How to Avoid Leaving Tracks Around the Internet - <AUTHOR> https://www.nytimes.com/2019/10/04/smarter-living/10-tips-internet-privacy-crowdwise.html <comment><USER2> > If you're in that category, Ms. Winterton recommended Ghostery, a free plug- > in for most web browsers that "blocks the trackers and lists them by > category," she wrote.

I'm not sure I can recommend Ghostery, as their business model is a bit suspicious: [https://en.wikipedia.org/wiki/Ghostery#Criticism](https://en.wikipedia.org/wiki/Ghostery#Criticism)

> Using websites whose addresses begin with https are also safe; they, too, > encrypt their data before it's sent to your browser (and vice versa).

Safe from your public Wi-Fi operator. Not from the company with a tracking script on the page.

> You don't sign into Apple Maps or Safari (Apple's web browser)

You sign into the OS, though.

> You never want to tell Facebook where you were born and your date of birth. > That's 98 percent of someone stealing your identity!

I can literally Google this information. We need to stop treating knowledge of public data like this as some sort of identity metric.

<comment><USER3> I would suggest Privacy Badger nowadays (as a complement to the irreplaceable uBlock origin).

<comment><USER4> Does Privacy Badger do something that uBlock Origin does not?

<comment><USER5> They have different purposes. Privacy Badger is not there to block all ads; it exists to block _trackers_.

For websites I like, I turn off uBlock Origin but leave Privacy Badger enabled.

<comment><USER6> Have you been able to compare that with latest Firefox's native tracker blocker?

So far to me that's been pretty good to the point I stopped using Privacy Badger (which I agree is pretty good too!).

</comment></comment></comment></comment></comment><comment><USER7> The omission of "Disable third party cookies" is fairly shocking. From my understanding, it might be the single most effective thing you can reduce tracking. Whenever I get the chance, I recommend the following pieces of Internet hygiene to anyone and everyone I can:

* Disable 3rd party cookies

* uBlock Origin

* Privacy Badger

* HTTPS Everywhere

These things are all dead simple and will significantly reduce your trackability. Of course they are far from comprehensive or perfect, but it's the Internet equivalent of washing your hands after you go to the bathroom.

<comment><USER8> Won't disabling third-party cookies render certain payment gateways unusable? While such advice may be very welcome among savvy computer users who know when they should temporarily turn third-party cookies back on, the NYT is unlikely to give advice that will break online shopping for large numbers of people.

<comment><USER7> I've had 3p cookies disabled for years and never experienced an issue with payments. But, it may be that I don't pay for things as often as others. My recommendations will slightly break some things like embedded Twitter posts but it's rare that I experience a site being functionally impacted in ways I care about.

</comment></comment></comment><comment><AUTHOR> -Use a private cloud, so that your data is in your control.

We've actually developed a self-hosted private cloud solution as a substitute to Dropbox for exactly these reasons. Basically a private Dropbox at home (no complicated installation and no server needed)

We're currently in beta, could interest a few in this thread! [https://www.duple.io/en/](https://www.duple.io/en/)

The point is to have a product that works just like a Dropbox, as simple and straightforward, but that is actually private with no one interfering, playing, accessing or reading your data.

<comment><USER9> Somehow I don't understand how you say Syncthing's disadvantage in comparison is that it's a P2P system[1], but at the same time your website says duple doesn't need a server.

Maybe I've misunderstood, but this sounds just like Syncthing with an always- on client - except for the file versioning, that sounds like an interesting feature to me.

[1] [https://blog.duple.io/what-is-the-point-of- duple/](https://blog.duple.io/what-is-the-point-of-duple/)

<comment><USER10> Agreed.

I've been using SyncThing for over 4 years and while it has a few rough edges (synced/shared/global file ignore would be great) still it's been fully reliable and a generally great user experience. So if you're trying to cater to existing SyncThing users don't mince words to make it appear that something which you claim is a negative with SyncThing doesn't exist in your product - which it clearly does.

SyncThing has a huge advantage: years of trust. They have been around since 2013 and continue to crank out features and builds consistently. Duple hasn't been around for _one_ year at the time of this writing. Beyond that it's clear from the Duple site that it's main goal is to take my data and file replication hostage via licensing fees. I'm curious how or why I'd donate before I've even installed the Beta (based on your click flow to even reach the downloads page)? No thanks.

Also, let's clarify something Duple has wrong...

Duple states: "Syncthing is P2P, so you get the disadvantages along with it e.g. all your devices need to be turned on at the same time. If not, you get a desynchronisation between your devices and create conflict." \- This is wrong. You _do not_ need all your devices on at the same time with SyncThing. Yes, it is true that it's good to have a device with a consistent state, however it's not required. The second part of the statement is FUD. When conflicts happen it's generally around odd permissions or file updates with regard to versioning. This was more problematic in versions prior to 1.0. At this point in time I haven't run into this issue other than because of disparate problems caused by file permissions which SyncThing does a great job preserving.

Duple also states SyncThing has no IOS support and yet, itself, has neither IOS or Android. Or Windows... Or an open source repo of what I'm supposedly using.

In my mind Duple doesn't compete with SyncThing and, really, never will. But here's the thing... Don't pretend to compete where you don't. SyncThing users aren't looking for Duple. You'd do yourself a better service to take that verbiage out because all it did for me was give me the impression that Duple is lying about competitors that they simply didn't take the time to understand. That leaves a bad impression in my mind.

<comment><USER11> I'm sure what they mean by all devices needing to be on and connected, is that if only one device is connected, there will be nothing to sync to. So if I take some photos while on vacation, but my desktop at home is asleep, then I can't sync my photos to it. So if I lose my phone before then, I'm sunk.

Of course this is fixed by simply having the desktop on all the time, which would then make it similar to a client server setup.

<comment><USER10> Well, they don't say that so it doesn't really matter what they mean. And they imply that by not having a device on all the time it is the cause for synchronization issues which is completely incorrect.

If I take photos on vacation and throw them in a sync'd folder the next time both devices are online they will resolve the new file delta between that shared folder. That doesn't imply I _always_ need one or the other device online. The more devices syncing the less likely it is that only one would be online at a time, but again there's no requirement there for an always on device.

Anyway... SyncThing is fantastic for users who are willing to invest some time learning how the software works. Every paid for product seems to cater to the "it just works" mentality thereby sacrificing control to me, the user, to handle situations that can't be handled by overly simplified, cloud-first, lock the user into our licensing model solutions. And don't get me wrong, those are fine for many people. For users who want more control via more responsibility - then SyncThing is great. But I don't like how they are spreading FUD about it just to get some name association.

</comment></comment></comment></comment></comment><comment><USER12> OK, it's not horrible advice.

But there's no mention of Tor, which is arguably the best available way to "avoid leaving tracks around the Internet". And better yet, using Whonix, which prevents leaks around Tor.

Using multiple email addresses is good. But if you're sloppy about browser hardening, they'll all get linked.

More generally, there's compartmentalization. Not just multiple email addresses, but multiple VMs, connecting through different VPNs, and/or Tor instances. Modern machines can run several Linux VMs, and switching among them is as easy as switching among app windows.

So basically you can present online as many different personas. Even if everything that each persona does gets linked, it won't get linked to other personas. If you're careful, anyway.

<comment><USER13> > More generally, there's compartmentalization. Not just multiple email > addresses, but multiple VMs, connecting through different VPNs, and/or Tor > instances. Modern machines can run several Linux VMs, and switching among > them is as easy as switching among app windows.

Shout out to [https://www.qubes-os.org/](https://www.qubes-os.org/) Qubes OS, an Open Source research implementation of this concept on the OS level. BYO OPSEC.

<comment><USER12> Yeah, love Qubes too.

The learning curve for that is steeper than for VirtualBox, however. As is, with absolutely no doubt, the security level. In that it uses a hardened version of the Xen hypervisor. That also means tighter hardware requirements, however.

<comment><USER13> I agree fully. I would be really interested in generalizing their security model amongst more (probably inadequate) hardware. We can dream :)

<comment><USER12> Some years ago, after reading beta-level posts about Qubes, I implemented as best I could in VirtualBox. I used pfSense VMs as VPN gateways, and Linux VMs for workspace.

While I was at it, I used multiple pfSense VMs to create nested VPN chains. Sort of like Tor circuits, but static (so much less anonymous) but also much faster.

Then Whonix came along. And it works very well with nested VPN chains.

</comment></comment></comment></comment></comment><comment><USER14> Oh the irony. Reading this article requires me to give away my e-mail address...

<comment><USER15> Or click the "Reader Mode" in Firefox? (YMMV).

<comment><USER12> Yes, if you do it fast enough, before the paywall loads.

</comment></comment></comment><comment><USER16> Install uMatrix and block all 3rd party JavaScript. It breaks functionality in some sites that embed social networks' widgets, but other than that works like a charm. As a bonus sites load at least 30% faster.

<comment><USER17> Exactly my experience, going on 3 to 4 years now. Spend the time to learn uMatrix. It's an incredible investment into yourself and your web experience. I barely browse on mobile anymore since I don't have uMatrix, although Brave does allow blocking scripts and some stuff quite easily. Highly recommend Brave on mobile.

<comment><USER18> I have Firefox and uMatrix on mobile. It is not a s seamless as desktop but bearable.

<comment><USER17> Nice, thanks for the tip! I'll have to give it a try

</comment></comment></comment></comment><comment><USER19> > Apple's privacy website reveals many examples: You don't sign into Apple > Maps or Safari (Apple's web browser), so your searches and trips aren't > linked to you.

Not linked... in a way visible to you.

</comment><comment><USER20> > Avoid unnecessary web tracking

Google is just one of 100+ ad networks that show you personalized ads. You can turn off ads personalization from Google or any of the other participating ad networks here at [http://optout.aboutads.info/](http://optout.aboutads.info/)

Source: [https://adssettings.google.com](https://adssettings.google.com)

<comment><USER21> Just because they no longer show you personalised ads doesn't mean they have stopped tracking you...

<comment><USER22> In fact I'd argue it means they have to track you. And telling them your preference gives them another data point on you.

</comment></comment></comment><comment><USER23> Step 1 - do not create a free account or logging to read The Times

</comment><comment><USER24> > Nearby patrons, using their phones or laptops, can easily see everything > you're sending or receiving — email and website contents, for example — > using free "sniffer" programs.

Is the author assuming the absence of https encryption here, or is there some widely available exploit I don't know about?

<comment><USER25> mitm for weak https exists

All "antiviruses" use it

</comment></comment><comment><USER26> [https://archive.is/QiBdd](https://archive.is/QiBdd)

<comment><USER14> Thanks for the effort, but this link does not work. The host is not responding.

Edit: sorry, my bad, cloudflare 188.8.131.52 resolves it as 127.0.0.5. Someone ought to check that out...

Edit2: apparently this is a deep rabbit hole: [https://community.cloudflare.com/t/archive-is- error-1001/182...](https://community.cloudflare.com/t/archive-is- error-1001/18227/10)

</comment></comment><comment><USER27> What about fingerprinting? Fingerprinting allows to track browser even in private mode or if you anonymize your IP address. You should disable WebGL right now because it is absolutely unnecessary, almost never used and its only purpose is to collect information about your video card.

</comment><comment><USER28> I had to clear my NY Times cookies to read the article. The irony.

</comment><comment><USER29> > A few more suggestions:

> "Create a different email address for every service you use," wrote Matt > McHenry. "Then you can tell which one has shared your info, and create > filters to silence them if necessary."

Obligatory mention - for gmail you can suffix your email address with a service name by using +, e.g., email@example.com will be delivered to email@example.com. So if a service leaks your data or sells your email, you'll know who to blame.

Although the article recommends not to use gmail, it's a neat trick if you're stuck with it.

"Forget password" becomes unusable though, since you'll probably forget what suffix you used for each service.

<comment><USER30> Oh companies have become smarter about it! Even the scammers I suspect! Many won't accept + in the email address and I think now it's well known enough that most scammers will run a regex to detect and remove the + sign.

Useful workaround is to have unique aliases on a domain name you control. Can't get around that with a minute of work!

<comment><USER31> fastmail supports a variation of this: if my email is firstname.lastname@example.com, then I can use email@example.com, or better firstname.lastname@example.com (or firstname.lastname@example.com). It seems like it'd be a little less obvious to scammers.

<comment><USER32> With fastmail you can just make a alias. My address is firstname.lastname@example.com and in the settings you can make a alias where you can just use something like firstname.lastname@example.com

[https://i.imgur.com/UWoU4NA.png](https://i.imgur.com/UWoU4NA.png)

<comment><USER33> Fastmail also lets you use wildcards and catchall addresses, giving you infinite email addresses whenever you need them, with no way to tell what "base address" they resolve to internally.

For example, my Twitter address might be email@example.com, my Google address firstname.lastname@example.com and so on. All of those go straight to my inbox unless I decide to set up individual filters for them.

The downside is that I can't easily migrate to a service that doesn't support this.

</comment></comment></comment></comment></comment><comment><USER34> An article about how to not leave tracks on the internet, requires me to sign up to read the said article, magnificent.

</comment><comment><USER35> CVS receipt coupons are based upon previous purchases + like 15% randomization in related categories (or maybe just random promotions they have going).

My CVS coupons are nearly always for an antacid, nicotine cessation, or allergy medicine - then I usually get a few extra coupons for something that surprises me like beauty products or facial cleanser.

There's nothing Google involved with the CVS coupons, I'd bet money on that.

</comment><comment><USER36> I don't know how one would know short of a leak if Facebook's track_ip_addresses.php, but is there any sense of how IPv6 is being aggregated by trackers to track identity?

We have a /48 at home using IPv6 privacy extensions for the full address but that isn't a useful component of a strategy if I'm being identified by the /48 rather than the full 128-bit address.

</comment><comment><USER37> they forgot the best tip nowadays which is:

* declare you are from EU even if you are not

then any provider is damned scared of messing with your privacy

</comment><comment><USER38> Unreadable . Does it mention E2E? It's way past time for tech to get serious about E2E , ignoring warnings and pleas from greedy governments. People have a right to communicate without being constantly surveilled, and it's the most serious track they leave.

</comment><comment><USER39> I find this:

> Log in or create a free New York Times account to continue reading in > private mode."

quite ironic :)

</comment><comment><USER40> For a public cloud replacement, try [https://ba.net/privatecloudoffice](https://ba.net/privatecloudoffice)

</comment><comment><USER41> I'm not familiar with a survey of how many know these things (and the good suggestions made here).

My suspicion is that few know, and fewer are doing it.

An important goal? Help those who care enough become aware enough to take action.

</comment><comment><USER26> [https://www.torproject.org/download/](https://www.torproject.org/download/) is the best

</comment><comment><USER25> That what looks like when someone gives advises when know nothing about industry and tech

And that is not even funny

</comment><comment><USER42> No mention of using encrypted DNS. Or did I miss it?

</comment><comment><USER43> well, we can't blame it on their head of cyber security.

<comment><USER44> Can you expand on this?

<comment><USER43> NY times recently fired/made redundant their head of cyber security [https://news.ycombinator.com/item?id=21329453](https://news.ycombinator.com/item?id=21329453)

</comment></comment></comment><comment><USER45> Is this the level of technical competency needed to work at the New York Times? How much do they pay?

<comment><USER46> if you look up some info on this writer, I think you'll find competency was not considered

<comment><USER2> Hey now, there's no need to attack the author like this.

<comment><USER47> "Safari's "don't track me" features are turned on as the factory setting."

<comment><USER2> I'm not sure where you're going with that comment.

</comment></comment></comment></comment></comment><comment><USER48> I think there are different categories of "tracks". One category is marketing tracks, which include cookies, browser profiling, tracking scripts, etc. This is the one most discussion on HN is aimed at and most people find personally offensive but aren't materially harmed by. The second is legal tracks, which is exposure to harm from legal authorities for activities such as piracy, political activism, and various types of forbidden speech under different legal/national regimes. The third type is personal tracks, which I categorize as the ability for private individuals or groups to connect your online presence to your real self. That is the one I'm most concerned with, as internet users seem almost entirely unconcerned about it but it has far more potential to harm you than Google knowing your sexual fetishes. Nobody cares that they're exposing their real name and face to millions of people and it only takes one lunatic who decides your activities or opinions are worth trying to ruin your life to cause you a world of hurt.</comment>


Global Trends 2025: the end of US dominance? - <AUTHOR> http://www.guardian.co.uk/world/2008/nov/20/barack-obama-president-intelligence-agency

<comment><AUTHOR> _"... We prepared Global Trends 2025: A Transformed World to stimulate strategic thinking about the future by identifying key trends, the factors that drive them, where they seem to be headed, and how they might interact. It uses scenarios to illustrate some of the many ways in which the drivers examined in the study (e.g., globalization, demography, the rise of new powers, the decay of international institutions, climate change, and the geopolitics of energy) may interact to generate challenges and opportunities for future decisionmakers. The study as a whole is more a description of the factors likely to shape events than a prediction of what will actually happen ..."_

The original document can be viewed here pdf, 5.7Mb ~ [http://image.guardian.co.uk/sys- files/Guardian/documents/200...](http://image.guardian.co.uk/sys- files/Guardian/documents/2008/11/20/GlobalTrends2025_FINAL.pdf)</comment>


Show HN: I wrote a Makefile to set up personal SMTP server with Exim 4 on Debian - <AUTHOR> https://github.com/susam/susam.in/blob/master/mta/Makefile <comment><USER2> Wow. I've heard people complain that I write too bash scripts when I should be writing python scripts (eng student). Can't wait till I show them this!

On a more serious note, I do like the idea of not building a argument parser / switch case in bash and using a makefile instead. Makes things neater somehow (especially with flags).

And the best part of it is that it's also an installation script! So gonna try to make my Linux installation script a single makefile now.</comment>


Steve Jobs' Video Dreams - <AUTHOR> http://www.businessweek.com/magazine/content/08_03/b4067029127747.htm

<comment><USER2> Yet anooother Apple PR. The MacWorld is near.

<comment><AUTHOR> I agree Apple PR does a good job, but not sure how much of a PR job this one is, I mean there are def some negative points made about apple and what it could do in the article...</comment></comment>


Carol Dweck Revisits the 'Growth Mindset' - <AUTHOR> http://www.edweek.org/ew/articles/2015/09/23/carol-dweck-revisits-the-growth-mindset.html <comment><USER2> That infographic at the end reeks of bullshit. I'm not completely certain, but I think it's similar to how comparisons of whatever new project methodology to the "waterfall model" reek.

.

I thought the optimal state for learning was supposed to be "flow", where things are interesting and a bit challenging but not so hard that you're banging your head against the wall?

.

I am not a people person. This doesn't mean I _can 't_ interact with people, or get better at interacting with people, but it does mean that it takes significantly more effort vs things I'm naturally better at / more interested in. This also doesn't mean I'm not good at interacting with people.

.

The article makes it sound like she completely skipped publishing in a journal, and went straight to her popular-audience book. This can't be accurate, this series of posts[1] starts by arguing that her paper doesn't show what it claims to show.

[1] [http://slatestarcodex.com/2015/05/07/growth- mindset-4-growth...](http://slatestarcodex.com/2015/05/07/growth- mindset-4-growth-of-office/)

</comment><comment><USER3> If anyone is interested, she's speaking tonight (10/4) in Palo Alto at the Oshman Jewish Community Center.

[http://patch.com/california/paloalto/carol-dweck-speak- palo-...](http://patch.com/california/paloalto/carol-dweck-speak-palo-alto- oct-4)

</comment><comment><USER4> Interesting points, in particular one about "false growth mindsets": A person has a fixed mindset about their capability to have a growth mindset, ie. they feel inadequate for having a fixed mindset, and know that having a growth mindset is good, and are worried about their own ability to have a growth mindset, and so say they have a growth mindset to avoid feeling like they aren't worthy (which is a sign of having a fixed mindset in an area).

</comment><comment><USER5> Worst is the whole country's cultures who really believe that each person can only be great at one single thing. Being great at multiple things? Impossible, right?

<comment><USER6> I don't I think I know a single person that thinks a person can only be great at a single thing. Or that _everyone_ is even great at anything.

I don't who these people are, but they're certainly not in Dweck's article.

<comment><USER5> It's a region-level culture I'm talking about. In this case, I was thinking of Eastern Europe culture.

You're in for a MASSIVE culture shock, if you ever get employed there. For this, and many other reasons. The cultural expectations in business are often the far opposite of that of the US.

Don't forget that individuals and group culture are two distinct things, but both are very real things. Let's be clear about which one of those we're talking about.

<comment><USER6> I'm a high school teacher in a public school in Austin, TX. I plan to teach at that school until I retire and write and sell books along the way.

If I ever find myself employed in Eastern Europe then something dramatic will have happened.

The difference in culture is interesting, though, since I don't have to live/work there!</comment></comment></comment></comment>


How to Catch a Cheater - <AUTHOR> http://nerdlife.net/how-to-catch-a-cheater/ <comment><USER2> During my Freshman year of college (2002), I was taking Econ 101. It was a class of probably 500 students, and our tests were multiple choice. By the time I got back to my dorm room, the answers to the test were always up on the course website (I'm not sure when they actually were posted).

After the first two tests, the professor must have noticed that something wasn't right. I finished the third test quickly, and was pretty confident that I had done extremely well. We used scantron sheets for our answers, so we got to take the paper with the questions home after the test. I had marked all of my answers on both sheets, so I loaded the course website and started checking my answers.

My heart sank as I went through the answers. Somehow I had managed to get every single question wrong. I figured that there must have been something wrong with the answers, and when I matched the answers (not the letters), I realized that I had actually gotten every question right.

The prof swapped the letters, so the kids whose friends were texting them the "answers" got screwed. It was pretty funny, even if it increased my blood pressure for a little bit.

<comment><USER3> For freshman year math courses, we wrote two versions of each test. They'd be nearly identical, but with a few of the numbers and variable names modified. We'd alternate passing them out so that people sitting next to each other had different tests. We'd also go around the room and write down who was sitting where. This made it really easy to catch the "look at your neighbor's paper" sort of cheating. (It's really hard to text answers to a calculus test, and taking a photo of your page would be _really_ conspicuous.)

Other departments had their own anti-cheating methods. Kids coming straight out of high school, who were used to less sophisticated cheat-detection methods, tended to get burned pretty bad their first semester.

</comment></comment><comment><USER4> > We were explicitly told that searching online for answers to homeworks was > forbidden.

I might be in the minority but I am of the opinion that if you are grading students on something that can be easily obtained through a google search you probably shouldn't be grading them on that.

<comment><USER5> I suspect you're actually in the majority. I bet that, rather, the minority position is that the instructor should create whatever conditions they want to so that they can exercise the students as they see fit - and that the students should extend enough respect to consider why those conditions are being created. This is my view.

Replace the teacher with a coach in a weightlifting class. One day he wants you to lift some freeweights, but he wants you to lift them in a particular way that does not use your legs. (Let's say he's having you do "military presses".) "Nonsense!" says the modern student, who already knows that it's best to lift heavy things with their legs. "Why shouldn't I be able to use this awesome resource (my legs) that's right here at my disposal!?"

Well maybe - just maybe - the coach wants to target your deltoids. Hmmm.

Enter Professor Luis von Ahn, who wants you to do homework without using google. Perhaps that is because he doesn't want you to target and improve your research abilities. It could be that, rather, he would like you to exercise and sculpt your ability to work problems from first principles. The professor may be aware that practice makes permanent, and homework is intended to get students to strengthen specific things, and that taking the easy way out robs the student of the intended benefit.

That's how I approach being a student, and so I grant that when sensei says wax-on, paint-uh-fence, and sand-uh-flo that he's got some idea of what I should be working on. But that's an old, old attitude that exists only in a handful of Hollywood movies these days. So that's why I'm betting you're actually in the majority.

By the way, the instructor here is an awesome guy. Anybody who hasn't heard of Luis von Ahn should do themselves a favor and watch his presentation on Human Computation:

<http://www.youtube.com/watch?v=dtFroEJN1nI>

<comment><USER6> Many math teachers ban calculators on math tests. I'm pretty sure this has majority support, not minority.

Google does simple math, so that's basically an equivalent issue.

IMO it's dumb -- in real life you have access to Google. But I mostly wanted to say I think there's clearly majority support for artificial grading conditions, since the no-calculators thing is so popular.

<comment><USER7> > IMO it's dumb -- in real life you have access to Google.

If one is taking a class merely to learn how to Google for the answers, then one should not be in a university. One should be in a trade school which only teaches you enough of your fields of study to be able to figure out the right terms to Google for.

When you take university classes, the goal is to learn to be the people that provide the solutions that the trade schoolers will Google for.

</comment></comment></comment></comment><comment><USER8> My AP (Advanced Placement) Chemistry teacher noticed some cheating on a major chemistry test we took. The cheating was pretty obvious; some kids just decided they were going to fail the test so they might as well have some fun. A week later, after a week of lecturing on a new section of the chemistry book and no mention of our scores, a student asked. No, he hadn't graded the tests. He was sorry, he had been really busy. After that, students started asking him every day if he had graded the tests.

Two weeks after we had taken the test, he said, "I have to come clean. The reason I have not graded your tests is that I lost them and have been trying to find them for the last two weeks. I'm very, very sorry, it was entirely my fault, and as a result" (he produced stack of paper from behind his back) "you all have to retake the test right now. Put your books away, take a test and two sheets of scratch paper, and start working."

We didn't have as many students sign up for the second semester of AP Chemistry. Not many people failed the first semester, and scores in AP classes were given a full letter grade boost compared to regular classes, but students knew he wasn't messing around. As a result, it was one of the best AP classes we had, and lots of kids got good scores on the AP test.

<comment><USER9> I wonder how many perfectly honest students did worse on the impromptu re-take two weeks later, with entirely new material on their minds.

<comment><USER10> Agreed it seems that it is always the honest students who gets the short end of the stick.

Thats a good thing though - it prepares the students for the real world.

<comment><USER11> How is doing this preparing the students for the real world (I'm being serious and not condescending or anything)? I don't see the real world being particularly more difficult than normal high school. Example - didn't file or pay taxes on time? No problemo - just take a penalty and finish up your work late.

<comment><USER10> Because it causes them to loose (hopefully) any idea that they get anything out of being honest, except shafted.

<comment><USER8> You've got it backwards: the students who studied honestly had much better retention after two weeks than the kids who wasted time trying to cheat or game the test. It was the teacher's intention to reward honest work by giving the hard-working kids a big advantage over the cheaters, and that's exactly what he accomplished. If only life was always so fair!

<comment><USER11> Your explanation is for a fantasy-land. Studying honestly in many AP classes comes down to cramming. Here's how Semiapies summed it up in a comment in this thread:

"In high school and particularly AP, those courses are blatant cycles of 1) cram, 2) test, and 3) forget all but the core of what that section was about.

(If you want to say, "You should learn it all for the final" keep in mind nobody does, nor are final exams built around remembering everything from the whole course.)"

\--

It's not like the crammers are even bad kids. A lot of them have no choice because if they didn't study that way they wouldn't have enough time to study and will end up getting worse grades.

This would mainly show people that the world screws you over and people who are part of crappy systems will go ahead and screw you over on top of the crappy system. I see little fairness in this situation.

<comment><USER8> Semiapies' description of AP classes is really bizarre and can only reflect a situation in which the teachers did not give a rat's ass about their students' AP scores. The nice thing about an AP class versus a non-AP class is that the AP test gives teachers an excuse to care whether their students are actually learning or not. Naturally that means the kids end up working a lot harder, but teachers who care at all about the scores at the end of the year (and mine did) will do everything they can to discourage cramming and other fake learning.

Kids who can't pass the class without cramming and who aren't going to retain the material shouldn't be in an AP class in the first place. They're going to run into a concrete wall at the end and waste their money (or the school's money) taking a test they aren't prepared for. Some students can handle it, and that's who the class is for. In my graduating class, there were maybe a dozen kids who got a 5 on at least one AP test, and I think there were two dozen who got a 3 on at least one AP test. That's out of a graduating class of a little over 300. (The entering class was over 400, so you can tell I didn't go to an especially good school.)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> That sounds terrible. If I saw something like that, I'd probably do the problem, then look up more information on it. I'd probably start with wikipedia but move onto google (well, ddg these days) if I didn't find anything.

The sort of policy that does not allow one to do basic research is pretty anti-academic if you ask me.

<comment><AUTHOR> The early homeworks in this class (Great Theoretical Ideas in Computer Science) were basically puzzles, where if you've seen the style of problem before you more or less knew the answer. The goal was to expose us to these types of problems and teach us how to think them through properly.

It was definitely one of the most fun courses I've taken.

<comment><USER13> That's one of those critical to include details. Otherwise the story makes the prof sound like a douche.

<comment><AUTHOR> Absolutely right, I updated the post.

</comment></comment></comment></comment><comment><USER9> This is a neat little sting, but looked at honestly, it's entrapment.

 _"Commonly referred to as The Glorblar Problem"_

That phrasing is a cue that the student is _expected_ to either look something up or to refer back to notes or memory of lectures or discussion of the Glorblar Problem in class. Why else mention it, if it were an honest homework problem?

We know they didn't hear about the Glorblar Problem in class - it doesn't exist. For the same reason, we know that hitting the books, either back at the dorms or in the library, wouldn't have turned up anything.

Remember that this is _homework_ , not a test. Yes, presumably the problem is doable without any reference material. The students don't necessarily know that, though. They do know that they've been _prodded_ in that question to at least check their thinking or work against external information....which isn't available to them through the channels they've been permitted to use.

So, the professor deliberately tempted people to look up something online, then amused himself by busting the people who did. Cute method, but it proves nothing other than "schmuck bait works".

<comment><USER14> "So, the professor deliberately tempted people to look up something online, then amused himself by busting the people who did. Cute method, but it proves nothing other than "schmuck bait works"."

The way I see it, the people that are actually doing their homework wouldn't even be tempted by it..because they are actually doing their homework.

"Remember that this is homework, not a test. Yes, presumably the problem is doable without any reference material. The students don't necessarily know that, though. They do know that they've been prodded in that question to at least check their thinking or work against external information....which isn't available to them through the channels they've been permitted to use."

Checking your work against the correct answer and Googling the answer (and just writing it down) are two different things.

<comment><USER9> Thank you - this is the most vapid thing I've seen today not written by a TSA official.

Especially:

 _"Checking your work against the correct answer and Googling the answer (and just writing it down) are two different things."_

And you can tell the difference based on a server log...exactly how?

<comment><USER14> "Thank you - this is the most vapid thing I've seen today not written by a TSA official."

Are you here all week? Do you always get this many laughs?

"And you can tell the difference based on a server log...exactly how?"

If you can't see that googling answers isn't cheating, I'm sorry.

</comment></comment></comment></comment><comment><USER15> I remember professors doing that kind of things when I was a student then declaring that students didn't studied well, didn't followed their rules, cheated, or anything else.

I don't think it help students to progress it any way. It just feel like you are fighting against a bureaucraty which has no rules, or which has rules that will only be revealed until it's too late. What they are creating is traps, and traps don't teach anything because they are random.

Please teachers, read Richard Feynman stuff, he had such a joy to teach his students and stop bullying your students.

</comment><comment><USER16> If the point of college is to learn rather than to simply get a degree, then after you do you work, you should check it, to see if you got it right, and if you failed, try again.

So, he doesn't want students to check their work, eh? After that first assignment, I'd cheat by every method I could possibly think of at every opportunity, because at this point, he has made it about grades, rather than about education.

The only time you can't go back and re-work and check the internet for help is during a test. You're SUPPOSED to look things up with homework, homework is for learning before a test. After all, the whole point of homework is to prepare yourself for a test, if you don't do the homework, if you just copy the answers, you won't be ready for the test. So what exactly is he achieving by not letting students get the maximum value out of homework?

</comment><comment><USER9> Here's a funny thought - what if someone did the assignment, put it away, then wondered, "Huh, so why is the Glorblar Problem notable?"

Dirty, dishonest intellectual curiosity - you have to _catch_ those people, right?

</comment><comment><USER17> You guys in US do it all the wrong way. I remember how examiners fought cheating when I was a student at Warsaw University, Poland (1990 - 1995). They simply allowed cheating. So, at the beginning of every exam an examiner announced something like: "Ladies and gentlemen. You are allowed to cheat. You can browse your books and notes, no questions asked. But I must warn you that exam tasks are designed such a way, that they require thinking - and thinking is not compatible with cheating, because thinking is fast and cheating is quite slow. So, you are allowed to cheat, but if you will it is very likely that you will not complete minimum number of tasks required to pass the exam. I wish you good luck."

</comment><comment><USER6> He should have put the wrong answer on the website. Anyone who just copies it will get a 0 for being wrong. Anyone who actually thinks about it and notices the difference shouldn't fail, imo, since that's appropriate, thoughtful use of the internet.

</comment><comment><USER18> Why not just put an incorrect solution online?

<comment><USER19> Agreed, that's what I thought the punchline would be. A sample solution that only works with the sample data provided. (something along the lines of x*y = x+y, with the sample data being (0,0) and (2,2))

</comment></comment><comment><USER20> The true lesson here is simple. If you're going to do something online you shouldn't, get behind a proxy(or 7).

</comment><comment><USER21> It seems this professor is more interested in entrapment and showing how smart he is rather than in his students learning (OK, maybe this was the lesson)

<comment><USER14> ..or catching cheaters. The students that cheated obviously don't care about learning or education, so why should he?

</comment></comment><comment><USER22> Wow - this seemed strangely familiar, until I realized I was in the class! What sucks is that a lot of people found the solution and showed it to other classmates, but only the 1 person who found it got into trouble. (No, I wasn't one of the students who found it).

</comment><comment><USER23> So he was going to subpoena their isps? Only the people who used lab computers needed to worry.

<comment><AUTHOR> If you're in CMU's network your computer is registered with them, so unless you live off-campus (which Freshmen aren't allowed to do) you can easily look up which student registered which machine (plus it's usually obvious from the hostname).

</comment></comment><comment><USER24> This seems to severely punish those who would even attempt to follow the rules. I've had instances where I can't find the answer to a problem and will spend hours hunting it down. If I had a professor give me a problem with that constraint, I'd probably scour a book for hours. What are you other options? Put "I don't know."?

Seems like this just forces everyone to the same result: those who break the rules will and save themselves time, those that try and follow the rules will probably break after hours, and end up googling anyways.

Maybe I'm missing something but this seems totally absurd.

</comment><comment><USER25> General cheating story:

My wife is a professor (ya that again:>). As an accounting professor they do a lot of their homework/projects in excel. Excel, of course, saves the information of the document creator in it's meta-data which is trivial to look-up. She'll routinely get 5 or 6 of the exact same file (with the same origination data) for the same project. Overall, she'll catch 10%-20% of her class cheating in a given semester without even really trying.

</comment><comment><USER26> It really bothers me when people cheat in engineering classes, or really anything where your competence (or lack of) could affect someone's wellbeing.

</comment><comment><USER27> I think some people are missing a few critical points of this exercise:

1) the homework was supposed to work out your thinking muscles. Getting the "right" answer wasn't the point of the assignment as much as trying to discover how to obtain an answer. (much better described in these comments by pohl)

2) On crying "entrapment": See Orpheus and Eurydice (<http://en.wikipedia.org/wiki/Orpheus#Death_of_Eurydice>). There were rules clearly put in place and whether they made sense or not, if broken carried with them penalties that the perpetrators were well aware of. If that doesn't smell like the "real world" I don't know what does. With that said...

3) Universities are NOT the real world. They barely resemble the real world. The point of university has never been to "prepare you for the real world."

<comment><USER9> As for 1, I think you're missing that a lot of people responded before the blogger updated the post (twice) in order to explain those points, including that he'd misremembered how the question was phrased.

As for 2, heaven forfend anyone apply ethics to the actions of those in authority.

As for 3, well, you've just cancelled out your second point.

</comment></comment><comment><USER28> My year the puzzle was called "Giramacristo's puzzle."

And Luis ended up telling everyone he was going to give them 0's and they'd take a huge hit in their grade, but he ended up not actually factoring that into the grades.

</comment><comment><USER29> run a proxy server company? this would be perfect material for a viral campaign.

<comment><USER30> I was actually wondering how he would get the access records for the school's PCs? It would seem that it would be a big bluff as most Sys Admins would give such records to a prof.

<comment><USER25> At least at the two schools I'm fairly familiar with, when investigating a cheating allegation those are routinely handed over.

</comment></comment></comment><comment><USER31> I guess the lesson is that real life is not at all the same as university life.

</comment><comment><USER32> Or you could just watch Lie To Me and learn to interpret microexpressions :)

<http://en.wikipedia.org/wiki/Microexpressions></comment>


Trump declares national emergency to build border wall - sahin-boydas https://nypost.com/2019/02/15/trump-declares-national-emergency-to-build-border-wall/ <comment><AUTHOR> The thing I find funny about some of the media narrative on this topic is the claim that ports of entry are the only places significant drug trafficking is occurring, it's almost 2000 miles of wilderness...

you know what's going on at entry ports because it's being monitored, you can't quantify what's going through in places you're not looking, more probably flows through hidden tunnels that are discovered all the time

there's no hyperbole in saying it's a threat and an emergency, seeing the effects of the drugs and crime, people getting raped/killed, human trafficking... it was an emergency decades ago when they could have done something to prevent it from getting to this point

<comment><USER2> "Emergency" comes from "emerge". Think "emergent threat". There is nothing emergent about this situation. Sure, drugs and our nation's handling of them is a serious problem, but "problem" is not at all the same thing as "emergency".

As a secondary consideration, I find it hard to believe that a fence or wall is going to help much. Some kind of DARPA-like competition-based inexpensive, well-considered electronic border monitoring might be helpful, but there are plenty of examples of people trivially bypassing fences and overpriced virtual walls.

(My personal favorite example of a virtual wall completely failing was at JFK Airport: [https://www.nbcnewyork.com/news/local/Security-Breach-JFK- Je...](https://www.nbcnewyork.com/news/local/Security-Breach-JFK-Jetski- Jamaica-Bay-Airline-165959376.html))

<comment><USER3> > There is nothing emergent about this situation.

That's a matter of perspective. If one party unilaterally decides to block the budgeting crisis, on a philosophical and political premise (albeit, the R's creating the situation to illustrate it), you end up with a situation where you cannot address an issue through political means, at any cost. This is a terrible precedent, but it's also logical for the tool at hand.

People have shotguns, which can blow through a window. I still lock my doors and close my windows. Walls work to a degree, for most situations intended to block access.

<comment><USER2> One party? Trump couldn't get his wall funded even when the Republicans controlled both houses.

<comment><USER3> Control is a misleading term. There is some control, but not enough for all actions and no solidarity (except among the opposition). Again, it's a matter of perspective, which seems lost on even those with all the information available.

</comment></comment></comment></comment></comment><comment> sahin-boydas [https://www.nytimes.com/2019/02/15/us/politics/national- emer...](https://www.nytimes.com/2019/02/15/us/politics/national-emergency- trump.html)

</comment><comment><USER4> Trump was elected on a platform with only a few big goals, and one of them was "Build the wall." This became something of a chant for his supporters. Now that Trump is president, shouldn't it be his duty to try very hard to make it a reality? Isn't that one of the most democratic things that he could do, to try and enact what he promised to the people that elected him, regardless of how good or bad an idea it is?

(note that this is not an opinion on wall proposals, which from my skimming seem like a colossal waste of money, or the procedural hijinks involved which seem like the bread and butter of American politics)

<comment><USER5> >Isn't that one of the most democratic things that he could do, to try and enact what he promised to the people that elected him, regardless of how good or bad an idea it is?

Trump has been _quoted_ as saying he didn't _need_ to declare a national emergency to fund the wall. He just did it because it was more expedient and he didn't want to have to deal with all that _democracy_ and the hassle of having to compromise over it. That's not democratic. If Obama had used emergency powers for such a petty reason, say to fund the ACA, there would already be blood in the streets.

Trump is president of the entire country, not just of the people who voted for him. I would hope, although I don't expect, that he could see the bigger picture.

<comment><USER6> Didn't Obama do this with the Flint water issue? That turned a local issue into a national one, likely to score points for the sitting president. I disagree with both usages of the "state of emergency", and I really wish presidents couldn't do it as easily as they can.

</comment></comment></comment><comment><USER7> I remember when Reagan signed legislation granting citizenship to millions of illegals. At the time the idea was that in exchange for doing this the border with Mexico would be tightened. Bush II had a decent proposal for addressing the large number of illegals in the country but his party shot down the proposal. Under Obama deportations greatly increased. This is an issue that has been going on for decades and one that resonates with a certain segment of the voting population.

I see no resolution as long as businesses profit off illegal labor with impunity. I've come to believe that few in power actually want to change things. Both major parties can flame the passions of their respective bases by keeping the status quo. If the prognostications of the effects of global warming are true then it is rational to want to fix the situation. Mass migrations are occurring and will get worse. The whole issue is a symptom of a broken political system in my opinion.

<comment><USER8> I find to hard to understand what the lefts actual position is on illegal immigration. I know they aren't a monolith but is the idea that immigration laws should still exist but not be enforced (or enforced lightly)? That seems to me to create a caste system where you have legal citizens and illegal citizens with defacto less rights.

If people want open borders, or something like it. My view is they should say so proudly and clearly. It's a defensible position even if I disagree. If the idea is we are going to continue to have a slave caste of illegal immigrants without many labor protections and fearful that their employer will call ICE on them if they don't work unpaid overtime, not only is that indefensible I'd be willing to go to war over it just like my ancestors did the last time we had a similar institution in America.

<comment><USER9> Definitely no monolithic opinion but my cohort (i.e. those I speak to regularly about this issue) believe there should be major reforms to vastly simplify legal immigration and enable a clear path to citizenship. You might call this open borders, but that implies a free-for-all. I personally think getting a work visa should be pretty easy, taxes paid by all, and employers should be severely punished for attempting to hire under the table.

I think you're right to say illegal immigration causes a caste system. I think that's artificially created by our strict immigration policies. We need more workers of all skill levels in the US. There are people who want to pursue a better life by moving here. Why get in the way?

<comment><USER8> That's perfectly reasonable and honestly I agree. If people coming here have the same rights and responsibilities I don't see the issue. The only thing I'd add is it may make sense to have a waiting period for certain welfare programs like the UK does, where you have to pay into the system for a little while before you are eligible in order to prevent people from coming for solely that purpose. Outside of that it seems such a plan would be popular, why isn't anyone framing it this way? Instead I see that we should #DefundICE[0], why is that better than reforming the laws that ICE is enforcing?

[0][https://www.newsmax.com/newsfront/aoc-ice-illegal- immigratio...](https://www.newsmax.com/newsfront/aoc-ice-illegal-immigration- aoc/2019/02/07/id/901772/)

<comment><USER10> I don't think Newsmax is the best source of news on this, you might as well have linked Breitbart.

As far as the defund ICE movement, it's just a small movement by a small set of people (namely AOC whom conservatives think is their modern red herring), lets not generalize and say all left leaning people want this when in reality they most likely don't, but you have to understand ICE has been abusing its power and it has also pushed to help create a massive private industry of private prisons housing "illegals" in which you could say should be defunded or more regulated since it's not properly handling people humanely nor are they helping the situation at hand.

<comment><USER8> >I don't think Newsmax is the best source of news on this, you might as well have linked Breitbart.

The cspan video in the link has her entire comments unedited for you to review if you doubt she made the statement. I wasn't able to find CNN or Buzzfeed's reporting on the matter I presume they chose to not cover it. I am citeing it for the quote not any of the editorial content, I'd cite the video directly but it's over half an hour long.

>As far as the defund ICE movement, it's just a small movement by a small set of people

This small set of people are extremely loud, if you have a more reasonable voice please use it. The DNC would be wise here to put forward their plan for immigration because as I see it today AOC and her supporters are driving the conversation from the left at least as far as public perception goes.

<comment><USER10> I haven't heard any of the DNC leaders pushing this agenda in any strong manner, also the only reason it might seem like it's loud is maybe due to the fact of conservative outlets pushing the narrative.

In regards to an Immigration plan the DNC has time and time again pushed for reforms and debate but nothing has been done not because they are not willing, primarily because the other party loves to lambaste any idea or reform immediately as "open borders" or "Amnesty" when it could be no further from the truth, this is nothing new for us, unfortunately it's just a political cycle at this point.

[https://en.wikipedia.org/wiki/Comprehensive_Immigration_Refo...](https://en.wikipedia.org/wiki/Comprehensive_Immigration_Reform_Act_of_2006)

[https://en.wikipedia.org/wiki/Immigration_reform_in_the_Unit...](https://en.wikipedia.org/wiki/Immigration_reform_in_the_United_States)

<comment><USER11>
      nothing has been done not because they are not willing, primarily because the other party

When the Democrats controlled the entire Federal government in 2009-10 (including filibuster-proof control of the Senate for parts of that term), they did _absolutely nothing_ toward immigration reform. In fact, Charles Schumer himself made speeches in Congress against illegal immigration.

They pushed the ACA through with no Republican votes: they could have easily done the same with immigration law.

</comment></comment></comment></comment></comment></comment></comment></comment><comment> sahin-boydas [https://www.washingtonpost.com/politics/trumps-border- emerge...](https://www.washingtonpost.com/politics/trumps-border-emergency- the-president-plans-a-10-am-announcement-in-the-rose- garden/2019/02/15/f0310e62-3110-11e9-86ab-5d02109aeb01_story.html)</comment>


Hotmail: Your password was too long, so we fixed it for you - <AUTHOR> http://www.securelist.com/en/blog/208193844/Hotmail_Your_password_was_too_long_so_we_fixed_it_for_you

<comment><USER2> "store full plaintext passwords in their db; compare the first 16 chars only [or] calculate the hash only on the first 16; ignore the rest"

Not entirely true. They could have stored the full passwords. Upon successful authentication, overwrite the saved hash with the hash of the first 16. Otherwise, retry authentication with just the first 16 characters. The password database would slowly adjust.

Doesn't begin to explain _why_ they'd put this limitation in after the fact, but it's not impossible.

<comment><USER3> But that definitely is _not_ what happened here, right? Because they are letting you sign in with the first 16 characters of your password, it means that they _must_ have access to plaintext of your old password. OP was unable to login with the long version of his password, the two options he outlines are the only possible way this _did_ happen, not options for how one might implement this change.

<comment><USER4> What I think he is trying to say is that (the dates are examples):

The Hotmail team decided to truncate all passwords to 16 chars last month, but they only store the hashes of the passwords. So the plan is:

For each user, when it submits the login form with his username and password, do the following:

1\. Compare the username and the hash of the password to the ones stored on the database

2\. If they match, replace the current password hash with the hash of the first 16 chars of the password that the user just sent -- because at this moment, the plain text password is available in the login form

\---

So, the hypothesis is that the OP logged in successfully yesterday, then had its password replace, and today when he tried to login again he couldn't, because the hash was changed.

<comment><USER5> Just one issue with that. If Microsoft is storing the hash, how does it know what the original password was and whether it was greater than 16 chars? If the algorithm is as above, then I just have to enter a password greater than 16 chars against ANYONE's username to be prompted for a password change and compromise their account.

<comment><USER6> Two arguments. The first is Microsoft doesn't need to know that the hash belongs to a password > 16 chars, it just needs to detect that the user is entering in 17+ characters and has not updated their password since the Hotmail update, and assume that they are submitting a password that is 17+ characters which should now be invalid, validate the old hash upon submission, fail authentication and prompt an "error" and ask for the truncated password, and then calculate a new hash and authenticate against that. Theres absolutely no reason for them to be doing that though, and it doesn't make a lick of sense either.

The second argument is that they have been silently truncating passwords to 16 characters forever, which they admit to. [http://windows.microsoft.com/en- US/windows-live/microsoft-ac...](http://windows.microsoft.com/en-US/windows- live/microsoft-account-password-16-characters)

<comment><USER7> Occams Razor suggests it's much more likely that back in the dawn of time some programmer thought a varchar(16) was more than big enough for a password column, it's even possible that's a consequence of how Solaris stored email/user passwords back in '96 before Microsoft bought Hotmail...

I _strongly_ suspect this means Hotmail has been storing cleartext passwords forever - people postulating strange workarounds whereby they might be able to detect password lengths in spite of storing hashes instead of passwords seem to me to be spectacularly unlikely compared to the much simpler alternative that they've been storing plaintext passwords truncated to 16 chars.

<comment><USER6> > it's even possible that's a consequence of how Solaris stored email/user > passwords back in '96 before Microsoft bought Hotmail...

From what I remember, Hotmail was a FreeBSD shop before Microsoft bought them, and ended up spending a boatload of money switching all the servers to NT.

But to the main point, I agree the 16 char limit smells strongly of plaintext passwords. However, there might be an argument that at one point those were all hashed for a massive security update. That would maintain the 16 char limit of the plaintext password since that would have been what the hash was generated from, but solve the issue of actually storing plaintext. I'd like to give Hotmail/Microsoft/Windows Live ID the benefit of the doubt and not immediately assume that they are _currently_ storing plaintext. (yeah, I know I shouldn't give anyone the benefit of a doubt in regards to security procedure)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'm fairly certain that they always truncated to the first 16 characters. About a year ago I had a 20 char password for my hotmail, and would happily enter it, but one day I was using some other input method (I think it was on my phone) and it stopped entering chars from 16 onwards. I was confused when it accepted my password, but then after some testing I realised what was happening.

It just seems they are being more explicit about it now. It is quite an odd decision to make though.

<comment><USER9> > _It just seems they are being more explicit about it now. It is quite an odd > decision to make though._

Given a choice between hidden limitations and explicit limitations, I'd much rather have the explicit ones. At least then it's clear what you're getting. I'd prefer they eliminate the artificial restrictions entirely, of course.

Disclosure: Microsoft employee

<comment><USER10> What is freaking is that it may not be an "artificial restriction", but a VARCHAR(16) restriction caused by a plain-text storing.

We certainly all have done this error: you create a database with the table "User" with the password in plain text. So VARCHAR, and humm, a max size... my password is 6 character long, but some user may go to 8, ok to be sure nobody will never complains, let's go for 16 characters. With some luck, your database truncate VARCHAR that are too long into VARCHAR(16) without notifying you. In this case, chance are nobody will notices there is a problem.

I do not thing this is the current explanation for hotmail. But it is funny to see that it looks like a very basic error.

<comment><USER9> I seriously doubt that this is the case (though I have no visibility into Microsoft account auth). Most likely, there was some poor design choice years ago (such as the one you described) that has been corrected, but the effects its caused haven't been fixed through the codebase. e.g. I would not be surprised if the code contains something like this:

      struct user_auth
      {
        char username[64];
        char pw[16]; // TODO: Allow longer passwords
        //...
      };

      bool authenticate_user(user_auth* ua);

This kind of code would limit passwords to 16 characters, but would be irrelevant to how passwords are currently hashed or stored.

</comment></comment></comment></comment><comment><USER11> This sounds suspiciously similar to the LM (of NTLM) password limits, <http://en.wikipedia.org/wiki/NTLM#cite_ref-v1_13-0>

<comment><USER12> Might make sense. Microsoft Accounts are also user accounts in Windows 8.

</comment></comment><comment><USER13> Passwords/phrases have really got to go. They are a relic, and every year they offer less and less security. Plus even reasonably smart programmers and administrators continually make the same mistakes over and over in handling them; no real reason to think that will suddenly change. I'm not sure what the answer is, but the vast majority of people are not going to be content with typing a 30 character or more passphrase even if it's something memorable, never mind the 6 - 12 character ones that look like line noise. Password managers are just a band-aid, and again most people would find them annoying. People just want to get to their email, do their banking, shopping, pay their bills, whatever. There's got to be something better than passwords. Maybe someone can really put some consumer-oriented thinking behind something like PKI and make it EASY for the average person.

<comment><USER14> Square? If it's not something you know it needs to be something you own. Cc's seem like a possible thing a lot of people own. Square-like thing for authing by swiping seems like it could be done. Or maybe mobile as a remote would be enough on it's own for most cases. Visit on web, unlock by pressing separate mobile button.

<comment><USER15> "If it's not something you know it needs to be something you own" -- Agreed, and I much prefer to authenticate with something I know. I'd rather not have all my accounts bound to some tangible object that can be lost, broken, or revoked by a central authority. I absolutely do not want my credit card company or anyone else to be the middleman every time I authenticate to any service. If that happens, they pretty much own me. Imagine what would happen if, for whatever reason, they stopped authenticating me.

Granted, if I authenticate with something I _know,_ there's a small chance I'll lose it due to memory loss. (Car accident, etc.) But that seems much less likely than me losing something I _own._

</comment></comment></comment><comment><USER16> An interesting article, but still promoting that old password advice that creates crackable but not memorable passwords. If you have a hash that can do ~2 billion keys/sec then you can simply brute force the keyspace including symbols.

Obligatory XKCD: <http://xkcd.com/936/>

The 16 character limit really helps though :)

</comment><comment><USER17> The hashing algorithm is one part of the puzzle. We need to get everyone to switch to bcrypt or pbkdf2.

But more importantly, we have to improve web dev practice to make sql injection a thing of the past. Most of these password thefts are enabled by sql injection attacks used to steal the database.

And finally, we need a standard solution for two factor auth. We should have a way to integrate two factor auth into our sites without being tied to a google account or something similar.

<comment><USER18> What I'd really prefer to see is to simply never send my password over the wire to a website. I don't want to have to place any trust in them.

When I log into an SSH server, I am authenticated using purely my private and public keys. The SSH server has my public key, and my computer has my private key. A password is never sent over the wire, which doesn't give an adversarial SSH server the opportunity to store a password. And, if the SSH server is compromised, it doesn't even really matter - all the attacker gets is my public key.

Why isn't this authentication mechanism standard for the web? And, why isn't anyone even talking about building something like this? I'd much rather see browsers implement public key authentication than things like Persona or OpenID.

<comment><USER19> SSL client side certificates are already implemented, but they have their own problems:

1) UI is hard to use [http://pilif.github.com/2008/05/why-is-nobody-using-ssl- clie...](http://pilif.github.com/2008/05/why-is-nobody-using-ssl-client- certificates/)

2) Can be easily stolen by malware (if client certificate is password- protected then password can be locally bruteforced on attacker's system)

3) It's not easy to switch identities (if you have multiple accounts on some website). And whenever there is no support for multiple identities, there is a ground for privacy concerns.

4) It's almost impossible to enter them from keyboard. How do I enter one on the iPhone? How do I write it on paper? What if I need to access some website from work and from home? What if my USB thumbdrive with client SSL certs fails or gets stolen?

5) They expire eventually, and when they do, users have another out-of-common- sense problem to solve.

So, implementation already exists but it's impractical.

<comment><USER18> Oh cool, I wasn't aware of this. SSL client side certificates are not quite the same as the public key authentication done using SSH, but it seems like it could still be workable if the UI weren't so awful.

The only real concern seems to be the UI. Issue number 2 (being stolen by malware), could also easily occur with current authentication schemes (malware could steal the cookies on your machine, which would give it indefinite access to all sites you use until you change your passwords on them). All the other issues you mention are really just UI and UX problems.

Another problem is the lack of a real name. "SSL Client Side Certificates" isn't short and catchy, like OpenID or Persona.

</comment></comment></comment></comment><comment><USER20> How does this make sense? If they hash the passwords, they get a fixed length result anyway. Why would they truncate the plaintext before hashing?

</comment><comment><USER21> yahoo is even worse. I went to change my password from a very easily guessable one to a not as guessable one. Once I figured out a password which fit their stupid requirements (if my password is >20 chars I don't think it having an upper or lower case is going to be the kicker) the site told me I had successfully changed my password. When I went to log in however it would not let me log in.

Turns out yahoo had silently truncated my password down to 24 letters. No indication that this had been done, it was really only through trial and error (I had a feeling something was up, and my password isn't too much more then 24) that I figured it out.

</comment><comment><USER22> Yikes. Take a look at this gem from Microsoft's knowledge-base: "This doesn't mean that your password has been shortened. Actually, Windows Live ID passwords were always limited to 16 characters—any additional password characters were ignored by the sign-in process."

Translation: "Even though you typed in a 40-character password when you first signed up, we ignored most of it and only used the first 16 characters."

Source: [http://windows.microsoft.com/en-US/windows-live/microsoft- ac...](http://windows.microsoft.com/en-US/windows-live/microsoft-account- password-16-characters)

</comment><comment><USER23> Add to that every time someone tries to log into my account I get an e-mail asking me to confirm or deny the attempt; instead of the option to ignore it.

And multiple attempts by other people to log in to my account by other people locks me out.

It's a good thing I only use it for Xbox.

</comment><comment><USER24> Why does hotmail has this 16-letter limit in the first place?

I would get it 7 years ago, but now?

<comment><USER25> Because this code was designed well over a decade ago, and someone decided 16 characters was an acceptable limit. From a guy that worked on the Live team, he said in many years of reviewing the security issues, password length never came up as a high enough priority issue to justify the changes required. There's much more important things for them to do.

Now as to why someone chose 16 characters 10+ years ago... who knows. But having such a limitation roll forward isn't that mysterious.

<comment><USER13> 10+ years ago, or maybe a bit more, enterprise hard drive sizes were probably still measured in MB. Things like the sizes of fields actually mattered, and the older the system, the more they mattered and the more people would have had to sweat about whether the field was 8, 16, or 32 characters or whatever.

<comment><USER26> If you are properly hashing a password, then the hash is always of a known length, regardless of length of password.

</comment></comment></comment></comment><comment><USER27>
       1. salt
       2. don't allow unlimited password attempts

</comment><comment><USER28> The problem isn't just hotmail. Most major banks (amex, chase, etc.) forbid special characters, limit the password length as well, or a combination of both.

Then again, banks are not exactly on the cutting edge of security, though they like to seem like they are. This isn't a surprise considering how shoddily their web apps are built.

<comment><USER29> _Then again, banks are not exactly on the cutting edge of security, though they like to seem like they are._

Every bank I've ever dealt with has assumed 100% liability for unauthorized transactions, so a bad password affects _them_ financially, not you. Therefore, I don't understand all the complaining about password length.

<comment><USER30> That's a pretty damn naive statement. Yes, in the end, customers are financially protected. But that doesn't make up for the hours, days or even weeks of phone calls, emails, letters, in-person visits, credit-reporting agency fixes, etc which are necessary to rectify fraud in the banking/finance industry.</comment></comment></comment>


USPTO open to public comment on what can be patented - <AUTHOR> http://www.uspto.gov/news/pr/2010/10_35.jsp

<comment><USER2> I have no problem with _any_ patents assuming they are truly innovative. The biggest problem with patents is that the non-obviousness step is almost ignored from my experience.

What they need is a way to determine whether an invention is an obvious extension or not. I suggest they do this probabilistically. Let's say it's a non-obvious idea if only 1/100 skilled practitioners would come up with it given the generic problem statement. Then it's easy to test. This would increase the cost of patents (a good thing imho) and dramatically decrease the number of spurious patents.

The interesting thing would be what proportion of inventions would qualify under this scheme. I have a feeling very few.

<comment><USER3> The biggest problem with software patents is a limited solution space. For a poor example, implementing text rendering on a graphics card is something which you can very easily formulate three attempts and measure which one works best against common criteria (sharpness, speed, etc). Once the best solution is patented, it's very unlikely anyone else will be able to use this technology (particularly in situations where the patent is a small part of a larger package, say, an operating system) and they will be forced to settle into the second best-fitting solution.

<comment><USER2> You know, an even better method might be for the problem statement to be open to the public. People could then submit their solutions, and if no one came up with the same idea then it's patentable.

This way if it truly is something with a massive inventive step, then people can get the patent. If it's something as simple as what you describe, then there's no way it would be patented in the first place.

</comment></comment></comment><comment><USER4> Software patents don't parallel hardware patents sufficiently closely.

When you are granted a hardware patent, most everything a competent competitor needs to reproduce the invention is directly in the patent.

With software (algorithm) patents, that's rather less the case.

If you were to more closely parallel the hardware model and if you wanted to encourage the public good, then the grant of a software patent would escrow full source code, and (when the patent lapses) that same full source code is then available for use by others.

And yes, I'm looking straight at the One Click patent here.

<comment><USER5> So why would source code for the "One Click" patent make any difference? It would take be all of ten minutes to make a perfectly functional implementation of "one click shopping" in an open source PHP cart which I could submit with the patent (or a day to build a simple cart from scratch if the open source- part is a problem). How would that make the patent less viable?

Or are you arguing that only specific implementations could be patented? That, if we allow the premise of software patents in the first place, doesn't make any sense. Then we'd need measures to determine how much to change before it's not the same. I mean, to keep with the example of hardware patents, I'm sure a patent for a new crankshaft would also cover if it's 5% larger and made of a slightly different alloy.

Re-implementing in an other language? What if it compiles to the same VM code? Then I'm getting the the business of generating and selling unique JVM languages. A new language for implementing the core of a competing algorithm? $1500, thank you.

<comment><USER4> Why?

Because it (also) places indirect costs and additional onus onto the submitter of the patent; costs beyond the existing filing fees and legal fees.

Because it also provides (some) tangible results for the community. (Now whether the covered source code is judged "good" or "bad" is another matter; there's certainly going to be some cases and some judgement required here around what's covered code, and whether or not the code is obfuscated, etc.)

Because it means all of the patent-covered source code eventually gets exposed and licensed, which then gives an advantage to the community.

Because even if your organization doesn't produce a product (and for whatever reason), you still have to produce functional source code.

And because it means that most closed-source organizations probably won't choose to patent their software.

<comment><USER5> In your post you referred prominently to the one-click patent. I fail to see how your proposal would have even slightly curtailed that patent.

> Because it (also) places indirect costs and additional onus onto the > submitter of the patent;

A developer for a day, as I demonstrated.

> Because it also provides (some) tangible results for the community.

> Because it means all of the patent-covered source code eventually gets > exposed and licensed

An implementation of an obvious process isn't a tangible, or even particularly valuable, result, as any member of the community could produce it in very little time.

> Because even if your organization doesn't produce a product (and for > whatever reason), you still have to produce functional source code.

No, you just have to throw a $500 project on e-lance. Or about what you pay the lawyer who's writing the patent for you every hour.

> And because it means that most closed-source organizations probably won't > choose to patent their software.

No, at best it would keep the stuff that's actually patent-worthy from being patented (and thus "out there", inspiring others, which is the whole idea behind patents), while the obvious crap gets patented (what does Amazon have to lose from spending a day writing a simple PHP cart?)..

<comment><USER4> This scheme makes patents part of adding to open-source, and also uses the comparative "allergy" that many commercial entities have to open source.

The folks seeking patents will have to decide if they want the patent enough to open-source their covered source code (later). Various firms certainly won't want that. Those that do go for the patents will then serve to produce open-source code.

But if you don't think it'll work or if you have a better idea, cool. Post away...

<comment><USER5> Code that's provided as part of a patent is tainted beyond reproach, and can never be part of free software.

> But if you don't think it'll work or if you have a better idea, cool. Post > away...

Can we please not go to this level? I did not understand how your proposal would work. Pointing this out does not obligate me to have a better idea.

<comment><USER4> Source code is not tainted beyond reproach after the patent expires in the existing patent system, though the source code does reverts to whatever copyright the producer might have.

Source code that's been patented under the proposed system becomes open source at the expiration of the patent; the covered source code or the escrow source code becomes open source code under the proposed system.

Pointing these details out can be quite useful; it definitely helps refine ideas or elevator pitches.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Patents are an incentive given to inventors to reveal their inventions and not keep them as trade secrets ( reason for patents from the perspective of the state).

Using this as a guiding principle, a patent should be granted only to those products that use an idea which has not been successfully replicated after some period of time.

Say if a product/service uses an idea and has been in the market for 2-3 years. If the idea adds to the greater good of the society and has not been replicated by anyone else yet; such ideas should qualify for the incentive of patents.

<comment><USER7> Make no mistake: patents are monopoly rights given to justify R&D.

The "revealing" doctrine is largely obsolete. Modern patents say virtually nothing of how a invention works that can't be found by easily in a product description - or at most cursory reverse engineering. The true secret-sause is kept behind closed doors.

However, more and more it appears the societal value of patents isn't realized, and in fact the majority actually decrease competition and research in a field.

</comment></comment><comment><USER8> I guess I would prefer simple rules instead of a value judgement. I would probably go with no patents on math, business processes, or software. Allow design patents on icons, UI elements, etc. this whole "patent a concept, not the specific implementation" is BS.

<comment><USER7> Amen on no math/process/software patents, but I'd have to say that the design patents alluded to in your comment are just as subjective as any used today. The legal criteria of the "casual observer" sounds just like the "I know it when I see it" use with porn.

<comment><USER8> I don't think so. Either something is one of those categories or its not. The design patent part is pretty straight forward in its application (ornamental aspects of object) and can't be used as a back door to replace a utility patent. It doesn't generate the drama of any of the above categories.

<comment><USER7> I wasn't implying that it's used like utility patents - just that it's very subjective whether someone is infringing - just like OP was describing.

</comment></comment></comment></comment><comment><USER9> How about this: All fucking patent tro, er non-practicing entities, must die.

Or more politely, patents should require that at least some of the 90% perspiration required for discovery/innovation be done by the entity requesting the patent.

Patenting pure knowledge with no attempt at implementation, or buying such patents and suing those who try to implement them, incentivizes the lazy, and hinders the kids in the garage/lab/hackerspace building the next HP, Apple, or Google.

</comment><comment><USER10> Here's an idea: only let people patent stuff that other people aren't likely to arrive at independently as soon as they're faced with the same problem.

Of course, since I can't put "Esq." after my name or "Congressman" in front of it, I don't expect this advice to be taken very seriously when I submit it to the USPTO.

<comment><USER11> I think it's funny that US lawyers use this antique English term.

Anyway, if you trust Wikipedia for legal advice, maybe you can use "Esq.".

<http://en.wikipedia.org/wiki/Esquire>

"In short, the situation is that those who are in situation where questions might arise about their possession of an active law license ... should be careful about using "Esquire" or any other designation that might lead to confusion. For others, the problem simply does not exist. Someone who never went to law school, never practiced law, and has a career unrelated to the legal profession (such as selling ice cream), will not be mistaken for a lawyer and can call himself "esquire" to his hearts content."</comment></comment>


Entrepreneurship – A second attempt – Feedback welcomed - <AUTHOR> I have come to the realization that my current startup's lethragic growth rate will not allow me to afford a living in the bay area. As such, I am presented with a few options: Get a job, or take another shot at starting a company (albeit, working out of a cheaper city). I am heavily leaning toward the latter, but this time I want to take some feedback earlier on from the YC community as I have found the people here to be amongst the most honest and knowledgeable. I would appreciate your critique (as well as pointers) of some of the ideas I am proposing for my next startup. Also, do you think there is a market need/ actual problem to be solved, or am I just forcing the issue?
a] Outsourcing: As I plan to operate out of Africa for a while, I was thinking of a managed outsourcing business where we train and place the smartest candidates on projects ranging from creative services to development. I see a shortage in talent locally and this model could allow companies to augment their talent pool with affordable labour.
b] Similar to A above but a focus on deploying and managing opensource projects such as wordpress, moodle, open ERP etc. Not only would I provide the technical talent, but also the operational labour to perform services like order management, chat management etc
c] Building a tool gamifies social actions (twitter, fb, instagram sharing etc) - with a lotto/random winnings component that creates recurring engagment by players
I would appreciate any feedback.
Regards. <comment><USER2> First off most startups fail because they don't have a working business plan or they don't have a good target market because they developed a niche that has very few people in it. Work on fixing your business plan and find a new market to target your product at.

a) In the USA the software contracting market suffers because everyone has to go through brokers to get a contract. Most brokers don't understand the technology they are placing people for and just read resumes for key words to place people. Software contractors lost their tax status in the 1970s and never got it back, so they pay a lot in taxes. If you ever heard of Joe Stack he flew his plane into the IRS building because he was a software contractor screwed over by brokers that keep part of the money and the IRS that takes a lot of taxes from software contractors. It is because the system is so messed up that some software contractors go without work for long periods of time and some end up homeless as a result. If you are going to make a new Freelancer web site, forget it, most are in favor of the client and the client always goes to the lowest bidder which is usually a foreign worker. There are no freelance websites for favor of the contractors. There is no shortage on talent, just that people with talent need more money to work and clients don't want to pay their rates so they seek to train young people to work for a cheaper labor. It is a corrupt system you are getting into.

b) Where are you going to get the money to pay people to work on open source projects? They don't bring in any revenue and crowdfunding doesn't always work. You'd be better off training people to work on open source projects in part a to gain the talent so they can be marketable and list the project on their resume.

c) It almost sounds like some kind of spam system that uses social networks to target gamers and then pays off some random lottery.

I don't really see a, b, and c working out.

I myself have been trying to write ebooks, but I recently found out I earn more money via Adsense on Youtube videos. Have you tried making Youtube videos on training people to program or something and put Adsense on it and see how much money it earns?

You really need better product ideas, like look for problems that need solving and see what market is looking for a solution and make a solution or hire people to make a solution and then market it at those people using advertising on places they visit on the Internet.

<comment><AUTHOR> Thanks for taking the time to reply. I might have to disagree on majority of the points you brought up but I appreciate the point of view.

For b], the emphasis is on helping SMEs deploy solutions that are opensource for their current operations, and provide them with ap-ops, tech-ops and general ops labor. I am not thinking of building out new opensource inititatives.

For c] you are completely off point. We are not targeting gamer sor creating a spam system, rather, I would be trying to create a system for lead capture and CCA optimization.

thanks though

<comment><USER2> b) SMEs don't always have the budget and usually purchase COTS Commercial off The Shelf products like Microsoft Office and build things on Excel and Sharepoint and other apps. I learned this the hard way trying to target SME law firms for legal practice management software. You'd have to convince them that using open source products and paying your company to manage and develop them for them is the better deal even if it does cost them more money in the long run. You'd also have to convince them that your company can do it better than their own people using the same free open source projects.

c) Lead capture still requires getting the link to your lead capture page out there. If you are posting it to social networks, some might see it as spam.

</comment></comment></comment><comment><USER3> Not a lawyer, but c) is almost certainly illegal. Gambling of any kind is heavily regulated and restricted.

As to a) or b): it's not impossible to run a consulting company, but then you'll end up running a consulting company, competing with all other consulting companies. Competing on cost alone is not a good idea.

<comment><AUTHOR> thanks for the reply.

c] is not illegal because there is no wagering involved</comment></comment>


Moving on from Conference Swag - <AUTHOR> https://christianheilmann.com/2020/01/09/swagged-out/ <comment> jim-jim-jim It doesn't help that most of the junk given away is so ugly and childish. At least doctors get useful things like Cialis notepads.</comment>


High performance network programming on the JVM - <AUTHOR> http://www.slideshare.net/eonnen/high-performance-network-programming-on-the-jvm-oscon-2012

<comment><AUTHOR> TL;DR They managed to scale their server up to 1 million open connections with a single Java process. Pretty impressive stuff.

More here: [http://urbanairship.com/blog/2012/05/17/scaling-urban- airshi...](http://urbanairship.com/blog/2012/05/17/scaling-urban-airships- messaging-infrastructure-to-light-up-a-stadium-in-one-second/)</comment>


Android PHP option planned for Javaphobes  - <AUTHOR> http://www.theregister.co.uk/2010/07/15/php_android/

<comment><USER2> Along with every other scripting language. Not news until someone has working apps running on most phones. Until then it's a toy. ASE isn't even available in the market yet. How is distribution going to work for that? I don't think .apks support dependencies, so at this point you'll practically have to ship your own version of the runtime with the app.

<comment><USER3> err APKs can reference other library APKs

<comment><USER2> But they can't pull in library APKs on install like in a fully functional package manager.

</comment></comment></comment><comment><USER4> I'd rather use JS on V8 to develop for android. Not necessarily nodejs but an in-house brew made by google, optimized for android and tailored to web hobbyists.

<comment><USER5> A thousand times yes to this comment. I have had a great deal of fun playing with the V8 engine, and it would beyond cool to write code for the Android using it. Android Chrome already has it integrated, so it should definitely be feasible.

<comment><USER6> My prototype of a pure JavaScript chinese checkers runs fine on my Nexus One <http://halma.artifia.com>

I created a small wrapper for it, similar to PhoneGap, to be able to put it in the Marketplace, too (not yet published, for lack of visual polish).

<comment><USER4> Beautiful. I like the simplicity of it.

<comment><USER6> Thanks - the graphics for the stones are actually from a friend's iPhone app. Unfortunately I can't find it in the app store anymore, he seems to have removed it. My main interest with the prototype was to see if the AI in JavaScript would work.

<comment><USER4> You should make an iPad version and sell it on the app store.

A wooden background is all you need, something like:

<http://www.gametableapp.com/>

or

<http://mashable.com/2010/03/31/game-table-ipad/>

</comment></comment></comment></comment></comment></comment><comment><USER7> Erm... this is great. But what if I'm a PHPophobe _and_ a Javaphobe?

<comment><USER8> <http://code.google.com/p/android-scripting/>

</comment></comment><comment><USER9> I'd love .NET... Not that I love msft but it's a language that's got it together to build some serious apps. Not saying bad things about Java, but I'm not personally a fan.

<comment><USER9> My bad - it seems Mono is already supported for Android [http://stackoverflow.com/questions/214615/will-google- androi...](http://stackoverflow.com/questions/214615/will-google-android-ever- support-net)

</comment></comment><comment><USER10> I was expecting app engine support for PHP before this.

</comment><comment><USER11> Why can't they just let us us a gcc toolchain and be done with it.

<comment><USER12> How's this? <http://developer.android.com/sdk/ndk/index.html>

<comment><USER13> Is that for writing entire applications in C or C++ or just parts of them?

<comment><USER14> Parts. But major parts if you want to, see e.g. the Android port of Quake 3: ~250,000 lines of C and a few hundred lines of Java glue.

</comment></comment></comment></comment><comment><USER3> lol this makes me facepalm. The Android SDK is super easy to use with Java. It's not like some of the major Java frameworks.... buuut whatever floats people's boats. At least this is perfectly fine to do with Android. good luck getting PHP iPhone apps approved. :P

</comment><comment><USER15> What is the goal of using something like php-cli without popular modules (blah-blah.so) as device-scripting language?</comment>