skysight-inc/HackerNews huggingface dataset:
First off, I hope you have actually spoken to the neighbour about the noise, rather than just coming up with the massively technological solution, which though possibly fun, could also be quickly used against you.

If your stereo matched the decibel level of your neighbours stereo in your apartment, that means your apartment would be as loud as your neighbours apartment, in your apartment, but the neighbour isn't in your apartment, so he would still hear his stereo over yours, you'd just annoy yourself.

So you would have to match the decibel level in their apartment, which would make your apartment even louder, and if your neighbour had the same stereo decibel sensor, it would sense your apartments noise, and raise it's volume, and you'd be in this loop of apartments raising the volume until one or all of the stereo's maxed out.
I posted the original because I thought it was interesting. Elated to see an honest response. I love HN.
A new carpooling platform for RIT students by an RIT grad student. Check it out
Please take a look and give me some feedback.Your feedback is my learning.
If you are running the server and your server is compromised than the attacker can remove the ssh server you are running and put up his own malicious program to collect your password if and only if they port is above 1024, and they don't need root privileges, they can have www-data privileges or whatever
Hi jQuery, Meet Vagrant
NOMAD Micro Home - Easily Assembled, Under $30K
I know Hacker News doesn't like dismissive comments but I can't help it - this sounds like a really bad idea. I don't think that contributing to noise pollution with more noise pollution is going to solve any problems, because now the rest of the neighborhood has to deal with your neighbor's racket and yours. And yours by definition is meant to irritate people.

Call the cops, or invest in some earplugs. Attempts at "operant conditioning" are likely to wind up with someone taking a bat to your equipment.
Probably because it's coming about due to private enterprise I say this not to start a political fight, it's just that it really isn't something that's been attempted on such a scale before (unless I'm ignorant of history). If Detroit is to make a run at revival it will have to do so with a cooperative local government as well. The state's takeover has at least made a dent in the circus that was the Mayor's office over the past few decades which is a good sign. If the city goes back to hilarious levels of incompetence and corruption once the financial situation is solved then it's all for nothing but hopefully a little hope is enough to turn things around and I think it might do the job.
What's so bad about these miles of "suburban hellscapes"? Why do you think the people who live in them are lazy?
What's The Best Path To Big Data Insight?
Privileged ports are why I disagree with this rebuttal. I want some assurance that when I ssh into a box, that I'm hitting a true and sanctioned sshd.
They don't. 20somethings don't use SMTP-backed
email as a significant component of telecommunication.

They use websites, apps, and txting.
There is an entire blackmailing mugshot industry.

Not sure if the company you worked for was one of the ones involved, but it is very much a thing.

http://www.wired.com/threatlevel/2012/12/mugshot-industry-le...
http://www.huffingtonpost.com/alison-winfield-burns/rich-and...
Put another way, if someone has gained access to run a script as a non-root user on my server, and somehow managed to kill SSH which is running as root to bind to that port, gained access to my host key (which should only be readable by root), so that my ssh client won't warn me when I connect, and is now running an ssh-alike on that port, I'm pretty well owned already. It's hard to see how someone with this much access doesn't have enough to go ahead an run their ssh-alike on port 22.

That said, I run ssh on a non-standard port for one reason only, it's a crap-load easier to check the log files for suspicious activity that way. I still run use the same protections I do for servers with ssh on 22.
I still can't understand why things like port knocking or single packet auth schemes like fwknop never really took off ...
To be fair, you could get the advantages of both by running SSH on a different privileged port than 22. Many of the lower numbered even-numbered ones are good options as for historical reasons those are all mostly unassigned. (Pretty much any even number below 16 isn't used by much.)

But I agree, the privileged ports point isn't something that should be brushed aside.
How can you ever tell that by port alone? If a box has been exploited, it's been exploited.
Again if he can remove ssh running as root on port 1xxxx, he can run his ssh-alike on port 22.
The absolute best way to know that is to know the public host key and verify your keys. Additionally, you don't have to resort to high ports to achieve a best of breed. Just !=22 is enough to avoid majority of skiddies.
I urge you to purchase and read The Strategy and Tactics of Pricing [0]. You are making a number of mistakes, not the least of which is to use low pricing as a differentiator. Bad idea. You've landed yourself on a potential slippery slope that can be devastating. I doubt your current competitors will follow you down. They are likely not suicidal. However, your position is easily attacked by anyone willing and able to take a dive for the weeds (in terms of pricing). Product being reasonably equal, the lower price wins. Customers nearly always want to pay as close to zero as possible.

I see a lot of "we had this revelation" type posts on HN. Perhaps this is a side effect of a younger, less experienced membership. A lot of these things are nowhere close to revelations. People --many people-- have trenched these paths before you. Anyone with a reasonable amount of business "street" experience could have told you that giving away EVERYTHING for a low price would convert better. What you need to do is optimize profit per unit and segment the market in order to maximize that function. The other thing you are doing is colloquially referred to as "leaving money on the table".

The pricing field is deep, wide and complex. The suggested book is one of many I studied over the years. For a number of years one of the most frustrating aspects of entrepreneurship for me was having to read piles of business books to understand what the hell I was supposed to do. Engineering school does not prepare you for this.

[0] http://www.amazon.com/The-Strategy-Tactics-Pricing-Profitabl...
His argument is that we can't be sure whether we're talking to the real SSH running or some rogue SSH run by an unprivileged user. That's why SSH servers have their server host keys with fingerprints you're supposed to verify using a different channel when first connecting: if someone managed to spin up a rogue SSH server, it would have a different host key and you would get a big fat warning from your SSH client that the server key doesn't match.
By experience, it just lets you avoid getting a shitload of brute-force attacks. So I do it.
>Khosla may yet want to cede this claim, even if it's legally legitimate, to not appear like a robber baron buying up eccentric anti-democratic privileges that were created by ancient wars.

For the sake of the community and historic use he should restore the access rights that were there. It is the right thing...but, hey, it's his property.
The photo content is not at all relevant to ads.
I remember telling a friend's kid, in ~2000, that if she really wanted a totally secure future, that she should quit computer programming and become a riparian lawyer. I maintain that this is still the best advice I've ever given.
I don't really agree with your domain knowledge point - he was a college kid and it was aimed at college kids.
How about: Why it doesn't matter what port you run SSH on

* Because anything but the IP address of your office or VPN connection should be blocked at the firewall level for that port
Exploiting a single user's account and opening a high port is not the same as getting root on a system.
If you have random people spinning up daemons on your servers then you don't have an SSH problem.
"By that standard, practically any online service or platform these days is a social network!" Yes, but to me, this is the correct standard anyway. Two reasons: a) My time is limited: Anytime I spend on something like Medium is time away from Facebook. They are all competing for that limited time I have for being involved in a social network. and b) All these services generally also mean a different set of friends for the me. There is some overlap but almost all my social networks have a different group of followers/recommenders etc. The more time I invest in building one set of friends, the less I do in another - and this is a sticky investment, one that can easily prove make or break for any social network.
>Well OP is assuming that I trust the root user of the machine I am SSH'ing to. If I do, then what's the concern?

Trusting the root user is different from trusting everyone with shell access to that machine. Only root (or a process with the appropriate capability) can bind to port 22 because it's below port 1024. Normal users can bind to port 2222. So now $EVIL_USER puts "@reboot /home/$EVIL_USER/bind_port_2222" in his crontab, or some such other method of getting to port 2222 before the ssh daemon.

This is mostly mitigated by the fact that $EVIL_USER can't read the host private keys which means that the impersonation will be detected by anyone who has the host in the known_hosts file, but that only counts for ssh, and assumes you've connected to the host previously. If you're running something like DNS or FTP on a multi-user machine, using a non-privileged port is a Bad Idea.
UNIX is built as a multi-user operating system. You may not use that ability very much, but there's a reason the operating system was built this way and there's a reason these things work the way they do. It is completely valid to point that out.

You're free to say you don't care, but it isn't really valid to brush aside the point by pretending a security model that's there for a reason isn't there.

Also it isn't uncommon at all for an attacker on a server to get access to a regular account and not a root account in their initial vector. It is often too easy to escalate, but do you really want to help them out more?
Its kinda silly to move the port, a targeted attack is going to start with an portscan of you box, the attacker is going to say "oh what’s this here on port 2222?" and promptly discover that its ssh listening on a high port. Port knocking would make that discovery less likely I suppose but its still all treating a symptom of a bigger problem.

So why not solve the problem with something a little more proactive like turning off password auth and go for sshkeys only. Maybe toss in something like fail2ban if you want to interrupt kiddies scanning your boxen.

That said high port ssh can be nice if you're frequently on restrictive networks and getting out on port 22 is impossible.

edit(spelling)
I hope the city has budgeted for adequate police coverage. Otherwise, they're building New Sherwood forest!
but he can do 1xxx from an unprivileged NOT ROOT and he requires root to do that with port 22, again
Call me maybe: RICON East talk
Interesting, I picked what I thought would be a "typical" car (Ford Focus sedan) and it shows the insurance getting more expensive as the car gets older. That's exactly the opposite of my experience with any car I've ever owned.

I'm also reminded why I drive old cars that are cheap to insure. My insurance costs are a fraction of what that page shows.
Startup School 2013 Talks
Imagine if more companies were in the business of adding trees rather than removing them.
That US presidents are willing to completely give up email to avoid the Freedom of Information Act (FOIA) seems pretty shady. I could see if they were mob bosses running a criminal organization but "public servants" - really?

http://en.wikipedia.org/wiki/Plausible_deniability
How so? Why would they ever be liable for more than actual damages?
I would really love it if they took this a step further. Instead of buying a big block that can become a massive park like Central Park in NYC or Golden Gate Park in San Francisco. It would be more interesting if they created a "graph" of park nodes linked by park edges so that there isn't a separation between the two. For an example of what such a project could look like check out this proposal for the city of São Paulo called Ecos na Paisagem:

http://www.flickr.com/photos/12588351@N02/sets/7215762319266...

Additionally, Park Avenue was on e an example of this when it used to be a park that stretched from Central Park to Battery Park:

http://stuffnobodycaresabout.com/2011/05/27/old-new-york-in-...
I wonder who will be responsible for maintaining the streets? My guess is that will still fall on the city of Detroit (because the farm is paying taxes).
I think you've missed the point. Ultimately, moving the port isn't securing the service but is just one more layer. It won't hold against a focused attacker but will hold against a majority of casual scanners just looking for a large number of SSH targets. The goal isn't to do keys OR move the port. The goal is to combine all the factors at your disposal to disrupt and discourage attacks.
When everyone else is the world is breaking more and more about how invasive these programs are a .mil blog is reporting otherwise. Hmm..
Nokia still sells loads of cheap phones that come with a proprietary OS.
He did for sure. Well or at least his team did. But changing it's color to red (like ALL Product (RED)) can't really be called 'designed' in my opinion. Or else I'll just take a standard orange pencil, make it red, call it new design. Boom.
Is it?

Let's say I buy a new 2014 Corolla for $16,800 and keep it for 20 years.

My insurance (in BC) would be about $100/month or $24,000

Even according to the Edmunds' calculator, insurance is the largest single cost.
All of this, and more, is probably why Google Ventures invested heavily in Uber in their latest round. (Note that they got a lower valuation than TPG was paying in the same round, so they must be bringing some tech to to table...)
Yes, you have pointed out - a targeted attack.

What if non-targeted attack like a robot scanning all port 22 in your datacenter?
I love how "Indifference" is still in use to this day.
"algorithms will never be able to do that" -> You seem to know very little about machine learning and AI.
Here is something to think about, the author is right, but if you follow many ssh setup tutorials that say to move to say port 25000, you are less likely to be port scanned than the default, but still more likely than if you had used something totally random like say port 42 or 818. By me even writing this clever hackers will start scanning those ports too, just to be sure they are hitting everyone. That being said, any port is better than the standard one and picking an unused port instead of the standard ssh port will give a reasonable 80/20 benefit for a lot of people.
So basically, he's gained root once to kill ssh running as root, but you think that gaining root again in order to run something on port 22 is what's going to stop him?
It As Easy As: Clicking The Link, Sign Up, Make $Money$
You can always switch to getblimp.com. (Shameless plug by a cofounder).
Dana S. Scott: Lambda Calculus, Then and Now
Maybe the whole concept of genius is a bit aged, weird and odd to start with? A glorified genius-concept comes uncomfortably close to the concept of a führer.

I think all men are created equal and when someone looks way smarter than the rest, most often he is just faking it?
Show HN:BzzzFeee the next step in social media. GIFs generated from BuzzFeed.
Wasn't it posted on HY that modern exploit tools like metasploit scan all ports for SSH services by default now?

That was my biggest reason not to bother changing the port.

Is there any real reason beyond that? (I do use fail2ban to block repeated attempts.)
Mandatory relevant XKCD: http://xkcd.com/932/
> Where Real Uploaders Meet

This slogan reads like a bad dating site
> the average U.S. commute is around 32 miles round-trip

That’s the same commute as I had during my time in high school. I did it on a bike, for 4 years, as did everyone else in my class. (I grew up in the Netherlands, where this is normal.)

> Raising gas taxes is going to cost people who have longer commutes

Which in turn will make people live closer to their work place and it will promote working from home. People might also start lobbying for more and better public transport.
octopress on github pages with prose.io, cheap and effective
Here's some information from python-dev about problems with Mavericks and python

https://mail.python.org/pipermail/python-dev/2013-October/12...
I think it's even better than this. A family doesn't need one car, it needs zero cars, it just needs to be able to use one or more cars on demand.

The average family uses their car probably less than 10% of the time. The rest of that time could be used by others.

Once self-driving cars are ubiquitous, I expect that an Uber-like service will be the norm. You either subscribe or rent per trip and schedule when and where you want to be picked up.

The service you subscribe to has a fleet of cars and knows when people want to be picked up and where they want to be dropped off, as well as whether you're willing to carpool on the way (for a discount). They can optimize the scheduling of their fleet in the same way that FedEx and UPS optimize their driving routes now.

The future is going to feel a little strange and I can't wait.
Thats where fail2ban is useful, pick a number of failed auth attempts on any service you care to integrate, lets say 8 PAM failures, and trigger a rule that inserts an iptables rule to drop/reject the attackers IP for 5minutes. That will time out the ssh scan for all but the most patient scanners. If you shared the fail2ban database across hosts you could inject null routes for the offender into your router or block them at your firewall.
Regardless of what the law says, we shouldn't forget that this is assholish behavior. And Vinod Khosla should be ashamed of himself.

Not that he cares or that I'm trying to incite anything. It's just important that we not forget this important point.
Thank you so much Blackberry team. I was waiting this app. It is really great user friendly and smooth.
In fairness, multi-user linux systems have been losing popularity for a long time, with KVM/xen-based VPS services taking over for having significant advantages in security and software compatibility.

A young software engineer in today's environment can easily never have any exposure to a truly multi-user OS.
You know, people in Japan drive little cars, and they get a bit of snow too:

http://www.google.com/imgres?imgurl=http://webecoist.com/wp-...
The reason he's right is most attacks on SSH are one-dimensional.

In most cases the dimension is IP range - an automated process moves from IP address to IP address examining port 22 for any common vulnerabilities. Rarely do these processes check all ports. Moving your SSH deamon to a different port prevents those automated processes from then hitting your security layer on whichever port you are running.

The other dimension of attack is when an attacker is focusing on your IP address specifically. Then he probably is going to nmap your IP and discover which port(s) SSH is running on. Changing the default port for SSH doesn't help here, but this use case is far less common.

Like others have said, changing port doesn't remove the need for security measures (cert-based/passwordless login, disable root, fail2ban) but it reduces any of those even being tested in the first place when most of your attempted attacks are IP-range based.
Don't they usually make that public?
I completely agree, moving the port is a must just to change up the configuration from everyone else's. Configuration items like port numbers are meant to be tweaked, especially when you can just stick a unique SSH port in your ssh_config.

However, it's not hard to imagine these scanners have moved further past the days of the Morris worm and aren't just simple port scanners. Identifying what services are on what ports is a relatively easy process that doesn't remove much from the discovery phase of a bot or script kiddie. Hell, code review metasploit for a half hour and rip theirs out.
I think you're misunderstanding - GNU/Linux is a multi-user OS regardless of if it is run in a kvm/xen/etc container or on bare metal.

Even if only one person (or no persons) ever log in, the machine is capable of running processes under multiple users and it is best practice to maintain this so that all users do not share the same level of privilege.
The ability for someone to "spin up a daemon on your server" would also be called an unprivileged exploit. The ability to spin up a daemon on port 22 on your server, however, would be called a privilege-escalation exploit waiting to happen.

If a zero-day gets discovered in the kernel that allows the former, you'll be hoping that it isn't also the latter. This is why trusting unprivileged ports is a bad idea.

(...until, you know, we finally start using DNS service-records for this sort of thing.)
Goodness, that actually looks like something from Road Runner cartoon.
...and why, pray tell, are they still providing turing tests to humans, if they already know who the humans are, you ask?

Well! Very obviously, any human can behave just as maliciously as a bot might! So captchas are there to slow us down. Point blank. They are flood control. They prevent spam, be it from bot or human.

The real question is, why would Ars Technica be so chicken-shit, that they can't come out and say that?
For background see: http://en.wikipedia.org/wiki/Colorado_River_Compact. Basically growth of southern cities has meant demand for water from the Colorado river has gone up while rainfall in the region has decreased. There is still a surplus right now, but that won't continue indefinitely.
Their apex has been up and down since the stories broke.
I have an uncle who works for a infosec company which has contracts with the provincial government. I know that internally, the police of the province (which is called the SQ) has no real power in terms of hacking investigation. It really is sad. They rely on gathering info from sources such as Facebook, that's how they got the kid.

What this article does not say is that right now is his first court hearing but they had found his identity a couple of months ago. My uncle was at the press conference where they said that they had found him and after it was finished he asked one the police officer on the case how they had found him. He straight up told him that they found him because he talked about it to his friends on Facebook. If not for that, the kid would not have been caught. The alternative is to wait for him to commit a crime against the great US of A and have the FBI do the job.

For the record, I'm a 20 year old guy from Quebec and I really wonder what I could have done if I tried my hands at it. I'm also glad I didn't.
This is absolutely true. But unless people have started to also run their webapps and other daemons as root, the boundaries still cling to relevancy.

But maybe I just miss computers where finger, write, wall and talk were all useful commands.

And people say things are more social now? The growth of hypervisors made our operating systems desolate and lonely! :)
The questions the article asks are extremely poor.

> Could automakers prevent hackers from getting into onboard computers?

"Hackers." Modifying their own cars. Terrible.

> And who would be liable in the event of an accident in a self-driving car?

The insurance company.