California Arrests the Owner of a Revenge Porn Site - <AUTHOR> http://www.slate.com/blogs/xx_factor/2013/12/11/kevin_bollaert_arrested_for_revenge_porn_california_s_move_is_a_promising.html?wpisrc=burger_bar <comment><USER2> You want to read a real story about this, Popehat is (as usual) your best outlet; he and Marc Randazza are coordinating an investigation of Craig Brittain, who appears to have set up a revenge porn extortion scheme using a fake "takedown lawyer" to enable victims to pay him to remove entries from his site.

Worth reading if only for extreme schadenfreude value.

[http://www.popehat.com/2012/10/30/the-takedown-lawyer- lets-h...](http://www.popehat.com/2012/10/30/the-takedown-lawyer-lets-help- marc-randazza-investigate-a-scammer-shall-we/)

<comment><USER3> If the photo is a "selfie" why can't they assert their copyright and force the photo to be taken down with a DMCA takedown notice to the web hosting company if the site owner can't be found or is unresponsive?

<comment><USER4> What happens if the site is hosted in anywhere but US?

<comment><USER5> Where ever it is, there would be local laws. Next,the US reserves the right to prosecute its own citizens even if they commit what the US thinks is a crime in another country, regardless of local law. On top of that, there may be an extradition treaty in place.

Then to stretch a bitter point.......

Failing all that, of course we know the US will kidnap.... sorry, "render" people.... All that's needed there is for them to define blackmail as a form of terrorism. Heh, then I suppose one could justify a drone strike!!!

</comment></comment></comment></comment><comment><USER6> If you need a primer for this horrible corner of the web, this is a fantastic and compelling article: [http://www.xojane.com/it-happened-to-me/charlotte- laws-hunte...](http://www.xojane.com/it-happened-to-me/charlotte-laws-hunter- moore-erin-brockovich-revenge-porn).

<comment><USER7> Interesting read, thank you. Still I can't help but to feel that the most sad part of this is all the commotion over an exposed left boob. That's actually a big deal? Don't get me wrong - I can totally relate to her feeling violated as it should be in nobody else's power to decide how her personal photos should be handled. I just can't let go of the feeling that perhaps if we had a more relaxed perception of the human body, this would be no more than a shrug and a would spare a lot of trauma.

We will never get rid of assholes, but that apparently _her job was in jeopardy_ because of this - and that this is seemingly accepted as okay as it isn't even questioned - was the real WTF realization for me. That is not the work of an asshole, it is the work of a truly degenerate society.

<comment><USER8> So long as there is a line in the sand of privacy, assholes will figure out how to abuse it and make people miserable.

And there will always be a line in the sand _somewhere_ , unless we completely abandon the very notion of privacy. It just so happens that line happens to be somewhere around "nudity" right now.

So don't get caught up in where the line is. For can you not picture the exact same story in Victorian times? "Oh, but if only we as a people were not so prudish, to be upset about an ankle..."

<comment><USER9> Of course revenge porn is disgusting, but I think more people should stand up and make it clear that what makes it disgusting is not so much the nudity, but the lack of consent and the aggression/humiliation.

I could be mistaken, but even in Victorian times, I think many people felt that being bothered about showing ankle was dumb, but didn't stand up because, hell, "everyone seems to be disgusted by it, don't they?"

I still believe the media should start emphasizing _how dumb it is to pester and punish people whose nude pictures got leaked_ instead of essentially saying, _" ooh, careful with your nude pictures or they might end up on the internet!!!"_.

<comment><USER8> _what makes it disgusting is not so much the nudity, but the lack of consent and the aggression /humiliation_

Is that not intrinsically obvious to everyone? Is there anyone saying, "We must shut down Hunter because he is publishing nudity"? I thought we were _all_ angered because of the lack of consent, aggression, and humiliation?

</comment></comment></comment></comment></comment><comment><USER10> Another "revenge porn" operator was on On The Media last week, and I've rarely had a more visceral reaction against another person in my life:

[http://www.onthemedia.org/story/revenge-porns-latest- frontie...](http://www.onthemedia.org/story/revenge-porns-latest-frontier/)

(EDIT: originally misattributed this interview as the guy arrested today; I was wrong.)

<comment><USER11> Really? I thought it was very humanizing and interesting to see the guy behind it all. He clearly caught up in the money and attention. Ofcourse he was a complete asshole, but he was self aware and felt bad about what he did. He is just the epitome of a troll - feeding off of other's misery. Schadenfreud to the Nth level.

<comment><USER10> That struck me as crocodile tears -- the telling moment for me was when Garfield asked him if he'd post pictures of his own mother or sister, and he reacted as if the question were completely absurd.

I decided then that he was either stupid, sociopathic, or both. In any case, you can't be sincerely sorry about that sort of behavior, and still do it regularly for fun.

<comment><USER11> The question WAS absurd given the context. He clearly explains right before that he does it because he enjoys doing the job - he enjoys trolling people, and he enjoys the money. He isn't doing it because he has some sick set of principles. He is NOT for instance saying that all pictures of naked people should be posted on-line or anything like that. So if he's doing it completely for his own enjoyment, why would he post pictures of his naked mom or sister? Why would he want to troll himself? Like he says, that doesn't make any sense.

The fact that Garfield didn't try to understand his motivations was what shocked him. Garfield's attempt at painting him as a sociopath was a wonderful piece of editing (and frankly defamation). Unfortunately OTM does this all the time. They feign objectivity for most of the interview, and then generally towards the end they editorialize in some small way so that they don't come off as sympathetic.

<comment><USER10> So, your logic is that because he's motivated by the enjoyment of making people miserable (without their consent), he's not a sociopath?

Garfield's point was that this is the thoughtless sadism of a cruel child, not that the guy is somehow _worse_ because he's unwilling to inflict the same pain on his family that he inflicts on strangers.

<comment><USER11> Please don't misunderstand, I'm not excusing his behavior. He's not a sociopath because she shows remorse and cares about the people around him. The guy wasn't making excuses for himself. He's not operating on some righteous framework, which Garfield's question implies. He's not saying he's doing it because he thinks it's the right thing to do. He knew what he was doing was wrong and he feels bad about it, but he was simply enjoying it too much to stop.

If I steal a candy bar and you ask me why I did it and I said "Well I felt bad, but it looked tasty and I really wanted it". Asking me then if it's okay for other people to steal stuff from me is a dumb question to ask. The only goal of the question it to try to shame me. The awkward silence was awkward b/c Garfield asked a dumb question. It was trying to shame the guy and show some hypocrisy. But there is no hypocrisy. He's fucking people over, and making himself rich. The guy already knows he's mistreating others.

</comment></comment></comment></comment></comment></comment><comment><USER12> I wonder if he's going to pay $250 to get his photos off of mugshots.com

</comment><comment><USER13> While 'revenge porn' is a scumbag move, women should be thinking twice when taking pictures of themselves naked (men too).

It's easy enough to send a picture to the wrong person, to lose your phone, to have your SO open the picture in a compromising social situation (in a meeting, public places, etc...), in addition to the 'revenge' scenario.

It's easier to simply not take the picture than to assume your ex won't be a douchebag after you break up.

<comment><USER14> And I suppose women should also think twice before putting on that slinky dress, or walking down that street at night, or going out with that guy?

Victim-blaming is victim-blaming, regardless of context. The person who behaved wrongly in these circumstances is the person who uploaded the pic to a revenge porn site, _not_ the person who took it, full fucking stop.

<comment><USER5> Ok, but what about personal responsibility in the real world? There is what we all should have the right to be able to do or , ha, ha, keep private (NSA, etc), and what is prudent or wise.

So, to exaggerate to illustrate.... It is a woman's right to walk down a dark ally in a dangerous neighborhood, dressed provocatively, how ever you define that, but, lets fact it, it isn't wise.

So, in some contexts, yes a woman should think twice about what she is wearing, where she is going or that guy she might be meeting. And frankly, so should men. No so much the clothes, but there are places I would avoid at certain time, and yes, there a some women I'd want to avoid.

As for "victim blaming", well, sorry, some victims are partly to blame, and should shoulder some of the responsibility. That does not excuse the offender, but it does have relevance. Both exist. And if you think that is wrong, then tell insurance companies and courts about limiting damage. "Was you car locked where you left it before it got stolen, sir?"

Oh, fuck, fuck, fuck.

Did those fucks make me any more correct?

<comment><USER15> > And if you think that is wrong, then tell insurance companies and courts > about limiting damage. "Was you car locked where you left it before it got > stolen, sir?"

"Rape Shield" laws are fairly common in the United States and elsewhere which prevents cross-examining rape victims about their past sexual history or submitting such things as evidence at trial.

This is done precisely to combat victim blaming and is much more relevant than your hypothetical "unlocked car" metaphor.

<comment><USER16> I think his point is that there are risk factors associated with choices and it's valuable to be aware of them and attempt to mitigate the risks.

Obviously the fault doesn't lie with the victim, but since the world can be dangerous it's important to be aware of that reality when making choices. If certain actions increase your risk (walking alone at night, taking naked pictures etc.) then it's better to consider that when making a choice in order to avoid potentially becoming a victim.

You're only in control of yourself - while we can and should strive to make changes to our culture and the system, that doesn't mean individuals should be blind to how their own choices may contribute to increasing their risk of being victimized.

<comment><USER13> Absolutely. We lock our doors at night, we lock our car doors, we do our best to prevent becoming victims. Not because we think it's our fault if it happens, but because we don't want it to happen because at the end of the day, it's our lives that are hurt...

</comment></comment></comment></comment></comment></comment><comment><USER17> So, what I'm seeing is that if he had not tried to extort people by demanding money to remove the photos, his site would not have been illegal?

<comment><USER18> I expect (hope) that child pornography distribution will be added to the charges as they build the case.

<comment><USER19> Libel too presumably, in the cases of the photoshops^Wimages manipulated by Adobe Photoshop(R)

<comment><USER20> Libel isn't (generally) criminal; it would be up to the people involved to take such a suit, and most probably wouldn't have the means to do so.

<comment><USER21> You also need to prove that the perpetrator knew the images were fakes, which is usually pretty difficult.

</comment></comment></comment></comment></comment><comment><USER22> Good. Everyone who owns, works for, frequents or defends these sites is a sociopath and a failure as a human being.

</comment><comment><USER8> _That's why I'm standing with Hunter Moore. He's a great big jerk, but he needs to have the right to post facts that politically powerful people like Charlotte Laws want to keep hidden_

What about facts like her home address, home telephone number, and social security number? Does Moore need the right to publish those things if she wants to keep them private?

<comment><USER23> Newspapers occasionally publish these things - see the recent example of an upstate NY newspaper digging up the addresses of gun owners. Or see the nyt widely publicizing the location of the new Goldman Sachs HQ, something that was nominally private.

(I say "nominally" because like the address of assorted gun owners and revenge porn victims, these things are a matter of public record.)

Send the editors to jail?

</comment></comment><comment><USER24> The cultural outcome of this someday is going to be that everyone has had their sex exposed somewhere, so it stops being a big deal. Like all sorts of other previously taboo topics. That day will be far better.

</comment><comment><USER23> Its great that the power of the law is currently being directed at great big jerks, but do we really think it will stay this way?

These revenge porn sites are journalism. And apparently we are all now cheering the government as it shuts down publications whose motives and views we disagree with.

[http://www.chrisstucchio.com/blog/2013/defending_hunter_moor...](http://www.chrisstucchio.com/blog/2013/defending_hunter_moore.html)

<comment><USER25> It is not journalism to hack people's computers, steal their stuff and pit it online.

<comment><USER23> You mean like the Guardian did after Snowden stole peoples stuff and released it? Or like wikileaks/etc? Or assorted other newspapers releasing illegally acquired information?

<comment><USER2> These are bad examples, because the legality of publishing Snowden and Manning's documents was in fact legally tenuous, and so far the publishers of the documents are protected largely by the enormous public welfare implications of the documents themselves. Especially in Snowden's case, that could change. Wait 6 months and see if the Snowden trove results in operationally relevant serious foreign intelligence disclosures that don't implicate the rights of US citizens, and then we'll see how much "journalism" really is a free pass to publishing "anything".

</comment></comment></comment></comment><comment><USER26> _California is getting serious with efforts to end the scourge known as "revenge porn," in which men who want to hurt women (usually as "revenge" for dumping them) post naked photos of the women online and then encourage their community of fellow misogynists to harass them._

Revenge porn is definitely not just a male vs female thing. IIRC IsAnyoneUp had a large portion of male victims.

</comment><comment><USER11> At least with this guy we had some recourse. When some Polish programmer makes a copy cat website no one will be able to take it down.

Bollaert just showed us the new reality: You can't stop the internet from trolling. Everyone missed the moral of the story and just sent the law after him.

(I think if he played this off as a social experiment to expose the world we live in, he'd have gotten a lot more slack )

</comment><comment><USER27> I'm not sure I agree with this. The owner of the site didn't post any content him self or steal anything. I know and understand that the content of the site updated by its users has harmed many people and is morally wrong. But they should be going after the users that updated the content not this guy.

Ask you self whats the different between anonib.com and revenge porn site?

<comment><USER18> I take it you didn't read the article. Please do so now, paying special attention to the words "blackmail" and "extortion".

</comment></comment><comment><USER28> Does this count as revenge porn under these laws?

[http://www.theguardian.com/theguardian/shortcuts/2013/aug/06...](http://www.theguardian.com/theguardian/shortcuts/2013/aug/06/peter- dowling-australia-sexting-penis-wine)

</comment><comment><USER29> I am curious to know if I can make my girlfriend sign a document giving me the absolute rights of all the photographs I might click of hers. [I am only hypothetically speaking.]

<comment><USER30> You own the rights to any photo you take, regardless of who is in it.

However, you can't use the subject to advertise or endorse something w/o their consent iirc (ianal).

<comment><USER31> > _You own the rights to any photo you take, regardless of who is in it._

Are you sure? I remember reading about a bunch of lawsuits against people that had taken photos of iconic shapes (coke bottle, certain cars) and the maker of the iconic shape claimed copyright. (I can't find a link right now)

<comment><USER30> How was that image being used was probably important in those cases.

<comment><USER31> Are you saying that even though I own the copyright to an image I can't use it however I want? (Genuinely confused)

<comment><USER30> Yes. You can't use the subject of the image to advertise or otherwise promote something without the subjects consent, but the image itself is your property.

You could take a picture of a random person in public and publish it in a gallery, but you couldn't use that image to sell your brand of pop, iirc and ianal. Sorry I can't find a good link right now.

</comment></comment></comment></comment></comment></comment><comment><USER32> If it takes this long to stop something like this, then god help you if you're victimized in a less elaborate crime!

</comment><comment><USER33> About goddam time.

</comment><comment><USER34> What an absurd way of earning money..

<comment><USER35> Well, some make money in more absurd ways, like the (War)Defense industry...

</comment></comment><comment><USER36> I was shocked to learn that this was legal (in other states) in the first place. Disgusting.</comment>


The ships that could change the seas forever - <AUTHOR> http://www.bbc.com/future/story/20170918-the-ships-that-could-change-the-seas-forever <comment><USER2> >"just 16 of the largest vessels produce the same emissions as all the planet's cars put together"

That's... Unbelievable. Emissions of what? Must be some specific compound cars produce in very small amounts.

<comment><USER3> Sulfur compounds. [http://www.dailymail.co.uk/sciencetech/article-1229857/How-1...](http://www.dailymail.co.uk/sciencetech/article-1229857/How-16-ships- create-pollution-cars-world.html) .</comment></comment>


Clinical Toxicology of Fluoride - <AUTHOR> http://www.maebrussell.com/Fluoride/Fluoride%20-%20Acute%20Poisoning.html <comment><AUTHOR> I was shocked to come across this while looking for something else in the Clinical Toxicology book cited. This is the same fluoride that's in water, right?</comment>


The Housing Boom Is Already Gigantic. How Long Can It Last? - <AUTHOR> http://greyenlightenment.com/the-housing-boom-is-already-gigantic-how-long-can-it-last/ <comment><USER2> another 200 years</comment>


Research estimates vaping is at least 95% less harmful than smoking - <AUTHOR> https://www.gov.uk/government/news/phe-health-harms-campaign-encourages-smokers-to-quit <comment><USER2> How did they determine vaping is 95% less harmful than smoking? I don't see references to the methods they used to make this assessment. Where did that number come from? As far as I can tell, the number was just made up!

<comment><USER3> You do know the number 95% comes very frequently from statistical analysis right?

<comment><USER4> You know putting "right" at the end turns your comment from helpful to dickish, right?

</comment></comment></comment><comment><USER5> I don't see how many different types of "juice" they tested, maybe I missed it? I always hear (on HN) that it is certain types of flavored juice that is the most harmful, so I'm interested in _which one(s)_ they tested

</comment><comment><USER6> I call bullshit, they can't just put out numbers like this. I remember that one of the last times that I stopped smoking happened because I was literally overdosing on nicotine from vaping almost continuously while drinking. I stopped for almost one year at the time because I was completely nauseated by vaping. I think that night was much worse than anything I smoked before, probably comparable to a red Marlboro smoked cutting the filter out (thanks Stephen king and the black tower.. -.- )

<comment><USER2> Hey, big tobacco is dead but welcome to era of big-vape!

</comment></comment><comment><USER7> Heavily editorialized HN title. The "research" mentioned in the article is not discussed in any detail, nor is any reference provided.

</comment><comment><USER8> No sources or study data included with the article.

This is not news, this is propaganda.

</comment><comment><USER9> I don't get why it is so difficult to check this. At this point there is probably a good amount of people that has been exclusively vaping for the past 10 or 20 years, after decades of smoking. The statistics for lung cancer and other smoke-related illnesses 10 or 20 years after quitting smoking completely should be already well known. It should be enough to compare the two to understand the difference in harm between smoking and vaping?

</comment><comment><USER10> Phillip Morris owns Juul now, so it doesn't surprise me that there might be efforts to throw smoking under the bus globally.

<comment><USER11> Altria, not Phillip Morris, bought a 35% stake, not full ownership.

<comment><USER12> Altria is Phillip Morris Inc's new name.

</comment></comment></comment><comment><USER13> So it could be 99.99% but they are holding back...better to be pleasantly surprised. :)

Isn't it ironic that Philip Morris owns a nice chuck of Juul that aims to get rid of smoking. My guess is that they'll milk this for decades and then pay a small % of their profit to settle claims. Then they'll jump on another bandwagon, maybe buy El Chapo's Select. Rinse, repeat.

</comment><comment><USER14> Misleading title. That's just a filling sentence in the middle of the article.

</comment><comment><USER15> Now contains 100% less radium...</comment>


AMD Open Source Driver for Vulkan - <AUTHOR> https://github.com/GPUOpen-Drivers/AMDVLK <comment><USER2> A lot of people are talking along the lines of "oh AMD is nice but... Nvidia".

No, in 2019 all AMD GPUs this decade support OpenGL through 4.5, support Vulkan, and still really don't have a great OpenCL situation (rocm is out of tree on every distro and only supprts parts of 2.0 still).

For gaming though, theres no reason not to get an AMD GPU. They are at near performance parity with Nvidia relative to their Windows performance, they work with the inbuilt drivers on every distro out of the box, and the only footgun to watch out for is that new hardware generally takes a feature release Mesa cycle to get stable after launch. You even get hardware accelerated h264 encoding and decoding (and vpx on some chips) via vaapi. All on top of the fundamental that they are much more freedom respecting than Nvidia.

 _Stop giving Nvidia your money to screw you over with_. CUDA, their RTX crap, Gsync, Physx, Nvidia "Gameworks", and much more are all anti-competitive monopolist exploitative user-hostile evil meant to screw over competition and customers alike. Nvidia is one of the most reprehensible companies out there among peers like Oracle. AMD isn't a selfless helpless angel of a company, but when their products _are_ competitive, and in many ways better (such as supporting Wayland) stop giving such a hostile business your money.

<comment><USER3> > their RTX crap

I was hyped about RTX when it came out and I'm all for more performant raytracing however my hype has seriously waned since the RTX release due to the lack of support. Until we have more games that support it I'm inclined to agree that there is no reason to included it when deciding between NVIDIA and AMD at this time. I would argue that by the time raytracing in gaming is more widespread there will be a more open and accessible solution, likely supported (or built) by AMD.

<comment><USER4> Fair enough. But when the choice is a 2080 for 699 with RTX and their new 2080 competitor without RTX for 2080, or no AMD card at all, it's not a hard choice.

</comment></comment></comment><comment><USER5> I can't speak for anyone else, but because AMD has been opening up their drivers, the laptop I purchased six months ago was AMD based.

I haven't done any kind of elaborate benchmarks, but as someone who runs Linux full-time, I want to support companies that make my life a bit easier.

That said, I have had some issue with my computer having some weird graphical glitches, and then crashing...I don't know if that's the drivers fault but I never had this with my NVidia or Intel cards...

<comment><USER6> I supported AMD several years because of this... Then I got tired of the low quality of both the open source, and the closed driver. Crashes, glitches in movies, flickering...

Some time ago, I bought an Nvidia. It works like charm with the closed driver on Linux and windows. I do mainly games on Linux/windows, some gpgpu (machine learning with tensor flow), and the usual stuff. I couldn't be happier... Except if it was open source ;-)

<comment><USER7> I purchased an AMD laptop precisely because I got tired of having to deal with NVidia, ether their glitchy proprietary driver breaking GNOME every so often, or Optimus being a pain via Bumblebee.

Since switching to the AMD laptop, my experience has been smooth. My only worry is the upgrade path, there aren't that many high-performance AMD laptops out there and my next purchase is definitely AMD.

<comment><USER8> If the new 3rd generation Ryzen stuff ends up being as good as it looks, then I'd say we're in for a good year as far as mobile AMD hardware's concerned. There's a good chance that you have nothing to worry about as far as upgrade paths are considered.

<comment><USER7> I hope so, but my current laptop has a desktop-class Ryzen 7 1700 in it and their mobile offerings usually come with half as many cores, but I guess we'll see what Ryzen 3 has to offer.

<comment><USER9> Which laptop is this?

<comment><USER7> The ASUS ROG GL702ZC

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Sadly I constantly hear people say that you should get an Nvidia card for both Linux and FreeBSD, because the drivers are better. While I'm sure that Nvidias driver a good, it's kinda sad that the attitude is that AMD is a better friend of the open source community, but yeah, we're going with Nvidia.

I get why, you have stuff to do and Nvidia performs better, but still it a little annoying.

OpenBSD seems to be the only open source operating system that suggests that you get an AMD card (or use Intel integrated graphics).

<comment><USER11> If you are ok with a proprietary driver and all the headaches that come with it, NVidia drivers are better for some 3-4 years after you buy a high-end GPU or 1-2 years after you buy a low-end one. After this time, NVidia drops support and you are stuck with a free driver that is much worse than the AMD ones (not by fault of the free drivers developers, mind you, but because NVidia makes their life hard).

Personally, I do prefer to avoid the headaches from day 1, so it's AMD or Intel.

<comment><USER12> I use an nVidia GeForce 8200 (published in ~2007) in my mediacenter and I don't have problems with drivers (v340.xxx legacy series: latest update is v340.107 [https://www.nvidia.com/Download/driverResults.aspx/135161/en...](https://www.nvidia.com/Download/driverResults.aspx/135161/en- us) ) on Arch Linux.

Same thing with a GTX 760 (currently using v390.42) on Gentoo: I kept that server running multiple times for many weeks at a time and never had crashes/weird things happening while doing GPU-mining, playing or just having the GPU idle while using the CPU.

As well with setting things up, I always just replaced the old card with the new one and that was it.

<comment><USER13> the post you reply to probably means support for gl regarding features and performance. a server and a media center will do fine even without proprietary drivers... well, until someone update the color stuff in v4l again.

<comment><USER12> Maybe? But then probably even AMD/ATI does not keep on tweaking their drivers more than nVidia to improve performance & OpenGL-compliance for all their 12 years old HW... (but I might be wrong).

>>a server and a media center will do fine even without proprietary drivers...

Honestly: not sure (never tried). My big question mark involving the GPU frequency scaling (maybe now an issue only with "Nouveau"?) when using video filters (e.g. framerate sync and/or nice upscaling filters).

</comment></comment></comment></comment></comment><comment><USER14> I'm glad AMD has consistently put in work to keep their drivers available to the Linux community, even if sometimes it's been less than perfect. I really hope that Nvidia eventually also open sources it's drivers.

<comment><USER15> When hell freezes over. Their management seems stuck to agressive anti-FOSS stance forever. Shame to every developer who works for them - it is like working for the evil.

<comment><USER16> I keep wondering where Oracle and Nvidia come up with their developers. I don't want to work at either because of their complete disregard for FOSS, and most developers I know have the same opinion.

<comment><USER17> Salary.

Remember, Comcast also has software developers.

<comment><USER18> also there are a lot of developers globally with looser morals because of different cultural values. in my experience anyone from a -stan country will make whatever you want as long as you give them a decent salary and a visa

<comment><USER19> Aside from the racism - are you suggesting that working on closed source software is immoral!?

<comment><USER18> closed source is the default. and where is the racism? you don't even get ethics lectures if you're educated as an engineer in a third world country. anecdotally i was educated from a pretty good private college and even there the ethics professor herself said you don't really get to make any ethics decisions as an engineer in india. your only choice is quitting and that is a really tough choice

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> It seems like this repo has existed for over a year and no commits within the past couple days, I'm not sure what the discussion is supposed to be about when there is just a link to a repo.

<comment><USER21> Indeed, AMDVLK was part of the AMDGPU pro driver first and was opensourced in december 2017, so it's not new.

<comment><USER22> I guess it's in the context of the Proton/Linux gaming discussions earlier.

</comment></comment></comment><comment><USER23> Nvidia refuses to support GBM for Wayland and instead came out with a completely different buffer API, EGLStreams. This is pretty arrogant. As I use sway, and it doesn't support Nvidia, I chose an AMD Vega 64, which works great.

[https://drewdevault.com/2017/10/26/Fuck-you- nvidia.html](https://drewdevault.com/2017/10/26/Fuck-you-nvidia.html)

<comment><USER16> How do you like sway? I'm still on an Nvidia GPU, but I might upgrade this year to an AMD GPU, and I've been hesitant to get back into tiling window managers untill I can use one on Wayland.

<comment><USER23> Love it. That said, the 3rd party application support for wayland is pretty poor. Chrom(ium|e) can't even do accelerated video under XWayland (so everything is choppy, even on my threadripper system). Firefox is better, but still uses XWayland. Wayland support is available in Firefox nightlies, but it _really_ isn't ready for daily use yet. For the most part everything works fine, but I'm anxious for native wayland support from many apps (Electron apps in particular).

</comment></comment></comment><comment><USER24> So does anyone know now if AMD Vulkan GPU's are fully open sourced? i.e. can we build everything from source, firmware, drivers, app and then use it without having to trust any blobs?

<comment><USER25> AMD beta tester here.

AMD separated HDCP and DRM related silicon from video acceleration units some time ago to be able to open source their GPUs completely sans the NDA bound stuff. Even this is a very big generosity and step from them for the Linux community.

I'm sure that the firmware contains some highly proprietary and revealing information about some of their secret sauce. So, they won't be able to do it even if they want to.

<comment><USER26> There is no secret sauce in the firmware, but it has HDCP garbage (which is causing it to remain a blob). AMD could provide one without HDCP as an open option, but I suppose they didn't see enough demand for it.

<comment><USER25> I think it also had the clocks, memory settings, thermal thresholds and other hardware tuning parameters. So opening the firmware may also lead to many many fried boards.

Also, if the core enablement and configuration is done in the firmware, some vendors may find themselves in a hard position, since they may be selling crippled GPUs as lower spec cards.

Last, but not the least if folks enable faulty CUs in their cards and see the faults, they may create some (albeit unjustified) noise in "teh internets", which will return as bad press.

So, while the firmware is good for research and educational purposes, it's also a Pandora's box IMHO.

<comment><USER26> You can fry the hardware even now, if you set fan curve incorrectly, or create some other power management mess. Opening up firmware isn't really affecting that.

In the end, opening it up isn't any worse than opening up the kernel driver to begin with (you could apply similar arguments to that). And AMD were OK with it, and from what I've heard, DRM is really the main issue here. As usual, media lobby poisoned the technology for us.

<comment><USER25> I think you won't be able to override the emergency shutdown thresholds in the firmware.

I'm a big free and open software advocate. I primarily use free and open source software, and try to open every line of code I write. I'd like to see the firmware on the open like the drivers. I just wanted to talk my understanding of hardware. If my comments sounded otherwise, I'm sorry, my bad.

<comment><USER26> I've heard from Linux AMD engineers, that they supported the idea of opening up the firmware, and opposition to it wasn't based on the concerns you listed, but primarily driven by DRM (and the need to split it into two variants which is an extra effort).

<comment><USER25> That's possible & I'd love to see the firmware source code and play with it TBH. I also like AMD because of the efforts they make to open themselves as much as they can.

BTW, I'm not employed by AMD or ATI. I was just one of the independent members while the GPU driver beta testing was closed to outsiders.

DRM always complicates things, but always get broken at the end. Also, it's always a crippling pain.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> I'd love to try AMD video cards again, but what's recently held me back is that I sometimes play around with stuff like Tensorflow and other ML libraries.

They all seem to be geared toward CUDA, which of course is an NVidia only thing.

I've never really looked deeply into it, but are there performant options, close to CUDA, that would allow me or others to use such ML libraries on AMD GPUs?

<comment><USER28> Tensorflow has a working AMD fork:

[https://github.com/ROCmSoftwarePlatform/tensorflow- upstream](https://github.com/ROCmSoftwarePlatform/tensorflow-upstream)

See following links for more discussion:

[https://www.reddit.com/r/MachineLearning/comments/85iwyj/d_t...](https://www.reddit.com/r/MachineLearning/comments/85iwyj/d_tensorflow_with_amd_gpu/)

[https://gpuopen.com/rocm-tensorflow-1-8-release/](https://gpuopen.com/rocm- tensorflow-1-8-release/)

[https://stackoverflow.com/questions/37892784/using-keras- ten...](https://stackoverflow.com/questions/37892784/using-keras-tensorflow- with-amd-gpu)

</comment></comment><comment><USER29> I have recently moved my home PC to latest AMD APU (latest Athlon). No CPU Fan because it's passive, no proprietary closed source binary blobs anymore because AMD open source drivers work out of the box (latest Ubuntu).

</comment><comment><USER26> I build amdvlk periodically to test. They didn't yet release VK_EXT_transform_feedback. radv (AMD Vulkan driver by Mesa project) already has it.

It's an important feature for projects like dxvk.

See [http://jason-blog.jlekstrand.net/2018/10/transform- feedback-...](http://jason-blog.jlekstrand.net/2018/10/transform-feedback-is- terrible-so-why.html)

</comment><comment><USER30> The more people support AMD by buying their hardware, the better the drivers will become. Obviously we should support the more open of the options, it's not like AMD can't deliver satisfactory hardware.

<comment><USER31> "But mah FPS!!" I have never understood the relative lack of loyalty amongst nerds. Demand more FLOSS, but buy NVIDIA for a few frames per second. Use Chrome instead of Firefox for a few milliseconds on render. Rejoice at clang while maintaining that GCC never did anything good for anybody.

The whole point of libre software is that the choice of what you use matters, but I rarely see ethical considerations trump hot rodding.

</comment></comment><comment><USER29> Nvidia will be forced to do the same pretty much soon. The real thread for this oligopoly (AMD, Nvidia) will be from Asia. Look what's happening with SoCs in mobile phones in general and project it to all different types of silicon including dedicated accelerators.

</comment><comment><USER32> Maybe there's something I'm missing here, but that github repo doesn't appear to have any code...?

<comment><USER33> [https://github.com/GPUOpen-Drivers](https://github.com/GPUOpen-Drivers)</comment></comment>


Sparsh - "your body is your USB flash drive ... conceptually" - <AUTHOR> http://www.pranavmistry.com/projects/sparsh/

<comment><USER2> I didn't see any real explanation of the tech, but it seems like a (slow) synchronized clipboard that has nothing to do with your body at all. At best, confusing, at worst... an anecdote:

I remember when I had to convince my grandma that closing the browser wouldn't make her email disappear.

Now I'll have to convince people that washing their hands won't wipe away the bits.

<comment><AUTHOR> I took a minute to title this one because as far as I can see you're right, it's not storing anything in or on your body but I didn't want to say anything in the title that wasn't on the page. So I added the "conceptually" bit from the page in an effort to accurately but succinctly label what this actually is.

Here's the page I found it from originally where it says that it uses Dropbox or FTP for the transfer:

[http://www.newscientist.com/article/dn20325-store-data-in- yo...](http://www.newscientist.com/article/dn20325-store-data-in-your-body- without-cyborg-modification.html)

I found it interesting because it ostensibly can be used with Dropbox which is an app that I like. Though I disagree with New Scientist that Dropbox is "still irritatingly complicated" but maybe that's just because I'm a geek.</comment></comment>


GitHub commit search: "remove password" - rsc-dev https://github.com/search?utf8=%E2%9C%93&q=remove+password&type=Commits&ref=searchresults <comment><AUTHOR> Too many comments here recommend to clean up the commit and just hide the mistake under the rug. This is wrong.

If you leak a password to any public location, there is only one reasonable course of action: CHANGE IT!

Don't even bother rewriting the commit. Focus on changing that password right away, and while you're at it, figure out a better way to manage your secrets outside of your source code in the future. Mistakes happen, but they shouldn't be repeated.

<comment><USER2> the solution is to store the password and any other sensitive information in a text file that you read when your program starts up. And don't forget to add that file's name to .gitignore so git will ignore it. As simple as that. :)

If you leaked the password in the git repository, change it as @jvehent just commented.

<comment><USER3> I think its as important to make it "hard to do the wrong thing" as "easy to do the right thing". In this case having to explicitly exclude a file containing passwords from being deployed would fail that rule of thumb.

The Azure Key Vault is a good solution that so far seems easy to work with (I've only just started using it though) and it can make the storage of secrets easier to secure but you still have the issue of storing the credentials to the key vault, so its difficult to fully get rid of the problem although you can definitely isolate access to your passwords that way and then have a more limited number of credentials to secure.

<comment><USER4> Somehow I doubt Azure Key Vault is easier than a gitignore line and a text file

<comment><USER5> .gitignore is easy but the pw is still naked. Probably a good practice to hash it.

<comment><USER6> Probably not as the result would be useless for authenticating against another service.

</comment></comment></comment></comment></comment></comment><comment><USER7> I liked this one:

[https://github.com/squared-one/omniauth- unsplash/commit/072b...](https://github.com/squared-one/omniauth- unsplash/commit/072bc946b5d069d0f30b32f8f3cc53d22abff36e)

 _"... It's not really removing any password, is it? But hey, why not use the momentum ... wheeeeeeeeeeeeeeeeee!"_

<comment><USER8> Another less 'relevant' result:

      -    acceptHandshake = params.pass == PASSWORD
      +    acceptHandshake = true//params.pass == PASSWORD

<comment> purple-again That just seems like a guy testing his authorization code. I would expect the next commit to put it back to its functional state.

<comment><USER8> Like 'Revert "remove password"'? ;-)

</comment></comment></comment></comment><comment><USER9> Right after my "remove secrets" post: [https://news.ycombinator.com/item?id=13650614](https://news.ycombinator.com/item?id=13650614)

There are just so many of those it's crazy:

        remove .env
        YOURFAVORITEAPI_SECRETKEY
        YOURFAVORITEAPI_PASSWORD

Also replace "remove" with delete/rm/replace/etc.

And replace "YOURFAVORITEAPI" with CircleCI, Travis, Mailchimp, Trello, Stripe, etc, etc.

Also, companies I contacted consider it the customer fault and basically don't care.

<comment><USER10> It is customer fault.

However it should be pretty easy for them to set up a script to search github for this kind of stuff and automatically invalidate keys

<comment><USER11> At my work one of my coworkers accidentally put a secret token in a GitHub issue. Couple hours later he got an email from the sysadmin at the parent company saying his token finding script went off. He probably wouldn't have noticed for a long while if that script wasn't running.

<comment><USER12> Wouldn't the token-finding script be even more of a risk?

If the token is XYZ and the script is searching [https://github.com/search?utf8=%E2%9C%93&q=XYZ&type=Commits&...](https://github.com/search?utf8=%E2%9C%93&q=XYZ&type=Commits&ref=searchresults):

1\. It's sharing the token with GitHub.

2\. It's embedding the token as query-string parameter in a GET request, which is much more likely to be logged (than sending it as data in a POST request), and more likely to be available to less-privileged/less-trusted staff.

3\. If the request is sent to a non-HTTPS endpoint, the query can be MITMd, revealing the token.

I'd be very wary of setting up a token-finding script, it feels like it adds more risk than it saves.

<comment><USER13> You can scrape the issues without exposing the token. You could probably do it by just subscribing to all of them and parsing emails. No one(especially in security) should be using a third party search to match sensitive data. It's like searching Google for your social security number.

</comment></comment></comment></comment></comment><comment><USER14> For anyone wondering, if you want to remove a file or secret you've already committed, you can use BFG Repo-Cleaner to go through your commit history and completely remove any trace of it.

[https://rtyley.github.io/bfg-repo-cleaner/](https://rtyley.github.io/bfg- repo-cleaner/)

<comment><USER15> Sounds like a better idea to just change the secret.

<comment><USER16> Why not both? :)

<comment><USER17> That's time you could be spending on adding a new feature or fixing a bug :) Just change the secret and be done with it!

<comment><USER18> And when someone new thinks "that password's wrong, it'll update it!"? Do both, gets rid of the issue on both sides and really doesn't take long :)

<comment><USER19> Why would they if the tip does not have any passwords in it? It's not like a potential contributor will search the commit log to see if there were once passwords around. Besides, making such changes in public changesets is rude, to say the least.

<comment><USER18> What I mean is, lots of folks seem to be saying to ignore the presence of the file and just change the password where it's used.

Removing the file, or the password and adding a comment, _as well as_ changing the password where it's used is much less likely to end up with a re-added password later.

Of course, removing the file, adding it to .gitignore and changing the password makes it even harder as a contributor would have to work to add the password back, which is even less likely to happen.

<comment><USER19> Oh sorry I tought you were saying to remove it from VCS history (as said many times in the thread). I totally agree you.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> There are so many of these.

It gets a little scary when it veers from professional security to individual personal privacy [https://github.com/search?p=2&q=smtp.gmail.com+pass&ref=sear...](https://github.com/search?p=2&q=smtp.gmail.com+pass&ref=searchresults&type=Code&utf8=%E2%9C%93)

<comment><USER21> I should be amazed at how prevalent this is but after almost two decades in IT/IS, it's no more than the equivalent to the Post-IT on a monitor, but more accessible. Dumb, but business as usual.

<comment><USER22> > the equivalent to the Post-IT on a monitor

Writing passwords down on a piece of paper, and keeping that in your wallet or locked desk drawer is actually one of the more secure ways of storing passwords these days.

No risk of electronic compromise, and its highly unlikely that people who would steal your wallet or break into your home are also interested in your online accounts.

<comment><USER23> To be honest, and not that I ever would, but, if I stole your laptop, the moment I would become interested in your online accounts would be the moment I found your paper with all of your passwords on it.

</comment></comment></comment></comment><comment><USER24> I'll raise you a handful more:

add password / add passwords

* [https://github.com/search?utf8=%E2%9C%93&q=add+passwords&typ...](https://github.com/search?utf8=%E2%9C%93&q=add+passwords&type=Commits&ref=searchresults) * [https://github.com/search?utf8=%E2%9C%93&q=add+password&type...](https://github.com/search?utf8=%E2%9C%93&q=add+password&type=Commits&ref=searchresults)

add secret / add secrets

* [https://github.com/search?utf8=%E2%9C%93&q=add+secret&type=C...](https://github.com/search?utf8=%E2%9C%93&q=add+secret&type=Commits&ref=searchresults) * [https://github.com/search?utf8=%E2%9C%93&q=add+secrets&type=...](https://github.com/search?utf8=%E2%9C%93&q=add+secrets&type=Commits&ref=searchresults)

<comment><USER25> Some of these commits are PGP signed...

<comment><USER26> What do you mean by that?

That people took the trouble to use PGP but then go and do something this silly?

<comment><USER27> It's a good reminder that the human is usually the weakest link.

</comment></comment></comment></comment><comment><USER28> Computers are supposed to be good at what imperfect humans are not. This only proves how primitive the tool is.

That is, for example, if Gmail can ask "it looks like you forgot the attachment" why can't Git say "this is a public repo and you're about to commit and push passwords. Are you sure?"

It's going to be easier to fix the tool than it is to make humans be perfect.

<comment><USER29> How would git know that it's a password/key/whatever?

<comment><USER30> Key is easy. The high entropy should tip you off.

Passwords, look for variables with the name password, passwd assigned strings.

Like Gmails attachment, it'll get stuff wrong, just make it easy to continue on.

<comment><USER31> This. However, it would only work with secure passwords. Setting the entropy count too low would result in a bunch of false positives.

</comment></comment></comment></comment><comment><USER32> A good a time as ever to mention AWS's provider-agnostic secrets-aware git hook that attempts to prevent this at the repository level [1]

[1] [https://github.com/awslabs/git-secrets](https://github.com/awslabs/git- secrets)

</comment><comment><USER33> Throw the word 'oops' in for good measure.

[https://github.com/search?p=2&q=remove+password+oops&ref=sea...](https://github.com/search?p=2&q=remove+password+oops&ref=searchresults&type=Commits&utf8=%E2%9C%93)

<comment><USER34> I actually compiled a list of these from the last time this subject was mentioned on HN. [http://gitoops.xyz/](http://gitoops.xyz/)

</comment></comment><comment><USER35> This is a good example of the increased risks from doing your development out in the open, any mistakes are exposed to a much wider group of potential adversaries.

On an internal VCS, this would still be a problem, but a bit less visible/exploitable...

<comment><USER36> On an internal VCS this may be a deliberate decision: Secrets need to be stored somewhere and a cost-risk analysis can result in "this is the best place that we currently have at our disposal". That obviously won't fly if your threat model includes "adversary may attack our github account from within GH" or if you ever plan on opening up that repo, but if neither applies this may be the best place to store some sorts of secrets.

<comment><USER35> Sure there's always a cost / benefit balance to take into account.

That said I'd say putting secrets in a git repo is a pretty risky thing to do. By the nature of the tool that means that the secret ends up on the device(s) of every developer who checks out the codebase, so the security of the secrets is equal to the security of the worst secured device in question.

<comment><USER36> > That said I'd say putting secrets in a git repo is a pretty risky thing to > do

Storing and keeping secrets is a pretty risky thing in general. Think: small team, small app, everybody has the secrets anyways for deployment purposes. Sure, setting up vault is superior - but how much effort does that cost that could be invested in a better solution. Or a puppet repo that you use to provision your machines, shared in the ops team: small team, everbody has root - on each machine there might be an ssh key that gives away all your secrets. So better invest in solid FDE and maybe tie that to a TF device, a yubikey that is required to decrypt the disk etc. Not perfect by all means, but there's limited time to go around and you really should think about what threats you want/can defend against. (for example, for most projects, I'm not wasting any thought about defenses against a nation state actor, that's a threat that I won't be able to meaningfully counter anyways).

<comment><USER35> FDE's and Yubikeys are nice and good controls for some classes of risk, but distributing your passwords onto dev laptops via a git repo. opens you up to a wide range of risks that those won't help you with.

Unless you got super-corporate lockdown with the end point devices you have risks like "A user with access to the repo. installs software which turns out to be malware", "A user with access to the repo. leaves their laptop in a coffee shop unlocked", "A user with access to the repo. puts it on a USB key and loses the key". None of these are nation state level concerns, they're things that could impact the project purely by accident, or at the hands of low-skill attackers

The point is once you've allowed secrets to be in a distributed system like this you have very little control over what happens to them, which is why I'd recommend using a secrets management system where there's more control (e.g. vault from hashicorp) in almost all circumstances.

</comment></comment></comment></comment></comment><comment><USER37> A while ago I discovered similarly that there are several searches which lead you to active database logins.

[https://github.com/search?&q=mysqli_connect+http&type=Code](https://github.com/search?&q=mysqli_connect+http&type=Code)

[https://github.com/search?q="rds.amazonaws.com"&type=Code](https://github.com/search?q="rds.amazonaws.com"&type=Code)

etc...

<comment><USER38> Wow. People would really store production passwords on GitHub for everyone to see?

I wonder if GitHub blocked those searches "We could not perform this search Must include at least one user, organization, or repository"

Edit: If I click on PHP for the language in the sidebar they show up. But hmm, I wonder if maybe GitHub tries to block leaks like that from being searched.

<comment><USER37> Yeah, I just started getting those too. But adding "&p=2" to the URL shows results for the next page...

 _shrug_

<comment><USER39> You could probably also just use Google to find them with site:github.com.

<comment><USER37> When I was a teenager I liked to use search engines to find PHP upload tests. People almost always served uploaded files from a directory and made no distinction between .jpg or .php files.

(No, I didn't exploit this, I just enjoyed finding them)

</comment></comment></comment></comment></comment><comment><USER40> To people like me who have done this many times in the past and want to add the file to gitignore

[http://stackoverflow.com/questions/1139762/ignore-files- that...](http://stackoverflow.com/questions/1139762/ignore-files-that-have- already-been-committed-to-a-git-repository)

The other alternative I can think of is to hide sensitive values in environment variables

<comment><USER41> Careful. If you have already committed it, and you ever push the repo to a public GH repo, your key is compromised. Just because some benevolent slacker- attackers on HN aren't sniffing the PSHB event queue, doesn't mean no one is. If you ever send the secret to Github, criminals have it. If you ever committed it, and then you ever push, then you've sent it to GitHub.

So yes, add the file to gitignore and git rm it, but also invalidate your keys and get new ones.

</comment></comment><comment><USER42> Even more frightening:

[https://github.com/search?utf8=&q=id_rsa&type=Commits&ref=se...](https://github.com/search?utf8=&q=id_rsa&type=Commits&ref=searchresults)

<comment><USER43> Wow private keys just sitting in plain sight o.O

<comment><USER34> From a former HN discussion [http://gitoops.xyz/](http://gitoops.xyz/)

</comment></comment></comment><comment><USER44> Seems this goes back to 1989 :)

[https://github.com/weiss/original- bsd/commit/0e1066151c90a80...](https://github.com/weiss/original- bsd/commit/0e1066151c90a8089c88365f3328934a588451a3)

</comment><comment><USER45> Search for "update password" and you'll see almost as many results (268,000), many presumably with active passwords.

"Add password" finds 792,000 results, of which at least some (on the first page) are actual passwords.

</comment><comment><USER46> I'd hope that all those people promptly changed their passwords after realising. But 200k commits, I'm sure a good percentage of them didn't.

</comment><comment><USER47> Related topic: "Production AWS keys on GitHub" ~ 3 years ago

[https://news.ycombinator.com/item?id=7411927](https://news.ycombinator.com/item?id=7411927)

By just looking quickly, it seems that you can still find many recent live keys...

<comment><USER9> Amazon scans GitHub and revokes valid keys (can't find source, but proof is that it's been a while no AWS keys were stolen from GitHub)

<comment><USER48> I have it on good authority ( >_> ) that this is indeed true.

</comment></comment></comment><comment><USER49> This one seems to be a winner:

[https://github.com/wrmsr/dotfiles/commit/a6597efe0421b6b0cc2...](https://github.com/wrmsr/dotfiles/commit/a6597efe0421b6b0cc2a3f6c0fb14e4e99c54177)

</comment><comment><USER50> Searching filename:id_rsa also yield a rather interesting result. Alongside with "BEGIN OPENSSH PRIVATE KEY". I wonder how much of these also contains ssh_config.

</comment><comment><USER51> People...seriously...

I get it...you like github but you don't want to pay for private repos. That's when you use Gitlab or BitBucket and then this problem goes away.

<comment><USER52> Well, we suppose that's a solution of some kind. How about never committing passwords and having passwords hardcoded in your codebase?

<comment><USER51> Also that

</comment></comment></comment><comment><USER53> After this was posted, there has been some serious trolling in Github with "fake" commits matching this search.

</comment><comment><USER54> Another for the list, JSON or YAML containing 'password' \- [https://github.com/search?utf8=%E2%9C%93&q=password+extensio...](https://github.com/search?utf8=%E2%9C%93&q=password+extension%3Ayaml+extension%3Ayml+extension%3Ajson&type=Code&ref=advsearch&l=&l=)

Reminds me of the eye opening experience available at [https://www.exploit- db.com/google-hacking-database/](https://www.exploit-db.com/google-hacking- database/)

</comment><comment><USER55> I set up a honeypot and made this commit: [https://github.com/teaearlgraycold/honey/commit/7c4289717979...](https://github.com/teaearlgraycold/honey/commit/7c4289717979bf675862ad43a6f3da46969c7481)

Already had a couple of sassy individuals telling me my honeypot is shit via the tty logging.

<comment><USER56> Fell for it, this is the first time I connected to a honeypot (or so I think). I especially liked the part where you type 'exit' and it just keeps you connected but the command line changed to 'root@localhost' at the beginning. Had a good laugh there :)

What software are you using?

<comment><USER55> It's running kippo

[https://github.com/desaster/kippo](https://github.com/desaster/kippo)

</comment></comment></comment><comment><USER57> How do you guys, handle this problem?

I use either `git-crypt` [1] or `ansible-vault` [2].

1: [https://github.com/AGWA/git-crypt](https://github.com/AGWA/git-crypt)

2: [http://docs.ansible.com/ansible/playbooks_vault.html](http://docs.ansible.com/ansible/playbooks_vault.html)

<comment><USER58> I follow the 12 factor app methodology ([https://12factor.net/](https://12factor.net/)), everything in ENV.

</comment></comment><comment><USER59> This made me realize an unexpected (to me) search behavior on Github. Basic/Default search will search commit history, but if I try to add advanced options I don't appear to get search history.

[https://github.com/search?utf8=%E2%9C%93&q=remove+password+u...](https://github.com/search?utf8=%E2%9C%93&q=remove+password+user%3Anicksagona&type=Repositories&ref=searchresults)

Here I was trying to search for "remove password" just on repos for nicksagona (just happened to be one of the first users to display when you go to this thread's search).

That comes up with zero results. This leaves me wondering how I would run similar searches on repos that I'm involved with as a way of auditing to make sure none of them have compromised passwords that would need changed.

I would love to hear suggestions on how to do this.

</comment><comment><USER60> Good thing all my commit messages are "xxx"

</comment><comment><USER61> If you found a similar mistake in your repository, you can delete commit from history using: `git rebase --onto <commit-id>^ <commit-id>`. Or if you want actually rewrite it, see git rebase -i` documentation.

<comment><USER36> A single person who checked out your repo before the force push will still have the credentials. Once this has been pushed to a public repo, assume that the credentials are burned and revoke them.

<comment><USER62> Indeed; but these actions _complement_ each other.

<comment><USER36> if you revoke the credentials, removing them from the git history serves no purpose but disrupts everybody that has a clone of the repo. So you're doing harm for little benefit other than covering up the incident. A net loss, if you ask me.

<comment><USER63> It serves the purpose of removing a hint on your password patterns from public availability.

E: Oh, and just to preempt this, even saying "i use only random passwords with no pattern" is useful information, as is having a ballpark password length.

<comment><USER64> Don't have password patterns, problem solved. Knowing that my password is 20 random characters of all possible symbols will not reduce your search space by any significant amount.

<comment><USER63> Still useful, means there's no point in checking any < 20, which halves the search space. Or, on the outside, can be useful to abort any attempts at bruteforce by way of cost evaluation and move on to another target.

<comment><USER65> My goal when choosing a password (generator) typically isn't "what will tie up an adversary for the longest, preventing them from moving on to attack someone else".

Call me selfish, but if my password is known to be too tough to bother, so Eve moves on to someone else's weak password, great.

<comment><USER63> If you know your password is too tough to bother, then having people bash away at it is no cost to to, and benefit to everyone else.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER66> This is the main reason I use gitlab, because they have free private repos. When your trying to smash out code as fast as possible in a startup you don't want to have to worry about acccidently checking a secret in

<comment><USER67> Bitbucket is another alternative for free private repos.

</comment></comment><comment> mickael-kerjean GitHub has become the best place to find all sort of sensitive information. From root password, access to companies network, Api keys, everything is available from a search box, you don't need to be a genius to do serious damage, spying or doing all sort of black hat stuff.

Sure people should clean up their work, but as a fact not everybody does and it won't change tomorrow. You'll simply hear on the news: some Russian hacker are behind the attack or another bad excuse

</comment><comment><USER68> This is pretty much how I found a couple exposed Stripe API keys. You just need to look through code of people who use the example implementation, and then dig in the history/config a bit. If you send stripe a key or two, they'll give you a free shirt.

[https://adamlaycock.ca/blog/2016/05/23/Stop-Posting- Keys.htm...](https://adamlaycock.ca/blog/2016/05/23/Stop-Posting-Keys.html)

</comment><comment><USER69> Not only passwords, but api keys as well. I can't tell you how many times I've come across public repos that have full api credentials in them. Boggles the mind..

</comment><comment><USER70> You'd better change the password instead of removing it.

</comment><comment><USER71> Just using a random commit name like 'minor bug fix', 'updated version' for these kind of commits will save a lot of headaches like this.

One can do better by adding random lines/ logs in lot of files and sneakily remove password from one of them and then give a random commit name.

But then it all boils down to your mindset at that particular moment when you are commuting.

<comment><AUTHOR> > Just using a random commit name like 'minor bug fix', 'updated version' for > these kind of commits will save a lot of headaches like this.

Just change the leaked passwords, don't try to hide the commits.

<comment><USER72> Precisely, just change the password/key and don't do anything at all. People might think you are stupid or think used random text, either way you are safe.

</comment></comment></comment><comment><USER73> Git-crypt is your friend!

<comment><USER9> Then .gitignore and .env are your best friends :)

<comment><USER73> git-crypt suits a significantly larger set of use cases such as storing private keys, etc.

</comment></comment></comment><comment><USER74> Someone here should make a bot and leave comments on all those commits warning people to change their passwords.

</comment><comment><USER75> Looks like a lot of people read Hacker News... [https://github.com/doutchnugget/awesomevim/commit/a7292962ce...](https://github.com/doutchnugget/awesomevim/commit/a7292962ce6376968e5096c4abef8b74bfaabe06)

</comment><comment><USER76> The worst part in that is that it provides tons of passwords to analyze and detect recurring words or schemes. This probably also will hurt people that never commited their passwords in public repos. Github should probably filter out such searches.

<comment><USER35> I think the ship of "easily analzed password dumps" has already sailed e.g. [https://xato.net/today-i-am-releasing-ten-million- passwords-...](https://xato.net/today-i-am-releasing-ten-million- passwords-b6278bbe7495#.1iy9voua1) <\-- 10 million passwords

<comment><USER76> Yeah, indeed. I guess we can expect password schemes to change over time, so it's still a good idea to prevent it. Not sure in which proportion it helps, though.

</comment></comment></comment><comment><USER77> Years ago, there were proggit posts of google searches for open myphpadmin consoles. I think people then went and deleted/messed with the databases. My search fu is failing me though, I can't find any of those threads.

</comment><comment><USER78> Or try "remove aws"

<comment><USER79> I tried "fuck", but it's nowhere near as prevalent as "remove password"

<comment><USER80> Give "oops" a try

<comment><USER47> "stuff" isn't far behind

<comment><USER81> Always been a fan of "fix" ...LOL

<comment><USER82> Fixed? At least "wip" for "work in progress" doesn't raise your expectations too much.

</comment></comment></comment></comment></comment></comment><comment><USER83> One of the things I've done after making this mistake was creating an example config file for this information, committing that, and then dropping a gitignore on the _real_ config file.

</comment><comment><USER84> Thank you for highlighting this is a such a common mistake. I hope developers of all skill levels look at this and realize it how easy it is to make this mistake and learn from it.

</comment><comment><USER43> I would recommend using torus.sh or other secret manager instead of an env or text file. I've forgotten to include them in .gitignore too many times.

</comment><comment><USER85> some random guy spammed a ton of commits with a bitcoin address saying "please send me money"

jesus christ, how low can you stoop

</comment><comment><USER86> Maybe a confidential-linter or git pre-commit hook would be nice to prevent leaking confidential information.

</comment><comment><USER87> Good find. Reminds me of the a query done for Google Search that exposes sites vulnerable to SQL injection.

</comment><comment><USER88> reminds me of this: "I don`t know" [https://github.com/search?p=1&q=+i+don`t+know&ref=searchresu...](https://github.com/search?p=1&q=+i+don`t+know&ref=searchresults&type=Commits&utf8=)

<comment><USER89> Heh the first result of this query has a password there as well [https://github.com/budworth/cs313-php/commit/9113053776bb834...](https://github.com/budworth/cs313-php/commit/9113053776bb834261241474a8b97d5c7e1e49f6)

</comment></comment><comment><USER90> leaks of this types are known since AGES, and still people are unable to keep private things private.

</comment><comment><USER91> look at these morons:

[https://github.com/checkr/supersecret/commit/6b9cdf366084318...](https://github.com/checkr/supersecret/commit/6b9cdf3660843180ace92a62cd6d0b828fc73ede)

</comment><comment><USER92> Once it's on the internet. Sites like github have become an amazing OSINT tool.

</comment><comment><USER93> There are tools that automatically rewrite your git history and can fix this.

</comment><comment><USER94> Rotate your keys and passwords in production, everyone.

</comment><comment><USER95> And now I got goatse'd, thanks Hacker News, lol.

</comment><comment><USER96> can someone please give me an ELI5 breakdown of what I'm missing... did these people attempt to change their password via git commits?

</comment><comment><USER97> The question is: how many are left in the wild?

</comment><comment><USER98> Another one: Search for Root password :D

</comment><comment><USER99> git commit --amend just cleanup all the mess. also, better to change the pushed one

</comment><comment><USER100> Wow!!!

This could be a big thing. It's time to write: How to write code without expose you

</comment><comment><USER101> Holy shit!

</comment><comment><USER102> use quotes. only about 19k

</comment><comment><USER103> some of these seem legit

</comment><comment><USER104> Encryption, do you speak it?

</comment><comment><USER105> imagine private repo's :)

</comment><comment><USER106> Not nice

</comment><comment><USER107> git is a great tool, unfortunately there's no standard of storing sensitive info (like passwords). some store it as ENV variables, some hard copy the files to servers using custom scripts etc.. would love to see an easy tool that developers can use to manage this info like people manage files on git.

</comment><comment><USER108> When you put your dotfiles in a repository online, be sure to commit all the public keys and none of the private ones.

Github, like SSH, uses an asymmetric authentication scheme. They even publish everyone's public keys. It's much more secure than passwords.

</comment><comment><USER109> Almost as many results on 'remove credentials' :-)</comment>


Augmented reality made easy (VIDEO) 2mins - <AUTHOR> http://www.ted.com/talks/chris_hughes_demos_easy_augmented_reality.html?awesm=on.ted.com_1A&utm_campaign=ted&utm_content=site-basic&utm_medium=on.ted.com-copypaste&utm_source=direct-on.ted.com <comment><USER2> The relevant controversy of said presentation can be seen here: [http://www.unitzeroone.com/blog/2009/06/23/ideas-worth- takin...](http://www.unitzeroone.com/blog/2009/06/23/ideas-worth-taking- credit-for-the-ted-augmented-reality-hoax/) and discussed here: <http://news.ycombinator.com/item?id=670645>

</comment><comment><USER3> Controversy aside, I can't wait for a furniture company to start using augmented reality.

It'd be pretty cool to download the IKEA app to my iPhone or Pre or whatever, print out a few strips of paper, and see how furniture would look in my house just by looking at my phone.

This would be pretty cool for posters / art too - tape the paper to the wall, and see what the art would actually look like hanging there.

</comment><comment><AUTHOR> Demo was done in the browser with flash. Quick google didn't find much else.

Source Code: <http://spazout.com/assets/tedflartoolkit.zip></comment>


Supercomputer Use at the BGI in China to Study the Genetic Neture of IQ - <AUTHOR> http://infoproc.blogspot.com/2010/12/supercomputers-and-mystery-of-iq.html

<comment><USER2> News from the future:

IQ found to be influenced by a whole mess of genes, and nutrition in parents, and grand parents, and hugely by the environment. And IQ tests found to be very bad at distinguishing between knowledge and intellect.

<comment><USER3> News from the future:

P != NP

Does that mean that we shouldn't work towards a proof? Are you implying the Chinese shouldn't bother investigating this because it has no value?

<comment><USER2> No I'm implying we should favour basic scientific research over specific narrowly focused research.

</comment></comment></comment><comment><USER4> It might be more productive to isolate genes that relate to a low IQ, and then discard those from the sample. When looking for a needle in a haystack it would make the haystack smaller.

</comment><comment><AUTHOR> I would've linked to the original article, but it is behind a paid wall.</comment>


OpenShot 2.0.6 (Public Beta) Released - <AUTHOR> http://www.openshotvideo.com/2016/02/openshot-206-beta-3-released.html <comment><USER2> So, are these the options we have now to edit video with open source software? Any other tool missing?

* [http://www.shotcut.org/](http://www.shotcut.org/)

* [https://kdenlive.org/](https://kdenlive.org/)

* [http://www.pitivi.org/](http://www.pitivi.org/)

* [http://www.openshotvideo.com/](http://www.openshotvideo.com/)

* [http://cinelerra.org/2015/](http://cinelerra.org/2015/)

* [https://www.blender.org/](https://www.blender.org/)

It would be great to have a place comparing the feature of all the open source video editors...

<comment><USER3> Natron, an open source compositor: [http://natron.fr/](http://natron.fr/)

LiVES: [http://lives-video.com/](http://lives-video.com/)

Lumiera, a re-write of Cinelerra: [http://lumiera.org/](http://lumiera.org/)

I think one also needs to clearly define the term "edit video." This list concentrates on Non-Linear Editors (NLE), but, for example, it is possible to "edit video" with ffmpeg.

</comment></comment><comment><USER4> How does it compare featurewise to Kdenlive

[https://kdenlive.org/](https://kdenlive.org/)

which I think is the most advanced OS video editing software around?

<comment><USER5> Thanks god KDenLive is catching up. Cinelerra[1] (and the cinelerra-cv community fork) was/is more advanced, but its interface is stuck in the 90's, it manage to crash twice per CPU cycle due to horrible code and is resealed without warning in big code dump every year or so. I lost -so- much time in this back in high-school (10-12 years ago) because it was the only high end editor on Linux. Back then the early KDenLive version were not so much better stability wise. However they came a long, long way. Too bad I don't need Video editor anymore, but I still compile KDenLive to see the new features.

[1] [http://cinelerra.org/2015/index.php/features/editing](http://cinelerra.org/2015/index.php/features/editing)

<comment><USER6> Heh, this year is the first time I've actually been able to get Cinelerra to run. I think the worst time I ever had with it was trying to compile it on Slackware a few years ago. Hours of compilation and nothing to show except insta-crash.

</comment></comment></comment><comment><USER7> I have been following the development of Openshot for the past 3 years and I can't help but think that the progress is very slow.

Being an open source project and one in which a sufficiently large number of people are interested, why is that the project is moving so slowly?

<comment><USER8> [https://en.wikipedia.org/wiki/The_Mythical_Man- Month#The_sec...](https://en.wikipedia.org/wiki/The_Mythical_Man- Month#The_second-system_effect)

The authors decided to redo the underlying library. And change the user interface. And go cross platform. That amounts to a virtual rewrite from scratch.

</comment></comment><comment><USER9> Behind the scenes, the awesome MELT framework [http://www.mltframework.org/](http://www.mltframework.org/)

<comment><USER10> It's MLT, not MELT.

And it's a base for other video editor, which is getting stronger each year, seems more stable than the others and already looks IMHO the best among FOSS video editors:

[http://www.shotcut.org/](http://www.shotcut.org/)

</comment></comment><comment><USER11> I do some video recording, with separate audio and then I use a video editor to multiplex the video/audio. And then of course, some nice titles, video fade in/out, brightness adjustment, etc.

Over the past 3 years, I've gone through Cinelerra, OpenShot, Kdenlive, and some I can't even remember. Very frustrated over the state of video editing on Linux, I unfortunately once had to use the editor on Windows. :(

But now, I'm using Kdenlive each time, and I'm very happy with it. There are some tutorials out there on YouTube which help too.

<comment><USER12> I don't you know if you've tried it, but I found the video editor in Blender to the best Linux editor for me yet.

Definitely worth a shot.

<comment><USER13> Blender seems to be a very good video editor BUT having tried it and many other ones, Blender is not as easy to start working with as most other editors. Still, given its features -- yes, I believe it's worth putting the lime to learn it.

</comment></comment></comment><comment><USER14> I wonder how the new Openshot compares to Pitivi: [http://pitivi.org/?go=tour](http://pitivi.org/?go=tour)

Having followed the dev of some of these for years (>6 years), I see Pitivi as slow dev-wise, but one of the few consistent ones.

</comment><comment><USER15> How does openshot compare to professional editing software, e.g. vegas or premier.

<comment><USER6> I think a better comparison would be to Windows Movie Maker or iMovie. It is ridiculously easy to use, but I don't think it has the work flow of professional editing software.

I used it a few times to make simple compilation videos - every year I teach a summer camp for kids, and I collect videos throughout the week, put them together and add a song which the kids choose. All I need are just a few transitions, and ability to add titles. With Openshot it was simple.

One year I used Adobe premiere, and it was like shooting a mouse with a bazooka. A lot of time and effort, for just basic stuff.

</comment></comment><comment><USER16> I hadn't heard of this project before this post, I must say that this is by far the most promising Open Source video-editing project i have seen.

I hope this gains both traction and donations, it's very much worth it!

</comment><comment><USER17> Is OpenShot is the GUI frontend to MLT ? Or does it do more ?</comment>


%*$*#&#* Windows 7 Calculator - <AUTHOR> https://social.technet.microsoft.com/Forums/windows/en-US/4ec1b55b-b516-471d-aa77-6b37b69d8df6/action?threadDisplayName=windows&forum=w7itproui <comment><USER2> It's not just Windows. I have an enormous investment in iPhoto -- lots of curated albums with comments. iPhoto won't run in newer versions of MacOS, and Photos won't run in older ones. So I'm looking at an event horizon: once I upgrade past Mavericks there's no going back, and as long as I'm on this side of the horizon there is no way for me to know if Photos is going to successfully import my photo albums or not.

This has happened before. When Apple dropped support for Rosetta after Snow Leopard I lost the ability to run a wide variety of useful applications. I still fire up Snow Leopard in a VM now and then just to run one of those apps. (BTW, running Snow Leopard in a VM is a non-trivial thing to do because Apple's license specifically prohibits it, and Parallels enforces that restriction.)

<comment><USER3> I work with mobile dev (among other things).

When you update your iPhone, you can't "unupdate" it, Apple after a while always deletes the certificate of all versions that aren't the current, and the installer always check the certificate before installing (this also means you cannot install iOS without internet).

Xcode, also checks the iOS version, and its own version, some versions of Xcode are tried to specific iOS versions... thus if you keep updating your iOS, you will have to update your Xcode.

For some reason, completely unknown to me, Xcode is ALSO tied to OSX version, For example Xcode 6.3 requires a OSX version more than Xcode 6.2, despite having no huge differentes between the two and Xcode 6.3 don't requiring any new OS capabilities that Xcode 6.2 didn't already used anyway.

But every time you update OSX and Xcode, not only they sometimes explicitly require a new machine model, but they also get increasingly more inefficient, using more and more RAM and CPU to do the same things.

Since right now, I am very low on money, this means I am stuck using Xcode 6.2, and trying to not misclick anything when I plug the testing devices and iTunes nag me to update them... because if I allow them to get updated, I will have to upgrade Xcode, OSX, and the entire machine, and right now sometimes I can't afford even food, affording a entire machine (specially with our currency getting completely broken and being only 25% valuable as it was supposed to when designed, comapred to USD).

<comment><USER4> If you have 8GB RAM, you should be okay to upgrade. I'm running 10.11 on my 2009 MBP, works fine.

<comment><USER3> I don't have 8GB of ram ;)

And this is why I mentioned ram in first place... The 6.2 Xcode already needs 6GB to run, this already killed one disk drive (because it is constantly swapping when I am using Xcode... the drive could not handle the strain of writing constantly all the time and broke down), I am using now a already damaged drive (someone gave me a drive with theirs that on Windows don't work anymore due to excessive amount of "bad blocks", the drive still work with *nixes for some reason, so I am using it, since I can't afford a new drive anyway).

</comment></comment></comment></comment><comment><USER5> Meanwhile, bc(1) has been here all along:

        wtbob@wtbob:~$ bc
        bc 1.06.95
        Copyright 1991-1994, 1997, 1998, 2000, 2004, 2006 Free Software Foundation, Inc.
        This is free software with ABSOLUTELY NO WARRANTY.
        For details type `warranty'.
        obase=16
        17281580835365214242
        EFD4823541245822

Twenty-four years and it's still working just fine!

edit: I can math

<comment><USER6> Fourteen? Perhaps you should do that math again with bc.

<comment><USER5> Heh, 1991 _seems_ like fifteen years ago…

<comment><USER6> Getting old is weird. I catch myself thinking of records released in 2005 as "new". (Even though I buy actual new music every week or two, and still remain relatively on top of modern music.)

<comment><USER7> I still get surprised I can buy booze. I'm 31.

<comment><USER6> I got carded recently. I'm old enough to have kids who are old enough to drink (I don't, but I could have).

</comment></comment></comment></comment></comment></comment><comment><USER8> Just for fun, I've tried that with the OSX calculator (in El Capitan, in case that matters).

When I paste the number in the article (17281580835365214242) into it, it shows as 9223372036854775807. Typing it by hand does the same, when you enter the last digit it transforms into that number, which is 0x7FFFFFFFFFFFFFFF in hex.

Funnily enough, if I paste the hex value (EFD4823541245822) and transform it to dec, it shows as the correct number, the one you can't paste or type.

So, the OSX calc looks broken too, in an even weirder way.

edit: Forgot to mention this was in programmer's view. As far as I can tell, other modes work fine.

<comment><USER9> Works for me after copying and pasting 17281580835365214242 it shows: 1,72815808353652E19

<comment><USER8> Ooops, yes, as the other comment says, I forgot to mention it was in programmer's view. Otherwise the number shows correctly.

</comment></comment></comment><comment><USER10> My favorite is open the "About Internet Explorer" box. Now try and select the version number. You can't. So if you want to submit a bug report to Microsoft, which needs a version number, you have to carefully manually tediously type in that 20 digit or so string.

Madness.

<comment><USER11> A cool little known feature about the old Win95 (Win32API) dialogs and error messages was: one could press Ctrl + C to copy the text content.

Sadly the devs who created Windows NT, the Windows shell, Office in the 1989-1998 era all retired. And the overall high product of Microsoft products went downhill.

In 2006 with the Longhorn and WinFS debacle it was already clear that dotNet wasn't fast enough for desktop usage. Up to Windows 7 there were no dotNet desktop included, everything was in the good, trusted and fast C++. Now with development partly transfered to Microsoft India and another CEO you get a mess of UX/UI/privacy that is Win10 and WinRuntime. All the old programs with an old code base are still okay or goodm but I can't stand their newer development (written from scratch apps). Maybe it's a culture clash, maybe their QA process is wrong, maybe their vision.

<comment><USER12> This has nothing to do with Windows NT vs new versions of Windows. In Windows 7 & above you can do the same thing but it's literally _only_ for error messages.

<comment><USER11> Windows NT _series_.

It should be common knowledge that Win 2000, XP, 2003 Server, Vista, 2008 Server, Win7, Win8, 2012 Server, Win10 (and XBox-OS, WinPhone8/10, HoloLens- OS, Azure cloud) are all NT based and just an incremental new version.

</comment></comment></comment></comment><comment><USER13> Yet somehow Windows 10's calculator is worse.

\- Also won't take in 17281580835365214242.

\- Inconsistently slow to load, sometimes "instantly" sometimes seconds.

\- Cannot double click to edit a previously entered formula

\- History is terrible now (not in-line, instead a different "tab" hiding the data entry controls).

\- Copy/paste sucks. Cannot copy out a formula.

I understand programmers being conservative with data types, but in a freaking calculator if you're trying to save memory by not making everything 64 bit or better then you're incompetent.

<comment><USER14> and its 47MB

<comment><USER15> Where do you get this number?

In the store ([https://www.microsoft.com/en-us/store/apps/windows- calculato...](https://www.microsoft.com/en-us/store/apps/windows- calculator/9wzdncrfhvn5#app-details) ) it says "Approximate size 3.07 MB - 5.79 MB", on my installation it says "368 KB" in the settings app and all "%ProgramFiles%\WindowsApps\Microsoft.WindowsCalculator*" directories are about 5 megabytes together.

RAM usage exceeds 47 megabytes with about 5 or 6 calculator windows open.

<comment><USER14> Yes, I meant ram usage. Specifically Working Set jumping above 46MB at the start of calc, and Private bytes hovering around 30MB, all for small one window app.

</comment></comment></comment></comment><comment><AUTHOR> The biggest surprise to me is why this wasn't caught during testing - especially since testing a relatively simple app like a calculator is often used as an example of how to do testing: try the biggest numbers, smallest numbers, zero, and some values in the middle. There's emphasis on testing the extrema, since that's where bugs (like this one) are most likely to appear.

I should also mention there's another suitable replacement, the free Microsoft Calculator Plus:

[https://www.microsoft.com/en- us/download/details.aspx?id=216...](https://www.microsoft.com/en- us/download/details.aspx?id=21622)

It's got a horrible early-2000s skin but you can turn that off easily; otherwise it works just like the old one with a few extra features (which I personally don't find too useful.) It's strange they didn't just ship Windows with some variation of that. Ever since I was caught by the modality "feature" (decimal points and trig functions don't work in "programmer mode"!?) I've replaced calc.exe with Calculator Plus.

<comment><USER16> From the License Agreement: [1] Installation and use. you may install and use the Software on a single computer, such as a workstation, terminal or other device, residing on your premises that is running a validly licensed copy of either _Microsoft Windows XP or Windows Server 2003._

Woo, Breaking the law. [https://www.youtube.com/watch?v=L397TWLwrUU](https://www.youtube.com/watch?v=L397TWLwrUU)

1\. [http://imgur.com/bfOKbIf](http://imgur.com/bfOKbIf)

<comment><USER17> I've been told before that it's not breaking the law, just the agreement between you and the company, which could result in a civil, but not criminal case :-)

<comment><USER18> Yes, but without that agreement you're infringing copyright.

<comment><USER19> Nobody but Kim Dotcom goes to jail for copyright infringement.

</comment></comment></comment></comment></comment><comment><USER20> I can recommend SpeedCrunch. Free and open source, comes in an installer free (USB/portable) version, and as for checking the value of the number in the topic, simply type hex(17281580835365214242). It supports Windows as well as OS X.

[https://bitbucket.org/heldercorreia/speedcrunch](https://bitbucket.org/heldercorreia/speedcrunch)

<comment><USER11> SpeedCrunch is great too, it was originally inspired by the WinXP PowerCalc - probably the best calculator from Microsoft: [http://dan.hersam.com/2010/11/10/powercalc-in- windows-7/](http://dan.hersam.com/2010/11/10/powercalc-in-windows-7/) (SpeedCrunch still lacks the graph rendering part, though has other features and improvements)

</comment></comment><comment><USER21> Solving something like that I would personally just fire up IDLE and use Python ......

<comment><USER22> I'm glad I'm not the only one. It is perhaps more common among linux/mac users, but windows user should just join the python-as-a-calculator club.

<comment><USER23> I've always wanted a handheld graphing calculator that ran Python.

<comment><USER24> Great idea. This is your jailbroken old Android phone with Cyanogenmod and Python running in a Terminal.

</comment></comment></comment></comment><comment><USER25> And I regularly get mocked by my coworkers for having an HP calculator on my desk right next to my notebook. "You know windows has a builtin calculator"

<comment><USER26> You can use an HP48G emulator either on your computer or on your android phone.

<comment><USER27> There's seems to be an emulator for everything these days. This is not the point. A physical calculator (and not a touch-screen app on a tablet) has something that the surrogate doesn't.

For one thing it does not require you to do GUI context switching. It does not compete for mouse (or keyboard) with the other tens of open programs. I find this invaluable.

On the other hand, touch screens take away tactile feedback. This gives the same bland taste as the soft power-off switches.

<comment><USER28> Same here, HP-12C on my desk at work.

</comment></comment></comment></comment><comment><USER29> Meanwhile, good old dc(1) uses big numbers (since OpenBSD 3.5)

<comment><USER30> And this funny line from the manual-page: (on Linux)

        > The input and output radices are separate parameters;
        > you can make them unequal,  which  can  be  useful or
        > confusing.

</comment></comment><comment><USER31> We seem to put a lot of energy trying to make software calculators having the same limitations of hardware calculators. Why?

<comment><USER32> Because then we can sell fancier software calculators?

Penny Arcade has some great quotes, but re: porting scarcity to virtual goods being 'like if the first thing God decided to create was AIDS' is my favorite.

</comment></comment><comment><USER33> I usually use the python repl as a calculator -- easy to see history, bigint support, and I can type a complex expression

<comment> iso8859-1 and infinite precision fractions!

</comment></comment><comment><USER34> By far the best GUI calculator I used is Qalculate: [http://qalculate.sourceforge.net/](http://qalculate.sourceforge.net/)

It's ridicolously fast and lightweight for the amount of features it contains, and it's also free and open source.

</comment><comment><USER15> Workaround for Windows 10 calculator:

1\. Switch to Engineering mode.

2\. Paste your number

3\. Press MS button to save your number

4\. Switch to Programming mode

5\. Restore your number from memory

</comment><comment><USER35> Meanwhile, "M-x calc"is reliable

</comment><comment><USER36> Not related to calculator but the Skype for business application refuses to send anything over 800 characters to the other party. Whenever I run into this (mostly while copy pasting chunks of code or long URLs to colleagues), I curse the engineers/product owners who put that stupid limitation. I mean WTF were they thinking when they put it in there anyway ? It's not a frigging SMS for crying out loud.

PS: One can right click and send the same message as a story and get upto 8k in length but that just shows how stupid the entire workflow is.

<comment><USER37> It's funny how there is no Skype code in Skype for Business.

</comment></comment><comment><USER38> I honestly have never run into problems involving such large numbers or at least numbers of digits, but FWIW, I really like SpeedCrunch when I need a calculator, if only because it maintains a history of inputs and results across sessions.

Still, if that used to work on older versions of calc.exe, and then they went and broke it, that is just plain stupid.

</comment><comment><USER39> Good lesson in keeping previous functionality with new versions, and remembering all of the functional requirements.

<comment><USER40> Yes, but also no!

"Remember" is a dangerous word to use here. Memory is fragile, fallible, and stored in ambulatory meat, which is inclined to wander off between releases. Store these use cases in automated tests that run automatically on every commit. And make sure the tests clearly express the _intent_ of the requirement, so that when somebody eventually breaks the test, they can quickly get the purpose. (If not, they'll be inclined to just delete the test.)

</comment></comment><comment><USER41> Why stop at just the calculator?

</comment><comment><USER42> Can you run the windows calculator from the command line? Something like:

      C:\> calc 20 + 5

</comment><comment><USER43> I can recommend Wolfram Alpha for this use-case.

<comment><USER44> WA is nice, but excruciatingly slow when you need something NOW.

</comment></comment><comment><USER45> I'd be great if Numi came to Windows

</comment><comment><USER46> why fix it if it ain't broke?

<comment><USER47> Mind you Apple also completetly fscked up the OSX calculator RPN mode a few version back. Some intern went in an seems to have 'fixed' it to require parenthesis.

Perhaps they 'fixed' it since, but I trashed it anyway, now I use the real HP-16C on the desk.

</comment></comment><comment><USER11> btw. Win8 calc got a loading splash screen as "feature". [http://betanews.com/2013/10/28/windows-8-1s-calculator- app-s...](http://betanews.com/2013/10/28/windows-8-1s-calculator-app-sums-up- whats-wrong-with-microsofts-new-os/)

The Win10 calc app still takes a second or two to start up: [https://www.reddit.com/r/windows/comments/3ng3f4/windows_10_...](https://www.reddit.com/r/windows/comments/3ng3f4/windows_10_calculator_is_one_hell_of_a_step_down/)

The old Win7 calc can still be downloaded from the Win10 store: [http://www.thewindowsclub.com/use-new- windows-10-calculator](http://www.thewindowsclub.com/use-new- windows-10-calculator)

I always keep an old Derive 6 around, it's still be best CAS and it's syntax compatible with the good old TI 89/92+/Voyage calculator devices. screenshot: [https://upload.wikimedia.org/wikipedia/sl/9/9f/Derive_zaslon...](https://upload.wikimedia.org/wikipedia/sl/9/9f/Derive_zaslonska_slika.png)

And the old WinXP PowerToy Calc is still good too: [http://dan.hersam.com/2010/11/10/powercalc-in- windows-7/](http://dan.hersam.com/2010/11/10/powercalc-in-windows-7/)

<comment><USER48> WolframAlpha may be a good online option too

</comment></comment><comment><USER49> Typical of modern software design practices: hide everything that might confuse the imbeciles that want to use your software. No radians, no hex, no binary, no settings. "Can't let the user change something, they may change it!"

<comment><USER10> People who need a "degrees" mode (instead of radians) shouldn't be using a calculator anyway.

<comment><USER50> Because all the good compasses, protractors, sextants, transits, and maps are marked in radians, right?

<comment><USER10> Because conversion is trivial, and should be done on the inputs and the outputs, not the intermediate values.

<comment><USER49> Trivial for for major values but I wouldn't know what 23 deg. was in radians without a calculator.

<comment><USER10> A special mode for that is not necessary:

23*pi/180

</comment></comment></comment></comment></comment></comment><comment><USER51> I can't stand the Windows calculator, I just install python instead.</comment>