The Bitcoin bubble – Greater fool theory - <AUTHOR> https://www.economist.com/blogs/buttonwood/2017/11/greater-fool-theory-0 <comment><USER2> I was having a conversation about bitcoin, and I was saying the fact that the price goes up so fast means people cant/wont actually use it as a currency. I think someone bought a pizza with 10k bitcoin? thats now 70 million $. Even in the last year it has moved up so fast, and if people think it will continue to grow 'because of adoption', people cant actually 'adopt' it and use it as a currency, because todays bitcoin is worth a lot less than tomorrows.

then i realized, i was describing deflation.

<comment><USER3> It definitely means people won't use it as a unit of account (for debts, budgets, etc), which is one primary use for a currency...

But I don't think it means people won't spend it or trade it for some other currency or asset. If you held a bunch of bitcoin while the price in USD doubled, and you happened to want a new smartphone, you're sure you wouldn't buy one?

If you were absolutely confident the price would quickly rise even more, maybe you would prefer holding, but if you really want the phone and you think BTC/USD has some risk?

<comment><USER4> I'd spend dollars on the phone, because the same BTC might buy 10 phones in a few weeks.

<comment><USER3> It's the same opportunity cost whether you spend from your BTC account or your USD account! You're choosing between "should I buy a phone or 0.1 bitcoin with these dollars?"

I think the presence in the market of an asset that many people believe is continually underpriced would have a general effect on spending, not just on the utility of that asset as a medium of exchange...

<comment><USER4> >> It's the same opportunity cost whether you spend from your BTC account or your USD account!

Only if obtaining BTC is frictionless and fee-free, something far from universal.

</comment></comment></comment></comment></comment><comment><USER5> Famous NYU valuation professor on how to value bitcoin:

[http://aswathdamodaran.blogspot.com/2017/10/the-bitcoin- boom...](http://aswathdamodaran.blogspot.com/2017/10/the-bitcoin-boom-asset- currency.html)

<comment><USER6> The key part is the statement that "it cannot be valued". Saved you a click.

<comment><USER7> To expand on this, as it is mysterious to me:

The reason it cannot be valued or invested-in is that it is a currency, and as such it only has a price. The difference is a bit murky to me (value v. price) but I think it's because as a currency it has a 'fiat' kinda representation.

</comment></comment></comment><comment><USER8> _But it is one thing to become a millionaire (the word was coined during the Mississippi bubble of the early 18th century) on paper, or in "bits"; it is another to be able to get into a bubble and out again with your wealth intact._

The Mississippi Bubble is an interesting one to invoke here. It was a share bubble fueled by France's overprinting of paper money and habitual currency devaluation.

The idea was to create a monopoly that would exploit the vast riches of France's territories in North America. The company never got off the ground, but the shares were sold and began trading anyway. Investors starved for returns flocked to the trading of the shares.

So yes, it's entirely possible that the overproduction of money by the world's governments is fueling a speculative bubble in stocks, bonds, Silicon Valley startups, and even digital currencies - not unlike the Mississippi Bubble.

Unlike the other inflating assets, however, the supply of bitcoin is rigidly fixed. As world governments produce ever more currency in an attempt to keep the other bubbles inflated, we can expect the bitcoin exchange rate to respond accordingly.

It's worth noting that the basic idea behind the Mississippi company was sound. The Mississippi was set to become a hub of world economic activity and valuable almost beyond measure - but not on the time scale of the day's short- sighted investors.

</comment><comment><USER9> The article is perfectly right when it describe what drives the current Bitcoin craze and its insane valuation but the conclusion is frankly a bit lazy:

>When the crash comes, and it cannot be too far away, it will be dramatic.

People have been saying that Bitcoin was going to crash for years now. And it has, multiple times, but always recovered so far. Seems like there's no shortage of "fools" willing to pump the currency even if for the most part they probably don't completely understand what it is, what it does and how it works.

<comment><USER10> Yeah I'm pretty disappointing in the quality of this article, especially considering its coming from the Economist.

The summary is a coin flip in essence.

It did, however, get me to think about this question: Is there a point where enough "fools" get involved that Bitcoin becomes "too big to fail"?

<comment><USER11> Well, people with no idea about how computers operate have been stopping me to ask my opinions on BTC recently. If there's a point where enough "fools" get involved for anything to happen that's a symptom this point is near.

But the way more usual outcome is that a bubble pops, not that it is lifted into infrastructural status. (But yeah, both happen, just with widely different rates.)

</comment></comment></comment><comment><USER12> When the majority is claiming 'there's a bubble' in a certain asset, then it's undervalued or not understood. When the majority claims 'there's no bubble', then usually it's a bubble.

<comment><USER13> Reminds me of the Sequoia "RIP: Good Times" and all the "tech bubble warning" articles in 2008.

</comment></comment><comment><USER14> Both can be true:

\- that bitcoin is an important tech that will eventually gain widespread adoption

\- current high price of bitcoin is due to speculation and is a "bubble"

<comment><USER15> question at this point though: If a crypto currency were to gain widespread adoption, why would it be Bitcoin?

<comment><USER16> Probably wouldn't. You need something that scales if all are to use it. Bitcoin, in the current form doesn't at a level to replace Visa tap pay. For example, for a country of 20 million buying bagels on their way to work.

<comment><USER3> By this standard, gold and USD also don't really scale, because you can't send them fast enough. Interbank clearing is pretty slow.

We already have exchanges and clearinghouses like Coinbase for example. It's easy to imagine a Bitcoin-backed payment infrastructure offered by Coinbase or a Visa-like consortium of exchanges.

Of course this taps into a huge and messy ideological debate about what kind of thing Bitcoin ought to be.

<comment><USER16> Whatever it ought to be, it should start by supporting more than 25M transactions a day.

I hear people preaching wider adoption by all means, but none tackles the limits.

I apologize, but it looks like the proponents want money in, and scarcity remaining.

</comment></comment></comment></comment></comment><comment><USER17> Not sure if this is true but I heard that currently less then 1% of the world population holds bitcoin deposits. Only a handful of people are holding large bitcoin deposits. Now if you believe that Bitcoin will get widely adopted then why is it so difficult to believe that the price will go up? And why do you care how much a single bitcoin is worth? As if we are going to be trading in whole bitcoin numbers. Fractions are perfectly fine and if you have problems with them just use multipliers.

Apart from the lack of legal structures, is Bitcoin that different from bonds or holding stock options which you bought for pennies? Alaska was purchased for mare $7m in 1960s which is worth $100m in today's money. You no longer can attach a price for Alaska because it not for sale but it is certainly worth a lot more. Similarly, Bitcoin is by far the largest wealth distribution most of us will experience.

Now you may disagree that with the fact that Bitcoin is currently traded for prices way above to what it used to be worth 6-7 years ago but similarly from the 1960s to 2017s the average inflation is about 1430.1% Keep mind that the 60s were neither globalised nor connected as much as today. And in a global, connected world everything happens at much faster pace.

Btw, I am not an economist, neither I claim that I have a good grasp of cryptocurrency. I just have an opinion :) and that all it is.

<comment><USER18> 1%? I would have guessed 0.1 - 0.2%.

<comment><USER17> I thought about this too when I was writing my comment but then I was also hoping that someone else will correct me.

</comment></comment></comment><comment><USER6> Nothing in this article is new, but OK. Here is its conclusion:

> If everyone tried to realise their Bitcoin wealth for millions, the market > would dry up and the price would crash; [...]. And because investors know > that could happen, there is every incentive to sell first. When the crash > comes, and it cannot be too far away, it will be dramatic.

Let's try this with something else:

If everyone tried to realise their Google stocks for millions, the market would dry up and the price would crash; [...]. And because investors know that could happen, there is every incentive to sell first. When the crash comes, and it cannot be too far away, it will be dramatic.

If everyone tried to realise their hoarded gold for millions, the market would dry up and the price would crash; [...]. And because investors know that could happen, there is every incentive to sell first. When the crash comes, and it cannot be too far away, it will be dramatic.

Look, I'm an economist! Sell your Google shares _NOW_!

(Or, to make the point directly, yes "that could happen", but that doesn't mean that it's likely. And if it's not likely, the conclusion doesn't hold. And if the conclusion doesn't hold, the author is not justified in saying that it's likely. The argument is essentially a circular one: If I assume that Bitcoin is likely to crash, I can "reason out" that it is likely to crash.)

<comment><USER19> Google shares represent a stake in Google's revenue stream. It has an intrinsic value beyond what you could currently sell a share at on the stock market. Likewise gold has some intrinsic value in manufacturing and ornamentation.

Bitcoin has no intrinsic value. Its value is just what you can trade it for at the moment.

<comment><USER6> > Google shares represent a stake in Google's revenue stream. It has an > intrinsic value [...]

I'm not up to date on Google specifically, but for a long time in its existence, it did _not_ pay a dividend, so its shares did _not_ represent a meaningful stake in Google's revenue stream. Did they have an intrinsic value anyway?

But regardless of your answer to that, my statement stands. If everyone holding Google stocks suddenly started selling them off, the price _would_ crash. It's just very unlikely that it would happen. More likely for Bitcoin? Maybe, but people have made this doomsday argument for quite a while now, and so far it's not proven right.

<comment><USER20> You buy stake in _future_ dividends. For companies that don't have any dividend currently you just have to compensate for the time delay when calculating the value.

If everyone would race to sell Google stocks for no reason, the price would quickly drop to a level where it would make huge sense to start buying. Imaging having a dividend to price ratio of 1000%. Even with no dividend, buying stocks (preferably with voting rights) in a company at a price to profit ratio of 1000% would be a great deal as it'd be a small thing to start paying dividends with those profit levels.

This does not mean that there aren't overvalued stocks and physical assets which does not make sense to buy at the current price. Bubbles has occurred before...

<comment><USER6> > You buy stake in _future_ dividends.

So no intrinsic value then. Just the expectation of possible future earnings. That obviously cannot work!

> the price would quickly drop to a level where it would make huge sense to > start buying

Like for Bitcoin. Yes, there would be enough Bitcoin fans who got rich enough on Bitcoin to have spare cash to start buying if it dropped a lot.

Thanks for playing.

</comment></comment></comment></comment></comment><comment><USER21> The article makes a valid point. Everyone can not possibly sell all of their Bitcoin, and if they tried, it would be defined as a crash. I would be lying if I said I wasn't worried about this.

But I think it's wrong to think of Bitcoin as a commodity, or that it needs some killer application. I really think Bitcoin is best thought of as a currency. Fiat currencies work because as a whole, we agree on its value. Usually, it's backed by a country's government, which represents the country's populace. It's value is inherently determined by the size of their economy.

Right now, Bitcoin isn't backed by a government at all, but it's still backed by people. Those people obviously feel that Bitcoin is worth what it is today. Of course, that can change, just like any currency.

But eventually, Bitcoin will reach a value high enough that more and more people will start accepting it alongside fiat. I mean, go to any border town along the Canada-U.S. border, and they all accept USD and CAD. Clearly, they do that because it's advantageous to attract customers. That could eventually happen with Bitcoin. Then we'll stop worrying about Bitcoin's valuation so much, insofar as we stop worrying about the values of fiat currencies. It matters, but not that much.

When that will happen, and at what value, I have no idea. But until then, I'm hodling.

<comment><USER22>
       Fiat currencies work because as a whole, we agree on its value.

This is fuzzy thinking, as it doesn't even make sense to talk about the value of a currency - only it's price. Mixing up concepts like this is what makes a lot of bitcoin and related conversations very muddled.

When you start off your thought with a category error, as you have here, it's hard to get anywhere useful.

<comment><USER23> You got me confused now. The price of $1 is $1, no? But the value is that I need 1 or 100 to buy a bread.

<comment><USER22> $1usd == $1usd is a tautology, not a price.

how much you need to buy a loaf of bread is purchasing power.

The price of a $1USD is always relative to another currency, you can't price it in isolation.

None of these things are valuations.

</comment></comment></comment></comment><comment><USER24> The "blockchain" hype right now feels so much like "internet" hype in the late 1990's. Was that a bubble? Yes, but successful companies and technologies did emerge from it. People did make money too: those who started companies (even the companies that aren't around anymore), those who got lucky and invested in the few winners (like Yahoo), and those who invested broadly across the whole "internet" market.

<comment><USER25> I want to believe this argument so badly, but it's been 7 years and we still don't have a widely used application related to it. How much longer do we have to wait?

While we're on this topic, why are all Ethereum projects so damn meta? Like, the top dapps are all recursively related to Ethereum in some way (like wallets for ethereum, different ways of spending ethereum etc.) If a technology is new and exciting, shouldn't it be relevant _outside_ of its own little meta-bubble? Like Amazon, for example. Buy stuff without going anywhere. It uses the internet but doesn't somehow recursively relate to it. Where's a similar dapp today?

<comment><USER26> ARPANET adopted tcp/ip in 1983. That's a solid 16 years before the beginning of the internet bubble. Blockchain is far from being a mature technology.

<comment><USER27> That's a tricky comparison: network connections were expensive and computers which could run an operating system which supported TCP/IP cost more than your car until the 90s. In contrast, everything anyone in the world needs to use Bitcoin has been a commodity from the day it launched.

The difference is that the average person doesn't have a need which would motivate them to use it. As soon as networks became available, people jumped on them because there were tons of things they could do: download software, chat, shop, find a date, read the news, etc. Bitcoin hasn't found that draw yet — literally the only time I've heard a non-technical person mention it was because they'd heard about a VC investing in a startup and they were wondering whether they should buy some in case the price goes up.

</comment></comment></comment></comment><comment><USER28> Bitcoin is only increasing in value because nobody wants to sell, and the small amount that is mined daily is not enough to satisfy the speculators.

In a world where bitcoin is actually use as currency, its value would crash into the ground.

</comment><comment><USER29> I don't think that anything new could be said about bitcoins right now, and it's been like that since summer, really.

Some people do indeed believe in them, whether for technical reasons or for simply being invested, while others just keep thinking that it will crash. Both sides have a point, and majority of the people are convinced that they are right, but there's no way to predict the future.

Let's just see what happens.

</comment><comment><USER30> I really love Ethereum and have been invested in it for a while. I think @vbuterin and crew have a clear idea as to how to move past problems, and I find it exciting to watch the Ethereum foundation execute their vision well.

Bitcoin, on the other hand, doesn't perform its simple functions well in the short term, and seems to have very little idea on how to scale long term:

1\. Transactions are still pretty expensive and take a good while to settle.

2\. Proof of work as a long term consensus strategy just doesn't work. The amount of energy required to mint transactions is immense.

3\. Bitcoin hasn't made the headway with corporate partnerships that I think will be critical for larger adoption.

On Ethereum's end: a movement to proof of stake, sharding with global consensus, and the corresponding lightening and whisper networks all are really exciting domains of exploration. My two primary worries here are:

1\. There has not been much work yet to bring well designed languages to the EVM at this point. Well designed languages, with good testing frameworks (QuickCheck from the Haskell landscape comes to mind), and formally verified fundamentals (e.g. wallets) are critical for contracts to be viable for anything other than playthings.

2\. I worry about regulation totally hammering down innovation in this arena before it can sufficiently get past the rough early days. I do cautiously applaud Russia's hesitance to regulate, in an attempt to avoid destroying innovation.

On (1), I would love to get involved writing adapters for languages or subsets of languages like OCaml or Haskell to compile down to the EVM. If anyone knows of any resources I could jump into to explore this type of project, I would love it if you linked them.

<comment><USER31> Smart contracts are an inusual programming environment, both in termos of what you are doing (managing state transitions, etc) and computing resources available (CPU and RAM are very expensive).

I suspect that this is better solved by more domain specific languages instead of an existing FP language

<comment><USER30> > I suspect that this is better solved by more domain specific languages > instead of an existing FP language

I don't disagree, but with the current state of current Ethereum languages: Viper and Solidity, I feel as though using the good thinking in an existing well designed language might be more worthwhile to explore in the short to medium term.

</comment></comment></comment><comment><USER32> So I've been giving this a lot of thought. I mean after I lick my wounds about not buying any Bitcoin at any point ever. But alas...

I honestly don't see any cryptocurrency being used as a currency possibly ever but at least not until it stabilizes in value. You have to look no further than the real world to see what happens with unstable currencies. In countries like Venezuela for example a secondary economy forms around something stable like the US dollar.

The big problem with cryptocurrency is one of the things that many advocates claim as an advantage: there's no central bank who can affect the money supply. As much as people might, say, criticize the Fed for QE policies and central banks in general for "printing money", these things are actually necessary.

Bitcoin (et al) are like "digital gold". Gold as a currency had its place but there are huge problems with it and good reasons why the world went the way of fiat currencies.

So I see these coins being used ephemerally. For example: seller converts USD to BTC, spends that BTC on something. The seller immediately converts it back to USD so neither party has a holding period of BTC as there's too much risk attached.

That's all fine and there are definitely use cases for that. Unfortunately many of them are illegal so even though the tech is agnostic to such things, illegal uses are and will continue to be a big driver in cryptocurrency usage. This too will hurt widespread adoption.

As for the stellar rise in Bitcoin, I do think it will settle at some point for this reason: there has been a proliferation of other coins. At some point people are going to realize that these are interchangeable so you can just use whichever one you need to (again, ephemerally). New coins will fill the demand and they'll simply become another commodity.

Maybe that's the solution to the central bank problem.

Still, I can't help but wish I'd bought some Bitcoin at some point.

<comment><USER33> As someone who gets paid in Bitcoin and only has Bitcoin I can explain how it works.

I make purchases using Bitcoin or credit cards. I then sell enough Bitcoin to pay the credit card bills.

<comment><USER34> When you buy a pizza for $20 when does the FX transaction happen, at purchase time or at the time you pay your credit card bill?

I would hate to be on the hook for btc denominated loan.

<comment><USER33> When I pay my credit car bill. With my San Francisco software engineer salary the FX risk of that $20 is acceptable.

</comment></comment></comment></comment><comment><USER35> Someone care to explain how forks / clone coins are not the same as money printing. The motivation behind them are the same. Greed. I would have imagined the value of Bitcoin would have went down a lot after every copy

</comment><comment><USER36> Can someone explain why bitcoin should be worth more than any of its forks, or any of the other cryptocurrencies? It feels to me that if anyone can fork bitcoin and create a parallel currency then I don't see why bitcoin should be valued differently, other than if people feel that it is much more "useful". But even in that case, vendors and trading markets will support multiple currencies. It seems to me that bitcoin might be useful as a conduit for transactions, but not as a store of value.

<comment><USER37> This same question could be asked about many technology startups.

Why should Uber be valued higher than Lyft?

That's a pretty crude comparison, but I'm just pointing out that just cause someone comes along and makes a clone of something doesn't mean it will be worth more than the original even if it is technologically superior.

It's true that forking a cryptocurrency required much less work than starting a company, but I don't think that the value comparison is that different.

If people believe Bitcoin should be valued higher than a clone of Bitcoin even if the clone is better, Bitcoin will be valued higher.

<comment><USER36> except that Uber and Lyft are operating companies with revenue, expenses and earnings. Bitcoin is a "currency" without inherent value, or cashflow potential. I admit, Bitcoin may have some utility, but is that utility any different from another cryptocurrency? To rephrase my question, if someone was able to clone Gold, why should Gold be worth more than the clones?

<comment><USER6> > Bitcoin may have some utility, but is that utility any different from > another cryptocurrency?

Yes. It's easier to find shops that accept Bitcoin than it is to find shops that accept other cryptocurrencies. That's the utility: Being able to use it to buy stuff.

This utility is not because Bitcoin made superior technical choices, it's simply due to first mover advantage and network effects. If every place that accepts Bitcoin today started accepting other cryptocurrencies, Bitcoin would be likely to lose against those with higher transaction capacity and cheaper/more transparent fees.

</comment></comment></comment></comment><comment><USER38> Unfortunately, if (or when) bitcoin crashes while being on top valuation it will dramatically harm the idea of blockchain as a technology. It's too bad that bitcoin usually associates with blockchain.

</comment><comment><USER39> Could a psychological problem of Bitcoin actually be, that there are not enough of them, so that to own a single one is too expensive?

I know that you can buy fractions, but somehow it does not feel right to buy 0.2347 Bitcoin, and I actually heard people say that they are buying virtually any other Coin because it is cheaper. It is not rational, but nonetheless it is happening.

</comment><comment><USER35> If you are holding now then I would be worrying about how to get it all out in cash a.s.a.p

</comment><comment><USER40> Non-Paywall version (archive.is)

[https://archive.fo/4xW6A](https://archive.fo/4xW6A)

</comment><comment><USER41> Is there a non-paywall version?

<comment><USER42> Use incognito mode and you should be able to read it.

<comment><USER43> or a vpn, if it comes to that

</comment></comment></comment><comment><USER44> Frankly I'm astounded by the vitriol toward Bitcoin on HN. Bitcoin has the potential to actually change the world (unlike most of the BS startups coming out of SV), and yet all these voices on HN poo-pooing Bitcoin appear (to me at least) to outweigh those who are willing to give it a shot.

Why is this? Do people fear what they don't understand? Are they mad because they feel like they missed out? Does Bitcoin's success mean their loss (like the banking folks and the government establishment)?

Did people hate the internet this much in its early days?

<comment><USER45> The problem is that it has potential to change world for the worse, not the better. Fixed supply monetary systems have been tried in the history and there are reasons other than evil bankers wanting to get power for their dismissal.

And claiming that bitcoin's success would be bankers loss indicates that you don't quite get what is the utility finance sector creates. One of the main things banks do is they convert short term deposits to long term loans. There is _nothing_ in bitcoin that reduces the need for that service in our economy. There were banks at gold standard times and there will be banks in the extremely unlikely world where bitcoin is main currency in a society.

There is no mechanism in bitcoin that would manage the volatility of the currency (against the price of bread and butter, not other currencies) That in itself makes it DOA as a proper currency. Further, even if that was sorted out and a society would want to have bitcoin as their currency, why the f*ck (pardon my french) the society would want to give the seignorage to bunch of cryptonerds? It is not like it is difficult to make a fork.

I am not mad about missing one more tulip bubble/ponzi scheme. I am mad that people never seem to learn.

Modern money is debt. It is a marker who in the society is owed and how much. Thinking that those markers should have fixed supply is just not smart.

<comment><USER46> Bitcoin may be a finite supply but cryptocurrencies in general are infinite. So can you really say it is a fixed monetary system?

<comment><USER45> Each one of the cryptocurrencies I have encountered relies on the idea that the supply is somehow predefined.

Give me a cryptocurrency whose supply is adjusted based on the needs of their users and I am interested. Give me a cryptocurrency that allows heavily negative interest rates for savings to embrace current consumption in the economy over hoarding of "money" and I am interested. But these are complete anathema for the current cryptocurrency folks.

<comment><USER46> It can be done easily. I would say it will be done in the future by governments and forced on us. The amount of control a government would have with a forced cryptocurrency is the only problem I see.

<comment><USER45> Yes, easily if it is made by government. But if you wanted to do that without government help enforcing things bit in a distributed manner, I find it a bit more difficult.

</comment></comment></comment></comment></comment></comment><comment><USER47> dang, another paywall

</comment><comment><USER48> "People are not buying Bitcoin because they intend to use it in their daily lives." This is why it's a bubble.

</comment><comment><USER49> Money is what you pay taxes with. Period. At the end of the day, that's controlled by the government.

<comment><USER49> Love the down votes, but I'd love more to see an example where this is not the case?

</comment></comment><comment><USER50> The Economist is owned by the Rothschild concern; just wondering if everyone knows this.</comment>


Pakistan tries to ban encryption under new telco law - <AUTHOR> http://www.techdirt.com/articles/20110729/03142715310/reports-claim-that-pakistan-is-trying-to-ban-encryption-under-telco-law.shtml

<comment><USER2> ha ha ha, good luck with that.

remember when the US tried to do something similar with the Clipper chip in the 90s? good times.

</comment><comment><USER3> might as well ban the internet while you're at it.

</comment><comment><USER4> That means no HTTPS, no online banking, no secure communication.

I say that law has zero chance of surviving, or if it goes through it will be shut down within a month until some high profile politician's private emails get leaked.

<comment><USER5> I would imagine that there would be an exception for government officials.</comment></comment>


Hopeful startup founder seeks your advice, where do I find a co-founder? - <AUTHOR>

I could really use some advice. I made a huge mistake, I thought I could start a startup without some kind of advisor, network of people I could turn to for help; or even a co-founder.
It certainly isn't too late. There isn't even a product out, but I simply have to much to do at once, with too little help or support.
Point blank, I need a co-founder or two.
There really isn't anyone in my life right now who would be in this with me, for the long run. Friends, family, and colleagues are totally behind me and think I can come up with a viable business.
I think I would be far more successful if I just had a co-founder. So my question is, where and how do I find one? <comment><USER2> Since you're posting this question on HN, I'm going to assume you are trying to do an internet startup.

Are you a hacker or a hustler?

Quick general definitions:

Hacker is the technologist who understands how to use technology to solve business problems.

Hustler is the sales/marketing person who understand the specific market vertical (customer problems) and has the ability to sell whatever the hacker builds in that market.

If you're a hacker, finding hustler co-founders is pretty easy. Look for a subject matter expert (SME) in the market vertical you are going after. They should be able to give you all the info you need to penetrate that market (customer pains, sales strategies, introductions, price points, etc). Al they have to do is tell you what to build, then sell it.

If you're a hustler looking for a hacker, it's much more difficult. Any hacker that's actually capable of playing an integral role in your success is already working on another project. The only place I know of where you can find decent talent is in corporate America. Find the person living the office space movie and offer them a path to freedom.

If you're a hustler looking for a hacker, you have to be one hell of a hustler to get any respect. You have to nail down every possible non-technical aspect of the opportunity. And it better be one hell of a good plan you put together. It has to be so well put together that the hacker knows immediately you are the real deal and all the hacker has to do is hack.

Being a hacker who's been approached by a lot of hustlers over the years, let's just say you have your work cut out for you (assuming you're the hustler looking for a hacker).

<comment><AUTHOR> Sorry, I should have been more specific. I would be the "hacker". I'm personally, doing almost all of the development. So I would be overseeing the technical side.

I'm looking for a co-founder who would be better suited for the business side. Not that I couldn't or wouldn't be very much involved. I would absolutely be out there trying to "hustle" and sale all day everyday as well. :)

<comment><USER2> It's a huge step in the right direction if you are willing to get out in front of customers! That's a pretty scary step for most techies.

You have to narrow down your scope to a specific market vertical. Get as specific as you can. Then you start getting customer feedback ASAP.

If you have several (or a lot of ) markets you can go after with your idea, then pick a couple to test.

What sometimes happens is you end up in a market that wasn't even on your radar because you talk with somebody about the tech you're building and they apply it based on their experience and, boom, you're in some totally out-of- left-field market that proves to be the lowest hanging fruit.

Find some competitors, then use LinkedIn to connect with some former employees, especially sales people. They will be perfect SMEs. Even if you don't partner with them, you can still pick their brain to get a better understanding of the market.

Next place to find your hustler would be to identify your best potential customers, then try to connect with one of the technical people via a back door channel (i.e. don't just call the company and ask to speak with them). This is a bit trickier, but still very valuable because you can cultivate a relationship with an inside champion (which makes the sales process much easier).

The hardest part (for me anyway) in finding a hustler is that you'll have to spend time working on your value proposition. Once you branch out beyond being the lone soldier, you have to figure out how to communicate your idea to other people. This takes time away from coding, which is always tough for any hacker. But it's an invaluable exercise.

</comment></comment></comment><comment><USER3> I`d recommend attracting a co-founder. i.e. create some kind of attractive looking basic concept site and show it around. It`s not a full site, just something that allows people to visualize your concept. Include a note on the site explaining that you`re looking for people to work with you on the project. Ideas are dime a dozen so the more you can show, the greater chance you`ll have of attracting serious and capable co-founders.

<comment><AUTHOR> Good idea, I almost didn't post my question because I don't have something up, yet.

</comment></comment><comment><USER4> You may just need more time or some help!?

Or should you be more specific on your needs? ( Hey! I'm assembling the worlds coolest cardboard boxes, anyone interested? :)</comment>


Numenta Introduces Breakthrough Theory for Intelligence and Cortical Computation - <AUTHOR> https://www.businesswire.com/news/home/20181015005330/en/4463080/Numenta-Introduces-Breakthrough-Theory-Intelligence-Cortical-Computation <comment><USER2> Direct link to (pre-print, not peer-reviewed) paper:

[https://www.biorxiv.org/content/biorxiv/early/2018/10/13/442...](https://www.biorxiv.org/content/biorxiv/early/2018/10/13/442418.full.pdf)

</comment><comment><AUTHOR> Discussion of the paper: [https://news.ycombinator.com/item?id=18223158](https://news.ycombinator.com/item?id=18223158)</comment>


Heyzap growing fast (YC 09) - <AUTHOR> http://venturebeat.com/2009/02/19/heyzap-shows-fast-growth-with-its-embeddable-casual-game-widget/

<comment><USER2> <http://dl.getdropbox.com/u/72/game_play_minutes.png> <\- They didn't post the nice graph :)

<comment><USER3> We like graphs...

<comment><USER4> To represent growth, you should show the derivative.

<comment><USER5> Yea, an increasing derivative with respect to time is sexy.

Preliminary job well done, guys.

</comment></comment></comment></comment><comment><USER6> Congratulations! I think this shows the benefit of being a YCombinator company and getting lots of press because of it, starting with TechCrunch. As some have noted, the company simply takes the feed from <http://www.mochiads.com/publishers.html> and allows users to insert a snippet of html containing embed code for that game (with heyzap's affiliate id) onto their site. On the other hand, it's that kind of simple idea that all one needs for the first version, and also proof that one really doesn't know what to expect from the media and the users until they launch, and so the only way to know how the market will truly respond is to create and release something.

<comment><USER2> We pull games from Kongregate, AddictinGames and others too, we also let game developers upload games. The game content is already out there we are most aggressive in making sure we have all the best games.

We focus completely on publishers, which no one else is doing and where we innovate. Our API and contextualized games adds to this capability. More coming.

</comment></comment><comment><USER7> i don't see why they compare you guys to kongregate and addicting games. Or did they come out with a widget too?

<comment><USER3> Great point. The comparison is not right, we are a publisher focused company, we are not building a destination site.

Different product, different strategy, similar content. We do love both companies though for different reasons.

No widgets out from any of the other players.

</comment></comment><comment><USER8> awesome, congrats guys</comment>


R, the master troll of statistical languages (2012) - <AUTHOR> http://www.talyarkoni.org/blog/2012/06/08/r-the-master-troll-of-statistical-languages/ <comment><USER3> The problem is that here the "generic" tools like "apply" are not really generic. Hence you can not use your intelligence and creativity to deduce a working program using a small toolset that you know fully.

Instead you must use a huge number of special tools that do only a few things. The code is hard to read, hard to write, slow, the compiled version is big. It is also error prone since you must use a large number of different paradigms. Some might have their arguments slightly differently. It's produced by googling for everything (or if there's a decent builtin help system, using that).

It seems strange that such concepts, like generic data types, operators and functions are not more widely spread. For example if you can calculate "max(a-b)" even if "a" is a matrix and "b" is a scalar, that's already quite nice. This can increase productivity a lot.

Since such design models are so fundamental, they are rarely found in "matlab- like" extensions for other programming languages: instead you must constantly do type conversions and transformations by hand and use awkward middle man functions to access data types. Most of your code is housekeeping and little actual progress.

See for example the problems with Julia where column and row vectors are totally different types: <http://2pif.info/op/julia.html>

<comment><USER4> _> See for example the problems with Julia where column and row vectors are totally different types: <http://2pif.info/op/julia.html> _

That was one year ago. They are still different types, but they behave as you would expect wrt arithmetics.

        julia> x = [1,2,3]
        3-element Int64 Array:
         1
         2
         3

        julia> y = [1 2 3]
        1x3 Int64 Array:
         1  2  3

        julia> y'
        3x1 Int64 Array:
         1
         2
         3

        julia> x + y'
        3x1 Int64 Array:
         2
         4
         6

Their size and dimensions are still different, though, but it is mostly a concern for library writers.

        julia> ndims(x)
        1

        julia> ndims(y)
        2

        julia> ndims(y')
        2

        julia> size(x)
        (3,)

        julia> size(y)
        (1,3)

See [https://groups.google.com/forum/?fromgroups=#!msg/julia- dev/...](https://groups.google.com/forum/?fromgroups=#!msg/julia- dev/W2C9-HbXH3o/P8A8jo7FHSoJ) for the discussion that resulted from that post.

 _Edit:_ I should add that there's now a mailing list dedicated to statistics with Julia: <https://groups.google.com/forum/#!forum/julia-stats>

<comment> alok-g This is pretty much the only thing that I do not like about Julia. Matlab also uses this concept, and I have had my Matlab code broken several times because of this issue.

<comment><USER5> Trailing singleton dimensions in N-D arrays was a far worse problem that I believe Julia fixed.

</comment></comment></comment></comment><comment><USER6> R has a rich heritage of trolling unsuspecting programmers coming from other languages. In ancient versions of R from the early 2000s, the underscore operator was synonymous for '<-', aka assignment. This is why in R some use periods for separators (ice.cream) rather than underscores (ice_cream), though just to make things more lulzy some package authors have started to use Java style camel case (iceCream) too.

I saw an example of R code using underscore for assignment posted on twitter a couple of months ago. See if you can make heads or tails of this: [http://www.stat.washington.edu/hoff/Code/hoff_raftery_handco...](http://www.stat.washington.edu/hoff/Code/hoff_raftery_handcock_2002_jasa/dist.r)

<comment><USER4> _> This is why in R some use periods for separators (ice.cream) rather than underscores (ice_cream)_

... and since the dot is legal in identifiers, they use $ as lookup operator.

        > ice.cream$flavor
        [1] "chocolate"    "vanilla"    "butterscotch advocado surprise"

</comment></comment><comment><USER7> This is the very same critic that was (and still is) made about perl.

 _> > I won't bother to explain all of these; the point is that, as you can see, they all return the same result (namely, the first column of the ice.cream data frame, named 'flavor')._

Having many ways to do one thing is good - whatever float your boat you know. Just for the given examples, I see how one may be better in a loop (the one where you use 1) while another one may be better when you type it on the command line to check stuff (the one with flavour)

 _> > The answer is that when you're trying to learn a new programming language, you typically do it in large part by reading other people's code–_

No. You learn by doing. You write some stuff, test it, and if you don't get the result you expect go back to try and figure out what's wrong.

And even before doing that, you set aside some time to _LEARN_ about the language.

But maybe, just maybe, the problem is not with the tool but with the person using it?

 _> > I have to confess that I've never set aside much time to really learn it very well; what basic competence I've developed has been acquired almost entirely by reading the inline help and consulting the Oracle of Bacon Google when I run into problems. I'm not very good at setting aside time for reading articles or books or working my way through other people's code (probably the best way to learn), so the net result is that I don't know R nearly as well as I should._

At least that's honest. Maybe you don't do well with a language (any language!) because huh, you didn't take time to study it and expect it to magically work??

I know I'm no good in java, but I also know why - I never took some time to actually learn it. I can do things with java, but not very complex things, and when I fight my way out of a problem I caused, I won't blame java but myself and my lack of knowledge of java.

<comment><USER8> _No. You learn by doing. You write some stuff, test it, and if you don't get the result you expect go back to try and figure out what's wrong._

No. This is how you learn to do whatever simple things you want in a language. The way you learn how to do things _correctly_ is mainly by reading code. If you have an expert to review your code that's better, but almost no one has that opportunity.

Edit:

I guess I should come right out and say what I'm thinking: not everyone's opinions about a programming language are equal. I suppose this is why people are constantly having discussions about the pluses and minuses of "dynamically typed" languages, while type theorists don't even recognize "dynamic typing" as a form of typing. Expert analysis has consistently shown problems with the R language design and implementation. It's not a good language. Its features are often misused or poorly used and it doesn't have a strong sense of what support it wants to give to its users.

[http://channel9.msdn.com/Events/Lang-NEXT/Lang- NEXT-2012/Why...](http://channel9.msdn.com/Events/Lang-NEXT/Lang- NEXT-2012/Why-and-How-People-Use-R)

<http://www.cs.purdue.edu/homes/jv/pubs/ecoop12.pdf>

<comment><USER9> I've been interested in type theory for a while, but haven't found a good avenue for getting into it.

Could people here list any resources on type theory that comes to there mind? Books, blogs, people, etc. A book that explains the fundamentals would be great.

<comment><USER10> While not being exactly about type theory like Pierce books (you can't waste your money on those), I really like the part about types in "The Implementation of Functional Programming Languages" by Peyton Jones (the chapters about type system are written by Peter Hancock). It's seen mostly from a technical point of view. The book notably contains a fully explained implementation of a type checker.

You can check it online while waiting for the Pierson ones: [http://research.microsoft.com/en- us/um/people/simonpj/papers...](http://research.microsoft.com/en- us/um/people/simonpj/papers/slpj-book-1987/PAGES/V.HTM)

<comment><USER10> Sorry for the ambiguity. It's certainly not a waste of money. I found "Types and Programming Languages" really good (for whatever that means, I'm far from being an authority in the subject). It seems to be wildly used as a textbook and is a reference in the subject. While I didn't read it, I expect the second one to be in the same vein.

</comment></comment></comment></comment></comment><comment><USER11> R is a great set of statistics wrapped in a crime of a programming language. You have to fight the latter to get to the former. Is the fight worth it? I and many others say yes... but it sucks that we even have to make that decision.

</comment><comment><USER12> The metaphor I use to explain R is that most programming languages are like different varieties of swiss army knife: general tools that can do a lot of different stuff with relative ease. R, on the other hand, is like a fillet knife: its totally obtuse for _most things_ , but in spite of its oddities it outshines all other choices at one specific task (statistical data analysis / filleting a fish respectively). Depending on what sort of camping trip you're going on you might want to bring one or the other or both.

</comment><comment><USER13> Language issues asside, R is being propelled by an _awesome_ group of developers (such as Hadley Wickham, Dirk Eddelbuettel, John Myles White, Brian Ripley etc). These people are why R is as successful as it has become - <USER2> through continued work on various aspects and packages and direct interaction with users new and old. Frankly, there should be some kind of slightly awkward parade for them all.

<comment><USER14> I'd say that R is awesome, and that R is a fairly annoying language, all at the same time. (I'll go back to writing some R code now.)

</comment></comment><comment><USER15> I think R's biggest strength of R is the package ecosystem. I would not trade the large community of active package developers for slightly friendlier syntax.

<comment><USER16> Indeed, the ecosystem of actively deved numerical libs is the only upside to R over other tools. It's a pretty large cliff for any other tool chain to climb over.

\--someone who's writing numeric/ data analysis tools in Haskell.

<comment><USER17> Off-topic but: Can you comment on the significance of this cliff for a team considering moving from R to Haskell for data analysis? Is the availability for statistics packages really sparse in Haskell?

<comment><USER16> the answer is: it depends! Shoot me an email at Wellposed and I can try to better answer your question.

I am quite literally building a full data analysis stack (as a product) in haskell, some parts of which will be available as a sort of proprietary augmented version of the haskell platform, and some parts are / will be open source.

I do think that there are compelling reasons to consider Haskell / GHC for analytical workloads, but depending on the details it really depends.

The principal cliff is just the HUGE number of (mostly poorly designed) libraries for many standard analyses written in R. Theres some nice engineering approaches to circumvent this, and theres some really exciting libs that a uniquely awesome and handy in haskell land.

A notable example is AD, a really easy to use auto differentiation lib by Edward Kmett, which has a really exciting refactor thats nearly done that will make it useable by mortal Haskellers :) <http://hackage.haskell.org/package/ad> and <https://github.com/ekmett/ad> (I've some neat bits i'll be hopefully adding to AD myself in the next month)

<comment><USER17> Thanks! I'll keep an eye out for these releases. :)

</comment></comment></comment></comment></comment><comment><USER18> When I think about R I find it difficult to stop making analogies between it and JavaScript. Both are dynamic, "script" languages with C-based syntax and with LISP-like nature that lurks underneath it. Both have functions as first class citizens. Both are inconsistent in different ways. Just to name a few that first come to my mind ... I think that these analogies reduced frustration that I had felt about R once when I "discovered" them and helped me to adopt and learn R.

<comment><USER19> That makes sense - they were both inspired by Scheme (R is in many ways just a Lisp that uses M-expressions), but evolved to deal with immediate concerns that, in retrospect, have created difficulties as the years have gone by. It makes R and JavaScript great and frustrating at the same time.

</comment></comment><comment><USER20> So why not just use Python these days?

<comment><USER21> At this point, mostly library support. Python is quickly getting closer to being a viable R replacement, but it's simply not there yet IMO. The two biggest holes in python for me are:

* The lack of built-in dataframes and libraries to work on them (like plyr). Pandas seems to be getting pretty good, but it's still not as mature as R's solutions.

* Visualization. ggplot for R is great, matplotlib for python not so good IMO. I've heard Bokeh and rplot are attempting to bring ggplot functionality to python. Again, not nearly as mature as R's solution.

I'd love to move to Python because R is not a fun language to develop software in. But at this point, R is by far the better tool for working with data (for my needs at least).

<comment><USER22> I'd love to hear what makes R not-fun to develop in. I'm always on the look- out for common pain points.

<comment><USER21> A large pain point for me is remembering the huge number of useful commands in R - I use at least 5-10x as many keywords in R as I did in C++. As I mention in another comment I basically need a reference (usually google and ?) at all times to keep track of these commands and their parameters. In many ways it's great that all these functions exist because I can analyze datasets an order of magnitude more quickly (in development time) than I could in a more traditional language, but developing in R is far more stressful to me. When I'm writing production-level code I constantly have to worry about readability and whether someone else who is reading my code will intuitively understand what I'm doing. With so many commands and so many ways to do things this can be challenging. I find my R code is often lower 'quality' than what I write in something like Python or C.

There are many little idiosyncrasies in R's syntax, I feel like I never grokked the language. For example, pretty much anytime I see '~' I have to relearn what is going on. From a mathematical perspective I appreciate that vectors are indexed from 1 instead of 0, but from a programming perspective it can be annoying.

BTW, thanks for contributing so many great things to R, I owe a lot of what I do to you.

<comment><USER22> I think a big problem is not just the language, but how it's usually taught - in other words, I think you shouldn't need such a large vocabulary if you learn the right primitives (which don't always exist in base R). The lack of a solid common foundation it also what makes code readability a challenge.

Part of the problem is the base packages: as soon as you open R you have ~1600 functions you can use, and you obviously can't memorise a significant proportion of them. Learning R is as much about what you don't learn as what you do.

<comment><USER21> Great point, I'll have to reevaluate how I use R. My training in R was very informal and mostly involved reading other people's code, so my "vocabulary" is probably a union of other peoples' and is probably too large.

Actually one thing that has helped in the past year was reading your split/apply/combine paper and using the plyr package more.

<comment><USER22> I'm working on a curriculum for basic programming in R, hopefully that will eventually help outline what everyone should know about R, regardless of what they use it for.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> _R has a million related built-in functions like sapply(), tapply(), lapply(), and vapply()_

Exactly that. I've always found R a horribly confusing mess, compared to general programming languages (I'm proficient in Ruby, JS, Obj-C).

On the other hand, compared to some of the other commercial stats packages, it's beautiful and logical and reasonable. I regularly use Stata, where you're only allowed one data table in memory at once, and almost everything relies on side effects and Byzantine macros. E.g want to calculate a mean? First, 'summarise' the variable, then assign 'r(mean)' to a var name, then quote that the right way to be substituted into an expression where it's needed.

</comment><comment><USER24> let's stop using the word 'troll' at this point ok ? it's clearly an insult. doesnt make sense to call a language that way.

</comment><comment><USER25> This was actually a fantastic introduction to an important aspect of R which I had only briefly explored in the past.</comment>


Apply HN: 3rdi-time travel in AR - <AUTHOR> Answer: we can travel backwards in time<p>Question: What happens when you put a layer of video uniformly scaled and rotated to the individual respective faces and vertices of a polyhedral mesh that has similar reflective properties to that of glass in Unity?  Do the resulting 'holograms' display self similarity? <comment><AUTHOR> [https://www.youtube.com/watch?v=LK0YS6g_OO4](https://www.youtube.com/watch?v=LK0YS6g_OO4)

</comment><comment><USER2> Not much overall info here, but with just my imagination filling things in...Yeah it could be cool.</comment>


State Propagation with Multiple Databases - <AUTHOR> http://www.victusspiritus.com/2010/09/21/state-propagation-with-multiple-databases/ <comment><AUTHOR> Oh yeah, I screwed the update function up good, shall fix tonight.</comment>


Perfecting the 3 Minute Startup Pitch - <AUTHOR> https://medium.com/@dannyyaroslavski/perfecting-the-3-minute-pitch-410285d971ce#.p6673p4ty <comment><USER2> I really like the "Idea Introduction Pattern" template. I think it's a good way to give a concise description of any business project:

        For [target customers], who are [dissatisfied | frustrated | ...] with [the current offerings in the market].
        My idea/product is a [new idea, or, product category]
        That provides [key problem/solution features].
        Unlike the [competing product],
        My idea/product is [describe key features]
        My name is [name], [role] of [company]
        & we are [changing the way ...]

I learned about it at an event at the Montreal Startup Breakfast Club. The presenter credited Geoff Moore for the original template.

<comment><USER3> Sounds like something an insect would manage to say. Marketing is better done organically.

Here's a better rendition:

1\. You're proud to introduce your product or service. 2\. Whereas competitors fail on significant specifics or just fail to deliver the full dill pickle, your product succeeds. 3\. For existing customers of incumbent products, we have seamless ways to transition. 4\. The future is our product. I am Flappy Bird of Vandaley Industries and I welcome you to try our dill pickles absolutely free without frustration for 2 nanoseconds. If you have any questions, contact our sales team at 1-800-FLAP-SOAR as well as the contact page on our walrus-site.

<comment><USER2> Sure, your suggestion works well, but where is the PROBLEM statement? Starting with a comparison to the competitor works only for an existing market.

Like OP on the 3 min pitch says, ppl want to hear what problem you're solving, otherwise they won't listen. Dill or no dill.

<comment><USER3> People dont want to hear about the problem. They just want to see the solution. An elegant presentation would intertwine them because like you said, time is limited. But I think the main problem with the original template you posted is that it us very drill like. Isnt a big part of pitching to feint the fact that youve done it a lot? If the audience or investors suspect you have experience marketing, doesnt that say you are essentially a drawn out desperate marketer? Honestly I dont know much about this I was just originally joking. I think its important to do that template without sounding drilled. But its a good template nonetheless.</comment></comment></comment></comment>


Ask HN: What is a secure way to allow 2FA resets? - <AUTHOR> I have 2FA on one of my web apps. Most users are using Google Authenticator which uses TOTP (Time-Based One-Time Password). On first login, we show them a QR code. We instruct them to save a copy of this QR code in the event they get a new phone or want to install a new 2FA app. However, I am running into a situation where users are not doing this. I can easily enough reset their account to show a QR code again on next login, but my question is: What is the safest way to "authenticate" them for a reset? I could do things like send a reset email to the email associated with the account, but I am just wondering what others are doing for situations like this. I want to make sure I am doing it as securely as possible.<p>Thanks! <comment><USER4> This is the most tricky issue about 2FA: who's going to authenticate the authentication system? From what I've seen in practice, if an account is lost, there are two primary ways for recovery.

(A) Secret key. When a user is setting up 2FA for his/her account, the system generates a secret passphrase/QR Code as a crypto key, with instructions for user to write it down or print it out, then store it at a secure location.

(B) Manual review. The policy of a hosting company I use, is that when a 2FA- protected account is lost, the user must submit a national passport and proof of payment to reset the account manually.

And if user wants to add a new device.

(C) Send a challenge to the original device. If the system is in form of an app, it's as easy as showing up a Yes/No warning in the app: _someone is adding a new device to your account, do you trust it?_ This is commonly used for various chat apps.

However, all the methods are not going to work for your use case, as the user wants to bypass the 2FA when setting up a new device... Currently, I don't see a satisfactory solution, otherwise, it effectively opens up a loophole and nullify the advantage of 2FA.

Let's see what other readers are saying.

<comment><USER5> A. OP's original problem is that users aren't noting down the secret when they're requested to.

B. Manual review works, unless there is a sufficient incentive to break it. Here's an example of PlayStation Network struggling with hackers disabling 2FA via customer support - [https://waypoint.vice.com/en_us/article/43ebpd/the- long-weir...](https://waypoint.vice.com/en_us/article/43ebpd/the-long-weird- story-explaining-why-i-bid-dollar700-for-a-stolen-psn-account)

C. If a user is resetting 2FA then most likely they've lost the device on which they had the authenticator app installed. If they still had access to it, authorizing them to perform a 2FA reset would be trivial.

D. Reset via email is the most commonly used one. It's scalable, unlike manual review. Less secure, arguably.

> This is the most tricky issue about 2FA: who's going to authenticate the > authentication system

100% agree here. It's a hard problem.

<comment><USER6> >D. Reset via email is the most commonly used one. It's scalable, unlike manual review. Less secure, arguably.

What's the argument that it's not any less secure? That seems like a pretty obvious conclusion to me.

<comment><USER7> Password reuse and 2FA enforcement.

Although, we at HN are the shining tier of amazingness (/s), most people will use the same password across as many accounts as they can, or use some dirivation of the password.

The bigger issue is that plenty of people don't enable 2FA onto their emails as it's never really suggested by the providers, some just don't support it, and the fear of getting locked out of something so central.

It's better than SMS 2nd Factor though.

<comment><USER8> Gmail at least (sort of) pushes 2fa with their 'security reviews'.

</comment></comment></comment></comment></comment><comment><USER9> You probably want to request a reset.

When a reset is requested, you should then allow a grace period - possibly up to a month for the reset to be cancelled. You should notify the user via email/out of band mechanism that a reset has been requested.

On each login you should prompt that the reset is ongoing and that it can be cancelled.

Finally after a month, you revoke the 2FA and allow a new device to be activated.

Or alternatively/as well, you require that the user sets up a new account. You may allow them to merge this account after the reset has completed.

Fundamentally the question is "if a user took over someone else's account what the impact be?"

On reset, you may want to delete any sensitive recoverable data - e.g. Credit card details or Passport info.

<comment><USER10> This is the one that I like the best if manual human review doesn't work for your use case.

Set a reasonable time period (a month seems like really long, I was thinking more along the lines of a week), use every piece of information you have to attempt to alert the user multiple times that a reset is happening (email, text, in-app alerts, etc...), make sure that each "alert" gives the user a one-click way of stopping the reset, and when the reset is successful, delete all information that is easily replaceable (like saved credit cards or addresses, or as much personal information that you can get rid of).

<comment><USER11> One of the problems with that is it makes account recovery after a compromise that much harder. If an attacker manages to prevent you from seeing those notifications (compromised email/sms) and you aren't actively signing in, it's possible for the month to lapse.

Once the attacker has control and you try to reassert ownership, the attacker gets a loud warning every time you try to login/change the TFA and a month to respond.

<comment><USER10> That's very true, so I guess at the end of the day manual verification is needed for just about everything where you absolutely need a user to be able to recover their account.

A scheme like the above still helps cut down on the number of times that manual verification will have to be used, and hopefully can be made rare enough that you can spend the proper amount of time verifying each one to do your best to prevent "stolen identities" from being used.

</comment></comment></comment></comment><comment><USER12> Consider the threat model:

An adversary takes over the email account, and checks if they reused their password on your site. If they didn't, then they'll try to reset the password, and you should check the second factor _before_ resetting the password. If they did reuse their password, then you should check the second factor on login (assuming it's coming from a previously unrecognized source). At this point, the attacker will either give up, or attempt to contact your support channels, impersonating the user.

It's up to you what restrictions you place on your support mechanism for resetting 2FA. I would suggest a combination of the following:

\- photo of a currently valid credit card associated with the account

\- photo ID with address that matches billing address

\- mandatory 7 day delay in the reset

\- prove access to the payment method by issuing a payment for some fractional amount and request the amount, then refund it (or don't and keep it as a "security fee")

But no matter what you do, please please please be consistent. Train your entire support staff (if any), keep records of when people talk with you, don't disclose when the last time you talked was, and insist on following a process. If your process fails, see how and improve it.

<comment><USER13> > photo ID with address that matches billing address

Please don't do this. There are people who move often to not have their current address on their photo id.

<comment><USER14> For this to be a problem someone would have to lose their 2FA device, and their backup codes, _and_ change their billing address but not the address on their ID. If all that does happen, they can solve it by updating their ID, which most states require within 30 days of moving anyway.

<comment><USER15> Or they could have used a billing address different from where they live to start with.

<comment><USER12> True.

I'd argue that trumps all other control over the account. If you can show that you control the payment method, then I'll accept you as the legitimate controller of the account. So, notarized, translated, and apostilled letter from the bank branch manager stating that you are the person in control of the account, sent by certified mail with signature delivery and I'll send you back a link to type in manually the same way.

As a shortcut, I'd say it's mostly safe to accept a picture of someone's face holding up their photo ID with the same billing address.

Or confirming the amount and/or origin (some banks/credit systems do not display the merchant name for some halfbrained reason) of a small transaction (e.g. 1.37 USD from merchant account ACMECORP-294817) that is refunded after a week.

</comment></comment></comment></comment></comment><comment><USER16> To add to the (mostly excellent) comments on this threat:

Consider the risk involved, and who is responsible for keeping the reset procedure secure.

If you're building a bank app, make sure you have a proper reset procedure, preferably with human validation, like how user 'steventhedev' described. The bank (your company) is responsible for this.

If you build commercial/enterprise software, the 'admin' user should be able to perform resets. Preferably a customer must have at least 2 admin users, to prevent locking out. The customer is responsible.

If you are building consumer grade software, go with a reset procedure through email. The consumer is responsible for keeping that secure. If their email gets compromised, it can't be your responsibility.

<comment><USER12> > If you are building consumer grade software, go with a reset procedure > through email. The consumer is responsible for keeping that secure. If their > email gets compromised, it can't be your responsibility.

That defeats the whole point of 2FA.

<comment> move-on-by I'd say on average anyone who is concerned enough about their security to turn on an optional 2FA feature is also going to have 2FA enabled on their email as well. If I were only allowed to have 2FA enabled on a single account, it would be a very difficult decision between my password manager and my email. As you point out, email access is the key to the kingdom. Also, the only password that I do not put in my password manager is my email account password.

</comment></comment></comment><comment><USER17> One option would be on the sign-up side: get them to "test" the recovery option. Keep bugging them about it every log-in until they do. This has two advantages:

1: This sends the message that you think it important, which might help them realise it is too.

2: They will have printed the QR code. Putting it somewhere safe is a small additional step.

<comment><USER10> Even then a backup code like that isn't going to work in all cases.

This is the same issue that electronic/cryptographic voting schemes run into.

You can't in many cases just tell your user "too bad you lost the code", you need a way for a user who has lost everything to get back in.

Shit happens, theft, floods, fires, other natural disasters, etc... And in those cases it's somewhat common for the user to lose their phone (with the 2nd factor app on it), as well as their backup codes.

Sure, a game might be able to get away with saying "sorry, you lost your 2fa and backup, so you are SOL" (the user won't be happy, but it's not the end of the world), but for a bank account? For a utility company? For your email account? Telling the user "so sorry you are fucked" is a very bad thing, and could even be illegal in some cases.

Forcing the user to verify that they printed it out and saved it can help cut down on the number of reset requests, but it won't completely solve the problem. You still need a way for someone who has lost everything to get the account back.

<comment><USER6> >Shit happens, theft, floods, fires, other natural disasters, etc... And in those cases it's somewhat common for the user to lose their phone (with the 2nd factor app on it), as well as their backup codes. >Sure, a game might be able to get away with saying "sorry, you lost your 2fa and backup, so you are SOL" (the user won't be happy, but it's not the end of the world), but for a bank account? For a utility company? For your email account? Telling the user "so sorry you are fucked" is a very bad thing, and could even be illegal in some cases.

In some cases you might be able to get away with using waiting periods. You can establish like a month or so and ask them to re-request after that with a recovery code you give them when they first make a request.

If nobody accesses the account in that time, you can have a bit more confidence that the request is legitimate and the account owner really has lost their credentials. And then when they re-request with their recovery code that's the authorization to start the reset.

In some cases you could tide them over with a temporary account that has limited privileges for the duration of the waiting period that can be merged back into the original account once its unlocked. You could probably even do some analysis behavior in the temp account to see how well it matches up with points of contact, frequency of use, word choice, location, etc. on the main account.

I wouldn't trust that for a bank or a primary email, you really need to verify identity for that. But for a utility company it might be ok.

</comment></comment></comment><comment><USER18> Put a timer on the reset - Allow them to start the reset process, but make it so it takes a while (At least a few days), and during that time make sure any successfully logged in person on that account sees large warnings that someone is resetting their 2FA. This ensures that whoever actually owns the account can react in time to stop a takeover, at the cost of making the reset process kindda painful.

<comment><USER19> Counter that if I'm a hacker, I'll already have knowledge of this and try and time my attack when my target is unlikely to log in, but I suppose we're getting into weeds with that.

<comment><USER20> There is no staying out of the weeds when it comes to security. The weeds are where the threats hide.

<comment><USER19> We all better get a cabin in the wood then ;)

</comment></comment></comment></comment><comment><USER21> Most answers here are things that won't work because people are human and will lose or forget stuff one way or another. What I've seen that works quite well is to have a user list a number of email accounts that they trust to vouch for them. If they lose their 2FA and 2FA backup then they can do an email reset, but only if n of m of their friends authorize it and only after a delay of some kind (24 hours, say). Now an attacker needs to figure out what the likely friendlies are, pop multiple email accounts, and the delay gives enough time for someone to notice something and lock the account down.

</comment><comment><USER22> Personally, I think true 2FA—of TOTP-type 2FA tokens that most people mean when they say "2FA" these days—can only work in the context of a SSO service / "identity provider" (in OpenID parlance) which requires KYC document submission (birth certificate, passport, etc.) upon sign-up.

In order to be able to prove who you are to reset your auth credentials, you have to have proven who you are when you set up the account, in a way which _distinguishes_ your identity from that of others who share some-but-not-all of your attributes (e.g. your legal name.) Otherwise, anyone with those same attributes "has the key" to your account.

The only convenient way to create such a distinguished profile, is to hand over some legal identifying document that is linked to a pool of other identifying documents, such that if you later see a _different_ such document, you can ask the relevant government whether it identifies the same person as the previous document you saw.

This requires keeping around identity documents for later comparisons, which is a fraught problem. I'd rather trust as few companies with my identity documents as possible—especially if I know that they're going to need to keep them on file.

Thus why I say that probably only SSO providers can manage TOTP 2FA: without a _secure_ 2FA-reset flow, they don't "really" have 2FA; and only very few companies (i.e. identity providers) are able to be trusted with the documents required to implement such a _secure_ flow.

——

...none of which matters all that much, because the real problem is TOTP itself, and the solution is to switch to a better type of 2FA. In the original enterprise 2FA smart-card implementation, it wasn't the company with the account requiring auth that issued the 2FA token, but rather a separate 2FA issuer. The client would then get their card _bound_ to each account they wanted to use it to authenticate. The card had a signing key, and the services just needed its matching public key.

With "real" 2FA impls like this, you aren't supposed to need N 2FA tokens that you would need to reset separately with each rinky-dink authable service, but rather just one 2FA token, with token rollover—and the security around it—handled by the issuer. Use better 2FA.

</comment><comment><USER23> I've been pondering a trusted network using shamir secret sharing for this case - where you can rely on other parties to hold the secret key and call on them. For example, origin player loses 2FA to system A, origin player calls out to their immediate backup personnel (origin player sets limit of how many are required to recover secret). Each backup personnel can say OK - <USER2> partial to system A, once enough have been sent the secret is recovered. Complex, and time in-detriment, and still prone to failure or breach of trust.

</comment><comment><USER24> This problem has me considering that TOTP/2FA is inherently less secure than password only. If you're using a password manager and that site has a unique password, you're almost certainly secure as long as the login process has rate limiting against brute force.

Once you add in 2FA/TOTP, you're looking at the rate of resets skyrocketing as well as social engineering getting much easier because it's so plausible and frequent that code generators are lost.

* SMS reset is so bad it's comical. Hackers went from having to crack billions of possibilities to having to catch a six-digit number sent not even to my phone, but to my phone number. I've spent a lot of effort getting my number out of services who demand it as a reset option when I turn on 2FA. If you're using it as single-factor reset, I'm much safer with 2FA off.

* Email reset makes TOTP and passwords pointless. Just get access to the email and it's as if neither of those ever existed. No reason to even have passwords. Use magic links like Medium does for login. It's the same thing as a password reset with one less thing to remember.

* Documents like passport or license mean instead of cracking a password with 40+ bits of entropy, all I need is the person's real name and Photoshop and some motivation.

* Personal information like last 4 of credit card, birthdate, SSN turn those publicly available bits into passwords themselves which are also far easier to get ahold of than any password.

<comment><USER25> If the reset process allows for _both_ the 2FA and the password to be reset using a single one of the four points you've mentioned then, yes, it's a terrible design that should be scrapped immediately.

However, if any of the four points you've mentioned allow for only resetting the 2FA option and still require possession of the password, then I think you're more secure with 2FA enabled. Why? Because the reset step, if nothing else, provides an additional hurdle to be crossed. Yes, SMS 2FA is terrible and anyone who uses it should be barred from owning anything more complicated than a light switch, but that doesn't discount all of the other, better methods.

Even e-mail as a reset factor can be more secure if the e-mail account is secured. In my experience, people are more willing to put up with "hassle" to secure their e-mail because it has stuff they care about in there. It's been far easier for me to get people I know to enable app-based or (shockingly) even physical device 2FA with a Yubikey on their e-mail accounts. I even know two older, non-technical people who already had it enabled because "I read that it's better for e-mail so I turned it on and put that printout it made me do in the safe."

So 2FA seems to me like it can be more secure as long as it is really _2_ factor auth and not "oh enter this other code...or also just use your phone to reset all access methods" (like some banks do, damn it).

</comment></comment><comment><USER26> aliexpress has a good hat-trick for it. If you're resetting your password, or authentication, then all stored credit card data is wiped from your account.

<comment><USER27> That's brilliant. You could even hide other data (shipping addresses, purchase history, etc.) until valid payment information is re-entered, or until the next successful purchase.

<comment><USER28> To generalize the idea: as long as anyone can create a new account, then the value of a new account is zero. The value of the lost account is the value of the differences between it and a new account. The recovery cost should be directly proportional to the value of the account. Aliexpress turns this formula on its head, starting the recovery operation by taking a high-value account and turning it into a low-value one, then presumably using a correspondingly low-cost recovery method.

There is an issue of not needing credentials to delete payment data as a kind of DOS attack.

Your idea is smart as well: it turns the high-value component of the account into a credential of its own.

</comment></comment></comment><comment><USER29> You're running up against the issue of identity management. The schiboleth sso technology of colleges and research institutions solved this by letting institutions manage accounts. To reset your login, go to you it department with photo ID and request a reset.

Obviously not very _convenient_. But one approach is to simply let a third party, like Google, do the identity management. Have only third party sso login, and don't do any identity management - only authorization.

I'm not aware of any frictionless, convenient and secure method. That was the reasoning behind Mozilla's web auth/sso project (I forget the name); access to email equals access to account recovery - so why not just allow proof of email account access be proof of identity?

<comment><USER30> I believe Persona is the project you are thinking of: [https://en.wikipedia.org/wiki/Mozilla_Persona](https://en.wikipedia.org/wiki/Mozilla_Persona)

<comment><USER29> Yes, thank you.

</comment></comment></comment><comment><USER31> Honestly, I'd be a liar if I said that I knew. PaulAJ might have the best idea that I've read - force people to test the recovery option. Though sadly, I've never had much luck convincing really smart people to test that mission critical things like backups work, so my inner marketer fears what that kind of friction will do to user retention rates.

For me, the central problem always comes down to mobile providers. I've managed to make some really serious changes to my mobile account without a hint of authentication. And, I would switch providers, but frankly, I've had that experience with every provider I have ever tried. When the secondary device itself is a major attack vector under every reasonable threat model, it makes the whole exercise seem like playing chess when your enemy is conducting full scale war games.

The right answer might be a mixture of manual review, sending challenges to the original device and conducting some profiling based on user agent, location and networks used to connect to the service. However, it's also entirely possible (and even likely) that our current means of authentication are fully hacked, completely fucked and due for a complete replacement.

<comment><USER32> > force people to test the recovery option

login.gov at least makes you prove you copied the 2fa backup number... at least on the next screen. So far that's the best I've seen.

After dealing with the shitshow that is the treasury's login, I was pleasantly surprised that login.gov appears to be pretty good. I was literally feeling sick to my stomach when creating a login.gov account in anticipation of more crap, but nope turns out it's fine :)

</comment></comment><comment><USER33> For valuable accounts, it may make sense to require physical contact in any "I've lost all credentials" scenario.

While there's still a balance between convenience and security, this is an effective deterrent, as it generally requires the attackers to risk being identified (and makes it hard for non-local attackers who may rely on effective immunity from prosecution because their local gov't won't care), so the attackers will pick another target.

Depending on what's possible, things like requiring them to actually visit you with an ID (some financial institutions do this), verifying identity and documents over a video chat (much harder to fake than photoshopping a single scan of ID, and in case of fraud, you'd have identifying info - video of face and voice of a fraudster or their associate), delivering new credentials by courier to the HQ of the company who's your customer, delivering new credentials by physical mail to the billing address, things like that - <USER3> that tie to the physical identity of the real customer instead of just their online accounts, or things that require a potential attacker to surrender part of their anonymity.

</comment><comment><USER34> How about a "Reset Buddy"?

During registration, a user adds a reset email that was different from the user's primary email. The email address is of someone you know who can give you the reset key when it is emailed to them.

With this approach, your designated reset buddy's email would have to be hacked as well then. So, even if you've been completely Pwn3d, your buddy hasn't.

<comment><USER35> That is good approach for all invite-only and referal-based services.

</comment></comment><comment><USER36> Just don't let them proceed without generating and inputting a code. Why are you just showing the QR code and hoping they save it?

<comment><USER37> Services like AWS do this. Requiring them to provide at least one (if not two) generated codes before proceeding ensures they have at least captured the 2FA code.

</comment></comment><comment><USER38> As of now there's not much you can do other than educating your users.

Maybe add a workflow that checks whether they have the backup code or not and if not prompt them to note it down again. Maybe on second login/usage after setting up 2FA. If they still don't do it just revert to email reset.

There isn't much you can do if the user isn't security conscious and doesn't intend to be.

Is it a particular demographic? I'd assume this is an issue faced by most of the apps with 2FA.

</comment><comment><USER39> What are you protecting? Financial data? If so, have them go to a branch office and prove their identity to a person.

Which is more important, retaining the person, or protecting their data? If retaining the person, then give them some simple and less secure method like a recovery email address. If protecting the data, I would leave them locked out of their account. Unpopular opinion, but I do that a lot it seems.

</comment><comment><USER40> If your app is team based, you could set it up so that admins of the team can reset people's 2FA device, similar to how AWS does it with IAM roles.

<comment><USER41> If their app is team based, they should be deferring 2FA to the IdP that that team should already have.

</comment></comment><comment><USER42> Look at the NIST defined identity assurance levels and the guidance for MFA issuance.

Trust isn't cheap. Credit based verification services are better than email. Adding verification via physical mail adds some value.

Fundamentally, you need to decide whether it's important to know that I am in control of the email address associated with "Spooky23", or that I am a particular human being.

</comment><comment><USER43> NearlyFreeSpeech has a pretty comprehensive guide for how they handle 2FA resets, it might be worth a look: [https://faq.nearlyfreespeech.net/section/login/losteverythin...](https://faq.nearlyfreespeech.net/section/login/losteverything#losteverything)

</comment><comment><USER44> Give them FIDO keys.

It's built on public/private crypto, so it's not like TOTP where the QR code is the plaintext private key that has to be distributed around like it's candy.

<comment><USER45> What happens when a user loses their FIDO key?

<comment><USER46> They use their backup key.

<comment><USER10> And if there is a flood that destroys that too?

</comment></comment></comment></comment><comment><USER47> Don't use email or SMS as it weakens the security to that of their email or - yuck - phone company customer service.

Manual review with proof of ID is the only way. Anything else will just have people not following instructions and requesting manual review anyway.

If anybody asks for higher security you can add a profile option to disallow manual review for their account. This should be visible on the settings screen but I would suggest making them write a request to turn it on. This can then open into a conversation about security if you are interested. And prevents people who don't understand it from turning it on to "increase security".

</comment><comment><USER48> Account recovery is the #1 problem with any authentication system. Facebook's optional trusted contacts is probably the most scalable, secure version I have seen.

</comment><comment><USER49> social. 3 out of 7 pre nominated contacts.

you have to do some diligence to ensure the contacts aren't all the same person, decide if they (or some minimum) have to also be 2FA, prompt the user from time to time to confirm the list, etc.

ps. this is called the recovery problem and is indeed the hardest part of 2fa. if you can punt entirely, eg like github, you can save yourself 95% of the grief of supporting 2FA</comment>


Howard on Curry-Howard - <AUTHOR> http://wadler.blogspot.com/2014/08/howard-on-curry-howard.html <comment><USER2> Wow. The essay they keep referring to throughout the exchange --Wadler's "Proposition and Types" [1]-- is hands down _the best_ exposition of the Curry-Howard correspondence I've seen so far: deep but thoroughly readable (Howard wasn't just being nice!).

Even if you already know this stuff, I seriously recommend reading it (this one, or any of his other expository writings on this topic [2]). His perspective is formidable.

[1] [http://homepages.inf.ed.ac.uk/wadler/papers/propositions- as-...](http://homepages.inf.ed.ac.uk/wadler/papers/propositions-as- types/propositions-as-types.pdf)

[2] [http://homepages.inf.ed.ac.uk/wadler/topics/history.html](http://homepages.inf.ed.ac.uk/wadler/topics/history.html)

<comment><USER3> SPJ is a _fantastic_ author. All of his papers are recommended unilaterally.

<comment><USER4> True but the paper is by Wadler

<comment><USER5> which is also a fantastic author anyway :)

</comment></comment></comment></comment><comment><USER6> William Howard is an emeritus professor at my university. He is quite old but he still attends the Friday department tea and appears to actively discuss mathematics. I have yet to build up the courage to talk to him, and I wonder whether he knows just how widely his work is discussed, even if it's usualy just at a high level.

<comment><USER7> You should talk to him. When you get down to it, people are just people. S peach comes naturally.

<comment><USER6> I have wanted to, but often he looks to be having such lively or focused conversations with people that I can't bring myself to interrupt them.</comment></comment></comment>


Obscure HTML tags that you should know and even use - <AUTHOR> http://www.instantfundas.com/2009/02/5-obscure-html-tags-that-you-should.html

<comment><USER2> They need to add 'label' to that list. It's not really obscure, but not enough people use it; not even the big sites (ahem, eBay.) It adds a good amount to the usability to the page, in my opinion.

('label' associates another block of text/html with an input field. So if something says: Name: |_________|, and Name is wrapped in the label tag, clicking on Name is enough to give the textbox focus)

<comment><USER3> Yeah, label is great.

You can associate a label with any element without having to nest the element in the label too; just use label's _for_ attribute with the element's ID. It's useful, for example, if you want the labels in one column and the form controls in another.

Make sure to have the label take the maximum available space; if you have a label centered in a table cell you want the label to span the whole cell so it's easier to click on it to select the associated control.

<comment><USER4> Once I started using  for all my forms, I became quite keenly aware of others' forms which don't use it. It's extremely convenient.

edit: <http://htmldog.com/> has great tutorials on modern and complete form building. It's a fantastic resource.

</comment></comment></comment><comment><USER5> flagged because it opened popups, i think it tried to install some software, froze firefox a few times, then gave me a popup asking me if I really wanted to leave

<comment><USER6> Flagged for the horrible JS that pops up when I want to close that tab and says "Are you sure?" Yes, I'm freakin sure.

<comment><USER7> I thought that was catchy somewhat, although quite weird.

</comment></comment></comment><comment><USER8> Firefox froze when this page loaded.

Default behavior for fieldset is different under IE, FF and Opera. IE rounds the corners where FF and OP do not. Not critical but if you're after the same look and feel it should be tested. Didn't try CSS with it.

</comment><comment><USER9> Interesting, especially the fieldset tag looks very useful, I didn't know about that one.

</comment><comment><USER3> Beware, wbr is not part of the HTML 4 standard (I'm not sure it's part of any standard). The other tags are standard.

<comment><USER10> _The <wbr> means word break and according to Peter-Paul Koch, it tells the browser that it may insert a line break here, if it wishes."_

If it wishes?! Because I'm always on the hunt for tags that will introduce more ambiguity in my layouts across browsers, I don't have enough yet. o_0

<comment><USER3> I think you don't understand the intent. It's to help you give hints to the rendering engine about where you'd prefer to have line breaks if there needs to be one nearby, so that you can tweak some of your text so it reads better.

I'd be surprised if it broke your layout on a browser (aside from the fact it's not a standardized tag).

<comment><USER10> Ah, I see, you're right. Actually taking the time to read more of the referred to page on quirksmode.org does make the intent of the tag clearer. The quote taken out of context in the article does make the tag sound like rather ridiculous though.

More from quirksmode.org:

 _I use it a lot in the great compatibility tables. These tables are very large and very tight, and I wish to avoid horizontal scrollbars, if possible. These scrollbars are mainly caused by the length of method or attribute names, for instance getElementsByTagName(). Therefore I do:

getElements<wbr>ByTagName()

I give the browser the option of adding a line break. This won't be necessary on very large resolutions, when the table has plenty of space. On smaller resolutions, however, such strategically placed line breaks keep the table from growing larger than the window, and thus causing horizontal scrollbars._

I still won't be using it. :)

</comment></comment></comment></comment><comment><USER11> It's not a real tag anymore, but <xmp> was really cool. Everything between the start and end tag was presented verbatim, with no HTML parsing. Basically a lazy man's HTML escape in a fixed width font--good for pasting in code. We use it every now and then for our internal tools since Firefox is down with xmp.

<http://www.blooberry.com/indexdot/html/tagpages/x/xmp.htm>

<comment><USER12> How is this different from a
 tag?

<comment><USER13> Markup is still parsed inside a
 tag. <xmp> is more like CDATA.

</comment></comment></comment><comment><USER14> How about the <optgroup> tag: <http://www.w3schools.com/tags/tag_optgroup.asp>

</comment><comment><USER15> I couldn't open the page at all due to virus warnings.</comment>


The US students who want to pay slavery descendants - <AUTHOR> https://www.bbc.com/news/world-us-canada-47886292 <comment><USER2> In 2019, the platform and precedent of paying reparations sounds like it's going to be a disaster. There's just too many instances to account for to prevent good intentions from turning into public chaos (especially with social media).

For example, there are:

\- Non-black people that have DNA relations to slaves

\- Uncertain and anecdotal family histories

\- No easy records of verification

\- People of other races that were enslaved at some point in the US

Further, at what point do the reparations end, once the door is opened? Do Native Americans get reparations for having their land taken and tribes killed? What about Japanese that were subjected to internment camps in WWII? Or Mexican bracero farm workers in the 1930s? What about foreign nationals that worked in banana republic for US companies like United Fruit?

The main thing is once money is thrown into the equation, everyone is going to come looking for their share to benefit from it.</comment>