$90,000 fines for selling 600 bunny rabbits: why are we paying for this? - <AUTHOR> http://www.jerrypournelle.com/view/2011/Q2/view677.html#Wednesday

<comment><USER3> Reminds me of "Everything I want to do is illegal." [http://www.mindfully.org/Farm/2003/Everything-Is- Illegal1esp...](http://www.mindfully.org/Farm/2003/Everything-Is- Illegal1esp03.htm)

</comment><comment><USER4> The man was repeatedly warned that he needed a license, and repeatedly refused to get one.

</comment><comment><USER5> Someone should really help this guy out with a design. Anything is better then this!

<comment><USER6> Pournelle is one of the great 90's tech writers who also did Sci-Fi work - <USER2> column in Byte back in the day was great:

<http://en.wikipedia.org/wiki/Jerry_Pournelle>

Think of him as the John Gruber of the 90's.

And yes, someone should give him some CSS help.</comment></comment>


40 Years After an Acid Attack, a Life Well Lived - <AUTHOR> http://www.nytimes.com/2013/03/03/nyregion/40-years-after-an-acid-attack-a-life-well-lived.html?hp&_r=0&pagewanted=all

<comment><USER2> I'm certain I've seen Dr. Miele in the BART before.

Everyone (myself included, which I am ashamed of) did everything to not stare at him nor look in his direction– which of course would have been glaringly and awkwardly obvious to anyone observing the scene.

Reading this article, his body of work is fascinating. Part of me hopes that if I ever see him again during one of my commutes, I'll have the courage to go up to him and ask him questions about all the cool stuff he's done.

<comment><USER3> I wonder how aware he was of it and how much he experienced it as socially isolating. When I saw "Shallow Hal," the beautiful thin actress who wore a fat suit for the role of the fat girlfriend tried it out by going to a bar. She was used to being looked at. No one looked at her when she was the fat girl. She remarked in an interview how socially isolating it was. I know he is blind but he is not stupid. I wonder how much of that he notices.

<comment><USER4> But a thin girl in a fat costume knows what it's like to be thin and socially active. It makes it more jarring to go from one extreme to the other (as it would be for an overweight person who was ignored to suddenly become the centre of attention).

By that same token, I don't know if Dr. Miele would notice much of it, because he has been isolated in public from such a young age.

<comment><USER3> I am handicapped and so are my sons. We are "normal" to each other. I forget how impaired my oldest son is. When he runs into something which trips him up, I am often jarringly reminded. The article suggests Dr. Miele likely experiences a "normal" home life and is sensitive to the detail of wanting to be known for the right reasons. He may not be painfully aware of how strangers react, because he is used to it. Or it might be like a constant annoyance which grates all the more for having gone on so long. It would be interesting to hear his take on it.

</comment></comment></comment></comment><comment><USER5> > But he said hers were wasted words.

> "That's so fascinating," he said, "but you know, it wouldn't have made a > difference. I was a cautious kid. I knew who was outside the gate. I knew > Bassy. You would have opened it, too."

I can't imagine the trust issues one would have after going through this. If a stranger does something, it can be explained away. But if it is someone you know, makes it much more difficult.

</comment><comment><USER6> About 6 months ago in my lab we had an acid attack. One student took offense to another telling him what to do, grabbed a hammer and the nearest vial of sulfuric acid and chased the guy down, knocked him down, and started pouring acid on him.

About the only lucky thing about the attack is that the victim didn't get any his eyes, but months on he's still recovering after multiple skin-grafts.

There isn't really a lesson that we can fathom from this really. It happened about 24 hours after an incident when the perpetrator had gotten angry and thrown a beaker on the floor, and literally 5 minutes before the acid attack happened (when the previous events were related to me) I commented that we should take it more seriously because if someone's not in control that's how acid gets thrown on people.

<comment><USER7> Tell us more about the perpetrator.

<comment><USER6> He was just a new student - working closely with the victim actually. Apparently he turned out to have schizophrenia, but it was previously undiagnosed or unreported or something. Which is just weird as hell because how do you get to Ph. D level and have schizophrenia in the first place?

</comment></comment></comment><comment><USER8> interesting as this again was done by a deeply disturbed individual, a paranoid schizophrenic.

society since then has not gotten better at identifying threats coming from sick people. down to sandy hook, the completely insane individual is left alone until he/she commits an atrocity.

<comment> k-mcgrady I have no specific evidence but I believe society has gotten better and identifying mental health issues and treating them.

>> "down to sandy hook, the completely insane individual is left alone until he/she commits an atrocity"

It's up to family and friends to help identify problems someone they know might be having and it's up to the government to provide adequate support and facilities to treat ill people. People being left alone with their problems until they crack is not just due to people not identifying the problems, it's due to inadequate care options.

<comment><USER9> Based on my recent personal experience, I don't feel that much has improved. Perhaps society is more accepting of the condition, and less likely to stigmatized. But helping a mentally ill person (in the USA) is pretty much not an option. Perhaps I didn't look hard enough.

<comment> k-mcgrady >> "But helping a mentally ill person (in the USA) is pretty much not an option."

Could you explain why? Here (the UK) there is quite a lot of free help from the health service and there are a lot of charities I know of which provide counselling. Local GP's are also able to work with people and refer them to specialists if necessary.

<comment><USER10> In England:

A person can go to their GP to get treatment, and the GP will either treat (access to short form talking therapies and some medications), or refer on to a community team.

The community team provides access to heavier duty meds; long form talking therapies; ECT; hospitalisation; a variety of different clinicians, etc etc.

Note that treatment can be forced, and against the patient's wishes. Note also that there's the possibility of community treatment orders. These mean that a person living in the community (not in hospital or prison) could also be forced to take medication regularly.

All of this is free at the point of delivery. (With the exception of prescriptions, but there are so many exemptions they're free to most people.)

And let's not forget that people with mental illness are far more likely to be the victims of violent crime, not the perpetrator.

<comment><USER9> _Note also that there's the possibility of community treatment orders._

We don't have that option. And I'm really torn on this one.

 _And let's not forget that people with mental illness are far more likely to be the victims of violent crime, not the perpetrator._

Absolutely.

</comment></comment></comment></comment></comment></comment><comment><USER11> A brilliant story, well written.

There have been a few horrific stories of cultural backwards attacking women with acid in the UK press. It's made me far more cautious when handling automotive batteries.

I won't move a car battery ever again without wearing safety goggles.

<comment><USER12> Acids are dangerous indeed. In case of hydrochloric acid you don't even need to splash yourself to get hurt. The fumes are enough to damage your eyes or respiratory tract - gaseous hydrogen chloride dissolves in the moisture covering eyes and mucous membranes, producing hydrochloric acid.

<comment><USER13> To be fair, I remember handling HCl in chemistry and the fumes didn't dissolve my eyes, though I could tell that the fumes weren't nice either. It would depend on the concentration of the gas, which would also be a function of the concentration of the HCl that was vaporising.

</comment></comment></comment><comment><USER14> It is an interesting story about someone's life and overcoming adversity.

But don't fall into the trap and read anything else into it, the things you should fear in life are quite boring. Some comments seem to be going down this path.

</comment><comment><USER15> Thanks for posting this article. Dr. Joshua A. Miele is an incredible person and very inspiring. Thank you for your great work and contribution to people.

</comment><comment><USER16> no offense but he looks like a certain Star Trek character I forget his name.

<comment><USER17> How does adding "no offense" to the front of a statement affect how offensive the remainder of the statement is?

</comment></comment><comment><USER18> What does this have to do with Hacker News?

<comment><USER19> How hard would it be for HN to filter posts like this? There are only so many permutations of "Why is this here? / What does this have to do with HN?" possible...

<comment><USER20> To my knowledge, HN hasn't added any new features in years. I think the people who run this site are pretty happy with it the way it is and don't want to change it, despite many suggestions for improvements. So I wouldn't hold my breath waiting for them to do anything about it.

<comment><USER21> Actually I added one about an hour ago.

This is an interesting suggestion but it would not be on our top 100 things to fix.

<comment><USER22> >Actually I added one about an hour ago.

What was it? I'm genuinely curious.

<comment><USER21> Better detection and banning of abusive crawlers.</comment></comment></comment></comment></comment></comment>


The venture industry has been cut in half - 50% of VC firms closed up shop in the last six years - <AUTHOR> http://www.ovp.com/News--Events/Newsletter/

<comment><USER2> Lies, damn lies, ...

All those LPs are taking their liquidated investments and putting them somewhere else. Probably in large part that somewhere else is more-successful VC firms.

<comment><USER3> I wouldn't be surprised if that somewhere else is currently hedge funds and private equity at the moment, though. Those sectors are _huge_ at the moment, and their growth has to have come from somewhere. I think a more likely explanation is that money fled venture capital after the tech bust and came to rest in hedge funds and private equity, and now that those bubbles are about to burst, it'll likely go back to venture capital. Or maybe blue-chip stocks.</comment></comment>


Show HN: NSL Archive – A record of publicly disclosed national security letters - <AUTHOR> https://nslarchive.org/ <comment><USER2> A national security letter (NSL) is an administrative subpoena issued by the United States government to gather information for national security purposes. NSLs do not require prior approval from a judge. [wikipedia]

<comment><USER3> While I guess this is something, I would be curious to know what types of users are being targeted with these NSLs, and for what crimes. While it's natural to think "Islamic extremism and terrorism" as that's the usual natsec rallying cry, I wouldn't be surprised to see these being used for other purposes.</comment></comment>


Another iPhone 4G prototype shows up, bears all including Apple's own A4 chip - <AUTHOR> http://www.crunchgear.com/2010/05/12/another-iphone-4g-prototype-shows-up-bears-all-including-an-apples-own-a4-chip/ <comment><USER2> I don't buy that this is real...the lack of response on the screen is suspicious. Wouldn't you want to show off the fancy new software too if you'd found a fully functional prototype?

Asian phone clone shops are really good, and if they already had a model to work from on the Giz post, I would posit it's entirely possible that it's a clone.

<comment><USER3> It seems to be a hardware prototype only, with some boot check and no system rom.

<comment><USER2> If that's true then the background is 100% out of character for Apple. I don't speak Vietnamese, so perhaps he explains that part (i.e., he loaded his own software on it), but I don't think an Apple-provided diagnostic would look like that.

<comment><USER4> I believe it. Apple device diagnostic modes are usually extremely rough. You can put iPods into diagnostic mode. It's just unadorned text, and, on older iPods at least, you had to click the forward and back buttons to scroll through the menus. I remember seeing a different iPhone test screen that was similarly unrefined.

Apple's 'character' is to have things looking good by release, not necessarily internally.

<comment><USER5> e.g. my old iPod nano in diagnostic mode: [http://blog.jgc.org/2006/09/ipod- nano-in-diagnostic-mode.htm...](http://blog.jgc.org/2006/09/ipod-nano-in- diagnostic-mode.html)

<comment><USER6> Where is the flaming fireball on the screen?

</comment></comment></comment></comment></comment></comment><comment><USER7> Is it just me, or are there more homophone mixups on HN lately?

<comment><USER8> Is it necessarily wrong? I looked at it for a second too long before clicking... and while I'm sure it's a typo, I think it does work out if you understand it to mean "contains everything, including the A4"

<comment><USER9> Given that it's so clear that "reveals everything" was intended, yes. It's generous of you to stretch the meaning to accomodate the mistake, though.

</comment></comment></comment><comment><USER10> I don't think they really need to wow people on release, the ipad already had plenty of information out there beforehand. Everyone has a fair idea of what to expect from the next iphone, no one is going to be overly surprised that there moving towards the A4 for new mobile devices.

</comment><comment><USER11> Despite this article not offering much new info, it was worth it for the closing comment.

</comment><comment><USER12> > "Alright, jerks. iPhone 4G, $199 on both AT&T and Verizon"

Better: "Alright, jerks. iPhone 4G, $299, available unlocked only"

<comment><USER13> Not going to happen. That would entirely destroy Apple's profits on it. Not to mention that even if it were unlocked it would only have 3G on AT&T's network, and wouldn't run at all on Verizon, so that's somewhat pointless.

<comment><USER12> Don't forget there is a whole planet outside the US borders.

</comment></comment></comment><comment><USER14> Has there been any confirmation at all that it has a 4G radio? Also isn't ATT not rolling out LTE until next year?

</comment><comment><USER15> clearly the best part of the video is having "how deep is your love" heard as ambience music

</comment><comment><USER16> So, who is apple going to blame for 'stealing' this one?

</comment><comment><USER17> Apple, Steve, it's been a long time, but this is what happens when you're #1. Just live with it.</comment>


Battling the 'Monsanto law' in Ghana - <AUTHOR> http://newint.org/blog/2014/10/20/plant-breeders-bill-ghana/#sthash.RCRTmcol.dpuf

<comment><USER2> I'm an environmentalist and a humanitarian, and I want both of these things:

1\. Freedom for Ghanaian farmers to plant their traditional crops. 2\. Access for Ghanaian farmers to high-yield varietals developed by companies like Monsanto.

This article implies that the law makes goal #1 illegal, but if you read closely, it is just an implication, and not an outright statement. My current understanding is that goal #1 is not made illegal by this bill. Does anyone have any contradictory evidence?

My understanding of this law is that it adopts US-style IP laws for agriculture, which is a controversial idea. Supporters would say it creates incentives towards goal #2, because it's hard for Monsanto to sell self- reproducing technology at a profit without IP support. Detractors would say that it has other downsides. I don't think the detractors are wrong, but I have a question for anyone that's open to exchange views:

If you oppose this law, but support goal #2, what do you think will bring Monsanto into Ghana? I only see three options: a) this law, b) Monsanto writes Ghana off as a loss and sells their unprotectable technology, c) we legally compel Monsanto to write Ghana off as a loss.

<comment><USER3> The issue in the U.S. is that flowering plants seeds travel by wind. So farmer A who bought Monsanto seeds infects farmer Bs field, who then can no longer legally harvest the seeds from field B because they contain Monsanto IP. Not sure if this applies to crops in Ghana, but its true in the US.

<comment><USER4> No, it is not true in the US, which you will learn if you read the rest of this discussion.

</comment></comment></comment><comment><USER5> Last night there was a fantastic story about C4 Rice here:

[https://news.ycombinator.com/item?id=8867365](https://news.ycombinator.com/item?id=8867365)

In one of the comments a user said:

"What is the plan to deal with the backlash from uneducated people screaming about how bad GMO is?"

If you're wondering why that backlash is as strong as it is look no further than the kind of legal trickery on display here.

Monsanto is about as evil as it gets in the corporate arena, just one step below the likes of Bechtel.

<comment><USER6> It's easy for the farmers to stay out of Monsanto's way - don't use Monsanto seeds, stick to the seeds they have used before Monsanto came about.

A law reserving proliferation of GM seeds to inventors is no different than law preserving copyright in software. How can one support the latter and oppose the former?

<comment><USER5> Please read the article. It's about laws specifically created to stop farmers from saving seeds so they'll have to buy them from 'approved' sources.

<comment><USER7> Really? The article talks about what external parties _think_ about why these laws are being written, but doesn't any provide any direct evidence. And none of those even talk about "approved" sources.

</comment></comment></comment></comment><comment><USER8> Technically all things have APIs, but some need API keys. [http://i.imgur.com/wtCYWyE.jpg](http://i.imgur.com/wtCYWyE.jpg)

</comment><comment><USER9> Could someone please tell me why intellectual property protection should even be a thing?

<comment><USER10> Why would any commercial entity invest in things like drug development, crop development, etc; if the moment they actually bring something to market it's trivially copied and sold at cost?

<comment><USER9> I'm not sure why I'm getting downvoted; it's an honest quesiton. Why does a business have to base its profits around a particular implementation of a thing?

<comment><USER4> Errr, "a particular implementation of a thing" cannot be patented. It might be copyrightable (in the US, things with no creative content like a telephone book cannot be protected by copyright).

GMOs are much more like inventions protectable by patents than creative works, like, say, an artificial form of life based on silicon. Not entirely different in principle than building a machine out of different mostly pre-fab parts, the combination of which is an invention.</comment></comment></comment></comment>


Pharmaceutical Executive Sentenced To 66 Months In Prison In Opioid Trial - <AUTHOR> https://www.npr.org/2020/01/23/798973304/pharmaceutical-executive-john-kapoor-sentenced-to-66-months-in-prison-in-opioid- <comment><USER2> "The sales executive hired a stripper as a Subsys sales representative to help persuade doctors to boost prescriptions. The woman, named Sunrise Lee, eventually was promoted to oversee a third of the company's sales force."

This is begging to be made into a movie.

<comment><USER3> Executive Producers: Richard Gere and Julia Roberts

<comment><USER4> I'm gonna just go on a limb and guess that this was downvoted into the greys by people who never saw the movie "Pretty Woman" where this was _very nearly_ the exact plot as the news story here and therefore completely missed the irony:

It _was_ a movie.

<comment><USER5> Not really. [https://en.wikipedia.org/wiki/Pretty_Woman](https://en.wikipedia.org/wiki/Pretty_Woman)

I have to say, simply because the woman was a stripper does not preclude her from being an effective manager. Perhaps the article could have spent more time talking about dubious moral and unethical things that she did rather than her past history of removing her clothing.

Profiling like this is only necessary when your life is potentially in danger, like being a cop in a dark alley. We're a modern society, can't we treat everyone as individuals to be respected?

<comment><USER4> May I kindly suggest a watch of the movie versus a read of an abridged plot from Wikipedia to see the associations I've drawn between this story and the movie?

The parallels aren't complete nor exhaustive but the way Gere's character repeatedly parlays his relationship with Roberts for professional and social advantage (which is only one instance talked about in said wiki article) is one of the more prevalent themes in the film I and presumably the commenter I relied to are alluding to when connecting these dots of "art imitating life".

This isn't an ethical argument about how effective sex-workers are in non-sex work careers but a critique of the power dynamics between two individuals. One who merely happened to be a sex-worker.

<comment><USER5> Julia Roberts was a prostitute which was an illegal job. Stripping is generally not illegal.

I also don't recall anything in the movie about her managing anything, but perhaps I missed that. It was quite awhile ago. And if I recall, she encouraged Gere's character to act in a more honest manner.

Really, there seems to be very little connection here.

<comment><USER4> Again you seem to think I'm drawing the comparison as a way of making a value judgement about sex work and those who engage in it.

 _That's not what's happening here_.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> > "I didn't think of who we were at Insys and how unethical what we were doing > was," he told the judge on Thursday, according to Bloomberg. "The only thing > I could think was how could I keep up with the fast and furious pace > necessary to get ahead."

Sadly, I think people really do get caught up in the pace and don't think about anything else. No excuse though.

</comment><comment><USER3> How many other people deserve to be right there with 'em?

There's this whole other version of the rat race / climbing the ladder that is either new or I just didn't know about:

If you can be adjacent to the people who can be blamed for something, you get to keep all the bonuses and not go to jail. Unless they find a way to blame the whole thing on you.

<comment><USER7> You have to think this is mostly a political show trial, with the main government players hoping to make a name for themselves for some future enrichments yet to be named.

If as a side benefit, some execs think twice about pushing addictive pills to people who want them, I suppose that is a good thing as well, but to see this as much more then just a way for the prosecutor to "make hay" I feel misses the point.

<comment><USER3> Absolutely. What galls me though is that in 30 years, when prosecuting things like this have long gone out of fashion, our grand kids will be having this very same conversation.

</comment></comment></comment><comment><USER8> "U.S. District Judge Allison Burroughs explained that she reached the lesser sentence after considering Kapoor's advanced age and philanthropy" \- So if you are going to hook people on your drugs, ruin their lives and make billions off of them, as long as you give some of it away that makes it better. Uh, ok.

</comment><comment><USER9> How is being old a reason for a short sentence. Is being young an excuse for a longer sentence?

<comment><USER10> It's just one of many whiny tools in a lawyer's toolbox.

The irony being that all those dead opioid users didn't have the chance to be old.

</comment></comment><comment><USER11> 20+ yrs ago Pharma was pushing doctors to use opioids more liberally since the manufactures said that they were safe for people that really needed it. Now we see that that was a mistake.

I suspect that we are heading in the same direction with pot. In the future, we will be looking back and wonder why we were not careful with the use of it. I think it should be legal but it should not be treated like its use has no consequences.

<comment><USER12> One difference: it's impossible to die (immediately) from marijuana.

Opiods? Yes.

Asprin? Uh huh.

Alcohol? Absolutely.

Like tobacco, week can be harm you, but only over a long period of time.

<comment><USER13> It may be that I'm not familiar with US English expressions, but it's not clear to me if "Uh huh" means yes or no. Based on context my guess is "yes", but I honestly don't know.

If I try to pronounce it to myself, I can do so with intonation that indicates either.

I really don't like to be the guy who is nitpicking, but in an international forum such as this it's helpful to be as clear as possible.

<comment><USER14> "Uh huh" generally means "yes". However, I think what might be tripping you up is that it is often used sarcastically to actually means "no".

In this case, I agree with you. It probably means "yes".

</comment></comment></comment></comment><comment><USER15> Why not the doctors?

<comment><USER16> In the early 2000s my entire state was littered with "pain clinics" which were just fronts for medically licensed drug dealers. Those are all gone now.

</comment></comment><comment><USER17> How in the hell did they charge $19k a month for fentanyl? The stuff is made on the industrial scale in China.

</comment><comment><USER18> Good. 5 years earlier would have saved lives.

If only they could go back and haul up all the tobacco executives from nursing homes and golf courses and do the same.

</comment><comment><USER19> Five years? All things considered? Lives ruined? Deaths? Etc.? Is a slap on the pinky finger. It'll be a country club prison. Sentence will be reduced for good behavior. Etc.

Better than nothing I suppose. But not by much.

<comment><USER20> It's definitely disproportionate to what a street level dealer typically gets for pushing an extremely small fraction of opiods relative to what these people were doing.

<comment><USER19> Right. He did the work of multiple dealers and got a fraction of the punishment. Evidently the criminal justice system has two problems. The victims and the loopholers.

</comment></comment></comment><comment><USER21> "U.S. District Judge Allison Burroughs..."

She's judged quite a few notable other rulings such as putting a hold on Trump's travel ban and the Harvard lawsuit

</comment><comment><USER22> It's a start.

Now do the Sacklers.

<comment> ryan-allen Is there any chance of that happening? This bloke is a "former billionaire", as opposed to a current one.

<comment><USER23> Also this bloke was a "Kapoor". So he probably had very little political clout/connections and was simply targeted for convenience and used as a sacrificial lamb to placate the masses. The Sackler's are cash multibillionaires ( not stock billionaires ) and they have strong politicals connections in the NY area, etc.

This case reminds me in some way of the Abacus trial. The only financial institution to be tried for the financial crisis was a small local bank founded by a "Sung".

[https://www.marketplace.org/2017/05/22/abacus-only-bank- char...](https://www.marketplace.org/2017/05/22/abacus-only-bank-charged- financial-crisis/)

You could watch a documentary about the case.

[https://www.pbs.org/wgbh/frontline/film/abacus/](https://www.pbs.org/wgbh/frontline/film/abacus/)

The Kapoor case, like the Sung case, is really a show trial.

</comment></comment></comment><comment><USER24> Title typo to fix: "eecutive" \--> "executive"

</comment><comment><USER25> There is a typo in the title.

</comment><comment><USER26> This is a blow for anyone wanting to 'legalize all drugs'.

<comment><USER27> I don't think so, except inasmuch as confirmation bias will lead anyone with an anti-legalize-drugs bias to construe this as evidence for that position.

The incentives for these actions can come in part from artificially high prices. More legalization gets you more players, and could perhaps dilute the power to use the machinery of doctors, drug companies, etc. as a top-down drug pushing force.

Additionally, society tends to build up immunity with exposure. You can get more irrational behaviors with highly controlled or scarce things. In the short term, introducing a lot of free/legalized drugs into an already constrained society could increase damage, but for the long term? Not such a clear picture, in my opinion. Perhaps a slow loosing to allow society to adapt.

Honestly, I see very little here to make this a blow against legalizing drugs besides confirmation bias for those already against it.

It also leaves out the cost of the war on drugs, which you would, in a rational analysis, need to compare against the cost/problems of legalization, as the cost/problems of the war on drugs go down. Which one costs more? Organized crime takes a serious hit with legalization, a secondary benefit. Consider Prohibition in the United States. Alcohol's a drug, actually a fairly destructive one. Why did they repeal it?

<comment><USER26> "Honestly, I see very little here to make this a blow against legalizing drugs besides confirmation bias for those already against it."

I don't see Budweiser execs going to prison for selling alcohol that resulted in someone become addicted or killing someone in an accident...which is most likely killing many more people per year than any other drug.

"Organized crime takes a serious hit with legalization"

This one has been proven false with MJ legalization. In California, for instance, legalization has only gotten more people interested in using and then when they realize they can get it for cheaper on the illegal market, it's put many legal shops out of business.

With legalization comes higher prices (and possibly shortages and the inability to get it whenever you want). As a result, it has really done nothing to curb organized crime or illegal sales.

This was only my theory before it was legalized, and now it has been proven correct. I guess drug users don't really care about paying their fair share.

This was from a year ago, but things haven't changed much:

[https://www.latimes.com/politics/la-pol-ca-gavin-newsom- crac...](https://www.latimes.com/politics/la-pol-ca-gavin-newsom-crackdown- pot-black-market-20190219-story.html)

"Consider Prohibition in the United States. Alcohol's a drug, actually a fairly destructive one. Why did they repeal it?"

It only worked because they stamped out corruption and killed/jailed all of the organized criminals involved in the illegal booze business.

With drugs, it's already gotten too big. The corruption in Mexico is at another level. The cartels run the country. The illegal market will never go away, especially since they don't have to deal with regulations and can provide a cheaper product (which will always be the case).

<comment><USER28> > With legalization comes higher prices (and possibly shortages and the > inability to get it whenever you want).

This isn't actually a feature of legalizing trade in something. If you're just contrasting "legal drug sales" with "illegal drug sales", the illegal vendor has much, much higher costs and isn't in a position to charge lower prices.

But California chose to impose ludicrously high compliance costs on the legal vendors, so high that illegal vendors can effortlessly beat them on price.

<comment><USER26> "The illegal vendor has much, much higher costs and isn't in a position to charge lower prices."

I disagree. Illegal vendors don't have to follow labor laws (they can get much cheaper labor), regulations (they aren't limited by the rules imposed by their state/city), and taxation (they aren't paying extra taxes on top of their current costs).

All of these equal lower prices. The legal market will almost never be able to complete with the illegal market, for these very reasons.

"But California chose to impose ludicrously high compliance costs on the legal vendors,"

We were told that when MJ was legalized, all illegal vendors would go away and the state would see a boost in tax revenue. Where do you think this extra tax revenue comes from?

Don't drug users want to pay their 'fair share' That I keep hearing about? The reality is they don't really care about paying any taxes and just want their drugs at the cheapest price. The current state of illegal sales clearly shows this.

</comment></comment></comment></comment></comment><comment><USER29> Great. Now do zuckerberg. Perhaps inarguably more mass destruction.

<comment><USER30> > "Perhaps inarguably"

Two words you rarely see together.</comment></comment>


Format string vulnerability found in 'sudo' - <AUTHOR> http://www.sudo.ws/sudo/alerts/sudo_debug.html

<comment><USER2> This vulnerability is reassuringly difficult to exploit under normal conditions. On this dreary morning in San Francisco, against my better judgement I've taken a crack at it (On most systems, due to a combination of old compiler AST-optimizing hacks and security methods, using techniques like information leaks through %X%X stack printing and Null pointer dereference bugs through the infamous %n specifier are challenging and virtually unexploitable on modern systems). Luckily (for blackhats and the curious), due to the way memcpy() works, I think, like the famously exploitable 'unexploitable buffer overflow' that existed solely in 32-bit Opera, this vulnerability is easier to exploit than it would be in real-world environments where system administrators don't even know what Data Execution Prevention and write protected memory pages are, much less turn them on.

Here's how it breaks down

For reference, here's the basic idea of Memcpy on x86

            movl    LEN(%esp), %ecx
            movl    SRC(%esp), %eax
            movl    DEST(%esp), %edx

So you the general premise of exploiting format string bugs if you've never seen them before (and if you're a young person like myself, It's entirely possible this is the first C format specifier bug you've ever seen in a major piece of software, yet again, Finite Field analysis scores another victory for the Static Analysis Team. Take that fuzzers!) is to either use clever format specifiers (%X, and %N as mentioned above are some old school faves) or to take advantage of lower system calls like brk() that can be indirectly abused through calls that accept format specifiers as an argument, but I digress.

So, the user arguments are stored in the above registers. To exploit this vulnerability, you must have control of the length argument which is stored in ECX general purpose register as you can see from this code snippet.

            cmp     %eax, %edx
            jx      link(copy_forward)
            je      L(fwd_write)
            cmp     $32, %ecx
            jge     L(fmt)
            jmp     L(get_prog_name_offset)

So, the user arguments are stored in the above registers. Before things like ROP, to exploit these vulnerabilities the attacker must have control of other, more directly meaningful arguments such as EIP (Which if you control EIP, why bother setting up some complex staged format string exploit?) and hoped that an external task would reboot this binary if it crashed, and keep trying until you beat address space layout randomization at the entropy game, again, I digress. Regardless, The format specifier returned from getprogname() allows us to do some funky stuff like use "safe" format string specifiers like %c (Don't you just love that classic Infosec industry model where %x is 'dangerous' but %c is 'safe' and where breaking MD5 is a big deal but nobody checks the integrity of their login scrips?) to pop bytes off the stack, write an address either to a stored instruction pointer that will be invoked later in the runtime of the program (and presumably will repair the stack before anything gets noticed by the OS) or to just get trashy and munge your local stack with a new EIP pointing to your shellcode (You can even have Null bytes in it, We're moving on up!). Of course, you're also going to have to be attacking a system running a filesystem with very, very, very long filenames, but I most modern ones support around 255 byte filenames, which is definitely not enough if you're using %c, but you could definitely exploit this bug with %o with a limit of 255 bytes.

The remaining, perhaps more difficult question still has to be asked -- Why is nobody taking compiler warnings seriously? Do you think compilers are just kidding when they say "Someone will use this to take control of any system that has this software"?

</comment><comment><USER3> In the source of sudo-1.8.3p1, the error is in src/sudo.c at line 1219. Relevant code snippet:

      easprintf(&fmt2, "%s: %s\n", getprogname(), fmt);
      va_start(ap, fmt);
      vfprintf(stderr, fmt2, ap);
      va_end(ap);
      efree(fmt2);

Obviously, fmt2 can still contain a format string, yet it is printed anyway with vfprintf. I'm really surprised this type of bug still exists. Doesn't every decent compiler warn the developer about this?

<comment><USER4> The real crime is creating a library function like printf without also creating a library function to escape format strings. Leaving safe escaping as an exercise for the application programmer clearly doesn't work.

<comment><USER2> This is like asking for SQL databases to have a SQL-Injection escaping function. You 'escape' format string attacks by using the C language in a correct fashion.

<comment><USER5> This is provided by MySQL, as an example:

[http://dev.mysql.com/doc/refman/5.0/en/mysql-real-escape- str...](http://dev.mysql.com/doc/refman/5.0/en/mysql-real-escape-string.html)

I'm sure what you meant was a server-side escaping function which is obviously pointless, but I did want to point out that MySQL's client driver does ship with one that you can use so you don't have to write your own.

<comment><USER6> Actually, isn't the escaping done serversiden when using placeholders?

At least in Perl, there's no need to escape placeholder values explicitly. I believe the prepared statement is stored on the server, and then the values sent later. Of course the escaping _could_ be the work of the driver.. anyone know?

<comment><USER7> See "Prepared Statement Support" from <http://search.cpan.org/perldoc?DBD::mysql#Class_Methods>

Prepared statements are disabled by default and require MySQL >= 4.1.3. Instead, the driver does the placeholder replacement on the client, and prepare() does nothing clever at all.

<comment><USER6> hm.. could be useful information.. thanks

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Affected versions are _1.8.0 through 1.8.3p1 inclusive_. Ubuntu 11.10 is not affected (it's running 1.7.4). Ubuntu 12.04 (alpha) might be, which appears to be running 1.8.3p1, for a short while anyway.

<comment><USER9> Super. My gentoo boxes are 1.8.2, and are broken as expected.

      $ ln -s /usr/bin/sudo ./%s
      $ ./%s -D9
      [some debug output with garbage]
      Segmentation fault
      $

Bug is here:

<https://bugs.gentoo.org/show_bug.cgi?id=401533>

Looks like it's patched on x86/amd64 already.

OpenIndiana looks unaffected. It's using 1.7.4p4.

<comment><USER10> Yep patch is in Gentoo, I just did a sync and 1.8.3_p2 will be built.

</comment></comment></comment><comment><USER11> ArchLinux, in its current state, is vulnerable. I suspect it will be patched soon enough.

/me sends a note to the package maintainers anyway.

<comment><USER12> ArchLinux doesn't have package signing, so patching sudo isn't going to get you much.

<comment><USER13> Sure it does, as of earlier this year. <http://www.archlinux.org/news/pacman-4-moves-to-core/>

Still in beta though. Not very stable.

</comment></comment></comment><comment><USER14> Lion runs 1.7.4p6

</comment><comment><USER15> OpenBSD 4.9 and 5.0 are ok (both on 1.7.2p8)

</comment><comment><USER16> c is terrifying.^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^HComputers are terrifying.</comment>


Firefox Operating System: Finally Launched at Mobile Congress 2013 - <AUTHOR> http://www.technogist.com/2013/03/firefox-operating-system-launched.html

<comment><USER2> I wonder what kind of future expect the late entrants FirefoxOS and Ubuntu. I wish success for both. The challenge is big. They lack the momentum and big pockets of established rivals, Apple, Google and Microsoft. But there are some interesting factors that would be in their favor.

First are the apps. As for Ubuntu, developers love Linux. That would help to get apps ported. Plus Ubuntu have the recently introduced webapps integration, that provides unity integration for selected webapps. I expect that they will improve this feature, and include more apps. Then there is the choice of QT as the UI toolkit. This is a good choice, because QT is proven and has a big community of developers.

Meanwhile FirefoxOS relies on the traditional web platform, a popular and accessible environment for developers, that is currently improving relatively fast. The web, enhanced with the mobile APIs that Mozilla is working on, is probably enough for almost all productivity apps. And with webGL, it is becoming good for decent gaming. Web development has the advantage of being portable across platforms. That lower costs. And it is relatively easier and cheaper to find developers for it. These are facts that should not be ignored.

So both Ubuntu and FirefoxOS, are offering an attractive development proposition. From a pure development standpoint, I much rather prefer both Ubuntu and FirefoxOS alternatives, than Android Java or Apple objetiveC.

There is a strategical factor: Android device manufacturers fear Google. It is the most powerful web company in the world, controls Android, and also owns Motorola. So it competes with device manufacturers. That is too much power. And who knows if it decides to become like Apple at some point. So device manufactures, should be open to examine alternatives, as a countermeasure against Google excessive power. Both Ubuntu and Mozilla are solid software companies, that seems unthinkable to become device manufactures.

As for windows, I can imagine device manufactures waking up from nightmares, screaming at midnight. Dreaming about a mobile world dominated by Microsoft, where they would have to pay a big fee for each windows license, out of their thin margins. It is also relevant the interest of big third-parties. Big players like Facebook and Amazon, would feel more comfortable, if their apps were running on OSs not property of their rivals, Google, Apple and Microsoft. Where these could implement strategies, to undermine the former.

Linux as a gaming platform is on the rise. Steam, the Ouya, Nvidia project shield, etc. There are more incentives to consider games for Linux. Making porting to Ubuntu mobile easier and more enticing. And webGL appears poised for a brilliant future. So both FirefoxOS and Ubuntu could be good gaming platforms.

I hope that with the help of these factors, they at least can establish a sustainable presence on the market, and are able to build from there. I would be happier with a world where open OSs are present on the mobile market.

<comment><USER3> I could see Ubuntu become the main alternative to Android for manufacturers, because Canonical will make it easy to piggyback on Android drivers, so it should be very easy for manufacturers to port Ubuntu to their devices. It also gives them at least as good customization power as Android, and the hacking/ROM community are going to love it, which I think is a good way to get people excited about a device/OS online these days.

WP8 doesn't give them any of that, it's been stagnating at 2% for more than 2 years and a half, and besides perhaps helping Nokia a bit (while being a much smaller company than they used to be, so easier to be "satisfied" with it), there's nobody really benefitting from supporting it in terms of sales. So Ubuntu would be a great WP8 replacement there, and as a strong customizable alternative to Android.

As for Firefox OS, I guess it depends on how well this ChromeOS/FF OS thing will work. And if it does, it probably only works on the low-end, at least for the next 5-10 years, when data will be so cheap, that using web apps won't be a problem anymore (although you can still use "native" web apps in FF OS, just like in Ubuntu Touch, so I guess there's that, too).

But since FF OS is going to be used mostly on low-end devices, that means it could be on a lot of devices as well, so it could do well in terms of market share (or at least well enough to give a company like Mozilla good revenues). For the same reason, I don't really see FF OS and Ubuntu competing with each other, since Ubuntu will be more on devices with at least a quad core A9/A53 or dual core A15/A57.

The only way they are competing with each other is manufacturer's attention. Some of them may not be ready to take on more than 2 operating systems at once, and if they have already committed to FF OS, then it might take stronger persuasion to start supporting Ubuntu as well, to have an alternative for high-end Android devices.

Android will continue to compete with both, at the low-end and at the high- end, although I think Google needs to make Android 5.0 a little leaner to put it back into the Gingerbread-range of resources needed, if they want Android to go hard into the sub-$50 phone market.

<comment><USER4> Firefox OS uses the Android kernel, so it benefits from Android drivers, too.

</comment></comment></comment><comment><USER5> I'm looking forward to a more open development model, than the "dump here is the latest code" model Google seems to be using.

<comment><USER4> Patches accepted! :) <https://github.com/mozilla-b2g/>

The Gaia repo contains the JS application frameworks and system apps. The Gon repo is the Android-based kernel and userspace. I believe the name Gonk refers to the small rectangular robots from Star Wars.

</comment></comment><comment><USER6> _Firefox OS devices will be first opened to the markets of the following countries: Brazil, Colombia, Hungary, Mexico, Montenegro, Poland, Serbia, Spain and Venezuela._

Wow this is the first global company I've seen opening up first to countries outside Western Europe + US/Canada. I wonder what the motivation for that is.

<comment><USER7> Spain is in Western Europe

<comment><USER8> Telefónica, the main spanish telco company, is one of the Firefox OS partners.

</comment></comment></comment><comment><USER9> > In this article, we will talk about the new operating system made by > Firefox.

Seriously? You really shouldn't put such blunders in bold. Not on a site named "technologist".

</comment><comment><USER10> I guess it's good that Firefox is doing this, but kind of like the Ubuntu mobile project, I just don't think it's going to make much of a dent.

Consumers don't care about technology ideology. Native vs web, NOBODY CARES!

Consumers want their apps. They want to play games. They want instagram. They want beautiful hardware and lots of accessories.

The only place in major markets where a Firefox OS stands a chance is low cost prepaid like Virgin Mobile USA, Straight Talk, etc. but there are enough good android options and even iPhone now, that it might be too late.

Maybe it could take off in some other countries, but I don't see Firefox OS taking off like the original Firefox did.

<comment><USER11> > Consumers don't care about technology ideology. Native vs web, NOBODY CARES!

You are absolutely correct. And when they sell these for $50 a pop in Africa, South East Asia and Brazil people will be happy they didn't have to buy the $600 iPhone or Android.

These devices aren't even schedules to arrive in the US till mid to late 2014. And by the time they do they may have a strong enough foothold with developers and existing websites to have leverage with the US carriers.

<comment><USER12> Why would you think a firefoxOS device is going to end up cheaper than Android, when both OSes are open source and linux based?

<comment><USER13> As I understand it, Gecko has significantly lighter resource demands compared to Dalvik. Andy Rubin himself, speaking on FirefoxOS, has said that there are simply places where Android cannot go.

Cite: "There are places where Android can't go," [Rubin] said, referring to memory and other hardware requirements. Firefox can help reach those. "For certain markets, it makes sense." [[http://allthingsd.com/20130226/googles- andy-rubin-on-firefox...](http://allthingsd.com/20130226/googles-andy-rubin- on-firefox-os-in-general-i-feel-friendly/)]

</comment></comment></comment></comment><comment><USER14> Really? I was starting to think this would be the "Duke Nukem Forever" of operating systems.

<comment><USER15> I don't know how you could seriously say[0] that.

[0] <https://en.wikipedia.org/wiki/Firefox_OS#History></comment></comment>


Cisco Nexus 9000 Switches Allow SSH As Root - <AUTHOR> https://nvd.nist.gov/vuln/detail/CVE-2019-1804 <comment><AUTHOR> If you have the Cisco 9000 Series, patch them now! This SSH backdoor allows an unauthenticated, remote attacker to login as root.

<comment><USER2> This is exactly why I only buy belkin routers. I can't even connect to it.

<comment><USER3> Ha! Thanks for making me laugh out loud.

</comment></comment></comment><comment> m-p-3 If a compamy as big as Cisco can screw this kind of thing so badly, the future of IoT looks bleak.

<comment><USER4> You know what they say: the S in IoT stands for security.

<comment><USER5> Can't wait for marketing people to catch up to this and call devices "SIoT" without changing anything about the product.

<comment><USER6> Perhaps "Security Hardened Internet Things" would be more appropriate?

<comment><USER7> Relevant: [https://twitter.com/internetofshit](https://twitter.com/internetofshit)

</comment></comment></comment></comment></comment><comment><USER8>
      > Cisco Nexus 9000 Switches Allow SSH As Root

Cisco Nexus 9000 Switches [have a vulnerability that Allows an attacker to] SSH As Root [over IPV6 using a default key-pair]

</comment><comment><USER9> An increased use of SSH keys for credential guessing is also found in our SSH honeypot: [https://pmcao.github.io/caudit/](https://pmcao.github.io/caudit/)

<comment><USER10> Heh - people are harvesting compromised secret keys then? Because "guessing" secret keys shouldn't be viable?

</comment></comment><comment><USER11> What product segment is this, what kind of organizations are likely have them?

Also, link to Cisco's own advisory: [https://tools.cisco.com/security/center/content/CiscoSecurit...](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco- sa-20190501-nexus9k-sshkey)

<comment><USER12> It's a switch used in enterprise data centers. It's pretty critical because servers plug directly into it.

</comment></comment><comment><USER13> This is a pretty egregiously editorialized title; what we know is that there's apparently an SSH keypair authorized on these devices, for which the private key is available on the device. That's a terrible, ugly vulnerability, but it's as likely due to stupidity as to malice.

The right title is something like: CVS-2019-1804: Cisco Nexus 9000 Switches Allow SSH As Root.

<comment><USER14> You're joking right?

It's "allow ssh as root with a publicly available ssh key". Your version is making it sound mundane.

<comment><USER15> If it was a genuine "backdoor" why would you want use a publicly available key?

<comment><USER16> Being the only keyholder reduces plausable deniability, so maybe.

<comment><USER14> The private key is on the shipped devices, from my reading.

<comment><USER16> Agreed.

I'm hypothesizing that you might do this, even with keys intended to be used as a back door, by shipping it on devices, you vastly increase the number of potential suspects for any backdoor abuse.

Continuing this train of thought - a hardcoded password is classic example of a backdoor, and just as "public" as including a private key.

</comment></comment></comment></comment></comment></comment><comment><USER17> Is there an explanation of why it's ipv6 only?

<comment><USER12> ACI control traffic is probably IPv6-only. They may be taking advantage of link-local addressing.

</comment></comment><comment><USER18> I don't own nor have I read the manual of one of these, and there's not much in the way of details on that page, but isn't this more like "use the factory- supplied default key to get in for the first time, then change it to your own"?

<comment><USER12> People are calling it a backdoor because presumably it was _not_ documented anywhere.

</comment></comment><comment><USER19> can someone help me understand this better.. Did Cisco leave a user public key in the switch and the private key has leaked ? To exploit this vulnerability attacker has to get hold of that private key ?

<comment><USER20> The keypair is essentially some default known value.

You shouldn't be able to use this to connect at all, but apparently works over IPv6.

So you'd have to have the private key, as well as knowing the IPv6 address of the device you're connecting to, and that device would have to have a route to the internet or a location you could connect to it from.

<comment><USER19> Any idea why it works for v6 but not v4 ? SSH authentication itself is agnostic to the IP version, no ?

</comment></comment></comment><comment><USER21> This is a nasty one! Sloppy in hindsight.

There is one bright side to otherwise disgraceful incidents: All the customers running older versions are now forced to upgrade to the latest versions. The burden of supporting really old versions suddenly vanishes.

Box vendors should really stop selling unmanaged boxes/solutions. In reality, customers end up buying service contracts anyway along with boxes. Instead, sell usage/service/connectivity and manage the hardware. A critical patch like this one could then be applied before a PSIRT is released. Frequent upgrades(security patches or feature/bug fix patches) are now commonplace. The user experience would be so much better if the solution were managed by the vendor (cloud managed).

<comment><USER22> Most places (especially where they have enough money to be buying Cisco Nexus 9k kit) will want some sort of change management, not the vendor to be making arbitrary changes to their critical infrastructure.

Also, given the number and severity of these sort of vulnerabilities in recent times, do you want to give the same companies remote access to your infrastructure as well? :)

</comment></comment><comment><USER23> I worked with Cisco a lot in the past. I am so happy we have more and more open source alternative to replace all those network solution vendors.

</comment><comment><USER24> I surely can't be the only one who sees open down to the hardware replacements as the only solution to this type of problems.

<comment><USER25> As a former Cisco employee, I can tell you why companies never want to open source their security-sensitive products:

Pros of open sourcing a product:

\- fewer total number of vulnerabilities

Cons of open sourcing a product:

\- more publicly-known vulnerabilities

\- less effort required to find new vulnerabilities

The product might be more _objectively_ secure, with more bug reports and more fixes.

But it will be less _practically_ secure. There will be more known vulnerabilities, and many customers can't upgrade, leaving more total vulnerable customers. And worse, now anyone on the internet can try and find new vulnerabilities for $0, while before they'd need to buy a $1,000+ piece of hardware to even get a shot at the compiled code.

The real defense against this problem is security auditing. Security engineers try to hack the device while asking a bunch of questions about SSH connections and private keys. This is the technique most companies employ, often combined with bug bounties.

<comment><USER26> Auditor: "Question 1. Did you manage to add backdoor keys to your production build?"

Auditor: "Big surprise. We once again recommend that you use a build system. Question 2. ..."

</comment></comment></comment><comment><USER27> Dude, Cisco, you had one job.

<comment><USER28> And they completed it successfully. They literally had a new backdoor _every month_ for years now. No company is _that_ incompetent unless ordered to be so.

</comment></comment><comment><USER29> Are this devices normally left with accessible 22 port in the wild?

<comment><USER30> A Nexus 9K is an expensive piece of kit, and is not a trivial switch to deploy what with VPC and other configurations being commonplace, so just powering it on will not deliver a workable product. I suspect most if not all deployments follow best practice and have a management VLAN with access lists control limiting the source address of the connecting client, and blocking access to port 22 from other networks.

 __* Edit __* Plus the Nexus the backdoor is only relevant if the switch in using ACI, and not standalone NX-OS mode. ACI training is a 5 day course for advanced engineers.[https://www.cisco.com/c/en/us/training-events/training- certi...](https://www.cisco.com/c/en/us/training-events/training- certifications/training/training-services/courses/configuring-cisco- nexus-9000-series-switches-in-aci-mode-dcac9k.html)

</comment></comment><comment><USER31> Western governments: Huawei needs to be banned from our collective infrastructure because backdoors

Also western governments: Cisco will remedy their errors

<comment> King-Aaron HackerNews: Huueerrggg Huawei can't even write secure code

Cisco: Hold my beer

<comment><USER32> The Huawei stuff is pretty bad, but the comments read like they've been copied pasted each time here. It's the exact same talking points.

<comment><USER28> Because the anti Huawei talk is obviously not in people's interest. Just look how zero politicians worldwide lament that Cisco should be banned from anything related to internet infrastructure despite showing _again and again_ that they are unwilling to stop implementing backdoors. Cisco makes it obvious that backdoors are A OK as long as it's our backdoors. No one acting against Huawei actually cares about peoples security.

<comment><USER31> Is it xenophobia masquerading as national security, or national security masquerading as xenophobia?

Neither... it's nothing but hegemony with the pretext of both.

</comment></comment></comment></comment></comment><comment><USER33> Huawei you all feel about that now?

This is a true backdoor, not some silly telnet left on.</comment>


Halo Creator Unveils Its Next Masterpiece, a Persistent Online World  - <AUTHOR> http://www.wired.com/gamelife/2013/02/bungie-destiny/ <comment><USER3> This is an interesting tease. I'm not sure why they are teasing it (presumably to get developers) but conceptually from a game perspective it could be interesting.

I played World of Warcraft from 1.0 (actually 0.9 but whatever) to 4.0 (a bunch of years, I've got the pets to prove it :-) Felt it finally completely jumped the shark with the Panda thing and the simplification of the world to the point of banality. As I told the Blizzard guy who surveyed me about it, I don't go into the library at the Middle School to play DND with the kids there using rules they can understand, I _do_ play complex scenarios with other adults. I think Eve Online gets this, Blizzard has yet to internalize it.

WoW was created to compete with EverQuest, which it did, way more successfully than even Blizzard expected. But it ran into the problem that the storyline, while interesting, and which character progression suitably nerfed, it got boring. And adding new story lines helped, but they had to add better gear to keep people grinding for it, and the basically I think they ran into the law of diminishing returns. Making your character twice as powerful was cool, but it made the previous game a bit silly, doubling that again and now you could single-handedly waltz through the old end-game raids (which had been designed for 40 simultaneous players in their best gear), and the dissonance gets to you. It's kinda fun, like God mode, but it's also hard to imagine a world where you could be this powerful and everyone else couldn't just fix the worlds problems without you. When the story line is "we're under seige by the forces of evil" and your character, through a series of quests, singlehandedly overwhelms all that evil? Its like reading Nancy Drew mysteries instead of Agatha Christie mysteries. To simplified to be enjoyable.

Then there is Eve Online, which is similarly durable to WoW and yet has a much larger percentage of retained adult participants. I expect for the reasons that Eve does _not_ constrain the behavior and doesn't make it "digestible" to people who don't understand that money can buy power and power can be manipulated. Compare getting into a high end Eve Corporation with a high end WoW guild. Interesting difference.

And then there is the business model. Everquest, WoW, and Eve, all have pay- per-month subscriptions. That is nice, but Zynga and others have shown it can be just as, if not more, profitable for the company to run the internal economy. Something Blizzard shied away from on WoW, embraced on Diablo 3, and Eve has had I think a mixed relationship with (but I may be completely wrong on that I'm not as familar with the online Eve currency market)

That suggests that there may be a market for a persistent world, with 'stories' for interest but not necessarily character gain, an environment where you every bit of content is available to you (perhaps not as successfully as you would like) from the moment you log in, and where you can use economic means or game-play means to achieve goals. Combined with a system for mixing up character strengths, items, and what not. With the game company running the economy, and taking a tax on that economic growth to fund the actual game. You have to be willing to bet that for everyone out there who will diligently cut rocks or what ever for a .001% chance at a powerful gem, there will be 10, 100, 1000 people who will just fork over fifty cents to a couple of dollars to just buy one. And playing the average revenue per gamer game rather than the monthly fee model.

Bootstrapping something like that will be extraordinarily hard, but if successful consider how much Blizzard would have profited if they had been the 'gold farmers' which at one point was estimated at a several hundred million dollar a year business in its own right.

Tending something like this, keeping it fun and profitable will also required very deft execution since it is tempting to take too much money off the table early on.

I hope the Bungie guys pull it off.

<comment><USER4> I think Eve did two things to embrace their online economy - hired a real-life economist to oversee changes and study it, and brought buying and selling of timecards with in-game currency into the game directly. Previously, you could buy timecards outside of the game and offer them to people, but you had to use external means to do so - forums, IM, email etc, with no guarantee of security. CCP went and made an in-game item for the timecards that you can buy and sell directly. By embracing that process they made things more secure for the players, and knocked down an barrier to their in-game economy.

I think you have a point about Eve seeming much more 'grown-up' - <USER2> sociology of the game was extremely interesting to me when I played. How alliances formed, mustering up hundreds to thousands of players at the same time for attack and defense, grand strategy, economic effects on alliances and wars, etc. I was in Goonfleet at the time and a lot of what was happening in game and in corp for command and control was evolving into something resembling how the real-life military does things - I was in the USAF at the time and could see the similarities. Stuff like chat rooms for operations, how fleet command was handled, position updates, alerting procedures (Goonfleet had a Jabber server that was used to send out messages telling people to log on for battles).

</comment></comment><comment><USER5> It's amazing to see the path Bungie has traveled. They made a couple of Macintosh games in the early 90s, then had a breakout hit Marathon in 1995 on the Mac, back when serious gamers played Doom on the PC and laughed at the Mac (maybe they still do?).

When I was a kid with a Mac, wanting to learn to program games, I read this interview over and over: <http://marathon.bungie.org/story/jasonjonesTofTMPG.html>

I had to read this again to remember that the original Marathon game had taken three developers a little less than a year.

And on re-reading it, it's great to see how much solid, long lasting advice there was in that interview.

<comment><USER6> Also interesting that this new game is called Destiny, and the word 'Destiny' is the last thing you see in the Marathon series (ie. when you complete Marathon Infinity).

<comment><USER5> What I remember about Marathon isn't only that it was a fun, playable game, but also the story arc and it's level titles' semi-serious references to military history, such as "Waterloo Waterpark" and "My Own Private Thermopylae".

It's nice to hear they're continuing that story arc.

<comment><USER6> I think the story is one of the best works of sci-fi ever... the terminals play with storytelling/narrative in all sorts of ways.

</comment></comment></comment></comment><comment><USER7>
      Bungie says it has a whopping 350 in-house developers working on Destiny

Holy burn rate Batman! Maybe it's just me, but if that number is accurate, this looks like an "all-in" bet by Activision and Bungie both. If this project fails, Bungie will likely not survive and Activision would at least take a major hit.

If you think that's wild, pessimistic speculation, consider this statement:

       One thing that was made quite clear is that the game will not be subscription-based. Every presenter was clear in stating that players will not pay a monthly fee to participate in this persistent world.

<comment><USER8> Game developes are what, $80-150K/year on average (of all levels). Add benefits and tax overhead, makes it $110-180K/year. Times 350:

$38,500,000 - $63,000,000 per year.

(I don't know if they include artists, managers, executives in that 350 number, so it could be more, much more).

It's really not a crazy budget, movies break that all the time. There are multi-billion dollar game studios out there.

<comment><USER9> Your salary number is bit too high, in general, game developers make less than your average software developer.

Also, there is no way they have 350 programmers working on that project. That number has to include various types of designers, artists, and programmers.

<comment><USER10> Wait, what? Game development seemed like the most stressful/worst thing you can do in software, i'd never expect game developers to make less than average developer.

<comment><USER11> Game Developer Magazine runs a salary survey every year. The average game programmer salary in 2012 was a little north of $90,000. There are game programmers who make much more than that, but it is not the norm.

[http://www.gamecareerguide.com/features/1108/game_developer_...](http://www.gamecareerguide.com/features/1108/game_developer_salary_survey_2012.php)

</comment></comment></comment></comment></comment><comment><USER12> This has been rumored for years as Blizzard's (aka maker of World of Warcraft) next big MMO. It's cool to see all of those leaks and conspiracy theories add up, though they don't mention Blizzard in the article, just their parent (partner?) company Activision.

Here's my favorite one:

 _In February 2007, an episode of 30 Rock entitled Hardball aired and in the credits it said, "Promotional Consideration Furnished by Blizzard Entertainment." What makes this interesting is that no Blizzard products were featured. No Warcraft. No Starcraft. No Diablo. No World of Warcraft. However, Halo was featured in the show! So Blizzard was advertising for Halo in 2007? This was right before word got out that Blizzard was working on a brand new MMO and they started hiring "Science-Fiction Texture Artists." Coincidence? Maybe._

[http://obsoletegamer.com/could-blizzards-next-mmo-titan- real...](http://obsoletegamer.com/could-blizzards-next-mmo-titan-really-be-a- halo-mmo/)

<comment><USER13> As someone who has been on that team at Blizzard, those Halo rumors were the kind we laughed over. With the talent and experience in game design, lore and art which the company (and that team in particular) has access to, it seems silly to imagine Blizzard going out and borrowing a game universe from elsewhere to base a game on.

<comment><USER14> since you say it that way, i think it's true that Blizzard would create a StarCraft MMO long before it would create a Halo MMO

</comment></comment></comment><comment><USER15> "[Creator] Unveils Its Next Masterpiece" says a reviewer who has barely seen the game.

This is some horrible journalism right out of the gate.

<comment><USER16> It's video game journalism, my friend. Everything is 10/10, buy it now!

<comment><USER17> My personal theory is video game journalism is young enough to have largely missed the old fashioned long-form investigative journalism phase, so there isn't even a _history_ of strong journalistic integrity.

<comment><USER18> I think additionally there is a large audience that reads reviews and other gaming news to be entertained more than to be informed.

It's fun to get hyped up and excited about some upcoming game, it's not that fun to read a review about a mediocre game.

And if you are largely going to make your purchasing decisions based on what your friends are doing anyway, or if a game isn't a super high-ticket item for you, then it's not something you really need to chase down professional reviews for.

<comment><USER19> When done well, critical video game reviews are extremely entertaining. Zero Punctuation, for instance.

</comment></comment></comment></comment></comment><comment><USER20> Looks spectacular, but why does it have to be a _shooter_?

I still hope that someone will eventually make a large scale world _exploration_ game. Journey on steroids, basically.

<comment><USER21> The problem with exploration, especially at the AAA-level is that content costs a lot of money.

For multiplayer-centric shooters, the cost of maps and levels can be spread across a relatively long lifetime, millions of matches.

An exploration-based game by definition cannot recycle its content. Attempts to proceduralize world generation have been mixed - Diablo did it, but the world itself is not the focus there either, and other games have been torn to shreds for their repeated, boring automatically generated content.

Even open-world games like GTA are focused on specific locations in the game world, and you can see the amount of detail drop off precipitously outside of these areas.

Content is really, really expensive - today moreso than ever. An exploration- based, AAA-level game would have to solve a _lot_ of completely unprecedented problems.

<comment><USER22> Procedural generation doesn't have to be the generation of random content purely from algorithms alone. It can just be tools to automate artist work by allowing them to specify what content should be at a higher level.

For example, the artist specifies that he wants a road going one way, a river crossing it and a cliff that runs along one side and the terrain generator creates the level.

I have a video of this process here. The input is a graph specified by the artist as well as a bunch of other metadata that he specifies in text files: <http://www.youtube.com/watch?v=3PRsHyyFoaM>

I have done a talk on the terrain generator as well which you can see here if you like: <http://www.youtube.com/watch?v=GcM9Ynfzll0>

<comment><USER23> +1 yours is the best comment I have read so far.

Higher level tools really do speed up content creation. It was a long time ago, but when I worked at Angel Studios, we put a huge effort into infrastructure tools.

A high level scripting language driven generator with good fix-up editing capabilities sounds good.

All that said, I would imagine that large entertainment companies have great smart creation/editing tools, but they are probably kept under wraps.

</comment></comment></comment></comment><comment><USER24> Bungie's original plans (circa 1999) for Halo a.k.a. BLAM! were much closer to a large world like this, also with minimal guidance. The ring-world of Halo was supposed to be a large landscape, requiring you to engage in guerrilla warfare and letting you improvise your way through the game with the storyline unfolding dynamically.

I'm excited to see this project happen, I've been waiting 14 years for it!

<comment><USER25> Me too. Reading about this project made me think back to the first time I ever heard about Halo. I'm sure they won't be able to quite nail it, but here's hoping they get a bit closer!

</comment></comment><comment><USER26> I'm almost certain that every MMO since UO has claimed to be about having the universe's story be written by the players themselves. It never turns out to be true, with exception to maybe EVE.

<comment><USER27> That's more or less correct, and you can blame WoW for it. <http://www.youtube.com/watch?v=nvK8fua6O64>

</comment></comment><comment><USER28> I'm intrigued by the concept, but... XBox 360 and PS3? For a game that is going to span years? I hope to see an announcement of PC support at least.

<comment><USER29> GiantBomb also put up a video about this, and I agree with Gerstmann, I think this is really for next gen console not PS3 and X360, since it isn't coming out until 2014.

<comment><USER30> The pre-order page lists xbox360 and ps3 as target platforms <http://www.destinythegame.com/wheretobuy>

<comment><USER29> That's... surprising then. Because I don't see how you can have a 10 year game on a console that is about to be obsoleted.

Technically you can just move an account up to the next version of the same console, but that still seems... strange.

<comment><USER31> I expect it'll depend on which comes out first, the game or the new consoles. They seem optimistic that the game will come first, so they'll get loads of sales on the old hardware. Then when the new hardware comes out, you'll have to purchase it again to continue playing on your new hardware.

I don't really see anything wrong with this. I can't imagine it costs much to port from 360 to Infinity (and PS3 to PS4). They get a wider user-base, which is extremely important for an MMO, and many will buy the game twice when they eventually upgrade their consoles.

<comment><USER29> Except I seem to recall them saying it would not be in this fiscal year, which likely runs at least through this year (based on the giant bomb vid linked elsewhere in the discussion of this post). If so, the PS4 at a minimum is all but certainly coming out this year, and rumors are the neXtBox is as well.

We'll see though :)

</comment></comment></comment></comment></comment></comment><comment><USER32> I wonder how this will compare to the Eve Online / Dust514 universe?

Eve Online is a persistent mmo, and Dust514 is a console game which interacts with Eve Online for one-off battles.

See <https://dust514.com/>, <http://www.eveonline.com/>.

<comment><USER33> I expect it will compare favourably, except it's first person shoot-em-up style.

I wonder how it will compare to Entropia Universe (fka Project Entropia).

They've also had a persistent, single instance, MMORPG universe for a long time. They ended up introducing missions because people _didn't_ come up with their own things to do. They also have an open ended skill system with no levels. Higher skilled players tend to migrate to the more dangerous areas which cannot be safely travelled by mid-level or beginner players.

Biggest difference I can tell is console vs pc.

(Played EvE for ~9 months, WoW for ~14months, Entropia probably ~2 years over a 9yr period...).

</comment></comment><comment><USER34> If you want persistent online worlds created by the users you should look at Minecraft. Yes, it's blocks. Yes, it's mostly children. But the variety of different gameplay is remarkable.

<comment><USER35> > Yes, it's mostly children.

[Citation needed]

For anecdotal evidence, you can look at the number of "my [husband/wife] made this in Minecraft" posts on Reddit and so on.

<comment><USER34> For anecdotal evidence you can look at the age polls on Minecraft forums which show 60% are under 21.

Don't forget that reddit isn't particularly child friendly, and yet even their the MC subreddit is younger than most of the rest of reddit.

<comment><USER36> Wow, I just ventured in there for the first time to confirm or deny your statement, and you are totally right. It is packed with kids. I guess minecraft is the new lego.

</comment></comment></comment></comment><comment><USER37> Hearing the developers talk about 10 years of content worries me. I know this is most likely a PR exaggeration, but creating a game that will occupy 10 years or anything close to that is a major responsibility. It would be almost immoral to create something that provides no meaningful experience and is just extended escapism. I obviously haven't played it and it looks exciting. I just hope it isn't made to make players feel super powerful, but ultimately fail to enrich a player's life.

<comment><USER38> This is an admirably socially conscious perspective.

</comment></comment><comment><USER39> Why do you have to refresh the page to change the header image? Wired can hit me up any time, I can fix that for them.

<comment><USER40> If it's anything like Yahoo! when I was there, they're resisting that because refreshing the page for every image displays another set of ads.

(It's 2005-era thinking, but the metrics for some ad networks are [or at least were] skewed to invite abuse of that metric.)

<comment><USER39> Oh thanks, that's a good point! Didn't think of that.

</comment></comment></comment><comment><USER41> Sounds like the world described in the book Ready Player One. Awesome read BTW.

<comment><USER42> My thoughts exactly. OASIS!

</comment></comment><comment><USER43> A bit premature to call it a masterpiece isn't it?

<comment><USER44> People are also assuming that Halo is a masterpiece. I don't consider it a masterpiece. It's a good shooter but that's about it.

It got the 3d shooting game mechanics right but Bungie is definitely standing on the shoulders of giant developers who created the masterpieces.

<comment><USER45> But it is the technical 'masterpiece' of the XBOX. It was the killer app on XBOX Live. And they changed the way other developers used the XBOX controller to input commands.

And somehow along the way, it became a household name.

<comment><USER44> EA, is that you?

<http://i.imgur.com/2SrLf.jpg>

</comment></comment></comment></comment><comment><USER46> So far as I can tell from the literature, nobody has licked the user-generated stories thing.

(Well, Eve has, in the sense that they basically built a sandbox and charge for time in it.)

There's lots of literature on building plots ahead of time. The only project that's come close to doing anything in JIT plots was _Façade_ , and that still relied on picking plot elements based on an overall dramatic arc in a very limited scenario. It also required enormous manual work to reach a usable state. (Look up the papers though, they're fascinating).

The basic problem is this: in an AOT plot generator, your system controls all the elements. Every character is controllable, every plot twist is controllable and so on.

Add humans and things get wildly out hand, because human players are thoroughly unpredictable.

So either you "railroad" the player, which destroys agency and the suspension of disbelief. Or you produce what is essentially random events, which destroys agency but might preserve the suspension of disbelief. Neither alternative is very satisfying.

What's wanted is a system that reacts to player actions, constantly replanning current events to satisfy a general plot arc.

I looked at doing JIT, automatic, reactive plot generation as an honours project but it's simply too big for a 1-year project.

Basically pen-and-paper RPGs with a smart, inscrutable GM are still going to be the state of the art on this for some time yet.

(Email me if you want the crappy preliminary research I did on this topic)

<comment><USER47> > So far as I can tell from the literature, nobody has licked the user- > generated stories thing.

Cryptic's new "Neverwinter" MMO aims to do this. How effective it will be is another thing entirely.

<comment><USER46> Pretty much everyone aims to do it. The publicity for just about every CRPG ever made, whether single player or MMO, talks about how amazingly immersive and dynamic and reactive it's going to be. So forgive me if I propose to wait and see :D

The thing is that you can go a long way with a sufficiently large, dense story graph. That's the direction that single-player CRPGs have moved in. But it's obviously a non-starter for MMOs.

</comment></comment></comment><comment><USER48> I really, really, REALLY hope this is not going to be console-only(which is what it's looking like at this point). I've yet to see a decent, popular MMO for consoles.

</comment><comment><USER49> Apart from having a story that spans 10 years (which, btw, actually undermines the goal of user generated content), what exactly is new about this? Almost every new MMO tries to be user centric.

I'm not seeing the: "We're not doing this just because we have the tech," .

</comment><comment><USER50> On a slight tangent, interesting that it's going to be multi-platform after being signed up as Microsoft exclusives for so long. I'd imagine it's mostly to increase their possible audience, but part of me wonders if it's because the split from Microsoft wasn't entirely without some burned bridges on both sides.

Which begs the question, have they found a way to share the universe between both platforms? That'd be pretty spectacular if they have.

</comment><comment><USER51> I sort of wish they hadn't sold on the Myth IP, because a) I _loved_ those games and b) I really enjoyed the world (albeit thanks, Glen Cook). An update of Myth II to run on, say, iOS and Android, with good multi-player support -- well, my boss at Apple used to tell me that the company'd go broke building software for me, but c'mon, wouldn't that be awesome?

</comment><comment><USER52> Seems like a french retailer [1] guesstimated the release date as being October 6th 2013. Note that I have no idea how reliable this information is, and I'm taking it with a wagon of salt myself..

[1] [http://www.cinemablend.com/games/Bungie-Destiny-Release- Date...](http://www.cinemablend.com/games/Bungie-Destiny-Release-Date- October-52643.html)

<comment><AUTHOR> Predicting the output and conclusion date of the work of 350 developers is not an easy task. I bet not even their CEO has a clear date in mind. The french retailer is probably just seeking PR attention.

</comment></comment><comment><USER53> I hate shooters, partially because your average 4 year can kick my ass at it. I'm still bitter at Mass Effect turning into more shooter than RPG, because that's what sells. Why oh why isn't there a persistent, space-based RPG for the single player that's awesome? Something like a KOTOR II, without the bugs.

</comment><comment><USER6> See also: _Huxley._ A game i really wanted to play but never got released seemingly.

<comment><USER54> I played the beta. It was Unreal with matchmaking, a little bit of PvE, and character development.

</comment></comment><comment><USER55> Halo + Ingress = Destiny

<comment><USER56> Yes, I was very intrigued by the way they represented off-line play. Its almost like you can continue to "play" on your mobile device even when you are not fully engaged in the universe proper. If they can pull this off it indeed would be a game changer.

</comment></comment><comment><USER57> Wasn't Triton supposed to be a Blizzard property? Is Blizzard's role here to contribute development and artistic resources to what will ultimately be a Bungie game?

<comment><USER58> The Blizzard project is titled "Titan".

<comment><USER57> Thanks! Maybe I won't have to get a PS4 after all. :)

</comment></comment></comment><comment><USER59> This game sound awfully similar to Richard Garriott's (short-lived) Tabula Rasa MMORPG.

</comment><comment><USER60> > Destiny, slated for release on PlayStation 3 and Xbox 360.

This is fucking irritating.

</comment><comment><USER61> Dibs on the Parzival handle.</comment>


Ask YC: Is it painful to develop with PHP/Perl/MySQL on Windows? - <AUTHOR>

I've been using OS X for a couple of years now and am proficient in the terminal. A situation has come up where I might be using a Windows notebook for a couple of months, and I'd like to know if there will be any challenges in using PHP/Perl/MySQL on Windows; as I said, I'm not very familiar with it any longer.
Based on some research, MySQL has Windows binaries available, Perl has ActivePerl (from ActiveState), and both PHP and Apache have binaries available as well.
The only thing I'm concerned about is if I'm going to have change anything in my scripts when uploading/deploying them to servers (running Linux). For example, Perl usually uses the #!/usr/bin/perl shebang. Or if some PHP and Perl extensions don't run under Windows.
Thanks for any help. <comment><USER4> I used to do it, I recall that it wasn't _that_ much of a pain to setup (like I spent a half day getting everything working and didn't worry about it again), but it was enough of a hassle moving code between my laptop and the production Linux servers that I went and learned vi, started developing over SSH, and eventually just bought VMWare and loaded up a Linux image.

The shebang line isn't really a problem - Windows servers just ignore it. IIRC, the Windows PHP and Perl Apache modules go by the file extension to determine which module to execute. This is probably in the configuration instructions somewhere...I just followed a tutorial on the web.

The parts that are really painful are:

1.) You have to be really careful keeping your code platform-independent - which is good practice anyhow, but can be tricky. Paths are the obvious problem - I was always forgetting and hardcoding backslashes instead of using whatever the PHP platform-independent equivalent is. Since the directory structures are different, you'll need to keep every path in a config file and reference them indirectly - again, good coding practice, but easy to forget.

2.) Some functions don't work the same between OSes - anything with symlinks, permissions, umask, or pipes is going to behave differently. IIRC most of these functions had sensible defaults (i.e. do nothing) and didn't fail outright, but keep this in mind.

3.) Calling out to external programs is a real pain. I think this is what made me finally switch - the app grew so that it needed to call out to UNIX-only command-line apps written in C, and I didn't feel like porting them to Visual C++.

That's all based off memory - it's been about 4-5 years since I developed on Windows, and 3 years or so since I last worked with PHP. Basically the upshot is that it's possible, but there were enough corner cases that for intensive work, I found it was better just to bite the bullet and get VMWare.

</comment><comment><USER5> I've done web development (PHP/MySQL) on both Windows and Linux, and Linux wins hands down for me primarily because of the number of useful utilities at my disposal on the command line and ease in moving around the directory tree.

However, packages like XAMPP help greatly in making sure everything runs smoothly when developing on Windows. Nothing in the PHP/MySQL code itself should have to be different on Windows, but configuration settings need to be tweaked prior to launch on a Linux box.

Caveats I can think of when moving code written in Windows to Linux is that Windows uses the backslash instead of the forward slash for directory paths, but I think newer versions of NT support the forward slash, too - <USER2> correct me if I'm wrong. Also, Windows uses a semicolon (;) to separate path variables while Linux uses a colon (:).

Windows also uses \r\n instead of just \n as a newline character so when/if you edit the code after porting to Linux, you'll get ^M characters at the end of each line, which I can't stand. A quick global search and replace restores my sanity though.

I don't have any experience at all using Perl on Windows, sorry.

</comment><comment><USER6> Use Cygwin for Linux like environment on Windows.

<comment><USER7> I swear by this. It's not perfect in many ways, but it's MUCH better than standard windows.

</comment></comment><comment><USER8> The phrase you want to Google is probably "XAMPP".

<comment><USER9> I'd also recommend setting up xampp to get going quickly - its pretty handy. For scripts and perl command line in win32 I found ActivePerl the best - <USER3> can get a version for free from here -> <http://www.activestate.com/Products/activeperl/features.plex>.

More info on perl on win32 here -> [http://win32.perl.org/wiki/index.php?title=Win32_Distributio...](http://win32.perl.org/wiki/index.php?title=Win32_Distributions)

</comment></comment><comment><USER10> Might it make life easier if you just ran Linux as a virtual machine with something like Virtualbox?

You can run samba on it and export the filesystem over to your Windows host, allowing you to work with all the stuff with Windows native editors.

Alternatively, just install Linux and do all your work inside of it. If you use WUBI (which the current Ubuntu Hardy offers) there's no need to repartition or anything and uninstalling it leaves the system in it's original state.

<comment><USER11> I would try the vmware route. The vmware player is free (I think the server verison as well), and you can boot any linux in it.

Use windows for developping, use rsync to transfer your changes to the vmware image (or use a shared disk, or mounted disk, etc...).

You will ahve much less hassle to install perl modules (they often require a compiler) and no path issues ("/ vs \")

</comment></comment><comment><USER12> I use linux for all my work perl/ruby stuff and I use Windows for all my home perl/ruby stuff.

The big question: are these scripts you are running yourself or deploying?

running yourself it's not that big a deal, because you can fix headaches as you hit them. Expect to be running CPAN a lot to grab modules. Expect to be re-writing any system calls to use similar functions in the language (your scripts will be better for it).

It is WAY easier to run linux on a virtual machine than it is to develop under Windows. Windows has a million and one quirks that will have you screaming if you're used to coding on linux.

If you have to deploy on Windows, I generally use perl2exe or rubyscript2exe to create a standalone exe -- usually less painful then trying to get machines to have matching perl distributions.

</comment><comment><USER13> I find it easier to develop in PHP/Perl on Windows than any of the other language/framework combos. Most of the frameworks these days are geared towards the Mac/Linux developer with extensive use of the command-line. It can still be done on Windows but it can be a PITA sometimes.

</comment><comment><USER14> I developed Eureka Science News (http//esciencenews.com) completely under Windows (using WAMP). Be sure to backup everything often though, catching a nasty machine-disabling adware on your dev box a week prior launch can be stressful (been there, alas)

</comment><comment><USER15> Depends on what you're going to use. Cygwin makes it easy. Using ActiveState + Native Win32 MySQL is going to be painful (I didn't have much success getting DBI/DBD::MySQL working in that environment, but that was a few years back).

</comment><comment><USER16> For the last 8 years, I've been developing LAMP projects on Windows and deploying on Linux. I don't have any trouble with PHP extensions nor do I have to change _any_ code to deploy on Linux.

</comment><comment><USER17> I've used XAMPP with PHP on Windows. Easy to setup and use. Supported toggling between PHP4 and PHP5 (I think the default was PHP4).

Currently I'm using VMWare and Ubuntu 7.x (be careful about using Ubuntu 8.x - I've seem to recall that VMWare tools may not have caught up and play well with that version yet).

I prefer the VMWare/Ubuntu approach for now since it will more closely mirror my intended deployment on Amazon Web Services (already started playing with an Ubuntu AMI).

</comment><comment><USER18> ive run apache, php, python w/ django, mysql, activeperl, and more on windows w/o issue. in fact, its been really easy to get just about everything going.

the only real problem ive ever encountered was that sometimes you'll need cygwin around to compile custom perl, php, or python extensions and modules. in the same vein, some (like orange, a data mining module for python) are made to be compiled with visual studio and can be a hassle to set up for anything else.

<comment><USER19> thats pretty amazing because i've found that python w/ django on windows really did my head in. so switched to linux!

</comment></comment><comment><USER20> I use perl on Windows all the time via Activestate, and it has no significant problems. The shebang doesn't matter if you use perl file extensions. Some Perl modules aren't on Activestate, though you can easily install them yourself and most of the time they work. I've found a few bugs, but not many.

</comment><comment><USER21> I can't speak to Perl, but PHP and MySQL are bone dead easy on Windows.

</comment><comment><AUTHOR> Thanks for the help.

I totally forgot about VMWare/VirtualBox; I'll have to look into them more. Seems easier that way, and I get to use the same OS that the server runs.

</comment><comment><USER22> If you like TextMate, TextMate compatible editor <http://www.e-texteditor.com/>

</comment><comment><USER23> Install Ubuntu on your notebook.</comment>