Review of "Stubborn Attachments" by Tyler Cowen - <AUTHOR> https://noahpinionblog.blogspot.com/2019/01/book-review-stubborn-attachments-by.html <comment><USER2> So the core thesis of the book is that long term growth is a moral imperative.

The main critique in the review is that the book is not actionable, since it's hard to know in advance what will lead to growth.

I'm not sure the critique makes sense. It's valuable to have a policy north star from an ethical perspective. Although it's hard to know what will lead to long run growth, at a minimum it's possibl to know what will destroy growth.

<comment><USER3> If that is the conclusion I think it is correct. It has been shown time and time again that countries become successful not by being productive as such, but by not being unproductive. The most important factors for success are: 1\. Staying out of wars, disputes and conflicts. 2. Economic and social equality. 3. Functional society and industries.

Essentially all countries who do badly fail at that. They are involved in conflicts, they have hierarchical societies and their industries are administrative, rather than technological.

So now you might ask, what about the US? It is certainly involved in wars, have inequality and dysfunctional society. Right, but mainly for part of society. The middle class and upper middle class have mostly been spared from any effects of that, at least until recently. Which means that this part of society is very successful.

</comment></comment><comment><USER4> Only two thing have mattered since 1810 - economic growth and birth rates.

</comment><comment><USER5> I don't see why hypothetical people have any moral weight. Future people aren't as important as present people, no matter how many of them you imagine, because they aren't real. IMO the sole reason to care about the future of humanity is that a great many real, non-hypothetical people want to have children, and because those children will be born without their consent, we have a duty to provide a livable world for them.

<comment><USER6> So let's say that you have a magic button that will give every person on Earth now living a 10% improvement in their material living conditions for the rest of their lives -- and will completely destroy the world in 150 years.

That gives everyone now living a chance to have children who live full and complete lives. Grand children and great grandchildren maybe not so much.

Is it uncomplicatedly the obvious right thing to do to press the button? If not, I think you and Cowen are expressing similar or the same ideas in different ways.

<comment><USER5> I'd press it only if it wouldn't kill anyone, which would require the unlikely scenario of all humans agreeing to stop breeding. What I reject is the idea that "be fruitful and multiply" is an inherent good. If future humans actually do decide on voluntary extinction, that's their choice and they are doing nothing wrong. If hypothetical future people have rights [edit: I do believe hypothetical future people have rights in the sense of it being wrong to take actions that are reasonably expected to set up a causal chain of event that will kill people who don't yet exist, but I do not believe a future with 100B humans is better than one with 10B humans with the same quality of life], why don't we also ban gay marriage and votes for women etc. because it offends past people?

<comment><USER6> It most likely won't kill anyone who currently exists, which are the only people you're claiming have rights.

My point is that once you start considering the counterfactual world of 150 years from now in terms of, "What harm will it do to the people alive then," there's very little daylight between your views and Cowen's.

I don't think that Cowen believes that there's an absolute moral importance to have children, for example.

</comment></comment></comment></comment><comment><USER7> The Library of Congress also decided to archive Tyler's blog, Marginal Revolution [0].

Tyler has interesting views, and some of them are rather unconventional. E.g., he thinks that religion is good predictor of economic growth (citing Mormons as an example). Although Mormonism might be a good predictor of economic growth, I disagree that we should have more Mormons or religious groups. He said it in a podcast with Erik Torenberg [1].

My startup has been awarded his grant called Emergent Ventures [2] and have met and talked to him in that context. Super interesting person and has a surprisingly great network in Silicon Valley, although he is based in the East Coast. For example next week, he's interviewing Sam Altman [3].

0: [https://marginalrevolution.com/marginalrevolution/2019/01/li...](https://marginalrevolution.com/marginalrevolution/2019/01/library- congress-archive-marginal-revolution.html)

1: [https://www.breaker.audio/venture- stories/e/40444931](https://www.breaker.audio/venture-stories/e/40444931)

2: [https://marginalrevolution.com/marginalrevolution/2018/12/se...](https://marginalrevolution.com/marginalrevolution/2018/12/second- cohort-emergent-ventures-winners.html)

3: [https://conversationswithtyler.com/event/sam- altman/](https://conversationswithtyler.com/event/sam-altman/)

</comment><comment><USER8> On a separate note, I like Cowen's podcast for his choice of guests, and his interviewing style.

[https://medium.com/conversations-with- tyler](https://medium.com/conversations-with-tyler)</comment>


Show HN: Mostro – simple and flexible server monitoring - <AUTHOR> https://www.mostro.com

<comment><AUTHOR> Hey there HN, Mostro team here :)

In a nutshell:

      - "If CPU on #worker servers is critical for more than 1 minute, then send alerts via PagerDuty and Slack"
      - get a server fully monitored in a few seconds,
      - everything is already configured for you, but very easy to adjust to your needs,
      - you get insights about MySQL, PostgreSQL, Memcache etc. out of the box,
      - the Bash-based agent is secure, open-source, lightweight, no root privileges ever,
      - text-based, server side configuration: easy to deploy accross your infra with tools like Ansible, Chef and Puppet
      - write your own additional checks using in any language (here's a tiny example: https://gist.github.com/KevinBongart/998410d8e6ee2763f4f6)
      - 30-day free trial, no credit card needed, but here's a coupon to monitor 1 server for free forever, just for you: enter "HN4lyfe" in your billing page

These pictures are technically worth seven thousand words: [http://imgur.com/a/2OQO2](http://imgur.com/a/2OQO2)

Feedback is more than welcome!

</comment><comment><USER2> *.mostro.com is blocked by our firewall as "Suspicious"

<comment><AUTHOR> This is really strange… would you mind letting me know (email@example.com) if that's a commercial firewall, or if a specific message shows up? First time I hear about this issue, I wouldn't want it to affect other people. Thanks!</comment></comment>


How to speed up your WordPress site - <AUTHOR> http://usersnap.com/blog/speed-up-wordpress-site/ <comment><USER2> I am agree with all your points you mention in the blog to speedup your wordPress website. Optimizing images i one of the most important point to speedup your site.</comment>


Elasticsearch from the Bottom Up (2013) - <AUTHOR> https://www.elastic.co/blog/found-elasticsearch-from-the-bottom-up <comment><USER2> Back in 2006 I wanted to learn more about how search engines worked, so I started porting Lucene to Common Lisp. Actually, I wrote a Common Lisp port of Ferret. Ferret is a Ruby port of Lucene. Lucene is sort of Doug Cutting's Java version of Text Database (TDB), which he and Jan Pedersen developed at Xerox PARC, and which, to complete the circle, was written in Common Lisp.

I didn't know Ruby, and I didn't know search engines, but I did know Common Lisp. It took me 7 months to create a binary-compatible, pretty dang functional port of Lucene. I called it Montezuma[1], and it's still actually used by people.

About half the time was spent implementing the text analyzer, document store, and indices. The remaining 50% was spent implementing search (and parsing the query language). It was a very rewarding experience--It was one of the largest projects I'd worked on, mostly solo (I got some help near the end), in an area I knew nothing about, working in an extremely test-driven fashion (over 2000 unit tests when I was done).

I did not, however, learn as much about indexing and search as I expected. I learned a lot, yes, but quite a bit of the Ruby code was so easy to translate to Common Lisp that I didn't have to understand everything in order to make it work.

I still recommend writing a small search engine as an interesting exercise, though.

1\. [https://github.com/sharplispers/montezuma](https://github.com/sharplispers/montezuma)

<comment><USER3> A footnote: For Java devs out there, the Lucene codebase is a joy to read [0]. Esp, the APIs. Highly recommend it just for the documentation which is top- notch. Michael McCandless, Lucene's committer-in-chief, sometimes blogs about its internals [1].

[0] [https://github.com/apache/lucene- solr/tree/master/lucene](https://github.com/apache/lucene- solr/tree/master/lucene)

[1] [http://blog.mikemccandless.com/2019/10/concurrent-query- exec...](http://blog.mikemccandless.com/2019/10/concurrent-query-execution-in- apache.html)

</comment></comment><comment><USER4> Hey. I wrote that a long time ago. Funny to see it re-surface and glad it's helpful. :)

There is a presentation version of it here: [https://www.youtube.com/watch?v=PpX7J-G2PEo&feature=youtu.be](https://www.youtube.com/watch?v=PpX7J-G2PEo&feature=youtu.be) (I made the presentation first and then wrote the blog posts)

I wrote a follow-up at called Elasticsearch from the Top Down here: [https://www.elastic.co/blog/found-elasticsearch-top- down](https://www.elastic.co/blog/found-elasticsearch-top-down)

<comment><AUTHOR> Nicely written posts that helped me better understand what's going on, thanks for writing.

</comment></comment><comment><USER5> Shameless plug from someone who want this project to flourish. Check [https://vespa.ai](https://vespa.ai) as an alternative to Elasticsearch. Migrating from a ES to it, I got a faster search, never had to face a unhealthy node and native tensor support (And Native ANN is coming soon [https://github.com/vespa-engine/vespa/issues/9747](https://github.com/vespa- engine/vespa/issues/9747)).

Very mature, and still progressing at a neck-break rate ([https://blog.vespa.ai](https://blog.vespa.ai))

<comment><USER6> Vespa looks pretty good, at least in terms of performance and operation. I've been evaluating it myself. I'm less happy about everything else.

It's got a mishmash of odd APIs, lots of XML, several query languages, lots of weird little quirks. It doesn't feel modern. It's pretty clear that this is originally an in-house project, developed over many years by many people, where not as much effort has been spent on consistent/cohesive design or documentation.

One rough area is the approach to schemas and indexing. Rather than let you define a "clean" schema and put in _your_ data and then have Vespa index it in all the ways it knows about, you're forced to essentially reshape your data into a format compatible with Vespa, which brings with it some severe restrictions. For example, Vespa will not index arbitrarily nested structured data. If you have something like {categories: [{id: 1}]}, Vespa will not index that. You have to flatten any array data to the top level. Nested maps and arrays are mostly not supported, although it's hard to tell from the documentation what is supported.

Vespa is also very obviously skewed toward ranking, not filtering. You can't search by exact string matching: You can't do something like "topic = 'news'". You only get case insensitive substring search. It's got lot of ranking functions but very little that's optimized for filtering.

Overall, I'm a bit surprised that Vespa's authors position it as an Elasticsearch competitor, because you certainly cannot just port an app that uses ES over to it.

To be sure, it's got lots of interesting features such as ML integration, and, again, performance and clustering design seems good. But it still feels very much like a niche product.

<comment><USER5> I migrated from ES and for me, I do not agree about the feeling that it doesn't feel modern. The Middleware logic container and Live reconfiguration it is mind blowing. About those two things:

\- Nested (For my use cases, this is a problem I do not have. For more complex cases, there is parent-child [https://blog.vespa.ai/post/174589826190/parent- child-in-vesp...](https://blog.vespa.ai/post/174589826190/parent-child-in- vespa))

\- Exact match ( use the exact match [https://docs.vespa.ai/documentation/reference/search- definit...](https://docs.vespa.ai/documentation/reference/search-definitions- reference.html#match) )

<comment><USER6> By modern I mean the approach to configuring and running, and the myriad of languages used: Antiquated XML for some things, a homegrown DSL for others, JSON for query results, then multiple languages for expressing various parts of the query -- it's pretty chaotic.

Another thing that felt antiquated: The whole notion of uploading an "application". I can appreciate the benefits of controlling the lifecycle of the configuration and have Vespa distribute it to nodes. But when you start out, that "application" is just one or two files, and yet you have to create a whole directory structure for it, as opposed to just POSTing individual configs to REST endpoints like you can do with ES. The heavy-handedness of it feels very "Java".

The document you linked to is a different type of exact match. I've been through this, and even posted a Github issue. Mysteriously, a Vespa developer replied that nobody had ever needed exact string matching, so nobody had bothered to implement it.

Parent/child is not applicable to what I was talking about, I think. I'm not talking about hierarchical relationships.

For my part, most of my work is in structured data, not text or vector-based ranking, and Vespa really doesn't seem to be designed for that.

ES also has a very, very good aggregation API. Vespa's aggregation syntax is odd and seemingly much more limited.

</comment></comment></comment></comment><comment><USER7> I used to use Lucene back in the 1.x days when a fuzzy search was a complete table scan. It was quite a surprise to see how your single term fuzzy query was interpreted as one term query for each fuzzy hit OR-ed together. The Lucene team soon realized they needed to code a levenstein automaton but none of them had ever done that before. They pulled several all-nighters reading math papers and coding and when they succeeded they were so happy they told the world about it [0]. It's a great story.

[https://dzone.com/articles/lucenes- fuzzyquery-100-times](https://dzone.com/articles/lucenes-fuzzyquery-100-times)

</comment><comment><USER8> There's also a YouTube recording of a talk with similar content by the same author from EuroPython 2014. Helped me out when I was adopting ES at scale in that time period. (And the principles are pretty timeless to modern ES, too.)

[https://youtu.be/PpX7J-G2PEo](https://youtu.be/PpX7J-G2PEo)

If you like this, you might also enjoy my deep dive on Lucene (the indexing technology underneath Elasticsearch) in "Lucene: The Good Parts":

[https://blog.parse.ly/post/1691/lucene/?utm_source=hn](https://blog.parse.ly/post/1691/lucene/?utm_source=hn)

</comment><comment><USER9> Does Elasticsearch need to be as complicated as it is?

I was surprised to find there wasn't an Elasticsearch + Kibana competitor that is "simpler".

I just want to be able to store JSON logs with a timestamp + a bunch of fields then search them in a nice little UI later. Apparently, that's pretty hard to do right.

<comment><USER10> > JSON logs with a timestamp + a bunch of fields then search them

There is S3+Athena for this with AWS and Google can store/query JSON with BigQuery. The nice little UI doesn't come with it, but at least you don't have to spin up an Elastic cluster.

<comment><USER11> Do you have a S3 + Athena example because when I tried it didn't seem to query adhock json file but rather the S3 file needs contain a array of json documents.

</comment></comment></comment><comment><USER12> One thing that really bothers me about ES is that compared to Solr, some terms that have a specific meaning in Lucene are either not used for the corresponding concept or even worse re-used for a different one.

It sometimes makes explaining the underlying implementation a bit harder to people who are Lucene-agnostic but are ES users, with no good reason apart from, I would guess, brand differentiation?

</comment><comment><USER13> I can super highly recommend talks by Adrien Grand on Lucene and Elasticsearch. They are super instructive yet easy to follow.

[https://www.youtube.com/watch?v=T5RmMNDR5XI](https://www.youtube.com/watch?v=T5RmMNDR5XI)

[https://www.youtube.com/watch?v=eQ- rXP-D80U](https://www.youtube.com/watch?v=eQ-rXP-D80U)</comment>


BlackFly – vertical take-off and landing (VTOL) vehicle - <AUTHOR> https://www.youtube.com/watch?v=FI8AemQcclY <comment><USER2> [https://www.opener.aero/](https://www.opener.aero/)

</comment><comment><USER3> Not much range. Also interesting that the USA version is more limited than the international version (likely due to its classification as ultralight in the USA).

Range (with reserve):

* 25 miles (USA)

* 40+ miles (Intl)

The size of the battery is the difference for USA vs. Intl:

* 8 kWh (USA)

* 12 kWh (Intl)

Cruise Speed:

* 62 mph (limited, USA)

* 80+ mph (Intl)

</comment><comment><USER4> Visit www.opener.aero</comment>


Amiga BBS Online in 2019 - <AUTHOR> https://blog.nootch.net/post/amiga-bbs-online-2019/ <comment><USER2> Post author here, let me know if you have any questions! I think the ESP8266 can also get other devices online, but haven't tried it.

<comment><USER3> Thanks, that was a nice write up. I wanted to buy the msxonchip fpga box but this MiST looks actually more interesting. I started out with a PC, then C64, then MSX-2, Amiga, then PC (and SparcStation) again. So this would be great to play with! And EvilDragon sells them which is also good.

<comment><USER2> There's the MiSTer too, which on paper at least looks more appealing. The problem with these devices is that FPGA development knowledge is rare, so the dev community is quite small.

</comment></comment></comment><comment><USER4> Definitely cool to see things like this... While I tend to prefer emulation over legacy hardware approaches, it's very cool to see these kinds of things. I'm a bit of a fan of legacy tech, and online BBSes and the ANSi/Ascii art scenes today. A lot of it is now on Facebook more than the BBSes still alive. The way Twitter, FB and YT have headed, I'd be surprised not to see more users on more classic independent sites and irc more and more.

</comment><comment><USER5> Neat! I like tutorials which give people reasonable options and don't assume readers know everything.

The MiST is a nice idea, but until any FPGA implementation can emulate an m68k MMU, I'll be running the real thing. I use my Amiga to compile m68k NetBSD packages.

Catalog files are basically man(ual) pages. They're documentation. Considering the size and cost of modern storage, it wouldn't hurt to install them.

<comment><USER2> Yes, I'd love an FPGA device that can simulate a 68060 with an MMU! Or just an affordable way to run AmigaOS 4.1 on PowerPC :|

</comment></comment><comment><USER6> Very nice. I didn't know about the Mist box and now I want one :) As a former owner of a few Amigas (500, 1000), part of me wants one now, and the other part is worried that using one now will spoil the memory.

<comment><USER7> also check out that actually-available-right-now version MiSTer which uses an off the shelf FPGA dev board as it's core</comment></comment>


Soundcloud Releases New App, Allows Universal to Flag Your Account - <AUTHOR> http://doandroidsdance.com/features/soundcloud-boldly-releases-new-app-allows-universal-flag-account-quietly-announces-data-mining-one-month/ The original article is from here: http://doandroidsdance.com/features/soundcloud-boldly-releases-new-app-allows-universal-flag-account-quietly-announces-data-mining-one-month/  June 27 <comment><USER2> The part that really gets me is that Universal isn't even trying to help people "do the right thing". In the email from Greg Morris he states:

 _" The problem I'm having is the ambiguity of the feedback. For example, on the first strike you just said "Universal Music" said I used one of their tunes. The set started with an Ellie Golding song which I thought was the problem. So I removed that and re-uploaded. It was then taken down again. You're not even telling me which songs are infringing."_

That is infuriating. He is trying to oblige to the request to remove a copyrighted song, but Universal isn't even telling him how he is in violation.

<comment><USER3> Oh boo hoo. He's promoting his own internet radio show, it's up to him to work out clearances. He asks what basis they have for doing it, like choice of law etc., well read the ToS, that's why it's there. 'Other people do it too!' is about the most juvenile argument there is, and the fact that they haven't experienced problems yet is neither here nor there. Maybe Universal hasn't got around to yanking stuff from them yet, maybe they have proper clearances or pay ASCAP feees, or maybe Universal/Soundcloud is enforcing their copyright arbitrarily...which they're perfectly entitled to do as a private entity. Equal treatment under law only applies to the government, unless you can show you're being discriminated against as a member of a protected class.

So his problem is he doesn't know which song(s) is/are infringing? Take your tracklisting and check it against discogs.com or some other music publishing database, and see which songs were published by Universal Music. Maybe 30 minutes of work for a 1 hour show, tops. The responsibility to check clearances does lie with the person who wants to use a copyrighted work.

Edit: I realize this is an unpopular view, but if you're downvoting I invite you to spell out what you think is wrong about it. Every magazine/website/course aimed at budding record producers/DJs/musicians provides coverage of copyright and licensing issues, to help their readership collect what is owed to them as much as to avoid infringement. There is no way you can be an aspiring or actual professional in the music industry for any significant length of time and not be aware of your basic obligations in this area.

<comment><USER4> In an actual legal case it is your right to be told exactly what you are charged with. Universal is taking actions _based_ on copyright law but _outside_ the legal system and refusing to be specific. This is allowed behavior but it is extremely distasteful.

It is not acceptable to mistreat someone because they are doing 'something' wrong.

<comment><USER3> In an actual legal case you'd also be liable for damages. I agree it's unhelpful of Universal to just yank the material without providing feedback on what, exactly, infringed their copyright, but the fact remains that the responsibility for copyright clearance lies with the person who wants to copy the work, not the rightsholder.

I agree it's distasteful, but given that Greg seems to be well-established professionally there's no way he doesn't know this. It's rather absurd to see him accusing SoundCloud of 'stealing' his subscription fee - ie complaining about the loss of his property interest in his SC account - while at the same time thinking he can help himself to all the raw material, ie other people's published music.

Yes, it's unfair that broadcast radio stations get all their music for free by default, while internet DJs don't, legally. They get that because they banded together and _negotiated_ for those rights. _That 's_ the solution: collaborate with other internet radio DJs and draft a blanket license agreement for noncommercial reproduction, then shop it to labels.

</comment></comment></comment></comment><comment><USER5> I have just had this very issue directly as an electronic music producer.

Was flagged for my own original music NOT on a remix or anything that contained samples but an original jam I made with some classic Roland hardware; Roland SH-101, TR-909, and TR-606! Seems the algorithm they use to flag has many flaws and is automated with no one at the wheel to look at individual cases.

Not sure where soundcloud is going with this, because I pay for the service and replied to them to fix and have heard nothing in over a month.

Moved my song over to mixcloud. I am creating a music app for musicians called Memory Echo if anyone is interested in working together on something different but similar for musicians that are not signed.

Knew this day would come just didn't know when.

Cheers! Electronic Sleep

<comment><USER3> That's a much more legit complaint than the one in the source article, and as an electronic musician myself I can see how that would happen. Sadly Mixcloud has problems of its own, eg this, which I posted here the other day: [http://support.mixcloud.com/customer/portal/articles/1595564...](http://support.mixcloud.com/customer/portal/articles/1595564-us- licensing-seeking-rules)

<comment><USER6> I was so confused on what type of license would prevent me seeking a track. Luckily I can just google "download from mixcloud" and problem goes away.

</comment></comment></comment><comment><USER7> It's been really interesting over the last 24 hours or so to watch the reaction from Joe Kay[0], whose label/collective Soulection[1] has shared hundreds of hours of mixes and dozens of original tracks and remixes on Soundcloud[2], and to an extent (at least initially) built their following on the site (not to take anything away from the impact performances, etc. have had on their growing popularity), but were always at high risk of this sort of takedown due to remixes of popular rap/r&b tracks.

One of my initial takeaways from this development is that while Soulection may not have come to exist without Soundcloud, the "next Soulection" will almost certainly take root anywhere _but_ Soundcloud.

It's a shame.

[0] [https://twitter.com/J0EKAY](https://twitter.com/J0EKAY)

[1] [http://soulection.com](http://soulection.com)

[2] [https://soundcloud.com/soulection](https://soundcloud.com/soulection)

<comment><USER8> Soulection originally uploaded their shows to MixCloud, but made the move to SoundCloud about a year back. :(

[http://www.mixcloud.com/soulection/](http://www.mixcloud.com/soulection/)

..if any HNers enjoy these tunes, the live show is every Saturday at 10am pst on rinse.fm.

<comment><USER7> Apparently they've had similar issues on Mixcloud:

[https://twitter.com/J0EKAY/status/484097294598275072](https://twitter.com/J0EKAY/status/484097294598275072)

And even if hip hop/trap/neo-soul/etc aren't your style, if you're into any electronic music at all there's probably something for you on Rinse.fm (unfortunately they're more an internet radio station than a platform like Soundcloud, not exactly apples to apples from a user perspective).

<comment><USER9> If you're interested in the history of Rinse.fm, check out this article:

[http://www.theguardian.com/music/2011/aug/27/rinse-fm- geeneu...](http://www.theguardian.com/music/2011/aug/27/rinse-fm-geeneus)

Real Pirate radio for the last twenty years.

<comment><USER10> Rinse has an FM license now, so they've gone from pirate to legit. It was funny listening to the DJs trying to curb their swearing (50 pound fine per naughty word) in the weeks after they were licensed.

</comment></comment></comment></comment></comment><comment><USER11> So SoundCloud users had a good run, but now the popularity of the service reached critical mass and raised the ire of the labels so they're knuckling under like every other provider. SoundCloud (sensibly) doesn't want the burden of dealing with the massive copyright infringement by it's users and outsources the job to the owners of the tracks.

Now I get that it sucks that you don't get explicit explanations of what infringed, and I worry hugely about their power to supress content that they actually do not own, but:

1\. Stop pretending that you should get a free ride because you're promoting the artist. If you actually give a shit, discover and promote new music from awesome bands that are not beholden to the labels. That's the only way to break the stranglehold.

2\. Don't rage at the service that provides a great product to producers of real, original content, just because you've repurposed the platform to promote your infringing mix.

<comment><USER12> > If you actually give a shit, discover and promote new music from awesome > bands that are not beholden to the labels. That's the only way to break the > stranglehold.

This. If you get a promo from an artist, ask them, "Is this under copyright with a label? Sorry, in that case I can't play it."

<comment><USER3> Actually the correct response would be 'can you give me a release to play it.' Everything is under copyright with someone, refusing to deal with any labels whatsoever just means punishing any artist that dares enter into a publishing relationship with someone else.

<comment><USER12> Even if you get a separate license on the side, Universal will still take your music down from SoundCloud. Just like how news services take down public domain NASA video from YouTube. They have a special direct relationship that doesn't follow DMCA or any other rules.

</comment></comment></comment></comment><comment><USER13> Farewell Soundcloud. It was nice while things lasted.

<comment><USER14> Yes,it really was. I am an old, classic, get off my lawn style person who never signed up for twitter or Facebook and still uses a dumbphone. But somehow I got onto SC and discovered a lot of great music there, which has led to a few hundred dollars of amazon purchases.

So it is something special, and I hate to see them mucking around with it ...

<comment><USER15> You shoud check [http://mycloudplayers.com](http://mycloudplayers.com), it is built over SoundCloud and has some amazing features for discovering new music based on the favorites tracks of the people you follow.

</comment></comment></comment><comment><USER16> I run a record label (Records On Ribs) and to be fair, SoundCloud have always scanned files for potential copyright infringement and taken files down when they have found it to be the case. The difference is that normally there is an appeals process with a nice backend. It is a little frustrating though because the automated service flags music we own the copyright for (as well as being Creative Commons) and we have to go through the whole process again. The lack of appeals here is the really worrying development.

</comment><comment><USER17> Why have we, as a society, become OK with handing over policing power to corporations unrestrained by due process? For example, by using sites like Soundcloud. Is it the lack of civics education in high school?

<comment><USER18> > _Why have we, as a society, become OK with handing over policing power to > corporations unrestrained by due process?_

These companies do not care about due process, they care about the bottom line of making a dollar at the end of the day. Soundcloud determined it is much less expensive for them to go this route than be sued by Universal. Every company follows this practice as for they are serving their best interest.

As a consumer your hope is that their best interest and your best interest share the inside of a Venn diagram.

<comment><USER19> > Soundcloud determined it is much less expensive for them to go this route > than be sued by Universal.

Which is sad, because Soundcloud would win in court, as they'd have no problem proving that the site doesn't exist primarily to help its users infringe copyrights owned by Universal.

<comment><USER20> Is it that simple?

</comment></comment></comment></comment><comment><USER21> First, that is a low blow linking to others doing it. They know, or haven't got to them yet. Websites like Etsy do the same on license content. Two, they choose you be set an example. Three, I always thought of Soundcloud the Vimeo of music. If it is an artisans music website, upload your own creations.

Unfortunately for soundcloud, aren't they killing their main userbase? DJ's mixing mainstream songs.

<comment><USER22> > First, that is a low blow linking to others doing it.

I thought the same thing at first, but the users that are linked to are all big, big names that get millions of plays on Soundcloud that will never get takedowns, whether they have clearances or not. It's more like saying "why are you hassling me for my $10 unpaid fine when you don't care about these corporations' $100,000 unpaid fines" than it is about narcing on the competition.

</comment></comment><comment><USER23> The one looming question is, does Universal have access to spectrum analysis products of tracks, or the actual sounds themselves? If they have access to the actual sounds, they'll be able to harvest song ideas from private tracks. No bueno.

<comment><USER16> Judging by my above comment, probably spectrum analysis.

</comment></comment><comment><USER24> Lack of appeals and lack of information make this a real problem. Soundcloud needs to address this to keep the artists from going elsewhere.

</comment><comment><USER25> Also their interface for tracking plays has gotten significantly worse. And you have to pay extra to get most of the same information you get for free from youtube.

<comment> squeaky-clean >And you have to pay extra to get most of the same information you get for free from youtube.

Well Youtube has advertisements, and soundcloud doesn't. Someone is still paying for you to get that information, it's just not you, on youtube. I do agree that their interface has gotten worse, though. Especially for tracking.

</comment></comment><comment><USER26> oh that's why some DJ's that I follow are moving to mixcloud

<comment><USER27> I think something similar will happen to Mixcloud too.

See U.S. licensing rules: [http://support.mixcloud.com/customer/portal/articles/1595564](http://support.mixcloud.com/customer/portal/articles/1595564)

<comment><USER28> Then comes another service... The circle of life...

<comment><USER13> Those are actually really permissive terms, and will likely keep Mixcloud in the clear. They do need to cover the cost of the licenses, but they're not operating illegally like Soundcloud was.

</comment></comment></comment></comment><comment><USER29> Citing the Terms of Soundcloud: "SoundCloud may assign its rights and (where permissible by law) its obligations under this Agreement, in whole or in part, to any third party at any time without notice, including without limitation, to any person or entity acquiring all or substantially all of the assets or business of SoundCloud."

This is embarassing. I use a number of payed accounts, with original content only, but sometimes you should rethink whom you give your money, and if you still can trust them. I don't want any major label - and nobody - to shoot me in the back out of nowhere.

I'm German, the SC offices are two streets from where I sit now. I have some doubt if their Terms apply to German law in all the details. Unfortunately, I'm no lawyer.

</comment><comment><USER30> I'm actually working on a service which sits on top of SoundCloud. It's still in its infancy, but I'd love to hear what people think of the concept; the service aims to help musicians and photographers expose their content to a wider audience, and on the flip side, allows you to sit back and listen to a playlist of music whilst enjoying a beautiful photo slide show. The playlists are tailored to a user's mood, and you're able to filter the music based on genre. The website's voliyo.com, and if anyone's interested in signing up to the beta as a photographer or musician, feel free to message me for an invite code!

</comment><comment><USER31> My understanding is that soundcloud is popular with (and funded by) musicians who post original music. Why should we all be so upset about this?

<comment><USER32> Because you or I don't have a way to flag Universal's account? It seems odd that a third party has direct control over your Soundcloud account (which you may have paid for) without any recourse.

<comment><USER33> That's the inherent risk of using a third party to host "your account" on a proprietary system. I have sympathy for all these artists, I truly do, but what were they expecting?

</comment></comment></comment><comment><USER34> Somewhat offtopic, but why is there an obsession with music discovery services? Soundcloud has its own niche in terms of sharing and usage, but other services like 8tracks and Slacker seem rather unnecessary. Is it that hard to discover new music on one's own?

<comment><USER35> 8tracks is user created playlists right? Why wouldn't that be useful — that's generally the best way to find music in a lot situations.

Slacker is internet radio I think and more run of the mill so not sure for that one.

<comment><USER34> Because the user-created playlists seem rather low-quality. Half the "indie" playlists appear to have bland mainstream radio music. Maybe I'm not the target audience for these apps, but friends, 4chan, Pitchfork and Spotify seem to be the right combination for me.

</comment></comment></comment><comment><USER36> The first part of this post is rather lame. In his complaining about putative tracking, he quotes their new policy. This policy says that they're collecting non-identifying info that can be opted out of, and if you sign in with Facebook or Google, they'll take note of your gender.

None of these things they're declaring gives them the ability to track who you are, or correlate it to what you're doing.

</comment><comment><USER37> How are mixes subject to take-downs? Shouldn't they be protected since they are pre-recorded and thus protected by exceptions to public performance rights?

</comment><comment><USER38> i use [http://mp3monkey.net](http://mp3monkey.net)

</comment><comment><USER39> Or, you can listen to real, really great music from underground labels on SC and never worry about Universal.

Kappa.

<comment><USER40> Sounds to me like Universal has blanket permission to harass anyone, regardless how "underground" they are. Universal doesn't like your brand of competition? They'll just flag you for infringement.

</comment></comment><comment><USER41> i recommend 8tracks.com

</comment><comment><USER42> just wen i started lovin this app

</comment><comment><AUTHOR> Original article from a couple of days ago [http://doandroidsdance.com/features/soundcloud-boldly- releas...](http://doandroidsdance.com/features/soundcloud-boldly-releases-new- app-allows-universal-flag-account-quietly-announces-data-mining-one-month/)

"SoundCloud seems to have given Universal the keys to the car within the last month, and is allowing the media giant full access to flag accounts' records without any communication whatsoever with SoundCloud. "

<comment><USER43> Thanks. We changed the url from [http://www.dancingastronaut.com/2014/07/soundcloud- continues...](http://www.dancingastronaut.com/2014/07/soundcloud-continues- push-boundaries-privacy-policies-enables-universal-screen-monitor-terminate- accounts/).

Btw, stories can't have both urls and text, so your submission text was lost. We're going to fix that so a message comes up when users do it.

<comment><USER44> Maybe the ability to have a seed post to go along with the link might be a feature worth evaluating?

<comment><USER43> You can do that now by posting a comment to the thread. I realize that's not exactly what you mean, but (a) it's close, (b) we're biased in favor of reusing existing features wherever possible, and (c) I'm not convinced that the submitter's comment should be privileged over other users', other than by being first to appear. What chippy wrote was fine, but that would not always be the case.

<comment> jack-r-abbit I don't think the submitter's comment needs to be privileged. But it would be nice if both text and url are entered then the system just magically turns that text into a comment from the submitter. It would just save the submitter a step. I'll refrain from the typical dev comment about how it should be easy to do in the code. It probably isn't _that_ easy. But probably not that hard either. :)

<comment><USER43> Ah, clever. That's either a really simple "why didn't I think of that" idea, or it's what people have been saying all along and I didn't get it.

Will think about this and maybe look at relevant historical data.

</comment></comment></comment></comment></comment></comment><comment><USER45> I use [http://samurai.fm](http://samurai.fm) now for my funk, disco, electronic needs.

</comment><comment><USER46> I don't understand the problem, I guess. You can't profit from other people's copyrighted material without their permission. That's just how copyright works. And they can grant or deny that parmission.

Get a license or use something else. And don't complain that they're being "unfair" by taking your stuff down and not telling you what infringed. If you didn't upload/sample/perform other people's stuff, you wouldn't need to worry about what songs were infringing.

Get your samples cleared. After having to get written permission from Twitter, Facebook, Amazon, and other services to use screenshots of their web pages in my books, this doesn't surprise me in the least. Fair use is a defense, not a right.

<comment><USER47> Building upon the cultural contributions of our past is how all of human civilization was built. Until the late twentieth century. Disney (for instance) strips our culture like a jackal, yet buys senators (such as Ernest Frederick "Fritz" Hollings) to subvert the law so they can keep it a one-way flow. To allow a few to subvert all of human existence for their personal gain is obscene.

<comment><USER46> I understand that's how culture works. But I'm talking about the fact that because of Disney, this is now how it works, and it should not be surprising that this is happening.

There's a big difference between "how it should be" and "how it actually is."

<comment><USER47> I agree completely, there is a big difference between how it should be and how it actually is. But its obvious that Disney's vision of reality isn't how it works. Culture works by sharing, still. How it will work going forward is up in the air yet; we can still control the outcome by not giving in.</comment></comment></comment></comment>


Windows 10 will use protected folders to thwart crypto ransomware - <AUTHOR> https://www.helpnetsecurity.com/2017/07/03/windows-10-protect-ransomware/ <comment><USER2> One of the "features" (back in the day) of running a diskless system was that you could set change policy on the server hosting the file which was completely out of reach of the "client" machine that was running the program. For nearly all of the system files there was no reason for them to change. NetApp turned this into a huge win when they could use snapshots to support multiple VM images with just the small configuration changes.

Given the well known benefit there, and that the processor on your hard drive is about as powerful as your phone, why not have the drive set up files that are 'read only' unless allowed to change out of band. Here is how it would work.

Your disk works like a regular SATA drive, except that there is a new SATA write option which can write a block as 'frozen'. Once written that way the block can be read but not written. You add an out of band logic signal and wire it up to a switch/button that you can put on the front (and/or) back panel. When the button is pressed the disk lets you 'unfreeze' or write frozen blocks, when it it isn't pressed they can't be changed.

Now your hard drive, in conjunction with a locally operated physical switch, protects sensitive files from being damaged or modified.

<comment><USER3> I would like to have a physical write protect switch on drives I connect via USB ports. It would be great for backup drives, so you wouldn't inadvertently goof them up when restoring from them. (Like get the arguments reversed in an rsync.)

I used such a lot with floppy disks back in the 1980s.

<comment><USER4> Wasn't write protection a thing on old USB flash drives? I have a 32 MB drive somewhere that has a WP switch on it.

<comment><USER5> I remember looking for those models some years back.

[http://www.fencepost.net/2010/03/usb-flash-drives-with- hardw...](http://www.fencepost.net/2010/03/usb-flash-drives-with-hardware- write-protection/)

[https://eikonal.wordpress.com/2010/05/21/usb-thumb-drives- wi...](https://eikonal.wordpress.com/2010/05/21/usb-thumb-drives-with-read- onlywrite-protect-hardware-switch/)

Ought to take a look again if they're available now. Even if they still only come with a few gigabytes of storage there would be some nice applications.

</comment></comment></comment></comment><comment><USER6> Okay, so I know Windows probably doesn't actually work this way, but from a user interface perspective... what's the rationale on giving an App permanent access to the user's home folder directories? Don't most well behaved apps have a file open / folder open dialog, which should be able to grant access to files at runtime? If the file opening dialog is provided and controlled by the operating system (I realize many, many legacy apps work differently in Windows) then the OS can silently grant permissions at the time of open, rather than letting apps either have free reign or no access at all.

I feel like this is the expected behavior anyway; Power Users may run utilities that need to touch the whole system, but most regular users are doing pretty good to juggle more than a handful of open files in their mental model of the machine while they're using it. The idea of file permissions is already pretty foreign to the average end user. Applications already have a designated area (%APPDATA%) where they can store their temporary files and things, so perhaps the documents folders _should_ be more locked down by default.

<comment><USER7> That is how Windows sandbox for store apps works, the applications cannot access files directly.

The problem is getting everyone on the store train, and to move away from classical desktop.

<comment><USER8> It's unfortunate that Windows seems to conflate sandboxing applications and central control of which applications are available. I'd love all the apps on my system to be sandboxed, but not if I lose the ability to install "unapproved" apps at the same time.

<comment><USER9> This isn't a thing on Windows. You are not required to go through the store in order to install or run UWP apps.

</comment></comment></comment></comment><comment><USER10> I've always wondered why Windows and other OSes don't offer a 'cold storage' area where you need thaw out files before editing. Files not modified within a selected time freeze from further modification. I've got plenty of files that are archived that I'd never want to change, but it's a hassle to unmount/remount just to add a new file to an existing directory.

<comment><USER11> How about just enabling Shadow copies by default! I don't understand why Windows has great "Time machine like features", but every fucking time I right click and go to Properties and look at the "Previous versions" tab and it is completely empty.

<comment><USER12> Probably because the typical anti-MS comments would be worse for them than the risk of ransomware (from their perspective):

"Windows eats all my hard disk!! I've updated to <windows xy>/Windows did an update and now all my disk space is gone!!! Don't update!!!!"

"New MS update steals your disk space, here's how to stop it"

And so on, and so on.

<comment><USER13> No it wouldn't be turned on by default. If it was every software that you run occasionally would break. This would be opt-in for certain folders.

<comment><USER14> No, this thread is about shadow copies being turned on by default.

</comment></comment></comment></comment></comment><comment><USER15> My concern is first off, this seems like it is going to break a massive number of applications. It also seems that they are pushing this layer of access management that doesn't have proper support on any platform but UWP.

I see this as Microsoft taking yet another step to force people to move to their new Appstore model. by choking the access to the operating system away from any other platform, which I find really amusing because their own top tier applications aren't built on these platforms (office, visual studio, etc..).

<comment><USER7> Better update yourself.

The next version of Office and Note for Windows 10 are going to be store only.

At Build they also had people from Adobe, Cakewalk and Kodi showing their desktop apps ported to the UWP via the Desktop Bridge.

Like they did with WPF and Visual Studio, they are pushing everyone into the train by dragging their own devs into it.

<comment><USER16> > Like they did with WPF and Visual Studio

Except Visual Studio _isn 't_ using anything newer than WPF yet, is it?

<comment><USER7> You completely missed the mark.

.NET developers only started taking WPF seriously after the performance improvements Microsoft did to WPF, which took place after Visual Studio team adopted WPF to prove its quality.

If you intended to do any remark regarding UWP, first WPF is not going anywhere as communicated to those that care to learn what goes at Build, and second the architecture between WPF, Silverlight and UWP is almost the same, just a few differences regarding XAML features and .NET APIs.

</comment></comment></comment></comment><comment><USER17> So last ransomware we seen in the news actually tried to reboot system and encrypt files before OS is loaded. So unless that new tech gonna protect MBR (which should be protected anyway) - not sure how it going to stop encryption.

<comment><USER18> This is why Secure Boot is a thing.

<comment><USER19> Wouldn't secure boot just prevent you from booting into the invalid MBR? At that point your files are already encrypted and your MBR already over-written, Secure boot is just preventing further exploitation.

<comment><USER20> You can get around UEFI Secure Boot by installing an old signed bootloader with known exploits (if I understand correctly this is why the "Secure Golden Key Boot" exploit of last year[1] cannot be patched without changing public keys in the UEFI firmware). Not only that, the code that is shared by most UEFI implementations is garbage[2] with a large attack surface; exploits against the firmware is a possibility.

The primary function of UEFI Secure Boot is for Microsoft to prevent other operating systems from being installed on as many systems as they can get away with (right now there is no provision that end users should be allowed to disable Secure Boot on ARM devices, for example). The "security" functionality is an unworkable side-effect that provides a convenient fiction to accomplish that goal.

[1] [https://www.reddit.com/r/netsec/comments/4wybax/writeup_of_s...](https://www.reddit.com/r/netsec/comments/4wybax/writeup_of_secure_boot_bypass_which_i_dub_secure/) [2] [https://www.youtube.com/watch?v=V2aq5M3Q76U](https://www.youtube.com/watch?v=V2aq5M3Q76U)

</comment></comment></comment></comment><comment><USER21> Completely unrelated, but am I the only with an impression that MS has switched Windows into a rolling release OS (like Gentoo or Arch) with infinite updates of Windows 10? This would be a genius move to solve the issue of the users remaining on the old unmaintained release like it was with XP, and like it is now with 7.

<comment><USER22> Just like OS X (10). It's like everybody is afraid to go to 11.

To be fair, software is a recent human endeavor, and except for Emacs, I'm not familiar with software versions over 10.

<comment><USER23> In operating systems, FreeBSD, HP/UX, and Solaris are all on version 11. iOS 11 is in beta now.

In databases, Oracle and Informix are both on version 12.

I think the lack of high version numbers is not necessarily paranoia, but simply that there isn't much software that's old enough yet.

</comment></comment></comment><comment><USER24> I always thought protecting users from malicious code they willingly download and run themselves is futile and a waste of developers' resources.

Do I miss something and this is actually a viable security approach?

<comment><USER25> It's not going to do much for targeted attacks, but there are definitely ways to limit the damage for large-scale ransomware attacks. As it is right now, ransomware doesn't even need to bother with privilege escalation because files valuable to users are most likely owned by them. Not to say that all ransomware malware sticks to just user privileges, but it's usually enough do get the job done.

Having a sort of firewall for file systems that's enforced by the system means that in addition to getting code to run with user privileges, the malware authors need to trick the victims into giving the software root (which might be impossible on enterprise networks), or use a privilege escalation vulnerability to do that.

Of course, people could still click through prompts, allow access to all apps due to warning fatigue, etc., but it's an improvement - if done correctly.

</comment></comment><comment><USER26> > If an app attempts to make a change to these files, and the app is > blacklisted by the feature, you'll get a notification about the attempt

So it's allow default? That sounds useless.

We need a deny default thing. Like Little Snitch but for disk. Every time an app accesses a directory it hasn't accessed before, ask. (Skip asking when files are opened using the system "Open file" dialog for a bit less annoyance.)

</comment><comment><USER27> I think that the most recent attack in Ukraine already overcame this obstacle. They were able to use an in-place update system by a trusted software vendor to install their malicious code on the victim's computer. That software would almost certainly have had permissions even under this list, so it's not that effective.

</comment><comment><USER28> How about using ML to detect profiles of access and disallowing un-common access patterns? If I only use VS Code to access my source, prevent win- malwr.sys from accessing that folder.

<comment> yjftsjthsd-h And then one day you want to zip up the project to send to a friend, run an external linter on it, or make backups. ML depends on an adequate training set, and real life uses change quickly enough to break it.

<comment><USER28> The OS would confirm that it was an end user making the action not malware. It is about the automatic creation of security rules based on observed behavior. The other option would be to create everything manually, which doesn't happen.

<comment><USER29> Browsers have already taught us how useless this is, users will always click through.

</comment></comment></comment></comment><comment><USER30> I'm surprised Google hasn't run a Chromebook advertising campaign which just says "use a Chromebook and never care about ransomware again"

<comment><USER31> Because files on Google Drive cannot be encrypted?

<comment><USER30> Google has old versions of all the files, and would immediately revert them when they detected a virus going around.

<comment><USER32> What if the malware just waits a few months to spring the news that your files are encrypted? Offsite backups don't save you from encryption based attacks.

</comment></comment></comment></comment><comment> d--b This sounds like a feature that will be painful to work with for regular apps, but that malware will easily work around.

I mean I am no security expert at all, but you kind of need administrative privilege to install a malware, so why not keep it to access all the folders you need?

<comment><USER33> You don't need administrator privilege. You just need to double click an exe.

</comment></comment><comment><USER34> This seems like a good idea, and I'm pretty excited to see this step. Though I suspect if certain apps are whitelisted to edit in those folders, ransomware will simply turn to finding exploits in those apps. And most of your document and photo editing apps out there may not have been designed with security in mind, as they never expected to be gatekeepers of file access.

This will also probably be a UAC-level nightmare for getting old software to work on newer PCs, as today's software generally just assumes it can have file access to document folders.

<comment><USER35> Many of the ideas seem good for a corporate/enterprise setup where you lock the system down to run a few business/tech apps, but not so pain-free for desktop users. I mean, nearly every app on my system needs access to the usual folders. Unless MS bundles a good whitelist of approved apps, granting permissions is going to get really annoying.

<comment><USER34> Akin to Windows SmartScreen and stuff, I expect Microsoft to offer the whitelist as a service. Obviously, they wouldn't want to cause extra headaches in getting Microsoft Office and the like to have access to your documents.

</comment></comment></comment><comment><USER36> How about we just have "copy-on-write" filesystems by default?

Something which then tries to "encrypt" your hard drive merely winds up creating another layer on top which you wipe out to get back the original files. You only have to flip a "hardware switch" when your disk fills up or you get a catastrophe.

I cry every time I see something that IBM or DEC got right _40 years ago_ that we _STILL_ haven't adopted.

<comment><USER37> Why was this not implemented widely? I mean not in source control systems like git or TFS, but built into OSes.

</comment></comment><comment><USER38> What are "end-to-end security features"? They mention it once but then never again.

As far as I know, the term end to end is about communications: an exchange between two or more parties, or endpoints, which can be encrypted "end to end". I'm afraid they just dropped it as another term nobody knows the meaning of, so we'll have to find a new term to describe why Signal and Wire are better than (non-PGP) email.

<comment><USER15> "end to end" has been a term in common use in language since the 1800s meaning complete coverage. look it up on the oxford english dictionary for more details.

<comment><USER38> Oh, right, objects can lie end to end and have nothing to do with encryption. I had never heard it in security context without meaning e2e encryption.

</comment></comment></comment><comment><USER39> I'm skeptical. The cost of managing these permissions might outweigh the benefit. But hey, why not try it. As long as I can disable it when it ends up getting in my way...

</comment><comment><USER40> Linux has had the same issue for the longest time: You need root or a capability to set the time, but any program you run can wipe your entire home directory.

<comment><USER41> [https://xkcd.com/1200/](https://xkcd.com/1200/)

</comment></comment><comment><USER42> Perhaps the place to implement countermeasures is in the disk drive (SSD these days)?

e.g. arrange for the drive to never delete anything unless some key exchange has recently been done, that depends on user input (bio parameters, or password).

From a user perspective you'd see this as :

All deletes (and file version changes) go to a recycle bin. Emptying the bin can only be done upon presentation of the secret.

<comment><USER43> Do you trust any of the SSD makers to implement proper and updated (obviously necessary) counter-measures against ransomware?

They can't even get encryption right.

[https://motherboard.vice.com/en_us/article/mgbmma/some- popul...](https://motherboard.vice.com/en_us/article/mgbmma/some-popular-self- encrypting-hard-drives-have-really-bad-encryption)

[https://www.theregister.co.uk/2015/10/20/western_digital_bad...](https://www.theregister.co.uk/2015/10/20/western_digital_bad_hard_drive_encryption/)

</comment></comment><comment><USER44> I wonder MS has given any thought to 'sealing' executable regions so no new instructions can leak into memory. IOW Once executed, a process can only reference instructions present in the binary itself. Basically make running JIT-ed code, self-modifying code, etc, a special process privilege, that can then have a limited process context for I/O.

<comment><USER45> Isn't that a subset of W^X / DEP [https://support.microsoft.com/en- sg/help/875352/a-detailed-d...](https://support.microsoft.com/en- sg/help/875352/a-detailed-description-of-the-data-execution-prevention-dep- feature-in) ?

Can be defeated by "return-orientated programming", which uses only the existing instructions in the binary and a modified stack.

<comment><USER44> Yeah, DEP + ASLR already addresses some of this. Perhaps the stack regions could partially be set to read-only to protect return addresses.

<comment><USER46> Control Flow Integrity is one technique for addressing these sorts of attacks:

[https://www.microsoft.com/en-us/research/wp- content/uploads/...](https://www.microsoft.com/en-us/research/wp- content/uploads/2005/11/ccs05.pdf)

IIRC there are even some experimental efforts to add hardware support for CFI techniques to new processors (Intel I think?) but there's work going on to add support for it to modern compilers, which would allow you to compile libc and other system libraries with it turned on.

EDIT: It appears Clang actually ships with some CFI support already: [https://clang.llvm.org/docs/ControlFlowIntegrity.html](https://clang.llvm.org/docs/ControlFlowIntegrity.html)

</comment></comment></comment></comment><comment><USER47> This seems like another strange workaround. We need to change the way the operating system behaves for the future. The problem is default allow for untrusted code to execute. Everyone recognises this as the problem, no one wants to step forward and implement the change.

We do it for mobile, mostly, the desktop needs the same shift.

<comment><USER33> That basically means forcing everyone to sign their code and offer it through the App Store. You'll see developers complaining about that upthread.

Windows 10 does make code signing mandatory for new drivers, and the drivers must pass a suite of acceptance tests.

<comment><USER47> You're right, but people complaining shouldn't dictate life. People also complain about being crushed by ransomware. Not to say they don't have a valid point, but the paradigm needs to change.

We used trusted stores for certificates and mobile applications, it's time for the desktop to do the same beyond drivers.

Not to say things won't creep through, but default allow needs to go for this to be truly solved, not a new feature or vendor product.

</comment></comment></comment><comment><USER48> _" If an app attempts to make a change to these files, and the app is blacklisted by the feature, you'll get a notification about the attempt," Microsoft explains."_

I don't understand. If they have a blacklist, why ask the user? Or is "blacklisted" used loosely here to include code flagged by heuristics?

<comment><USER49> Perhaps "brownlist" would be more appropriate

</comment></comment><comment><USER50> The filesystem itself is a risk: per-user default permissions so any application launched by one user can trash all his files is scary. Even applications being able to access other installed applications is dangerous. I hope the industry find a way between all closed (a la Apple) and all open.

</comment><comment><USER51> Or "Windows Will Protect Vulnerable Client Software With More Client Software".

Wouldn't it be much easier and more effective to offer a one-click low cost encrypted cloud backup-service? They could bundle this with Update or Defender to offer point in time recovery.

</comment><comment><USER52> macOS already does this.

System Integrity Protection.

[https://support.apple.com/en-gb/HT204899](https://support.apple.com/en- gb/HT204899)

[edit] apologies, indeed, SIP only protects system files, which is not what this article is about.

<comment><USER53> This is about protecting user files and areas, not the system files. A user level ransomware can indeed encrypt all /home/$user contents on macOS just as easily as it can C:\Users\$user on Windows.

</comment></comment><comment><USER54> This seems like a rushed reaction to recent events - I think there will be problems as a result of the rushed implementation. I could only begin to imagine the embarrassment if this was the cause of the next zero day attack.

<comment><USER55> What?

</comment></comment><comment><USER56> The UI is not really explained. I hope this is not going to train more generations of Windows user to click "yes yes yes" in response to annoying dialogs.

</comment><comment><USER57> .. what about the existing file versioning and backup tools?

<comment><USER58> Also some crypto trojans delete or even encrypt your snapshots if you using the existing restore software from Windows.

</comment></comment><comment><USER59> How often are browsers affected by 0-day exploits these days?

I they are not, wouldn't using web-applications and keeping your system up to date solve the whole issue?

</comment><comment><USER60> Countdown to malware using this feature to prevent removal

</comment><comment><USER61> To me it seams like a part of the definition of a zero day exploit makes it impossible to stop.

<comment><USER62> Part of the definition of a zero day exploit requires software providers to constantly fix issues, otherwise a thousand days exploit would be enough to compromise a system, and no zero day concept would have been necessary, they would be just called exploits.

<comment><USER63> At least, it requires _someone_ to be able to act in mitigation. That might also be the user of the software (if they can patch it, find a workaround, have some other software validate inputs or detect attacks, etc.).</comment></comment></comment>


Black Friday Online Sales grew 17% to a record $5.03B - <AUTHOR> http://alphastreet.com/b6884c03 <comment><USER2> Which is great, except dwarfed by Chinese 11:11 holiday.

[http://time.com/5016471/singles-day-china- november-11-deals-...](http://time.com/5016471/singles-day-china- november-11-deals-shopping-single/)</comment>


Silent Circle announces ultra-private, ultra-expensive Blackphone - <AUTHOR> http://pando.com/2014/02/24/idealism-costs-silent-circle-announces-ultra-private-ultra-expensive-blackphone/

<comment><USER2> I don't particularly like the misleading headline saying its 'ultra- expensive.' $629 is a standard flagship price for smartphones. It's just a phone with qualifications like this one will never get carrier subsidies, so it comes off as 'expensive' to an average consumer. This phone isn't targeting average consumers though.</comment>


Lisp for the Web, Part II - <AUTHOR> http://msnyder.info/posts/2011/07/lisp-for-the-web-ii/

<comment><USER2> I have been writing a Web app using Weblocks, and I have been very pleasantly surprised at the breadth and depth of the libraries available for the purpose. I would go so far as to say that the Common Lisp library problem has been solved, at least as far as writing Web apps is concerned. Here are the highlights of the packages on which my app directly or indirectly depends:

      CLSQL: database interface (I'm using PostgreSQL)
      Weblocks: widget-oriented app framework with AJAX
        Hunchentoot: web server
          CL+SSL: SSL foreign interface layer
          Babel: charset conversion
        PURI: Portable URI library
        CL-JSON
        CL-WHO: HTML generation
        CL-PPCRE: regular expressions
      CL-OAUTH: OAuth implementation
        Drakma: HTTP client
      CL-SMTP: programmatically send email
      Monkeylib-bcrypt: bcrypt foreign function interface

And almost all of these (and many more I haven't listed) are easily downloaded and installed with Quicklisp.

</comment><comment><USER3> I've been hacking together a site using Hunchentoot, Postmodern + PostgreSQL, CL-WHO for HTML generation, and CL-JSON + Backbone.js for client interaction. I'm probably duplicating a lot of functionality that would already be done with Rails or Django but I'm having a lot of fun doing it this way :)

</comment><comment><USER4> Allow me to flog WuWei, <http://wuwei.name>, a toolkit for doing Ajax web UIs in Common Lisp, now in production use on <http://biocyc.org> .

<comment><USER5> Very nice. It would have been a little easier to setup if mtlist and wuwei where Quicklisp installable. Thanks!

<comment><USER6> According to README, quicklisp installation is available for wuwei.

<https://github.com/mtravers/wuwei/blob/master/README.md>

</comment></comment></comment><comment><USER7> Just use RESTAS, closure-template & Postmodern.

<comment><USER8> What makes this stack superior to the other suggested libraries?

<comment><USER7> RESTAS is written by someone who knows both Lisp and the web _really_ well. It's a good sign when a developer resists the urge to invent a new templating syntax (specially a lisper, come'on) and chooses to use a boring semi- standard, like Google's Closure Template.

RESTAS is MVC, in the loosest sense of the word. The author, archimag, went way out of his way to make the "C" part, the controller, as flexible as possible.

RESTAS created its own module system on top of the Lisp package system. Importing a Lisp package from within an application also _mounts_ that package's controller URLs underneath your app's.

He wrote one of the most authentic clones for Closure Template language. In fact, it generates HTML and JavaScript.

I could go on and on, but to put in a nutshell: the author actually _looks_ at other web frameworks for inspiration, and is not someone trying to bolt an idealized "Lisp way" on top of the web. No continuations, no pretending that the web is a GUI, none of that crap. You want web, you get web: clean, modular, RESTful web.

</comment></comment></comment><comment><USER9> Great article! The only thing I'd do differently is just serve up the js as a static file instead of using code transformation. That seems likely to break for non-trivial amounts of js.

<comment><USER10> I beg to differ. I've used ClojureJS (a Clojure to JavaScript translator) for building a non-trivial web app front end, and the result has not only been robust but also a pleasure to build (from a Lisp programmer's point of view).

[Disclosure: I'm the author of the ClojureJS library]

<comment><USER9> Interesting. What's the site, and is the original Clojure source before -> js transformation published somewhere?

<comment><USER10> We're not launched yet (but, close). I'll definitely post about it when we're live. I'm not sure how much of the Clojure (subset) code we'll publish, but I'll write more about our process and experience once we're launched.</comment></comment></comment></comment>


A drug that can make your old memories like new - <AUTHOR> http://www.sciencemag.org/content/331/6021/1207.abstract?sid=f6ef25a6-1b03-4232-96c7-0d2be6923fe0 <comment><USER2> Just from the abstract, it looks like they're genetically increasing the amount of this particular protein (PKMζ) in the neocortex of rats, not giving them a drug. I'll read the article and revise.

Edit: The approach here is to create a virus that carries a gene coding for the protein they want to overexpress. The virus inserts the gene into the host cell's dna, which in this case is in the rat's neocortex. They say that expression of this protein is under control of a cytomegalovirus promoter, but I'm not sure if they need to use an additional drug to induce expression.

In any case, the HN title is incorrect.

</comment><comment><USER3> Paper seems to be behind a paywall. I've copied the full version here: <http://184.108.40.206/misc/memoryenhancement.pdf>

See my profile for why I do what I do. Please email me to let me know when my services are needed.

<comment><USER4> Nice job...well done. I've just downloaded this and reposted it to min.us:

<http://min.us/mvjf9pl>

</comment></comment><comment><USER4> Does this exist somewhere that isn't behind a paywall? Or better yet...is there a good description anywhere of the methods used for the relative layman?

 _Edit_ : Ok I've been snooping around for articles on this and so far I've found these:

[http://arstechnica.com/science/news/2011/03/the-memory- virus...](http://arstechnica.com/science/news/2011/03/the-memory-virus-gene- boosts-memories-made-weeks-earlier.ars)

[http://www.physorg.com/news/2011-03-enzyme-erases-long- term-...](http://www.physorg.com/news/2011-03-enzyme-erases-long-term- memories-rats.html)

<http://www.nih.gov/news/health/mar2011/nimh-03.htm>

[http://www.sciencenews.org/view/generic/id/70519/title/Enzym...](http://www.sciencenews.org/view/generic/id/70519/title/Enzyme_revives_long- term_memories)

</comment><comment><USER5> The drug that also up-regulates NGF is available over the counter in Russia, and it's called noopept (GVS-111). Good luck finding it in stock anywhere.

</comment><comment><USER6> I'm guessing this will be used to enhance the gravitas of someone on the witness stand while talking about a past crime in 3... 2..

<comment><USER7> Smoking meth improves your memory too, but it's hard to imagine a bunch of cracked out tweakers being given extra credibility on the witness stand.

<comment><USER8> The only memory-based effects of methamphetamine I've heard of have been impairment, not improvement. Do you have any citations?

Also, methamphetamine has a very high addiction potential. I don't know if this does - I've yet to even glance at the paper - but I would be willing to hedge money on your comparison being between apples & oranges.

<comment><USER7> [http://io9.com/#!5548581/meth%20addicted-snails-prove- that-a...](http://io9.com/#!5548581/meth%20addicted-snails-prove-that- amphetamines-are-the-ultimate-memory%20enhancer)

Meth makes you vastly more intelligent, that's partly why people get addicted to it. It may impair memory and intelligence in the long term, but this new drug may well do the same, so if you want to do an apples-to-apples comparison then you really have to compare the short-term effects of meth with the short- term effects of this new drug.

Also, I wouldn't say that the addiction potential of meth is that high unless you're abusing it. It's currently a prescription drug that's available to anyone age 6 and over, meaning the government thinks it's less dangerous than marijuana.

</comment></comment></comment></comment><comment><USER9> see 'Green Mars' by Kim Stanley Robinson

<comment><USER10> It wasn't until the end of 'Blue Mars' that Sax Russell and his team at Da Vinci were able to create a memory enhancing drug.</comment></comment>


Fast, cheap and automated: deploying static websites to AWS - <AUTHOR> https://www.jotaen.net/e7ywT/deploying-static-website-to-aws/ <comment><USER2> Static sites are a neat solution for most web publishing these days (I built Punch - one of the earliest static site generators).

However, one of the main complaints I received was the inconvenience of using such a setup to deliver a client project (or managing a site with a team of non-tech people). At this stage most still end up with Wordpress or other CMS from last decade.

I'm working on a new project called Pragma[0] which combines the benefits of static sites with the conveniences of CMS and Web-site builders. I wrote about it in detail: www.laktek.com/2016/11/29/introducing-pragma/

[0] [https://pragma.build](https://pragma.build)

<comment><USER3> You might be into Lektor ( [https://www.getlektor.com/](https://www.getlektor.com/) ), which is a great middle ground between static site and dynamic CMS -- it's a static site generator, but has a GUI client that is somewhat usable for non-technical people. It's a very clever system and un-opinionated about how you structure your content.

</comment></comment><comment><USER4> > But of course there are downsides: caching can be annoying sometimes, > because file changes take much longer to be rolled out

If you just want the SSL, you don't have to enable caching on cloudfront — that way you get in the instant updates at the cost of a bit of performance.

<comment><AUTHOR> Valid point. I will clarify this aspect in my blog post later today. (UPDATE: done. thanks for your input!)

</comment></comment><comment><USER3> A few years ago, I used CloudFront as a CDN for video files hosted on S3, and I ran into performance issues -- I think because the traffic was relatively low, and hence it took more time for the CDN to "reload its cache" (for lack of a better term) than it would have been to just serve the files directly from S3.

Just a word of caution for people thinking (as I did) that a CDN is an automatic performance boost for all situations... it might actually be a detriment if you don't get reasonably high traffic.

<comment><AUTHOR> Interesting – can you quantify these performance issues somehow or do you have any other insight what was happening there?

It surprises me to hear it, because when CloudFront refreshes an item, it should immediately start to forward the retrieved data from the first byte onwards. So, the maximal additional latency could be the initial roundtrip between CloudFront and the origin (which I suppose should be neglectable in case of S3).

<comment><USER3> It was a while ago (2011), and it was specifically with streaming videos using the RTMP protocol... so it might have been specific to that. But here is a StackOverflow answer someone wrote that explained the general idea of how CDN's might slow down the process for infrequently-accessed files:

[http://stackoverflow.com/a/7800805/477513](http://stackoverflow.com/a/7800805/477513)

EDIT: In re-reading that S.O. answer, I see now that this is specific to LARGE files (these videos were 50+ MB each)... so your use-case of HTML files and images for a static site would probably not result in this performance problem.

</comment></comment></comment><comment><USER5> Is there any inherent advantage in setting the TravisCI account permissions in the bucket properties rather than the IAM role, or is it just a personal preference thing?

<comment><AUTHOR> In this case it was indeed a matter of personal preference, because I wanted to see all the bucket permission in one place.

AWS offers some guidance on this question in their docs: [https://aws.amazon.com/blogs/security/iam-policies-and- bucke...](https://aws.amazon.com/blogs/security/iam-policies-and-bucket- policies-and-acls-oh-my-controlling-access-to-s3-resources/)

</comment></comment><comment><USER6> It's a great design! I use a similar setup for my blog and wrote about it here: [http://blog.michaelschmatz.com/2016/03/31/how-i-wrote- this-b...](http://blog.michaelschmatz.com/2016/03/31/how-i-wrote-this-blog- post/)

</comment><comment><USER7> What about GitHub Pages + CloudFlare? Hard to beat free. There's also free CI with Travis.

<comment><AUTHOR> In my case I decided for S3 because I use Hugo instead of Jekyll and I wanted to avoid checking in the build assets into the Repo. My S3 costs range around a few cents per month.

However, if you use Jekyll or don't mind commiting the build output, GH Pages is a superb option for sure.

</comment></comment><comment><USER8> I've been meaning to try this out instead of github pages just to learn about it. I was hoping this tutorial was for users 1 step less technical :(.</comment>