment><comment> a-dub OT: Does the existence of this openssh port mean that the Windows command window is now a fully functioning terminal?

<comment><USER21> It depends on what you mean by fully functional.

<comment><USER22> In other words, no. There's basic functionality though - 80/20 etc.

</comment></comment></comment><comment><USER23> I assume the author doing these under the Administrator account or had admin privilege.

<comment><USER24> You can read them with or without admin access on the same user. On the other hand a different user's admin account wouldn't help unless you can dump the first user's password.

[https://msdn.microsoft.com/en- us/library/ms995355.aspx#winda...](https://msdn.microsoft.com/en- us/library/ms995355.aspx#windataprotection-dpapi_topic02)

</comment></comment><comment><USER25> So ssh private keys are stored in plain base64 encoding in the windows registry? How is that even possible?

<comment><USER26> No, part of this involved using Windows's Data Protection API to decrypt it.

Other non-administrator users can't read these registry keys, it's encrypted with the login password (as is common with macOS Keychain and GNOME/KDE's credential stores) so even other administrators can't decrypt it.

On Linux, administrators (root) can extract the keys from ssh-agent. This is actually no less secure and usually more secure.

This is a cool demo of how to do it on Windows, and there's a reason the author didn't call it a vulnerability - it's working as designed and this form of attack is outside the intended threat model.

<comment><USER16> >On Linux, administrators (root) can extract the keys from ssh-agent.

I don't understand how the situation is different. Of course you can extract the keys from a running ssh-agent since the whole point is not having to provide your password every time so they have to have access to the private key one way or an other. How is the situation different on Windows? Surely when the user is logged an administrator with access to the full RAM and storage will be able to piece everything together (like TFA does for instance)?

On the other hand if you really can't trust your admin you have a huge problem anyway, even with a HSM you could be phished very easily.

Actually overall I'd say that this Windows method is _slightly_ less secure because it means that the Windows keychain thingy is a single point of failure, if somebody compromises it they have access to everything including the ssh keys in the registry.

<comment><USER26> I don't think Windows gives an administrator account unfettered access to the full RAM, no. And without that or the user's login password, all they could get from the registry is the encrypted version, just as on disk. The encryption is separate per-user with that user's password.

Of course there may be ways to get an even more advanced level of access than administrator, such as the system account, but honestly Windows does lock some things down really hard at the kernel level and Data Protection decryption based on in-RAM credentials might be one. I don't know modern Windows internals to that level.

<comment><USER16> >I don't think Windows gives an administrator account unfettered access to the full RAM, no.

Are you sure? Typically root has access to the full RAM on an un _x system. Unless this is linked to a hardware TPM module I 'm not sure why and how it would be protected. Maybe I'm wrong to assume that Windows Administrator == un_x root?

Anyway, if the OS has a way to hide some of its state from even the admin then surely it could use it to hide the unencrypted SSH key in RAM instead of hiding the key-to-the-registry-key? My main argument is that at some point if the OS doesn't want to prompt the user for a password it must have access to the private key one way or an other, so I'm not convinced that Windows is more (or less) secure than Linux in this situation.

</comment></comment></comment></comment></comment><comment><USER27> So, good reason to use the Cygwin version of ssh-agent? I assume it doesn't suffer from the same thing.

<comment><USER9> I don't understand what it "suffers" from. It's performing as-intended. A user needs to be able to retrieve the plaintext of their SSH private keys.

There's nothing that seems architecturally unsound about how Microsoft implemented this. DPAPI is a reasonable way to protect the keys "at rest" in the registry. The OP was able to extract the keys because he has the credentials for the user from whom he is extracting the keys.

Short of storing the keys in the memory of a dedicated crypto-processor outside the host computer (and performing the cryptographic operations there) the plaintext of the private keys will have to be recoverable to the user.

<comment><USER28> the entire point of agents is that they DON'T just hand you key plaintext, otherwise what would the point of them be compared to just an un-encrypted file.

ssh-agent signs requests, tokens, etc on your behalf. You never see the private key.

<comment><USER29> ... which is why the blog post is about figuring out how to decrypt the underlying storage that ssh-agent reads from to get to the private key.

Edit: If your point was specifically about this from EvanAnderson's comment

>A user needs to be able to retrieve the plaintext of their SSH private keys.

then the "user" there is the abstract identity used to locate and decrypt the private key, not the human invoking ssh-agent.</comment></comment></comment></comment>


Andreessen Horowitz launches $2.2M fund to invest in underserved founders - <AUTHOR> https://techcrunch.com/2020/06/03/andreessen-horowitz-launches-2-2m-fund-to-invest-in-underserved-founders/ <comment><USER2> as a black person in tech. this is the wrong move. what's 2m to a fund like AH. if this program is to work, they need to invest in the community i.e scholarship funds or dinners etc - have people of color like me interact with VC's on the regular. my disdain for VC's as they're more like vultures these days. most people of color suffer from the lack of opportunity - n the lack of opportunity starts at a grassroots level. I have been privileged enough to be able to afford college get a CS degree, work at tech companies. not be arrested etc. but most people with the color of my skin are not. also scholarship funds need to like a machine gun - not based on some artificial merit metric.

<comment><USER3> I think it's offensive. I thought surely the m was supposed to be a b. But nope, the $12B gorilla in VC launched a tiny $2.2m fund. Not even enough to fund a single round in a single company at the levels they usually fund. I hate to down a good idea. But at least make an effort. Is this all that one of the biggest VC firms on the planet can muster?

</comment></comment><comment><USER4> AH is clearly doing this as a counter to YC.

On the one hand, it doesn't sound like much, but on the other, 2000-era angel investments were really small - $25k - $50k were typical.

(Woz's seed funding to Google was $100k.)

Also, VCs are really into larger, later-stage investments this decade, usually more than $2 million per startup.

Having said that, $2.2 million is like 8-9 senior engineers in SV for a year, so not much.

<comment><USER5> Not to detract from the point but I never heard of Woz funding Google.

As far as I know, first $100k (and only seed round) was funded by Andy Bechtolsheim, co-founder of Sun Microsystems.

</comment></comment><comment><USER6> The underserved fund for the underserved founder.

</comment><comment><USER7> "A16z has $12 billion in assets under management across its funds, so a $2.2 million fund is not groundbreaking from a monetary perspective"

The math comes out to 0.018%.

</comment><comment><USER8> They should invest in establishing local VC firms in underserved communities.</comment>


China is flooding Silicon Valley with cash. Here's what can go wrong - <AUTHOR> https://www.washingtonpost.com/business/economy/new-wave-of-chinese-start-up-investments-comes-with-complications/2016/08/05/2051db0e-505d-11e6-aa14-e0c1087f7583_story.html <comment><USER2> To me, the "China is" in the [current] title implies action by the state, however the article describes actions by individual companies.</comment>


China's social network surveillance databases are apparently leaked to Internet - <AUTHOR> https://twitter.com/0xDUDE/status/1101917885100945409 <comment><USER2> > And the most remarkable part is that this network syncs all this data to > open MongoDBs in 18 locations.

Lol, again.

I recall in a previous list of open MongoDBs, the Chinese equivalent of the US Food and Drug Administration had an open MongoDB.

</comment><comment><USER3> > The most dialogs which are being monitored are typical teenager > conversations.

In the picture "你还用说我大", "那是衣服紧" (Translate: "You don't need to tell me that mines was big", "That's because the cloth is tight").

I don't know about the "typical" thing due to lack of context. But my sense tells me, that "teenager" is doing some sex talk.

Another one: "说:!收【【【46--48道士号】】】卖的微信XXXXXXXXXXX" ("Buying 46~48 level Taoist account, contact me using WeChat XXXXXXXXXXX"). I guess this person is trying to buy a in-game character. Taoist is a type of character similar to magician.

I think the message is captured by some type of Internet Cafe managing software, which can be installed on the machine so the admin could remotely control and "auditing" it. Typical feature includes shutdown, force logout, timer etc. I don't know it can also record chat messages, but the fact it can does not surprise me that much to be honest.

<comment><USER4> Where is this data? It sounds like they haven't disclosed it, just announced it?

<comment><USER3> I have no idea. Those messages I've quoted is from the Twitter page.

</comment></comment></comment><comment><USER5> Just leaving aside for a second what a crime against humanity this surveillance is...

It never ceases to amaze me how many of these massive data leaks are simply "mongodb in default configuration".

I just don't understand how it was thought, at any point in time, to be a good idea that mongodb in its default configuration, would be open to the world with no authentication.

<comment><USER6> That what happened when DevOps started to mean "we don't need an ops team, the devs can do it".

<comment><USER4> "we don't need dbas, the ops team can do it."

<comment><USER6> At least the ports would be closed :P

</comment></comment></comment></comment><comment><USER7> From the screencaps it looks like surveillance systems used to monitor internet cafes and public access points where people must use their real ID to login, so it's a bit easier to link accounts to actual identities. A number of these IM suits are actually encrypted in transit that it's very unlikely that this level of interception is possible without a root certificate installed on the client machine.

<comment><USER8> Couldn't this data be coming directly from these IM services' servers? I doubt any of them are E2EE.

<comment><USER7> It's possible but I really doubt it, considering the sheer volume of message being generated every moment. It would be much easier and less likely to have hiccups like these if they just give them server access on demand, rather than having a live data feed replicated to 18 separate locations. Moreover the tweets actually show names and addresses of various internet cafes in one of the pictures. This information should not be available if the data is coming from the service provider's backend.

Contrary to popular opinion on HN and other forums in the Anglosphere, surveillance in China is a nuanced problem and tech companies are far from completely passive. Local police are often denied when they request information because technically they lack jurisdiction on companies located in a different town or province. As a result they resort to catch-all interception using devices like these makeshift DPI systems(there is no clear legal requirement, but internet cafe owners are easily coerced into installing them or risk having their business hut down over various infractions) and Stingray-like fake cell sites (a constant source of conflict with major telcos because they are often poorly installed and would interfere with normal cell sites).

These ad-hoc schemes are usually put together by the lowest bidder, so they tend to be horribly inefficient and insecure like what's been shown in this case. But to local LE it's still preferable to going dark, not to mention there is usually little accountability when their system breaks.

<comment><USER9> > I really doubt it, considering the sheer volume

I feel like most people felt that way about the NSA's capabilities pre-Snowden

<comment><USER7> Or did they? The global SIGNIT capacity of the NSA has been pretty well known before Snowden. The more revealing part of the Snowden leaks was that the NSA has been spying on US soil without clear authorisation.

Personally speaking, Snowdon actually made me a lot less paranoid about the NSA: They are, like every other nation state backed blackhat, relys on having physical access and 0day exploits to do their bidding. No magical backdoor or quantum computers involved.

<comment><USER10> NSA spying on US soil was long known[1] (and of course "clear authorization" was never granted if you interpret that phrase to mean "public" and "accountable")

I'm not sure where you got the notion that they need physical access to anything either. Apart from intercepting comms on the wire, they deliberately subvert crypto standards in such a way that only they have access [2]. That is as close to a "magical backdoor" as it's possible to get.

[1] [https://en.wikipedia.org/wiki/Room_641A](https://en.wikipedia.org/wiki/Room_641A) [2] [https://www.theguardian.com/world/2013/sep/05/nsa-gchq- encry...](https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption- codes-security)

<comment><USER7> Well, Room 641A is a form of physical access. They are not yet capable of breaking into any commpany's network from outside.

The slides in the guardian article is pretty vague. The only proven case of NSA inserting a backdoor would have been the DUAL_EC_DRBG algo, and people have been alleging that from the very beginning. IIRC, Bernstein went on further and suggested that the NIST ECC curves may be compromised, but that's far from proven.

Most real life attacks we have seen such as logjam and beast arises from longstanding vulnerabilities that are in no way exclusive to the NSA, but they are probably in a better position to analyse past interceptions once an.exploit has been found.

<comment><USER11> > They are not yet capable of breaking into any commpany's network from > outside.

They can break into _any_ company's network but they can't break into _every_ company's network.

I believe that if the NSA targets a company, they'll almost certainly be able to infiltrate the network after some nontrivial targeted and sustained effort. Maybe someone like Google could fend off the NSA but I doubt it. The NSA only has to get lucky once, Google has to be secure 100% of the time. It's a tough battle.

But the NSA isn't currently monitoring every private corporate network, that's just crazy talk. I think.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> The opening statement of the author is really overblown and sensationalist. Only at the end of the thread did he admit that all data there apparently come from net cafes, but 1. there is no evidence that messages from private devices are being included in this database 2. one has to understand that China is vast, and each local authority differs a lot from the next one in deciding what it does. It totally wouldn't surprise me that the local authorities of several cities/provinces decided to sign a contract with this net cafe management software provider, who essentially installs a spyware on each net cafe computer and routes the traffic to the police. Doesn't suggest it's any sort of coordinated, deliberate action from the central government though. Comparing it to PRISM and NSA is highly misleading and irresponsible, and just putting a blanket word "China's" in the title is inaccurate. Sadly it's how most news stories are done these days.

</comment><comment><USER13> Where are these leaks available?

<comment><USER14> It sounds like the leak is just the mongodb instances being open to incoming traffic from the internet without authentication. This a common problem with MongoDB, because its default configuration is insecure.

</comment></comment><comment><USER15> Who are the leakers and how easy would it be for the government to track them?

</comment><comment><USER13> is the _index key common to nosql dbs? looks like elastic at first glance, but i haven't used mongodb ever

</comment><comment><USER16> We knew this all alone, but seeing the screenshot still turns my blood boiling. F __K THEM

</comment><comment><USER2> How typical is it for the Chinese to use English headers in their DBs?

Could this "solution" be off the shelf, or developed by non-Chinese?

The front-end users wouldn't see the backend structure.

Along with some native English speaker names like "CertificateNo" for certificate number.

<comment><USER17> As a non-latin language user, I can say that we do use English headers most of the time because nobody wants to deal with potential locale/coding problems.

</comment></comment><comment><USER18> Is there any research that proves the causal relationship between surveillance and crime rate ? I've been constantly shut up with this statement "Don't you want your country to be safe" when I talk about privacy intrusion by Govt .

<comment><USER19> I guess you could look at major European cities like London where CCTV is pervasive and other cities with considerably less.

It seems to me that most of the justification for surveillance systems is focused on edge cases, terrorism and paedophilia which are statistically unlikely of affect the vast majority of people.

If you watch some of the reality TV you see in UK about CCTV surveillance you'd think the county is suffering from a crime epidemic when in fact a lot of the situations are minor and often escalated by overly aggressive police officers interacting with uneducated angry drunk people.

Better social policy regarding education and alcohol would be the better solution.

<comment><USER20> > If you watch some of the reality TV you see in UK about CCTV surveillance > you'd think the county is suffering from a crime epidemic when in fact a lot > of the situations are minor and often escalated by overly aggressive police > officers interacting with uneducated angry drunk people.

I couldn't find London's murder rate further back than 1990 for some reason, but for England, the murder rate is higher now than it's been since at least 1900.

We don't know if CCTV surveillance, gun bans, and silverware purchasing restrictions have had an effect reducing violent crime, but at the very least it hasn't been enough to counter the increase.

> Better social policy regarding education and alcohol would be the better > solution.

I'm pretty skeptical that this would decrease violent crime and/or murders. Do you have any evidence for this?

<comment><USER21> This is probably the best study out there, and it hits the alcohol point pretty well:

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3015237/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3015237/)

<comment><USER22> Alcohol is involved in 40% of violent crime in the US.

[https://www.alcoholrehabguide.org/alcohol/crimes/](https://www.alcoholrehabguide.org/alcohol/crimes/)

<comment><USER23> What happens when you remove "angry drunk picks a fight" type of crimes from those stats?

Drunk people getting in fights is categorically different from violent crime committed for material gain (robbery, carjacking, etc). The causes for the problem and the way to go about solving the problem are totally different. Keeping people from getting angry drunk is not going to stop a home invasion. Stopping a home invasion is not going to improve crime stats because it's a single instance of violent crime. It's very possible to have a society relatively devoid of "violent crime" in which drunken brawls are fairly common. It's also possible to live in a society with lots of violent crime but no bar fights.

Including or excluding drunks to make the crime stats look how you want them to is no more honest than using gang violence to make the "mass shooting" statistics look how you want them to.

You can't just paint with a broad brush when it comes to violent crime (well you can but it's stupid and counterproductive if your goal is to understand crime for the purpose of advocating for public policy that reduces it). A drunk guy getting in a fight is different from domestic violence is different from robbing a delivery driver but they'll all show up when you "select * where includes_assault = true;"

<comment><USER24> It's true that they're different types of crime, but that doesn't make it not crime and it doesn't make it not violent.

<comment><USER23> Where did I say otherwise? Of course it's still violent crime.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> Non-mobile link: [https://twitter.com/0xDUDE/status/1101917885100945409](https://twitter.com/0xDUDE/status/1101917885100945409)

<comment><USER26> Fixed, thanks.

</comment></comment><comment><USER27> He will be a Hero of China in 21 century to save Chinese from communist party.

<comment><USER26> Please keep political and ideological flamebait off HN. Ditto for nationalistic flamebait.

<comment><USER28> It's a copy/paste of one of the comments on Twitter. No idea to what purpose though.

[https://twitter.com/xiaojianguo2013/status/11023946262191308...](https://twitter.com/xiaojianguo2013/status/1102394626219130882?s=20)

</comment></comment></comment><comment><USER29> But who need it?

</comment><comment><USER30> _sigh_

I don't condone surveillance. It is a reality of life. However, I would expect that it is done responsibly and securely. I don't consider surveillance a big violation BUT doing a poor job at protecting the collected data _is_ an egregious violation of privacy.

<comment><USER31> Why?

Who will hurt you more than authorities can?

<comment><USER32> In the case of the US, the government is bound by due process, at least theoretically, which makes it far less likely to hurt me than private entities.

Granted, that may not be the case when it comes to China.

<comment><USER33> That's putting the cart before the house. Due process isn't an agent that enforces your rights, due process is a convention of how things are done. Nothing fundamentally prevents anyone from simply not following due process, other than the actual power structure of society, i.e., what people could get away with. That actual power structure depends on stuff like knowing things about people allowing you to control them. To illustrate what I mean: If your opponent can blackmail all judges, there is no due process for you.

</comment></comment></comment></comment><comment><USER34> I wonder if India's neighbor also engages in "our ability to arrest you proves our network is secure" tactic. Aadhar, the BS cattle-tagging project is premised on this principle, while they ship Indian citizens' information to Inqtel backed corporations ... because "it's nationalist" to do so.</comment>


Show HN: VisaEase.com - Review and Feedback - <AUTHOR> http://www.visaease.com

<comment><AUTHOR> Friends, non-Romans, internet people...I come to you bearing a link to the project and now company I've been working on the last few years (it's completely bootstrapped) asking for advice in a combination of a Show HN and Ask HN.

I present to you VisaEase: [http://www.visaease.com](http://www.visaease.com)

If you could spare a moment to check it out, I'm hoping to get feedback on the site in general and specifically: \- Ways to increase customer conversion \- Any suggestions on how to reach the right audience of people ready to emigrate? \- Many of the site's visitors are early on in the immigration process and not yet ready for our services. \- Suggestions on ways to improve the site design, especially the homepage which I think may need a redesign \- What do you think about the style of the copy on the site? \- We created all the copy, videos, etc. ourselves and wanted to get some outside opinions from pros and semi-pros to this part of marketing \- Do you know anyone that would be interested in freelance infographic design work (we have lots of interesting stats to share, but want to do so in a fun and hopefully aesthetically pleasing way)? \- Know anyone that may be interested in investing in the immigration space?

I've written the code for the platform that powers VisaEase in five houses and at least three states/provinces. I've worked it in coffee shops, in restaurants, on planes, in the middle of the night, in the early morning, on "vacation". It's spanned three relationships and two day jobs. This feels like a major milestone in my life so I wanted to let you know that VisaEase is finally out there in the wild, I took extreme care in getting it right. Some of the most intelligent people I know have had difficulty navigating the US immigration system for non-employment based greens cards and visas. The process is very time consuming and plagued by some bad entrenched interests (e.g. people that purposefully want to keep the process complex and jargon filled) and essentially through much back and forth with helpful immigration attorneys, logic mapping, etc. the system can accurately (in less than 30 minutes of your time in most cases) fill out needed immigration paperwork for someone without every asking them duplicate information.

The first uses for the platform will be fiance and marriage based green cards and citizenship, so if you know of an international or inter-citizenship love fest you want to help along send them to VisaEase and let them know an actual immigration attorney (even our chat is staffed by an immigration attorney, not a paralegal or general support) will also review their application for free literally saving them thousands of dollars (in case they need that extra reassurance).

Thank you in advance and good luck with your startups as well.

<comment><USER2> Are you looking to sell? Looking for investors?

How will you scale the attorney review @ $99? Takes at least 10-15 minutes of attorney time to do a solid review.

<comment><AUTHOR> Potentially looking for investors. The attorney review is free for the short term. We have an immigration attorney on staff and access to very helpful attorneys. We are giving customers the platinum version of the product for $99 right now, but this is a limited time offer.

[http://www.visaease.com/visaease-application- process/pricing...](http://www.visaease.com/visaease-application- process/pricing/)

[http://www.visaease.com/visaease-application- process/service...](http://www.visaease.com/visaease-application- process/service-offering/)

<comment><USER2> I started practicing immigration law last year and I have been envisioning a platform almost exactly like this recently. Particularly your eligibility test -- you nailed it. I think this is a good value proposition for people who want to DIY their petitions.

What is your marketing strategy? Adwords may be tough because you will pay $4 per click, competing with lawyers who earn $2,000+ per conversion while you'll get $99.

Are you looking for only big investors? I can't invest much but would be interested in getting involved in some way.

<comment><AUTHOR> We are looking for "mid-large" scale investors if we take funding at all.</comment></comment></comment></comment></comment>


Tennis sensor in the form of a Dampener - <AUTHOR> https://www.kickstarter.com/projects/laviesak/shot-stats-challenger-make-your-tennis-racket-smar

<comment><USER2> been waiting for something like this to come out - let's see what it can do!</comment>


Show HN: Cabalī – Local, encrypted, ephemeral chat that doesn't use the internet - <AUTHOR> https://cabalee.gram.co.nl/ <comment><USER2> it says it's lossy. does it mean few people on the cabal like let's say 3 or 4 wouldn't work? nice iidea</comment>


Amazon search was down - <AUTHOR> http://www.amazon.com/s/ref=nb_sb_ss_i_0_7?url=search-alias%3Daps&field-keywords=anti+fatigue+mat&sprefix=anti+fa%2Caps%2C144

<comment><USER2> What are the point of these posts? These big sites are rarely down for more than a half hour, by the time you see the post the site is back up.

</comment><comment><USER3> At least now I know they use Tomcat.

<comment><USER4> That's rather interesting. I remember attending a talk several years ago by someone from Amazon and he claimed their codebase was in excess of two billion SLOC, and that it was almost entirely C++.

If they're running Tomcat, does that mean the C++ monoculture at Amazon is falling by the wayside?

</comment></comment><comment><USER5> I just saw this. I thought our company proxy was borked again, but it's the same on my phone.

</comment><comment><USER6> Don't post these X is down posts.

</comment><comment><USER7> Looks like it's back up.</comment>


7tunnels and Pseudo Random Number Generators - <AUTHOR> I recently stumbled across 7tunnels and the product page, at least to me, seems like a bunch of marketing mumbo jumbo. Things like this: "Because 7Tunnels is new, it is not tainted by any of the legacy exploits, which have rendered most, if not all, other current encryption methods vulnerable or potentially compromised." If being new is a competitive advantage, it seems like that, definitionally, is already starting to get eroded. However, I am certainly a proponent of a more secure internet. Any thoughts on whether 7tunnels is onto something or is complete marketing fluff?<p>http://www.7tunnels.com/product/ <comment><AUTHOR> Interestingly this seems like a very well known encryption technique. [https://www.khanacademy.org/computing/computer- science/crypt...](https://www.khanacademy.org/computing/computer- science/cryptography/crypt/v/random-vs-pseudorandom-number-generators)

Why would anyone want to build a company around this? Doesn't make any sense.</comment>


Apple-like one page scroll website - <AUTHOR> https://github.com/peachananr/onepage-scroll

<comment><USER2> I'm using Safari. On your demo site, swipe to go back doesn't work. Any idea why this is happening?</comment>


You Need More Than 6 Hours of Sleep - <AUTHOR> https://hackernoon.com/you-need-more-than-6-hours-of-sleep-5186cfcf1dd5 <comment><USER2> Weird, I do biphasic sleep and get 6 hours and 20 minutes of sleep.

Havent been sick in 2 years. I'm attractive enough to know I'm attractive. And brain ability, as long as I get my 20 minute biphasic nap, I'm good for the rest of the day.

<comment><AUTHOR> Most people don't know how to properly execute polyphasic sleep. This is primarily aimed at the 50% of the population who don't sleep enough in general.

<comment><USER2> Biphasic sleep is quite easy. After 2 years of doing it, I just need to nap sometime before 10pm and fall asleep between 12am-6am

<comment><AUTHOR> I agree, but again the point is not to get into hacks and alternative schedules but to raise awareness of the issues of short sleep.</comment></comment></comment></comment>


Donuts.css - <AUTHOR> http://www.larentis.eu/donuts/

<comment><USER2> Gauges are actually pretty terrible interfaces for quickly communicating information in a dashboard.

      * hard to scan (insufficient contrast between needle and gauge)
      * typically don't show labels/values for boundaries
      * typically don't show labels/values for scale/units
      * typically don't show labels/values for alert thresholds
      * even when labels are present, they are still difficult to read quickly
         due to lack of alignment
      * when displaying multiple gauges of related metrics, you can't visually
         compare them without looking closely

Here's a pretty good overview on dashboard design (PDF, sorry) from Stephen Few that includes a good breakdown of why gauges are terrible:

[http://www.perceptualedge.com/articles/Whitepapers/Dashboard...](http://www.perceptualedge.com/articles/Whitepapers/Dashboard_Design.pdf)

I can highly recommend Stephen Few's books on dashboard design and data visualization--he's much more focused on real-world applications than Tufte.

<comment><USER3> Is it an historical anomaly that gauges were/are used to display car information (velocity, rpm, remaining fuel, mpg)?

<comment><USER4> Well, vehicles (planes, cars, trains, etc. all use gauges) use them to display data in a very different way than information dashboards.

If we look at the points OP listed:

      * hard to scan (insufficient contrast between needle and gauge)

Gauges in vehicles typically have a high contrast (orange/blue needle on black background)

      * typically don't show labels/values for boundaries

Labels for boundaries (and in between values) are present

      * typically don't show labels/values for scale/units

Units are given (or are implicit; i.e. for the gas tank gauge, I don't really care about the unit that much– all I care about is a very rough estimate of _when_ I'll have to stop at a gas station)

      * typically don't show labels/values for alert thresholds

Alert thresholds are clearly labeled, and they are also rarely reached (it is rarer for the typical car to go over 140 MPH than it is for a web server to encounter a critical level of dropped requests, for example)

      * even when labels are present, they are still difficult to read quickly
         due to lack of alignment

Labels are legible on vehicle gauges in part because a) there are few of them and b) you know what value interval to expect (i.e. when driving on the highway, my gaze will not start at 0 and go upwards looking for the needle, but rather start instinctively around 60 or so)

      * when displaying multiple gauges of related metrics, you can't visually
         compare them without looking closely

Metrics tend to be fairly independent (i.e. you only ever really need to interpret one at a time) in vehicles.

I'd say it's an historical anomaly that digital interfaces use gauges to display information (precisely because of vehicles), but in vehicles they actually make a lot of sense.

Gauges are not the "comic sans" of dashboard design; they actually are a fantastic solution for a very specific type of information display problem.

But many digital designers resort to them because we are so much used to them, when there are in fact many other options available when displaying more complex/nuanced information. The book that OP recommended (Information Dashboard Design) is a foundational text in that topic and comes highly recommended.

</comment></comment></comment><comment><USER5> Calling it Donuts.css kind of implies its done in CSS exclusively.

<comment><USER6> Looking at the code, the design is mostly done in CSS: the obvious border- radius for the circles, :before pseudo-classes for the origin, and rotate transformations along with transitions for the animated arrow. Circle sizes are based upon the css subclass.

The jQuery only sets the colors and the arrows' angle.

<comment><USER7> Having a tiny bit of JS and having no JS at all is worlds apart. I edited the DOM in my inspector to try to add arrows and change percentages, but nothing happened after I injected new elements.

Had this been entirely in CSS, it would have automatically rendered immediately after modifying the DOM.

<comment><USER8> It's not really possible to do what you want to do (at least not without generating a CSS rule for every possible percentage value), but you can get damn close by calculating the right rotation (apparently "percent * 1.8 - 90") and setting the "transform" properties yourself.

EDIT: here's a "pure CSS" version: <http://codepen.io/tlrobinson/pen/aGvrF>

</comment></comment></comment></comment><comment><USER9> I'm pretty happy with gauge.js for this kind of widget: <http://bernii.github.com/gauge.js/>

<comment><USER10> One difference between the two: guage.js is pixelated on a retina display, Donuts.css is crisp.

<comment><USER11> I can't speak for any of the other features, but gauge also has fancier color "phasing" based on the values -- donuts.css just does red / yellow / green.

</comment></comment></comment><comment><USER8> "Pure" CSS version: <http://codepen.io/tlrobinson/pen/aGvrF>

It generates a rule for each percentage value, so it's not very efficient. Only supports integral percentages.

<comment><USER12> just add a 'transform' under the '-webkit-transform' and it works on ff

</comment></comment><comment><USER13> This is great, and perfect for a project I am working on. Pity the name is not representative.

</comment><comment><USER14> And to see them move - in a Chrome console:

$('.donut-arrow').attr('style','-webkit-transform: rotate(85deg)')

</comment><comment><USER15> Apparently it uses CSS rotate() for the rendering. I'll have to remember that trick.

</comment><comment><USER16> If I change data-percentage, the page needs to be rerendered for the arrow to be updated. Needed to change the transform for the arrow to be changed. Didn't expect that since it's a javascript library.

</comment><comment><USER17> I was hoping it would be a donut made in CSS (mainly because I'm hungry), but I was still quite happy with the results. This is neat, and actually something I was recently looking for! Well done! :)

</comment><comment><USER18> Blocked. Anyone have mirror?

<comment><USER19> Does this work for you?

<http://archive.is/BlN2K>

</comment></comment><comment><USER20> Looks like a very customizable widget. :)

</comment><comment><USER21> Leaving the Yoda at the end of the impress.js demo is pretty lame, especially considering you didn't write it.</comment>


Australia Deploys Sheepdogs to Save a Penguin Colony - <AUTHOR> http://www.nytimes.com/2015/11/05/world/australia/australia-penguins-sheepdogs-foxes-swampy-marsh-farmer-middle-island.html <comment><USER2> I did some research in sheep farming a number of years ago. One farmer told me a story of the incredible skill and instincts of dogs (in this case, Great Pyrenees). I'll give a brief re-telling here.

Farmer had two large flocks of sheep (500+ each). They lived a few kilometers apart. The farmer had about 15 Great Pyrenees dogs that lived with the flocks. Without any training, the dogs would divide themselves amongst the flocks. A 'sentinel' dog would travel back and forth between the flocks and if one had suffered some recent coyote attacks, the sentinel would adjust the number of dogs to increase 'security' at the affected flock. The dogs would remain with the other flock for days until they were able to fight off the coyotes. After the threat was dealt with, the dogs would naturally re-balance between the flocks and the sentinel dog would continue mobile surveillance.

<comment><USER3> I've always wondered what you can train animals to do that you'd need insanely complex robots to reproduce.

<comment><USER4> Walk, run, in unknown territory; turn dog food into energy...

</comment></comment></comment><comment><USER5> I keep 2 maremmas on my small farm to guard my livestock against predation. They are magnificent at what they do, chasing off ground predators as well as aerial ones. They immerse themselves in their flock and guard fiercely, working as a team to keep my chickens from getting eaten. I love how independent they are in their work, though in my case they aren't alone for more than a day at a time: one thing the maremmas can't do is milk my goats for me!

<comment><USER6> Return the favor and offer them homemade chevre as a treat.

<comment><USER5> Worry not, the dogs get plenty of goats' milk and scrambled eggs that their charges produce for them!

<comment><USER6> Dogs, chickens, and goats are a good mix from personal sustainability standpoint. Particularly nutritious milk plus eggs to supplement produce. Cows are way too ungainly. Wondered though whether there were particular goat breeds with more docile dispositions than the ones I've seen which also don't exhibit a wanderlust.

<comment><USER5> My goats are a Nubian/Alpine mix. They produce a fair amount of milk, are good browsers (they're part of our crop rotation plan) and a few shakes of a bucket of grain is all it takes to get them to come in. We have perimeter fencing as there are some things in the garden that would be poisonous for them to eat, and I don't want their snacking to cut in to our floral arrangement sales profit.

With a small herd of just 4 milkers (last springs' kids were given to another farm business who make money leasing goats as natural weed trimmers) they are incredibly friendly, like a strange type of dog. They respond to their names and love a good back scratch from their people!

Now if only the laws in my state (NJ, USA) weren't criminally restrictive when it came to selling raw milk products.. well, more chevre for me!

<comment><USER6> A good read. Thanks for sharing the information. NJ always seemed like a micromanaging politico's paradise. Ever consider relocating to PA, which seems to have no farm raw milk sale restrictions, or even FL along the Gulf? North of Tampa there is a raw goat milk dairy farm which goes by the name 'Fields Place Goats' and maintains the same breeds as yours.

URL: [http://www.fieldsplacegoats.com/lineage.html](http://www.fieldsplacegoats.com/lineage.html)

Just a few idle thoughts. Good luck with your animal husbandry! (and whip up some gourmet Bleu du Bocage for your friends over the winter, but age for a few months before serving)

</comment></comment></comment></comment></comment></comment><comment><USER7> I watched the film _Oddball_ with my son, it was actually pretty awesome. It's got Alan Tudyk, and the guy who played _Kenny_ (Shane Jacobson), which is a guy who has a passion for portable dunnies (key movie quote "There's a smell in here that will outlast religion") [1].

Watch them both if you want to understand Aussie culture :-)

1\. [http://www.imdb.com/title/tt0822389/quotes](http://www.imdb.com/title/tt0822389/quotes)

</comment><comment><USER8> When we finally make it to another planet, we will probably accidentally bring rats and cockroaches, but I cannot imagine not having work dogs along for the rest of the ride.

</comment><comment><USER9> Saw this on the BBC last night. This is taking the idea of re-purposing to a new level.

</comment><comment><USER10> Warrnambool native here.

The problem with Middle Island is that it is occasionally land-bound. Building Warrnambool's iconic breakwater causes siltage to build up at the mouth of the Merri so it's not so much that foxes got onto the island but that they have access when the sandbars build up. Culling the foxes has never really worked either, so it's good to see something else being done to mitigate the damage we cause. There's a number of islands there but most are constantly land-bound so the penguins don't have much of a chance against foxes and feral cats. Middle island is their last refuge in the area.

</comment><comment><USER11> Some friends of mine have alpacas to protect their chooks and other animals from foxes. They will just stomp them into the ground.</comment>


Color Spaces for Human Beings (2012) - <AUTHOR> http://www.boronine.com/2012/03/26/Color-Spaces-for-Human-Beings/

<comment><USER2> And they get it wrong right out of the gate.

There is a distinction between a colour encoding model and a colour space.

RGB is a relative colour encoding model, not a colour space.

More poorly written misinformation to keep confusing the "humans."

<comment><USER3> I'll agree that "color space" isn't the most useful term because it's pretty vague, but there's really not a meaningful "distinction between a color encoding model and a color space", sorry; "color encoding model" isn't a standard term, and is also not very descriptive. Moreover, "relative color encoding model" isn't a term used by anyone ever and doesn't have a prima facie obvious definition, so nobody is going to understand precisely what you mean by it.

I'd rather see terms like "color appearance model" or "color order system" or "device-dependent color space" etc., but using vague generic terms is occasionally appropriate, so we shouldn't totally chuck them out.

In any case, such semantic quibbling is all fairly irrelevant to anything, and has very little bearing on whether the page under discussion is "misinformation".

<comment><USER2> RGB is a colour model.

It is misinformation.

The reason that a given HSL / HSV implementation may not accurately deliver a given chromaticity vector has more to do with the nature of colour spaces than the model's implementation implicitly.

So I disagree, it is misinformation, and the reasons for choosing a given color model / colour encoding scheme are varied.

An incorrect and simple answer for a complex series of problems.

<comment><USER3> Sorry to sound negative here, I'm not trying to discourage you. You seem to have a bunch of misconceptions about color and color science. My primary recommendation is to try reading a couple books about the subject, which should help you get a better grip on the parts you're currently missing.

> _RGB is a colour model_

Without some further qualification, "color model" and "color space" are effectively synonyms.

> _It is misinformation._

There's really nothing particularly wrong with the linked article. I don't like the author's proposed HUSL space, but his explanation of why HSL and HSV are bad tools is straightforward and reasonable.

> ... _a given HSL / HSV implementation may not accurately deliver a given > chromaticity vector_ ...

In a technical sense, "chromaticity vector" is not very meaningful as a term when discussing gamma-corrected RGB coordinates, and is _completely meaningless_ w/r/t HSL or HSV. Chromaticity is a precise technical term, referring to the projection of trichromatic matching functions onto a two- dimensional plane perpendicular to luminance. When people talk about "chromaticity" they usually either mean xy coordinates in xyY space, or sometimes u', v' coordinates, or very occasionally some other chromaticity plane, such as more recent spaces based on more explicit measurements of human cone responses. The Cr and Cb coordinates of a Y'CrCb model are sometimes referred to as "chromaticity" coordinates, but in a technical sense that is a wrong and misleading term to use.

I'm not sure what "given chromaticity vector" you are talking about, but if you want to get chromaticity from R'G'B' values, you should first linearize them, then transform from RGB -> XYZ, and then divide by Y to find x and y.

> ... _has more to do with the nature of colour spaces than the model 's > implementation implicitly_

This is not a comprehensible string of words. I've spent more than a decade studying color science, color reproduction, etc., and I don't have the foggiest idea what you're getting at.

<comment><USER4> Thanks for that, terminology is important in any domain but I found it to be decisive when you talk about colour science. A lot of people are using incorrect terms in incorrect contexts which leads to even more confusion.

</comment></comment></comment></comment></comment><comment><USER3> My comment about this from last week: [https://news.ycombinator.com/item?id=9713814](https://news.ycombinator.com/item?id=9713814)</comment>


China has passed a national security law for Hong Kong - <AUTHOR> https://www.bbc.com/news/world-asia-china-52765838 <comment><USER2> This is the death knell for Hong Kong and for One Country, Two Systems -- which has effectively been over in Macau for years.

I can't help but wonder if things would have been different if the US had different leadership -- actually interested in furthering the cause of freedom and democracy throughout the world. While of course the UK is responsible for policing the handover agreement, it's been too busy staring down its own irrelevance while nursing the self-inflicted gaping wound of Brexit. I tip my hat to Beijing, they sure did know when to strike.

It'll be very interesting to see if the UK goes through with it's offer to provide a path to citizenship for 3 million HK'ers. Frankly, it's the least they could do.

It's probably time to learn Mandarin, huh?

<comment><USER3> >> It'll be very interesting to see if the UK goes through with it's offer to provide a path to citizenship for 3 million HK'ers. Frankly, it's the least they could do.

As far as I can tell, a lot of Brexit was driven by anti-foreigner anti- immigration sentiment due to how easy it was for non-skilled people from other countries to enter into the UK? If so, I think that although Britons might be emotionally fine with that offer in the heat of things, they might not be so OK once they remember the negative emotions that drove Brexit in the first place. Either that, or Britons are extremely selective and discriminatory on who gets to get a pass for immigration (but that wouldn't surprise me).

And then there's the other interesting factor in the wave of anti-Asian racism due to COVID-19-induced negative emotions, which the UK has also been experiencing. [https://www.scmp.com/magazines/post-magazine/long- reads/arti...](https://www.scmp.com/magazines/post-magazine/long- reads/article/3086438/how-east-asians-uk-are-fighting-back-against)

If they go through with the offer to provide a path for citizenship for 3 million HK'ers, I think that's a decision that will force the general population to realize that they have a ton of cognitive dissonance all over the place. Or they won't, and they'll act like everything's normal and as it should be.

<comment><USER2> As far as I can tell, Brexit was largely driven by discontent around Polish migration. There's over a million Polish citizens in the UK. This is a pretty good read [1].

[1] [https://www.humanityinaction.org/knowledge_detail/understand...](https://www.humanityinaction.org/knowledge_detail/understanding- the-brexit-vote-the-impact-of-polish-immigrants-on-euroscepticism/)

<comment><USER4> Poles are well thought of here. The meme of the hard working Polish builder is well known.

I think one Pro-brexit faction created disinformation around Romanian immigrants.

The other main brexit faction created a meme around "taking back control" from bureaucrats.

Neither is based on reality.

<comment><USER5> So ok, honestly trying to understand this. You are saying a massive country- wide vote was decided based on a couple of bizarre myths ("Romanians and bureaucrats") propagated for some reason by some vaguely motivated groups, and majority (slim, but nonetheless) of the country made a decision on some ridiculous myths that have no basis in reality.

What was the motivation for these lie-spreading groups to propagate those myths?

How could a majority of a Western, best-educated probably in the whole world, about as democratic and core-value-believing country, be in a single moment swayed by a bunch of scammers like that? Was there any other basis for that, perhaps? Again, honest question, I know almost nothing about British politics, but dismissing a major vote in a very rich and educated country as lunacy seems ... not a great explanation?

<comment><USER4> The two groups are were Vote Leave and Leave EU.

I don't want to derails a discussion about China effectively ending One Country Two Systems further but you can easily search for a description of their tactics if you want.

You can also search for news on when the UK government report in to Russian interference in the vote will be released but I wouldn't hold your breath...

Now back to what China is doing to the people of Hong Kong and why our companies are still outsourcing manufacturing to China without restriction.

<comment><USER6> >You can also search for news on when the UK government report in to Russian interference in the vote will be released but I wouldn't hold your breath...

Just like in the US, right? ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> As someone who lives inside China I just hope this will encourage more direct and indirect confrontations with the system that defines the current central government i.e. among the intellects and influentials in China, now that a pillar of the freedom of Chinese expression is on its way to unnatural erosion under the paradigm introduced by this new law unto Hong Kong, that of which used to be where grey areas of Chinese politics surface themselves without cease, and where parts of the contemporary Chinese history are still being played on record, untampered.

<comment><USER8> What is the incentive for someone to "confront" the system in China? It means imprisonment, career destruction, the destruction of their family's wealth and well-being, and possibly death.

The way to change a belligerent governmental system isn't through direct confrontation unless you can literally mobilize a majority of the population - it is by changing it from within. Become part of the system, spread an ideology, and change it where you can.

The protest mentality in Hong Kong just provided optical cover for Beijing to accelerate their plans to implement centralized governance.

The peaceful protests had some positive impact, but directly confronting the Chinese government through violent protests in Hong Kong made things worse, not better.

<comment><USER7> "Be extremely subtle even to the point of formlessness. Be extremely mysterious even to the point of soundlessness. Thereby you can be the director of the opponent's fate." ― Sun Tzu

I speak not of confrontation with the central government but confrontation with many aspects of the things in "the system" that currently underlines and defines how the cerntral government thinks and operates.

The ambiguities introduced by the word "system" here is in no means unintentional in that it needs not even be political or geopolitical: it can be cultural, it can be like you said ideological, it can be legalistic, it can be infrastructural or componential, it can even be technological, transnational, game theoretical, self-regulatory, etc. It's a board spectrum having to do with the emergent phenomena in the power structures that spread across different industries and establishments in and outside of China. As much as the Chinese central government is central and monolithic in nature, there are many shades to it, and for everyone involved in running this conglomerate (including those at the top) it is a constrained optimization problem to survive, diversify future risks, etc. Ultimately we are dealing with human nature and the status quo here. There are some beauties and there are lots of ugliness. But it is definitely not immutable. It will continue to change.

What they are currently doing to Hong Kong is shooting themselves in their own foot. It is a very short-sighted move and likely they are aware of the many cons that come with it too. Now the question is what they are going to do next to minimise damage and how the system that constraints them can be confronted to encourage more freedom of Chinese expression.

In the next twenty years China will probably overtake the States in terms of market sizes, but very unlikely in terms of science, art, technologies, etc. And without all those wonderful human endeavors China as of now is and will continue to be (if there are no changes) pretty much just one giant sweatshop, except for small parts of Beijing and Shanghai, etc where the manufactured consent are being examined and there are still traces of liberal arts (and also maybe parts of Yunnan where the hippies live). One could argue that it was necessary for China to position itself as a sweatshop in the post-Mao era (1975~1989) under the darwinism-inspired mindset on national progress [1], but as times change we are coming to a point where "the system" needs to be adjusted to encourage more freedom of Chinese expression and confrontations challenging the status quo. The act of postponing it or doing things aimed to diminish it is very short-sighted, backward-thinking, self-mutilating, and sad, and it would continue to screw up the reward systems of capitalism for innovation domestically, and to an increasing degree around the world due to its sheer market size. And I hope that is not the direction we as a civilisation is heading towards.

"The supreme art of war is to subdue the enemy without fighting." ― Sun Tzu, The Art of War

Confrontation needs not be violent.

[1]: [https://www.jstor.org/stable/j.ctt1tg5mmd](https://www.jstor.org/stable/j.ctt1tg5mmd)

<comment><USER8> Then the word "confront" is wrong to use, because 99% of the people reading your first comment would not interpret it by the Sun Tzu interpretation.

</comment></comment></comment></comment><comment><AUTHOR> Removed from title is that it just passed and is going to be enforced going forth from July 1st. Less than 24 hours.

This is key because July 1st used to be the annual HK march since 1997, or the hand over.

[https://en.wikipedia.org/wiki/Hong_Kong_1_July_marches](https://en.wikipedia.org/wiki/Hong_Kong_1_July_marches)

</comment><comment><USER9> I thought China would wait to take Taiwan first, so they could limit resistance in Taiwan by saying "we'll let you have your own system like we did in Hong Kong." Now that China has reneged on Hong Kong, Taiwan won't believe them.

<comment><USER10> That's basically exactly what happened with the last presidential election. The pro-China (conservative) party was heavily favored to win and then suddenly the Hong Kong protests ignited and reminded Taiwanese about China and the pro-USA party (liberals) ended up winning in a landslide.

<comment><USER11> I hope we (the US) can clean up our act so we can go back to having at least some credibility in the world again. (other than just being rich and having a lot of guns) I'd love for us to be worthy of the praise we get from some places.

I can't say that I've been particularly "proud" to say that I'm an American when I started travelling abroad a few years ago. Hard for people to miss though, I sound like a stereotypical Midwestern radio announcer.

Well, maybe except for that one very plastered German guy who kept yelling at us for being English at Oktoberfest.

</comment></comment></comment><comment><USER12> I know this is not on many people's radar right now, but I strongly believe the rise of Xi's authoritarian nationalism is the biggest story of this century (after global warming).

And this is our generation's "Berlin wall moment". By itself, you might look at this law (after it's published) and not see anything bad. But in the greater context of Chinese policy choices of the last few years, this is nothing less than the signal to end democratic open society in another part of the world.

This is not just about Hong Kong. It's about a small group of powerful people thinking they can create a new order where they can do whatever they want to their own people, their neighbors and the world. They take full advantage of the naivety and openness of our global open system while openly threatening anyone who dares speak out, be it individual Canadians or Australians, the Indian state, a twitch Streamer or a Hong Kong comedian.

So, Is there anything we can do?

some ideas...

\- call to boycott the Beijing 2022 Winter olympics

\- share the story of the Uyghurs. Today's news include proof that Uyghur women are being sterilized en masse: [https://apnews.com/269b3de1af34e17c1941a514f78d764c](https://apnews.com/269b3de1af34e17c1941a514f78d764c)

\- if a company does not list Taiwan as an independent country, they are in effect performing appeasement politics. Increase the cost of doing business with dictators by loudly calling out these companies. Don't be shy, they are getting much more pressure from the Chinese side. It is time to pick a side.

\- more importantly, do NOT tolerate any discrimination towards Chinese. It's immoral and increases support for the regime: [https://twitter.com/jenjpan/status/1277664711325048832?s=21](https://twitter.com/jenjpan/status/1277664711325048832?s=21)

... at least, that's what I can come up with in 10 minutes. I'm sure there's much. We need to move the Overton window on this people, the longer we let this go on, the bigger the consequences will be.

<comment><USER13> Not sure why this is downvoted, so plz have an upvote!

<comment><USER14> Posts that are critical of China's gov. will automatically get downvotes from a particular subset of people.

<comment><USER12> I see my post going up and down, it's a true roller coaster, haha.

</comment></comment></comment></comment><comment><USER15> It's 2020 and humanity is really scared of democracy.

<comment><USER8> There are many forces out there that are actively trying to diminish the global public's respect for democracy.

It involves slowly eroding people's respect for the core principles we always associated with democracy...

The First Amendment? We don't need that since Hate speech shouldn't be protected - and there's the Paradox of Tolerance!

Second Amendment? We don't need that - no population could ever hope to topple the military anyway!

Judicial process? Who needs a court, when I can organize a mob to get stuff done? Besides, the courts are hopelessly corrupt rapists!

Executive branch? The police are racist belligerents who should be defunded and removed, and the Military has a long history of war crimes!

Legislative Branch? Oh, that decrepit thing? Votes aren't proportionate so the small states have all the power - controlled by racists. We need a revolution!

US History? It's all based on genocide and slavery. That's all we should teach.

Statues / monuments? We need to tear it all down. They were all racist slave owners.

When you destroy everything people believe in - it's a lot easier to get them to embrace something more extremist.

</comment></comment><comment><USER16> This makes me sad. I loved Hong Kong the way it was and had held out some hope that it can. stay more or less that way for a while. I knew of course that Hong Kong had a huge uphill battle. But was still waiting for that miracle.

</comment><comment><USER17> The people of Tibet, Taiwan and Hong Kong are all feeling the same about China and now add India to the list with the recent tiktok ban.

</comment><comment><USER18> Besides the politic, I eager to see the moving of the global technology industries with these moving of China. Do hope the technology will go up in spite of war, ban...

</comment><comment><USER19> The core of the communist party follows an unambiguous agenda.

John Garnaut described this very well in his speech "Engineers of the Soul"

[https://sinocism.com/p/engineers-of-the-soul-ideology- in](https://sinocism.com/p/engineers-of-the-soul-ideology-in)

</comment><comment><USER20> The key is still we do NOT have a copy of the law on us. That is how dead our system is. This is the end. See you on the other side.</comment>