Why many Indian politicians have a criminal record - <AUTHOR> http://www.economist.com/news/books-and-arts/21716019-penchant-criminality-electoral-asset-india-worlds-biggest <comment><USER2> The Article doesn't cover basics of Criminality of Indian Politicians.

These are just two example in last week from 1 south Indian state caught on camera (Because Local media would not cover since pretty much media in state supports ruling party):

[https://www.youtube.com/watch?v=wOueUSVSuYk](https://www.youtube.com/watch?v=wOueUSVSuYk) [1]

[https://www.youtube.com/watch?v=3hG2fqW- tcM](https://www.youtube.com/watch?v=3hG2fqW-tcM) [2]

Very rarely criminality of Indian politicians comes out because Media do not want to cover it. These showed up because someone could record. But in both cases, elected representatives and their goons are already out of trouble.

India is a land of lawlessness and that's a reality.

[1]A journalist being beaten by local representatives brother because he wrote on their corruption.

[2]Goons of local representative beating a women (1 eyed mind you) because she didn't agree for their illegal construction in front of her house.

<comment><USER3> The videos you linked were so hard to watch.

> India is a land of lawlessness and that's a reality.

It's a little more subtle : well connected people to whatever they want and get away with no consequences. People who dare to oppose these powerful people discover the true meaning of hell. It's true practically everywhere in the world including the US.

IMO for all the shit that social networks receive (for good reasons), one of the side effects is that it's a lot easier to share such gross violations of law an example of which are the above videos. In a way social networks give people power.

<comment><USER4> >People who dare to oppose these powerful people discover the true meaning of hell. It's true practically everywhere in the world including the US.

It can be true in the US, but it definitely is not the norm. This statement rings false. For all the problems the US has, yes including corruption in some places, it is almost entirely unique in its freedom of speech and its allowance for political opposition without fear of retribution as a modus operandi.

<comment><USER5> > its allowance for political opposition without fear of retribution as a > modus operandi.

Are we talking of the country of COINTELPRO, that killed civil rights activists, or obliterated unions and the US socialist party by force and shady tactics? it's like, you can say what you want, as long as it has zero consequences -- otherwise, prepare to meet some serious shit.

<comment><USER6> We destroyed the unions so hard that there are over 7 million government employees who are members of various unions.

Because when a government really destroys a group they let huge swaths of their own employees join that group.

<comment><USER5> No, they make sure that what's left as unions is pretty much harmless.

</comment></comment></comment></comment></comment></comment><comment><USER7> Rampant corruption has turned a lot of people into cynics in India. The phrase "Kuch nahi ho sakda India da. China dekh lo kithe pahunch gya" (Nothing will happen in India. See the development in China) gets thrown around a lot in a conversation.

It isn't a problem that affects a single party, both the ruling BJP and the Congress have the same issues. The problem with BJP being our Dear Leader being rather illiterate and surrounded by "Yes Men". The man behind the demonetization was found out to be an individual with a PhD in Yoga. And of course, there's 2002.

The Congress being the Congress mired itself with a series of scams in it's second term, and thus began what Bannon calls the "start of the right-wing revolt".

A personal anecdote about the Congress: A cousin of mine once decided to run for the Lok Sabha but quickly changed his mind because he found out the Congress guy was bribing the poor people (of which there were a lot in his village) with bottles of Johnie-Walker from the past two elections. And ofcourse, it was easy for the said Congress individual to do so because the then Chief Minister was close to Ponty Chadha, the liquor baron with a monopoly in the state of Punjab, for which the CM went to Dubai unannounced [1].

You could write a multi-volume encyclopedia on the tales of the corrupt Indian Politician.

[1][http://www.tribuneindia.com/2005/20050712/main3.htm](http://www.tribuneindia.com/2005/20050712/main3.htm)

<comment><USER8> This is what makes AAP's victory in Delhi not so surprising. Delhi is far richer than the rest of India; blatant bribery doesn't work quite as well here as it would be in another state

</comment></comment><comment><USER9> I have another theory. You don't get votes in India. You buy them. A wannabe politician needs a lot of money to win an election. Criminals who have made money through bootlegging or by beating up people have a leg up in this respect. Once they get to power, they indulge in corruption to pay off the people who helped them win and to save for the next election. The next election, they have more money to pay the average voter so his competitor needs to be an even bigger criminal.

<comment><USER10> How do you buy votes if the ballot is secret ?

Not saying that people don't try, and there is that odd politician who does come only from money. By and large most chief ministers victory can be explained not by money, but more by identity/group based politics.

This is pretty much also exactly the same to what happens in the US.

<comment><USER11>
        > How do you buy votes if
        > the ballot is secret?

Is this a rhetorical question?

The answer is by distributing 2,000INR notes to people and transporting them to the polling station, relying on reciprocity and promising more to come if you get elected.

<comment><USER10> No its not rhetorical and your answer is naive at best.

People in India will take money if you give it to them, but they will vote on identity only. This is because there is no reciprocity - once the voting is done the politicians have no incentive to pay them again and they don't. The only reciprocity that exists, if at all, is along identity and everyone gets it.

Take a look at any CM in any state of India - their win is largely explained by identity and not money. The current PM who was two time CM of a state, doesnt even have a house to his name.

<comment><USER11>
        > People in India will take money
        > if you give it to them, but they
        > will vote on identity only

Extraordinary claims require extraordinary proof.

        > This is because there is no reciprocity

This is the opposite to what published science suggests, and thus needs something stronger than "here's what I think should be the case"

<comment><USER10> Thats because that published science is born of a prejudiced mind. I have spent my entire life in this country and been a part of the political process in many different ways. Pick any random person from the street in India and he will tell you as much.

</comment></comment></comment></comment></comment></comment><comment><USER12> The article fails to differentiate between charges and conviction. In India anyone can get charged for a crime no one ever gets conviction.

As an Indian I think Criminality of Indian Politicians is a non issue. Very few of the politicians are actual hard criminals. Most face charges that anyone in important position is likely to face.

Nearly all my politician friends have been in jail and have criminal records but I can vouch they are pretty good people.

India does not uniform laws and far too many laws to deal with the exactly same crime.

Examples: 1\. One of my friend has been fighting in court for last __7 years __over a case registered on him by his political opponent. My friend called him "asshole". However as per Indian law it is a crime to abuse a person if the person belongs to specific caste (SC/ST) not just that, the police are required to register the case even if they think the charges are frivolous or unsubstantiated. This gentleman has been visiting court every few months. The charges will be dropped some day as a political bargaining chip.

2\. I barely escaped having a criminal record when I participated in a political movement. The cops basically filed any random charges against the protestors including molestation, attempt to murder and what not. I escaped because I had a fake ID card with fake name on it.

3\. A lot of civil offenses are "crimes" in India.

For example you are CEO of a publishing company that publishes a scholarly book on world mythologies. Some person files a complain saying you (CEO) has hurt the sentiments of public which is a criminal offense. India Ebay CEO was arrested as a criminal becomes someone sold a CD on the website that had porn clip in it !

4\. Courts that don't work.

Indian courts spend time only on cases that make the judges popular. Such as cases that involve celebrities or cricket. That is why conviction rates are next to nothing. One Indian celebrity recently got acquited from tow major crimes after around 12 years of fight.

5\. Drinking wine or beer might be a crime in some states and in one state they want to give capital punishment for the same.

6\. Eating beef might be a criminal offense.

</comment><comment><USER13> In case anyone wants to see more specific data, there is a site ([http://netafilter.in/](http://netafilter.in/)) that displays all constituencies, their MPs and the number of cases filed against them on a map.

<comment><USER14> This is really nice. Any sources for the data?

<comment><USER13> The information icon at the top says the database is from [http://www.myneta.info/](http://www.myneta.info/), another decent site for Indian political data.

Myneta.info looks like it is maintained by a group called The Association for Democratic Reforms ([http://adrindia.org/about-adr/who-we- are](http://adrindia.org/about-adr/who-we-are)), and based on affidavits submitted by the candidates themselves (apparently a Supreme Court declaration that makes it mandatory). This means the actual number of cases could be different from those declared.

</comment></comment></comment><comment><USER15> There are some comments in this thread bringing out examples of corruption in the West. While Western societies are by no means perfect and have their own warts, they are much better than India when it comes to corruption, effective judiciary, free press or tolerance for scandals.

People typically vote with their feet. If you have any doubts about which society treats its citizens better, just look at how many Indians are clamoring to get out of India and immigrate to USA/Europe and the numbers of Americans/Europeans wanting to immigrate to India.

<comment><USER10> If people voted with their feet, how do you explain Bush and Trump ?

<comment><USER15> Maybe because nearly 50% of voting population actually preferred Bush/Trump over the alternative? Especially when federal government has vastly increased its power (defense, education, environment, taxes, social policies) and when president has the rare power of nominating supreme court justices who can then stay forever deciding crucial matters (corporations, abortion, gay marriages, affirmative action...). In such cases, its better to vote for a bad candidate on "my side" rather than a better candidate from "other side".

In fewer words - hyper-polarization. Once you win republican or democratic primary, you are guaranteed to win 45% of the vote.

</comment></comment></comment><comment><USER16> >Mr Vaishnav dispels the conventional wisdom that crooks win because they can get voters to focus on caste or some other sectarian allegiance, thus overlooking their criminality. If anything, the more serious the charge, the bigger the electoral boost, as politicians well know.

Nothing in the article backs up this statement. I hope when the author publishes his book, somebody will point out why.

I believe caste and identity politics play a huge role in such elections. Thefts and crimes are ignored precisely because people think that XYZ crook(from their caste/community) has the courage to stand up to authority and will represent them properly.

Different communities promote up their own representatives and as the elections becomes dirtier, in the end only crooks from various communities stand up.

Kind of similar to how capitalism forces merchants to sacrifice most skills not relevant to 'reducing cost/making money', Indian politics does this to our MPs/constituencies. Money and muscle power become a pre-requisite for being considered as a possible electoral candidate.

Then again, the advent of social media and the internet has started changing things (I don't have stats to prove this though). Crimes committed by MPs (or their families) are being highlighted throughout the country and the guilty are being shamed. I use the word shamed because I am not too sure what happens once the media spotlight moves somewhere else. Possibly, they walk free...

</comment><comment><USER17> Many US politicians and officials would easily be considered war criminals if there were any sort of binding international law. Even more would likely be jailed for activities that are well known if they weren't already powerful.

Once criminal organizations get powerful enough they can start doing extensive image management and PR, as well as building elaborate headquarters complete with fancy architecture, columns, etc.

Governments are simply the most successful criminal organizations. We the people are continually fooled by the grandeur of the columns and the silly dignity of the titles.

We're also overly grateful for the gifts of patronage they dole out to keep us at bay such as welfare, medals, etc.

The more pomp and circumstance, the more ritual and solemnity, the bigger the racket. It should be no surprise that both candidates in the recent US election still have numerous FBI investigations into their business dealings, and the majority of Americans considered both to be highly unfit for office.

Our presidential motorcade is a sham... The vehicles are tanks made to look like limousines, yet we'd look down upon a foreign leader who paraded around in a tank.

All tyrants attract sycophants, and in our case they make up most of the political and media elite. The most humiliating display in our nation is the exceedingly rare occasion when a president condescends to sit for a one-on-one interview. The softball questions are spoken with a humility (and a reassurance that there certainly won't be any sort of tough follow-up question) that should make us all gag.

In the US, there is a steady stream of news stories about corrupt or otherwise undesirable situations elsewhere in the world.

</comment><comment><USER18> Indian villages are still tribal. The tribal cheiftains win the elections. As there is no legitimate methods to be chieftains, the way to be one is to show power or be a criminal. Now real power is with politician, and crininals become politicians. There is also corruption. The higher posts are occupied by castes in higher levels. There has to be a way to create a level playing field and that is not to stop corruption but force the bureaucrats to take bribes from all sections of the society. For that you need criminals as leaders. So OBC, other backward communities (official name) and communities in lower level elect leaders with criminal background. The communities in the top level have their members in bureaucracy and they are "influential".

</comment><comment><USER19> India has one of the largest below poverty line and uneducated population in the world. Isn't it obvious that you can just win them over giving them a little money as less as 500 or 1000 Rs which is gonna make their days. I remember when the voting guys come to my town, the parties generally setup up a buffet system for lunch and if you had voted for the party you get free lunch. An then there is giving free gifts like TV's, Phone's and mixers if you vote for them. Tell me can you challenge a system like this??

<comment><USER20> Anonymous voting, so you can just lie about it and get the free gifts anyways?

<comment><USER21> Isn't voting in India already anonymous?

I suspect that even with anonymous voting people's psychology will compel them to vote for the party who gives them a gifts.

</comment></comment></comment><comment><USER22> Ironically, the photo in the article is of former CM Jayalalitha who passed away last month. She has pending corruption cases against her. But when she died, the outpouring of praise from most people, many who were even against her while she was alive, has been unbelievable.

</comment><comment><USER23> > "One can walk just about the whole way from Mumbai to Kolkata without > stepping foot outside a constituency whose MP isn't facing a charge."

So there's a line of clean constituencies from Mumbai to Kolkota? That 'isn't' should be an 'is'.

</comment><comment><USER24> India does have a high level of criminality and corruption in politics, but it is different from the U.S. in one aspect.

An Indian politician who brags about sexual assault and doesn't even deny video-taped evidence of the bragging .... would have no chance of being elected as Prime Minister. As we demonstrated in November, American voters have a much higher tolerance level when it comes to electing our president.

<comment><USER25> I beg to differ here. In India, you can be elected as a PM if you have large social media brigade. Our current PM has charges of rioting against him and he won by huge margin by using effective PR and his social media brigade.

<comment><USER26> I am not saying he was not indirectly responsible for the riots, but he has been cleared from those charges.

</comment></comment></comment><comment><USER10> Article sounds racist, but this is the economist after all.

Here is the thing - If you look at the past 5 Prime Ministers of India and compare them to the past 5 Presidents of the US, you will find that India more or less throws up much better candidates than the US for the top spot.

If Indian politicians had such a criminal record, this would be unlikely the case.

<comment><USER27> I cannot imagine why you'd think The Economist is generally a racist publication. Have you ever read it? Really? I do not get such an impression from TE at all and I read it often.

As to this article, The Economist is reviewing a book by a third-party. If the facts are correctly quoted from the book, the book's sources are correct and the item is newsworthy, I see no problem at all with such a book review.

There need be no racial motivation for pointing out institutional failings in any country. India is an important country in so many ways, and the readers of The Economist would surely want to know about politics there.

<comment><USER10> It is racist because the institutional failing it is pointing out is born from the publications/authors prejudice rather than any objective assessment of reality.

<comment><USER27> Thanks for trying to explain your position. I don't have the facts myself. Perhaps you could give a specific example of which data in the article were incorrect. Also, I would be pleased to know how you were able to discern the motivation behind the supposed mistake(s) made in the article.

</comment></comment></comment></comment><comment><USER28> I'm an Indian and can verify that. A lot of scumbags keep winning and hold onto power here usually by hook or crook. In fact even the prime Minister modi was on a mass murdering case of Gujarat 2002. He was the chief minister when the riots Happened!! That guy has still not even apologized or said sorry to the families whose people were killed. The current govt has the largest share of criminals in power. There are some honest players coming up. We'll see if they are really honest in a few years.

<comment><USER29> What about 1948,1986,1992,2013... Riots , why always whining about Gujrat or you think that only in gujrat riots politicians were involved ?

<comment><USER28> They are not the prime ministers now. The context that we are talking here is about the current govt. If the previous govts had lots of wrong doers then it doesnt mean the current govt doing the same is okay. Get your priorities straight.

<comment><USER30> Using the same argument - we shouldn't discredit those crimes and criminals just because they are not prime ministers or chief ministers now. Get your priorities right.

</comment></comment></comment></comment><comment><USER31> This is why British offered a separate country to UC/BC/SC/ST/Sikh/Christian/Parsi/Buddhist/Jain communities in 1932 [https://en.wikipedia.org/wiki/Communal_Award](https://en.wikipedia.org/wiki/Communal_Award)

</comment><comment><USER31> AKA [https://en.wikipedia.org/wiki/Stockholm_syndrome](https://en.wikipedia.org/wiki/Stockholm_syndrome)

</comment><comment><USER31> Voting in elections is Hegemony, not Democracy in India without goo.gl/forms/g4fX5CELGg</comment>


Air Gaps - <AUTHOR> https://www.schneier.com/blog/archives/2013/10/air_gaps.html <comment><USER3> Is there an effective way to "mostly" airgap, if you need Internet connectivity for your work? This is a comment I posted on a similar thread a few weeks ago.

</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>=====

Just curious, how would airgapping be practical if you need Internet connectivity for your "real work"? For example, let's say you run a quant trading firm and the algorithms you're concerned about being stolen need connectivity to download live trading info, and then after processing that info they need to communicate buy/sell orders to the outside world. Are there any methods that could be used that would prevent all communication with a secure system (with an airgap level of certainty) besides the strictly defined data you need to do your "real work"? \-----

gaius 19 days ago | link

Sure, you would just use Radianz, and that is in fact what everyone does. This is a very solved problem! Bloomberg also operates a private network, and there are others too. These systems can operate perfectly well without access to the public Internet. A couple of jobs ago I worked at a financial services firm with 2 networks and 2 PCs on everyone's desk. Rednet for outside connectivity, and an internal network for real work, and never the twain shall meet. NO-ONE needs the Internet for real work, let's be honest, just for goofing off. Time we all started to prioritize security over mere convenience. \-----

*

wikiburner 19 days ago | link

Yep, maybe trading wasn't the best example, although they are still effectively at the mercy of the security of their data providers network - which admittedly is probably quite good. Let's say you're a P.I., journalist, researcher, law enforcement, or intel agency, and need to automate news or people searches for some reason. If you were able to very strictly define the data you're expecting to receive, isn't there any way you could automatically pass this data on to a secure system without opening yourself up to exploits?

<comment><USER4> I've not played in this space for a looong time but...

There are four things you want to do -

1\. Get a herd of cash together. The stuff that follows is not cheap.

2\. Set up a hardware data diode (an appliance that only allows data to travel in one direction). [1]

3\. Set up an air gap like Whale Comm's appliance used to do (two 1U rack- mount servers, back-to-back, which [dramatization alert] automates plugging a USB stick into one server, copying data onto it, pulling it out, sticking it into the other server, and coping the data onto it - at ~10Mb/s, if memory serves). [2]

4\. Any time anything traverses the trust boundary, convert from one format to another, so PDF becomes RTF, DOC becomes TXT, PNG becomes GIF, and so on. The point is that converting attachments into other formats drops malicious payloads, or stops them from exploiting vulnerabilities in the apps that open the original formats.

[1] Tenix used to do one, but they cost crazy money (millions). I don't know much about this space anymore, but this might provide some pointers: [http://en.wikipedia.org/wiki/Unidirectional_network](http://en.wikipedia.org/wiki/Unidirectional_network)

[2] Whale Communications was acquired by Microsoft. The product is now called ForeFront Unified Access Gateway, and while still a good application firewall, no longer provides that air gap ([http://en.wikipedia.org/wiki/Microsoft_Forefront_Unified_Acc...](http://en.wikipedia.org/wiki/Microsoft_Forefront_Unified_Access_Gateway)). I've no idea who else can do this.

<comment><USER5> My employer (Fox-IT) sells a data diode ([https://www.fox- it.com/en/products/datadiode/](https://www.fox- it.com/en/products/datadiode/)). List price is "call us for a quote", but the quote won't be anywhere near $1 MM.

Using a "proper" diode instead of hacking something yourself gets you a guaranteed-good solution - how much do you trust your firmware? - plus some software that automates "I want to send X through this machine" for many common and/or high-value instances of X. That said, custom hardware plus custom software plus certifications plus enterprise sales is indeed (a lot) more expensive than snipping the tx wire/fiber.

Automatically copying USB sticks doesn't seem particularly useful to me.

<comment><USER4> The air gap (copying data out of band, as it were) is useful in that the connection can be physically broken by software on the system high side, using a software kill switch, automated schedule or other rules.

</comment></comment></comment></comment><comment><USER6> Knuth on his air gap: "I currently use Ubuntu Linux, on a standalone laptop—it has no Internet connection. I occasionally carry flash memory drives between this machine and the Macs that I use for network surfing and graphics; but I trust my family jewels only to Linux." : [http://www.informit.com/articles/article.aspx?p=1193856](http://www.informit.com/articles/article.aspx?p=1193856)

<comment><USER7> In a post-Stuxnet world, can we trust flash drives? If I remember correctly, that virus would jump onto flash drives to spread to the next few computers it touched. I think I might prefer an ethernet wire connection without the outgoing wires.

<comment><USER8> As long as you wipe and format the flash drive from the secure computer every time you use it, there shouldn't be any risk. I don't think even Stuxnet could have infected a linux machine that didn't mount or autorun the partition.

<comment><USER9> Flash drives are not dumb. I know that Travis Goodspeed has had some success in reflashing their microcontrollers to speak corrupt USB to attack USB stacks of host machines (which of course run in kernel mode).

<comment><USER10> A fascinating talk by Travis Goodspeed on the mayhem possible by reprogramming the USB controller in a disk:

[http://www.youtube.com/watch?v=D8Im0_KUEf8](http://www.youtube.com/watch?v=D8Im0_KUEf8)

Writing a Thumbdrive from Scratch: Prototyping Active Disk Anti-Forensics

</comment></comment></comment></comment></comment><comment><USER11> I find it somewhat amazing that a few months ago, I'd have read an article like this and thought "Man, talk about paranoid."

But today, after all that I've read and learned recently, it makes perfect sense.

<comment><USER12> I read a comment just like this a couple of months ago. Someone saying that until this point they thought Richard Stallman was a complete paranoid nutjob but it turns out he was completely correct. I guess that's why he will be seen as a visionary in so many areas.

And speaking of stallman and airgaps: [http://stallman.org/stallman- computing.html](http://stallman.org/stallman-computing.html)

> I generally do not connect to web sites from my own machine, aside from a > few sites I have some special relationship with. I fetch web pages from > other sites by sending mail to a program (see > git://git.gnu.org/womb/hacks.git) that fetches them, much like wget, and > then mails them back to me. Then I look at them using a web browser, unless > it is easy to see the text in the HTML page directly. I usually try lynx > first, then a graphical browser if the page needs it.

<comment><USER13> While I admire his dedication to free software and security, I find it sad that he who has done so much for the internet and modern computing eschews most of it.

<comment><USER14> You could have said something similar about Dijkstra, who most of his life didn't even use a computer.

<comment><USER12> Ihad a formal methods lecturer who insists that no computer scientist should be allowed to use a computer until they are 40

</comment></comment></comment></comment></comment><comment><USER15> I've been setting up networks since 2002 the following way:

Internal network, NOT connected to the internet. External (small network) is connected to the internet, and has "terminal server" (Windows Terminal Server if I must, Xrdp if I can let the external servers be Linux).

Firewall between outside world and external network, configured to allow reasonable work on that network. Firewall between external network and internal network only allows internal network initiated connections to the RDP port (3389) on the external network.

Also, an rsync setup that allows some controlled transfer of files between inner and outer networks (preferable to USB drives - the USB ports should be disabled logically and physically, although I didn't always get to do that). This rsync setup goes through a different port, with a cable that is usually not connected (the air in "airgap"). When files need to go in or out, I plug the cable for a few minutes, and unplug when not needed.

From experience, this lets you keep a network reasonably secure, without having to put two PCs on everyone's desk.

Of course, there's risk: There might be a way to root the inside machines through a bug in RDP, after rooting the outside machines. However, it will work well, against "standard" attacks and malware that assume internet connectivity. Even if they get in (through a USB drive, as schneier says was done in the Iranian and US army facilities), they can't just call out to the internet.

<comment><USER16> RDP makes it easy to access drives, devices, etc. from the the client... do you do any additional configuration to disable these features?

[http://geekswithblogs.net/DesigningCode/archive/2010/04/19/f...](http://geekswithblogs.net/DesigningCode/archive/2010/04/19/file- transfer-using-rdp.aspx)

<comment><USER15> Yes, drive sharing was disabled server side (though, if the external RDP server is compromised, one could turn this back on). On the client side, we set up the connection not to try to share anything.

</comment></comment></comment><comment><USER17> It is completely possible that mentioning Windows in the article was meant to be only a smokescreen. I'm sure a person in his position would absolutely not want to publicly declare the exact solution he is using. In reality, it might as well be something completely else, like Slackware or some USB-bootable distro. Yes, this might be security through obscurity but considering that he admitted that he isn't familiar with the inner workings of Truecrypt etc, it is the safest bet. Not disclosing what exactly you are using doesn't allow an adversary with unlimited resources to adapt and optimize to break this specific scheme.

<comment><USER18> That doesn't seem plausible. He could non-specifically say "don't use Windows. Ideally use [some stock linux distro] or investigate other unix operating systems that can be configured for safety." That wouldn't really give away anything.

<comment><USER19> It's not about giving things away -- it's about delaying your adversary. If the NSA takes Schneier at his word and targets him accordingly, then (assuming this is a diversionary tactic) any 0days or other attacks they attempt to send his way will fail. Now obviously that's not a long-term strategy, but it does provide an extra layer of protection against naïve attacks based on his public statements. To be clear, I'm not sure I buy the smokescreen idea, either, but your reason for disbelieving is flawed.

<comment><USER18> It's fair that this would make some difference. But it's not as "he's not on Windows, but we have no clue what he is on?" is a recipe for quick success. He doesn't have to say what linux distro he uses, just give a placeholder for a decent one, and he doesn't even have to use Linux.

In any case, is it worth potentially misleading a lot of people for the sake of such a marginal increase in his own security? He could have an even more secure setup if he didn't talk about instituting an air gap. He's already giving away information.

</comment></comment></comment></comment><comment><USER20> Windows is a bad choice for an air gapped system. A much better would be Slackware, where its even simple to maintain an air gapped system. Maintaining a Linux with a package manager, e.g. Debian without internet is much more trouble.

I had scripts to maintain an air gapped Debian 10 years ago, but can no longer recommend them, as Debian now has signed archives, and the script breaks the sign.

<comment><USER21> You can still use optical media (CD/DVD) or USB keys to install packages with APT, so I don't see how Slackware would have any advantage over Debian there.

There's even a apt-offline[0] to create a list of 'needed' packages on one system, then download these packages on another one and transport them to the air-gapped system. Of course, you will still have to decide whether to trust these downloaded packages, and unless you trust at least some Debian Developers to do the right thing, this will be hard to do even with GPG signatures on all packages.

[0] [http://packages.debian.org/wheezy/apt- offline](http://packages.debian.org/wheezy/apt-offline)

<comment> vezzy-fnord Slackware is generally more secure by default, such as explicitly requiring root (not sudo) for package management and at least sudo for utilities that prompt the kernel. This is much in the vein of the *BSDs.

Also its conservative nature, constant security advisories and eschewing of bleeding edge are a bonus.

<comment><USER21>
      $ dpkg-query -W -f '${Status}\n' sudo
      unknown ok not-installed

IOW, it is perfectly possible not to use (or even install sudo) on Debian. I don't want to argue whether Debian or Slackware have a more 'conservative nature' nor whether that's an advantage, but there are of course also security advisories for Debian (e.g. today for the systemd packages…).

> at least sudo for utilities that prompt the kernel

Basically everything 'prompts the kernel' in one way or another, could you expand on how exactly Slackware manages to run when every syscall needs sudo? (Or what you mean by 'prompt the kernel'.)

I guess at the end of the day, you can configure a Debian installation to be more secure than any given Slackware installation and you can configure a Slackware installation to be more secure than any given Debian installation – this, of course, depends on your skills and experience with any of the two, so you should use with whatever you're more comfortable :)

</comment></comment></comment></comment><comment><USER22> > 1\. When you set up your computer, connect it to the Internet as little as > possible. It's impossible to completely avoid connecting the computer to the > Internet, but try to configure it all at once and as anonymously as > possible.

There's no technical reason you can't keep your airgapped computer completely off the internet for its entire life cycle. I'd even go so far as to commit heresy say that this is just plain bad security advice that Mr. Schneier is giving out here. Instead, you should probably get your install media from a trusted source and use that to install the OS and any initial updates (maybe that's a manufacturer's install CD or a Linux ISO that you burned yourself - avoid anything that isn't write-once). If the OS on your airgapped machine has a unpatched remote vulnerability, you're already putting that system at risk by connecting it to the internet even once.

Don't discard that trusted install media - if you need to create another airgapped machine, you're using the same airgapped data to perform the install. I realize that Bruce was discussing setting up a stand-alone computer, but I thought I'd share my experience: Years ago, around the same time that Blaster was a nuisance, I managed a network of airgapped machines. If any one of them had been hit because I chose to just let it download updates off the internet, the entire network would have been compromised. This would be much worse if you were worried about a targeted attack - every time you connect a fresh computer to the internet with the intent of moving that box over to the secure network, you're giving the attacker another opportunity to gain access.

For transferring data back and forth, I've used CDs in the past, but toyed with the idea of using a dedicated serial cable for transfers instead. Tar up the files, connect the cable, tell the remote machine to listen, shoot them over, then disconnect the cable. The connection has no network stack to worry about independent programs sending data across the channel; if extra data is added, the result on the other end likely won't untar; there's no auto- execution of programs to worry about. The only thing I have to worry about being compromised are my copies of tar and cat. Removeable media in general has issues - Schneier mentions a few examples in the article of successful compromises using USB sticks.

<comment><USER23> _If the OS on your airgapped machine has a unpatched remote vulnerability, you 're already putting that system at risk by connecting it to the internet even once._

Even if it's behind a NAT firewall with no external ports open? And you only connect via SSL (or SSH) to specific known hosts?

<comment><USER22> There are whole bunch of things you can do to mitigate the risk, and whole bunch of other variables regarding the network environment that you're setting it up in. The network behind that NAT might be compromised, and depending on the operating system there may be ports open by default that could be compromised before you can close them or there could be some other remote vulnerability. I remember about a decade ago having a Windows box that I was wiping/restoring for a family member infected with Blaster after its first reboot before all of the system updates were finished downloading.

Something with a good reputation for security, like a clean OpenBSD install with no ports open, is unlikely to get hit on its first round of updates. Even so, if you're going to go through all of the hassle to set up an airgapped system anyways, why bother taking the risk?

</comment></comment></comment><comment><USER24> For the _really_ paranoid, to the extent that your data can be represented as a text file, you can print it on paper from your internet connected machine and OCR it into your air gapped machine, and vice versa. In this case, you only have to worry about your printer or scanner having a backdoor. If you are very confident in your OCR accuracy, you can encrypt it prior to printing and decrypt it after scanning.

Just remember to burn the paper afterwards.

</comment><comment><USER25> "Don't worry too much about patching your system; in general, the risk of the executable code is worse than the risk of not having your patches up to date."

Not good advice. If you plan to open anything other than text files on the machine, un-patched software is almost as big a risk as transferring executables. The only difference is that it seems less dangerous to you.

<comment><USER26> I came here to say the exact same thing. The problem with complicated file formats isn't that they contain "macros"; it's that the code that parses and interprets those files is prone to memory corruption.

</comment></comment><comment><USER27> I'd do two things differently.

First, instead of using removable media from which data could still be recovered, I'd get a second Ethernet switch. Whenever I wanted to move data from my regular machine to my secure machine, I'd have to move the cable on my regular machine from one switch to the other. Thus it would be physically impossible to be connected to both internal and external networks simultaneously, _and_ I wouldn't be leaving any persistent physical data trail like a USB stick or CD-ROM.

The second thing I'd do is a _double_ air gap. Think of it as an airlock: you can't open the inner door until you're sure no contaminants got through the outer door. The intermediate host would have a single purpose: run malware checks. Thus, only data that had already been checked in a secure environment would even be allowed to touch the real secure machine.

<comment><USER28> You're assuming that the only way to compromise a computer is through a direct internet connection. This is wrong. Pre-internet viruses spread on diskettes.

The point of the air gap is to assume that any computer that has ever been connected to the internet is infected in an undetectable manner and that this infection is capable of spreading autonomously. Only by _physically_ denying the infection the means to spread can you protect against it. Secondarily, you want to deny the infection the means to communicate back home, but sometimes the point of an infection isn't to steal data - see Stuxnet.

<comment><USER27> "You're assuming that the only way to compromise a computer is through a direct internet connection."

I'm assuming the exact opposite. I recognize, as does Schneier, that infection can occur without such a connection. Any mechanism that facilitates transfer of data also facilitates infection. That includes USB sticks and CD-Rs, which have the _additional_ problem of leaving artifacts around for others to pick up later. It's the "we can secure USB sticks better than we can secure networks" belief that's magical.

"Only by physically denying the infection the means to spread can you protect against it."

As soon as you physically move a USB stick from one machine to another, you've effectively created a network. A really crappy one with high latency, but that doesn't make it any more secure _as you yourself illustrate_ with the diskette example.

<comment><USER28> A network connection, even brief has an enormous attack surface. The corresponding surface when using physical media is much smaller.

<comment><USER27> Bull. A network connection _on a physically separate network_ subject to proper inspection/monitoring has a very small attack surface. The corresponding attack surface for a USB stick is larger, with new exploits being discovered every day. The separate switch is functionally identical to the USB stick. They both allow transfer of data. They can both potentially be attack vectors. They both (in this construction) require manual intervention to complete the data path. The only difference is that it's a lot easier to get a copy of someone's data on a USB stick, after someone conveniently recorded their data transfer on a readily purloined bit of media.

You can't acknowledge the exploits that have occurred via diskettes or USB sticks, and then also say they're fundamentally better than an isolated network. It's illogical. In fact, it's stupid.

</comment></comment></comment></comment></comment><comment><USER29> I worked on an "Air Gapped" network. We didn't call it that. As the internet and open source took off it became more and more painful.

To get files over to the network, we'd have to download from internet and then burn to dvd and bring it over. The thinking was that DVD's with their write once capability would prevent unwanted files from hoping aboard. This didn't help if the file you were transfering was infected, but files were virus checked before burning.

Oddly files went Windows->Dvd->HPUX machines meaning the virus scan on windows was somewhat useless.

But having no access to cpan or online research on your main work machine was hard.

</comment><comment><USER30> This article misses the most important security tip: _do not_ use any proprietary software, especially the ones starting with "W" made by MS.

<comment><USER31> Are you sure? How much more difficult would it be for an intelligence agency to get an open source hacker to "accidentally" inject a vulnerability disguised as a bug, than to pressure MS to write a backdoor? (or to get MS to hire a mole)

<comment><USER30> Yes I'm sure. It would be much more difficult, because that vulnerability could be possibly detected by many people reviewing the code, so it must be more sophisticated and hidden than the one buried in the precompiled binary. Also I haven't seen any discovered backdoor/vulnerability on widespread open source product yet, contrary to the countless examples of products by big names. Not saying that open source is 100% secure, but it's still _much_ safer than proprietary programs.

[EDIT] Thanks for pointing out Debian SSL example, I wasn't aware of that. But it still doesn't deny the key point I mentioned - that there are more discovered backdoors and vulnerabilities in proprietary software than the open one.

<comment><USER32> All those people reviewing the code took two years to discover the Debian SSL bug.

[https://www.schneier.com/blog/archives/2008/05/random_number...](https://www.schneier.com/blog/archives/2008/05/random_number_b.html)

[https://wiki.debian.org/SSLkeys](https://wiki.debian.org/SSLkeys)

<comment><USER9> Now how long would that have taken WITHOUT source code?

Would we _ever_ have known (without keyfiles on disk to analyze)?

</comment></comment></comment></comment></comment><comment><USER33> Man, Bleachbit sure took no time at all to put up his "testimonial" blurb on their site!

> "Since I started working with Snowden's documents, I have been using [...] > BleachBit" \-- Bruce Schneier _

<comment><USER34> haha I was thinking the same when I noticed it. Has anyone here used BleachBit? From the description it looks like ccleaner + eraser mix.

<comment><USER33> I'd try it out if I weren't a Mac guy these days. Looks decent, and nicely minimalist.

</comment></comment></comment><comment><USER35> What about isolation? With heavy use of virtualization one can make the air gapped machine even more secure:

\- Only open documents in a virtual machine \- Only interface with the document transfer media (cd/dvd etc.) through virtual machines. Don't ever mount or use this media on your host. \- Clone a new throw-away virtual machine for opening EACH document and delete it after reading the document

About his points:

1) This is nonsense. It's possible to set up an OS (for example linux) with zero internet connectivity, just download the ISO on another computer, verify checksums and signatures, burn onto optical media and you're set.

8) Also, use one-time media. Write once on the internet host, fill up and finalize media, read once on the air gap host, destroy media.

Also, I don't think Schneier is recommending to use Windows for this task. He's just assuming that most people out there is using Windows and can use these tips to improve their security. For his own high security setup(s) I'm pretty sure he'd have the common sense to not use Windows.

</comment><comment><USER36> Surprised that he decided to use Windows.

<comment><USER37> If you assume your connected machine is going to get p0wnd, and you rely on the air gap to prevent your secure machine from being penetrated, you could run any OS you like, no matter your opinion of how much the vendor cooperates with the NSA.

<comment><USER38> Given that he's going to the level of preferring a store-bought USB stick over one found in a parking lot, it shows he's concerned about transferring malware. Not using the OS for which the most malware exists seems like a sensible choice.

After all, if you're going to all this trouble and inconveniencing yourself in the name of security, what's a touch more inconvenience with using an operating system that you're less user-friendly with?

<comment><USER39> Who is your threat? Are you worried about a spray-and-pray attacker who just dumps a bunch of malware out there? Or are you worried about being specifically targeted by someone who wants your stuff?

In the first case, a USB key bought at a big box store might be full of malware. In the second case, the big box store is the perfect place to buy something, as long as it's not the store where you always buy stuff, because the APT wants to keep his profile small.

</comment></comment></comment></comment><comment><USER40> Ironically it is a result of modern encryption that separating things from the internet is so difficult. If every app sends data over an encrypted channel it makes it much harder to audit what exactly it is doing. You can't impose rules if you don't know what the data is or where it will end up.

</comment><comment><USER41> He forgot to mention keeping the computer in a faraday cage. If he has Snowden info, it seems likely that intelligence agencies would be monitoring him closely enough to use Van Eck phreaking to spy on his laptop display (or other part of the computer that leak info through rf, which is all of them).

<comment><USER42> Schneier explicitly mentioned tempest ([http://en.wikipedia.org/wiki/Tempest_(codename)](http://en.wikipedia.org/wiki/Tempest_\(codename\))) in the article.

<comment><USER43> Wild stuff!

[http://lasecwww.epfl.ch/keyboard/](http://lasecwww.epfl.ch/keyboard/)

</comment></comment></comment><comment><USER44> "the first company to market a USB stick with a light that indicates a write operation -- not read or write; I've got one of those -- wins a prize".

Get to work, people!

<comment><USER45> There are sticks out there that have hardware write-enable switches (I keep my medical records on one), so that you can at least control when writes occur.

<comment><USER9> Nothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you. They aren't appliances.

<comment><USER46> What you propose is probably possible for many USB sticks, but I don't think it's possible in general. Flashing a microcontroller often requires access to a serial interface like SPI, I2C, or JTAG. That's typically on different pins than USB (which pins can be buried in potting or otherwise inaccessible to compromised hosts). In addition some models can have particular pins connected to disable flashing.

<comment><USER47> Some microcontrollers I've been working with, that had USB capability also supported DFU- flashing new firmware via USB.

I have also resurrected a write-broken flash drive, by re-flashing it's firmware (a tool for which was provided by microcontroller vendor, which I found out by looking at VID/PID values and googling them).

<comment><USER46> Oh definitely it's possible for many microcontrollers. DFU is very handy during development. I was just reacting to this statement:

 _Nothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you._

Nothing, that is, except possibly a complete absence of such a facility! It depends on the microcontroller and how it has been wired into the USB device.

</comment></comment></comment></comment></comment></comment><comment><USER48> Schneier is not as paranoid or as particular as I thought he would be:

> _1\. When you set up your computer, connect it to the Internet as little as > possible. It 's impossible to completely avoid connecting the computer to > the Internet, but try to configure it all at once and as anonymously as > possible. I purchased my computer off-the-shelf in a big box store, then > went to a friend's network and downloaded everything I needed in a single > session. (The ultra-paranoid way to do this is to buy two identical > computers, configure one using the above method, upload the results to a > cloud-based anti-virus checker, and transfer the results of that to the air > gap machine using a one-way process.)_

A friend's house is not "anonymous". If you have the need for an air gap, then you probably should assume that your attackers have the ability to suss out your off and online social network. In a not-too-distant future, it's not hard to imagine a surveillance operative being able to expand their examination of network traffic to not only include you, but associates of yours, and then to detect when an online-installation routine was run. At that point, the fact that that computer's fingerprint (however it may be calculated) was never seen again from that friend's home might be one flag of several in a comprehensive surveillance flag.

Though I guess if Schneier is talking about a off-the-parts computer, I'm assuming he means a desktop computer that can't be assembled in the Starbucks two states away to connect to the Wifi. OTOH, I think I would prefer a Linux laptop as my air-gapped computer

</comment><comment><USER49> I'd actually be interested in hearing from Tptacek on this topic, but he's absent for once. Weird.

</comment><comment> guard-of-terra Also you can boot from livecd each time. You can use livecd boot on your internet-enabled device. Imagine fellow rootkiter's frustration when he realises root filesystem is read only.

Of course you're still vulnerable to BIOS/firmware malware.

</comment><comment><USER50> There is another backchannel that can be used if your air-gapped computer ever does get compromised, which I haven't seen anyone discuss yet. If your internet-connected computer and air-gapped computer both have audio speakers / microphone, then that seems like a perfect covert way for a compromise to set up wireless communications between them An audio signal can appear to be similar to fan noise, or outside of human hearing range. I wonder if this has ever been exploited before.

</comment><comment><USER51> Bruce gives a good collection of tips, but in his specific case it probably matters little. If he is a target of surveillance, I would be thoroughly surprised if he did not get "black bag" intrusions (as he puts it). He is a target that is definitely high enough priority ("I have Snowden's documents!") that dedicating assets to investigation is more likely, and at that point an air gap seems more like an inconvenience to the attacker than true protection.

</comment><comment><USER52> I ordered a new desktop computer last night, and a number of the options from which I chose did NOT seem to have Wi-Fi built in. Rather, they sold low-cost USB devices for Wi-Fi connectivity. I didn't actually check all the motherboard specs to confirm this, but it seems pretty accurate.

So getting an air-gapped computer without Wi-Fi would seem to be the least of the problems.

</comment><comment><USER53> I've been using serial cable with data leds and gpg ascii armored data over it. Very easy to visually inspect all data before further processing. Only attack vector remaining is gpg ascii armored parser, signature verification & decryption.

Afaik, this is quite safe.

This computer has not been connected to the internet ever, and it won't be in future.

Don't forget physical site security.

</comment><comment><USER54> Secure Linux air gap.

Here is a real secure Linux air gap:

1\. From a friend's computer, burn two copies of your favorite Linux liveCD.

2\. Hold the two identical discs so that you can see the reflection of the document in front of you in one (mirror writing) and the reflection of the reflection in the other. (normal writing.)

3\. You now have a secure Linux air gap with which you can read any document.

</comment><comment><USER55> I'd like to sign my executable files on an air-gapped machine. Problem is, the code-signing tools for OS X and Windows (ie. codesign and signtool.exe) seem to require access to my private key to generate the signature AND and an internet connection to generate the timestamp.

Is there any solution here?

</comment><comment><USER56> What about using a Linux CD? You can get online and use it for what you need without it downloading or installing software. Every time you re-boot it's guaranteed to be the same OS without any spying malware on it... I guess you'd have to save files on a USB drive though.

</comment><comment><USER57> > if you're using optical media, those disks will be impossible to erase

I pop the old optical disks I'm tossing away into a microwave oven for 10 seconds at 1000 watts. How recoverable is the data stored on them? (And how cancerogenus the stench?)

<comment><USER58> More than you would like. The amount of surface area left is substantial so something could be recovered. The best way is to melt them with thermite. If it is legal in your area.

<comment><USER59> wait, thermite is illegal?

<comment><USER58> I have no idea. Chances of a mix that violently burns at 1300 degrees being under regulation somewhere in the wide world are not that slim.

<comment><USER60> It's useful for fixing cracks in cast iron and joining rails, so I don't see why it'd be regulated.

<comment><USER61> Something being regulated does not mean that it can't be used industrially. Many types of explosives are regulated even though they are used industrially every day in quarries and mines.

Still, restricting thermite would be silly and ineffective. As a chem-lab assistant, I made the stuff in highschool. Aluminum powder is widely available and rather cheap, as is iron oxide (obviously ;). I also made cupric oxide thermite, but that didn't work as well.

</comment></comment></comment></comment></comment></comment><comment><USER62> this reminds me a lot of what a lot of radio personalities who deal with personal finances recommend, the system which you do your banking on should only do that and nothing more.

While such a system is obviously still connected to the net, you reduce your risk by running a discreet set of software.

To be totally safe you would need a room which protects from emissions escaping it. Back in my service days we had system isolated as such simply because you could be monitored through walls.

<comment><USER63> _discrete_

</comment></comment><comment><USER64> "Note: the first company to market a USB stick with a light that indicates a write operation -- not read or write; I've got one of those -- wins a prize."

</comment><comment><USER65> Isn't this an example of poor OPSEC? If he is in fact using the procedures spelled out in this post, he's giving his potential attackers a clear picture of all of his security measures so that they can focus effort on exploiting a weakness.

</comment><comment><USER66> He forgot that the computer must be wrapped in tinfoil.

</comment><comment><USER67> How about conducting all IO by webcam OCR?

</comment><comment><USER68> Schneier is kind of disappointing more and more...

Be cautious of this advice dear readers.

" (The ultra-paranoid way to do this is to buy two identical computers, configure one using the above method, upload the results to a cloud-based anti-virus checker, and transfer the results of that to the air gap machine using a one-way process.)"

No, the ultra paranoid would buy two computers, perform install 1 from friend 1s internet connection, downloading everything keeping a copy and check-sums, then perform install 2 on a friend of a friends connection, then compare the results of both the downloaded check-sums and the installation. (For certain flavors of Linux it should be the same).

There is no point in uploading to a cloud-anti-virus checker if the NSA is after you, its not like they are going to use Slammer or some other known virus against you.

Jesus christ, and he is using Windows !? WTF. He is going against his own advice - to use public/free software as often as possible.

For the step of moving files between air-gapped computer, he suggests using USB sticks. _He forgot to say that you must encrypt the entire usb-stick as well_ , You dont write a file-system to it! Only an encrypted blob. As "viruses" can be transferred on the NTFS he is probably using. Even Linux fs had a vulnerability - when the kernel tried to mount the fs it would privilege escalate to root and run code - code that can be hidden in the NTFS alternate (hidden) streams.

EDIT: For the NSA-agent wishing to leak, a good idea is too look into HaikuOS, MenuetOS etc and use those instead of GNU/Linux, or ArchHurd. Something very rare, something unexpected. Modify the installation from the default as much as you can. Hm, we should make an Ask HN thread - what is the best ingenious methods for current NSA employees to leak again, now that they have to share a computer with a partner?

<comment><USER69> _No, the ultra paranoid would buy two computers..._

The ultra-ultra paranoid might use their popular and widely read blog - a blog which is almost certainly read by more than one or two people at the NSA - <USER2> post an enormous boat-load of misdirection that is nevertheless also helpful advice for people who are actually stuck attempting to secure Windows computers. Advice that happens to highlight what a nigh-impossible task that really is. (TEN rules? Good luck.)

I can't think of any reason for someone in Schneier's position to publicize his _actual_ security arrangements at this time.

Then again, maybe he feels he has a duty, as a security expert, to use and thereby remain familiar with the most popular systems around.

<comment><USER8> >Then again, maybe he feels he has a duty, as a security expert, to use and thereby remain familiar with the most popular systems around.

I think this is the case for security experts like Schneier and Krebs. Most of the threats they're interested in affect Windows. Most of their readers run Windows. They would be a less useful resource if their first recommendation was always "ditch Windows" even if that's accurate.

<comment><USER70> Maybe he needs to use Windows but whether or not his single air-gap-ed computer runs Windows or not isn't going to determine whether he's going to be running Windows in general.

I don't know how maintaining a full off-Internet computer isn't much more extreme than switching OSes. If he is recommended an off-Internet machine, it seems clear he'd want to recommend the hard steps as well as the easy steps.

I mean, he says he's running open office so Linux should be able to work great for him.

</comment></comment></comment></comment><comment><USER71> I'm not sure air-gaps are as safe as we think they are.

Yes, its tinfoil time: the NSA and various other Defence agencies have deployed satellites capable of tuning into any CPU built since 1998.

Air gap in a deep, deep hole. Or maybe on the other side of the Sun. These are the only really safe places fur humans subjects of the new Tech Overlords to to stash data...

<comment><USER72>
      [citation needed]

<comment><USER71> I don't have a desire to provide a citation because I'm exploring, conjecturing .. I mean, after all its not infeasible that the satellite- launches that the NSA has been progressively making, over and over, are to support a network of CPU-sipping listening posts. This had been discussed even in the 80's, in certain circles ..</comment></comment></comment>


Ask HN: What is your preferred NoSQL database? - <AUTHOR> I am already using Postgres but to save some large unstructured data, I am looking at secondary NoSQL. I am not sure about using MongoDB but I like RethinkDB or CouchDB. Would like to know if any of you are using it in production despite these projects being not very actively developed or any other option apart from Graph database. <comment><USER2> NoSQL means two things to me: (1) schemaless(!) document store (2) sharding across multiple machines out-of-the-box.

(1) there's always a schema, it's either explicit or implicit. I find explicit to be less troublesome along the road. Sort of like static type checking-- values have types, do you want to handle it at compile (sooner) or runtime (later)

(2) can be provided by NewSQL databases, e.g. CockroachDB but you will be paying upfront in latencies. Can't get away with doing N+1 queries so code has to be cleaner sooner.

</comment><comment><USER3> Have you considered using Postgres with JSONB?

</comment><comment><USER2> What charactistic of this data suggests NoSQL when structured data is in psql? Specifically do you need a distributed db?

</comment><comment><USER4> For NoSQL, I currently use MongoDB and Elasticsearch in production. Elasticsearch was by choice, whereas MongoDB was something I inherited.

For new projects, if I'm picking NoSQL at all, I'm more likely to lean Elasticsearch, but it definitely takes longer to set up and has a much higher learning curve. And as always, it's going to heavily depend on the data and its access patterns. My default continues to be RDBMS unless there's a good reason not to, even though at this point, I actually have more experience managing MongoDB and Elasticsearch clusters.

</comment><comment><USER5> This might help though it's relational: [https://sqlite.org/appfileformat.html](https://sqlite.org/appfileformat.html)

But yeah for blobs I'd just use the file system or something like s3

</comment><comment><USER6> ArangoDB - multi-model NoSQL db

</comment><comment><USER7> Google Firestore

</comment><comment><USER8> Mongo I guess...

Not noSQL but a nice serverless is fauna.com

</comment><comment><USER9> NoNoSQL is my favourite. ie. SQL

</comment><comment><USER10> Why not use the filesystem?</comment>


Raspberry Pi 4 PCIe bridge "chip" - <AUTHOR> https://blog.zakkemble.net/rpi4-pci-express-bridge-chip/ <comment><USER2> I'm starting to think RPi owners just don't want to acknowledge that there are other embedded linux-capable dev boards out there that can do all the things they want (eMMC, PCIe, multiple USB3, eSATA) without going through all of these insane hacks.

If it's for the adventure, cool. If it's because you are pissed at the RPi folks for not including it then holy crap widen your horizons....

<comment><USER3> The software support and community of the Raspberry Pi is several orders of magnitude better than anything that exists for the other boards you're mentioning. "Embedded linux capable" is different than having many linux distributions, and other operating systems, treat the boards as a fully supported target.

It's true that RPi owners don't know about a lot of that other stuff, but there are reasons they don't know about them.

<comment><USER2> And it kind of has to be when Broadcom won't answer their pleas for help, right? I've worked with Broadcom and they won't even pick up the phone unless you're moving 100K EAU. (and, protip: when you do get technical help or source it's complete crap)

<comment><USER3> Your case is maybe kind of illustrative of what I was talking about. The number of RPi users who work at the level where they might have questions for Broadcom is vanishingly small, and that's okay. Almost all people want to write software in userspace, even if it's software that does cool embedded, IoT type stuff.

What's the best right now in terms of openness and support for someone working at the driver level?

<comment><USER2> I've been a Freescale/NXP customer for decades and I like their stuff. Their documentation is comprehensive, their technical notes and errata are free to read. They're not perfect but they work at it. Their Github presence is decent. iMX is a good line for Linux, LPC for microcontrollers but the new iMXRT parts are looking great for FreeRTOS.

I don't work as much with TI but I've used Panda in the past for OMAP4 and some personal work with Beagle/AM335x and it's solid stuff. I'd like to think Beagle's community is as good as RPi's, just a little more low-key (and the chipmaker participates as well)

<comment><USER4> I've always been a fan of the iMX line - they're my goto reference designs for low volume embedded work along with STM32Fx for MCUs - but the BSPs are just not comparable for hobbyists.

With RaspPi you can download an SD card image fully set up with a simple "wpa_supplicant.conf" for WiFi and a Bounjour discovery service to register a hostname like 'pi.local'. Takes like an hour with a crappy connection and then another hour at most for apt-get update. Need to hook a security camera? Download a prebuilkt MotionEyeOS image. Need to control a CNC with GCode and a .Net core API? Grab the Duet 3 and a raspberry pi.

<comment><USER5> If you can use Multistrap then all you need is a linux kernel and you can build a full Debian system for your Linux chip.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> No doubt that RPi has been a game changer, but I can never convince myself to build a light file/media server with a Pi. Do I really want to spend $100+ buying a Pi and accessories, or should I just spend $300 on a Synology... which actually has an NVMe slot.

<comment><USER7> Or, like, repurpose your previous desktop into a server when upgrading the desktop.

<comment><USER8> Even old laptops can make good servers. Built-in UPS and screen for recovery. Depending on just how old, you might even be able to add more storage using USB3 ports, or with a controller in an ExpressCard slot or in place of the wireless card, or by replacing an optical drive.

<comment><USER9> This! I have a highly underpowered laptop (which I bought brand new but at a very low cost for travel purposes) that I just didn't know what to do, because it was so damn annoying and awkward for any personal use. The keyboard was quite awkward. The trackpad was even worse. The display was so basic that even I didn't want to use it for YouTube/Netflix. The CPU... well you get the point. Finally, just a few weeks ago, I thought that I would really like to build a Linux server and thought of my Raspberry Pi 3. I remembered that I would need to connect an external HDD to make it even halfway useful for data storage. I would also need to find a USB wifi adapter (because my home setup currently isn't wired). Then I looked at this laptop which had been collecting dust for like 2 years. I realized it was perfect for my needs: has a 1 TBB HDD (not SSD) and a built-in wifi adapter. I installed Lubuntu (one of the least resource intensive distros) and then started installing numerous services on it: Nextcloud, IRC bouncer, SMB server. I only have Nextcloud running at the moment as it's the only thing I've been able to make serious use out of, but it just works.. perfectly.

</comment></comment></comment></comment><comment><USER10> The Tindie store seems to be out of stock. But, if you need one of these, the GitHub repo for the project includes an Eagle brd file.

Note that most PCB houses want Gerber files. PCBWay has an online converter for brd files. It does require creating a userid on their site, but it will give you the Gerber file without buying anything...so you're free the buy the PCB from anywhere you want.

</comment><comment><USER11> Great work, this opens new flood gates for Raspberry Pi community and I'm glad that the maker made it available on Tindie.

Off topic: When I heard about Apple silicon on iMac, I was wondering whether it will retain PCIe or will Apple will 'courageously' kill PCIe on iMac (/s).

</comment><comment><USER12> Very clever to use the same pinout as the PCIe "flexible risers" that already use USB cables, so only the chip replacement is necessary.

</comment><comment><USER13> I long for the day we can buy proper ATX-sized arm boards. This is nice and all but arm can do way more, and without all that historic 16/32 bit mode clutter x86 has for compatibility.

<comment><USER7> You can buy mini-ITX sized ones from SolidRun. They even run open source firmware (EDK2) that exposes most things as generic ACPI hardware.. well there's still quirks and hardware bugs of course :D

<comment> non-entity Is edk2 something that should be run in production? I thought it was more of development platform for UEFI.

<comment><USER7> Well, commercial vendors usually use AMI's modified version that has a proprietary fancy setup UI and whatever other crap. But for hobbyist custom firmware (these ARM systems, Chromebooks, etc) completely raw upstream EDK2 is totally fine.

Fun fact, System76 now runs slightly modified EDK2 (as a Coreboot payload) with a custom setup UI written in Rust: [https://github.com/system76/firmware- setup](https://github.com/system76/firmware-setup)

</comment></comment></comment></comment><comment><USER14> Discussion from the original PCIe hack: [https://news.ycombinator.com/item?id=20399555](https://news.ycombinator.com/item?id=20399555)

</comment><comment><USER15> If you can plug a keyboard into the power socket, I'd love a Raspberry Pi mod that put an NVMe drive on the PCI bus. _That_ would be a useful little computer.

<comment><USER16> Doesn't the chip-ectomy also lose Ethernet?

Edit: apparently not, but how is the Ethernet connected on the pi4? Is it on the BCM SoC?

<comment><USER17> Yeah, the Pi 4 finally has an onboard Ethernet controller on the SoC itself.

<comment><USER16> This says the Ethernet controller is "natively attached" but the SoC datasheet doesn't mention Ethernet: [https://www.raspberrypi.org/documentation/hardware](https://www.raspberrypi.org/documentation/hardware) /raspberrypi/bcm2711/README.md

So maybe it's a separate chip?

<comment><USER18> You have to search for RGMII in the bcm2711 datasheet, which is a media- independent link.

In theory you could rip the PHY chip out and replace it with a fibre PHY, so you'd get a fibre Pi.

</comment></comment></comment></comment></comment><comment><USER19> I find this fascinating, and I have a few follow-up ideas.

How many PCIe lanes are on this connector? Is this a full 16x slot? I assume since it has a very limited amount of PINs I'd assume it's just a 1x.

The next obvious step is hooking up this to a PLX chip. Duplicating the number of lanes available even if there's no additional bandwidth could really open up doors.

<comment><USER20> It is 1x, obviously. But I highly doubt that the PCIe bus is going to be the bottleneck here ;-)

I guess it would be possible to design an ATX size motherboard with a RPi4 compute module slot (once CM4 becomes available). The PCIe bus would allow all sorts of peripherals. Don't expect any performance though.

<comment><USER21> Have you seen [https://turingpi.com](https://turingpi.com) ? I can't imagine an ATX/ITX/STX compatible breakout board for everything on the Pi 4 would be an impossible task.

<comment><USER20> Well, yes, something like that, but not in a cluster form, but just a single CM4 on a mini-itx form factor board, with PCIe slots, USB ports, ethernet, etc.

You could build a fully blown Linux desktop peripheral wise, just don't expect desktop performance.

</comment></comment></comment></comment><comment><USER22> One of the biggest limitations of the RaspberryPi is that it's only got one network port, so that rules out running it as an OpenWRT router for practical reasons. Does anyone know of a similar miniature board with multiple network ports that could be used as an OpenWRT router? I'd like to replace my crumbling router with a low power one that is more configurable than my old one.

</comment><comment><USER23> I'd love a computer like the Raspberry Pi -- but one where every chip on the system board is "plug-and-play", that is, all of the chips have pins, and all are pushed into sockets such that any one of them could easily be pulled and replaced by another chip that matches the pinout for the given chip, with no desoldering or re-soldering...

</comment><comment><USER24> Not just the adventure for some. We use the RPI3/4 as a plug-in module to my clients range of industrial controllers because we want reliable availability, forward/backward compatibility and the most important recently is we want to diversify our supply chain from China it fits the bill nicely on all three.

</comment><comment><USER25> so one can connect a pcie sata adapter and connect sata disks even if on the same x1 lane?

<comment><USER26> Given it is x1 PCIE 2.0 you are likely to see little performance benefit vs using a USB solution for connecting sata drives while introducing potential stability issues.</comment></comment>


Libgit2: a Git Linkable Library - GitHub - <AUTHOR> https://github.com/blog/752-libgit2-a-git-linkable-library <comment><USER2> Are there perl bindings? I've been tweaking git-svn to not be so painfully slow, and since it's currently spending over 99% of its time forking to very simple git commands, that should help.

<comment><USER3> Should probably be easy enough to use Swig on it.

</comment></comment><comment><USER4> You can tell he's associated with Github because he's holding whiskey. If you know those guys you'll know I'm right.

<comment><USER5> I don't know those guys. What's the connection?

<comment><USER4> Those guys love Whiskey. Except for Tom, who loves Whisky. (That's Bourbon vs. Scotch). I'm with Tom.

</comment></comment></comment><comment><USER6> This is excellent. Last time I looked at libgit2 was in May and it was seriously lacking. They must have put in a ton of work this summer!

Good job Vincent, and props to Github for sponsoring it.

</comment><comment><USER7> Also discussed (a little) here: <http://news.ycombinator.com/item?id=1938445>

EDIT: Corrected URL.

</comment><comment><USER8> I've been thinking about doing something like that myself. Looks nice.

(Shame it's gpl rather than bsd/mit)

<comment><USER9> Correction: it's _L_ GPL, with the linkage exception [Edit: I'm wrong. See silentbicycle's comment below]. That's a big difference. Most importantly, it removes any reason to complain about licensing other than dogma, FUD, or ignorance -- libgit2 may be linked into permissively-licensed code at will.

I tend to prefer permissively-licensed code, too, but there's a world of difference between viral licenses with and without linkage exceptions.

<comment><USER10> Correction to your correction: It isn't LGPL, it's GPL v2, _with an addendum adding a linking exception_. They couldn't use the LGPL because it uses some code from git, but they apparently got permission to add a special exception for that code (but not a license change). They may rewrite that part, but it's not a high priority at the moment. This is a weird special case - IANAL, but it seems like a de facto LGPL.

I've been talking with Vincent Marti about this, because I'm considering writing a Lua wrapper for libgit2, but wary of relying on libraries under the GPL. (I'm fine with the LGPL.)

Also, I ported the library to OpenBSD - it needed some finagling with preprocessor directives for thread-local storage. Contact me if you're interested. It's a bit rough, just good enough to get started on the wrapper.

<comment><USER9> Guh, reading comprehension fail. Thanks for the correction.

IANAL either, but I agree that GPL-with-linkage-exception is functionally equivalent to LGPL, so I still think the _rest_ of my comment's correct.

Of course, given my track record in this thread, I'd recommend folks double- check my work :)

<comment><USER10> No worries. It's a weird pseudo-LGPL situation. I hope I didn't sound like a smug asshole. I thought the same thing and double-checked, that's all.</comment></comment></comment></comment></comment>


Ruby programmer trying out Meteor.js - <AUTHOR> https://semaphoreapp.com/blog/2014/11/19/meteorjs-getting-started.html?meteor=true

<comment><USER2> What's wrong? Why did you change the title to "Ruby programmer trying out Meteor.js" while the original article is simply "Meteor.js: Getting Started" ?

Also, the article does not even mention Ruby once!</comment>


Benchmark of 100 crowdfunding videos reveals what works and how much to spend - <AUTHOR> https://www.videopixie.com/blog/crowdfunding-video-cost-benchmark-what-works-how-much-to-spend <comment><USER2> Ok, there's a chance I'll gain some valuable insight from posting this, which beats the cost of putting myself out there, so here goes...

I just completed a 30 day hardware Kickstarter last week and spent $22k on the video ($18k for main video, $4k for founder interview) and raised $57k, which is an outlier to this data. I can tell my campaign is not in the Video Budget / Amount Raised graph because it would stick out near the bottom right. So it seems to me that something's not right.

The product is compelling and I think it shows in the video. Much of the feedback I got for the video was positive. And there are a couple near competitors that have raised $1M+. My internal goal was to break $100k and that did not happen.

Did I make a mistake with this video or campaign? I hit all of the points: early product intro, upbeat mood, 2:23, image quality, founder presence, location scouting and voice talent, and outside help.

You can watch the video here: [https://www.kickstarter.com/projects/samuelclay/turn- touch-b...](https://www.kickstarter.com/projects/samuelclay/turn-touch- beautiful-control)

<comment><USER3> I saw your prototype at a HDDG meetup in SF. I think your campaign was very well done. If you fell short of your internal goal, it might be price related. You are in impulse buy territory, but the product might be too niche for that price.

I ran a failed crowdfunding campaign back in July. We raised ~$25k of a $100k goal. We spent $7k on the video and another $500 on google, FB, and twitter ads.

The ads didnt seem to do anything. I felt our other marketing efforts were more fruitful. We wrote some guest articles for various tech websites and got written up by a few more that we reached out to.

In the end, we felt the price was too high, so we cut some features and dropped the price by almost half for a recent relaunch [0]. We also launched with no goal to remove all customers' doubts about receiving a product.

[0] [https://www.crowdsupply.com/aeroscope-labs/aeroscope- wireles...](https://www.crowdsupply.com/aeroscope-labs/aeroscope-wireless- oscilloscope)

<comment><USER4> A one-channel scope is useful, but it still feels as cutting your left arm when you are used to (and need) more than one channel. And these days most of the things are digital, so that means SPI/I2C/whatever with more than one line, and even then, A-B is quite important. I guess you can't combine two of them with a hardware trigger in/out so you can synchronize them and simulate a two-channel.

As it is, it's more like a toy scope, fortunately pretty close to impulse buy prices as these things go, so I guess it will be alright. I would buy one but it's iOS only, so I'm stuck with my Rigol :).

<comment><USER3> You are very perceptive. We had a prototype of two scopes synced with a cable we called "nunchuck mode," but we shelved it because we weren't sure how useful that would be.

I think the main selling point is the portability and remote measurement aspects. It fits in your jeans so you can literally have a scope with you at all times. You can also capture waveforms from over 100 ft away.

I was worried about the one channel limitations when we first decided to go with this form factor. After thinking about my own scope usage, though, I realized that I use only one channel on my four channel scope 90% of the time. More channels is obviously better, but not always necessary in every instance.

Thanks for the feedback.

<comment><USER5> First, I think you've made a really creative project. You did a good job of laying out its features and what you saw as the market need. The price is certainly inline with a number of other scopes in its range.

EE Times did an excellent survey article on USB oscilloscopes the under $200 ones are here: [http://www.eetimes.com/document.asp?doc_id=1326699&page_numb...](http://www.eetimes.com/document.asp?doc_id=1326699&page_number=6)

There are two serious challenges with "remote display" oscilloscopes, and that is connectivity to, and compatability with, the display. Over the the years I have owned a couple but the challenge is always that when you buy into a remote display'd test tool you bet that _both_ the manufacturer _and_ the environment will continue to exist. For me I've got a nice 2 channel 100Mhz USB scope that has a "display and control" application that runs on Windows 98. It kind of worked on WinXP, and barely worked at all on Win7 and works not at ll on Win10. It also uses USB 2.1 which, from a connection standpoint has been exceptionally long lived. The previous "universal" connection was parallel ports and those went away and a lot of gear became useless.

The choice of IOS is ok for now, but Apple will rev IOS in an incompatible way and if you're gone by then the scope is dead meat. Compare that to my first oscilloscope that was a used Tektronix 465b that was built in 1980, recalibrated in 1990, traded to a friend in 2000 and is still running today and doing the job. Test equipment lives a long time because the job is the job, it doesn't change, and if the tool is self contained it will never not be able to do the job until the parts it uses are no longer made.

So as a tool buyer (and I'm an outlier, having bought the 465b, a Rigol 1152D, a Tek 2216, and then a Tek MDO3024, and 3 different 'headless' oscilloscopes) none of the headless ones are completely functional any more and all of the 'headed' ones are. But there is a saving throw here.

Like you, I appreciate how cost effective it is to build these things these days. Why not build the display as well? Lets say you contract with a tablet maker in Shenzen or build your own LCD display + SoC of your choice. Then _you_ are in control of both the display and the instrument and it opens up some other possibilities. You could for example have several test instrument "bodied" that could pair with the display, so a DMM body, a scope "body" a Freq Counter body, etc. Easy to unbundle, easy to get either "higher end" or "lower" end remotes. Second it solves your multi-channel problem if you tie all the probes to the same 'sync' line. Now you can have 8 channels if you want and the display body software just sucks them all in. You can also dump Bluetooth LE and go with the inexpensive Nordic 2.4ghz spread spectrum radio chips. Now you can share a nanosecond disciplined time base with all your tools and bring the signals back together in the display "panel." You can sell a larger 'indoor/bench' display panel or a ruggedized 'on the road' panel. That iPad Pro in the video cost the person $700 - $800, a panel with an ARM53 SoC talking to it can be had in Shenzen for $35, $150 is you put an IPS panel on it. Now you sell it for half the price of an iPad, it works with all your tool heads forever and I, as the engineer buying your stuff, know that even if you go out of business my test equipment will still work.

If you build something like this I'll buy one for sure. Market size is somewhere between 1 and several million engineers :-). If you want more thoughts on this feel free to contact me in email in my profile.

</comment></comment></comment></comment></comment><comment><USER6> I never saw the economics of crowdfunding before, but this confirms what I suspected: crowdfunding isn't really about getting your project funded by the crowd, but about buying a structured platform to launch from.

It looks like a 10% non-refundable deposit is the entry ticket, plus a bunch of non-refundable marketing work on top. And you can't tell the truth about how much money you actually need for fear of not hitting your target.

I'm not saying there's a problem here, but this isn't how I envisioned crowdfunding in the beginning. I thought it was a promising way for makers without money to get started. But it seems it's become a place for people with money to advertise and execute market analytics.

<comment><USER7> No argument here, but I can tell you that this kind of market research was absolutely impossible for such small sums in the pre-internet age.

</comment></comment><comment><USER8> Does anyone else feel that Kickstarter has turned from helping cash strapped startups and individuals raise funds for interesting projects into a low-risk small business pre-order system?

I feel it's a shame people are spending $20,000+ to try and convince you to donate them money, I don't feel it was in the original spirit of Kickstarter earlier on.

<comment><USER9> It still functions perfectly for smaller things too. For instance I spent today starting to get all my ducks in a row to fulfill a comics KS I raised $15k for. ([https://www.kickstarter.com/projects/egypturnash/decrypting-...](https://www.kickstarter.com/projects/egypturnash/decrypting- rita-volume-3-and-omnibus))

</comment></comment><comment><USER10> Interesting information! I really like the analysis of video content, particularly the "founder presence" info. However, I think that the headline results that isolate video cost when looking at raise results is a bit of an odd way to do this analysis because it leaves out the rest of the marketing mix. I'm actually preparing a crowdfunding campaign myself (first time), and I'd think that the main levers for success would be, in no order of importance:

A: Pre-campaign support (solid email list, social media presence, etc), B: Video Quality, C: Rest of Page quality (ie: copy, visuals, etc), D: Paid advertising, E: Media Coverage, F: (Most important) Compelling product & pricepoint

Money Raised should be a function of a-f (and several other factors I'm sure I'm missing) so isolating any one of those variables on its own is not that useful. Presumably a campaign with a $100k budget for its video has also made significant investments elsewhere.

Something I'm still trying to figure out: assuming there is a limited budget, would one rather spend 20k on a video or 5k on the video + 15k more on Facebook ads? My thinking is that the 3M extra views (assuming $5 cpm) would be worth more than the marginal increase in video quality from $5k-$20k.

Granted, if there's a good ROI on online ads, the budget there should theoretically be "unlimited", but that's not always the case. Curious about other peoples thoughts here.

<comment><USER11> Totally agree. I think that's what we are seeing from the other comments as well. Video is only part of the battle, and a more complete study would look at all the variables together.

Video is interesting in that it accelerates your efforts in other areas. The time you spend making a better video should also help you reach a bigger audience (A), increase conversion thus making advertising (D) more effective, it probably helps with PR too (E) since media outlets prefer to show interesting videos, and with page quality (C) to a degree since you can reuse frames from the video for the page.

So back to your question! how much to spend on video is you have $20k budget overall. From an execution standpoint, we certainly see a sweetspot ~$3-6k for video, in that it allows you to get a clean professional video that looks legit. That's enough to hire a director with a small crew for a day and simple editing. If you spend less then you'll have to take on some of the director's responsibilities to make sure you hit on the requirements we found in the benchmark (location scouting, quality images, tight narration...) We wrote more about this here [https://www.videopixie.com/how-much-does-a-kickstarter- video...](https://www.videopixie.com/how-much-does-a-kickstarter-video-cost)

</comment></comment><comment><USER12> Many of the graphics here violate visual best practices, which can make them very misleading (the scatter plot in particular). The most egregious is the use of a log-scale on three of the graphics, which isn't highlighted at all. Humans don't compare and interpret log scales well (see The Elements of Graphing Data by Cleveland, etc.). I would've much rather seen percentages (say on return on investment) or break out the analysis into tiers that were more comparable.

</comment><comment><USER13> Interesting. I've run two campaigns. The first we spent 5k on the video, and did 280k. The second campaign, we spent 2k on, and did 343k. I would say the video was negligible --- but the email list, marketing, product dev, and promos were far more important. As we prep for our third campaign, I'm thinking more about the video quality however.

[1] [https://www.indiegogo.com/projects/pavlok-breaks-bad- habits](https://www.indiegogo.com/projects/pavlok-breaks-bad-habits) [2] [http://indiegogo.com/projects/shock-clock-wakeup-trainer- nev...](http://indiegogo.com/projects/shock-clock-wakeup-trainer-never-hit- snooze-again--2/)

</comment><comment><USER11> Author here! happy to answer questions, and curious to hear about your own crowdfunding video stories.

<comment><USER14> Awesome article!

It says you asked 100 campaigns. Does that mean you got 100 answers or you only 100 campaigns? I'm curious as to how the bias of who responded to you would affect your data.

<comment><USER11> That's great to hear! We contaced many campaigns, and received answers from 100 of them. We are very grateful to the companies who shared their video info. This kind of transparency is much needed, in particular in video production. In terms of methodology, one third of the sample is from randomly selected campaigns on Kickstarter / Indiegogo, one third are campaigns that made videos with Videopixie creators (I am a co-founder), and the remainig third we targeted specifically to cover the full range of campaign sizes. Obviously we'd love to do this with even more campaigns. This was kind of a proof of concept for us. People seem to benefit from the data, and we have a methodology in place, so I hope we get to do more of it!

</comment></comment></comment><comment><USER15> Can any causality be shown? I'd think there is likely a correlation between money spent on the promo video and the amount of resources, name recognition, e-mail lists, etc that a company already has prior to running the campaign.</comment>


SpiraClock: A Visualization Technique for Nearby Events - <AUTHOR> http://www.emn.fr/z-info/spiraclock/

<comment><USER2> Wow, this video does it justice:

<http://www.youtube.com/watch?v=ZG_rOWDPCeI>

I love the zoom on the clock here...I bet this could translate to touch devices really easily. First to implement this in Protovis (<http://vis.stanford.edu/protovis/>) wins!

</comment><comment><USER3> This is actually pretty cool (check out the YouTube video). I wish it was easier to add events.

The use case cited is bus schedules, but it is really quite broadly applicable. Any time you have something "coming up" you can see at a glance how much time you have left till then.

I think many more people would use this if it was turned into a product, rather than an SDK or a collection of .jars.

EDIT: Found it! Check out HeliCal: <http://www.lri.fr/~dragice/helical/>

<comment><USER4> I think the coolest thing would be to change the operating system clock and to integrate it with the system calendar.

edit: actually ment usefull instead of cool.

</comment></comment><comment><USER4> I don't think it's meant to be used as a calendar, but to get,at a glance, information about your imediat free/busy time.

</comment><comment><USER5> It is a very pretty way of representing events, but I'm not sure that it's terribly practical. For example a typical use case: Hi Jim, are you available this afternoon at 4pm for a meeting? Well, let me just check my spiraclock. Hmmm, where _is_ 4pm on this thing???

</comment><comment><USER6> Second paragraph says "A SpiraClock SDK is no available", which should very probably read "now". I first interpreted it as meaning that a previously- existing SDK has been taken down.</comment>