By ByteBot
In 2018, an Australian amateur radio developer registered sondehub.org as a joke — a redirect to an existing radiosonde tracking site with slightly better filtering. By December 2024, he was receiving messages suggesting Russian military actors were DDoS-ing his server to disrupt Ukrainian drone operators pulling real-time wind prediction data. He also invoiced the U.S. Department of War for data access that year. The invoice went unpaid. Welcome to how open-source infrastructure works in 2026.
The story, published today by developer xssfox at sprocketfox.io, hit #1 on Hacker News within hours with 566 points. It deserves the attention.
Wind Data Is Not Just Meteorology
A radiosonde is the instrument package attached to a weather balloon. Agencies worldwide launch over 900 of them daily, measuring temperature, humidity, pressure, and — crucially — wind speed and direction at altitude. NOAA explains the basics: the data feeds global weather models. What NOAA does not cover is that the same data feeds artillery ballistic calculations, FPV drone navigation, long-range munition trajectory modeling, and parachute cargo drop planning. Wind at altitude is wind at altitude — the physics do not care who is asking.
SondeHub aggregates radiosonde telemetry from 313+ volunteer receiver stations running cheap software-defined radio setups globally. It runs a prediction engine that models where a balloon will land — and where it came from. That reverse-prediction feature, built to help hobbyists recover fallen radiosondes, accidentally mapped classified military launch sites in 2019. When military facilities discovered this, they contacted SondeHub and requested removal. The developer obliged.
The China Balloon, the DDoS, and the Drone War
The first major inflection point came in February 2023. After the U.S. shot down a suspected Chinese surveillance balloon with an AIM-9X missile, SondeHub traffic exploded. .mil and .gov email addresses flooded the support queue. The site had become the public reference for understanding what these objects were and where they came from.
The more significant inflection came in December 2024. API request spikes — massive, single-source, concentrated near the Ukraine-Russia border — hit SondeHub’s wind prediction endpoint. A message via Telegram offered an explanation: Russian actors might be attacking to disrupt Ukrainian forces using SondeHub’s wind data for drone operations.
The developer’s response is the most striking part of the story. Rather than block the traffic or shut the endpoint down, he contacted AWS support with this: “It is incredibly important that the source AWS account is not blocked, rate limited or terminated — loss of life could occur.” He then built a self-hostable Docker version of the predictor so operators could run independent instances regardless of what happened to the central service.
The logic is worth sitting with. The party DDoS-ing his server was presumably trying to deny it to the other side. Shutting down to stop the attack would have accomplished the attacker’s objective. So he kept it running and made it harder to take down permanently.
Invoicing the Department of War
When the U.S. Office of the Secretary of War formally requested radiosonde data in 2025, xssfox did not provide it for free the way he does for the amateur community. He invoiced them. His reasoning: “if we didn’t do it someone else probably would.” The invoice was never paid. No follow-up arrived. The government presumably found the data elsewhere — it is, after all, public atmospheric data from civilian weather stations.
There was also a surreal exchange with an FAA tower supervisor requesting airspace coordination for meteorological balloons. The developer had to explain these are uncontrolled, legally untracked objects operating under FAA Part 101.D regulations that no one files individual flight plans for. His summary: “Explaining to the FAA that weather balloons exist wasn’t on my bingo card.”
The Question Developers Are Actually Asking
Dual-use technology debates usually happen at a comfortable level of abstraction: AI weapons targeting, facial recognition infrastructure, surveillance APIs. SondeHub makes it concrete and personal. One developer, no military intent, no government funding, no formal agreements — and his project became real-time intelligence infrastructure in an active war.
The code is still on GitHub. The API is still public. Restricting it would not stop the underlying data from flowing — NOAA and European weather agencies publish the same radiosonde feeds. SondeHub just made the data more accessible and the prediction better. That is enough to matter in a drone war.
xssfox published his account openly, ethical uncertainty included: “Suddenly my mind was filled with ethic and legal questions.” He did not walk away with clean answers. The ACM Code of Ethics asks developers to consider whether their work will be used responsibly — but offers no playbook for the moment impact arrives uninvited, at scale, in a war zone.
What makes this account worth reading is not that SondeHub ended up in a war. It is that the developer documented what he did about it — the invoice, the AWS message, the Docker containers built in response to an active military DDoS — and admitted he still does not know if he made the right calls. That level of candor from a developer caught in an impossible situation is rarer than the situation itself.
