Wikimedia warns EU copyright reform threatens the 'vibrant free web' - <AUTHOR> https://techcrunch.com/2018/09/04/wikimedia-warns-eu-copyright-reform-threatens-the-vibrant-free-web/ <comment><USER2> Article 13 is the key one, mandating upload filtering. This has all sorts of side effects - suddenly you can't make a Dropbox style file sharing site without implementing pre-emptive filtering. You can't rely on notify-and- takedown.

Article 11 potentially has huge implications for social media sites; suddenly a user posting a news article link with a quote becomes a copyright liability.

All the worry that was focused on the GDPR should be focused on this instead, in my opinion.

<comment><USER3> Absolutely agree. Both articles are a huge mistake for EU and will have incredibly negative impact on users and DSPs while favoring rights holders.

The status quo favors DSPs (and indirectly users) but damages rights holders. A solution is badly needed, however it should be one balancing needs of all 3 groups instead of favoring one (or two).

<comment><USER4> Why should there be "balancing"? The entire premise of copiright is just wrong to begin with.

Here we have this perfectly anti-rival public good produced. But of course anti-rival just doesn't work that well with free market economics, you know with the externalities and all. And since we just can't imagine any other form of work allocation schemes than the free market, what to do?!

Naturally the most obvious thing, destroy the pesky anti-rival externalities. Let's waste as much effort, and misery, as it takes to force it into the shape of the rival goods we all know and love.

It's quite sad really.

<comment><USER3> I'm sorry but I don't think I follow.

You disagree with the notion, that people that produce content should be paid for it?

I do believe that correct attribution and fair compensation is vital to get quality content. These proposals are not the answer though.

<comment><USER5> > You disagree with the notion, that people that produce content should be > paid for it?

Nobody disagrees with that.

The fact is copyright exists to create _artificial_ scarcity. "Content", once produced, is not scarce in any way; that's why the scarcity is artificial. These laws exist to force everybody to pretend that isn't how things work. It's fundamentally dishonest. It is trivial to copy and distribute "content". People have been doing it since computers were a thing and ironically they do it better than the copyright owners themselves.

It's up to the industry to find some other way to pay people. I don't really care how they're going to do it, and frankly it's nobody else's problem but their own. Instead of concentrating on a new business model, they keep embarrassing themselves with endless anti-piracy measures that do nothing but make the DRM-free copy look better than the original.

<comment><USER3> That's a bit harsh, don't you think? Just because something is easy to copy doesn't mean it doesn't have value. Creators should be paid for their work no matter how simple is to copy. If they are the first one who created it and someone else benefits, then they deserve to be compensated.

My best solution would be something along these lines [https://news.ycombinator.com/item?id=17913535](https://news.ycombinator.com/item?id=17913535)

<comment><USER6> It's not harsh. Although I disagree with his solution- we need copy right, but copy-rights have been terrible for us.

However - Have people (on HN) forgotten how the content companies enforce copy right ? The RiAa/MPAA?

Copy rights were to help creators earn return on their creation. Today copy rights extend far beyond the natural life of the creator and are constantly being extended to favor corporations/owners, at the expense of the commons.

The lotr will never enter the public domain. And Disney is one of the greatest problems in this field. (And now they own Fox!)

Packet sniffing was created for the *AAs. Massive invasions of privacy and the initial subversion of the internet traces to their doorstep.

Copy right was one of the first fights of the collective group of people who landed up on /. And HN

<comment><USER7> > Packet sniffing was created for the _AAs

I'm pretty sure tcpdump predates Napster and any involvement of the _AAs in the workings of the Internet...

<comment><USER6> Nope - as I recall that was the ISPs defense "we don't know what people are sharing since we can't look into packets"

<comment><USER7> The first version of tcpdump dates from '88[0]. And I'm not sure it was even the first sniffer out there, quite likely not.

[0] [https://en.wikipedia.org/wiki/Tcpdump](https://en.wikipedia.org/wiki/Tcpdump)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Can we just agree to silo off the EU? Why should foreign companies have to comply with these policies anyway? GDPR compliance has already had a negative impact on web UX.

<comment><USER9> >Why should foreign companies have to comply with these policies anyway?

Because they want revenue from EU citizens? Should a car company from China have to comply to US safety regulations when selling cars to US citizens?

>GDPR compliance has already had a negative impact on web UX.

Nah. I've switched off tracking on every website I use often via the popups and I've noticed much faster loading. Imo GDPR has made the web experience better.

<comment><USER8> > Should a car company from China have to comply to US safety regulations when > selling cars to US citizens?

In your example, the car company is implicitly selling to a foreign country. When it comes to software/websites, a user from a foreign country is incidentally served rather than implicitly.

<comment><USER9> Which part of the ip is hard to decode? If you don't like how a country's laws are shaped, then stop selling there. You can't have your pie and eat it too. Either you obey the market laws and sell or you don't. If someone is using a VPN to get around your geo ban, then I think that's the user's implicit choice.

<comment><USER10> Why should the onus of blocking content in some faraway country be on the company publishing it? If you don't want your country's citizens to have access to something, well then, time for a Great Firewall.

<comment><USER9> >If you don't want your country's citizens to have access to something, well then, time for a Great Firewall.

It's not the EU who wants to ban access to something. It's the provider who wants to benefit financially from selling that product( targeted ads) without having to comply to the laws of the country that the selling happens. There is no other market that you get to do that. Why should your web page be different?

</comment></comment></comment></comment></comment></comment><comment><USER11> EU builds a good reputation after setting a good standard with GDPR, some politicians started talking about copying it which made me happy. Now I'm scared again wondering what would happen if they go through with this and politicians everywhere start copying it.

<comment><USER12> Good reputation for what? Government interference in the free web? GDPR was just the first step. Open your eyes.

<comment><USER13> Honestly curious what definition of "free" you're using here? Are you saying that anything moving away from uncontrolled anarchy is cutting away freedom and we therefore shouldn't do that?

The government forbids you to make a company spying in people bathrooms and sell the pictures, would you say that's interference in your free life as well?

<comment><USER14> I don't want to put words in openbasic's mouth, but here I go anyway:

> _what definition of "free" you're using here_

Free as in relatively unencumbered by government regulation. I think it's fair to say based off his "GDPR was just the first step" comment that he views increased government control of the internet as the axis along which the freedom he is referring to is measured.

> _Are you saying that anything moving away from uncontrolled anarchy is > cutting away freedom.._

I take that as a given. Anarchy is the state in which people are unconstrained, and are thus maximally free. Anything short of anarchy implies that there is something limiting people's choices.

> _...and we therefore shouldn 't do that?_

Isn't this basically the entire issue with governments? We give up freedoms in exchange for other benefits. Entire political philosophies devote their energy to the question of how much freedom we should exchange.

> _The government forbids you to make a company spying in people bathrooms and > sell the pictures, would you say that 's interference in your free life as > well?_

Do you really think that openbasic is taking this EU move as a chance to advocate for total anarchy? Or is it more likely that they disagree with this freedom/benefits trade-off and you are strawmanning?

<comment><USER15> >Free as in relatively unencumbered by government regulation. I think it's fair to say based off his "GDPR was just the first step" comment that he views increased government control of the internet as the axis along which the freedom he is referring to is measured.

Freedom in the US and Freedom in the EU are differently defined, in part because of history and culture.

The GDPR takes away some "freedoms to", but, for example, it gives me "freedom from tracking without consent" and "freedom from having my data eternally stored by a third party"/"freedom from having my data _owned_ by a third party", which I think of as valuable freedoms to have.

</comment></comment></comment></comment></comment><comment><USER16> What's with all the comments supporting censorship all of sudden? Every social media site now has hordes of "people" defending censorship. Is it just more european users on social media now? Or is it just government funded trolling? I just don't get it.

Saudi arabia just declared online satire as a cybercrime punishable up to 5 years in prison.

[https://www.france24.com/en/20180904-saudi-arabia- declares-o...](https://www.france24.com/en/20180904-saudi-arabia-declares- online-satire-punishable-offence)

We know how much china and russia loves censorship. And of course europe has a long tradition of censorship.

As americans, we had long hoped that the world would join us and embrace freedom, but it looks more and more like we are forced to join them.

I'd rather keep our freedom and separate the internet into "intranets". There is no european or saudi or chinese or russian websites or tech I need. Let the world have their backwards censorship and lets hold onto our freedom.

If we have to cater to everyone's sensitivities, than that is a race to the lowest common denominator. That means we have no freedom at all.

<comment><USER17> Please understand that for many of us in the EU, freedom of speech as understood and implemented by Americans is not something desirable.

Based solely on my personal experience, most of the people are actually happy on how censorship is handled by our institutions. I've never felt restricted in expressing my opinion in whichever topic we are discussing, and I am actually happy that people preaching racist ideologies (that have cost us a lot in the past) find some obstacles in their way.

I personally don't consider your freedom of speech as inherently superior or the obvious step into progress. As many things in life, it has its pros and cons. Would you deem as "progress" all those echo chambers on the internet where people find support for ideologies that have cost millions of lives in the past?

<comment><USER18> >I've never felt restricted in expressing my opinion in whichever topic we are discussing

Of course, if you belong to a mainstream ideology...

<comment><USER17> In some cases I do, in others I don't. I've never encounter censorship in either of those. Besides, I had some pretty interesting discussions with people expressing ideas which did not agree with my thoughts. If, as you said, I would be on the "mainstream" side, they would have been censored. That did not happen.

</comment></comment></comment></comment><comment><USER19> So what can we, as citizens, do to get the watered-down, "compromise" version of the bill that's still much worse than current laws, but a bit better than this travesty?

</comment><comment><USER20> The WWW is fundamentally broken at this point, perhaps this legislation will completely destroy it and kickstart some other form of network.

</comment><comment><USER21> The EU needs to go.

</comment><comment><USER22> Unfortunately, there isn't a vibrant free web. Wikipedia is about the only major non-ad supported website that normal people visit. Most user content is probably on Facebook or Medium. Most breaking news is first available on twitter. Even independent websites, most likely have Google analytics and Google ads.

From a European point of view, the current copyright situation is just a wealth transfer from European companies who have the copyrights, to American advertising companies.

<comment><USER23> > Wikipedia is about the only major non-ad supported website that normal > people visit.

Which costs $69 million per year to operate, has 300+ employees and requires six million donations. Your example also isn't free.

> Most user content is probably on Facebook or Medium

Medium is less than 1% the size of Wordpress, both in terms of traffic and amount of content. The majority of all content on Wordpress sites is ad free.

The consumer is paying for all of it in one manner or another. If it's a donation, it's coming out of your pocket. If it's an ad, it's data about you being monetized. There is no such thing as free if you're talking about something the size of Wikipedia or similar services.

<comment><USER24> There should be a better mechanism for funding sites like Wikipedia that provide what is effectively a global, common, public good. Perhaps a budget from the UN or something should be set aside for funding projects like Wikimedia, Archive.org, etc.

It's a bit ridiculous that something so important to so many people relies on donations from individuals.

<comment><USER25> One of the problems with that model is it centralizes power in one organization which is subject to the whims of its members. I'd argue that that might guarantee less stability than the current system.

Perhaps a large endowment, like private universities, could work? Enough money to let them invest in a diversified portfolio and run their sites off of the profits.

</comment></comment></comment></comment><comment><USER26> Wikipedia is contributing to the slow death of what could have been, and almost was, a web of independent pages maintained by individuals and groups. I have had a recurring experience of skimming a Wikipedia article, only to get the feeling that the text is familiar - then tracking it down to the book or article that it was lifted from, without attribution. If a "vibrant free web" means routine copyright theft committed by a homogenizing, centralized collective established as some kind of anonymous authority, I can do without it.

<comment><USER27> Please take the next step [https://en.wikipedia.org/wiki/Wikipedia:Text_Copyright_Viola...](https://en.wikipedia.org/wiki/Wikipedia:Text_Copyright_Violations_101)

<comment><USER28> Wikipedia should verify the copyright before allowing changes. It should not be the publishers responsibility to enforce the copyright. Wikipedia should be responsible because they decided they wanted to allow anyone to edit. They should hire moderators, and if they cannot moderate, they should not run a platform of theft.

<comment><USER29> > It should not be the publishers responsibility to enforce the copyright.

Why not?

Copyright is an unnatural right created in the name of encouraging creative output; if the person who owns the rights to control copying a work don't enforce it, _why should the rest of us do it for them?_

<comment><USER30> Don't you have a bloom filter for all content ever created with which you can compare the content?</comment></comment></comment></comment></comment>


Investors are slashing startup valuations–and not even Uber and Airbnb are safe - <AUTHOR> http://qz.com/664468/investors-are-slashing-startup-valuations-and-not-even-uber-and-airbnb-are-safe/ <comment><USER2> Heh, Evernote, down 75%. Ouch.</comment>


Facebook pays $16B for new monetization problem - <AUTHOR> http://www.usatoday.com/story/tech/2014/02/20/facebook-whatsapp-monetization-problem/5641947/

<comment><AUTHOR> I actually think WhatsApp's $1/year revenue thing is a smart idea and that they might well hit the required level of growth, though I would like to know what their actual profit margin is because obviously all that infrastructure doesn't run itself for nothing. so I'm not sure I agree with the analyst here...but that's one of the best-written headlines I've seen outside the Onion.</comment>


List of things to learn for a uni student interested in back end development? - <AUTHOR> * python * django * postgresql * aws * docker * bash * apache * linux
i plan on getting into either data engineering or devops later in my career. for the moment, im just a college student.
what things should i add/remove from this list? <comment><USER2> I would like to add web servers like _nginx_ to your list.

Apart from this, I would ask you to concentrate more on the concepts than the tools that you have chosen. Like you can use tools Django has to build an API server but concentrate more on finding out more about the life cycle of the request that hits the API server.</comment>


"Most serious" Linux privilege-escalation bug ever is under active exploit - <AUTHOR> http://arstechnica.com/security/2016/10/most-serious-linux-privilege-escalation-bug-ever-is-under-active-exploit/#p3 <comment><USER2> Seems to be fixed by this commit (in 4.8.3).

commit 89eeba1594ac641a30b91942961e80fae978f839 Author: Linus Torvalds <email@example.com> Date: Thu Oct 13 13:07:36 2016 -0700

        mm: remove gup_flags FOLL_WRITE games from __get_user_pages()

        commit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 upstream.

        This is an ancient bug that was actually attempted to be fixed once
        (badly) by me eleven years ago in commit 4ceb5db9757a ("Fix
        get_user_pages() race for write access") but that was then undone due to
        problems on s390 by commit f33ea7f404e5 ("fix get_user_pages bug").

        In the meantime, the s390 situation has long been fixed, and we can now
        fix it by checking the pte_dirty() bit properly (and do it better).  The
        s390 dirty bit was implemented in abf09bed3cce ("s390/mm: implement
        software dirty bits") which made it into v3.9.  Earlier kernels will
        have to look at the page state itself.

        Also, the VM has become more scalable, and what used a purely
        theoretical race back then has become easier to trigger.

        To fix it, we introduce a new internal FOLL_COW flag to mark the "yes,
        we already did a COW" rather than play racy games with FOLL_WRITE that
        is very fundamental, and then use the pte dirty flag to validate that
        the FOLL_COW flag is still valid.

<comment><USER3> So it's been a known bug for 11 years? That sounds like a pretty serious issue with the QA and or bug tracking process.

<comment><USER4> It sounds like it wasn't realistically exploitable until recently.

</comment></comment></comment><comment><USER5> At Appcanary, we're thinking about opening up our vulnerability database to be browsable and searchable by the public. If you're not sure which version has the patch for this vulnerability in your distro, here's what we know:

Ubuntu - [https://appcanary.com/vulns/45984](https://appcanary.com/vulns/45984)

Debian - [https://appcanary.com/vulns/45983](https://appcanary.com/vulns/45983)

Amazon Linux - [https://appcanary.com/vulns/45992](https://appcanary.com/vulns/45992)

Centos - no patch yet

If you found this useful, please let me know!

<comment><USER6> Do you keep track of Android releases?

edit: [https://appcanary.com/vulns](https://appcanary.com/vulns) made my browser crawl. Please fix that page.

<comment><USER7> I think you just need more RAM, it's convenient having it all on one page instead of paginated.

<comment><USER6> Do you know any good sites where I could download some more? ;)

<comment><USER8> I think there's some FPGA code somewhere to emulate external RAM...

</comment></comment></comment></comment></comment><comment><USER9> _It 's probably the most serious Linux local privilege escalation ever._

Look, the Azimuth people have forgotten more about reliable exploit development than I have ever known, but, no, as stated, this is clearly not true. Not long ago, pretty much all local privesc bugs were practically 100% reliable.

What I think they mean to say is that this is unusually reliable for a kernel race.

I still think, though, that the right mental model to have regarding Linux privesc bugs is:

1\. If there's a local privesc bug with a published exploit, assume it's 100% reliable.

2\. In almost all cases, whether or not there's a known local privesc bug, assume that code execution on your Linux systems equates to privesc; this is doubly true of machines in your prod deployment environment.

<comment><USER10> You said it: If you are not explicitly on the business of providing external access to your machine, the privesc isn't your problem (it's a problem, and it's bad, though), it's the fact that anybody could exploit the privesc in the first place.

<comment><USER11> no, because a bug like this turns any code execution exploit into remote root...

<comment><USER9> The point is that code execution is almost always remote root, because lots of bugs like this exist. Also: most engineers overestimate the relative value of root vs. simple inside-the-VPC code execution, which is almost always gameover anyways.

<comment><USER12> Thomas has elaborated on this a few times over the years, but to elaborate for people who weren't around for those conversations: if you can make an HTTP request from inside the firewall, which probably doesn't require root, you can pivot the attack to a variety of internal services which are not designed with security in mind. That could let you e.g. reconfigure networking appliances, grab credentials to internal or external services from DevOps-y credential stores, grab all manner of business secrets, pivot to direct SQL access to the DB laundered through e.g. internal analytics dashboards or admin tooling, etc.

</comment></comment></comment></comment></comment><comment><USER13> >However that's hard to do when the vast majority of kernel bugs come from vendor drivers, not the upstream Linux kernel, Stoep said.

Doesn't this actually validate Andrew Tannenbaum's argument[1] over 25 years ago when he said monolithic operating systems are inherently insecure and a rethink is required.

[1] [https://groups.google.com/forum/m/?fromgroups#!topic/comp.os...](https://groups.google.com/forum/m/?fromgroups#!topic/comp.os.minix/wlhw16QWltI)

<comment><USER14> Looks like you are quoting from: [http://arstechnica.com/security/2016/09/linux-kernel- securit...](http://arstechnica.com/security/2016/09/linux-kernel-security- needs-fixing/)

While it's true that vendor drivers living in kernel space is horrible for security... that's somewhat offtopic here. This particular bug is in the memory management system, which is one of those things that kind of has to be in the kernel. A microkernel architecture seemingly would not have helped in this particular case.

<comment><USER15> > This particular bug is in the memory management system, which is one of > those things that kind of has to be in the kernel.

Not really. L4 family (the post-Liedtke world) and Minix3 both have MM out of the kernel.

<comment><USER16> A privilege escalation in MM daemon would still allow you to write and read any user memory. Just not kernel memory or execute anything not covered by memory access capabilities. For nearly all intents and purposes, it is root.

<comment><USER15> Couple things here.

Firstly, as the MM daemon runs on its own process and is well-separated from other code, it is far easier to audit, debug and so on. Its interface is also entirely explicit. There's value in modular programming. It's far more reasonable to expect quality from such a MM daemon than the mess in a random monolith kernel.

Secondly, in seL4, physical pages are capabilities. There might be more than one MM daemon, owning separate sets of capabilities to physical pages. Security-critical memory might be managed by a MM daemon your vulnerable process has no capability to talk to.

Just my two cents.

</comment></comment></comment></comment></comment><comment><USER17>
      CVE-2016-5195

      This flaw allows an attacker with a local system account to
      modify on-disk binaries, bypassing the standard permission
      mechanisms that would prevent modification without an
      appropriate permission set. This is achieved by racing the
      madvise(MADV_DONTNEED) system call while having the page of
      the executable mmapped in memory.

Excellent example why mounting partition with system binaries (such as /usr) read-only is a good idea. CoreOS does this.

[EDIT] added "read-only"

<comment><USER14> As others have pointed out, mounting read-only wouldn't have helped here.

What would have helped:

* Block ptrace() syscall using seccomp.

* Don't mount /proc, or mount it read-only.

As I understand it, those steps would close all attack vectors for this bug.

FWIW, the Sandstorm.io sandbox blocks ptrace() and doesn't mount /proc at all, so I think the bug has never been exploitable by Sansdtorm apps. (Disclosure: I am the tech lead of Sandstorm.)

I think Docker now defaults to mounting /proc read-only and blocking ptrace(), so it may mitigate this vulnerability as well, but I'm not 100% sure about that.

<comment><USER16> Ptrace is not needed for an exploit, you only need to be able to mmap a file. Does not even have to be writable.

<comment><USER14> No, it's more complicated than that. You need one process to mmap a file, and then you need a second process to be writing into the first process's address space while the first process triggers the COW. You can't do it with one process attacking itself.

<comment><USER18> No, it requires only two threads to trigger the race. Two processes are not needed.

<comment><USER14> [https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c13](https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c13)

> _Please note that this mitigation disables ptrace functionality which > debuggers and programs that inspect other processes (virus scanners) use and > thus these programs won 't be operational._

> _The in the wild exploit we are aware of doesn 't work on Red Hat Enterprise > Linux 5 and 6 out of the box because on one side of the race it writes to > /proc/self/mem, but /proc/self/mem is not writable on Red Hat Enterprise > Linux 5 and 6._

Is everyone barking up the wrong tree here?

EDIT: All of the PoCs here use ptrace() or /proc/self/mem. Why would they do that if they didn't need to?

[https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs](https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs)

<comment><USER14> I just talked to amluto who explained that the race can only be triggered by a write that uses the "force" flag to get_user_pages() (a kernel function). /proc/pid/mem and ptrace() do this but regular writes and process_vm_writev() do not.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> See also the dedicated page for this vulnerability, dubbed Dirty COW (for copy-on-write), aka CVE-2016-5195:

[http://dirtycow.ninja/](http://dirtycow.ninja/)

<comment><USER19> Gotta love the dedication with the Dirty COW "swag" web shop and all. Though something tells to me it's just a strange in-joke. Might be the prices? ($1,000 for a mouse pad .. oh, really?)

<comment><USER14> It would appear that the creators of the web site are not even affiliated with the people who found or fixed the bug.

 _" Dirty COW is a community-maintained project for the bug otherwise known as CVE-2016-5195. It is not associated with the Linux Foundation, nor with the original discoverer of this vulnerability. If you would like to contribute go to GitHub."_

Seems fishy.

<comment><USER20> We live in a world where slightly arcane developer jokes are "SWAG squatted"

</comment></comment></comment></comment><comment><USER21> Okay, I have no idea what to do. Not a security engineer, can't follow what this thing does but I do have a couple of VPS's running my blog and a few other things. Now maybe there's an argument that I shouldn't be doing this if I don't completely understand all the ins and outs, but what the hell, I like learning about Linux.

So my question is: is simply updating and upgrading enough to protect me from this MOST DANGEROUS BUG EVER IN THE WORLD OH MY GOD YOU'RE GOING TO END UP PART OF A BOTNET AND HURT LITTLE CHILDREN!!1!!1! Which is how this reads to even a semi-technical reader, I mean I know my way around the command line but I'm at a loss as to what to do here.

Help me out HN please!

</comment><comment><USER22> Since for any serious bug that's published, there's very likely a dozen private or not-yet-found, and also considering on how many networked devices the linux kernel is used, I would really like to see a better upgrade story for Android devices and any other linux-inside gear which doesn't have a distro package manager to apply the fix. As little as I like obstructing tech companies with more laws, especially since most laws don't understand the tech, I feel like laws are the only pressure we can hope for. This is why the abuse of IoT devices is a good thing. It will highlight how dangerous it is to slap a random linux version in some device and never bother with updates. A fleet of smart tvs needs to be hijacked with a stalker trojan that is then used by people to record and later post online private moments of unsuspecting owners of always standby smart tv, amazon echo networked microphones, etc. It's just how the world works before it realize the risks and does something about it.

As an engineer you can argue and plead with management to not release something that you don't intend to provide timely updates with a well- communicated support time. Like a 2 year warranty that's prominently communicated, this would highlight to consumers that it's unsafe to use the device unless disconnected from the network. Just like a car that doesn't pass your local safety regulations is not allowed into public traffic.

Actually, I'm surprised modern cars do not require periodic zero-expenses-for- the-owner software updates at licensed dealerships. You can explain to a driver that tires go bad because they drove X miles and have to be paid for, but you cannot argue that software updates need to be paid for because from the time they bought it Y days have passed. Take the Samsung battery optimization that went wrong, where the separation layer was a tiny bit too shallow. It's fair to assume some regulation will follow for safety purposes. Similarly, networked devices, which are not (and cannot be?) microcontrollers with mere 500 lines of code, have to be regulated in terms of software updates.

Now you may say the industry will go broke if they're required to provide upgrades, or less devices will be made, but I think this will lead to consolidation of the software stack, which is mostly a good thing, as those who want to produce dozens of cheap IoT devices can do so without hiring kernel developers. It's like other industries where cheap toy makers source materials like plastic from vendors, knowing it's safe, or create the materials following a detailed recipe which is certified.

<comment><USER23> That's assuming the distributor warranted you against vulnerabilities in his product (and I remember seeing a "Distro X GNU/Linux comes with ABSOLUTELY NO WARRANTY" on every device I've used...). Forcing said warranty is preposterous.

Concerning smartphones there are so many privacy and security issues that are far easier to exploit than something that involves kernel hacking... But anyway, isn't Google rolling out security updates for Android? I use CM and I know they don't. There are projects like Replicant which provide a mostly free distribution, but I don't think they're rolling out security updates either. If you're interested maybe contact them?

<comment><USER22> Are the system (not app) updates Google releases applicable to all Android devices?

It's true that there are a high number of bugs available just in mobile browsers, which do receive google play updates, if you have google play, but viewing the underlying code as verified to be correct would be naive.

If I know that a smart phone or smart fridge will not get software updates and be substantially limited in functionality by that, I wouldn't pay more than 100 bucks for it, because I expect to buy another one in probably 14 months.

However, if the update problem would be fixed properly, I wouldn't mind paying a premium.

It seems that this isn't just laziness by the vendors but also calculated into nudging customers to buy new appliances and gadgets although the hardware is capable and perfectly fine. No vendor would admit to that, but this is being investigated and called planned obsolescence. If the price would reflect the artificially limited lifespan of a device, then the problem goes away, and it's just a matter how much of the materials gets recycled.

</comment></comment></comment><comment><USER24> Cool, this will be great for rooting Android phones to fix this and other security bugs!

<comment><USER25> It's sad that anyone should have to rely on security bugs to take ownership of their own phone...

<comment><USER26> These phones exist, because people are buying them. Other phones that allow unlocking the bootloader also exist.

</comment></comment></comment><comment><USER27> Can someone help me better understand how this works, or perhaps point me to a decent article explaining more of the details? Most of the articles I can find just briefly explain the exploit, but not really how it works (in detail).

From looking at the example code, it seems like the general process is:

\- Open some (normally un-writable) file as read-only and mmap it in to your process.

\- Kick off two threads. One thread to repeatedly write to the same mmap-ed address via /proc/PID/mem and another thread to keep issuing the madvise call.

\- Wait for some race condition to be (un)satisfied such that you're able to write to a cached copy of the file.

What I don't fully understand is how the /proc/PID/mem thing works.

Here's what I'm curious about:

1\. What would happen if you tried to write to the mmap-ed region directly? Since it's been mapped in with "PROT_READ", does this mean that you'll get a segmentation fault or something? From the manpage, it seems like "MAP_PRIVATE" allows it to be a COW mapping, but I don't see how the combination of "PROT_READ" and "MAP_PRIVATE" is even valid. Unless this means that any writes to data copied from the mmap-ed region into other buffers will be COW-ed and that you can't actually write to the mmap-ed region itself? That would make sense to me.

2.How is writing to /proc/PID/mem any different than writing through the mmap- ed region directly? Assume that you weren't running the madvice thread. What would happen then if you tried to write to the /proc/PID/mem file? Presumably the same thing that happens if you just tried to write to the file directly…

3\. Finally, how does the madvice call cause a race condition? I realize this might be a little too much to cover in a comment, but this seems like the meat of it.

</comment><comment><USER28> Curious that the original commit's hash to fix this was never indexed by Google: [https://www.google.com/search?q=f33ea7f404e5&ie=utf-8&oe=utf...](https://www.google.com/search?q=f33ea7f404e5&ie=utf-8&oe=utf-8)

<comment><USER29> It is now, I see 16 results.

</comment></comment><comment><USER30> Doesn't seem like it works on a $10 DigitalOcean droplet (1 vCPU) with grsec- patched 4.4.8. After running for quite some time (which I suspect a system administrator would notice) "cat foo" still outputs the same contents.

<comment><USER31> How much is "quite some time"? It ran for several minutes before eventually succeeding on my fast, modern desktop.

<comment><USER30> The loops finished.

</comment></comment></comment><comment><USER32> I wish someone could explain in simpler terms to us casual users what this means.

If only privileged users can SSH into my server, does this really affect me? In other words, I already allow only SSH users to become root.

</comment><comment><USER33> If I'm reading this correctly it works only when there's already access to a user account on the system. So you need to have an existing vulnerability already [eg an untrusted user].

Interesting whether it will give new root exploits for Android as suggested in the comments.

<comment><USER34> Yes, that is exactly what a privilege escalation bug is.

</comment></comment><comment><USER35> If one's running an LTS version of Ubuntu like 14.04 or 16.04, can one can expect to get an update with the security patch for this?

I'm running Kubuntu 14.04 with the latest security updates, and I'm still on kernel version 3.13.0-98-generic.

        ~ $ lsb_release -a
        No LSB modules are available.
        Distributor ID: Ubuntu
        Description:    Ubuntu 14.04.5 LTS
        Release:        14.04
        Codename:       trusty

        ~ $ uname -a
        Linux anon-pc 3.13.0-98-generic #145-Ubuntu SMP Sat Oct 8 20:13:07 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

No idea why I haven't gotten an update to 4.x. Should I just switch to a rolling release distro like Arch to have the latest updates of everything?

<comment><USER36> Hours ago. apt-get update && apt-get upgrade.

[https://www.ubuntu.com/usn/usn-3105-1/](https://www.ubuntu.com/usn/usn-3105-1/) [http://people.canonical.com/~ubuntu- security/cve/2016/CVE-20...](http://people.canonical.com/~ubuntu- security/cve/2016/CVE-2016-5195.html)

<comment><USER35> It looks like my kernel updates are being held back:

        ~ $ sudo apt-get upgrade
        Reading package lists... Done
        Building dependency tree
        Reading state information... Done
        Calculating upgrade... Done
        The following packages have been kept back:
          ffmpeg libva1 linux-generic linux-headers-generic linux-image-generic
        0 upgraded, 0 newly installed, 0 to remove and 6 not upgraded.

The newest available version of linux-image-generic according to apt-cache showpkg is 188.8.131.52.108. (I'm running 18.104.22.168 right now.) Maybe 3.13.100 has the fix to this bug, but I'll have to figure out what's keeping back linux-kernel-image from being updated.

What's really puzzling though is that I _should have kernle 4.4.x_ , since I'm running Ubuntu 14.04.5, according to the Ubuntu Wiki: [https://wiki.ubuntu.com/Kernel/Support#A14.04.x_Ubuntu_Kerne...](https://wiki.ubuntu.com/Kernel/Support#A14.04.x_Ubuntu_Kernel_Support) It's strange that my Kubuntu installation is frozen on 3.13.x.

<comment><USER37> Note the "HWE" (hardware enablement) on that chart. Ubuntu 14.04 came with 3.13; if you want a 4.4 kernel, you have to install linux-generic-lts-xenial.

<comment><USER35> Thanks, that answers my question! Installing linux-generic-lts-xenial should let me get the 4.4.x kernel on Ubuntu 14.04.

I might still switch to Arch Linux. It's been a hassle to get the latest releases of various packages (like python, gcc, etc). I've had to use third- party PPAs or manually install them. Ubuntu's freezing of packages makes it great as a base image for Docker containers and other reliably reproducible deployment scenarios, but that's not so great as a regular desktop user.

<comment><USER38> I have been using Antergos (Desktop friendly Arch) on and off for a while. If you haven't updated for a while, it could cause problems. After I updated after staying off it for two months I had an x crash. Restarted, no problems, all updates installed.

Chris from LAS does say I believe in User Error 6 or 7 that if you don't update Arch in a while you could have stability issues when you update.

</comment></comment></comment></comment></comment></comment><comment><USER39> The github page [0] states that "The In The Wild exploit relied on using ptrace." Now, I'm wondering what purpose ptrace serves, aside from debuggers? Why don't we just disable this by default on production systems (where you shouldn't be debugging anyhow)?

[0] [https://github.com/dirtycow/dirtycow.github.io/wiki/Vulnerab...](https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails)

<comment><USER40> > production systems (where you shouldn't be debugging anyhow)

I'm not sure about this. Ideally, yes, but if you don't know what's causing an issue it can be difficult to reproduce it, and strace can be phenomenally helpful in figuring out the cause. Of course, you could leave it off until you think you might be in such a situation.

</comment></comment><comment><USER41> Go go armlinux Internet of Things bot army!

</comment><comment><USER42> So the escalation is rw access to privileged files, are LXC and Docker container breakouts prevented then? Also does /proc access through lxcfs or Docker's handling of /proc make any difference?

<comment><USER43> Theoretically, no. LXC or docker will not help against this. Not even against this particular exploit seen in the wild, but that could be mitigated with lxc (maybe docker), partically lxc.container.conf you can set seccomp to drop ptrace syscall which this wild exploit depends on.

Here, it really is a difference between VM and container though.

<comment><USER44> It might protect against the current in-the-wild exploit. It sounds like it modifies a binary/library so if the container doesn't share binaries/libraries with other containers or the root namespace then you are fine. (well fine in the sense that there is no privilege escalation from the container to outside the container or across into another container.) However, there are other interesting read only pages that are shared by everyone that might be targeted (VDSO?).

</comment></comment></comment><comment><USER6> I've filed a bug against Android Nexus/Pixel kernels. Will take a look tomorrow. I'm sure someone else already beat me to the punch.</comment>


Edward Snowden: Contact Tracing is "The Architecture of Oppression" - <AUTHOR> https://www.youtube.com/watch?v=k5OAjnveyJo&list=PLdQ3f4qejD1j37Zjll6GiDJW-ljfCvh7f <comment><AUTHOR> In this video interview Edward Snowden says contract tracing is useless for this pandemic but good for surveillance.

</comment><comment><USER2> This discussion appears related to [https://news.ycombinator.com/item?id=23041146](https://news.ycombinator.com/item?id=23041146).

</comment><comment><USER3> Contact tracing is used successfully in SK. Just sayin.</comment>


Ask HN: Unsanitized query string on donaldjtrump.com - <AUTHOR> Hey all, I was poking around Donald Trump's website for security vulnerabilities and discovered this: http://shop.donaldjtrump.com/?search=%3Cscript%3Ealert%28%22%22%29;%3C/script%3E<p>Although it doesn't actually inject an XSS, it seems to confuse the server, taking it down for about 20 seconds. Any idea what is going on here? <comment><USER2> It is possible that that query is kicking off some extremely resource intensive search although that it really just a guess.

</comment><comment><USER3> It looks like the server is just down. It might have been hugged to death due to people's reactions to the DNC.

Edit: No, you were right. It does take the server down. Weird.

It seems to be based on some product called Volusion.</comment>


Facebook puts global block on Brazil's Bolsonaro supporters - <AUTHOR> https://www.reuters.com/article/us-facebook-brazil/facebook-puts-global-block-on-brazils-bolsonaro-supporters-idUSKBN24X3XC <comment><USER3> The nuance is in the first paragraph:

"Facebook (FB.O) said on Saturday it has put a global block on certain accounts controlled by supporters of Brazil's President Jair Bolsonaro implicated in a fake news inquiry [related to the 2018 elections], a day after it was fined for not complying with a [Brazilian] Supreme Court judge's order to do so."

Update: this is a dupe of [https://news.ycombinator.com/item?id=24025587](https://news.ycombinator.com/item?id=24025587)

<comment><USER4> __A day after it was fined for not complying with a Brazilian Supreme Court judge's order to do so __

And here I was getting angry at Facebook and their censorship. Cheap clickbait is a cheap clickbait.

</comment></comment><comment><USER5> Pet peeve: articles describing people being censored _never_ show you what they were censored for.

Hiding this information makes it look politically motivated. If it's so bad, why isn't the content of the material that got them banned reported on?

"Hate speech allegations" is more than meaningless. It means precisely nothing. What did they actually say?

<comment><USER6> Either hate speech is a thing that causes real world harm and shouldn't be repeated, or the benefits allowing that speech outweigh the harm it does.

People can belong to either school of thought. But if you agree with the first statement, then you should also agree that Reuters publishing hate speech is just as harmful as Facebook publishing it. If you agree with the second, you probably don't think Facebook should take the content down. If that's what you think go ahead, but it's not a tiny peeve - it's a major difference of opinion.

I'm not taking a stance either way, just pointing out the options - <USER2> both block the speech or neither does.

The only illogical thing would be agreeing with Facebook's decision to take the content down but disagreeing with Reuters' decision to not repeat the same content. I can't see how that would work.

<comment> _-___________-_ Before you can discuss any of that, you need to define "hate speech", and that's often where the problems begin.

<comment><USER6> The thrust of my argument isn't the validity of the Brazil court's or Facebook's judgement, it's whether Reuters should follow suit.

So any definition of hate speech is fine, as long as Facebook and Reuters take broadly similar ones.

For argument's sake, let's take Facebook's definition

> We define hate speech as a direct attack on people based on what we call > protected characteristics – race, ethnicity, national origin, religious > affiliation, sexual orientation, caste, sex, gender, gender identity and > serious disease or disability. We protect against attacks on the basis of > age when age is paired with another protected characteristic, and also > provide certain protections for immigration status. We define "attack" as > violent or dehumanising speech, statements of inferiority, or calls for > exclusion or segregation.

[https://www.facebook.com/communitystandards/hate_speech](https://www.facebook.com/communitystandards/hate_speech)

</comment></comment></comment></comment><comment><USER7> Lol I hope they'll do all other regimes as well ;)</comment>


SpiderOak Encryptr password manager released - <AUTHOR> https://spideroak.com/solutions/encryptr <comment><USER2> Downloaded the desktop and android client today after I got their e-mail. I've been looking for something to replace LastPass so I'm hoping this does the trick.

</comment><comment><AUTHOR> It's nice that the Android APK is available as a direct download, no Play store required, for those who are particularly security/privacy conscious</comment>


Net filter trials 'unlawful', claims engineer - <AUTHOR> http://www.zdnet.com.au/net-filter-trials-unlawful-claims-engineer-339304184.htm

<comment><USER2> It is nice to see how reserved this guy is being - just quietly pressing forward with his questions. I hope he manages to highlight some of the hypocrisy the Australian government is engaged in right now.

At about this point in the Google Wifi sniffing beatup Stephen Conroy (Minister for Broadband) was waxing lyrical about how Google was creepy, how they deliberately sniffed people's bank passwords etc... It would be sweet justice to see him charged with a criminal offence based on his own hyperbole.</comment>


Is it possible to build a scalable, micro-service architecture for free? - <AUTHOR> Is it possible to build the foundation of a scalable, micro-service architecture for free using free tier services like Heroku and Amazon DynamoDB?  If so, what components would you leverage and why?  Do you have any experience doing this and if so, how successful was it? <comment><USER2> It definitely is possible...provided that nobody uses it. You don't get charged for data transfer between instances on the same data region, so you could architect the system in a way that takes advantage of that. The problem becomes dealing with the outside world. Once you have users then there is a chance that they would push the one instance that is acting as a portal to the outside world out of the free tier.</comment>


How about a functional programming conference? - <AUTHOR> http://tech.puredanger.com/2012/07/24/functional-programming-conference/ <comment><USER2> I'd love to see a conference that catered to commercial functional language developers. One area I'd like to see more discussion would be the problems/solutions for doing stand-alone/embedded development (iOS/android and industrial embedded work).

Can't wait Alex! Already looking forward to StrangeLoop this year

</comment><comment><USER3> You mean like <http://www.icfpconference.org/>

<comment><USER4> I like to be hopeful and think that FP has gained enough exposure and use for its advocates to support two whole conferences.

<comment><AUTHOR> Yes, exactly. :) FP Days is doing good stuff too. And there are of course very robust single-community conferences for Clojure, Scala, Erlang, etc. But surely we have something to learn across langs.

</comment></comment></comment><comment><USER5> It's in Europe but FP Days is now in its second year aimed explicitly at commercial FP developers and with a multi-language approach.

<http://www.fpdays.net/fpdays2012/index.php> <http://fpday.net/fpday2011/>

I think the different language communities can learn from each other hence the multi-language focus.

</comment><comment><USER6> I'd enjoy an FP exclusive for sure. It would be a great excuse for a place to hash out both philosophical as well as practical conjectures</comment>


Untold History of AI: Algorithmic Bias Was Born in the 1980s - <AUTHOR> https://spectrum.ieee.org/tech-talk/tech-history/dawn-of-electronics/untold-history-of-ai-the-birth-of-machine-bias <comment><USER2> Tangential comment: When I first learned how long ML has been around I was really surprised. Markov chains were invented more than a hundred years ago. The perceptron was invented in the late 50s - and it's clear now that just a simple perceptron can do a _lot_ of fairly impressive things. Backprop was first worked on in the late 60s. RNNs have been around since the 80s.

It feels like ML is such a recent thing, but it's really just that we've only recently gotten to the levels of hardware and data needed to make these algorithms work smoothly. It makes me wonder what other interesting theories are still gated by hardware limitations. I think astronomy has had similar situations where things have been figured out long before they were actually observed.

<comment><USER3> Machine learning libraries have been around for a long time also. I remember seeing them around and playing with them in the late 90s, without really knowing what to do with them. For some reason, few people cared about them then, much like few people took virtual reality very seriously at the time. Interest in these things swings back and forth like a pendulum. It seems that you can pick almost any uninteresting thing that no one cares about anymore and work on it, and soon enough, it will be back in the spotlight again.

<comment><USER3> At one point, naive Bayesian classifiers were considered machine learning. Now we use them for spam filters. Chess playing algorithms were also considered machine learning at one point. We keep moving the goalposts. We won't ever reach a specific point of concluding that we have intelligent machines. There won't be a breakthrough, much like living organisms never had an intelligence breakthrough; they just gradually became more and more intelligent through incremental development.

</comment></comment></comment><comment><USER4> In the 1980s, they had to explicate their biases in order to make the algorithm's predictions correlate well with human judgment. Today we can just use neural nets to learn our biases for us.</comment>


Introducing R to a non-programmer in one hour - <AUTHOR> http://alyssafrazee.com/introducing-R.html <comment><USER2> Per the comments on the article I'd also advise "<-" for assignment rather than "=", reasons (in no particular order):

1) Google says so: [http://google- styleguide.googlecode.com/svn/trunk/Rguide.xml](http://google- styleguide.googlecode.com/svn/trunk/Rguide.xml)

2) It's the accepted convention of the language. When she looks things up of SO, they'll use it; if she looks at a package's source, they'll use it.

3) In RStudio it's "option+hypen" (Mac) to type the four-character " <\- ", so no extra typing required.

4) Statistically-speaking, things like x = x + 1 makes no sense

5) You need "<<-" for the occasional global

6) 2 -> x

<comment><USER3> Also, a language shouldn't use the same operator for declaration (initialization in dynamic languages) and assignment imho.

<comment><USER4> Just to be clear, R doesn't ever use the same operator for both, it uses == for comparison like C and Python. That being said, extra differentiation is a bonus.

</comment></comment></comment><comment><USER5> There's not much you can actually teach to someone in an hour, especially about programming. So much of it is dependent on other computer skills...I once taught a class for _five hours_ of introductory programming, and while some people learned things, we were frequently caught up in things like people saving filenames of "folder/hello.rb"...that is, the forward-slash was part of the filename, not the path...which I didn't even know was possible on any platform.

But what you _can_ get across, and the OP seems to have done this, is how accessible programming can be. I don't know about RStudio, but jumping into a REPL is easy enough in any modern languages, as is running a script. We take it for granted, but very very few people who haven't programmed realize that a "program" is simply composed of text. Hell. most people don't understand that about web pages.

So even if you won't teach much in an hour, overcoming that intimidation factor of "where/how do I even start?" is still pretty huge.

<comment><USER6> RStudio is the best IDE I've ever used and I wish something like that existed for other programming languages. The default workspace is split into the script, data, terminal, and meta (files/charts/help), and selecting a data frame variable will display it in a formatted window, making it very, very easy to debug data issues (I'm attempting to switch from R to Python/pandas due to performance/package issues, and I'm having much more difficulty debugging code.)

<comment><USER7> Check out Spyder if you are doing Science stuff with python: [https://code.google.com/p/spyderlib/](https://code.google.com/p/spyderlib/)

<comment><USER6> Actually, that looks right up my alley. Thanks!

</comment></comment></comment></comment><comment><USER8> Nice, brief, introduction to R. If I might be so bold, I might suggest taking the Coursera "Computing for Data Analyis" class. It's only 4 weeks long and the first lesson covers everything in this blog post and more (I'm actually taking this class now). Though the first class is a bit longer than one hour (but not by much!).

</comment><comment><USER9> As an intro, its well written and documented.

If there is a fail, his sister is a senior in sociology and she "must have" already done significant statistical analysis in class... right? At the very least did some averages using her calculator in high school or something? So there should be substantial opportunity for compare/contrast, assuming his sister is compatible with this learning technique and the author knows anything about what the sister already knows. That would make a remarkably awful non-specific general population introduction.

Also some focus on what she's doing... I did not find generic screwing around with R to be particularly challenging, I found "how do I connect R to my enormous database cluster in an intelligent fast simple way" to be a huge problem when starting out. OK I can average and std dev five hand entered numbers, that's very easy, now how about a complicated multi-site relational database with 1M records? She may have a totally different challenge, like all her raw data is CSV format or something.

R is fun once you climb that vertical learning curve wall at the start and generate your first live result. The learning curve is very easy after that first result.

<comment><USER10> The author of this piece is a woman.

<comment><USER9> Luckily it doesn't change my response in any way other than in addition to all the "he" translating to "the author" all the "she" should refer to "the author's sister". I'm a "he" who provided software support to my sister, so you can see the likely source of that assumption. No negative implication of her ability to successfully portray her chosen gender role intended.

Also I think its lame to check out bylines to make sure I run stuff thru the right sexism filter; I clearly stated its a "good" article; not "good, for a girl" article, or "not up to the manly standards of excellence" article.

<comment><USER11> It's not a byline. It's the name of the website, the name of the window when opened in Safari, it's _got her picture right next to the text_.

You might not have belittled her because she's a woman, but simply assuming "Programming article = male by default" is in and of itself harmful.

</comment></comment></comment></comment><comment><USER12> In my experience, non-programmers are the only people who can grok R in the first hour.

<comment><USER13> I'm not so sure. A few years ago in university I took a stats course (offered by the maths department) that had twice-weekly mandatory labs where we learned and used R. Most people in the course were not programmers at all, and I ended up helping people most of the time during the course.

R is really weird, but non-programmers are typically unaccustomed to precisely typing non-english into a computer. They aren't trained to quickly spot syntax errors or grok error messages.

</comment></comment><comment><USER14> Nice post. I've recently been trying to get back into R with the goal of being able to replace Excel. For the basic stuff R is great but as you start doing more complicated things it takes quite a while to figure out to do them in R. This is a part of the learning curve.

<comment><USER15> I really like Excel for adding up columns of numbers. Any task where you want to see the data (and the quantity of data is low enough to realistically be seen) and the operations performed on the data are relatively simple and straight-forward.

But once the operations start getting more involved, I really start disliking Excel (or any spreadsheet). Excel shows the data but hides the formulas. At this point, I very much prefer a script.

<comment><USER14> Something I've been thinking about is an Excel frontend with an R backend. Each worksheet becomes a data frame so you can edit it in Excel and quickly apply some formula but you can also jump into an R console to do something more complicated.

<comment><USER16> Have a look at DataNitro for a similar idea with python as the backend: [https://datanitro.com/](https://datanitro.com/)

I've never used it, but it looks quite nifty.

It would certainly be interesting to see something similar for R.</comment></comment></comment></comment>


Skype hands 16-year-old's personal information to IT company - <AUTHOR> http://www.nu.nl/internet/2950158/skype-hands-16-year-olds-personal-information-to-it-company.html

<comment><USER2> > Gommers contacted Skype, another of his firm's clients, and asked them for > the suspect's account data.

This seems to be an ongoing theme: personal relationships causing people to do unethical things. It's particularly true in journalism. You want to help your friend, right? You don't want to make them mad.

Standards (like Skype's alleged "policy") need to be better, and much more strictly enforced.

<comment><USER3> If this were the case I would argue that the bigger problem is the apparently very easy accessibility of client data to employees.

<comment><USER4> Yes! Training people to not be human is much harder than just maximizing accountability and minimizing opportunity for people to do the wrong thing.

</comment></comment></comment><comment><USER5> Way to go iSIGHT! That's what we always dreamed the "infosec" industry would be! A bunch of for-hire goons willing to do the dirty work for private companies. Fun fun fun!

</comment><comment><USER6> "The company says it is reviewing how personal information came into the hands of a private firm."

I thought that was pretty clear from the article - they asked.

</comment><comment><USER7> If I were to guess, Skype is probably the most privacy breaching communication tool there is right now. They are giving the information _way_ too easily to pretty much any type or level of law enforcement right now, from police to national security agencies and anyone in between, and it's not just US either.

<comment><USER8> Wait so is this a "guess" or fact?

<comment><USER9> It's a well-informed classificaton, and he openly called is his "guess". Declaring something "the most privacy breaching software" is inherently subjective and arbitrary, so I don't think anyone here is stupid enough to think that's being passed off as fact. This is obviously just his opinion and you're entitled to disagree, but we've all seen Skype in similar headlines before - do you have a more interesting counterargument?</comment></comment></comment>


How Steve Jobs' Love of Simplicity Fueled A Design Revolution - <AUTHOR> http://www.smithsonianmag.com/arts-culture/How-Steve-Jobs-Love-of-Simplicity-Fueled-A-Design-Revolution-166251016.html

<comment><USER2> How Dennis Ritchie's love of simplicity fueled everything that now matters in computing, including the operating systems and software Steve Jobs used to "fuel a design revolution".

Apple makes beautiful hardware, but does that amount to simplicity? If the focus is Apple software, maybe in 1977 it was simple, but today it is anything but simple. Restrictive? Yes. Simple? No.

When I want simplicity in software I look to New Jersey, not Cupertino.

<comment><USER3> Can we please get over the (entirely reasonable) hurt feelings about Ritchie not getting the attention Jobs did?

Jobs certainly made a lot of contributions to his field, even if they were in a different area than Ritchie, and it doesn't advance the discourse to constantly yell "BUT THIS OTHER GUY!" whenever someone is memorializing Jobs.

<comment><USER2> No hurt feelings. No yelling. Here's my point: real simplicity is the stuff of Dennis Ritchie. Not Steve Jobs.

As I said, Apple makes beautiful hardware. And you could say they promote a certain "simplicity" of use. Maybe you could even call Apple hardware "simple". I don't know. It's an enclosure with a board inside. What I do know is that once you get to the software side, Jobs is not the guy who should get credit for "simplicity" of design. That guy should be Dennis Ritchie. Alas, many journalists will never know this and write about it, because they don't spend time learning C and UNIX (whereas they do spend time using learning and Apple products that are built with C and UNIX).

It is the simplicity Ritchie gave us, his design philosophy, that allows so much to be created, like the software that drives Apple products. Anyone can create simple things or complex things in software, but we all need to start with something simple in order to do the building. That something is not the work of Steve Jobs. It is the work of Dennis Ritchie and colleagues.

If the title did not use the word "simplicity" I would have no comment. Jobs is a hero of design. But simplicity, to me, is another matter. He is not the true source. Even the early Apple computers where the software was "simple" were not the work of Jobs, but of his co-founder, who is not longer part of Apple.

<comment><USER4> I agree with you: Ritchie's contributions, because they're at the core of so many things we use (including iOS and OSX) are more influential than Jobs' contributions (which are pretty darn influential).

However, please re-read the headline you've got an issue with: "How Steve Jobs' Love of Simplicity Fueled A Design Revolution."

Does the article claim that Jobs' creations were the simplest ever? Or that his simplicity trumped that of Ritchie? No.

Also note that the article is clearly talking about a _design_ revolution. Did Ritchie spark a design revolution? No.

(Well, he did, in operating system design. But that's really not the sense of the word "design" the article is using...)

So I don't understand what your problem is, other than the fact that you don't like Jobs' contributions a great deal. The claims made by the article are utterly orthogonal to the importance of Ritchie's work!

<comment><USER2> "(Well, he did, ... "

That's all I'm saying, really.

I see "simplicity" as orthogonal to the idea that Steve Jobs led a revolution in design. I see the so-called revolution he led as being beautiful hardware enclosures, of all sizes. But this is just my opinion. I expect many would disagree.

I also expect many would not choose to look at these devices past their enclosures and what they see on the screen. From that limited perspective, it certainly looks like Jobs made everything simple. (Me, I think Ritchie and his colleagues did that. They dared to simplify when no one else would. Apple like many others took the ball and ran with it. But unlike many others, they also build hardware that looks fantastic... from a marketing standpoint, this is a winning combination.)

</comment></comment></comment></comment></comment><comment><USER5> How Google's Love of Simplicity Fueled A Web Design Revolution</comment>


The owner of several 1 letter NPM packages - <AUTHOR> https://www.npmjs.com/~zhengzk <comment><USER2> Unlike domain names where people actually pay for them, I think package repositories like npm should punish squatting like GitHub.

For example I contacted GitHub because I wanted an organization name for a company I'm registering in 2017. Their support looked at the organization, which had zero public or private repositories, told me they went beyond a time period of zero activity in which their name could be reclaimed by someone else and I got it (and no they didn't tell me the time period, it was just a vague statement regarding it).

NPM should look at these and if they've been empty for X amount of time, remove them. Now the problem is controlling new squatters so they may need to offer a more complex solution when a name returns to the pool but I think it needs to be done (I know names don't typically return to be re-used in NPM but if they're removing them for squatting I think they should).

<comment><USER3> Good news! npm's dispute policy actually explicitly covers this behaviour. If someone wanted any of these packages, npm would likely be happy to give it to them. You can also report them to have the packages removed by emailing them at email@example.com

Source: [https://www.npmjs.com/policies/disputes](https://www.npmjs.com/policies/disputes)

<comment><USER4> I didn't know about this. Perhaps it should be better publicised?

<comment><USER5> It's right in the footer with a clear name in all NPM's pages... it took me no time when I was looking for it back in the day to find the policy, maybe the problem is you never needed it?

<comment><USER4> You're referring to a link buried within 'Legal Stuff' at the bottom of the page, away from all other actionable sections linked to a package.

I don't think that's even close to being a satisfactory call-to-action.

Whenever I've picked a name for a project, I've always generated them by combining words together with hyphens. If I realised that I could take over package names that were being squatted, there are many times I would have done so.

<comment><USER5> Yes? I mean the one clearly labeled "Package Name Disputes"... it's not like this page needs a big CTA, it's something you'd reasonably expect to find within a "Policy" or "Terms of Service" page but instead it has a link on every footer.

And actually... "Package name disputes" are mentioned in different ways within 5 of the 6 links in the "Legal stuff" section, so I am pretty sure that it's just for lack of reading/searching, not because they are actively trying to hide it.

<comment><USER4> If a package has only one published version with no dependents or real users, the call-to-action should be a button near the top of the screen that should describe the action expected (e.g. "claim package name").

Clicking on this button should start a partly-automated, formal process and not require writing an email or manually soliciting contact with the original owner. This process can then be managed by NPM, who can stop relying on hearsay over whether these disputes are being resolved.

The only reason to bury this within the 'Legal Stuff' section is when you erroneously assume that this action is likely to be a legal issue and informed by patent, trademark or copyright law.

The current solution is cumbersome, not pointed to sufficiently, and likely to become progressively worse as the NPM ecosystem expands. I'd bet many NPM users aren't familiar with this resolution process. (Apart from those that remember the kik and left-pad debacles. "hahah, you're actually being a dick. so, fuck you. don't e-mail me back.")

All I'm saying is that this process needs to be clear, structured and measurable.

If NPM was doing a good job here, this HN post would never have been upvoted.

<comment><USER5> I agree with that, it could be improved and automatically detect abusers.

NPM is also improving, AFAIK they were really messy in the beginning and now getting better and better. This issue came up as I mentioned in other places because of an initial error that has been corrected long ago (case-sensitive package names). So hopefully someone will see your comment and do something about it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> This account is clearly squatting. Not only do they hold several one letter package names but also many other names that are generic. The majority of them have nothing more than a package.json

<comment><USER7> A new version of website squatting? There can't be very much money in npm package squatting, though.

<comment><USER8> A fellow poster up a bit mentioned that the empty 'D' package has something like 64k downloads per day. Surely there's money in compromising the systems that this ends up on? Malicious packages are a known point of vulnerability, and with that broad a shot, you're likely to get access to at least a few apps / AWS accounts / whatever.

</comment></comment></comment><comment><USER4> [https://www.npmjs.com/package/D](https://www.npmjs.com/package/D)

      Stats

        64,840 downloads in the last day
        1,360,036 downloads in the last week
        4,980,362 downloads in the last month

Why is this package _so popular_?

Shouldn't NPM be able to determine the difference between packages that are in use and package squatting?

<comment><USER3> It looks like npm is confusing the download count with another package, 'd' (lowercase)[0]. I didn't realize that npm packages were case-sensitive, and apparently neither does their download counter!

Edit: Apparently there is a Github issue for this[1]

[0]: [https://www.npmjs.com/package/d](https://www.npmjs.com/package/d) [1]: [https://github.com/npm/registry/issues/38](https://github.com/npm/registry/issues/38)

<comment><USER5> And I think they aren't anymore. But they were back in the day, so for compatibility reasons they have to keep some of them that way.

Edit: further evidence: when you mistype a name in lowercase such as [https://www.npmjs.com/package/aaaaaaaaaabbb](https://www.npmjs.com/package/aaaaaaaaaabbb) it gives you instructions on how to create the package with that name; however when you do with a name with a capital letter such as [https://www.npmjs.com/package/aaaaaaaaaabbB](https://www.npmjs.com/package/aaaaaaaaaabbB) it just shows a 404

<comment><USER3> Ah, that makes sense. Given that OSX and Windows are often case insensitive filesystems I could see that being a world of messy edge cases.

</comment></comment></comment></comment><comment><USER9> Sure, guy looks like a jerk, but these are terrible package names, I'm glad no libraries I use have these names.

Google searches would be so bad.

<comment><USER2> Agreed, single letter library names are essentially useless. Some of the others, however, maybe not. Overall I'd like to see a policy against squatting on a specific library name and never using it.

<comment><USER5> But there is one right in the footer: [https://www.npmjs.com/policies/disputes](https://www.npmjs.com/policies/disputes)

I am writing a blog post about the topic as well, I think NPM is doing a great job here.

<comment><USER2> I had no idea. I never heard of npm doing this and missed it as a spot on the site. Thanks!</comment></comment></comment></comment>


China has built a telescope the size of 30 soccer fields to look for aliens - <AUTHOR> http://www.theverge.com/2016/7/4/12093384/china-world-largest-radio-telescope-complete <comment><USER2> Dont do that. Aliens are evil. They live on a shitty planet with two suns. So when they hear about our place they want to move here.</comment>


Show HN: HackerWeb – A simple HN iOS app built with React Native - <AUTHOR> https://itunes.apple.com/us/app/hackerweb/id1084209377?mt=8 <comment><AUTHOR> Hello everyone, OP here. This is my first iOS app built with React Native. It took me few months since around September.

Feedback welcomed!

</comment><comment><USER2> It is cool. How did you process title length to show ... on detail scence?

<comment><AUTHOR> Oh you mean which title length?

<comment><USER2> I mean on detail scence (clicked to one of news). I see the title example is "How we built Facebook Lite for..." that is you had substring the full title, right ? But I wonder do it's length responsive to screen size ? Example : With bigger screen size, title will be display more longer "How we built Facebook Lite for every Android..."

<comment><AUTHOR> Hmm, I don't actually control that. I use NavigatorIOS which just need to pass the 'title' string. [http://facebook.github.io/react- native/docs/navigatorios.htm...](http://facebook.github.io/react- native/docs/navigatorios.html)

<comment><USER2> Well, because as the mention that is NavigatorIOS will be discontinue maintained and also hear from them about the new Experiment Navigation so that I have not ever tried NavigatorIOS. Curiously why you want use NavigatorIOS ?

<comment><AUTHOR> I use NavigatorIOS mainly because it looks more native on iOS (with blurred background), though less customisable and sometimes buggy. Navigator and NavigationExperimental is more customizable but somehow looks "off".</comment></comment></comment></comment></comment></comment>


Predicting Yelp Stars from Reviews with Scikit-Learn and Python - <AUTHOR> http://www.developintelligence.com/blog/2017/03/predicting-yelp-star-ratings-review-text-python/ <comment><USER2> I wrote this article -- feedback, comments, etc are highly appreciated.</comment>


Autobiography of Benjamin Franklin - <AUTHOR> http://www.gutenberg.org/files/20203/20203-h/20203-h.htm <comment><USER2> I wish I would have been smart enough to have read this book as a kid. Luckily it's never too late. This book was written in the late 1700's yet it's as relevant now as it was then. It should be required reading by all students.

We hear a lot of mythology about current politicians and their accomplishments but Franklin was the real deal. He was a self made man. Who started with little and he used what he had available to become one of the richest man of his time and one of the most respected founding fathers.

I regularly hear a lot of "I can't's." Read this book and learn how one man turned all his can't's to can's. It's well worth your time and it's free to add to its allure.

We often get trapped in to fantasies were we have special powers to accomplish great things. Franklin had no special powers yet he accomplished much. He started with a fraction of what most of us have available yet he's a true american hero.

If you don't want to read it here is a link to a youtube read. [https://www.youtube.com/watch?v=IfulxLKypr8](https://www.youtube.com/watch?v=IfulxLKypr8)</comment>


Show HN: Postmates is delivering happiness today in SF - <AUTHOR> http://postmates.com/valentines

<comment><USER2> Have to echo that it's a beautiful app...

So this is like Uber for bike messengers (and other courier type services)? Very well done, have had occasion where I could have used it in NYC.

<comment><USER3> Thanks! NYC is coming up - no worries.

</comment></comment><comment><USER4> Nice looking app. I stopped at the part where you asked for a credit card. I am not sure if I can trust you with that info. Great job though and I'm glad you're delivering happiness in SF.

<comment><USER3> We actually just have a version under review that allows you to skip the CC entry during registration. ;) However, we use Stripe to store your Credit Card details.

<comment><USER4> Cool, good to know. I look forward to the next release. :)

</comment></comment></comment><comment><USER5> Great idea and beautiful UI. I sent chocolates to a friend in SF. I'm a little sad he got an email notification, though. I was hoping it would be a surprise.

<comment><USER3> Max, great feedback. Tracking is important for us, but maybe we should have disabled it during Valentine's!

</comment></comment><comment><USER6> I love it! What a clever promotion - it'd be awesome if you could post some summary of results back to HN so we can learn from your experience.

</comment><comment><USER7> My valentine is thousand of miles away from S.F. Is it okay to send the chocolate to myself? I promise to eat it in her honor.

<comment><USER3> Go for it!

</comment></comment><comment><USER8> Really, let me use my existing contacts please.

</comment><comment><USER9> Really cool, guys. Congrats!

</comment><comment><USER10> Beautiful app.</comment>


Electronics banned from cabins on some Middle Eastern flights to U.S - <AUTHOR> http://money.cnn.com/2017/03/20/news/companies/middle-east-airline-electronics-ban/ <comment><USER2> There is no way you should check your laptop, baggage handlers are notorious for stealing. This will be brutal for business travelers.</comment>


How to Learn Hacking - <AUTHOR> http://www.catb.org/esr/faqs/hacking-howto.html

<comment><USER3> I can't see myself recommending this guide to anyone. A few things stand out:

\- the invitation to "go away" if you confuse ESR's definition of hacking with the definition the general public uses.

\- the suggestion that hacking is something for those with above-average talent for programming. Perhaps you should keep reading if you count yourself as above average?

\- the proposal of a system for learning how to hack that is apparently so robust that it is self-evident. No examples need be brought in to support this proposal, nor does it need to defend itself from alternative systems.

\- it is suggested that hacking is the only way for software architects to train their design sense. Ok, sure.

The biggest problem I have is that the vast majority of ESR's suggestions are really good ones. I agree with plenty of things he's saying. I just wish, like many open source products, it was packaged in a more digestible fashion, so I could recommend it to less experienced friends.

<comment><USER4> I think this guide has a good place for children who are interested in computers and get in trouble for messing with their schools network. Many of these kids will have absorbed media which does not really understand the diffrence between being a software engineer and breaking into computers. They may not know about the FOSS/unix world. I think giving this to them would do them a lot of good.

My main problem with it is that ESR is unable to differentiate between being a good programmer and being ESR.

Really what we need is a guide written by a prominent member of the FOSS community who can show budding programmers what's out there in modern FOSS(this was written in 1996) without couching it in language designed to sate the author's ego.

<comment><USER5> "My main problem with it is that ESR is unable to differentiate between being a good programmer and being ESR."

This line really identifies what my issue with ESR is. I've skimmed over his writings, and he definitely mixes the skill of being a hacker with his own beliefs about what that person should think and how that person should act. That theme definitely runs in his blog - the technical aspects of are great, but there's definitely a lot of humble bragging going on as well as most of the commentors being nothing more than an echo chamber.

</comment></comment></comment><comment> FLUX-YOU In case readers were interested in security:

[http://data.langly.fr/blackhat](http://data.langly.fr/blackhat)

<comment><USER6> This guide is very hand-wavey. Tor alone is a poor operational security strategy; using nikto and unix-privesc-check does not a hacker make.

This may be a decent place to begin one's inquiry, but don't let it end here too.

Here are some talks I recommend:

Tricks for Defeating SSL in Practice - Moxie Marlinspike

[https://www.youtube.com/watch?v=MFol6IMbZ7Y](https://www.youtube.com/watch?v=MFol6IMbZ7Y)

OPSEC: Because Jail is for wuftpd - <USER2>

[https://www.youtube.com/watch?v=9XaYdCdwiWU](https://www.youtube.com/watch?v=9XaYdCdwiWU)

</comment></comment><comment><USER7> This is from the man who wrote a "how to sex" no really, it's here if your eyes can stand it.

[http://www.catb.org/esr/writings/sextips/bedplay.html](http://www.catb.org/esr/writings/sextips/bedplay.html)

<comment><USER8> He also wrote The Cathedral and the Bazaar if I'm not mistaken. If that can balance it all out.

<comment><USER9> > catb.org

It took me a while to get why the site's named that way, too.

<comment><USER10> Why is the site named that way?

<comment><USER9> Catb - cathedral and bazaar :)

Unless I am embarassingly wrong.

</comment></comment></comment></comment></comment><comment><USER11> When _not_ open-source is okay:

Basically hardware. Say you're trying to create scientific image proc for an an off-the-shelf smartphone. The following review of the 40MP android nokia shows the debate. [http://www.cnet.com/news/the-secret-behind- nokias-41-megapix...](http://www.cnet.com/news/the-secret-behind- nokias-41-megapixel-camera-phone/)

The key point takeaway for me is how you create cheap consumer level electronics with a research team behind it. (Hint - Nokia's investment in R&D depends on them expecting to get lots customers)

Con: There is contention that this order of magnitude increase in pixels is not useful to image quality. And proprietary algo's on embdeded hardware in the camera module (7px "sampling" -> 1px "stored") is not available.

Pro: In some cases, there is contention that this innovative smartphone camera increases signal to noise ratio, so maybe we live with the black-box of the hardware to get better images downstream. And if "gimmicks" like this huge camera sensor sell units, we can expect more cheaply available units for mass deployment of the hardware/software. -> Thus for hacking we're riding the wave of mass adoption of what we're once esoteric technologies - high-end digital image sensors.

</comment><comment><USER12> hacking is a style of programming, hacking is being a cool start up guy, hacking is being a computer wizard, hacking is X, hacking isn't Y.

why some people keep trying to use the word hacking for what they do no matter what, it's because it sounds cool?

<comment><USER13> In particular, hacking seems to be about doing things that are not by-the- book. So...how can it be learned?

</comment></comment><comment><USER14> [http://paulbuchheit.blogspot.ca/2009/10/applied- philosophy-a...](http://paulbuchheit.blogspot.ca/2009/10/applied-philosophy- aka-hacking.html)

This is good too by Paul Buchheit.

</comment><comment><USER15> How to become a Hacker

[http://www.catb.org/~esr/faqs/hacker- howto.html](http://www.catb.org/~esr/faqs/hacker-howto.html)

<comment><USER15> Same guy but content is different

</comment></comment><comment><USER16> so how are people coming up with zero-day vulnerabilities all the time? How are these people able to find a way to inject code in pdf or word documentation year after year? Is software forever vulnerable, even ones written by huge number of engineers?

<comment><USER17> I imagine having a huge number of engineers actually increases the chances that software is vulnerable. This is because bugs often arise when different people are making different assumptions about what some code does or doesn't do.

It always makes me uneasy when I have to go and make modifications to other people's code, especially in the workplace where you usually don't have the luxury of time to fully understand the code base.

</comment></comment><comment><USER18> > If you think "hacking" has anything to do with computer crime or security > breaking and came here to learn that, you can go away now. There's nothing > for you here.

This. I don't think the author realizes that the reality out there is complex. You can "hack" for "good" or for "bad". Open-source is about not putting a moral judgment about what you want to achieve.</comment>


Mathematics Is Biology's Next Microscope; Biology Mathematics' Next Physics - <AUTHOR> http://journals.plos.org/plosbiology/article?id=10.1371/journal.pbio.0020439

<comment><USER2> (2004)

Interesting idea and well informed presentation, but apparently not a convincingly mainstream view.</comment>