Hacker Newsnew | past | comments | ask | show | jobs | submit | bubo_bubo's commentslogin

"Modern package management systems like APT spend a lot of effort installing and removing files, and they don't do it completely"

Well, there /is/ another way to do it.

STATIC LINK ALL THE THINGS

Which would work if licenses and copyrights didn't exist.


That's one of the main touted benefits of containers (a.k.a build reproducibility). You can view containers as a an overly complicated way to make software with complicated deployment brain-dead easy to deploy.

We're at the point in the hype cycle where it starts getting fashionable to dismiss that as an overkill, but the reality for most of us out there is that most software is way more complicated than a single executable and containers make it easier to deploy complicated software.


I'm talking about mutations to the file system. Things like database files, logs, /var/run, etc.

Managing internal dependencies (like libraries) is another concern entirely. But containers are good for that, too.


> Which would work if licenses and copyrights didn't exist.

I don't think it would.

Dynamic linking allows a library to be patched once and have the patch apply to all the programs using it. If every program was statically linked, you would have to update each one individually.

Not to mention the waste of space.

I'm guessing much of that is moot these days, but IMHO it's still something to aim for.


Patch a library and perhaps you end up breaking some programs that rely on that library.

The benefit of that goes away with containers anyway, you don't share libraries, every instance gets its own install.


Could have sworn that _nix already had mechanisms for loading different lib versions side by side...


I think GP is being snarky/sarcastic.


"but this is a realistic constraint given the difficulty and cost of recording a professional singer"

Just because a singer is professional doesn't mean they're any good. My wife copes with adversity by singing and she can sing "fuck fuck fuck shit shit shit" in soprano, on key, from the kitchen. The only thing keeping her from singing in public is her stage fright.

There are a /lot/ of people like her, that would answer an ad in the newspaper (or craigslist) that would like to /volunteer/ and contribute to a geeky project as long as they got credit in the paper.

At that point, the largest non-tech cost winds up being the studio rental fee, if you have one.


You could also go to karaoke bars and observe who the good singers are.


YES.


The great thing about the modern web is that ads are centralized (for various values of centralization) on ad networks. So it's damn easy to have an ad-free experience by dumping them to 0.0.0.0 in hosts.

It doesn't get rid of silly css and "too clever by half" javascript for the "content site" but dumping the ad networks makes a difference.

Every time I suggest this some ... person... says "but the ads pay for the Internet!" I just look at them as if they're wearing a suit made of dead kittens.


Yes, it's duress. I'm sure you having 10 years of your life locked up in an encrypted vault would put a cramp in your style.

>transferring cold hard cash to them

So? If I go to the 7-11 and buy a soda, and the cashier has been skimming the till, I am transferring cold hard cash to a thief.

The difference you keep skipping over is mens rea and I suggest you read up on it before you sound more foolish than you already are.


That last sentence was really uncalled-for. I think you don't really understand that I was discussing an economic argument.

Regarding putting a cramp in your style - how about if a thief has stolen your phone with valuable something on it that isn't anywhere else, but you have an application that tells you where the phone is and you own a shotgun. Can you go and get your phone back by force if in your calculation it has a higher chance of actually solving your immediate problem, than involving the police? Why or why not? It's your phone. The thief knows what he did. The thief knows that it's yours.

I am not saying that there is no argument on your side of letting people take care of issues directly with criminals (whether by force or transferring ransoms), but there are important arguments on the other side as well. It's certainly not so clear-cut that you can start ending with petty insults (and please check your reply to be substantive if you reply to this.)


But are the police or the FBI going to investigate your ransomware-locked computer when there are thousands of cases of this happening a year? The ransomware is usually running from a script. There is no guy wearing a ski mask on the other end watching the wallet. These groups aren't the same as a sketchy guy on the other side of town with your stolen laptop or phone, ready for the police to find him and recover your goods.

So what option does your average user have when confronted with a situation like this? They could call up the police and report it for statistics sake but the police aren't going to be able to fix the problem nor would they really care (unless you're the mayor or some prominent politician). The bad guy is probably not in the same country and there's no way to identify them anyway. Maybe you could figure out the hacking group but if you knew the actual identities then why aren't you working for Interpol already? Also maybe try using a site like in the link to check if the ransomware is compromised. But most likely, you just have to pay the ransom, get back your stuff, and learn an expensive lesson in how important regular backups, online and offline, can be.

You could just not pay it. The hacking group doesn't get their money but it's not like it cost much to run the attack in the first place. They will have someone's data out there that is much more valuable to the victim that will pay.

I compare this to leaving your bike unattended in a public place. Maybe you did a good job trying to lock it up but the thief hacksawed through your cheap lock. Or maybe you just left it unlocked. Either way, your bike is gone. Maybe buy a much stronger lock or two in the future. In this analogy, you aren't getting your bike back. You just have to spend the cash on a new one, expensive but hey, you need a bike to get to/do your job. You can report it stolen but unless there is some big bust and they find the guy, the thief is going to get away with it. Complaining that someone stole your bike isn't going to solve the issue. It sucks that the thief will profit off your loss but the data/bike is already gone. You aren't getting it back unless you drop the cash on a new bike/decryption key. The lesson is that you are going to either have to never ride a bike again (or use a computer, both unlikely) or you will have to use better security to prevent theft of your valuables.

Crime does pay, a lot. People get away with theft like this all the time and there's not much an individual can do except try harder in the future to defend themselves against theft in the future. Secure your computer better, run backups, don't do dumb stuff (like run unknown software or leave a bike unlocked).


You're wrong.

>The ransomware is usually running from a script. There is no guy wearing a ski mask on the other end watching the wallet.

Yes, there is a guy (a bad guy) wearing a ski mask on the other end. If you do this, then you're the bad guy. Then you're a criminal. Not in some abstract way or an analogy, you're actually nearly literally a "bad guy wearing a ski mask" and the reason bad guys do this is to hide their identity while they commit crime, steps which you if you do this also take. It's very black and white.

> These groups aren't the same as a sketchy guy on the other side of town with your stolen laptop or phone, ready for the police to find him and recover your goods.

Yes they are.

> They could call up the police and report it for statistics sake but the police aren't going to be able to fix the problem nor would they really care (unless you're the mayor or some prominent politician). The bad guy is probably not in the same country and there's no way to identify them anyway. Maybe you could figure out the hacking group but if you knew the actual identities then why aren't you working for Interpol already? Also maybe try using a site like in the link to check if the ransomware is compromised. But most likely, you just have to pay the ransom, get back your stuff, and learn an expensive lesson in how important regular backups, online and offline, can be.

This is a very "wild west" mentality - 'there is no rule of law anyway!'. But that isn't quite right, is it? In point of fact the FBI actually does run a site where you can get ransomware keys recovered, it was covered here on HN.

Let's actually look at the wild west. What is the wild west today - California. Can a criminal just walk up to someone who is unarmed and go rob them, like in the 'wild west' days? Do people have to dual with each other and so forth?

No. While there was a period of unlaw (or at least films portray this) it gave way to the rule of law, which is normal and sane. (I could be completely wrong, I don't know any historical information about the wild west, I'm literally going on movies.) Californians walk around unarmed. it's not like in those movies, or in some kind of gang violence warzone.

I can't make extremely nuanced judgments and policy suggestions, I am just saying that you don't have to necessarily accept that there is "nothing that could be done." Laws exist for a reason. Moreover, it takes a high level of sophistication to write programs. If people are funding you to do that by simply meeting your request, you would start thinking of them like your clients (after all, they're paying you!!). If instead they turn you over to the FBI and Interpol, and write you an angry letter that you are a criminal gang member and wtf are you doing, are you really going to get up the next morning, crack open MSVC++ and think about creating your next crime?

I'm not saying this from the point of view of some trigger-happy district attorney. I'm telling you as one HN reader to another that they are way, way on the side of "bad guy in a ski mask", it's not even close to being a judgment call. No, nothing separates them from going down to their local financial district wherever they're located and and stealing someone's laptop. It's exactly the same.

> I compare this to leaving your bike unattended in a public place. Maybe you did a good job trying to lock it up but the thief hacksawed through your cheap lock. Or maybe you just left it unlocked.

First of all, I'd like to acknowledge that analogies including this one are incredibly useful in law when it comes time to make policy decisions, and sometimes can capture many real-world consequences. I don't want to sound like I have the answer to whether your way of thinking is correct or incorrect or what it is missing.

I would like you to consider a couple of effects: "crimes of opportunity" -- is there a difference (as someone else pointed out in this thread or another one) between leaving a laptop in the front seat of a car and locking it, and doing the same thing but throwing a coat over it? Clearly in terms of legal consequences there may not be much difference, if someone smashes open a car window and takes a laptop it's similar. But for the purposes of the analogy, you may want to consider "crimes of opportunity" in your thinking. My personal impression is that writing or using ransomware isn't nearly in the same boat - you don't accidentally use highly valuable programming skills to create ransomware; you don't accidentally take extremely sophisticated and detailed steps to hide from Interpol, the FBI, and others, and perform ransomware attacks, in a context in which most of the Internet is well agreed that governments are able to exercise certain deeply embedded back doors in many extraordinary cases -- what I mean is that the guy in the ski mask doesn't "happen to have" a ski mask on, they would have to take extraordinarily detailed steps to perform their crimes. It's a criminal thing.

>Crime does pay, a lot. People get away with theft like this all the time and there's not much an individual can do except try harder in the future to defend themselves against theft in the future. Secure your computer better, run backups, don't do dumb stuff (like run unknown software or leave a bike unlocked).

I don't understand why you don't also consider the role in law enforcement agencies and their actions. The Internet isn't exactly a lawless place. Law enforcement, which includes international cooperation among many governments (Interpol being one example of this), has sophisticated tools. These are undermined by any victims funding the crime.

I mentioned above the programmer firing up MSVC++ and writing their next ransomware project. Would you do it? Probably not.

But for many programmers, the calculus would change -- immensely -- if the question is, can a criminal get you to do for $80,000. If you divide that by 1,000 victims, that is just $80. So the question is, "Would you do it for $80,000, given moftz's world view that you're not some guy in a ski mask, and there's no international law anyway" OR "Would you do it for $80,000, given that many of your users will refer you to international law enforcement, and send you angry letters about the kind of criminal scum that you're acting as, and your country and others will stop you and you will have to defend yourself criminally. because you are a criminal."

That is a different equation entirely. If we accept the worldview you argued for, this creates the former, very dangerous and wild-west, and horrific scenario -- if we accept the latter scenario, few programmers would be motivated to act so unethically.

It's our choice as people of the world what kind of world we want to live in. Absent rule of law, "might makes right", but that's why there are laws everywhere and most people aren't affected by them, until they get into the kind of criminal behavior that we're discussing now.

It's a very clear line. It's not even close to requiring any interpretation.

The suggestion that people need to "protect their stuff" -- when as a matter of the state of the art this is actually pretty much literally impossible -- muddies of the issue.


Knowingly buying stolen goods is illegal because they are still not yours even if you 'bought' them.

Paying a ransom to get your own property back because it is yours is not even in the same ballpark.


we'll agree to disagree on whether it's in the same ballpark. I see the difference you point out, sure.


>Empathy does not seem to be an involuntary ability like eyesight or smell.

But my wife has accused me of selective hearing...

/rimshot

I'm here all week. Try the veal.


When you buy a BMW, you have an extra asshole installed.

/snark

But seriously, in my early 20s I did land surveying. I found that the richer the neighborhood, the nastier the neighbors were. I've had people be rude to me because they think "something is up" when we were simply trying to document how one neighbor can buy 6 inches from another to make a legal setback for a garage. And then I've had just random people offer me coffee on a chilly morning. I'll let you guess which was the upscale and which was the working class neighborhood.


There is also a big difference between old money and new money. And hard-earned money vs. inherited money.

My dad used to deliver furniture as a side job for a local upholstery shop. Most of the clients had money, but some were rude while others (esp. the "old hard earned money" types) were extremely friendly.


I am sure it doesn't help that plenty of people say ugly things like "eat the rich." Plenty of rich folks "have dozens of friends and the fun never ends -- that is, as long as they're buying." If you know all the people around you would not hesitate to sell you out and only have any so-called respect whatsoever because you have money and power, it isn't like you are getting any empathy.

That shit cuts both ways.


My sense is the kind of people who say "eat the rich" actually are rich, they're just cash poor and pretending that's the same as real poor.

In my experience actually poor people want to be rich and would rather they not be eaten when that happens. It's the kids from privileged backgrounds with self-loathing and anger issues who embrace "black bloc" politics most warmly.

I am probably biased coming from mostly urban environments lately.


Seriously wtf. Black bloc is hated by yuppie liberals the most.


I live in an old-money, hard earned neighborhood. People are a marvel: Respectful, polite, kind and always willing to assist if they can.


"old-money, hard earned"

I'm confused. That phrase reads to me as "inherited and thus old money, I was poor or middle class but worked hard and made myself rich the hard way"

In my understanding, you used opposite situations to describe the same people. Can you tell me what I'm missing here?


Elites that are reproducing themselves but with "old" values so-to-speak, often they have a family history of doing the same job. They work hard to maintain their living standards.

To get a little more in details wrt to the demographics: I am thinking about lawyers, physicians or researchers which have assets >5 million who had to go through the grind of tough academic programs, highly competitive and skilled professions etc.

I am opposing this to rich heirs, actors, athletes, lottery winners, just-sold-my-pizza-app-startup etc. who like to show-off their recently acquired wealth. This is not a universal example obviously, there are outliers everywhere. Only talking about trends here.


You are describing people who are rich because they and their lineage belong to professions. That's a kind of modern aristocracy, and like most aristocracies they have good manners and obey a kind of noblesse oblige.

But also, most of the unequal laws and policies in a country are created to prop up the position of such people. E.g. house-price inflation helps only those who already own - or stand to inherit - houses.


old/new money suffices without an indicating your opinion whether people worked hard, or not.


Rich athletes? It's literally true that they work hard for their money.


The only thing that's changed is that in-your-face racism is acceptable to many whites because "Trump says what's on his mind." For a lot of people, dog-whistle euphemisms like "urban" aren't needed anymore.

People have become coarser and rude.

Just because we got a black president doesn't mean things are better for non-whites.


IMHO, I do not think racism as a whole is on rise. As for "is acceptable" or not, I think that's a personal choice. Racism is never about internal thinking, it's about conduct.

Trump said many things, but I do not think it's fair to label them as racism speech or similar. He certainly did not "say what's on his mind"; otherwise the words would be 100* worse TBH.


America's problem is institutional racism, not conversational racism.


What happened Bubo is that Obama's go-to-move is race baiting. 'You are racist' button got hit so much: it no more has any meaning. Trump was not in WH for the past 8 years.

Here are some of his supporters: http://twitter.com/TrumpWorld00/status/767313253479448577 http://twitter.com/Don_Vito_08/status/772789053385240576 http://twitter.com/dt_ads/status/772242215271862272

More:

http://twitter.com/DiamondandSilk http://twitter.com/sweetatertot2

And now you know. You can by self find out more about Clinton.


If you hit the 'stop loading' button early enough, the stuff you're talking about doesn't have a chance to load.

It's slow enough to do this because web pages load enough crap to run a Quake game.


Thanks, that worked. You're right, it's surprisingly slow.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: