Etherpad 1.5 Released – Features full pad export, import - <AUTHOR> http://blog.etherpad.org/2015/01/01/etherpad-1-5-turkey-slayer-edition/

<comment><USER2> > Full Etherpad Pad Export and Import

Is there a way on the beta site to start from a file? For example, with ethercalc, you can drop an XLSX or CSV file and it creates an instance from that document ( [https://ethercalc.org/](https://ethercalc.org/) )

<comment><AUTHOR> You would just create a new pad and import that file..

</comment></comment><comment><USER3> I just started typing some stuff, testing everything out and then it kicked me out. Perhaps it's because I was using foul language?

<comment><AUTHOR> Nah it's because we're testing some new code on the beta box. I just filed bug #2430 which looks like the problem.

</comment></comment><comment><USER4> Any word when [https://etherpad.mozilla.org](https://etherpad.mozilla.org) will be updated?

<comment><USER5> MoPad is still running the old etherpad version[1], the release is etherpad- lite[2]. Is there some easy way to migrate from the old etherpad installations?

[1] [https://github.com/ether/pad](https://github.com/ether/pad) [2] [https://github.com/ether/etherpad-lite](https://github.com/ether/etherpad- lite)

<comment><USER5> Looks like mozilla maintains a fork of the old etherpad codebase at [https://github.com/mozilla/pad](https://github.com/mozilla/pad)

<comment><AUTHOR> The plan is to migrate over to the new installation, we're just getting MyPads through which will give team pad functionality.. Mozilla move pretty slow compared to us..... [https://github.com/mozilla/pad/commits/master](https://github.com/mozilla/pad/commits/master)

</comment></comment></comment></comment><comment><USER6> Is there a free hosted version?

<comment><USER2> The source is available at [https://github.com/ether/etherpad- lite](https://github.com/ether/etherpad-lite)

<comment><USER7> Is this really EP-lite? The text in the link says nothing about it, but the interface looks like EPl..

<comment><AUTHOR> We dropped the "Lite" part, it's now just "Etherpad"

</comment></comment></comment></comment><comment><USER8> Looks cool, but the demo is down...

<comment><AUTHOR> Yep I was restarting the service, apologies :)</comment></comment>


Pharma Startup: Pharmaceutical Start Up and Entrepreneurial Network - <AUTHOR> http://www.pharmastartup.org/ <comment><USER2> Would this also include other healthcare related startups?</comment>


India's draft bill proposes a 10-year jail sentence for using cryptocurrencies - <AUTHOR> https://www.theblockcrypto.com/tiny/indias-draft-bill-proposes-a-10-year-jail-sentence-for-using-cryptocurrencies/ <comment><USER2> Probably will be chalked up to combating "black money".

Strange and regressive, much like demonetization was.

<comment><AUTHOR> Another type of demonetization like you pointed out.

</comment></comment><comment><USER3> Anyone know why they care so much?

I do see [https://www.coindesk.com/reserve-bank-of-india-denies- involv...](https://www.coindesk.com/reserve-bank-of-india-denies-involvement- in-draft-bill-to-ban-cryptocurrencies)

But nothing about why shows up in English. Tax evasion? Capital flight?

<comment><USER4> It's more of a move to control the narrative that the government is tough on "black money" and "terrorism", since previous actions to bring back such wealth into the tax net and into the books flopped terribly.

Everyone except the government officials and politicians seems to know that undisclosed income and wealth are mostly held in real estate, gold and other assets. But this government has had a hatred for cash and cryptocurrency for a few years, and seems to believe that curbing cryptocurrency will solve the problems.

What's completely absurd is the criminal penalty being talked about. There's no law so far on cryptocurrency (except that banks were told by RBI not to work with companies in this area). What are people who have had these for several years to do? It's all very short sighted, and looks like a deflection from other things.

<comment><USER5> There is also supposedly a proposal in the works to tax cash withdrawal from bank accounts if it crosses an annual limit of 10 lakh rupees.

:)

</comment></comment></comment><comment><USER6> This will never work</comment>


Opera browser sold to a Chinese consortium for $600M - <AUTHOR> https://www.engadget.com/2016/07/18/opera-browser-sold-to-a-chinese-consortium-for-600-million/ <comment><USER2> I really like using Opera on Linux. It is the only full featured browser that has good, scalable UI and touch input support. And builtin adblocking + "battery saver mode" (developer version only) are really good additions. However, I do not trust Chinese companies with my data, I will need to switch to Firefox soon.

<comment><USER3> May give Vivaldi a look. Made by many of the original Opera people.

[https://vivaldi.com/](https://vivaldi.com/)

<comment><USER4> is this using electron?

<comment><USER5> Doesn't look to be using Electron, as Vivaldi.app/Contents/Frameworks does not contain the Electron framework.

</comment></comment></comment></comment><comment><USER6> The Chinese company Kunqis failed to aquire Opera because it didn't get enough shareholder approval. Therefore this is the plan B, where Opera sells some assets, including the browser, to Kunqis.

Source: [http://e24.no/boers-og-finans/opera-software/opera-gaar- for-...](http://e24.no/boers-og-finans/opera-software/opera-gaar-for- noedloesning/23742772)

<comment><USER3> And even plan B is not finalized and approved by regulators etc. Meaning it could as easily drop dead as plan A.

Frankly the engadget headline here is as hyperbolic, if not more so, than anything The Register gets shit on for.

</comment></comment><comment><USER7> Those controversies of Qihoo 360 (stated in Wikipedia for both the society and the product of "360 Secure Browser") and Haier (for their partnership in the mobile platform) can't lead to anything good for Opera (browser).

Also, the presence of a "consortium" for which I haven't read any other relevant name sound like a way to cover the direct acquisition…

What I can see here is: \- A Chinese company trying to both comfortably beat their (Chinese) competition while gaining (out of PRC) customers for their "services" (which will likely be integrated within the browser); Which is fine, except for their "controversies". \- An executive team (at Opera), that seams pretty all about finance and economics, trying to make the most (money) from an offer in a market (the web browsers one) that is (at least, I think so) hard to remunerate. Obviously those shareholders will be happy; but are those shareholders really involved into the product that they own, or they are just silent speculators who made an investment for the sole purpose of profit when they realized the company's potential of being acquired ?

I'm also disappointed because I used to like the effort that Opera has put into their own browser in the latest months; the same effort that convinced me to adopt their browser (beta version) instead of Chrome and advocate them.

P.S.: Obviously, those are just my thoughts after having read the article; I hope for a more detailed statement from Opera…

<comment><USER8> > Obviously those shareholders will be happy; but are those shareholders > really involved into the product that they own

The shareholders are ecstatic with joy. The browser has been nothing but an advertising front for what is factually an advertising company for years now.

The fact that you actually saw the abomination that was Opera 15 and beyond in a positive light, instead of the truth of abandoning browser development in favor of a token Chrome fork, speaks volumes to this strategy having worked for them.

<comment><USER7> I have to say that I haven't experienced* the 12 to 15 transition that you refer; to me Opera is just a browser that changed over the time and, because I'm not a long date user, I never ever seen it as the advertising medium that you say. Of course they could have chose to better differentiate themselves, but the actual decision/strategy seems to have worked also for me.

BTW, as long as I know, they also pushed some code into Chromium so I see it as a solid step toward the consolidation of web standards by using a common and open base. Better achieved if performance exists as well.

[*]: Even if I occasionally tried some desktop versions of Opera during the years, I've always preferred Firefox and later Chrome as default browser.

<comment><USER8> It wasn't a transition. There is no other way to describe as this:

They threw away a perfectly functional software package with thousands of features, and replaced it with a fork of third-party software that didn't offer even a tenth of the features of the original package.

That said, yes, the strategy worked. The world at large swallowed their lie because it was mostly people like you, who weren't using Opera in the first place, and didn't know better about what really happened.

The people who suffered were their loyal users, people who had even bought Opera at some point.

<comment><USER7> You get my attention and curiosity; it is a browser, what were the "features" that you are talking about ?

At some point I've read that it had an e-mail client, later externalized; if those are the "feature", so I'm also ok with that, as I'm more into Vim than emacs. That's my point. If you're referencing something else, I'm curious. :)

<comment><USER8> Well, the email client for one. Not only is it built in, it also functions better than any other i've seen. You know how many email clients have a spam folder that learns by what you drop in it and pull out of it? Opera mail allows you to enable that auto-learning for EVERY folder. It works great.

The mail client also doubles as an RSS reader client.

Aside from that, it also has mouse gestures that are core in the browser, not bolted on with JS addons, which means they work consistently, everywhere, and fast. Gestures i do a lot: Right-click + wheel to change tabs, hold right tap left to go back, hold left tap right to go forward, and various hold rought and move mouse gestures to open new tabs, close tabs, move up a level, etc.

Then there's the performance and memory efficiency. I have 100+ tabs open and the thing sits at 2 GB with my email story as well. Right-click + wheel scrolls me through tabs at basically display refresh rate, chrome can't even switch that fast.

A very powerful url blocker that can be configured per-domain is built in, and is faster than _any_ kind of js-based addon could ever dream of.

I can actually manually edit menu and toolbar ini files and even add macros and javascript bits right there. For example i use that to add menu entries to right-click on links to open those links in other browsers.

I can edit text-based style descriptor files with additional image files to completely restyle the browser effortlessly.

Getting to the screen where i can view and edit cookies for the active page directly takes me 3 clicks.

I can configure activation, deactivation of js, plugins (flash, etc.), even animated images per site with 3 clicks, globally with 2 or a hotkey. I can tell plugins like flash to load on demand, i.e. _only_ when i click on them or tell the page to start loading plugins by clicking in the adress bar.

I can add browser-wide custom css, or site-specific custom css, again, 3 clicks.

I can disable all CSS for the active page with one click.

It has a note-taking facility built-in that doubles as "richer" bookmark manager, and also serves to give strings for auto-complete suggesting when typing in input fields.

It has one-button keyboard shortcuts, e.g. "seach in page" is "." for me.

I can have a vertical tab bar and a horizontal one at the same time.

I can open a list of all links on the current page, filter it by various conditions, select the ones i want and hit "download these to a folder" in one action.

I can add custom panels in the side panel by adding urls there, which is where i keep a bunch of "translate this word" things.

And that's just scratching the surface. I could go on for a long time. And keep in mind: It has all this stuff in it, and excluding JS engine performance, still outperforms Chrome and Firefox. JS being slower and SSL compatibility slowly going kaput are the only actual downsides.

<comment><USER7> > [...] it also has mouse gestures that are core in the browser [...]

> It has one-button keyboard shortcuts [...]

> I can configure activation, deactivation of js, plugins (flash, etc.) [...] > I can tell plugins like flash to load on demand [...]

> I can have a vertical tab bar and a horizontal one at the same time.

All of this is still here.

> [...] I have 100+ tabs open and the thing sits at 2 GB [...]

I'm not used to leave opened such a large number of tabs, but even today's Opera seems to handle them quite good (I may be wrong, but I think that Chromium smartly remove some tabs from memory and reload them later, on demand and with cache).

> A very powerful url blocker [...]

If you really need this, I think that /etc/hosts is the way.

> I can actually manually edit menu and toolbar ini files [...]

> I can add custom panels in the side panel [...]

> I can open a list of all links on the current page, filter it by various > conditions, select the ones i want and hit "download these to a folder" in > one action.

Perhaps extensions (which I do not use) are designed to simplify and customize the process...

> I can edit text-based style [...] to completely restyle the browser > effortlessly.

Not really a feature, but a "nice to have". As for myself, I'm ok with the OS- native look.

> Getting to the screen where i can view and edit cookies [...]

> I can disable all CSS for the active page with one click.

I think that you can achieve the same result from the Inspector with a couple of more clicks (that's not a behavior that most users need).

:)

<comment><USER8> Not gonna bother to answer in detail because you are not worth the time, but you're making assumptions without actually knowing how the features work, and you're quite wrong in your assumptions.

<comment><USER7> I was just trying to mitigate your disappointment ;)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I really wish promising technology couldn't be seriously damaged simply by being "bought". Perhaps there should be a law that says something like: fine, you can buy this but you must permanently open-source a snapshot of that product from 2 years ago (ensuring some legacy regardless of your actions).

Yes, Opera might be fine. It might even end up better. If history tells us anything though, new management can cause a lot of problems. The term "consortium" doesn't exactly scream "experts at moving technology forward". One of the companies where I worked was bought by a "consortium", and I saw some very…interesting decisions made back then.

Opera wasn't special because of a dollar figure; it was special because of its _attitude_ toward technology. If a consortium values return over anything else, they risk alienating too many of the people that made Opera successful.

<comment><USER10> Their attitude has proven to be largely unsuccessful. Why should they be obligated to preserve it?

</comment></comment><comment><USER11> Is Opera fairly popular in other countries? I have a feeling this won't go over well with a large portion of the U.S.-based power-users that use it...

<comment><USER12> It's very popular in countries and continents like India, Asia and Africa. Specifically on small, cheap phones.

<comment><USER13> Do these phones typically run Android? Or older OSes that have a mobile JVM?

<comment><USER14> Mostly Android nowadays, far as I'm aware.

<comment><USER12> So are you going with them, Geoffrey?

</comment></comment></comment></comment></comment><comment><USER15> Time to uninstall from my phone.

</comment><comment><USER16> I remember the times of Opera 12.... :(

<comment><USER8> I still use Opera 12 as my main browser in TYOOL 2016, with menu entries and buttons to load horrible JS abominations in Chrome.

</comment></comment><comment><USER17> Time to delete Opera Link account, and uninstall the Mini :(

<comment><USER18> I'm sorry to tell you that your Opera Link (not to be confused with Opera Sync, the syncing platform for the new products) has already been deleted. Opera stopped providing the Opera Link service December last year.

The servers has been decommissioned, and according to Norwegian law, the user data has been deleted.

</comment></comment><comment><USER19> Now it's going to start reporting to (new) mothership. Whatever that means.

</comment><comment><USER20> Out of interest does can anyone know/can say why Mahi de Silva and Erik Harrell left? Seemed sudden in each case.

</comment><comment><USER21> Anyone trying out Brave? www.brave.com</comment>


The Maybe Monad in Ruby - <AUTHOR> http://blog.pretheory.com/arch/2008/02/the_maybe_monad_in_ruby.php

<comment><USER2> This is just like the Gang of Four pattern fetish that sprung up in the 90s, then people saw "patterns" everywhere, and everything had to be named. Its like that with Monads, suddenly people are seeing then in ordinary things all over the place.

<comment><USER3> It's a very traditional OO situation: you want a value that know how to handle its error case. Haskell makes it easy to implement that with types. Either you can check the integer return value (which your compiler can't verify), you can hack something up similar to it (return all the values in a list, say, and check how long that it), or you can see that a list is also a Monad, and Nothing looks like [] and Just x looks like [x].

In Rails, there's a file whiny_nil.rb, whose sole job is to report errors about people accessing a nil object when they shouldn't be. Using Maybe with pattern matching, coming from Haskell, makes as much sense as implementing Iterator with first-class functions. It looks weird, coming from Visual Basic, but it makes your code readable and short.

<comment><USER2> No question its a good thing, I am just amused at the "look ma, its a monad" craze going on. But if people are getting excited over FP concepts, thats nothing but a Good Thing (as long as it doesn't turn into a fashion, which will then go away).

</comment></comment></comment><comment><USER4> Pretty Sweet. Here's my hacked together Python version (not sure what Monads have to do with it):

      class Maybe:
        def __init__(self, obj):
            self.o = obj

        def __repr__(self):
            return repr(self.o)

        def __getattr__(self, name):
            try:
                return Maybe(getattr(self.o,name))
            except:
                return Maybe(None)

I'm trying to decide whether using it's Pythonic or not.

<comment><USER5> Are you sure you want to use __repr__ in this way? You'll end up with 'None' instead of None at the end.

<comment><USER4> Eh, I don't think the repr matters much. What does matter is actually getting all of the other methods implemented (stuff like cmp, eq, etc.). They're all basically pass-throughs, though. Even with that, I think it's still broken in some ways. I should learn more about what Python does for type conversions.

</comment></comment></comment><comment><USER6> Rather than an explicit Maybe I've always wanted something built into the language. Why can't the language check for null customers in customer.id? I'd prefer customer.id to == null if customer is null.

<comment><USER7> I think the problem is that often you really do want to know if customer is nil. The nice thing about having to explicitly specify this is that you localize the effects - and make it clear in your code that you want this 'pass-through' behavior in a specific part of your code.

If you wanted this behavior everywhere, you could just include this code

      class NilClass
        def method_missing(method, *args)
          nil
        end
      end

But I think this would cause more problems than it would solve.

</comment></comment><comment><USER8> Very nice, I always wondered the same thing about chaining together conditionals.</comment>


We're Sequencing Every Member of the Weirdest Bird Species on Earth - <AUTHOR> http://www.atlasobscura.com/articles/were-sequencing-every-member-of-the-weirdest-bird-species-on-earth <comment><USER2> The Kākāpō species has a peculiar ambassador in the form of Sirocco[0], the individual who attempted to mate with Mark Carwardine's head.

> "He had to be raised away from other kakapo and this led to him being > imprinted on humans. As an older bird, he still does not associate with > other kakapo. This extends to the mating ritual of 'booming'; Sirocco booms > in the presence of humans, rather than female kakapo. Sirocco is therefore > seen as unlikely to be successful when it comes to breeding. However, his > affinity to human beings means he has become an effective advocate for the > kakapo species."

He's now New Zealand's "Official Spokesbird for Conservation". He even has his own Facebook page[1].

If you want to help save these amazing birds you can go to the Kākāpō Recovery site[2] and either donate, or adopt a Kākāpō.

[0]: [https://en.wikipedia.org/wiki/Sirocco_(parrot)](https://en.wikipedia.org/wiki/Sirocco_\(parrot\))

[1]: [https://www.facebook.com/siroccokakapo/](https://www.facebook.com/siroccokakapo/)

[2]: [http://kakaporecovery.org.nz/adopt-a- kakapo/](http://kakaporecovery.org.nz/adopt-a-kakapo/)

</comment><comment><USER3> The kākāpō truely is an eccentric creature - in the 80s Douglas Adams and zoologist Mark Carwardine went out to find one for the BBC radio documentary series "Last Chance to See". The chapter in its accompanying book is called "Heartbeats in the night" \- even more fun to read than watching the documentary[1] Carwardine did with Stephen Fry some 20 years later:

.. when eventually European settlers arrived and brought cats and dogs and stoats and possums with them, a lot of New Zealand's flightless birds were suddenly waddling for their lives. The kiwis, the takahes - and the old night parrots, the kakapos.

Of these the kakapo is the strangest. Well, I suppose the penguin is a pretty peculiar kind of creature when you think about it, but it's quite a robust kind of peculiarness, and the bird is perfectly well adapted to the world in which it finds itself, in a way that the kakapo is not. The kakapo is a bird out of time. If you look one in its large, round, greeny-brown face, it has a look of serenely innocent incomprehension that makes you want to hug it and tell it that everything will be all right, though you know that it probably will not be.

It is an extremely fat bird. A good-sized adult will weigh about six or seven pounds, and its wings are just about good for waggling a bit if it thinks it's about to trip over something - but flying is completely out of the question. Sadly, however, it seems that not only has the kakapo forgotten how to fly, but it has also forgotten that it has forgotten how to fly. Apparently a seriously worried kakapo will sometimes run up a tree and jump out of it, whereupon it flies like a brick and lands in a graceless heap on the ground.

By and large, though, the kakapo has never learnt to worry. It's never had anything much to worry about.

Most birds, faced with a predator, will at least realise that something's up and make a bolt for safety, even if it means abandoning any eggs or chicks in its nest - but not the kakapo. Its reaction when confronted with a predator is that it simply doesn't know what the form is. It has no conception of the idea that anything could possibly want to hurt it, so it tends just to sit on its nest in a state of complete confusion and leaves the other animal to make the next move - which is usually a fairly swift and final one.

it's frustrating to think of the difference that language would make. The millennia crawl by pretty bloody slowly while natural selection sifts its way obliviously through generation after generation, favouring the odd aberrant kakapo that's a little twitchier than its contemporaries till the species as a whole finally gets the idea. It would all be cut short in a moment if one of them could say, 'When you see one of those things with whiskers and little bitey teeth, run like hell.' On the other hand, human beings, who are almost unique in having the ability to learn from the experience of others, are also remarkable for their apparent disinclination to do so.

The trouble is that this predator business has all happened rather suddenly in New Zealand, and by the time nature starts to select in favour of slightly more nervous and fleet-footed kakapos, there won't be any left at all, unless deliberate human intervention can protect them from what they can't deal with themselves. It would help if there were plenty of them being born, but this brings us on to more problems. The kakapo is a solitary creature: it doesn't like other animals. It doesn't even like the company of other kakapos. One conservation worker we met said he sometimes wondered if the mating call of the male didn't actively repel the female, which is the sort of biological absurdity you otherwise only find in discotheques. The ways in which it goes about mating are wonderfully bizarre, extraordinarily long drawn out and almost totally ineffective.

Here's what they do:

The male kakapo builds himself a track and bowl system, which is simply a roughly dug shallow depression in the earth, with one or two pathways leading through the undergrowth towards it. The only thing that distinguishes the tracks from those that would be made by any other animal blundering its way about is that the vegetation on either side of them is rather precisely clipped.

The kakapo is looking for good acoustics when he does this, so the track and bowl system will often be sited against a rock facing out across a valley, and when the mating season arrives he sits in his bowl and booms.

This is an extraordinary performance. He puffs out two enormous air sacs on either side of his chest, sinks his head down into them and starts to make what he feels are sexy grunting noises. These noises gradually descend in pitch, resonate in his two air sacs and reverberate through the night air, filling the valleys for miles around with the eerie sound of an immense heart beating in the night.

The booming noise is deep, very deep, just on. the threshold of what you can actually hear and what you can feel. This means that it carries for a very great distances, but that you can't tell where it's coming from. If you're familiar with certain types of stereo set-up, you'll know that you can get an additional speaker called a sub-woofer which carries only the bass frequencies and which you can, in theory, stick anywhere in the room, even behind the sofa. The principle is the same - you can't tell where the bass sound is coming from.

The female kakapo can't tell where the booming is coming from either, which is something of a shortcoming in a mating call. `Come and get me!' `Where are you?? 'Come and get me!' 'Where the hell are you?' `Come and get me!' `Look, do you want me to come or not?' `Come and get me!' 'Oh, for heaven's sake.' `Come and get me!' 'Go and stuff yourself,' is roughly how it would go in human terms.

[1] [https://www.youtube.com/watch?v=wrmi5UV6-wk](https://www.youtube.com/watch?v=wrmi5UV6-wk)</comment>


The Impact of Rudeness on Medical Team Performance: A Randomized Trial - <AUTHOR> http://pediatrics.aappublications.org/content/early/2015/08/05/peds.2015-1385 <comment><AUTHOR> HN frequently talks about rudeness. There are a gajillion threads about, for one example, Linus. This study seems to show that rudeness degrades performance of teams.</comment>


A charity that spends a sliver of its money on those it purports to serve - <AUTHOR> https://publicintegrity.org/politics/iupa-leorf-police-union-charity-telemarketers/ <comment><USER2> Although this particular case is egregious, I'd like to point out that donors should not be overly focused on a simplistic view of a charity's finances.

A charity that only moves money around should of course be pretty efficient about it. But a charity that actually _does_ things faces the same kinds of inefficiencies as any business.

For instance, The Nature Conservancy is a charity I like (I'm not necessarily recommending them -- do your own research). About 2/3 of the raised funds go to their actual programs, and the rest is administrative and fundraising.

However, they are one of the few large environmental charities that _actually does stuff to help the environment, and attracts the expertise to do it well_. The rest are lobbyists and money-shufflers, which I have little patience for when it comes to charities.

In other words, I'm much more tolerant of inefficiency when actually doing something. I think anyone who actually does things would agree that it's not always efficient when observed from afar. But in reality it's much more efficient to go straight to the people who can do stuff than what other charities do: buy time with Congress, hoping that they will pass laws that will either (a) move some money around in such a way that someone (perhaps someone without much expertise) will do something; or (b) force someone to stop doing something, hoping that they won't find a much worse thing to do instead.

<comment><USER3> You would think that the "total efficiency rating" of a charity wouldn't measure just the internal overhead of the company you're giving the money to, but rather how much useful work comes out the other end once the job of actually helping someone has been subcontracted out N times. In such a view, a money-shuffler is clearly less efficient, because in the end they have to give the money to someone else, so they can only add overhead on top of whatever efficiency that someone-else already has.

<comment><USER2> What is the "total efficiency" of a charity that mainly does lobbying and awareness, and no actual work ever happens?

</comment></comment></comment><comment><USER4> In high school I actually worked at one of these organizations. It was the typical boiler room you might imagine: Grubby, dirty office space in a forgotten retail center with dingy cubicles consisting of a beat up desk, a phone and a stack of 3x5 cards to call. We were taught to do just about everything we could to convey that _we_ were active duty officers calling for donations, without actually saying that. Middle class citizens were all too often happy to donate or, in our case, buy tickets to what I assume was a non- existent fund raiser because of who they assumed we were. The whole system felt 100% fraudulent from top to bottom.

I lasted about 3 months and moved onto telephone sales for a major retailer. Back then if you had a deep voice you could make way better money than your friends working at fast food, etc.

I can recommend telephone cold calling as a means for getting an extremely harsh but powerful lesson in reading people via voice tone very very quickly. :)

<comment><USER5> Why deep voice?

<comment><USER6> Many people perceive a deep, masculine voice as authoritative. It's just the same way a big musclebound guy will be taken more seriously than a physically frail person saying the same thing. We haven't evolved as much as we like to imagine.

<comment><USER7> You're near Oakland, right? Have you seen the movie Sorry to Bother You? If not, I think you might enjoy it. It's an Oakland focused telemarketing spoof, and one of the better things I saw last year: [https://www.rottentomatoes.com/m/sorry_to_bother_you_2018](https://www.rottentomatoes.com/m/sorry_to_bother_you_2018). It's not perfect, but it's definitely original.

<comment><USER6> I've seen it, but thanks for the reminder to give it another viewing.

</comment></comment></comment></comment></comment><comment><USER8> This same scheme applies to any "charity" that does not overtly state 100% of their proceeds are donated. And it's not limited to law enforcement associations. Those commercials you see on TV about starving children, abused animals, suffering refugees, etc. are all complicit. What really happens: executive level and staff salaries are set at the market level for the association. All donations go to cover these "costs" throughout the year. Whatever is left over from these "costs" actually gets donated to their target group. The donations usually equal about 10% or less of their received funds. Correlate the executives that run these to other donation groups and you'll see a pattern of people running them. Unless 100% of the proceeds go toward the target group is clearly communicated, all you're doing is paying someone's salary to run a feel-good effort that actually contributes very little to their target. And I'm a cop. Do your research.

<comment><USER9> It strikes me as incredibly psychopathic on the part of the operators to run charity scams like this. How do they justify it to themselves?

Do other countries suffer similarly with fake self-serving charities like the US does?

<comment><USER10> > How do they justify it to themselves?

By looking at their bank accounts.

> Do other countries suffer similarly with fake self-serving charities like > the US does?

Not quite, robocalling is much less common, as are easy ways to figure out who is a likely donor.

A very good effort in this domain is Givewell, their own transparency report is a good example of how it should be done and their information is usually of very high quality:

[https://www.givewell.org/](https://www.givewell.org/)

[https://www.givewell.org/about/our- mistakes](https://www.givewell.org/about/our-mistakes)

</comment></comment></comment><comment><USER11> See also, Fraternal Order of Police. A quick Google search returns many results of the low quality of fundraising by this organization, which is not rated by charitynavigator because it's actually not a 501(c)(3).

<comment><USER12> In many cases, the FOP is really "give us money to get a sticker for your car that means some of our members might go more leniently on you".

See also: companies on eBay selling counterfeit stickers.

See also: the FOP designing stickers almost like vehicle tabs, with color coding so they can see that you're "paid up", sorry, "have donated".

<comment><USER13> In Washington state you can even get special license plates that say "law enforcement memorial" for an annual fee, presumably for the same purpose. I was tempted to get these for my car+motorcycle but then I remembered I haven't gotten pulled over in 20 years so I probably don't need it.

<comment><USER14> In California I occasionally see "11-99 foundation" license plates, for $2500 any non-felon can get one and hope the California Highway Patrol will go easy on them.

<comment><USER15> Had to look up the foundation. Why would you need to do a background check to donate? Seems counter productive.

</comment></comment></comment></comment></comment><comment><USER16> An ex once worked for a "charity" like this. The person running the "nonprofit" drove a very nice car, but as far as we could tell the income (mostly derived from fooling retirees into increasing their recurring donations) went largely to perpetuating the owner's paycheck with a small amount diverted to printing pamphlets.

<comment><USER12> Australia used to have (still might, I moved to the US in 2006) a scheme called "work for the dole" ("dole" being slang for unemployment benefits).

Be unemployed long enough and you had to do a work program, or learning scheme. I was laid off as a web developer during the first dot com crash. And ended up in one of these - a computer "web" course, run at a church, that'd teach people HTML, etc. One, I figured it'd be easy for me, and two, I could even mentor people.

It was a shit show. 10 people, 5 donated computers (which were old, and didn't have fresh installs, so lots of browser bar removals, etc., etc.). Only one copy of Dreamweaver. Lots of screwing around.

I'm thinking to myself, I know the government pays people to come up with these schemes and can make themselves a supplier - provide a program, outcomes, and get paid per student to teach them.

Why then the donated old computers, the church hall, and the shared copy of Dreamweaver? The second morning, the "tutor" told us the owners were going to come by and check on things.

It was two ladies in their 50s. They had near zero familiarity with computers and very little desire to know / learn anything...

... probably because they were too busy discussing the features of their two brand new company cars, Jaguars, that they'd just picked up. Not leased, just purchased outright. With the funds that were presumably to provide computers and educational materials.

<comment><USER17> >I'm thinking to myself, I know the government pays people to come up with these schemes and can make themselves a supplier - provide a program, outcomes, and get paid per student to teach them.

Unemployment/retraining and social services type programs are child's play when it comes to state sanctioned wastes of money. The real money is in the programs judges force people to attend. The people who are really smart (or devious, depending on your viewpoint) make up programs that sound like they screwing people who deserve to be screwed (if you ask the people who take everything at face value) out of their money but are really a much broader dragnet. Traffic school and anything having to do with DUI are the best examples that come to mind but all sorts of "failure to respect the rules set by the government" civil infraction and misdemeanors have accompanying privately run programs that the judges will require people to attend in lieu of jail time or longer probation (both of which cost the state money). These programs can fly under the radar basically forever because a large chunk of the population will turn a blind eye to anything bad as long as you can do some mental gymnastics and make it seem like the bad thing is happening to "criminals".

</comment></comment></comment><comment><USER18> There is a whole gaggle of these outfits.

In New York, they always have aggressive guys with heavy Long Island accents. The schtick always puzzled me, as I live upstate and the accent sounds like nails on a chalkboard up here.

</comment><comment><USER19> Always check the percentage of money donated/used for the purpose of a charity vs how much is spent on overhead/fundraising (using public sources not the charity). Ideally 90% should go to the purpose and no more than 10% to the other. It's sad how many are inverted.

</comment><comment><USER20> I use givewell ( [https://www.givewell.org/](https://www.givewell.org/) ) out of fear of this kind of thing. I have no affiliation with them but I do recommend them due to the way they evaluate charities.

</comment><comment><USER21> To get the most bang for your buck: [https://www.givewell.org/](https://www.givewell.org/)

<comment><USER8> Nice find! Thanks! Happy holidays to you!

</comment></comment><comment><USER22> Seems like it's too easy to setup a "charity" with little to no oversight. Just my outside opinion with little knowledge of the process or follow up done. This kinda reminds me of the Goodwill reports that came out bashing them...

<comment><USER23> The whole charity tax exemption concept is just a big loophole, and I can't imagine it was created unintentionally. Obviously there is not sufficient manpower for enforcement of the rules, not to mention it's impossible to make the rules without so much room for plausible deniability that it wouldn't make a difference anyway.

<comment><USER24> Ikea

</comment></comment></comment><comment><USER25> I generally assume most charities are bogus until and unless I specifically research it and discover otherwise.

For example, the Seattle Marathon has long claimed to help UW medicine, and then it turned out that less than 1% of their money (and none of the entry fees) were going there.

[https://www.seattletimes.com/seattle-news/just-1-of- seattle-...](https://www.seattletimes.com/seattle-news/just-1-of-seattle- marathon-money-goes-to-charity/)

</comment><comment><USER26> I consider almost all charities to be scams, it's an easy way for a few people to make a lot of money and everyone else to get shafted.

</comment><comment><USER27> The Susan G. Komen breast cancer organization gives only 20% of their donations to cancer research and pays their CEO $684,000 per year.

<comment><USER28> Their business seems to be "raising awareness", as if there are people out there that are still unaware of breast cancer.

</comment></comment><comment><USER29> I never donate to any charity that asks for donations on a phone call. I ask them to email or mail me the information to consider. Furthermore even if it is a charity I know about, I rather donate directly on their website to make sure middlemen don't take their cut.

</comment><comment><USER30> Example: American Red Cross raised $500 mio for Haiti, built 13 (!) houses, didn't know where money went!</comment>


The Legend of Verdun - <AUTHOR> http://www.newstatesman.com/politics/uk/2016/02/legend-verdun <comment><USER2> If you've not listened to Dan Carlin's 6-part series on the Great War, take the time to do so. The "whys" and "hows" of World War I are much harder to get your head around than WWII...it's just much less linear. Not only does he do an excellent job of making the mechanics of the war understandable, he draws the element of humanity into stark relief by interspersing explanations of troop movements with first hand accounts of the suffering and carnage men sustained.

Episode IV focuses on Verdun and can be listened to as a stand alone episode but the rest of the series is very much worth the time. [http://www.dancarlin.com/product/hardcore- history-53-bluepri...](http://www.dancarlin.com/product/hardcore- history-53-blueprint-for-armageddon-iv/)

<comment><USER3> And if you prefer very long and dense text, I'd strongly recommend John Keegan's "The First World War" \- similar to your description, it really gets into the human reality of the war with first-hand sources.

<comment><USER4> >very long and dense text,

It really isn't by the standards of history books though. It's very readable because it does get into the human reality as opposed to endless facts. It's probably the best single book on WWI that I've come across.

</comment></comment></comment><comment><USER5> An important reason why the fight was so bitter over seemingly small amounts of land that this article (and others) seem to miss is that a relatively limited area of northern France amounted to over half of the country's industrial production. Coal and steel in particular, critical to the war effort were overwhelmingly produced there.

Any incremental part of this region lost to the Germans wasn't just a symbolic loss of ground or a moral defeat, it meant a real long term resource loss which could tilt the balance of the war in Germany's favour. In comparison, the allies were largely unable to strike Germany's industrial centers. It's quite easy to depict all senior commanders of the time as inflexible and stubborn (some of them were, to various extents anyway), but there's more to it than that.

Defence in depth just wasn't an option, and mechanised war was a fiction anyway. With the benefit of hindsight, and ignoring the industrial value of the North, it's easy to jump to simple but wrong conclusions about why the war was fought that way.

Edit: Link to English source illustrating my point [http://encyclopedia.1914-1918-online.net/article/raw_materia...](http://encyclopedia.1914-1918-online.net/article/raw_materials)

<comment><USER6> Best i can tell, when commanders are presented as inflexible and stubborn, its about the tactics, not the strategy.

Yes, they had good reason to fight there. But the way the fighting was conducted was more often than not a stilted mess.

<comment><USER7> Indeed, much of the criticism seems to be centered around the general theme of, "Charging machine guns over open ground didn't work the last 300 times we tried it, but maybe today will be the day."

<comment><USER8> With enough artillery and men it actually did work in many cases. The large scale assaults regularly made progress measured in miles. The problem was that you couldn't meaningfully continue an advance or exploit a breakthrough. Once you left your trenches you also left your supply lines. The enemy could respond to any breakthrough with overwhelming force mobilized by their own rails and roads.

</comment></comment></comment></comment><comment><USER9> Petain was not the only reason why French officers started sparing men. The early French officers were professional army men, who cultivated the tradition of charging the enemy directly, a suicidal exercise at the age of machine guns. But they not only forced their men to do so, they charged the enemy themselves too. As a result most of them died in the first year of the conflict. They were then replaced with drafted civilians who didn't share this chivalrous conception of war.

The other main reason is that as the men hardened with experience, not only were they reluctant to participate in a mass suicide, but French officers started to be increasingly killed by "friendly fire", which somewhat tempered their strategy.

<comment><USER10> _The early French officers were professional army men, who cultivated the tradition of charging the enemy directly, a suicidal exercise at the age of machine guns. But they not only forced their men to do so, they charged the enemy themselves too. As a result most of them died in the first year of the conflict. They were then replaced with drafted civilians who didn 't share this chivalrous conception of war._

One historian I heard (not sure how accurate this is) said the British Army had a parallel but somewhat inverted experience. Before the war the British Army was much smaller than eg the French or German armies, but was very professional and had adapted well to modern weaponry and tactics in both attack and defence.

The trouble was that at the beginning of the war, the war was expected to be over quickly so the British command didn't worry about sending nearly all its officers (and their institutional knowledge) to France for the experience and 'adventure'.

It didn't work out as planned though and after getting bogged down and suffering many casualties very quickly, the huge job of training lots of new officers and soldiers was left to an older generation of ex officers back home who reverted to the older tactics. It didn't take long for the British army to revert to those ineffective suicidal charges too.

</comment></comment><comment><USER11> If anyone has an opportunity to visit the Verdun area, please do. It's surreal. The landscape is still scarred by the war. It feels like you're on the moon. Craters, pieces of metal still sticking out of the ground, bunkers... undoubtedly wherever you are walking there are probably soldiers buried beneath you.

<comment><USER12> I visited a few years ago. Haunting and surreal. Here's a few of my photos, they don't do it justice except to show the craters and pieces of metal like you described.

[https://goo.gl/photos/WGePPQWYwNHeCaN37](https://goo.gl/photos/WGePPQWYwNHeCaN37)

<comment><USER13> Some of the Bosnian countryside is similarly pocked and then grassed over. I wasn't sure when driving through a few years ago if that was a remnant of war or a natural feature?

</comment></comment></comment><comment><USER14> A good movie about the insanity of the trench warfare and some of the French commanders of WWI is Paths of Glory - [https://en.wikipedia.org/wiki/Paths_of_Glory](https://en.wikipedia.org/wiki/Paths_of_Glory).

</comment><comment><USER15> For those who read French, Le Monde just published and interesting piece about Verdun at [http://www.lemonde.fr/histoire/visuel/2016/02/21/verdun-c- et...](http://www.lemonde.fr/histoire/visuel/2016/02/21/verdun-c-etait-une- boucherie-inouie_4869124_4655323.html)

</comment><comment><USER16> I found the use of the word "legend" a bit confusing. Since I'm not a native speaker, I looked it up in the Oxford Dictionary [1], but still, none of the meaning seem to be applicable here:

1\. A traditional story sometimes popularly regarded as historical but not authenticated.

2\. The story of a saint's life.

3\. An extremely famous or notorious person, especially in a particular field.

4\. An inscription, especially on a coin or medal.

5\. A caption.

6\. The wording on a map or diagram explaining the symbols used

My initial association was along the lines of 1., and so I was afraid to read an article doubtful of historical consent -- but that was not the case. Neither was the article about a singled-out person which could give rise to 3. The last three definitions clearly refer to a different kind of legend altogether.

Could someone with a better intuition please explain how the title of this article is meant to be understood? and since 3. refers to a single person).

[1] [http://www.oxforddictionaries.com/definition/english/legend](http://www.oxforddictionaries.com/definition/english/legend)

<comment><USER4> I'm not sure that the word is quite right in this context but it basically refers to the fact that the event is deeply embedded in the national consciousness and that it appears to provide lessons that may not be correct ones. It's a variant of meaning 1. The sense in which that applies is probably best given by these paragraphs:

What were the lessons of Verdun, if any? In 1940, Hitler's smart new generals, such as Heinz Guderian, tackled the problem of static warfare with a blitzkrieg technique of fast-moving armoured attack. They went round the side, and back, of Maginot's costly fortresses, making them capitulate without firing a shot. Verdun fell in a matter of hours, France after a six-week campaign. But Hitler missed the main point, militarily: never make a fetish of any fortress, any stronghold, so that you become committed to hold it however unacceptable the costs.

The capture of Verdun in 1916 would have been unlikely to have caused France to lose the war. Yet in the Second World War, Hitler's orders to his generals not to surrender an inch of ground, led to repeated disasters – beginning with the sacrifice of Friedrich Paulus's entire 6th Army at Stalingrad, which eventually brought about the destruction of the Third Reich.

And yet, in the heart of the French army, the myths and the slogans of Verdun, chimeric as they were, persisted well into the 1950s. Brave young paras died at Dien Bien Phu in the First Indochina War with Verdun on their lips.

</comment></comment><comment><USER17> I am named after my great-grandfather who perished here along with so many of his compatriots. He died at Fort Douaumont, as I recall, as the German soldiers shot into the tunnels of the fort. He had three children and was around forty years old. My grandmother never knew her father. These tragedies resonate throughout generations. Astonishingly, it is possible to find his death certificate online [1].

[1] [http://goo.gl/WdUpid](http://goo.gl/WdUpid)

</comment><comment><USER18> Very cool to see Verdun's centenary commemorated by its greatest historian 50 years after he wrote The Price of Glory.

[http://www.amazon.com/The-Price-Glory- Verdun-1916/dp/0140170...](http://www.amazon.com/The-Price-Glory- Verdun-1916/dp/0140170413)

</comment><comment><USER19> I think of the problems with American politics today is that our politicians cast many problems in the context of WWII (ISIS are as bad as Nazis; any negotiation with Iran would constitute another Munich). If they were using WWI as the analogy, they would come to very different conclusions.

<comment><USER20> I wonder what the world would look like if WWII had never happened. Nobody came out of WWI feeling good about the results, and a lot of people were determined that it should never be repeated; but WWII gave us a lovely tidy narrative of good vs. evil that arguably restored a lot of shine to the idea of glorious, heroic battle, at least in places that had not actually been devastated by it (e.g. the USA).

<comment><USER21> Not really -- world war 2 was really a settling of the over-punitive peace imposed in the first war.

I wouldn't be surprised if future historians view 1914-1989 as one war.

<comment><USER20> > _Not really_

I'm not clear which of my points you disagree with.

Also, there were three Axis Powers in WW2, and two of them had fought _against_ Germany in WW1. It's overly simplistic to say that post-war suffering in Germany was the sole cause of WW2--especially as there were terrible sanctions after that war as well, but Germany has not gone to war again.

<comment><USER21> I don't buy the good v. evil position on WW2. The problem with WW1 is that it was a stalemate or a pause. All parties involved were weakened, but the status quo continued. The old 19th century system carried on, bereft of its youth and treasure.

Europe was all about Germany being stuck between a rock (the post-war sanctions) and a hard place (the threat of the communist revolution that Germany implanted to defeat the Czar to the money men in Germany). Italy was a sideshow.

The difference in the post-WW2 era, and the reason we didn't have WW3 in 1960 is simple. The US emerged triumphant and essentially occupied or otherwise controlled all of the powers, save China and the Soviet Union. As the US loosened control, mutually assured destruction made WW1/WW2 style "total war" too costly.

</comment></comment></comment></comment></comment><comment><USER22> There is a Youtube series called The Great War where they are performing news casts as if the events had just happened (only 100 years later).

The size of the armies was huge and the loss of life was astounding. Which is what you get when attrition is the common strategy employed.

[https://www.youtube.com/watch?v=HfKUd8bvQfc](https://www.youtube.com/watch?v=HfKUd8bvQfc)

At this point the US is just getting upset over 128 citizens being killed on the RMS Lusitania when it was sunk during a period of unrestricted submarine warfare. Our entry into the war as an Associated Power won't take place until 6 April 1917.

</comment><comment><USER23> I finished the article but went immediately to Google for "Fort Douaumont", to learn more details of "the world's most impregnable fort, [which] was, by a series of almost incredible errors in February 1916, virtually undefended" and the recapture of which "is estimated to have cost the French as many as 100,000 men".

Wikipedia has a pretty good writeup:

[https://en.wikipedia.org/wiki/Fort_Douaumont](https://en.wikipedia.org/wiki/Fort_Douaumont)

> _Kunze and his men reached the fort 's moat and found that the wall > casemates ("coffres") defending the moat were unoccupied. Kunze managed to > climb inside one of them to open an access door. But his men refused to go > inside the fortifications as they feared an ambush. Armed only with a bolt- > action rifle, the Pioneer-Sergeant entered alone. He wandered around the > empty tunnels until he found the artillery team, captured them and locked > them up._

> _By now, another group from the Brandenburg regiment, led by reserve-officer > Lieutenant Radtke, was also entering the fort through its unoccupied > defences. Radtke then made contact with Kunze 's troops and organised them > before they spread out, capturing a few more French defenders and securing > the fort. Later, more columns of German troops under Hauptman Haupt and > Oberleutnant von Brandis arrived. No shots were ever fired in the capture of > Fort Douaumont. The only casualty was one of Kunze's men who scraped one of > his knees._</comment>


There are eerie similarities between the US now and Japan in the 1990s - <AUTHOR> http://www.nytimes.com/2008/03/05/opinion/05roach.html?ex=1362373200&en=8da090c366d0fcb3&ei=5090&partner=rssuserland&emc=rss&pagewanted=all

<comment><USER2> [http://www.economist.com/opinion/displaystory.cfm?story_id=1...](http://www.economist.com/opinion/displaystory.cfm?story_id=10729998) is a good rebuttal.

</comment><comment><USER3> "...A more effective strategy would be to try to tilt the economy away from consumption and toward exports and long-needed investments in infrastructure."

Fat chance of that. Faith in the spending power of American consumers would have to dwindle a whole lot before companies stop selling to them.

</comment><comment><USER4> If infrastructure spending is the solution (not sure I agree with that one) then federal funding for fast-tracked subway network construction in regional population hubs would be ideal. Massive up-front costs (pouring money in the economy) coupled with long term huge productivity gains. Never happen though, sigh.

</comment><comment><USER5> Sample size: 1. Kids: learn some jargon and you too can be a macroeconomist!

</comment><comment> patrickg-zill Add a hint of Weimar as well, could be a potent mix.</comment>


Hotmail Adds New Feature "My Friend's Been Hacked" - <AUTHOR> http://www.tekgoblin.com/2011/07/16/hotmail-adds-new-feature-my-friends-been-hacked/

<comment><USER2> > Hotmail is also working hard to eliminate accounts that have simple > passwords such as "12345678″ and "password" by increasing security measures > and not allowing simple passwords to be created.

Awesome. Not like I use Hotmail, but... So now if someone's password generator just happen to generate "weak" password not containing, for example, a digit (uh, even `openssl rand -base64 12` provides such outputs from time to time) user'll have to step away from usual password generation scheme and create special password just for hotmail.com.

Please, for the love of sanity, never ever forbid any passwords (except for too short ones, with a reasonable minimal length). Just freak user out so he'll think twice before using possibly weak password. You'll educate users this way instead of frustrating them.

(And never limit maximum length or set of possible characters, except for rare cases where there are technical obstacles requiring to do so - like non-8-bit- safe protocols. If user wants to authenticate with a passpoem, written in runic alphabet — let him have it.)

<comment><USER3> Curious, what is your reasoning behind allowing 123456 in order to keep some kind of crazy "random generator" purity, but at the same time requiring a minimum length? Suppose my pw generator randomly generates passwords of different lengths? It seems to me the same operating principle behind why you don't want to limit character selection/order applies to string length as well.

<comment><USER2> I thought that a minimum limit's there just to ensure sanity of a generator. You can't generally predict how a hash function will behave, but you can certainly define a minimum output length. What I was thinking about, that the restrictions are too strict, and there's a gap between what's secure and what looks secure.

I believed that it's generally expected that a password generator would produce passwords of a certain minimal length. At least I considered that nobody would write a generator (intended for a real-world usage) that'd produce, say, 3-character password for some edge case.

However, you sound reasonable. This leads us right to the extreme case - should empty passwords be allowed? (Considering that the user will be bugged like hell before letting him to do so.)

I should think more about this.

<comment><USER4> I remember creating a blank password on Mac OS9 in grade school. It was clearly a bug that allowed me to do it, because the minimum password length was set to six characters, if I recall correctly. After I set the null password, I couldn't change it, but it worked fine for logging into my account. I was too embarrassed to ask the admin for help, so I was stuck with no password for about two years.

</comment></comment></comment></comment><comment><USER5> The people I know who use hotmail these days all love it. Unfortunately an @hotmail.com email address in my field is just instantly regarded as unprofessional and laughable.

<comment><USER6> Oh, be serious. I still use my @hotmail.com account extensively. I've had it since before MS bought it, so I think it is more a sign of my longevity online than anything else. Most professional software engineers that I know feel the same way. My experience is that people who judge you by your email tend to be very young and inexperienced software folk.

<comment><USER7> I'm in the same boat as you as far as how long I've been using hotmail. I've been migrating more and more to gmail, but I've got that hotmail account tied to so much shit over the years, I'm not even sure what I'd be losing if I ditched it completely.

</comment></comment></comment><comment><USER8> >Hotmail will put the account in recovery mode which will cause a password reset.

This sounds like it could be easily abused. How will the password reset work if the hotmail address is the only one a user has? What will he need to do to reclaim access to his account?

<comment><USER9> in comments to the original blog post, the PM for this feature mentions that the "my friend's been hacked" reports aren't enough by themselves to trigger this, they have to be accompanied by suspicious usage patterns on the alleged hacked account.

</comment></comment><comment><USER10> I think that this is a great idea, but there will need to be a few things in place to make it secure enough for use.

\- Only friends that communicate "a lot" should be able to report it (and not repeatedly).

\- If the account's password was compromised, then the attacker will enter the account recovery flow on next login attempt. So the AR flow will need to ensure that the user is not the attacker (SMS and e-mail that are trusted, based on age and usage, is pretty good).

But why not just create a system that will alert the user when a successful login was made from a new device on their account? And include an account lock link in the e-mail, so they can quickly lock their account from anywhere with cell phone access.

</comment><comment><USER11> I've noticed that Hotmail's spam filtering has improved significantly in the past year or two (I still have an old Hotmail account). It may be 7 years to late to compete with gmail for new customers, but it's nice to see these improvements from Microsoft.

<comment><USER12> An added benefit of this is Exchange customers can take advantage of what Microsoft has learnt from filtering Hotmails spam by using FOPE (<http://technet.microsoft.com/en-us/forefront/cc540243>) as a cloud based spam filter. It's amazing how well it works

</comment></comment><comment><USER13> Has anyone ever seen Microsoft confirm a problem with Hotmail _itself_ being "hacked"? I have an account with Hotmail I don't use and haven't done since 2007, I logged in recently to discover it had been sending spam emails. Every single person I know with an active or inactive Hotmail account has the same problem.

<comment><USER14> I have several old accounts, I just logged into a few and they haven't sent any mails. I have family that use Hotmail and don't get spam from them either.

Maybe you and your circle all happened to use some of those other big profile sites (Gawker, Sony, etc.) that have had their e-mails and password lists stolen...

<comment><USER13> Hm, how strange. I've not used the account for anything other than msn, a google search for it only yields results from 2 forums where I've posted it (in "add your msn" topics) from ~2006 and the password is what was used for a variety of other things at the time, none of which were "hacked", so I always assumed it was the result of an internal Hotmail breach. How strange, maybe it was just me and my friends then. Confirmation bias at work...

</comment></comment></comment><comment><USER15> Summary of a summary of [http://windowsteamblog.com/windows_live/b/windowslive/archiv...](http://windowsteamblog.com/windows_live/b/windowslive/archive/2011/07/14/hey- my-friend-s-account-was-hacked.aspx)

</comment><comment><USER16> Is this a testament to the innovation of the Hotmail team or the non-savvy of its userbase? Honest question.

<comment><USER17> Both, really. It's a sort of clever way to deal with a problem that plagues non-savvy users.

</comment></comment><comment><USER18> haven't tried this feature yet. and don't expect to try any time in the future either. if my friend is hacked and keeps sending me email, i'll just block that person.

</comment><comment><USER19> So, they've made it easier for people to launch simple denial of service attacks on hotmail accounts.

</comment><comment><USER20> What if you have a contact who has been hacked and uses Hotmail, but you don't? (This is actually the case for me right now.)</comment>


Lean Startup Machine Team Needs Feedback - <AUTHOR>

We're in the middle of the Lean Startup Machine this weekend here in SF.
http://sf.theleanstartupmachine.com/
We're scrambling to try and get validation around a couple of ideas. If you could complete this survey, it'd help us a bunch!
http://goo.gl/s2AdG <comment><USER2> I could be wrong but this doesn't seem like you guys trying to validate _a couple of ideas_. It seems more like validating _an idea_. Else it'd be any idea revolving around plants. Since the first answer I would have posted would have been no (I'm not your target audience in this survey), everything else became moot so I didn't actually fill it out.

<comment><AUTHOR> For sure EECS, all the ideas we are trying to validate are focus on growing plants. The way you didn't fill out the form was just right.

</comment></comment><comment><USER3> Agree with EECS - Every question is moot if the answer to your first question is NO...</comment>


Unlocking blockchain: 5 music startups to watch - <AUTHOR> https://www.iq-mag.net/2017/11/unlocking-blockchain-5-startups-watch-katerina-kirillova-tickets-cloud/ <comment><USER2> Author uses sleight of hand to hide conflict of interest. The byline says founder of Tickets Cloud. Then if you end up reading carefully towards the end - the author is associated with the 2nd "startup to watch" \- crypto.tickets

I am onboard for blockchain the technology but this is just bullshit. Most of them are generic business with "blockchain" thrown in.

</comment><comment><USER3> I don't hate the general idea behind crypto.tickets (linked in article), but they have an ICO on the homepage which is immediately making me skeptical...

</comment><comment><USER4> what an great article, i dream of a future where i use internet instead of going to bank. i will buy music and ticket straight from artist without using intermediary. wow.</comment>


Blazor Introduction – What Is Blazor? - <AUTHOR> https://www.claudiobernasconi.ch/2020/01/21/blazor-introduction-what-is-blazor/ <comment><USER2> Sorry but I fail to see the point of Blazor. It just feel like cool tech lacking a use case?

Anyone feel like helping me out here?

<comment><USER3> It lets you write complex web components using C#. For a lot of people, like myself, this means being able to share things like models and static utility methods between the client and server.

I've personally been using Bridge.NET recently for a project that requires JavaScript. Sure it's heavy and TypeScript is out there, but I personally hate the TS syntax and tooling. When I only use JavaScript in my 5% day to day, I don't really feel like maintaining it in a language I find cumbersome. Bridge.NET is obviously just writing TypeScript with C# syntax, but I will definitely be evaluating Blazor in the near future.

Stuff like WASM is seriously important for web applications moving forward. Especially in the area of DRM, like it or not.</comment></comment>


DuckDuckGo vs. Google Search Results - <AUTHOR> https://mlu.red/muse/53406466310.html <comment><USER2> Wrong forum for such a link. Just wait for the DDG apologists to attack your claims.</comment>


The Game of Startups: Are You Playing to Win?: Multifaceted - <AUTHOR> http://multifaceted.io/2014/the-game-of-startups-are-you-playing-to-win/ <comment><USER2> I completely agree with the line, "Treat the stock options like a lottery ticket. You should work for your startup because you believe in the founder's vision, not because you think you will get rich". Bad behavior (hopping to startup to startup looking for the pot at the end of the rainbow) leads to poor loyalty and high hiring costs. If you are not passionate about the business itself, then don't take the offer.

</comment><comment><USER3> What Sean has done with Spree reinforces how powerful the Ruby-on-rails open source community is in developing complex code. The challenge is to keep on top of the changing e-commerce landscape and demands of end users. Ultimately a e-commerce site/platform is only as good as its ability to close out a shopping cart transaction.</comment>


Senator Chris Murphy – "We tried to organize a kind of coup [in Venezuela]" - <AUTHOR> https://twitter.com/ChrisMurphyCT/status/1290656459496263687 <comment><USER2> mmmm wtf... I feel like twitter is not the place to put this in writing? Maybe it is common knowledge.

<comment><AUTHOR> I think it was common knowledge but unconfirmed, if that makes sense - no rep had actively referred to it as a coup before despite it clearly being one</comment></comment>


25 Dots, 8 Lines - <AUTHOR> http://e-riddles.blogspot.gr/2013/04/25-dots-8-lines.html

<comment><USER2> Spoiler - interesting solution [from the comments]: [http://www.scribd.com/doc/133494020/Extended-9-dots- puzzle-t...](http://www.scribd.com/doc/133494020/Extended-9-dots-puzzle-to- nx2-dots)

Solved mathematically :)

<comment><USER3> Where's the 'solved' part? At the very best, he shows that you can do it with 2 _n-2 lines. Even that includes a lot of hand waving/implicit "it is easy to see"-s.

That you need 2_n-2 lines, he doesn't talk about at all.

<comment><USER4> Additionally the OEIS now contains a wrong fact [1] - the sequences are offset by one. I am not even convinced that 2n - 2 is optimal - does somebody know if it is or can proof a better lower bound than the trivial n?

[1] <http://oeis.org/A058992>

</comment></comment></comment><comment><USER5> I left a hill-climbing solver running overnight and found quite a few solutions, including a couple that can be made to stay inside the square: <http://imgur.com/a/Wd2dS>

</comment><comment><USER6> I can solve it with just 5 lines. You just have to get the pen to infinity and then come back.

Wait, if infinity wraps around that'll take just one line!

<comment><USER7> I am pretty sure that it is meant to be solved on a compact, simple connected subset of |R^2, with Euclidean metric.

<comment><USER8> Careful with that. If the frontier of that subset is not far enough from the points, the problem will not be solvable.

<comment><USER7> And probably the word 'open' is also missing, then I can always find an embedding such that there is enough room :)

</comment></comment></comment></comment><comment><USER9> My solution: <http://i.imgur.com/z2mo2Jj.jpg>

</comment><comment><USER10> My solution <http://i.imgur.com/S2L9pht.jpg>

</comment><comment><USER11> Solution (rot13):

Whfg genpr nebhaq gur bhgfvqr gura hfr gur fbyhgvba gb gur fznyyre chmmyr.

<comment><USER12> Great. Keeps it simple.

On a side note, can anyone build a cool ROT13 converter? There are some, but they are showing their age.

</comment></comment><comment><USER13> Why do you need 8 lines? You just need 5 lines, and an enormous piece of paper.

EDIT: Beaten to the punch. I should learn to read comments first.

</comment><comment><USER14> It doesn't specify that you can't add curved lines between your straight lines without lifting your pen.

</comment><comment><USER15> It's possible to solve it entirely "within" the box.

</comment><comment><USER16> What? kindly explain a little..</comment>


Creating a Virtual Printer Using Node.js [video] - <AUTHOR> https://www.youtube.com/watch?v=58Ti8w1yX2w <comment><USER2> It would be so helpful if the author would make a simple statement at the beginning of the video about what this does and why it is useful. Over ten minutes into the video, we have no idea. Read the project description on Github, still no idea.

Why not start with, "This project creates a virtual printer that advertises itself with Bonjour and writes a postscript file to local storage." Follow that with a simple statement about why that is cool and what you can do with the file, which is still not apparent.

Obfuscation has become the norm.

<comment><AUTHOR> Would a better description under the video on YouTube help, or would you want me to have mentioned it on a slide?

<comment><USER3> put the desc under the video

</comment></comment></comment><comment><USER4> Github: [https://github.com/watson/ipp-printer](https://github.com/watson/ipp- printer)

<comment><AUTHOR> Here are the rest of the links:

[https://github.com/watson/ipp-encoder](https://github.com/watson/ipp-encoder)

[https://github.com/watson/printcat](https://github.com/watson/printcat)

[http://printb.in](http://printb.in)

</comment></comment><comment><USER5> Is this any different to "Save as PDF"?

<comment><AUTHOR> Save to PDF would just give you a PDF. The idea here is that you can do whatever you like with the print-job as long as you can program it. So print to PDF is just the most simple example.

I mention a few low hanging fruits in the talk like "print to bookkeeping" \- but that's just one use-case. Consider that you can use it as a printing proxy and divert jobs to different printers or implement an authentication system or a payment system before printing. There are a lot of options...

<comment><USER6> Print to bookkeeping is actually a pretty brilliant idea... I'm planning to start doing itemized taxes for the coming year, and this could be useful as a basis for capturing receipts... Combined with cloud print... snap a photo of the receipt on my phone, print to bookkeeping, sort it out later.

Might even be able to combine with GPS info in the image to log where the receipt is from, etc.

This could be a pretty decent idea for adding to online bookkeeping services... so that you can tag receipts, for tracking the taxable portion of them, etc.

Advance print queues for printing services could be another thing...

<comment><USER7> How is that better than 'print to google drive' from chrome or android?

<comment><USER6> The printer endpoint could be integrated into a web-based accounting platform.

</comment></comment></comment></comment></comment><comment><USER8> I've just recently discovered NodeJS -- heard about it for years, of course. I was able to create a web server for one of my group's web apps in about 5 lines of code. It's a bit weird to wrap one's mind around it at first, but then it starts to make a lot of sense.

This IPP server is cool, though I'm not sure what uses it has yet. Maybe just a handy way to print to disk without having to choose a folder and file name. Or use as a proxy to redirect print requests to different printers depending on size or type of print job. Or a way to queue up print requests until off- hours. This is just off the top of my head and I'll bet there are other cool uses as well.

</comment><comment><USER9> Printers and Javascript, a match made in hell.

<comment><USER10> JavaScript is great. I do enjoy all the posts about how it sucks. First it was a toy language. Now people complain that it's a weakly typed language replacing strongly-typed languages they prefer... I'm interested to see the next iteration of this phenomenon.

Meanwhile I just enjoy developing in it every day. Other than having to maintain the odd ExtJS app, it's simply the best. _cue triumphant sax_

<comment><USER11> Just out of curiosity, what other languages do you have experience with?

<comment><USER10> C++, Java, Groovy, C#, Perl, Python, PHP, Ruby, Smalltalk, Objective-C, *86 Assembly, and played around with Go, Swift, Lisp and Haskell

oh, and Visual Basic!!!

I didn't say JavaScript is all anyone needs for every situation, just that it's great imo.

</comment></comment></comment></comment><comment><USER12> That had absolutely nothing to do with making printers great (again).

Printers suck a putting stuff on paper, doing a digital copy via a printer protocol doesn't fix that. It's neat and there might be some interesting use cases, but it doesn't fix what's wrong with printers.

I'm not even sure that printers where ever that great. Printers seems like devices that sort of peaked 40 years ago. Since then they have gradually decreased in quality. Printing 1000+ pages a day seems to be a little much to ask from many printers, they simply wear out to quickly. The whole process of looping paper around inside something that fits on a desk (sort of), combined with cheap plastic parts is a receipt for disaster.

Software-wise the manufacture should stop trying to add more feature that no one while ever use and instead work on making "cancel print job" actually work. The number of times a printer (driver?) has chosen to pick the wrong paper-tray is mind boggling. Why are there even multiple trays, we only ever need to print on standard A4 paper? Sadly picking a printer where the hardware quality will support the volume also result in feature bloat.

I really hate printers, and no amount of Javascript will make them any better.

<comment><USER13> > I'm not even sure that printers where ever that great. Printers seems like > devices that sort of peaked 40 years ago. Since then they have gradually > decreased in quality. Printing 1000+ pages a day seems to be a little much > to ask from many printers, they simply wear out to quickly. The whole > process of looping paper around inside something that fits on a desk (sort > of), combined with cheap plastic parts is a receipt for disaster.

If you get an old LaserJet they're industrial beasts. But no-one wants to pay money for a printer, so we end up with two markets: the very expensive, but good, professional printers, and the domestic horrible printers.

If you're printing 2 reams a day you can afford to invest in a decent printer.

> Why are there even multiple trays, we only ever need to print on standard A4 > paper?

You only need that. A bunch of offices need to print on A4, and C5 envelopes, and sometimes A5 and sometimes on labels.

<comment><USER14> I would pay for a quality printer. Something along the lines of Epson EcoTank, but it's going to take some time to heal my printer wounds.

The printer needs to be well built. The printer needs cheap ink, and no chipped cartridges, the ability to use generic ink, and ink cartridges that don't dry out. Then, and only then will I spend a lot on a printer.

The printer industry seems to have shot themselfs in the foot while being clever with chipped cartridges. People realized they don't need to print? I have a Epson r2400 collecting dust. I just got tired of paying over a hundred dollars for their pricy ink.

I am now so used to not printing; maybe I'll never return?

<comment><USER6> If you go color laser, you'll probably have a better experience...

</comment></comment></comment></comment><comment><USER15> This is really cool</comment>


Drone-mapping slums for land titling – one pixel at a time - <AUTHOR> https://factordaily.com/orissa-drone-mapped-slum-titling-project/ <comment><USER2> This is the happiest article I have seen in a long time.

It makes me think of Hernando de Soto Polar and the ILD.

"Between 1988 and 1995, he and the Institute for Liberty and Democracy (ILD) were mainly responsible for some four hundred initiatives, laws, and regulations that led to significant changes in Peru's economic system.[4]

In particular, ILD designed the administrative reform of Peru's property system which has given titles to an estimated 1.2 million families and helped some 380,000 firms, which previously operated in the black market, to enter the formal economy.[5]"

See: [https://en.wikipedia.org/wiki/Hernando_de_Soto_Polar](https://en.wikipedia.org/wiki/Hernando_de_Soto_Polar)

<comment><USER3> I have just read his excellent "The mistery of Capital", and highly recommend it.

In short, it's about how a reliable property system allows people to use the non-physical value of their properties (the "economic" value in his words, or "meta" in my mind) to borrow money and fuel entrepreneurship. Very common in the developed world, quite unreliable and uncommon in the developing world.

</comment></comment><comment><USER4> This is a fantastic project - one of those perfect intersections of new technology and political need.

A peruvian I know discussed the De Soto experiment and it was clear that whole land reform is important, there is a raft of political issues - but things like this _may_ move the political equilibrium in the right direction.

Still great project.

</comment><comment><USER5> I'm pleasantly surprised this is used for good.</comment>


Cisco Pushing 'Cloud Connect' Router Firmware, Allows Web History Tracking - <AUTHOR> http://tech.slashdot.org/story/12/06/29/1425210/cisco-pushing-cloud-connect-router-firmware-allows-web-history-tracking

<comment><USER2> A friend of mine just sent this my direction. Looks like I won't be looking at Cisco consumer grade hardware anytime soon.

<comment><AUTHOR> Certainly a bizarre move by Cisco. Besides the data tracking and privacy issues; imagine the damages if they ever had a security breach.

4\. Your Responsibilities as a Cisco Connect Cloud User You are responsible for any data that is sent or received by you and/or any other party in connection with your access to and/or use of the Service used in connection with your account. You agree that Cisco will not be liable to you or any others for any loss or damages due to your use of the Service.</comment></comment>


How I compiled TrueCrypt 7.1a for Win32 and matched the official binaries - <AUTHOR> https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/ <comment><USER2> That's amazing work. Well done to the author.

<comment><USER3> Came here to say this too. It is this kind of in depth investigative work, that has genuinely taken time and smarts to achieve, is what I come to HN to enjoy reading. All credit to the author.

</comment></comment><comment><USER4> This is a great first step but we're not done yet. It proves the binaries are built from the published code, but only when the published code has been thoroughly vetted can we conclude there is no backdoor.

<comment><USER5> Also the build is not deterministic yet, even on his own machine he got some differences in truecrypt.sys between successive builds. By definition the build is not (yet) fully deterministic then:

"Using the same source and same project directory results in the same pattern of difference in the block starting at 0002CBAC, as the pattern shown between my build from the correct project directory and the original file. This means that this difference is a normal result of the compilation process, and can be considered harmless from our point of view"

<comment><USER6> The disassembly for both versions of the file was a 100% match, though, which is a pretty good indicator that the binary difference must be something unimportant and not related to the actual code.

<comment><USER7> It's possible that the difference is in the actual code: x86 machine code sometimes has multiple different encodings for the same assembler instruction. These would show up as single-byte differences in the binary. See [http://www.strchr.com/machine_code_redundancy](http://www.strchr.com/machine_code_redundancy) for some examples. Compilers might use this to stenographically hide additional data in the binary. Printer manufacturers already do something similar ([https://en.wikipedia.org/wiki/Printer_steganography](https://en.wikipedia.org/wiki/Printer_steganography)). I wouldn't be surprised if MS compilers embedded a hidden data in binaries -- it could be useful to track down malware authors; or identify software created with pirated MS tooling.

<comment><USER8> Perhaps this could even be used by an organization to differentiate official binaries of closed-source software from leaked binaries.

</comment></comment></comment></comment></comment><comment><USER9> "TrueCrypt is a project that doesn't provide deterministic builds."

Why? What is the benefit of doing so when everyone wants a deterministic build?

<comment><USER10> Deterministic builds are hard...really hard. The combined power of the Debian community has trouble getting deterministic builds, as does the Tor project.

<comment><USER11> _Deterministic builds are hard...really hard._

I'd have thought that deterministic builds are really simple unless your toolkit ecosystem is FUBAR. After all, a compiler is a simple function from input to output (unless the FUBAR ecosystem syndrome arises, as I said).

<comment><USER12> Here is a not-in-depth look at what's involved in trying to generate byte-for byte binaries on msvc:

[http://stackoverflow.com/questions/1180852/deterministic- bui...](http://stackoverflow.com/questions/1180852/deterministic-builds-under- windows)

In short, if you ignore certain things when comparing binaries and make sure you build things on absolute path of the same length(!), you can tell binaries are functionally equivalent.

<comment><USER13> Well, the parent poster would say that if binaries depend on the path length of build location, then that's evidence of a FUBAR toolchain :)

</comment></comment></comment></comment></comment><comment><USER14> Just a slightly off-topic question, but WTF does TC require VC 1.52 for?

<comment><USER15> Considering they document their build process very carefully, I can only imagine they wound up standardizing on that library a long time ago and keep using it to this day.

<comment><USER16> Yes, even if there is any recent open source alternative to build 16-bit code, selecting the 20 years old compiler binaries ([http://en.wikipedia.org/wiki/Visual_C++](http://en.wikipedia.org/wiki/Visual_C++)) for which it can be easiest to be sure they haven't changed (there's still enough CD's around produced at that time, I believe I still have one too) is a damn good decision.

<comment><USER17> "Reflections on trusting trust" is 30 years old. 20 year old binaries should still be more trustable than newer ones though, I suppose.

<comment><USER16> Truecrypt didn't exist in 1993.

</comment></comment></comment></comment></comment><comment><USER18> I am just shooting into darkness, but would not it be easier to compile it twice and diff outcomes to find found out what parts are being changed so those can be ruled out?

<comment><USER19> He did that further down in the article, when he noticed that file path was encoded in the TrueCrypt.sys file.

</comment></comment><comment><USER20> it seems to me that the relaxed gpg key verification that the author uses doesn't give us any more assurances regarding the authenticity of the source than a simple hash offered on the website would. i think in this situation, if the author did not intend to attempt more rigorous verification of the truecrypt pgp key, at least cross-checking that the key offered on the site matches the key offered on a public key server pgp.mit.edu for example would be prudent before signing the truecrypt key with your own.

      Import the .asc file in the keyring (File > Import certificates).
      Now you should mark the key as trusted: right click on the TrueCrypt Foundation public key
      in the list under Imported Certificate tab > Change Owner Trust, and set it as I believe checks are casual.
      You should also generate your own key pair to sign this key in order to show you really trust
      it and get a nice confirmation when verifying the binary.

<comment><USER16> You can do yours checks and compare with the author's! It's a very fast thing to do for the checks you mention. The more people repeat it, the better.

<comment><USER20> i think there are two concerns here. one is that the source is not tainted by a third party during or before the download. the second (arguably much more important in this case) concern is that the compiled binary matches the source. the second concern is addressed well by the author as far as i can tell, but i think that there is room for improvement in their concerns about the former. i assume they have thought about this and do have at least some concerns because it is mentioned that

      The PGP signature of the binary can be downloaded
      through the button PGP Signature, which makes you
      download TrueCrypt Setup 7.1a.exe.sig over HTTPS
      (*although with the NSA in the middle, it might not
      mean much*).

[emphasis mine]

cross-referencing the pgp signature with at least one other (public) source would go a long way toward allaying those concerns (that the HTTPS might not mean much).

this criticism is in no way meant to detract from the rest of the work, and i mean only to refer to pgp sig verification best practices here.

<comment><USER16> But you can do this too easily and be make sure yourself! Do it yourself with GPG, then calculate SHA of the binaries, compare with his text. he published the checksums with which he worked in more points of his analysis.

</comment></comment></comment></comment><comment><USER21> I get the point reg. verifying the Windows-Compiling-Build, but wouldn't the same verification on an open source platform allow for even easier (maybe even automatic) verification?

How about an vmware/vbox image setup explicitly for that purpose? Not feasible for windows due to licencing issues, i guess.

Also, huge kudos for the effort going into this work. Thanks!

</comment><comment><USER22> > TrueCrypt is not backdoored in a way that is not visible from the sources

... as long as you also trust the compiler not to introduce any backdoor... (cf. Reflections on Trusting Trust)

<comment><USER23> Oh god, not this conversation again.

<comment><USER22> Why not? If you're being so paranoid about the origin of a binary, you have to at least acknowledge the fact that you're trusting the compiler in making this comparison.

So let me throw out an idea that might help justify this trust too. Compile the same TrueCrypt sources with a totally different compiler, then use both binaries in a deterministic way and compare the raw encrypted result. (I'm assuming here that the same encryption keys and data will give the same result, but don't know for sure if that's true.)

<comment><USER24> Create a piss-poor barebones compiler (compiler A) by hand _(literally, if possible. punchcards would allow you to hand-verify the contents of the program in a way that is not susceptible to Thompson 's attack (there is no risk that your eyes were built with a compromised compiler))_ that suffices to compile a compiler that you want to verify (compiler B). Compiler A should to run on hardware that you can trust (need not be x86).

      (= ((a-binary b-source) b-source) b-binary)

If you trust a-binary, and you trust b-source, then if that returns true you should be able to trust anything created with b-binary. _(a-binary b-source)_ will not equal _b-binary_ , but _((a-binary b-source) b-source)_ should.

If the hardware is not executing binaries as described, then all bets are off. Compiler A could, in theory, be build and run on a homebrew CPU ([http://www.homebrewcpu.com/](http://www.homebrewcpu.com/)), but if you are putting that much effort into this, this better be your hobby...

<comment><USER15> Let's not forget you need to verify by hand the electrical characteristics & functionality of every logic chip you use to build that homebrew CPU, because the supply chain of basic logic chips is already known to be infected (primarily a QA issue, but clearly a potential vector)

<comment><USER25> Don't forget the power company. They can cause "spurious" bit flips by momentarily dropping the voltage at just the right instant. Best to use a battery made from potatoes you've grown yourself.

<comment><USER15> You also need to ensure either the device, or the location you operate the device is rad-hardened. We cannot rule out the possibility that They can control the phases of the sun and introduce errors to your circuit at-will with solar flares.

<comment><USER26> I think it's time for the crowbar.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> I entered just to say it's an incredible work done by this guy... it's been years since I analized a file on hex mode (from Norton Commander, jeje).

</comment><comment><USER28> Please God, don't let the author be working for the NSA. These days I get suspicious at every "it's all good" piece of news.

<comment><USER29> The good thing about his analysis: It has all the information you need to reproduce it and form your own conclusion. So even if he was working for the NSA, by following his steps, you will either come to the same result or not.

That's how science works.

</comment></comment><comment><USER30> Coolest post I've read today! Good work!

</comment><comment><USER31> Kudos for effort.

</comment><comment><USER32> Tldr: Binaries didn't match, here's some handwaving at the differences.

<comment><USER33> I think that's inaccurate. The disassembly of them matched perfectly.

<comment><USER13> Well then, what and why are the differences? I mean, if there's an arbitrary data block somewhere, then the "matching disassembly" can have wildly different behavior by simply copying & executing parts of that block.

<comment><USER34> It's explained in the article. Timestamps, file paths, certificates and oddities of the PE format.

<comment><USER13> I got an impression from the article that disassembly was what he did to explain the binary differences that remained _AFTER_ he corrected for timestamps/certificates/etc.

<comment><USER35> Your impression was wrong. He showed _all_ of the differences in the screenshots. That's how few there were. Not a single bit of the code portions was different. Only a handful of metadata bytes, plus appended certificate.

The disassembly was only there to be cute and emphasize the point.</comment></comment></comment></comment></comment></comment>