Red Lady cave burial reveals Stone Age secrets - <AUTHOR> http://www.newscientist.com/article/mg22530134.200-red-lady-cave-burial-reveals-stone-age-secrets.html

<comment><USER2> According to various news and a citation on Wiki, "she" is actually a male. [http://en.wikipedia.org/wiki/Red_Lady_of_Paviland](http://en.wikipedia.org/wiki/Red_Lady_of_Paviland)

<comment><USER3> The article is about a skeleton in Spain, not Wales.

</comment></comment><comment><USER4> Hm. Scratches on the stone don't necessarily mean its a 'headstone'. It could have been a tool, used to sharpen sticks or polish points. The cave was inhabited, and the stone's lines took a long time to scratch. Anyway the assertion that the 'v's created by intersecting lines indicate 'female' is a lame reach.

<comment><USER5> Of course, but that is a very common interpretation of V-shaped marks in cave art [1]

1: [https://en.wikipedia.org/wiki/Chauvet_Cave#Paintings](https://en.wikipedia.org/wiki/Chauvet_Cave#Paintings)

<comment><USER6> You do realize that is a circular argument?</comment></comment></comment>


Ask HN: Resource-based economy. When, how, why? - <AUTHOR>

At the end of 99% of the problems in the world I see money. Money is the root catalyst. Money is the answer that ignites the cycle again.
I always wonder what a resource-based economy would solve or what other problems it could cause.
One problem people mention: laziness. As if that isn't a problem now.
I'm no economist, nor do I have any prevelance to be but I do enjoy the idea of no poverty (unless self-inflicted), no software patents that limit innovation, less war, less crime, less scarcity. Less suck.
Is anyone interested in discussing this? <comment><USER2> I am curious as well. We've decided that Capitalism is the answer. It is better than communism, sure.

...that about sums up how people feel about it.</comment>


PHP 7 Virtual Machine - <AUTHOR> http://nikic.github.io/2017/04/14/PHP-7-Virtual-machine.html <comment><USER2> It's always pleasant to see PHP occasionally get a positive moment in the limelight on HN. It's oft scorned yet powers a very large chunk of the web. With the work done on 7 it's also one of the fastest scripting languages around and deserves a little more credit if I'm honest.

<comment><USER3> Honestly. I think its main problem is it's not hipster enough. It's too popular. I bet if you made it difficult to use (for most people), added features that make certain aspects a nightmare to scale and gave it a weird name then it would do well here. Obviously don't let anyone know about the origin... say you built it at a series of obscure coding bootcamps.

<comment><USER4> I think that's unfair, the reason PHP has a bad reputation is not because of silly hipsters. It's because for a long time it was a terribly designed language. It was a laughing stock for a good reason. The whole "hobby-grade templating language turned general purpose with complete disregard to how programing languages are designed" thing.

Now I'm willing to believe that it's improved a lot since then, but it's got a very bad reputation to overcome, and it's deserved. The languages seems headed in the right direction at least, maybe in a few years we'll forget what PHP used to be.

<comment><USER5> I'm pretty sure a substantial part of PHP's reputation is the nightmare code produced by PHP developers.

<comment><USER6> And that goes right into the whole "badly designed language" trope as well. Essentially, anything written in PHP prior to version 5 (and especially prior to version 4) should be considered suspect.

I'm a long time PHP developer (well, was until recently - my current position is in the javascript/nodejs stack arena), and have been using it since the v3 days (so not there from the beginning, but close enough). There were some truly awful examples and code practices out there.

That isn't to say you couldn't write quality procedural PHP back in the day (had you configured your server properly and stuck with "best practices") - it's just that the majority of people hacking on PHP didn't. I'm sure there were a few that did, though - but I'm hard-pressed to recall any at the moment.

Today's PHP is a much different beast than yesterday's. The OOP model and other advancements makes things so much better, provided they are all used properly and followed. Now - could you make PHP 7 as ugly as 3? Sure. But you'd be insane to do so unless you had no other choice...

<comment><USER5> Nail, meet hammer with claws on both sides.

It's entirely, 100% possible to write good, clean, tested, maintainable code in PHP. But most people working with PHP, for whatever reason (and I'm sure there are many reasons), simply don't bother.

I suppose the same can be said of all languages, but PHP devs are the worst offenders IME.

</comment></comment></comment></comment></comment></comment><comment><USER7> It's fairly impressive that the php7 core team was able to release something that competes well with HHVM from a performance perspective.

I assume they are working with significantly fewer advantages and resources than Facebook, so that's a pretty nice result.

<comment><USER8> HHVM was released in 2011, while PHP 7 was released in 2015. So perhaps in that extra time there was additional techniques, optimizations, and technology that allowed PHP 7 to stay comparable in terms of performance to HHVM.

<comment><USER7> There was a long time to catch up, yes. But HHVM did several big improvements to their JIT tech between then and now.

PHP7 also rolled out with very little noise about stability, migration issues, etc.

Not knocking FB at all, just noting the PHP folks did a nice job.

<comment><USER9> The PHP team is absolutely obsessed with backward compatibility. They broke surprisingly few things with PHP 7, and everything they broke was clearly documented.

You don't get to power a significant fraction of the world's most important websites if you break backward compatibility every few months.

<comment><USER10> They broke an unusual number of things in 7.1, a couple somewhat annoying e.g. defaulting DateTime('now') to including microseconds, without a single builtin function available that can strip/change microseconds on a datetime.

<comment><USER11> Yes, but they decided to keep it to 7.1, not 7.0, which meant the majority of the perf upgrades were available to most users who migrated to 7.0 _easily_.

7.1 was where all the breaking changes got pushed as a result.

</comment></comment></comment></comment></comment></comment><comment><USER12> Another one of nikic's seminal guides into the workings of PHP. It was him who wrote the foreach guide on StackOverflow [http://stackoverflow.com/a/14854568/308851](http://stackoverflow.com/a/14854568/308851) .

Another note: if I ever catch you using these cute "finally ... interesting edge-cases" described in this article, your PR will be refused. Yes, yes, it's very smart, and you might win an obfuscation contest but in a professional environment we like code that can be understood even when the emergency phone kicks us out of bed. If it's five times as long, I care not, but if it requires me to think hard on the code, I do.

</comment><comment><USER13> Great write up. Thank you for writing this. I've always been interested in the PHP VM, but it is not documented. Nikic is one smart dude.

</comment><comment><USER14> That the smart branches optimization requires a workaround in the IR codegen concerns me a bit. It makes sense in a HW context, like MIPS branch delay slots, but not really here. There could be a flag in the branch instruction that disables the optimization at least.

</comment><comment><USER15> I wonder if it's possible to compile it for iOS?

I need a templating engine in my app, and php seems like the most popular one.

<comment><USER16> PHP is a whole lot more than just a templating engine. I think you would find that much more effort than is required just to make some templates.

<comment><USER15> Perhaps you can send me down the righ path?

I want my users to be able to send emails from their iPads, and those emails would be generated based on templates. There will be many such templates built in, and eventually users will be able to hire web developer-type person to make custom templates.

My thinking was that PHP is the most popular language for that sort of thing, so it would be nice if could support that. My second choice is handlebars. I'm not sure if JSX would do the job?

Any thoughts appreciated.

<comment><USER17> PHP is not a templating language. You can build a template engine with it, but then, you can build one with any other language.

If your app is in swift or objective-c, look into template libraries for those languages. Simple Google search tells me there's a couple of options including one using handlebar's format.

<comment><USER15> How is this not a template? It generates valId HTML out of data.

      <?php
      for ($x = 0; $x <= 10; $x++) {
        echo "The number is: $x   <br>";
      }

?></comment></comment></comment></comment></comment>


Show HN: Journyal – record all your travels in the background - <AUTHOR> http://journyal.com <comment><USER2> Can I share a captured journey with others afterwards? Can I share it in real- time? wasn't sure from the webpage.</comment>


Hacker Steals $8.4M Worth of Ethereum from Veritaseum Platform - <AUTHOR> https://www.bleepingcomputer.com/news/security/hacker-steals-8-4-million-worth-of-ethereum-from-veritaseum-platform/ <comment><USER2> I have no idea what these guys do. They don't even take the time to explain it. The fact that these guys can run an ICO and call $8.7 million dollars miniscule is what's wrong with ICOs today.

This just looks like another run-of-the-mill ICO backed by convoluted, cryptospeak that one can only pretend they know what they actually intend to build [2][3]

Even the investors sound sketchy. Why does no one even challenge their business model? [1]

I'm willing to bet this hack was an inside job.

[1] [https://bitcointalk.org/index.php?topic=1887061.0](https://bitcointalk.org/index.php?topic=1887061.0)

[2] [https://drive.google.com/file/d/0By5WJsM3KjltOG](https://drive.google.com/file/d/0By5WJsM3KjltOG)

[3] [http://veritas.veritaseum.com/](http://veritas.veritaseum.com/)

<comment><USER3> It's surreal. If a legal hammer doesn't come down on ICOs and smart contracts soon, it's simply going to be rational to either hack other parties' smart contracts or start ICOs just to get "hacked."

I don't really see a downside right now, aside from ethics. It doesn't seem like any of the hackers have been prosecuted or even lost the coins. They can just slowly tumble them and...move on with their lives, newly rich.

I mean I really don't see how this is sustainable. Incentives for not doing this are rapidly evaporating, which will create systemic instability and erode confidence in the currency. But in the meantime you can acquire a fortune in what seems like a pretty straightforward, low risk way.

<comment><USER4> I keep bringing up the example of Bitcoin exchanges and wallets. In the first few years, there were constant hacks and scams (with wallets). Due to the global nature of Bitcoin, there was no effective way to regulate it, so this state of affairs continued until consumers and the ecosystem in general finally became wise, and avoided exchanges unless they met certain conditions (e.g. backed by reputable parties, used security best practices like cold storage) and avoided certain categories of wallets altogether (e.g. web wallets that store consumer coins server side).

<comment><USER3> I'm willing to accept that your postulate is true (if I understand it correctly, the thesis is that the market will "mature" and solve these problems).

But even if that _is_ true, it doesn't diminish the fact that _right now_ the only thing apparently stopping anyone from becoming rich is ethics, not effort. Normally in situations where there are few effort penalties but high ethics penalties for quickly acquiring a fortune, there is a disincentive in the form of regulation and the judiciary system.

That's not the case here! (If it is, correct me if I'm wrong). For example, how many of those fraudulent Bitcoin wallets were prosecuted? The salient example seems to be Mt. Gox, but I feel as though that one was prosecuted because there wasn't much anonymity available to the founder.

There doesn't seem to be much of a reason to _not_ try to e.g. exploit a vulnerability in a widely used smart contract. The endgame is millions or tens of millions of dollars, cleaned through a tumbler and then reported to the IRS. "Where did this windfall come from?" "I was an early cryptocurrency investor, I did very well!"

As someone who has done _a lot_ of code review over the years and read more bug bounty reports than I can count, I can very easily see this becoming the de facto activity of unscrupulous security researchers until the market undergoes the improvement you speak of.

I guess to put my point more succinctly: it seems somewhat unprecedented to me how easy it is to do this and simply get away with it. A commenter on Hacker News was able to pinpoint the Parity Multisig vulnerability - it's not like it necessarily required a team of people and 6 months.

<comment><USER5> Somebody stole $800m through the swift network from bangladesh. So, yes, it happens in the regular world.

<comment><USER3> To open this comment: I used to own application security at an international bank. I was responsible for technical penetration testing across the organization, including code responsible for deposits, withdrawals, C2C transfers (customer to customer), wire transfers and ACH transfers (as well as the multifarious authentication mechanisms and APIs interacting with external verification systems). I was also closely involved in incident response on more than one occasion, though that was not my particular team.

With that background in mind, I'm going to have to strongly disagree with your point on two grounds. First - yes, SWIFT was successfully attacked, and $800M is an egregious amount. But while security vulnerabilities can exist in essentially any type of software, it is _significantly_ more difficult to _get away_ with defrauding a banking institution out of seven digits or more. There is virtually no way to identify a single vulnerability and then exploit it to rapidly siphon funds out of the institution. If nothing else, the intermingling of various transfer protocols and identity constraints tends to make that very difficult.

When I was in that role, we were very frequently targeted. The _only_ way attackers were ever able to successfully steal money from the bank was by first achieving identity theft _or_ by compromising existing accounts. Here there is still an economic caveat - to achieve successful attacks against banks on the scale of what is currently rampant in Ethereum smart contracts, you generally need to reliably achieve a certain scale. The attackers tend to be groups acting in concert, and will actively look for institutions where a critical mass of accounts can have funds siphoned out of them.

In practice, this most often occurs when there is either 1) a truly egregious security flaw in the specific institution or 2) a major security breach that facilitates password cracking en masse against users who have accounts at the bank and use the same passwords. A good example of #1 would be an online bank that allows users to bypass the identity/address verification step in the account opening process (i.e. there may be a vulnerability that allows them to assign themselves a social security number without verification, skip parts of the verification process or change it later on). I was very good at making sure we never had such a serious issue.

That leaves #2, and it's the way that we were almost always attacked in practice. Password breaches would occur, we'd get a rash of accounts compromised, and those accounts would attempt transfers out of the system. Sometimes it was more complex (two types of compromised accounts involving C2C transfers, etc). We mitigated these through sophisticated rate limiting, aggressive logging and a lot of incident response. Sometimes it happened often enough to essentially become a dull background noise for us. But in my ~2 year tenure, the most I ever recall us losing in any single attack was about $15,000 (across hundreds of accounts), and I can count on one hand how often that happened.

So that's my first point, regarding inherently superior (or more charitably, "mature") security mechanisms. My second point is that a bank and a smart contract or an ICO aren't really analogous. They are both in the financial domain, but they have different risk profiles and functions. A smart contract would be more analogous to a regular contract, and while I am very willing to concede that smart contracts have theoretical benefits, it is very clear at the moment that the lack of a legal fallback (for now) is a weakness, _even if it 's also a strength._ A smart contract and a contract are both _generalizable_ , whereas a bank would more akin to a specific, constrained type of legal contract that houses money in exchange for certain privileges. Smart contracts are inherently more vulnerable than banks because they can be much more open ended in purpose and execution, without the corresponding legal oversight that regular contracts have.

An ICO is also not analogous to a bank; as the name implies, it's much more similar to an IPO. IPOs absolutely _do_ not share the risk profile of ICOs, and there would be significant legal penalties if an IPO were manipulated in such a fashion as to cost investors tens of millions of dollars that simply evaporated due to fraud. No one would take the underwriting bank or the founding team seriously if they said, "well hey it's not a significant amount of money that was lost compared to our market capitalization." _NB:_ I'm not talking about an overvalued IPO dipping in share price, I'm talking about a significant amount of the invested money literally being stolen from both the company and the investors with apparently no way to make either of them whole. The idea of this happening is conceptually beyond the pale for me.

Instead of a smart contract or ICO, a banking institution is more like a wallet or an exchange. And this brings us full circle to Mt. Gox, which actually _was_ liable, much like a bank would be. In return for legitimacy and expanded utility, companies like Coinbase have had to accept an increasing amount of legal oversight and liability over the years.

</comment></comment></comment></comment></comment></comment><comment><USER6> There are no details to this supposed hack and the used attack vector. The given information is so vague, this is indistinguishable from an exit scam.

I hope they will come forward with more information but Veritaseum has always looked fishy, about 98% of the tokens are held by one address [https://etherscan.io/token/0x8f3470A7388c05eE4e7AF3d01D8C722...](https://etherscan.io/token/0x8f3470A7388c05eE4e7AF3d01D8C722b0FF52374?#balances) and are not in free circulation.

<comment><USER7> With the market cap beeing $360.000.000[0], and only 2% beeing in circulation, the value of the stolen tokens seems to be higher than the value of all coins in circulation.

2% of $360,000,000 are $7,200,000 and the hacker stole more than eight million.

Or did I get this wrong somehow?

[0] [https://coinmarketcap.com/assets/veritaseum/](https://coinmarketcap.com/assets/veritaseum/)

<comment><USER8> 2% represent the $360M(market cap, in circulation). 100% is 50 times that, $18B (total supply), i.e. 100M tokens.

What is stolen is 0.07% of 100M tokens which is 70K tokens, which is roughly $12M for current market price.

<comment><USER9> According to the founder, the amount of stolen tokens is 37k: [https://bitcointalk.org/index.php?topic=1887061.msg20355530#...](https://bitcointalk.org/index.php?topic=1887061.msg20355530#msg20355530)

That number also matches the number transferred (36,687.9382688909) to this wallet mentioned in the article: [https://etherscan.io/address/0x3fff90bf314673194c3a265ed1c0a...](https://etherscan.io/address/0x3fff90bf314673194c3a265ed1c0aa68f59550c4#tokentxns).

Also, according to two other articles (linked from the bitcointalk thread), cite the value of the stolen as US$4.5M, not US$8.4M:

[http://www.altcointoday.com/ethereum-ico-veritaseum- suffers-...](http://www.altcointoday.com/ethereum-ico-veritaseum- suffers-4-5-million-hack/) [http://www.newsbtc.com/2017/07/24/yet-another- ethereum-ico-g...](http://www.newsbtc.com/2017/07/24/yet-another-ethereum-ico- gets-hacked-veritaseum-loses-us4-5m/)

Checking market charts around the time it happened (~00-08 July 24th), there's a significant dip in value, with the price going as low as US$~122: [https://coinmarketcap.com/assets/veritaseum/#charts](https://coinmarketcap.com/assets/veritaseum/#charts). At that rate the stolen tokens would be worth US$4.48M.

<comment><USER8> Then the 0.07% number was probably wrongly estimated by the founder, that number would be 0.037% then. He might have missed the 3 before 7. Anyway, that explains it.

</comment></comment></comment></comment></comment><comment><USER10> I don't really follow Ethereum, but from headlines on Hacker News I've learned that

1\. Ethereum is difficult to work with

2\. Its difficulty does not provide security

This doesn't exactly inspire confidence in it.

Some comments on this article imply that this was just a scam, so maybe Ethereum is secure. I think that a lot of people learn about things they don't care about via headlines, which may be damaging for Ethereum in its infancy.

<comment><USER11> Development on top of ethereum platform is in it's infancy. SQL injection attacks were as frequent when web development was young. I haven't checked it myself but I guess the current API is quite low level and doesn't include higher level abstractions to prevent this kind of attacks. Also there are no established development practices regarding security.

<comment><USER12> > I guess the current API is quite low level and doesn't include higher level > abstractions to prevent this kind of attacks.

A fundamental principle of Ethereum is that its smart contracts have Turing- complete computing power. Therefore, there is no possibility of 'higher level abstractions' that will permit only legitimate contracts to be written (even if the abstractions are limited in their power, an attacker can make use of the full power of the underlying system.)

Writing provably-secure smart contracts is as difficult as writing provably- secure software for any other Turing-complete platform: i.e. only a small percentage of developers can do it. Furthermore, the software that comprises the platform itself has not been stringently verified.

Of course, we are using lots of software in banking and finance that is not formally verified, but there are significant differences: it runs in secured environments with controlled and very limited external access, and there are out-of-band methods for correcting mistakes. In contrast, blockchain currencies are actually promoted as being immune to this sort of interference on account of transactions being irrevokable (and no, the hard fork that rescued the DAO participants is not a counter-example, as that will not be feasible in future.)

I cannot say these problems will not be resolved in the future, but why would anyone put any significant value at risk until they are?

<comment><USER13> > Therefore, there is no possibility of 'higher level abstractions' that will > permit only legitimate contracts to be written (even if the abstractions are > limited in their power, an attacker can make use of the full power of the > underlying system.)

High level abstractions and Turing completeness are not in opposition. Haskell, for example, offers high level abstractions in the form of a functional language with abstract data types, strong typing and purity (unless you specify something else explicitly, functions only have access to their arguments).

I think Safe Haskell would be a good Turing-complete, general purpose contract language. Untrusted code can be compiled to machine code and executed safely, by using a restricted IO monad that only allows specific input/output operations[1], so the contract logic can be executed safely without a sandbox.

[1] [https://downloads.haskell.org/~ghc/7.4.1/docs/html/users_gui...](https://downloads.haskell.org/~ghc/7.4.1/docs/html/users_guide/safe- haskell.html)

<comment><USER12> I don't know if the abstractions of Safe Haskell, or something like it, will be sufficient. The link you gave seems to imply that the guarantee of trustworthiness is restricted to something less than every aspect of the code's semantics. One problem, as I see it, is that, from a computing point of view, a fraudulent contract may be indistinguishable from a valid one. You see this principle in the claim sometimes made that the DAO hack was not theft because a contract means exactly what its code does, nothing more and nothing less (that's not a view I hold, of course, or I would not be worrying that theft is possible.)

</comment></comment></comment></comment></comment><comment><USER14> Is anyone making money on Ethereum in ways that are unrelated to just currency appreciation/speculation?

Is Ethereum actually being used for something meaningful?

(I guess in a way though Ethereum found its first killer app, pure currency speculation/appreciation. That gives it time and money to find something more useful.)

<comment><USER15> A very good question for which the answer was NO for a long time.

Prism is a live service using Ethereum smart contract(s).

It is from the Shapeshift people and is a kind of "digital asset portfolio". You can invest in many types of digital assets without having to hold them.

People are spending real money on this Ethereum smart contract.

[https://blog.prism.exchange/blog/introducing-prism-the- world...](https://blog.prism.exchange/blog/introducing-prism-the-worlds-first- trustless-asset-portfolio-platform/)

<comment><USER16> If I read that correctly, "digital assets" is just a fancy expression for "other cryptocurrencies". So that does come back to pure cryptocurrency speculation, except that it's across a range of them, not just Ethereum itself.

<comment><USER17> Man, this is JUST like the .com v1 bubble: "I'll buy your over-inflated N billion dollar company using the stock from my over-inflated M billion dollar company."

</comment></comment></comment></comment><comment><USER18> "In a post-mortem announcement, Middleton posted online today, the Veritaseum CEO said "the amount stolen was miniscule (less than 00.07%) although the dollar amount was quite material."

what... 0.07% was worth $8.7 million. So the market cap is $12,428,571,428?

Looked through most of the website and still have no idea what they do...

<comment><USER19> The hacker stole their BS coin VERI, so he stole 0.07% of all VERI. I guess he can't even sell this crap coin anywhere, because why the fuck should anyone buy Veri now?

<comment><USER20> The hacker turned around and sold stolen VERI right back to the ICO investors, so he/she got ether back right away.

</comment></comment></comment><comment><USER21> Title is also misleading ... They stole veri tokens and sold for eth not directly stealing any Eth... There was a story here last month that had a headache line like 'guy buys bit coin as 12$/coin is now worth millions' when what he actually did was sell those coins and use the money to start a company which he in turn sold for millions

<comment><USER22> Were they really able to sell the stolen VERI for that amount of ETH? That would be really impressive...

<comment><USER23> Not unless they sold before the news was out. Any mention of a hack is basically a fast track to flash crash in the cryptocurrency space.

</comment></comment></comment><comment><USER24> So I somewhat follow r/Ethereum and I remember seeing a good number of posts about Veritaseum... the general consensus is that it is a scam and has been the target of pump and dump schemes, like many other tokens.

This sure does look like an inside job...surely they reported to whatever Government crime bureau in their jurisdiction? But given the terms of many of these sales, there are literally no repercussions if the "company" decides to just take the money and run. Buyer Beware.

I think if anything, this whole ICO thing, as I've observed, just enlighten me about what we have consumer protection. It's not so the big corps and such won't scam people...they don't need to even try, people will time and time again, fuck themselves over. It's a sad reality. There was even a "Useless Ethereum Token" that did an ICO and raised something like $50k in a matter of days. Maybe the internet likes paying for jokes... regardless, I know countless people are dumping their next months rent on whatever ICO is happening that day with little regard to anything behind it.

Disclaimer: I do believe in the Ethereum platform and am long in it. I also hold FunFair tokens, which I believe to be one of the first platforms that really takes off.

<comment><USER25> I am very intrigued by this FunFair technology. Do you know when the next Token Event will be held? Or how I can get some? I read I can do development work for FunFair tokens, but don't see any more details.

<comment><USER24> They had a one time token offering. But yeah, the demo looks good and the CEO of it is well known in the gaming community, [https://en.wikipedia.org/wiki/Jez_San](https://en.wikipedia.org/wiki/Jez_San)

</comment></comment></comment><comment><USER26> Why don't the ETH people actually put out some decent templates for smart ICO contracts. It seems nonsensical that their platform is supposedly a "world computer" designed to enable smart contracts when a vast majority of the created contracts fail because of being hacked.

I invested in the ETH pre-sale and have done very well from it, but I have been selling a bit lately because I think someone else will come along with a system that open sources some really solidly vetted template contracts that have been thoroughly penetration tested by professionals.

<comment><USER27> It's not just the templates, Solidity is a terribly designed language. It reminds me of the original JavaScript before 10+ years of dedicated attempts to make it usable.

With how many VM's we already have for Java and JavaScript it's idiotic that ETH designed their own language and eventually they will pay the price. This will probably be another coin that comes along without an idiotic language/VM

<comment><USER28> fwiw the VM's instruction set seems just fine, the problem entirely lies within the crap programming languages available at this time. This seems to all be fixable if someone comes around and designs a language that makes it harder to shoot yourself in the foot.

<comment><USER29> The VM also has severe problems. Whether or not you are required to check exceptions at a call site depends on how you call a function, for example. It also does not have a monotonically increasing time value, since operations are allowed to manipulate the clock time up to some value.

</comment></comment></comment></comment><comment><USER30> This is a youtube video of by one of the founders: [https://www.youtube.com/watch?v=VbdQ3Q6FQYE](https://www.youtube.com/watch?v=VbdQ3Q6FQYE)

It is linked from the "prospect": [https://drive.google.com/file/d/0By5WJsM3KjltOGJHYS1HT3Uyczg...](https://drive.google.com/file/d/0By5WJsM3KjltOGJHYS1HT3Uyczg/view)

What kind of fools invest into this?

<comment><USER31> So shocking it's funny – in the same vein that "American Psycho" was funny. The next step for ICO's will surely be a reality-TV show.

</comment></comment><comment><USER32> I'm really sorry to be that guy but.. again? Even the article says it's 4th time this month. What's going on?

<comment><USER33> What's going on is that this is just showing what any sane people already knew: any kind of commercial transaction must be backed up by actual real life laws or sooner or later one of the parts gets ripped off.

Nobody can - or I would dare say, likes - to be watching is own back every single moment or their existence... but that's what crypto in general expects you to do.

<comment><USER34> I've been in crypto since early 2013 and I only check my wallet balance when I need to transfer coins to/from it. I may have opened my wallet 5 times in the past 4 years. The risk is increased when you don't control your own private key, if you do, the risk of losing your coins is very small.

</comment></comment></comment><comment><USER35> Totally.Misleading.Headline!!! :(

Hacker stole $8.4M worth of Veri coins, not Ethereum!!!

</comment><comment><USER36> >Middleton said that a hacker had somehow managed to steal VERI tokens during the ICO.

Somehow? they couldn't even figure out how the hack happened? How convincing for their clients.

</comment><comment><USER37> Anyone have knowledge about this project? Looking at their website, the best I can tell is it's just a wallet? Looks pretty sketchy to me.

[http://veritas.veritaseum.com](http://veritas.veritaseum.com)

<comment><USER38> No HTTPS? Amazing...

<comment><USER39> [https://veritas.veritaseum.com](https://veritas.veritaseum.com) It's just not enforced.

<comment><USER40> You gotta be kidding me.

<comment><USER41> Recommended browser plugin: [https://www.eff.org/https- everywhere](https://www.eff.org/https-everywhere)

<comment><USER42> I have this plugin. Does nothing for this website.

</comment></comment></comment></comment></comment></comment><comment><USER43> Oh, those naughty, naughty hackers. Oh, well, bad luck everyone. Do keep sending money. You'll soon be able to buy this bridge I'm selling.

</comment><comment><USER44> "Hacker". On the Ethereum subreddits a lot of people think the CEO is just cashing out and running.

<comment><USER45> You can tell by how disinterested he seems to be in getting the money back. Anybody who really lost $8 million would be losing sleep, crying, and doing absolutely everything they could to get it back. This guy is not some billionaire, $8 million is a life changing amount for him.

You don't just shrug off losing that kind of money. If I had invested in this project, I'd be in touch with the FBI.

</comment></comment><comment><USER46> There seems to be a lot of etherum heist latwly, yet i dont see any shocks in the valuation of etherum. Does the market at large simply not care?

<comment><USER37> It may not be crashing the value, but if we keep seeing hacks sustained at this frequency, it could slow or halt what might otherwise be continued growth.

<comment><USER47> ETH did not participate in the big spike of BTC back-end of last week and is now tracking down today.

</comment></comment></comment><comment><USER48> I've thought about this after seeing a few ICO's. If you want to get super rich over night just start your own coin. I mean you could put in a legit effort and really try, still fail and make millions.

</comment><comment><USER49> _the amount stolen was miniscule (less than 00.07%) although the dollar amount was quite material_

So this ICO has a valuation in the billions? Sounds quite fishy.

</comment><comment><USER50> I just want to take a second and complain about the twitchy monstrosity that is the floating nav bar. I scroll up to read text above and it covers up the text I'm currently reading so I have to scroll up twice and then down once to get rid of it. It's obnoxious and ugly and I wish it wasn't so popular. /rant

</comment><comment><USER51> The compiler should fire warnings to prevent injection like attacks. I understand solidity is a tool to program what to do with balance... A super set of rules that (at least) alerts the developers about dangerous operations will probably become a thing in the future.

</comment><comment><USER52> Then the hacker proceeded in dumping the Veritaseum for 50% of market value.

Now if you believe the price will bounce back, you can make a lot of profit on stolen coins. Immoral? Quite possibly. Against the law? Not this year.

<comment><USER53> I think it should be tested in court. Many ICOs are the textbook depictions of Ponzi schemes. When there is stealing, possibly self-stealing, involved the word "fraud" comes to mind.

<comment><USER52> There are a few problems though.

\- Since Cryptocurrency is international, the US SEC does not have jurisdiction everywhere in the world. When there is millions on the line, you could just move to another country and try a scheme, or direct a foreign lackey to do it.

\- "The Federal Reserve simply does not have authority to supervise or regulate bitcoin in any way. To the best of my knowledge, there is no intersection at all in any way between Bitcoin and banks that the Federal Reserve has the ability to supervise and regulate."

\- To count for an exchange you have to issue shares. Not everybody does this.

\- Is cryptocurrency a token or a security?

\- How to distinguish between nouveau riche BTC millionaires trying out their luck with an ICO and a criminal organization using it to launder money?

\- Who is the single legal entity to target when the ICOs are distributed, and no single entity issues coins?

\- What to do with those that profit from future illegal activity, as a 3rd party? Right now there is a lot of obvious market manipulation going on. Whales banding together to influence and set prices. Pumping up interest with bots and 5-cent army trolls. Selling stolen coins for 50% of market value. Sharing upcoming announcements with a small group of investors, devs, and supporters, allowing them to speculate on insider knowledge. How do they prove I must have known about the stolen coins, when the news hasn't even broken yet and I already put out a buy order of 50% of the price in case of a flash crash?

</comment></comment></comment><comment><USER54> All these BS coins are going to destroy the entire idea. Not that it will be a great loss. :)

</comment><comment><USER55> "hack" 100% wasn't stolen just a marketing stunt.

</comment><comment><USER56> Anyone make else make a bunch on scooping up cheap coins on etherdelta then selling them the next day?

</comment><comment><USER4> [https://www.reddit.com/r/Bitcoin/comments/1giuft/quote_from_...](https://www.reddit.com/r/Bitcoin/comments/1giuft/quote_from_john_lyons_ceo_of_the_international/cakvvom/)

<comment><USER37> How is this related?

<comment><USER4> It's possible a group like this is the culprit. They have the means and motive. There were also massive DDOS attacks against BitcoinXT when it was picking up steam.

</comment></comment></comment><comment><USER57> I'm calling shenanigans on this one, there are too many flags even for a cursory look at this story.

1) there is no code for this project that I was able to find;

2) blogger /personality CEO;

3) no report on the transactions (txHash) that would show the "theft";

4) [https://steemit.com/money/@financialcritic/analysis-of- the-v...](https://steemit.com/money/@financialcritic/analysis-of-the- veritaseum-scam)

5) [https://steemit.com/veritaseum/@deobrands/is-veritaseum-a- sc...](https://steemit.com/veritaseum/@deobrands/is-veritaseum-a-scam)

Finally, and this is subjective but still "feels" odd: The Veritaseum project is built on top of Bitcoin but it was Ether that was taken? If it was a smart contract then number 3 on the my list is even more important because we can replay it as many times as needed until we find the bug or exploit used, if any.

PS: Ethereum = refers to the project, the network and the foundation name; Ether = currency issued by the Ethereum network.</comment>


Systemd: Don't fallback to Google NTP and DNS - <AUTHOR> https://github.com/systemd/systemd/issues/12499 <comment><USER2> This discussion is the worst to have to repeat every time.

This fallback will only be used when:

* You have no DNS and NTP servers assigned via DHCP (your router does by default in 99.99% of cases) * You have no DNS configured in /etc/resolve.conf * Your distro does not change the defaults to nothing or something else (almost every distro does) * You still have internet connectivity (somehow)

In most cases, these conditions would simply not be met because everyone has DNS configured somehow. This isn't a fallback for when your DNS is unreachable, it's for when no DNS has been configured at all anywhere (including by distro upstream) but you still want to use the internet.

So in that rare circumstance, where your distro didn't change upstream defaults and you don't have any DNS configuration, it will fall back to Google DNS.

<comment><USER3> > /etc/resolve.conf

It's /etc/resolv.conf, and systemd overwrites it, Network Manager overwrites it (like every 10 minutes), dhcp overwrites it, etc. What do they overwrite it to? Most just get it from the router even if the router has no assigned servers. These days manually managing /etc/resolv.conf by hand requires hooking into every service that overwrites it on most systemd distributions. So really the people this change would affect are those with misconfigured routers.

My issue is why they didn't go with a more private DNS such as Open DNS or even Cloudfare DNS. Google's privacy policy is worse than either of the two. It seems the questioner asked in bad faith but I would've hoped Poettering would respond to the validity and dismiss the malintent instead of dismissing the whole issue.

<comment><USER4>
        It's /etc/resolv.conf, and systemd overwrites it,
        Network Manager overwrites it (like every 10 minutes),
        dhcp overwrites it, etc. What do they overwrite it to?

I still haven't understood where is the definitive place to set dns nowadays.

/etc/resolv.conf is routinely touched by stuff like NetworkManager and other stuff. Systemd-resolved config seems like the correct place, but I'm not sure how that plays with network-manager.

<comment><USER3> Universal practice is editing the resolv.conf file and then write-protecting it with.

      chattr +i /etc/resolv.conf

This always works, but certain applications NetworkManager have their own preferred way of doing things that I quite frankly do not care to learn.

<comment><USER5> I think it get's a bit harder than this, with newer systemd supporting name resolution over dbus. It's conceivable that some programs may move away from libc resolvers using resolv.conf and start querying the service directly over dbus.

I'm not sure I'm personally a fan, just saying it's something that might become more common based on my read of the systemd docs awhile back.

<comment><USER6> > with newer systemd supporting name resolution over dbus.

Not only that, with suitably configured nsswitch.conf, (e.g. with nss- resolve), you might find out that your /etc/resolv.conf is used only by apps that have their own resolver and ignore the glibc one.

</comment></comment></comment></comment></comment></comment><comment><USER7> At flare-up #237 you'd think one would have figured out a professional way to handle questions like this.

Buried in the pointless flamewar is the maintainer's own reply which is the way forward:

> Anyway, if there's a well respected network of community DNS servers that > can roughly match Cloudflare/Google we can add, sure.

That is the correct and _initial_ response the maintainer should have given. It puts the onus on OP to show how their preferred DNS stacks up against Cloudfare/Google.

Instead, the maintainer plays dumb wrt the importance of defaults, essentially guaranteeing that OP will escalate the rhetoric. Worse, the maintainer responds in kind.

If the maintainer had gone the correct (and easy!) route, we'd all benefited by having learned how this non-profit DNS stacks up against the others from a technical standpoint. (How does it, anyway?)

And to cover my bases-- when spam gets through to the inbox, no serious person asks, "Why doesn't anyone ever talk about the spammer's responsibility to prevent spam? What about the spammer?" Similar logic applies for why I'm talking about maintainer and not OP.

<comment><USER8> _Buried_? As the 6th post in an 8-post thread? And I don't see any flaming at all. Your comment here is far more aggressive than any in the Github issue.

<comment><USER9> It's after another maintainer post, and then the post begins by ... weird name calling about the funding question (which, albeit maybe a bit excessive, I'd still consider valid to ask.)

I think "buried" is an OK description of that.

</comment></comment></comment><comment><USER10> From a technical standpoint, there seems to be absolutely no reason to put cruft like this in systemd. If the network isn't configured (or configured correctly), there's no point in making sure DNS "always works". It has more potential to leak information at the wrong moment than to fix anything the user/administrator did wrong.

<comment><USER11> This is probably part of networkd, which is a different daemon in charge of managing the network

<comment><USER12> Or is it systemd-resolvd? Who can tell these days?

<comment><USER13> if it is systemd-resolvd, then privacy oriented solution would be to not use google, cloudflare or even the non profits. It would be to just have list of 13 DNS root servers and do recursive name resolutions (i.e. what caching resolvers were meant to do).

But the absolute correct behavior would be a hard failure, because if you have IP properly assigned and routing setup but no DNS, then you either purposefully set it up that way and don't want DNS to work, or you have misconfigured network setup which you should be aware about it, without having to troubleshoot why some machines don't have working Internet while others seem perfectly fine.

</comment></comment></comment></comment><comment><USER14> > I believe Google's DNS service is used for monitoring DNS traffic from IPs. > This is then most likely used for personalisation, which aids Google's > mission to take freedom and privacy away from nontechnical and technical > users.

The Privacy Policy for Google's public DNS service explicitly says that they don't do that. If you really think Google is doing it then you should take it up with the FTC who would really enjoy making an example out of Google.

<comment><USER15> > you should take it up with the FTC who would really enjoy making an example > out of Google.

How do you prove it though? Google will not just give you the source code of their DNS infrastructure and even if they did there is no way to prove that it's indeed that code that is running and not a modified version that _does_ collect data?

<comment><USER16> Actually google is one of the few organizations out there with real reproducible builds. If they gave you the sources and the program image, you could prove the latter was derived from the former.

<comment><USER15> This has nothing to do with what software they're running internally though, and again as I said even if you can audit and build your own version of the Google DNS infrastructure there's nothing guaranteeing that it's exactly what's running internally.

The problem is that ultimately there is a conflict of interest - Google is an advertising company that benefits from knowing as much as possible about people for ad targeting purposes, and as such some people (like me) might not be willing to trust them.

<comment><USER16> My personal bias is that I've worked at Google and I've worked elsewhere and I know that Google's control over what code runs in prod is years ahead of the other places I've worked. They have strong controls that audit that binaries running as sensitive roles (roles with access to real user data and logs) were produced from reviewed and submitted code and built in the official hermetic build farm. For very sensitive roles (gmail etc) they audit the command line and everything. The controls everywhere else I've worked are a complete joke by comparison.

This quote is from Google's security infrastructure whitepaper:

"""Google's source code is stored in a central repository where both current and past versions of the service are auditable. The infrastructure can additionally be configured to require that a service's binaries be built from specific reviewed, checked in, and tested source code. Such code reviews require inspection and approval from at least one engineer other than the author, and the system enforces that code modifications to any system must be approved by the owners of that system. These requirements limit the ability of an insider or adversary to make malicious modifications to source code and also provide a forensic trail from a service back to its source. """

I don't think the conflict you mention exists. Google benefits when people use the open web. They run DNS because DNS is critical to web user experience and ISP DNS is garbage. Also, by the way, ISP DNS privacy story is a complete disaster.

<comment><USER15> I am not talking about malicious code contrary to Google's intention being ran on their infrastructure. I am talking about code that Google _wants_ to run. Code that harvests DNS queries for ad targeting might be within Google's objectives and wouldn't be considered as malicious, but it would be malicious when looking at it from the user's point of view.

<comment><USER16> You're saying that Google has a plan to intentionally subvert their published privacy policy, and act which if discovered would end the company's existence, and that some engineer on the project wrote and another reviewed this change, that none of the dozens of privacy zealots in their internal privacy org[1] have managed to notice, and that the people who operate 22.214.171.124, some of whom are just as privacy-deranged as anyone you've ever met, and who collectively own a disturbing number of fedoras, kilts, and unicycles, who are the biggest nerds you've ever seen, happily run this service 24x7 without blowing the whistle?

Seems unlikely.

1: [https://gizmodo.com/meet-the-woman-who-leads-nightwatch- goog...](https://gizmodo.com/meet-the-woman-who-leads-nightwatch-google-s- internal-1825227132)

<comment><USER15> Facebook has been caught doing that where phone numbers for 2FA purposes that were promised not to be used for ad targeting started being used for exactly that purpose. Facebook is of comparable size and operates within the same regulatory environment as Google, so if they can do it and get away with it there's no reason to believe it would be different for Google.

<comment><USER16> That's basically ridiculous. Facebook is a corrupt organization. It was established to sexually harass young women. It was irredeemable from the beginning.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> What are the 'obvious privacy reasons' to not use google DNS/NTP?

I am being 100% serious when I ask: What bad does someone expect to happen as a result of this.

<comment><USER18> Google logs and stores forever every DNS request (and other info related to it like approximate geolocation), they also temporary store even more information that can identify you (like your IP address).

[https://developers.google.com/speed/public- dns/privacy](https://developers.google.com/speed/public-dns/privacy)

Edit: let's suppose for a moment that Google is not evil, does not cooperate with the NSA and doesn't make bad use of that information. It's still a liability and any data leak will be a problem for anyone using Google's DNS. Some things are better not being logged at all or at least not permanently.

<comment><USER19> _stores forever every DNS request_

That's not what your link says.

 _The permanent logs are a sampling of the temporary logs_

<comment><USER18> I may have misinterpreted this part:

> The permanent logs are a sampling of the temporary logs where your IP > address is removed and replaced by a city or region-level location.

What I understood from it is that they replace your IP address with an approximate location but keep the rest of the data. Can you explain me how you interpreted it?

</comment></comment></comment></comment><comment><USER20> Why is this repeatedly raised? This is only done like this for development purposes. It has been discussed for years at this point.

Distros/users are encouraged to change these defaults and many do.

Seems pretty clear cut and simple to me.

<comment><USER21> Probably because it shows the character of the systemd devs.

<comment><USER20> I can imagine it getting a little frustrating to have to constantly reiterate the same point over and over again.

Especially when people are refusing to understand the reasoning and logic explained from last time. It's already been explained, a quick duckduckgo search can show quickly what the reasons are and why the whole privacy argument is irrelevant here.

<comment><USER21> Easy fix! Just change it or dont set it at all.

Instead, he chooses drama.

<comment><USER20> He chose the option that was the fastest for development purposes/testing. On average Google/Cloudflare worldwide has the fastest and most reliable DNS services.

Why would he change it?

He says it clearly that it's the responsibility of distro maintainers to modify these defaults which they are encouraged to do.

It's everyone else who is choosing drama. This is for development purposes, the entire privacy argument is completely irrelevant.

<comment><USER21> If it's so irrelevant, then why _not_ change it? That's what good leaders do. Small price to pay to get good will and a large group of bystanders on your side.

His way generates conspiracy and alienation.

<comment><USER20> Because all of the alternatives are simply less reliable, less performant, less available and offer no benefits for development/testing. That is the only factor that matters here.

>That's what good leaders do. Small price to pay to get good will and a large group of bystanders on your side.

I don't think he cares about people who are determined to stay ignorant. Especially of those who refuse to comprehend the needs/use cases for different parties.

Frankly considering he has received death threats about systemd, I am surprised he even put a response at this point. It would make sense to me if he just closed the ticket immediately with a link to the previous discussion.

<comment><USER21> Sure, he doesn't care, and so then this happens. We happen. Drama.

<comment><USER20> The only factor here that matters is development/testing.

Drama is irrelevant and wouldn't change anything. At worst, he gets his issue tracker filled. If it bothers you, then the only thing that you can do is change to Devuan or don't use systemd-networkd/systemd-resolved. Distros are going to continue using systemd irrespective of this nonsense drama.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> Could someone explain why systemd needs DNS/NTP fallbacks to begin with? Why aren't these both runtime configs?

EDIT: I assumed there were also runtime configs based on the name "fallback."

My question is primarily why you need compiled-in fallbacks, and secondarily why the fallback configs aren't pulled from config files.

<comment><USER23> More to the point: does _any_ Linux software at all use a default DNS or NTP server? NSS resolver library doesn't default to using a specific DNS provider, and it's a DNS resolver. NTPd _might_ default to using ntp.org pools, but that might just be my distro's default configs.

To me this is more evidence that Systemd is really just "Poetteringd": whatever he feels like it should have, it has. Really disappointed that distros continue to use this software rather than start a community replacement that addresses its shortcomings.

If I re-did systemd, it would retain the same functionality, but not come enabled by default, and it'd be broken up into independent packages to be installed as needed. It would also use standard interfaces and do away with the binary formats, defer to existing system software rather than default to its own custom versions, de-complicate its awkward filesystem tree and simplify management of service configs, make the command-line interface more sane, and begin integrating more cloud-specific features to replace more complex cloud software (such as for service discovery, cluster management, and HA).

All these fixes would allow the "anti-systemd" crowd (of which I am a card- carrying member) to run a simple init system if they want, or extend it to the full range of systemd functionality. It would remove glaring pain points and user friction, embrace the existing system's default functionality (and backwards compatibility), and extend the software to be more useful in cluster environments. In addition, if this were maintained by the community, all distros could adopt it like they did systemd, and we don't have a half dozen different service systems like before.

Now please somebody reply and tell me why this is a terrible idea...

<comment><USER24> It more-or-less worked that way for decades (and it worked better), so it's not a terrible idea.

My theory is that the big distros are intentionally destroying forwards and backwards compatibility on the desktop as much as possible.

The more often window managers, desktop software, etc., stop working, the less their own teams have to compete with existing software. Wayland's X11-as-a- second-class-citizen and gtk's elimination of API stability are two other good examples of this.

Also, tearing down established standards is a great way to sabotage the various BSD's out there.

What they don't get is that sabotaging the rest of the community is undermining their own market share within Linux, even as it shrinks Linux's market share.

<comment><USER25> > My theory is that the big distros are intentionally destroying forwards and > backwards compatibility on the desktop as much as possible. The more often > window managers, desktop software, etc., stop working, the less their own > teams have to compete with existing software. Wayland's X11-as-a-second- > class-citizen and gtk's elimination of API stability are two other good > examples of this. Also, tearing down established standards is a great way to > sabotage the various BSD's out there.

I see this sentiment a lot and I don't get it. The developers I've talked to have been doing a _lot_ of work to get XWayland working and to fix all the edge cases. And GTK has been API stable for years, the only thing that really seems to have broken was themes. And actually now GTK3 is feature complete and will not be receiving any more changes except bug fixes.

As far as init systems go, there seems to have never been any real standard and most distros always seem to have done their own thing. It does not seem like anything could be done there especially when a low level piece of software like this needs to use Linux- or BSD-specific APIs. It simply is not possible to have a portable standard there right now.

I have a humble request, please don't continue by promoting these unfounded theories and accusing people of sabotage. I personally would welcome a friendly fork of systemd to make some positive changes but it won't happen if people are doing it out of hostility. Many of the issues in the GP post have been brought up over the years. Upstream and the distros all have a stance on them and there is a reason why things are the way they are. It would be unwise to proceed without having substantial discussions with them to put resources where they are actually needed most. There was already a hostile fork that died because of not paying attention to this.

</comment></comment></comment></comment><comment><USER26> > I will block discussions here now, since I don't think we need the input > from the script kiddie peanut gallery here.

How _not_ to interact with your community 101.

Defaults matter, because even if they are changeable via a build-time flag, most of the time they won't (how many people knew this was a default before now?)

<comment><USER27> > How _not_ to interact with your community 101.

On the contrary, I think he handled it perfectly.

I've become exhausted with most discussions on social media, because conversations frequently get hijacked by loud people with strong opinions that don't express them in good faith. Without strict moderation, it can become impossible to have a rational discussion on certain topics. For example, pretty much anything on HN involving Google devolves into worthless noise.

In the case discussed in the OP, Poettering clearly has no intention of changing the default configuration (at least based on the reasons given in the issue), and has provided a way of modifying the configuration for those that care enough to change it. There's no value in further debate, and closing the issue to further discussion keeps Poettering and other contributors from getting distracted/burned out by unproductive conversation.

If people don't like it, they're free to fork Systemd or start up their own competing software project, and then they can handle community interaction for their own project in whatever way suits them.

Frankly, I wish more discussion were handled this efficiently.

<comment><USER28> Its not really efficiently.

Something like: "we've discussed this a number of times, see #12345" closing now

would have closed the ticket and not made the front page.

By being a top draw dick about it (when the originator was at least being earnest) the debate rolls on.

He had given a full answer, he could have left it there, but chose not to.

its this kind of "rock star" and cheerleaders that give IT a bad smell.

<comment><USER29> Are you talking about the comment that closed the ticket [1]? Are we not seeing the same thing, because that's not a " _top draw dick_ " I'm seeing.

He was perfectly reasonable. And I don't know if you've ever managed any popular open source projects, however it's best to close tickets fast instead of letting them linger on, especially when you have over 1000 opened issues and especially if, as a maintainer, you know that you won't change your mind about that issue.

Then he got accused of being funded by Google. He actually showed restraint.

[1] [https://github.com/systemd/systemd/issues/12499#issuecomment...](https://github.com/systemd/systemd/issues/12499#issuecomment-490057558)

<comment><USER30> > Are we not seeing the same thing, because that's not a "top draw dick" I'm > seeing.

> He was perfectly reasonable.

The original complaint had the form "this default should be changed for reason X". Poettering's response was "our defaults are Y, and you can change them". That's not perfectly reasonable. It's a non sequitur. Poettering's response passively-aggressively ignores what the original complaint was all about, instead of simply issuing a direct rejection.

<comment><USER29> It isn't a non-sequitur, he offered a solution for users that would like different settings, while choosing not to engage in pointless arguments.

While professional courtesy is recommended, maintainers don't really owe an explanation for their work when provided for free. Put that man on a payroll and you might deserve a more detailed answer.

<comment><USER30> It is absolutely a non-sequitur to tell someone what the defaults are when they are complaining that they do not like what the defaults are. "Choosing not to engage in pointless arguments" would be _not responding at all_ , rather than responding in a manner that is implicitly insulting. Poettering phrased his response as if he was answering a different issue than the one he was actually responding to. Deliberately misinterpreting someone's question instead of directly saying he didn't want to get into that matter is poor behavior.

<comment><USER31> If they don't like the defaults, they could just fork the project.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> > I believe Google's DNS service is used for monitoring DNS traffic from IPs. > This is then most likely used for personalisation, which aids Google's > mission to take freedom and privacy away from nontechnical and technical > users.

Not questioning if Google does it or not but I was made to believe that IP is not really useful for ads targeting because it just doesn't work great with multiples users behind a single IP. Now with CGNAT on both type of networks (fixed and mobile), using IP for targeting does not seem pertinent to me.

<comment><USER24> Timestamps are usually enough to infer end users, even on much larger data sets. (Researchers used the Twitter firehose to deanonymize a large dataset a few years ago).

</comment></comment><comment><USER33> So what colour should we paint the bikeshed?

Fair response IMO, this is the type of issue that can attract a lot of noisy opinions so very reasonable to lock comments to contributors.

</comment><comment><USER34> FYSA: you can override Potterings delights in /etc/systemd/resolved.conf.d/fallback_dns.conf by specifying an empty string for the fallbacks.

</comment><comment><USER35> I'm kind of behind on systemd, can someone explain why it has DNS and NTP at all? Shouldn't it just use whatever the rest of the computer uses?

<comment><USER36> Systemd is kind of like the Borg. It slowly assimilates daemons until it eventually replaces all system level functionality. Its next target is home directories[1], then who knows what else.

[1] [https://systemd.io/HOME_DIRECTORY/](https://systemd.io/HOME_DIRECTORY/)

</comment></comment><comment><USER37> How to delete the fallback Google DNS and setup Cloudflare for example:

/etc/systemd/resolved.conf.d/fallback_dns.conf

      [Resolve]

      FallbackDNS=188.8.131.52 184.108.40.206 2606:4700:4700::1111 2606:4700:4700::1001

The same with NTP:

/etc/systemd/timesyncd.conf

      [Time]

      FallbackNTP=time.cloudflare.com

<comment><USER24> How do you completely disable the fallback, though?

</comment></comment><comment><USER38> What fallbacks do the major downstream distributions use?

<comment><USER39> Arch Linux for example:

#FallbackNTP=0.arch.pool.ntp.org 1.arch.pool.ntp.org 2.arch.pool.ntp.org 3.arch.pool.ntp.org

</comment></comment><comment><USER40> >Christ, what's next? You accuse us of controlling people's minds with vaccinations we get directly from Bill Gates? And that systemd uses 5G to spread CoV-2?

That seems a very aggressive response to a perfectly valid question in modern times. Google pays Mozilla tens of millions to be their default search provider. Companies use money to influence things to their benefit all the time.

edit: Another example was all the extensions that Kite bought out and had their service offering added to (which sent all your code back to Kite servers).

<comment><USER41> Asking someone if they are a shill is never "a perfectly valid question".

<comment><USER30> > Asking someone if they are a shill is never "a perfectly valid question".

It was more of a question whether there is a conflict of interest; "shill" is a more loaded term than what was used. And the answer was actually a qualified _yes_ , so there was at least a sliver of validity to the question.

</comment></comment></comment><comment><USER4> the more i grow up the more i emphatize with Poettering.

</comment><comment><USER42> The original title was much more explicit: "Systemd Fallbacks to Google NTP and DNS".

I guess @dang changed it with good intentions, but he accidentally destroyed the meaning. "We wanted the best, you know the rest."

<comment><USER43> > Don't fallback to Google NTP and DNS. #12499

</comment></comment><comment><USER44> The singular party who is entitled to complain about this default configuration is Google.

</comment><comment><USER45> > Christ, what's next? You accuse us of controlling people's minds with > vaccinations we get directly from Bill Gates? And that systemd uses 5G to > spread CoV-2?

> I will block discussions here now, since I don't think we need the input > from the script kiddie peanut gallery here.

Ohh my what a toxic open source community. I can't imagine working on a software project where the lead dev/maintainer says things like that to people.

Edit: I suppose with all the downvotes apparently lot's of people here think such responses from the leader of a open source project is acceptable behavior.

<comment><USER46> More like - that community leader takes an unbelievable amount of flack and is still generately polite and helpful in most of his interactions.

How about we cut them a little slack for occassionally being human?

<comment><USER24> I don't care if Poettering's an a—hole or not. I enjoy reading Torvald's rants, in fact. They're usually informative.

I'm upset that he has done more than any other developer to break my machines, and he keeps getting more authority so screw things up.

PulseAudio was bad enough, but at least it only broke one subsystem. SystemD has unapologetically broken: background process management, time keeping, network resolution, pam authentication, screen saver session management, x11 startup, logging, and probably more.

<comment><USER47> > I'm upset that he has done more than any other developer to break my > machines, and he keeps getting more authority so screw things up.

I may be wrong, but you should be blaming the ones who made the _actual_ decision of replacing whichever init system, with systemd.

systemd was developed under Red Hat's umbrella. Nowadays, the vast majority of mainstream Linux distributions use it, and I doubt it was because Red Hat/Poettering pressure them to do so.

</comment></comment></comment></comment><comment><USER36> So to summarize:

When discussing privacy and Google a common refrain is "just don't use Google products then". But Google's DNS is used as the default for a key system daemon in the majority of Linux systems?

I'm going to file this under "voting with your wallet is bullshit".

I also hope that the systemd team is watching the Google DNS ToS like a hawk because: "We may modify the Terms or any portion to, for example, reflect changes to the law or changes to our APIs. You should look at the Terms regularly."</comment>


Operation Vegetarian - <AUTHOR> https://en.wikipedia.org/wiki/Operation_Vegetarian <comment><USER2> The source mentioned in that page has more information: [https://www.thevintagenews.com/2018/01/10/operation- vegetari...](https://www.thevintagenews.com/2018/01/10/operation-vegetarian/)

</comment><comment><USER3> The potential risk to potential reward here seems pretty low. Both a good chance of it killing lots of people you didn't need/want to, and a good chance of it not doing any damage whatsoever to your enemy. War is full of bad things and hard choices, but this sounds like the worst of both worlds. Perhaps why it never got deployed.

<comment><USER4> WWII was also distinguished by the use of aerial firebombing, where tons and tons of explosives were hurled into cities more or less at random in the hopes that it would have some psychological or material impact. The whole idea of "precision strikes" and not harming civilians is a fairly recent development in the history of war. (Let's hope it sticks around!)

<comment><USER5> My knowledge about this is largely from Jonathan Glover's excellent/depressing _Humanity: A Moral History of the Twentieth Century_.

I thought 'harming civilians' is the fairly recent development. Battles usually always used to be between two armies on a field, away from cities. At the beginning of WWII, bombing cities was not even considered by the Allies; by the end, they were doing it themselves, justified by the Germans V2s bombing cities in Britain. The Germans justified that by saying the WWI British blockade of Germany was aimed at starving the people and killed many more. In the Nuremberg trials, the standard was "stuff they did that we didn't", but that standard had been slipping constantly during the century, as that book makes plain.

Perhaps most frightening was the description of the 'decision' to drop the atomic bombs on Japan, which wasn't even a decision, but a series of misunderstandings between a few different groups. No-one made a decision.

<comment><USER6> Um, no. The world history of warfare is very much one of looting, pillaging, rape, and enslavement. This held true everywhere from Africa over the centuries, to Greece and Rome, to the Ottoman Empire, to the Aztecs and Mayans and Olmec to Japan, to the Russian revolution, to the First Peoples in North America long before there was a United States of America .</comment></comment></comment></comment>


Vela 1979 event was Israel's treaty-violating nuclear weapons test - <AUTHOR> https://foreignpolicy.com/2019/09/22/blast-from-the-past-vela-satellite-israel-nuclear-double-flash-1979-ptbt-south-atlantic-south-africa/ <comment><USER2> Submitted 2 days ago. Linked wikipedia article gives more doubt on what happened and who was responsible

[https://news.ycombinator.com/item?id=21039013](https://news.ycombinator.com/item?id=21039013)

<comment><AUTHOR> No, this article is not the wikipedia article: it is a in-depth report that summarizes, among other things, recent open source analysis of previously classified data.

It leaves no real space for reasonable doubt as to the nature of event.

</comment></comment><comment><USER3> "even" -> "event".

<comment><USER4> Fixed, thanks.

</comment></comment><comment><USER5> I had a hard time parsing the title. I suggest "treaty-violating".

<comment><USER4> Edited, thanks.

</comment></comment><comment><USER6> EDIT: I was wrong. As a reply to this comment mentions, the article mentions another treaty that Israel ratified in 1964.

Original: Flagged for editorialized (and wrong at that) title. Israel never signed the Non-Proliferation Treaty, as mentioned in the article linked.

<comment><USER4> The article mentions that it violated the 1963 Partial Test Ban Treaty, which Israel had signed.

<comment><USER6> Seems like you're correct. I unflagged.</comment></comment></comment>