Buster Keaton: Anarchitect - <AUTHOR> http://www.lapsuslima.com/buster-keaton-anarchitect/ <comment><USER2> The article doesn't make this fully explicit, but The Electric House can be described very easily in contemporary terms: a self-taught technician installs a home automation system for a client, but a hacker gains access and basically wrecks the lives of everyone living there.

<comment><USER3> If I may expand on the observation...

Spinning Jenny was a type of knitting machine (a multi spindle spinning frame) that brought multi-fold increase to operator's output. A typo f optimization if you will. It's inventor may have been altruistic (or not) in his motives but ultimately it meant: more efficiency- less workforce. Today's machines crave such leanness so programmers of today get hired to automate 'overhead' jobs away. Long term, the trend may prove either good or bad, the point is, such machines do not care. Much like in Buster's era.

</comment></comment><comment><USER4> The Every Frame a Painting channel on YouTube has an excellent short piece on Buster Keaton covering some similar themes, but with more of a focus on camera frames than architecture: [https://www.youtube.com/watch?v=UWEjxkkB8Xs](https://www.youtube.com/watch?v=UWEjxkkB8Xs)

</comment><comment><USER5> If you live in the SF Bay area and this article piques your interest, you should check out the Niles Film Museum: [http://nilesfilmmuseum.org/](http://nilesfilmmuseum.org/) in Fremont, on the site of Charlie Chaplin's old studio. They are dedicated to the preservation of silent film and they have regular showings of Keaton, Charlie Chaplin, Harold Lloyd and other stars of early silent film, with a live pianist and a docent who usually gives a 5 minute or so talk at the beginning giving you some background.

<comment><USER6> Also in the Bay Area, the San Francisco Silent Film Festival's opening night this year will feature the newly restored _The Cameraman_. It's at the fabulous Castro Theater, with live accompaniment by the SF Conservatory of Music, on May 1.

Also, as it hasn't been mentioned, Keaton's _The General_ is generally considered to be his masterpiece. If you see a picture of Keaton on a locomotive, or with a very fat, very blunt cannon, it's from this film.

</comment></comment><comment><USER7> If you haven't seen Buster's stuff, scroll through that (very long) article to get a sense of the reality-defying stunts and illusions that he weaves into his films. It's amazing that the early film artists took the medium so far. I love Buster so much.

As an introduction to Buster I recommend Sherlock Jr.

</comment><comment><USER8> Remember that all these movies are available for free on The Internet Archive : [https://archive.org/search.php?query=buster%20keaton](https://archive.org/search.php?query=buster%20keaton)

</comment><comment><USER9> Great article. And I love the site!

I love how non-intuitive everything is on the site, and I have to go looking for things, exploring. For example, the essays are listed under Archons. What are Archons? I love it! And I'm still not sure what lapsuslima.com is for, but it's really got my curiosity piqued.

I understand the motivation for good website design (inspired by "Don't Make Me Have to Think"), but unfortunately the downside is that almost every website I visit now looks, feels, and behaves almost identically. It's made the Internet so homogenous and boring.

</comment><comment><USER10> Watched this documentary during a fight last month and it was really good

[https://www.youtube.com/watch?v=JDyBBkC7Lk8](https://www.youtube.com/watch?v=JDyBBkC7Lk8)

<comment><USER11> > Watched this documentary during a fight

That conjures up a really interesting image ... :)

<comment><USER10> Which one I dare ask?

<comment><USER11> The image of someone watching a documentary on Buster Keaton whilst having a fight!

</comment></comment></comment></comment><comment><USER12> Excellent article. "One week" is my favourite silent movie of all time.</comment>


Microsoft Buying GitHub Would Be Bad - <AUTHOR> http://garrett.damore.org/2018/06/microsoft-buying-github-would-be-bad.html <comment><USER2> _> "This is a watershed moment for GitHub. I predict in as little as 6 months nobody will be creating new open source projects on GitHub."_

I'll certainly take that bet, if the author wants to back this bold prediction with money.

</comment><comment><USER3> Um, regarding GitLab or BitBucket, I'm pretty sure Atlassian owns BitBucket, and the idea of them being acquired seems hilariously low given they've almost always been profitable and never relied on the pump-and-dump-err-acquired method of Bay Area startups.

</comment><comment><USER4> It's naive to think that companies will fear having their code stolen by Microsoft.

Companies, which are Microsoft competitors in other fields, use Microsoft software such as Windows and MS SQL Server to process and store valuable data. There was always a risk of Microsoft backdooring their software to spy on competitors.

That doesn't happen because 1. Microsoft wants to be in business and 2. Private repositories probably come with legal requirements that GitHub/MS don't spy on users for competitive gain.

Finally, while software such as Wine has been written to liberate some application from Microsoft's platform monopoly, there is also a lot more Open Source software written for other purposes. I don't see them investing the effort to move away from GitHub unless Microsoft does something evil.

<comment><USER5> > unless Microsoft does something evil.

You mean like forced telemetry in Windows 10? Microsoft is extremely snoopy lately. I certainly wouldn't trust them with my data.</comment></comment>


Facebook Permanently Disabled My Account While I was Sleeping, NO WARNINGS. - <AUTHOR> I woke up this morning to not being able to view my facebook. OR log into Spotify for my daily route to school.
I never post inappropriate or otherwise content on my facebook, or really anything other than some photos and jokes, not even a re-blogged copyright info.
I'm a pretty mellow facebook user lately, and just use it to talk to friends and family.
I emailed them after getting:
"Disabled - Ineligible
Your account was disabled because we determined that you are ineligible to use Facebook. For more information about our policies, please review the Facebook Terms. If you think your account was disabled by mistake, please contact us. "
When trying to log in.
I emailed them concerned as to why, what, how, and if possible to at least get a download of my facebook for all of the photo's, conversations, and memories I kept on facebook with my loved ones, and they responded with:
"Hello,
Upon investigation, we have determined that you are ineligible to use Facebook. You can view our Statement of Rights and Responsibilities at the following address:
https://www.facebook.com/terms.php
Unfortunately, for safety and security reasons, we cannot provide additional information as to why your account was disabled. This decision is final.
Thanks for your understanding
The Facebook team"
I don't know if I was hacked and they posted some bad stuff, or what. But does anyone else have any experience or know how to deal with this?
It doesn't appear that facebook had a number to call. And have not seem to have broken any of their rules or regulations.
Thank you! <comment><USER2> In a year from now you will accept that they did you a favor, how unlikely it seems now.

Good fortune with the rest of your life.

You may have guessed, I do not use Facebook.

<comment><AUTHOR> While I am excited to embark on this new path, I am quite frustrated as to why I can't get a download of all my conversations and photos, that mostly were solely on Facebook because that seemed like the most reliable hoster.

<comment><USER2> I can imagine, keep in mind that no other place than your own equipment is safe enough to keep your private life. Even your own equipment isn't safe enough to go without proper backup.

2 important things you should consider in this day and age: 1\. It does not matter if you pay for services or not, you are always considered product instead of customer and your stuff is only interesting for them when there is monetary gain. 2\. Everybody in any company is only there for a finite time, this makes people not care about what happens when they move on.

Conclusion, no company or service offerer is ever fit to take care after your stuff, only you are, online or offline.</comment></comment></comment>


A new hardware implant shows how easy it may be to hide malicious chips - <AUTHOR> https://www.wired.com/story/plant-spy-chips-hardware-supermicro-cheap-proof-of-concept/ <comment><USER2> This seems not terribly interesting to me. The article motivates itself the allegations of devices embedded in supermicro products saying "But even as the facts of that story remain unconfirmed...". But it's not that the facts as unconfirmed, as far as I can tell there was literally no supporting evidence and the story didn't really make much sense.

Then it's discuss how a microcontroller attached to the serial port of Cisco networking equipment can be used to reconfigure the equipment to allow access.

Given that the purpose of the serial port is reconfiguring the device, this is unsurprising.

They used a small commodity microcontroller. It's not sitting on a footprint. It's just bodies onto the PCB. It's quite obvious from inspecting the board...

So... what's the point of this article? If you have physical access to the hardware you can make a small but obvious change to the PCB? I'm not even sure where the $200 comes from. The part costs <50 cents. It's so big many people could solder it by eye (I have in the past, and was soldering a similar pitch part last night using an iPhone as a magnifier).

So... this level of modification has been possible for at least 20 years. It's pretty obvious, and is about a days work...

What I would have been a little more interested in seeing is a part placed on an existing footprint. I've actually done this myself. Maybe I should have billed it as security research...

[http://41j.com/blog/2016/09/mirrorswitch/](http://41j.com/blog/2016/09/mirrorswitch/)

Beyond that, I'd be interested in knowing how easy it is to get hold of dies are repackage them additional microcontrollers. This would mean there's no physical visible difference on the PCB. But even this could be detected as automated XRay inspection is not uncommon.

Ultimately... if you are a state level actor. You have better and less easily detectable options than this.

<comment><USER3> Honestly, the Supermicro story makes me uneasy. Yes, both accused corporations rebuffed the story. Yes, there was no real evidence or any follow-up to justify the story.

But god damn, the paranoid person inside me can't let it go. It sounds like such an easy thing to do for such an amazing payoff. And of course both accused have a massive incentive to not disclose a vulnerability such as this one. Hell, the higher-ups might not even know about it if the company has gone through efforts to maintain plausible deniability in scenarios like this.

<comment><USER2> I think the fact that fake components regularly make their way into the supply chain should be more of a concern than the supermicro story.

So, supply chain security is poor, and getting backdoored parts into the supply chain is a realistic possibility. Bunnie has a good recent talk on this.

[https://www.bunniestudios.com/blog/?p=5519](https://www.bunniestudios.com/blog/?p=5519)

The question in my mind, is is it worth the risk of detection. Particularly when other methods are less traceable, more easily deniable.

<comment><USER4> bunnie himself says near the end of the presentation that he believes that _something_ happened with supermicro but that the details were deliberately obfuscated by the usgov sources for the story

<comment><USER2> Well what bunnie says in that talk is that something may well have happened but it doesn't pass Occam's razor as presented in the Bloomberg article.

Specifically he says that adding an IC to the board doesn't make sense. And that embedding something in an existing package/device is possible.

This is very different to what is described in the article being discussed here, and much more complex.

The Bloomberg article seems largely inaccurate in any case. I don't think it's worth using as a motivation for any security work.

<comment><USER5> Yeah Occam's razor says your efforts would be much better spent on flashing custom firmware than a retrofit. That or a deliberate backdoor built into the chip from the ground up.

Or something like this: [https://m.youtube.com/watch?v=_eSAF_qT_FY](https://m.youtube.com/watch?v=_eSAF_qT_FY)

But a nearly magic rice-grain part with a microcontroller and networking?? You could make a fortune in IOT with something that capable.

</comment></comment></comment></comment></comment></comment><comment><USER6> The Supermiro story was quite fascinating and I absolutely believe in its feasibility. We know that China attempts to hack into American security and government systems, so it raises a very valid fear that a company like Huawei could, and likely would, do something like this.

That whole story was just to easily - and too quickly - dismissed by the major companies...

<comment><USER7> Nobody claimed that it's impossible to have hardware implants in principle. You can find papers that predate the Bloomberg story and discuss much more advanced approaches than what was presented there.

The problem with that story was that it claimed that such an attack _was_ in progress, while citing no sources and presenting no credible evidence. Using stock photos of unrelated components and basing part of the article on an interview where the expert explicitly _speculated_ on the _possibilities_ and not an actual attack didn't inspire confidence in Bloomberg reporting either.

</comment></comment><comment><USER8> As the article mentions, there probably aren't a lot of instances of this, given that software exploits are often easier to implement. And once discovered, can be re-used hundreds of not millions of times very easily.

That said if someone is interested in a specific target or small set of targets, this is a really stealthy way of compromising a system. I would be shocked if every major international spy agency hasn't at least tried this.

<comment><USER9> They do it on the reg, already known long before the Bloomberg article

[https://arstechnica.com/tech-policy/2014/05/photos-of-an- nsa...](https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade- factory-show-cisco-router-getting-implant/)

[https://en.m.wikipedia.org/wiki/NSA_ANT_catalog](https://en.m.wikipedia.org/wiki/NSA_ANT_catalog)

USB/Ethernet sockets with implants etc

</comment></comment><comment><USER10> Snowden talked about this.

The US hold a big share of the electronic's intellectual property. Most of the tools used to design silicon chips are proprietary, and it would be trivial for the NSA to implant hardware backdoors without anybody knowing it, and it would be very difficult for the public to audit this hardware.

I think this is exactly why Huawei routers were not trustworthy.

Detecting malware is child's play, now if they want to not be detected, they need to target the hardware. Even if you know your hardware has a backdoor, it becomes too expensive or impossible to patch it.

Always wondered why wifi chips always used binary firmwares? Me too.

<comment><USER11> Huawei routers and equipment are not trustworthy because they are literally insecure at a firmware level. If you want an interesting read check out the Finite State's "Supply Chain Assessment" of Huawei's IoT and networking devices[0] released back in June. The latest episode of Enterprise | Security Weekly, "Please Don't Go - ESW #156"[1]has Matt Wyckhouse (co-founder and CEO) to discuss the findings and IoT security. You'll want to go to 1:08:08 to get to it should you opt for the full episode rather then the linked segment.

[0] [https://finitestate.io/wp-content/uploads/2019/06/Finite- Sta...](https://finitestate.io/wp-content/uploads/2019/06/Finite-State- SCA1-Final.pdf)

[1] [https://securityweekly.com/shows/supply-chain-security-in- th...](https://securityweekly.com/shows/supply-chain-security-in-the-iot-era- matt-wyckhouse-esw-156/)

</comment></comment><comment><USER12> An intelligence agency put an ad in for a "break-in specialist." The ad promised a very diverse line of work, for a tidy guy who knows how to "cover his tracks." If agencies are putting "ads in the paper" to hire such guys, I don't think it's unreasonable to claim that they also have guys who can covertly plant a chip.

</comment><comment><USER13> NSA could easily tell these corporations that they have to deny existence & feasibility of such technology. Anyone who takes their word for it is a sheep.

</comment><comment><USER6> Don't forget: this has been done before. [https://www.cryptomuseum.com/covert/bugs/selectric/](https://www.cryptomuseum.com/covert/bugs/selectric/)

<comment><USER14> Also, CIA installed cameras in Xerox machines:

[http://electricalstrategies.com/about/in-the-news/spies- in-t...](http://electricalstrategies.com/about/in-the-news/spies-in-the-xerox- machine/)

</comment></comment><comment><USER15> But anyone needing to do that doesn't care if its $200 or $20 million. It's way more complicated than just soldering the chip in.

</comment><comment><USER14> Wow, if I am to understand this article correctly, bad actors gaining access to my hardware can do bad stuff.

<comment><USER16> Yeah, and the nation that produces the world's cheapest electronics (and where all corporations are intertwined with government) is run by bad actors.

<comment><USER14> So why be so concerned with soldering stuff to the board? Wouldn't they just alter the die?

</comment></comment></comment><comment><USER17> As an aside, this mentions that Snowden leaked that the NSA has been carrying out supply chain attacks? What, is this guy just leaking everything now?</comment>


Why do people buy things? - <AUTHOR> http://ruste.gitlab.io/blog/2018/08/23/why-people-buy.html <comment><USER2> It seems like pretty much everything could fall under the category of tool if you turn your head just so and squint hard enough.</comment>


HAPPY BIRTHDAY Integrated Circuit (IC) - <AUTHOR> http://www.technology.am/integrated-circuit-celebrates-50th-birthday-064044.html

<comment><USER2> This one is pretty close to home for me.

My grandfather, Victor Grinich, was one of the founding members of Fairchild. When I was growing up, I remember hearing about how he was one of the "Traitorous Eight" who broke away from Shockly and started Fairchild.

Among the founders, which included physicists and chemists, Vic was the only electrical engineer. It was only after he passed away that I learned from Gordon Moore that he was primarily responsible for choosing the first family of integrated circuits that Fairchild made. He was such a humble man, even though his work with a handful of others essentially created Silicon Valley.I still have a few of those first chips and diodes in my desk drawer as a reminder of his humility and brilliance.

I'm a physics & EE/CS major at MIT, and sometimes I feel like this stuff is in my blood.

<comment><USER3> Great man indeed:

[http://www.nytimes.com/2000/11/11/business/victor- grinich-75...](http://www.nytimes.com/2000/11/11/business/victor- grinich-75-co-founder-of-upstart-electronics-company.html)

<http://en.wikipedia.org/wiki/Victor_Grinich>

Your turn to take the torch.

</comment></comment><comment><USER4> happy birthday from me.. :) because.. today it powers everything from the pocket-size iPhone to Google's giant server farms

</comment><comment><USER5> woh.. I thought that IC is not much older... Happy to hear it is 50 year old...

</comment><comment><USER6> Happy birthday IC</comment>


Cloudflare Workers - <AUTHOR> https://workers.cloudflare.com/ <comment><USER2> Hi! I'm the PM for Cloudflare Workers. Happy to answer any questions about our announcements, or Workers in general.

<comment><USER3> Do you have plans to provide a Workers KV interface that would allow us to search for keys, as well as view, modify and create new KV entries?

Also, it's currently only possible to avoid leaking that multiple websites belong to the same entity by creating multiple Cloudflare accounts due to the nameservers. This means that if we want to use Cloudflare workers for our 5 unique nameservers, then we would have to do a lot of unnecessary duplication. So on a somewhat unrelated note, do you have any plans to add support for adding additional nameservers to a Cloudflare account (this is currently holding us back from using Workers over Lambda, and it's something we would gladly pay for).

<comment><USER4> > additional nameservers to a Cloudflare account

The price point may not be ideal but Business plan websites can set up branded subdomains (eg ns1.example.com, ns2.example.com).

Also, there are a limited amount of nameservers (2550 possible combinations with 50 male and 51 female nameservers I believe), so there's probably a few thousand other accounts with the same combination of nameservers as you. This can still be a problem though, if you use a less-common TLD and/or you use pages with similar content.

You could try using the API to automate this across multiple accounts [https://api.cloudflare.com](https://api.cloudflare.com).

<comment><USER3> It's definitely a problem for us, although it's fewer nameservers than I expected :)

No idea how I missed custom nameservers on business plan.. Hope it's something they added this year, otherwise I feel quite embarrassed.. It's too pricey for personal use (since the plans are associated with websites and not accounts) but the company will probably upgrade a few of the websites, thanks!

</comment></comment></comment></comment><comment><USER5> I love the idea of Workers! The catch I ran into last year was the 1MB limit for webpacked JS files. That puts many npm packages off limits -- I ended up doing some webpack magic to stub out subdependencies I didn't need from a package that didn't support tree shaking, which is pretty far from "just works."

Here's a good thread where the problem package was a SOAP library depending on "request," but the same logic is easy to run into with any app: [https://community.cloudflare.com/t/worker-size-limit-a- probl...](https://community.cloudflare.com/t/worker-size-limit-a- problem/24849)

The upshot is if you have an idea that would be easy with dependencies, you can't reason about how difficult/possible it will be with Workers until you spend some time figuring out if the dependencies can be compressed small enough to use -- and the answer may change partway through if you need to add something.

<comment><USER6> While we haven't relaxed the 1MB restriction, we _have_ made some changes to the way we compress and distribute your code to the edge. I'd encourage you to try again, and our new CLI[0] handles the webpacking for you.

[0] [https://workers.cloudflare.com/docs/quickstart/cli- setup/](https://workers.cloudflare.com/docs/quickstart/cli-setup/)

</comment></comment><comment><USER7> I love the CLI example! Probably the best way I've seen that presented (hint, mouseover to copy/paste.)

</comment><comment><USER8> We tried using a worker for a bit, and while it's mostly very convenient, the request/response cache API does NOT support Vary headers, which was a major dealbreaker for us.

<comment><USER2> We can probably help. Vary is usually intended to shard the cache based on parts of the request. You can do the same with the cache API - modify the cache key (quite similar to the example for caching the POST request ([https://workers.cloudflare.com/docs/reference/workers- concep...](https://workers.cloudflare.com/docs/reference/workers- concepts/using-cache/)), as you modify cache key to match the POST body).

</comment></comment><comment><USER9> Took them about a year but there is finally a free tier!

<comment><USER6> We're excited about it also :)

</comment></comment><comment><USER10> Announcement is here: [https://blog.cloudflare.com/just-write-code-improving- develo...](https://blog.cloudflare.com/just-write-code-improving-developer- experience-for-cloudflare-workers/)

<comment><USER11> What I always wonder about is how one can write "non-trivial" stuff using CloudFlare workers. Don't get me wrong, I am more than intrigued by the concept, but as far as I understand, it cannot do things like connecting to a database or third party service. That makes the types of problems you can solve with it relatively small.

This is confirmed what I see if I look at the Cloudflare marketplace: it has apps for things such as cookie banners and automated GA integration, but that's not that interesting.

What's the long-term vision for this?

<comment><USER2> I might misunderstand what you mean by third party service, but today you can connect to any service on the Internet (including databases like Firestore) with Workers using fetch() [1].

We're building out our storage products -- we started with Workers KV, our distributed Key-Value store, and will to continue expanding our offering to support more use cases. You won't be able to build everything with Workers right away, but we've seen customers solve really interesting problems with it. As we add functionality to support more and more use cases, we expect Workers to grow into a really powerful platform.

Note that Cloudflare Workers is a different product from Cloudflare Apps (which is what you see on the Marketplace). Cloudflare Apps does allow developers who want to distribute their Worker to other Cloudflare customers to do so, using Apps with Workers.

[1] More on fetch() here: [https://workers.cloudflare.com/docs/reference/runtime/apis/f...](https://workers.cloudflare.com/docs/reference/runtime/apis/fetch/)

<comment><USER3> > We're building out our storage products -- we started with Workers KV, our > distributed Key-Value store, and will to continue expanding our offering to > support more use cases.

I have no affiliation, but would love to see a partnership with Dgraph.. Feels like a perfect match for both parties.

</comment></comment></comment></comment><comment><USER12> It seems all the CDN are having their own Edge WASM / Worker Engine out. StackPath, Fastly, Cloudflare, and I am sure there are more to come.

But wouldn't very single one of these be a lock in that I cant really move freely in and out, unlike CDN.

<comment><USER13> Cloudflare Workers is based on the Service Workers API, which is a W3C standard. StackPath looks like they are following this API too (though I haven't dug into their docs). So it ought to be possible to move code between these platforms. Hopefully others will follow suit as well.

Fastly has gone a different route since they support WASM exclusively (no JavaScript), but I believe they are also following an open standard for the underlying APIs (WASI).

(Disclosure: I'm the tech lead of Cloudflare Workers.)

<comment><USER14> I'm a developer evangelist for StackPath and can confirm that our serverless product is also based on the Service Workers API

</comment></comment></comment><comment><USER15> I've been playing around with it for a project, and still need to experiment a bit more but the KV store integration might just work nicely for sessions (no strong consistency, but it seems to have it for the same session so ).

It has many usecases like validating a JWT, authorization for DB calls, cache layer, transforming assets, scrapping, etc. Basically the usecases where you'd normally launch a full server and be like "I need a full server for that?".

</comment><comment><USER16> Workers is pretty cool. I've work with the Worker team and Queue-It to get the later's SDK working there. Which has been wonderful to handle traffic at the edge.

Two things I wish were better: package installation (you have to use a compiled package instead of the GUI interface) and general docs (Mozilla's are okay, but not all are applicable to Workers).

</comment><comment><USER17> Thinking a lot about serverless blog and seems this will be helpful. Cloudflare makes many good projects last time.

<comment><USER18> I'll have a blog post next week (on my personal blog) that you'll find interesting! Workers + Workers KV is pretty great for this use case. KV isn't currently available on the free tier though; the $5/month plan should be more than enough though. (I'm the PM of KV)

</comment></comment><comment><USER19> What are the limits of using Workers KV on different plans including the free tier?

</comment><comment><USER20> Is there something like that for python?

<comment><USER21> StackPath EdgeEngine can do JS with WASM support for PHP, C, C++, Go, Python, Perl, Rust + others [https://www.stackpath.com/products/edgeengine/](https://www.stackpath.com/products/edgeengine/)

<comment><USER13> Cloudflare Workers also supports Wasm and so supports all those languages, too, in theory.

In practice, though, Python's, Perl's, and PHP's Wasm support is extremely immature and probably won't meet the needs of a production web application today. Go is closer but still presents challenges.

Rust seems to have by far the most mature Wasm tooling (and Rust support is built-in to the Workers CLI tool). C and C++ are also reasonably usable.

</comment></comment></comment><comment><USER22> Any plans for C++ support?

<comment><USER18> If you can compile your C++ to wasm, it will work. The tooling doesn't support it natively at the moment, so it's not as simple, but it should work!</comment></comment>


FAQ from Guccifer 2.0 - <AUTHOR> https://guccifer2.wordpress.com/2016/06/30/faq/ <comment><USER2> Based on what I've read there is a high chance he is from Moldova, and now works for one of the big IT companies. Probably in his mid 30s. Lives in US or Canada.

A few things point to it:

* He thinks Moldova is part of Romania. That is a contentious issue. He mentioned it specifically. To do so, they'd have to care about it a bit. Doesn't like the Russians it seems, that hints to it as well.

* He listed possibilities about how someone could be a hacker not just be part of the Russian FSB -- working for a multi-national IT company.

* Age based on what he considers are typical "cool" role models for this age. He listed Rambo and Terminator -- those were the typical boys' role models growing up in the early 90s in Eastern Europe (especially ex-Soviet Union).

* Cares and knows about DNC and specific candidates. Guessing they are following the election process, so probably live in US or Canada.

<comment><USER3> I was struck by his correct usage of "its" and "it's". That is something many native english speakers do not get right. He clearly speaks and writes english very well or has someone editing his posts. That would agree with your suggestion he is living in the US or Canada.

<comment><USER4> That might be something that foreign speakers find easier to get right because they have to actively learn it, and the words are more different in other languages so they wouldn't confuse the concepts.

<comment><USER5> Absolutely, but in my opinion it has more to do whether you learn to speak before you know how to spell and write or vice versa. Homonyms or near homonyms like "it's" and "its" or "their", "they're" and "there" are just different things for second-language speakers. For me as a non-native speaker it's a miracle how someone could ever spell "definitely" the wrong way.

His writing lacks the typical mistakes Eastern Europeans often make when writing English prose, namely omitting the indefinite article. If you look closely he might be overcompensating, for example:

        I've already said about the software vulnerabilities

I'm not a native English speaker myself but isn't the article superfluous here? The next one is more obvious:

       But I made some conclusions from the Marcel's story

<comment><USER6> Actually the article in "the software vulnerabilities" is pretty useful, since he's referring to the specific vulnerabilities that let him in to the DNC. You could potentially gather that from context, but to my native ear the article sounds better.

The second example is, as you say, an obvious mistake.

</comment></comment></comment></comment></comment><comment><USER7> Seems like this Guccifer 2.0 figure really is just in this for the fame and glory. No real hacker with a different agenda would reveal so much about him/herself (assuming the info is true). It puzzles me. It's almost as if this new Guccifer wants to be caught just like the last one. As if his prosecution by the FBI will finally validate his status as a great hacker, the one who hacked the DNC amid one of the most historic elections in US history.

<comment><USER2> Far fetched speculation, I wonder if FBI specifically instructed those who were hacked to tell the world it is the evil Russians. It played well with their victim's PR story (it is understandably we couldn't resist such a powerful enemy) but it also worked to flush him out with a blog post like this.

Say, they suspected he was Romanian or from Moldova (a lot of Moldovans do not like the Russian govt.) so telling the world "this was a Russian super-hacker" was a way to get him angry and force him to try to repair his image so to speak.

I think in the end because of of that blog post he might have revealed too much and is at a greater risk of getting caught now than he suspects.

</comment></comment><comment><USER8> While most of what he said strikes me as "likely true" this struck me as being utter nonsense:

> The DNC had NGP VAN software installed on their system so I used the 0-day > exploit and then deployed my backdoor.

The NGP VAN is a service, not a piece of software, and most of the software NGP provide isn't internet accessible. Plus there's also the sticky issue of how he would get ahold of it to fuzz it.

On this issue I believe CrowdStrike. He purchased malware on the black market ($1.5K per this FAQ) and then emailed it to tons of people at the DNC until some moron clicked.

This FAQ has a few obvious lies like that in it, like his poor English is another obvious lie since they are so inconsistent with it.

I think they read about the NGP VAN and then made up the zero day story to make themselves seem more badass. This individual strikes me as your typical script kiddy, in particular considering how much they glorify Guccifer (1) who themselves was a script kiddy.

PS - Crowdstrike are still wrong about the Russian intelligence claims, they never had one shred of proof, even after posting their supposed "proof" it was all just generic hacktools and things you can buy on Tor.

<comment><USER9> > The DNC had NGP VAN software installed on their system so I used the 0-day > exploit and then deployed my backdoor.

I was the tech director for Bernie 2016, and this part tripped my bullshit meter as well. The VAN is a SaaS, not an on-premise solution. The DNC has some servers that have tight integrations with VAN (e.g. direct db access as opposed to using the API) but saying they had "NGP VAN software installed on their system" is a stretch at best, and those certainly aren't the same servers that the DNC uses to store their oppo research and such.

NGP-VAN does run on Azure though, FWIW. I don't know what OS the DNC's servers run on, but it wouldn't shock me if it was Windows as well.

If I had to guess, this whole part is a red herring. I'm sure either guccifer social-engineered folks at the DNC and/or the DNC was storing their oppo research on old servers with shitty security. The NGP VAN was an easy name to throw out and divert attention since their own security issues have been well- publicized in the past.

<comment><USER10> This is totally off-topic, but I tried a few times to get a hold of someone (anyone really) in the campaign to volunteer my technical skills, and every person I talked to was like "Yeah, that sounds awesome! Call this person and say you want to volunteer!" And that other person was just someone in charge of phonebanking and only knew other phonebanking volunteers. It was tedious and impossible to get escalated to someone that might be more useful.

<comment><USER9> Well, part of my job description involved helping to organize tech volunteers, so I guess at the end of the day that falls on me. Really it's a general problem with a widely distributed yet generally meagerly staffed campaign. There's a lot of autonomy with regional/field staffers and in turn they don't necessarily know about everything going on at the national core (where our digital/tech efforts happened). The way to help was primarily either through finding a project to help with at [https://github.com/Bernie-2016](https://github.com/Bernie-2016) or getting involved with Coders for Sanders ([https://coders.forsanders.com);](https://coders.forsanders.com\);) I originally was a volunteer with CFS and then joined the campaign full-time after completing a few larger volunteer projects for them. But of course there's no way for a random person wanting to get involved to really know that. I'm rambling now; I don't have a good answer per se, other than that I'm sorry you had a bad experience and I wish we'd found a way to solve this problem.

Somewhat related, I've started helping out a bit with an OSS project called Code Corps that may help with this sort of thing in the future. The basic idea is that you input your interests (education, environment, economy, etc.) and your tech skills and then get matched with political/nonprofit orgs that need your skills. [https://www.codecorps.org/](https://www.codecorps.org/), [https://github.com/code-corps](https://github.com/code-corps)

<comment><USER10> Cool project! Thanks for the links!

</comment></comment></comment></comment></comment><comment><USER11> "You asked me several times if I'm a man or a woman. I'm a man. I've never met a female hacker of the highest level. Girls, don't get offended, I love you."

Oof.

<comment><USER12> Oof? Every other day on HackerNews I see a new post about the dearth of women in tech and how dire the "shortage" is.

If there are substantially fewer women in tech, why is it unreasonable to think there are practically no skilled female hackers?

(And note that when I use the term 'hacker' I'm referring to the illegal, blackhat variety, not the 'I turned my oven into a WiFi hotspot!' kind)

<comment><USER13> Two reasons come to mind.

First, "there aren't many" is _vastly_ different statement from "there aren't any." It's not clear which category "I've never met" falls into, but it's easy to take it the wrong way.

Second, that whole thing is completely unnecessary. The answer could end at "I'm a man" and be done. He seems to feel a need not only to state his maleness, but to point out that the question is stupid because it's not possible for him to be a women given his skill.

<comment><USER14> I wonder what institutional barriers keep women from hacking. As lack of interest is often dismissed as an explanation.

<comment><USER13> I'm sure lack of interest is a big reason, but that just changes the question to, _why_ is there a lack of interest?

Personally, I think it's because so much of this activity happens online, and online communities are still often extremely misogynistic. Women interested in participating in such communities often have to hide who they are lest they be faced with an endless cavalcade of "tits or gtfo" and unsolicited dick pictures and other aggressive behavior.

</comment></comment></comment></comment></comment><comment><USER15> > Opposite to her, Donald Trump has earned his money himself. And at least he > is sincere in what he says. His position is straight and clear.

This must be satire...

<comment><USER16> "Build a wall across the Mexican border and force the Mexican's to pay for it" is an extremely clear proposal, and it's been repeated often enough that I'm willing to believe that Mr. Trump sincerely believes it's what we should do.

That doesn't make it, y'know, actually feasible, or a remotely good idea even if it were.

<comment><USER15> Is that an actual proposal of his? I would call "force the Mexicans to pay for it" anything but clear, hah.

Admittedly I have basically zero knowledge of either presidential bid, the "Donald Trump has earned his money himself" part was what really made me think this must be a joke.

<comment><USER17> The leverage to be used is to threaten to block remittances from Mexicans in the US back to their families. This makes up a large part of Mexico's economy. It could certainly work.

Guccifer 2.0 actually criticizes Trump on immigration in the very next line, though. So it's a pox on both the Clinton and the Trump houses.

<comment><USER16> Blocking remittances is probably impossible. Even if you could shut down all the direct channels for money to flow from US nationals to Mexican nationals, which you can't, it's trivial to either send easily resellable goods like gift cards or to transmit the money to some third party in a neutral country who agrees to forward it on for a small fee.

Even if it were possible, blocking remittances is probably illegal under our free trade agreements with Mexico. Any attempt short of pulling out of NAFTA is all but guaranteed to be tied up in courts for years before it could possibly go into effect.

And even if it were legal, a huge disruption to trade is all but guaranteed to cost the economy vastly more than the cost of just doing it ourselves (even assuming we actually wanted to).

All of which is before you even consider the internal politics of getting the US congress to pass a bill in the first place, or of convincing the Mexican government to roll over and accept a huge insult without requiring anything in return.

There is essentially no realistic model under which "it could certainly work". It's a feel-good idea that falls apart with the smallest amount of critical analysis. It's a childish conception of international relations, and any attempt to actually implement it is all but guaranteed to both fail miserably and make absolutely everybody worse off in the process.

<comment><USER18> You're not looking at this as part of a comprehensive policy. If you bypass normal remittances, you out of the frying pan and into the fire of processes that make your illegal status visible to the federal government through KYC and all the "soft" rules that are in place that track people that use gift cards, etc. If someone had the political will, it would be trivially easy to identify practically all illegal immigrants who operate in the country and use any mechanism to store or transfer money. You don't even have to be more "evil." The processes and information are all already in place. Just a man willing to use them would have to be placed into a position of power.

Even if you're legal, as soon as you bypassed the remittances law you probably committing half a dozen other crimes, that are easily tracked.

Regardless if this is a "good idea" or not, it is very, very feasible.

</comment></comment></comment></comment></comment></comment><comment><USER19> This Twitter analysis on the FAQ is worth following: [https://twitter.com/pwnallthethings/status/74848214296815616...](https://twitter.com/pwnallthethings/status/748482142968156160)

<comment><USER2> All guessing of course, but disagree with the insinuation it points to Russians still.

\- Rambo is not just a lame attempt at sprinkling in an American cultural reference. It is exactly what an Easter European boy in his 30s would have been looking up to back in the day.

\- Other than just Russian security services can find translators. English speaking / translating ability is not a rare, expert-only domain. Could have asked a friend.

I guess at the end of the day, nobody likes to be hacked by a random loner guy. It feels more validating to be targeted by KGB's successor. As it explains away the security failures -- "Well these people torture and kill, should be glad we only got hacked by them, could have been a lot worse ...".

</comment></comment><comment><USER20> How does this square with the generally accepted view [1] it was the Russian security services?

[1] [http://motherboard.vice.com/read/guccifer-20-is-likely-a- rus...](http://motherboard.vice.com/read/guccifer-20-is-likely-a-russian- government-attempt-to-cover-up-their-own-hack)

<comment><USER21> That article seems to be mostly speculation, though. Maybe Guccifer is a Russian, but not affiliated with the Russian government (aka Putin aka Ivan the Terrible).

But apparently this is The Cold War 2.0, and whenever Russians may be involved, this means that the Russian government is involved...

<comment><USER22> It would appear that different people wrote different parts of this. The English goes from fluent to almost Google translatese ("inside the network to stay stealth.") in talking about the actual hack. This would suggest that an organization or at least multiple people were involved.

[https://twitter.com/pwnallthethings/status/74848214296815616...](https://twitter.com/pwnallthethings/status/748482142968156160)

</comment></comment></comment><comment><USER10> I'm surprised at how many people are "trusting the client" here. Analyzing what is being said, as though any of it were the truth. As if the FSB couldn't type all this up just as easily as some thirty year old single guy from Moldova. Not only that, but this is so over the top ("I'm the best hacker ever!!!one") that I'm surprised people are taking it seriously. To me, this really just sounds like someone or some group of people trying to make themselves sound like a hacker, complete with hacker folk heroes like Snowden and Assange.

</comment><comment><USER23> > As for me, I see great differences between Hillary Clinton and Donald Trump. > Hillary seems so much false to me, she got all her money from political > activities and lobbying, she is a slave of moguls, she is bought and sold. > She never had to work hard and never risked everything she had. Her words > don't meet her actions. And her collision with the DNC turned the primaries > into farce.

> Opposite to her, Donald Trump has earned his money himself. And at least he > is sincere in what he says. His position is straight and clear.

So... good hacker. Crappy political commentator.

<comment><USER24> 1) Compile a bunch of publicly available information into a large package and "leak" it. Call it a hack.

2) Call yourself Guccifer 2.0

3) Post a well-written-in-English FAQ that conveniently attacks Clinton with the same tired shit meanwhile praising Trump.

This is some extremely thinly veiled bullshit.

<comment><USER25> He definitely doesn't sing Trump's praises that much. In fact in the very next sentence he says he disagrees with him on some pretty key issues of his platform.

</comment></comment></comment><comment><USER26> This feels state-sponsored, perhaps a product of Russia. Catching my attention:

* Emphasis on disparaging Clinton is interesting as current Admin policy is decidedly (and effectively) counter to Russian interests.

* Referring to Intel community using the reverent European bureaucratic term "Special Services".

* The boastful lone hacker, but calls himself Guccifer 2.0. Obligatory reference to Lazar midway through the manifesto.

* Real political and security drama in the UK and Europe, but focuses on a comparatively boring Clinton campaign, dropping leaks just as a stumbling Trump campaign needs them the most - and all the while Trump, who is largely reviled in Europe, is praised in the FAQ.

I'd be amused to learn this was homegrown. I have the increasing sense the Clintons made more than their share of powerful enemies at home as I begin to read the "Crisis of Character" book.

</comment><comment><USER27> Who is Guccifer?

<comment><USER28> He's a hacker who perhaps most notably claimed to have hacked into Hillary Clinton's private email server.

[https://en.wikipedia.org/wiki/Guccifer](https://en.wikipedia.org/wiki/Guccifer)

</comment></comment><comment><USER29> Yup, not buying it. Too cutesy, too impersonal, too obvious. This is a team effort. And not a very good one.

<comment><USER21> Maybe he used that style on purpose to mislead any adversaries?

</comment></comment><comment> guard-of-terra What's he notable for?

This guy's writing reminds me of Bill Cipher uncomfortably.</comment>


How to make a font of your handwriting with free software - <AUTHOR> http://www.canonical.org/~kragen/oilpencil/making.html

<comment><USER2> I've never met a programmer with handwriting I'd like to use as a font...

<comment><USER3> Actually, I'd say that goes for all people, not just programmers...

I have never met anyone who can, with any regularity, write in monospace.

</comment></comment><comment><USER4> Yaaaahooooo!!!

This seems to be a great idea. I can surely use this to create a fonts for my work.

I once wanted to create a logo for my web app with my own handwriting. So I wrote the name of the website on paper and photographed it. I got a very blurry image. So dumped the idea. I never thought it was possible.

But I can't create a font for my handwriting. Since my handwriting is partly cursive and partly non-cursive. I write the first and second letters of a word in cursive and the rest in non-cursive. And my 'r','o' 'y' and 'g' vary a lot. They depend on where they appear in the word.

</comment><comment><USER5> Very interesting. It seems like he could have used a scanner and saved a lot of time with the images though.

<comment><AUTHOR> He mentions that in the "Better Ways to Do It" section at the end -- mistakes he made, ways he could have saved time and effort.

</comment></comment><comment><USER6> If you happen to have a tablet PC and a copy of Windows, you can use Microsoft's free "My Font Tool" to create a font of your handwriting. Sure, it requires some hardware, but it's easy and the results are great.

</comment><comment><USER7> i'm not sure my handwriting would look real to me as if i did that. the appearance of a given letter varies according to its neighbors or the word it's in.

<comment><USER8> That's why there are things like kerning and ligatures.

<comment><USER7> a method to discern these from a sample would be cool. for example the "ti" in "tight" will look different than the "ti" in "ting" because of the difference between my "g" and my "n" irrespective of the "ti".

if this is contemplated in existing solutions, i betray my (vast) ignorance on the topic.

i found the original post interesting because i notice many dozens of "fonts" in my own notes. at a glance the font alone brings back the tone and setting of its scribbling/scribing/boredom/...mood and often helps me remember more than the fact or hint that it is supposed to represent- the way i perceived it at the time.

further- i have heard of ways to listen to the sound of a person's keyboard over time and know what they're typing. with enough info, you could know not only what, but how they're typing it. well-tuned, you might be able to get a machine to know how you would've written something, not just what it would look like given a one element sample of the glyph that represents the single keystroke(s).

not exactly related, but i always liked <http://www.fuzzmail.org/> for adding a dimension, maybe in the extrovert direction. for me, what we're talking about would be more introverted, me recognizing myself like i'd recognize a recording of my voice. me, not the way i hear myself when i talk, but the way i know i sound.

in fact- for the anthropologists with sway over PG, it might be interesting to randomly "fuzzmail" (with willing participants, of course) the comment threads on here and see just how people compose what are very often, alternately and at once, extremely insightful/kind/thought(ful/less)/human comments.</comment></comment></comment>