Pentagon Orders Wikileaks to Delete Classified Documents - <AUTHOR> http://www.boingboing.net/2010/08/05/pentagon-orders-wiki.html <comment><USER2> The spider drawing is a nice touch. If you're unaware of the meme it can be found here: <http://www.27bslash6.com/overdue.html>

<comment><USER3> _I am currently away on leave, traveling through time and will be returning last week._

I always get a kick out that line when I read it.

</comment></comment><comment><USER4> I wonder the likelihood that Wikileaks is a CIA honeypot operation.

<comment><USER5> I love the idea, and I would argue that the CIA/NSA/etc are very intelligent,.. but they aren't quite that intelligent.

</comment></comment><comment><USER6> Well, now that they've ORDERED them...

<comment><USER7> It does sound funny, but I wouldn't underestimate them.

Depending on how mad they get they have a lot of tools at their disposal to make sure these don't get released.

If I were them I would start by DOSing all wikileaks servers.

Next I would trace where the servers were and pressure local governments into seizing them. (It wouldn't take much pressure, other governments can't be happy about wikileaks either.)

Next I would stage local burglaries and just "happen" to steal the wikileaks servers.

Wikileaks does have some options if this happens, most notably peer-to-peer releasing. Because of that the DOD may decide it's not worth starting up with them.

<comment><USER2> I wouldn't underestimate Julian Assange either. He made the first free portscanner (precursor to Nmap), co-invented Rubberhose deniable encryption and wrote the Usenet caching software NNTPCache. He knows what he's doing.

<comment><USER8> He didn't write the first free portscanner (all portscanners were free in the '90s, and most still are). He wrote the first fast one.

<comment><USER2> This is what wikipedia says: _"In 1995, Assange wrote Strobe, the first free and open source port scanner. Strobe inspired Fyodor to develop the Nmap port scanner."_

Is that incorrect, or weren't the other ones open source? I'll trust you over wikipedia :-)

<comment><USER8> There were definitely port scanners before Strobe, but Strobe was the fastest port scanner. The notion that there would have been a commercial port scanner in 1995 strikes me as funny.

If you just need me to "win the bet" here I'll point out that even SATAN scanned ports, and the netcat man page (also '95) shows how to use it as a port scanner. Hobbit "invented" UDP port scanner (which Strobe didn't do) in '94.

If you were thinking that maybe portscanning was an original idea, I'll recommend that you research NUAA (a "port scanner" for X.25 networks) and Tone-Loc (a "port scanner" for telephones).

Remember that 1994 is before the web and before ISDN. The Internet was mostly a means to get on IRC, which was in large part a place to talk about attacks on dial-up systems. This is back in the days where there was a "commercial" UUNet and a "noncommercial-only" NSFNet, and actual splits between the two. To some attackers, a high-quality NUA scanner might have been more valuable than a high-quality TCP scanner. Who scans TCP ports when 1/3 of Unix systems are running rexd and another 1/3 are exporting / to "everybody"?

For the record, I 100% believe Strobe inspired Fyodor. I don't want to take anything away from Strobe. It was impressive for its time.

(Late edit: I'm reminded by a friend that Pluvius wrote pscan.c before Proff wrote Strobe. So there.)

(Later edit: here's probe.c from Phrack in '94:

[http://www.phrack.com/issues.html?issue=46&id=23](http://www.phrack.com/issues.html?issue=46&id=23)

[look for probe_tcp_ports]).

<comment><USER2> I stand corrected...

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> While it is all funny to laugh at the DOW, it is worth pointing out that the talk here is about the remaining 15000 documents that still haven't been released.

<comment><USER10> ... and to say nothing about the many thousand diplomatic messages Manning claims to have leaked.

I would love to take a peek.

</comment></comment><comment><USER11> Check out the video! What a dummy!</comment>


Leaving Beta, New Sponsors - <AUTHOR> https://letsencrypt.org//2016/04/12/leaving-beta-new-sponsors.html <comment><USER2> Let's Encrypt might be one of the most important initiatives for a secure web. I applaud all their great work.

The fact that they have chosen to reduce certificate lifetime in order to encourage automation is a really big win for the security of the web as a whole.

<comment><USER3> The only hiccup I've run into is that if you run too many tests during automation setup then they start denying further requests from you for weeks or longer under "too many certificates issued for that domain".

<comment><USER4> From [https://letsencrypt.org/getting- started/](https://letsencrypt.org/getting-started/)

If you are trying out the client for the first time, you may want to use the --test-cert flag, and a domain name that does not receive live traffic. This will get certificates from our staging server. They won't be valid in browsers, but otherwise the process will be the same, so you can test a variety of configuration options without hitting the rate limit.

<comment><USER5> It sounds like you are thinking of this being a tool for testing deployment configuration, but I could also see using it for internal test environments. The qc person adds the test CA to their browser, if they see "untrusted connection" then something is wrong. Would that model be supported?

<comment> vertex-four For internal test environments, you'd probably want to run your own ACME server[0] and use certs from that if you can. Then you only need to trust your internal CA that you can manager, rather than the test one that LetsEncrypt offer.

[0] [https://github.com/letsencrypt/boulder](https://github.com/letsencrypt/boulder)

</comment></comment></comment></comment></comment><comment><USER6> I assume "Leaving Beta" means their service as a whole is leaving beta, even though their Github client is still Beta?

From [https://github.com/letsencrypt/letsencrypt](https://github.com/letsencrypt/letsencrypt):

"The Let's Encrypt Client is BETA SOFTWARE. It contains plenty of bugs and rough edges, and should be tested thoroughly in staging environments before use on production systems."

And NGINX support is still labeled "highly experimental".

Not complaining though; these things take time. Thank you for bringing free encryption to the masses, Let's Encrypt!

<comment><USER7> The client will be renamed and moved to the EFF soon: [https://letsencrypt.org/2016/03/09/le-client-new- home.html](https://letsencrypt.org/2016/03/09/le-client-new-home.html)

<comment><USER8> Any plans to make the official client based on Go? I wasn't too happy about having to download a bunch of Python stuff on my server just to get an SSL cert. Reminded me of the days of yore when you had to fiddle with Perl modules just to run basic scripts.

<comment><USER9> There are a bunch of great unofficial clients, several written in Go (I like acmetool): [https://www.metachris.com/2015/12/comparison-of-10-acme- lets...](https://www.metachris.com/2015/12/comparison-of-10-acme-lets-encrypt- clients/)

<comment><USER10> Unfortunately lots of Go code on GitHub has significant oversights, this included. I remember reporting a DoS bug in a different Go acme library identical to this one I found in acmetool in less than 60s:

[https://github.com/hlandau/acme/blob/master/acmeapi/ocsp.go#...](https://github.com/hlandau/acme/blob/master/acmeapi/ocsp.go#L52)

In case it is not obvious, anyone in a privileged point on the network can fill resb with enough data that the program panics due to OOM and crashes. ioutil.ReadAll really needs a big warning in the docs because I have seen this pattern far too often.

<comment><USER11> Yeah, serious +1 to this. I'm amazed by the usage of ioutil.ReadAll in popular Go libraries and tools.

</comment></comment></comment></comment></comment></comment><comment><USER12> Full list of sponsors here: [https://letsencrypt.org/sponsors/](https://letsencrypt.org/sponsors/)

Good to see most of them using HTTPS for their homepage. Though Cisco and Gemalto don't yet.

<comment><USER13> No Apple or Microsoft. Are they opposed to this initiative? Do they think it's not important?

<comment><USER14> Apple don't give money to no one. Possibly the least altruistic company ever, which is disgraceful considering they're also the wealthiest.

<comment><USER15> Steve Jobs was pretty publicly opposed to donating to charity, but he's been gone for a while. If you Google "Apple Donations" you'll find a whole slew of articles detailing some of the contributions they have made since Tim Cook took the reins. For example, they match employee donations both in money and time.

<comment><USER16> Tim Cook exposes the lie that Steve Jobs ignored philanthropy

[http://appleinsider.com/articles/12/02/02/tim_cook_exposes_t...](http://appleinsider.com/articles/12/02/02/tim_cook_exposes_the_lie_that_steve_jobs_ignored_philanthropy_)

</comment></comment></comment></comment></comment><comment><USER17> What can we as a community do to ensure the long term financial health of Let's Encrypt?

EDIT: Any chance Let's Encrypt (or the underlying 501c3) could obtain cybersecurity grants from the US government?

<comment><USER18> Donate!

<comment><USER19> I don't know how much it helps but if you shop on Amazon, EFF is a sponsor of LE and EFF is an option for Amazon Smile. Tricky part is remembering to use smile.amazon.com instead of www but Amazon has started reminding users to go there and there's also browser plugins to force it to go there.

<comment><USER20> I wish Amazon would just forward to smile.amazon.com instead.

<comment><USER21> They want to support charity, but not too much.

</comment></comment></comment></comment></comment><comment><USER18> The node/express middleware works flawlessly for me. I am really stoked that Let's Encrypt is happening.

Writing multi-microservice apps in Node just got a lot easier to deploy for my side projects and small consulting clients - as well as cheaper. Of course it's safer, you never have to think twice about doing TLS.

That said, I'd still opt for a wildcard certificate for anything enterprisey.

Thank you to all the people who worked for years to make it happen.

<comment><USER22> > That said, I'd still opt for a wildcard certificate for anything > enterprisey.

Many sites use wildcard certs because they're the simplest way of getting SSL for your entire domain. There is one huge problem with that, though: Sharing the private key between different services means that the security of your private key is only as good as the weakest link. If any of your services suffer a compromise that leads to a private key leak (i.e. Heartbleed), all your other services are now vulnerable to MitM as well. Not just that, but weaknesses in your TLS configuration on one service could have implications on other services as well, as demonstrated by the DROWN attack.

That is not to say that there are no valid use-cases for wildcard certificates. If you're, for example, hosting a SaaS where each customer gets a custom subdomain, but the infrastructure behind each subdomain is essentially the same, there's no additional risk and wildcards are the perfect solution. If you're just getting a wildcard certificate because it's the most convenient solution, however, you're probably weakening some of your infrastructure in exchange for that.

<comment><USER23> You seem to be assuming that there needs to be a distinctive backend codebase for each domain covering the wildcard certificate.

This is something entirely orthogonal to the number of certificates. You could have 1000 codebases with different attack vectors under one SSL certificate, or 1 codebase the same attack vectors serving up 1000 SSL certificates.

<comment><USER22> I'm not sure I follow?

What I was trying to say was that it's a good idea to have one key per DISTINCT($attack_surface), which includes anything from physical security to the software stack, in order to limit the damage during a compromise. Throwing wildcards at everything tends to go against that principle, even though I admit there are use-cases where wildcards are entirely appropriate (namely those where each subdomain has the exact same attack surface anyway), and using something else isn't worth the trouble.

</comment></comment></comment></comment><comment><USER24> Mozilla on this: [https://blog.mozilla.org/blog/2016/04/12/mozilla- supported-l...](https://blog.mozilla.org/blog/2016/04/12/mozilla-supported- lets-encrypt-goes-out-of-beta/)

</comment><comment><USER25> I really really wish there was a client with decent support for using DNS- based verification, mainly so that I can generate certificates for mail servers (since they don't run a local httpd on the same machine).

Even if it was just spitting out a string that I needed to add/edit in my zone files (self-hosted DNS) every ~90 days, I'd be fine with that.

I haven't had much luck finding clients w/ support for this. I did find one that supported using Route 53, etc., via the APIs, but that didn't help me any.

If anyone is working on something like this, I'd be happy to throw a few dollars their way.

<comment><USER22> Take a look at any of the three bash clients listed here[1].

[1]: [https://github.com/letsencrypt/letsencrypt/wiki/Links#bash](https://github.com/letsencrypt/letsencrypt/wiki/Links#bash)

</comment></comment><comment><USER26> What's the plan if LE ever goes down / commercial / rogue? Millions of sites will have to get new certs manually within 90 days or less or they will all break. Wouldn't it be healthier if LE had some "competition" with compatible protocols as backup?

<comment><USER22> Let's Encrypt is actually an implementation of the ACME (Automated Certificate Management Environment) specification, developed by the IETF[1]. The goal is to get other CAs to adopt the standard as well.

In the meantime, other CAs are starting to offer free DV certs (Symantec being the most recent example), although there's no word yet on ACME compatibility.

</comment></comment><comment><USER27> I would like to thank LE and its sponsor for disrupting https and doing a great job. I love it.

</comment><comment><USER28> Can someone clarify something for me please:

"1.7 million certificates for more than 3.8 million websites"

How is this possible if they (AFAIK) don't issue wildcard?

<comment><USER29> They do do SAN.

<comment><USER30> Subject Alternative Name (SAN) and photo showing a SAN on a CERT: [https://en.m.wikipedia.org/wiki/SubjectAltName](https://en.m.wikipedia.org/wiki/SubjectAltName)

</comment></comment></comment><comment><USER31> Great News! I've been using Let's Encrypt through Laravel Forge and it's far and away the best experience I've had with SSL. Let's Encrypt is great for all web developers and end users.

</comment><comment><USER32> Anyone know what, if anything, this means for the rate limits on issuing certs on a given domain? That was the one thing that was stopping us from making SSL completely automatic on our customer's domains.

<comment><USER33> They recently raised the rate limit on certificates per domain per week from 5 to 20. [https://community.letsencrypt.org/t/rate-limits-for-lets- enc...](https://community.letsencrypt.org/t/rate-limits-for-lets- encrypt/6769/2?u=mholt)

<comment><USER34> It's also worth pointing out that you can have up to 100 SANs in a certificate, so you can technically issue for up to 20x100 (2000) subdomains per week.

<comment><USER35> When I hit a rate limit on sub1.example.com, it let me create a certificate with a SAN for sub1.example.com and sub2.example.com

So I think it's actually essentially unlimited, you just can't request _the exact same_ certificate more than 20 times per week

<comment><USER36> There are separate rate limits for FQDNs and domain names. The former is 5, the latter is 20.

</comment></comment></comment></comment></comment><comment><USER37> Please add wildcard support.

<comment><USER38> They don't support wildcard, but they do support alternate names, so you can have multiple domains on the same cert. I know it's not the same, but if you have a known list of subdomains, you could still use it.

<comment><USER37> I have a list of 75,800 subdomains on one of my sites, several hundred sometimes added in the course of a day. On my IPFS HSHCA subdomain CORS proxy, I have ∞. It's not mechanically sensical to just sit there banging on a centralized server all day to get an updated certificate.

Wildcard certs start at $100/yr (for -the- cheapest) and go quickly up from there.

Many people are not using SSL for many use cases because of this, and that's bad. Why leave them out in the cold for doing things like enforcing CORS security?

It's mind boggling to me that they could leave them out of the final product.

<comment><USER22> Out of curiosity, have you thought about registering neocities.org as a Public Suffix? Aside from bypassing the rate limits, neocities.org seems like it would belong on the list, given that you're (more or less) delegating control over subdomains to other parties. The PSL has implications for cookie scope as well (which might or might not be a concern for you).

I would very much like to see wildcard support in ACME and hope that Let's Encrypt will adopt it eventually (although I think clients should offer it as an opt-in, as not to encourage practices which are bad for security), and I think that both of your examples are a good fit for wildcard certificates. I'd probably still stick with a regular wildcard as well - $100/yr vs. managing ~1k+ SAN certificates sounds like a bad trade-off - but I thought I'd mention it anyway.

<comment><USER37> Oh wow, I had no idea public suffix was a thing. I'll definitely check it out, thank you.

</comment></comment></comment></comment></comment><comment><USER39> If you wish to allow the creation of subdomains by users, or if you dynamically handle unlimited subdomains for any purpose, then Let's Encrypt won't be able to help you just yet. Luckily, wildcard support is at least planned, so these use cases will eventually be supported in the future.

I've been using Let's Encrypt for my personal blog and I definitely appreciate the free security that is does offer, even without wildcard certificates.

<comment><USER25> So, they've solved a major problem... but not _your_ problem?

Honestly, wildcart certs would make my job a lot easier too, but with automatic renewal I'm more than happy to deal with multiple certs and stop giving the commercial CAs my money.

</comment></comment><comment><USER40> I want to use LE for my side project that I host on GAE. Does anyone have a good tip on this? Also do I have to manually renew it every 3 months?

</comment><comment><USER41> I would love to use LE but I can't because my use case is all about internal network. I don't want self-signed cert. I want to leverage internal domain system, especially the ones with IPs. While I understand the design of LE would not encourage any of the above, I do hope one day LE has a solution to end the pain of self-signed cert (without modifying host CA file).

<comment><USER22> If your internal domain is also a public (ICANN) domain, you can use DNS-based validation to get a certificate. Basically, you create a TXT record with a challenge token and make sure Let's Encrypt can resolve that record. Your actual internal domains don't have to be publicly resolvable or routable for that to work.

This is still a WIP in the official client, but there are a number of other clients with dns-01 support[1].

Publicly trusted CAs are not allowed to issue certificates for internal domains (i.e. made-up names which don't end with an ICANN TLD.)

[1]: [https://github.com/letsencrypt/letsencrypt/wiki/Links#bash](https://github.com/letsencrypt/letsencrypt/wiki/Links#bash)

</comment></comment><comment><USER42> Besides the automation features, what's the difference between these guys and, say, StartSSL, who also provide free SSL certificates? If I only have one or two personal domains for toy projects, why would I switch?

<comment><USER43> Let's Encrypt certificates quality is better: Grade A [1] versus Grade A- for StartSSL [2].

I personally like who's behind it. AFAIK, Let's Encrypt started with EFF sponsorship, later came Google, Mozilla, Facebook, now Cisco, Akamai, HP.

Probably there are other differences, would be glad to know.

[1] [https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.le...](https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.letsencrypt.org)

[2] [https://www.ssllabs.com/ssltest/analyze.html?d=www.startssl....](https://www.ssllabs.com/ssltest/analyze.html?d=www.startssl.com)

<comment><USER22> That grade is actually mostly about your TLS configuration (available cipher suites, etc.), and not about the certificate. Aside from some major no-goes (like SHA-1 certificates), TLS security is about server configuration; certificates are relatively straightforward in that respect.

It's true that they embrace a lot of best practices, like short certificate lifetimes, automation, logging all certificates to CT log servers (which StartSSL started doing quite recently as well), etc. The client also helps with securing your TLS configuration, among other things.

</comment></comment></comment><comment><USER44> Randomly who designed the website @ [https://letsencrypt.org/](https://letsencrypt.org/) ?

I love the landing page, it's clean, well organized and simple.

</comment><comment><USER45> I wonder if NameCheap will ever offer this to customers, I guess it would take out from their profits if they did considering they sell SSL tickets, but I never bought a ticket from them, and unless I absolutely have to / am being paid to I wouldn't bother doing so either way. If domain registrars push this it could raise more awareness, that and web hosts elsewhere. I wonder how DigitalOcean can aid in this endeavour as well (LEMP / LAMP images with LE integreated as an option?).

<comment><USER46> I was pleased to see Dreamhost (who I use) offering free Let's Encrypt for any domain bought/hosted with them. Quick & easy setup. Would love to see other registrars/hosts do the same.

</comment></comment><comment><USER47> I'm confused.

The web has a new server. If I trick the server into thinking that stuff I write gets hosted on example.com, it will generate a certificate asserting that I have a right to post stuff on example.com. It's easy for me to get that certificate revoked, but hard for the legitimate owners of example.com to do so.

Comparing this to self-signed certificates, I can think of a bunch of drawbacks, but I can't see any advantage. I hope I'm missing something.

<comment><USER48> Part of getting a certificate from Let's Encrypt involves getting a file from them that you then serve from a certain URL on your domain. Someone without enough control over your server to be able to do that won't be able to issue a certificate for it. This is called a "domain-validated" certificate.

It's not self-signed: Let's Encrypt is a certificate authority, which signs the certificates it issues.

<comment><USER49> I think their point is that any connection that LE makes to example.com in order to verify ownership will be insecure and thus vulnerable to MITM.

Not a problem specific to LE, but to any DV cert.

</comment></comment></comment><comment><USER50> Reminder to the LE site maintainer folks:

[http://i.imgur.com/jvp6a8M.png](http://i.imgur.com/jvp6a8M.png)

Open Sans does not render very well on some platform combinations.

Edit: I should say your specific version of Open Sans. Your 14272-byte version of OpenSans-Regular.woff renders like this, whereas other sites' 21956-byte version renders fine.

<comment><USER51> If you can't rely on a platform/browser to properly render a font as popular as Open Sans, it's really not worth working around it... I run firefox on Linux as well and don't have any issues. It's very likely on your end somewhere.

Edit: Do you get the same issue on [https://leclan.ch/](https://leclan.ch/) ?

<comment><USER50> Interestingly enough, leclan.ch renders fine on my local system.

Edit: HN's VPN endpoint hatred is preventing me from replying, so I'll post here as an edit:

Not likely eot/svg. You and LE are both serving me OpenSans-Regular.woff - yours is 21956 bytes, and theirs is 14272 bytes.

<comment><USER51> I'm using open sans (locally hosted as woff) on that site so i'd say it's unlikely to do with the font itself. Maybe your browser has issues with eot/svg fonts.

Could likely be something to do with fontconfig on your system.

</comment></comment></comment></comment><comment><USER52> Does "leaving beta" mean that any API limits have been increased? The 7 certs per domain per week thing is kind of a pain…

<comment><USER53> What does this mean to you? Note this is an honest question. Does it mean you're rebuilding your server from scratch and therefore requesting a new key each time for the same domain? Or does it mean something else?

I wonder if anyone has created a simple middle service that can locally cache the certs so you talk to the cache server?

<comment><USER52> When I was first testing out my automation I was using real keys instead of the staging server, so every time I tested I was eating up a cert.

In the end though, I have more than 7 certs for my main domain--With a bunch of services built up over the years, I have roughly 14 or 15 certs (so it took me 3 weeks to get all my certs created). Subdomains count against your domain limit, so "mail.example.com", "blog.example.com", and "www.example.com" count as 3 certs for "example.com".

<comment><USER53> Are you 100% sure subdomains count against your limit? I just asked that question on letsencrypt recently and was told there is no limit to subdomains.

</comment></comment></comment></comment><comment><USER54> This is awesome news.

Should we be worried that LE is sponsored by the big players (cisco et al.)

Not implying that we should. Just genuinely wondering if we should be wary or if it means anything at all, for the future of LE I mean.

ps:might be my misunderstanding as im not sure what sponsored actually entails.

<comment><USER55> Having Cisco onboard is scary, but it doesn't imply that backdoors have been added to LE. Sponsors only give money to support LE development and infrastructure.

<comment><USER56> hmm sponsors not "only give money"... they usually expect something in return - which is understandable.

To me this is a deal-breaker. Cisco did so many bad things in the past in terms of privacy that the only good news is that now I know to stay away from LetsEncrypt.

<comment><USER22> Could you elaborate on how Cisco being a sponsor affects your trust in Let's Encrypt? It's in the nature of the CA system that it's only as strong as its weakest link, and there are dozens if not hundreds of CAs of questionable trust.

This seems like a conceptual misunderstanding of how TLS works. Let's Encrypt does not have access to your private key and does not have the ability to decrypt your traffic. They put a stamp on your certificate saying "Yep, this key belongs to this domain" \- that's it.

<comment><USER57> Hypothetically, the risk could be that LE is now a trusted CA, Cisco could pressure to get a signed, trusted cert for anything.

I don't think that's realistic, but if we're talking conspiracy theories...

</comment></comment></comment></comment></comment><comment><USER58> Does this mean anything for developers? Like, do I have to change anything to keep using LE?

<comment><USER34> You don't have to change anything.

</comment></comment><comment><USER59> Came here to complain about the HN title which tells me nothing about why I might care to read the OP.

Noticed the domain, now glad to know.

The title could do with a fixup though - my RSS reader doesn't show the target domain.

</comment><comment><USER60> Does this mean that the 5 cert/domain/week limit is being lifted?

<comment><USER22> It's been changed to 20 per domain (and 5 per identical FQDN set, i.e. certificates that are exactly the same) recently.

</comment></comment><comment><USER61> Been using ReliableSite.net for years for our hosting, brilliant company and will always recommend them. What a pleasant surprise to see them as a new sponsor!

</comment><comment><USER62> This is fantastic news well done Let's Encrypt.

</comment><comment><USER63> Wow! Awesome news. Good job guys. We all have the right to be a little safer. It is running out the vile business of certificates.

</comment><comment><USER64> Hats off to all the people who contributed to LetsEncrypt. Your work has brought web security to the next level.

</comment><comment><USER65> I use LE to secure my rasperry pi at home, accessible via a domain.

\+ client side certs.

Really easy to setup, thanks for all your efforts!

<comment><USER66> Dynamic or Static DNS? I've currently got a Pi running my site, but haven't bothered with setting https up. Probably also because it seems a bit more complicated if you use a non-standard web server (in my case thttpd). But on the other hand, I baerly looked into it at all.

<comment><USER65> Dynamic, I use Amazon Route53 to manage the DNS, and have a script that checks my public IP every 15 minutes, if it's != the one it has seen before, it updates Amazon Route53 to the new IP.

In terms of setting up HTTPS, I use nginx.

</comment></comment></comment><comment><USER67> just installed a certificate yesterday and felt happy as I didn't had to wait for hours to get a certificated via email.

</comment><comment><USER68> I wish their client had first class support for other operating systems like FreeBSD. Current client is too debian/ubuntu specific.

<comment><USER69> Which part of [https://www.eriklundblad.com/log/post/lets-encrypt-on- freebs...](https://www.eriklundblad.com/log/post/lets-encrypt-on-freebsd/) is hard?

<comment><USER70> Actually, setting up LE on FBSD was even easier than that. We've had LE working on two of our FBSD servers for 4 months. Running the py27-letsencrypt client with --certonly and -d domainname -d ..., installed the certs in /usr/local/etc/letsencrypt/live/<domain>/...

Then pointing nginx to the "live" cert location and setting a cron job to renew every 4 weeks or so pretty much takes care of the whole process. I notice the FBSD LE client was just upgraded, not sure what new features it offers, but certainly should work at least as well as before.

</comment></comment></comment><comment><USER71> I'm incredibly happy that boulder is under the MPL. Not enough new software is copyleft these days.

</comment><comment><USER72> Leaving beta? They don't even have a Windows/IIS client yet. They're nowhere close to "release quality".

<comment><USER73> Sure they are. They're a CA, the clients are just for users' convenience. Anyone who wants to can write their own client against the LE rest API.

<comment><USER72> I disagree. When you go to the webpage linked above and hit "getting started", there's not even a _hint_ that their system works in OSes other than Linux.

Possible there is support for Windows and IIS, but _their own website_ strongly suggests otherwise.

EDIT: if they consider their client and their CA as two different products, well, right now the website conflates the two badly. And there's absolutely nothing there to suggest it supports Windows/IIS.

<comment><USER73> > here's not even a hint that their system works in OSes other than Linux.

> And there's absolutely nothing there to suggest it supports Windows/IIS.

Their "system" is an API for issuing certificates. There's nothing platform specific about that.

> right now the website conflates the two badly.

From [https://letsencrypt.org/getting- started/](https://letsencrypt.org/getting-started/): You're welcome to use any compatible client, but we only provide instructions for using the client that we provide.

Edit: This is the protocol they use: [https://github.com/letsencrypt/acme- spec](https://github.com/letsencrypt/acme-spec)

I found the link here: [https://letsencrypt.org/how-it- works/](https://letsencrypt.org/how-it-works/)

<comment><USER72> So what part of this is going out of beta? The protocol, the CA, or the client?

Now I'm just confused.

But I still say: if their mission is to make it as easy as possible to install a SSL cert on any website, as long as they don't have any (apparent) support for Windows/IIS, they're a long, long, long way away from fulfilling that mission and probably shouldn't be leaving beta.

<comment><USER74> Typically beta/stable is about stability, not about features or platform support.</comment></comment></comment></comment></comment></comment>


Zelle users are finding out the hard way there's no fraud protection - <AUTHOR> https://techcrunch.com/2018/02/16/zelle-users-are-finding-out-the-hard-way-theres-no-fraud-protection/ <comment><USER3> Most of the article was pretty good up until the close:

 _And as word gets around that Zelle and the banks are not helping people who were scammed, it will ultimately damage Zelle's reputation and send users back to PayPal, where buyer protections exist._

This isn't "damaging" Zelle's reputation - you should _never_ use Zelle (or Venmo) for this type of transaction. Asking your bank to "help" is like asking the US government for a refund when you mail an envelope full of cash to some anonymous person.

<comment><USER4> On one of Zelle's site pages, it states: "EASY. FAST.SAFE. DONE. Forget running to the ATM or mailing a check. With Zelle, there's a new way to move money. Backed by the nation's leading banks and credit unions, you can send and receive money with peace of mind and without the hassle."

So, two problems here. It's not "safe." It safely arrives at its destination, but for most people, a safe money transaction is one that's protected from fraud somehow, which this is not. And it's not "backed" by banks so much as it is backed by your bank account. Again, backed by banks sounds like fraud protection. I don't think there's anything wrong with Zelle. It sounds like a useful service. But unless they are sanguine about these kinds of problems occurring then they ought to make it very clear to not send Zelle to a destination you don't 100% trust. That the only guarantee here is for guaranteed delivery of your cash and nothing else. So that's not quite the same as mailing an envelope of cash, which I know from personal experience as a lad is inherently unsafe even if the destination is your best friend's house.

<comment><USER3> Safe in the sense that me sending money doesn't expose my bank account to being ripped off. We have a huge problem in the office right now in that we don't have any mechanism to pay each other digitally for things like lunch - seriously! A lot of the office feels really weird about giving their banking credentials to Venmo (even though it's pretty popular here in Ann Arbor, MI) and a bunch of people think paypal is shady (I use both of them, but I'm probably a little more open to risk).

Zelle sounds like it will be exactly what we've been looking for - a safe way to send cash to each other, with the exact same risk profile of _cash_ \- that is, I give you my cash, and you have my cash, but nothing else.

I 100% agree with you though, that the banks need to make it clear that this is to be used to send money to friends, and family - not strangers - <USER2> you are okay with strangers just taking your cash. Poor communication on their part.

<comment><USER5> > We have a huge problem in the office right now in that we don't have any > mechanism to pay each other digitally for things like lunch - seriously!

Have you considered running an internal credit system? Those who pay for other's shares of a given lunch get credits for those, and those whose lunch is paid for get debits.

When a group of people go to lunch, the person with the persons with high debt should pick up the tab.

Once a week or once a month or something, people should bring cash to settle their debt, with the cash then distributed to those with credit.

We almost did that at an office I worked at...but got bogged down in bikeshedding other features. In particular, our biggest lunch problem was not settling the bill. It was agreeing where to go to lunch. So some people wanted the lunch manager to also handle that, and wanted to do it in a way that was fair.

How to do it fair is not obvious, and no one could agree on the solution.

<comment><USER6> We used splitwise to do this at work for while. Its designed for splitting roommate expenses, but ended up working pretty well for accounting for who should pay for the next lunch.

When someone would leave the company we would settle up with cash.

</comment></comment></comment></comment></comment><comment><USER7> Zelle exists because the US government hasn't mandated free person-to-person transfers like nearly every other country on the planet. It tries to be a private initative to allow for electronic transfers.

That being said .. it's still just a virtual check. If you write a real check to someone and they cash it and then don't give you what you ask for, you do have to get that person or entity arrested or take them to court somehow.

Even if Zelle was an official US federal reserve system (which it really should be and not this hacked together bank program), I think you'd still have the same exact issue.

Judging from the comments even Venmo appears to have the same issues, even though it's owned by PayPal. Their parent company PayPal has some protection because there's that buffer that exists in the PayPal account before it goes to your bank account (although I though Venmo had this too?) so they can recover money from that layer, but not always when it gets transferred all the way out.

<comment><USER8> It's also a difference of expectations. I live in a non-US country where escrow services never took off and consequently nobody expects fraud protection from financial service providers. The banks cover unauthorised use but not authorised transfers for fraudulent reasons. That is dealt with by the police.

PayPal has set some interesting expectations for what a service provider should cover.

<comment><USER9> I'd argue that it's not just PayPal though, although they've played a part for sure. Credit cards in the US are ubiquitous and offer a very high level of fraud protection that consumers are used to.

Of course, that fraud protection (and the multiple points & cash back systems) are all covered by overhead in the system. Merchant fees are quite expensive, although the consumer never usually sees them except for small things like cash discounts or minimum transaction amounts at small businesses. There have been some interesting court cases about the ability for merchants to pass those fees onto their customers.

</comment></comment></comment><comment><USER10> I've been scammed in reverse by the precursor to zelle, quickpay. I accepted a transfer and released goods, then the transfer was reversed.

I was told multiple times by chase reps that transfers were not reversible once initiated, but they never reimbursed me even after I filed a complaint with the CFPB. It wasn't enough to be worth suing over.

</comment><comment><USER11> Well, no fraud protection other than, you know, the law. It's still quite illegal to defraud anyone, especially "over the wire". Since Zelle is all cozy with the banks I'd expect there wouldn't be too much pushback when the police ask who was responsible for some fraud...

<comment><USER12> Most police departments or prosecutors are not going to spend any time on your $200 concert ticket.

<comment><USER13> Perhaps they ought to spend time on actual crime (e.g. a $200 ticket) rather than non-crimes like which particular natural substances someone chooses to burn and/or ingest? It seems to me that police departments could earn a good return on investment simply by, y'know, chasing down criminals who defraud others. Maybe I'm a starry-eyed optimist.

</comment></comment></comment><comment><USER14> Correct me if I'm wrong, but if I send a scammer money through Venmo (which Zelle is competing with) the money is gone.

How is this different?

<comment><USER15> You are wrong, which is why Venmo is used to scam sellers instead of buyers: [https://www.thebalance.com/venmo- scams-315823](https://www.thebalance.com/venmo-scams-315823)

<comment><USER14> _The user agreement specifies that the service is for "payments between friends and people who trust each other," and that there is no buyer or seller protection._

That sounds the same as Zelle, with the exception that Venmo _might_ help you if scammed. Sounds like you're very unlikely to get help on the Zelle platform.

</comment></comment></comment><comment><USER16> Zelle is _great_ for things like splitting rent. Just don't use it to buy things from strangers.

<comment><USER17> This makes sense to me as a Venmo equivalent, but doesn't Chase have a QuickPay feature that uses Zelle? Is it more secure from there or corner- cutting?

<comment><USER18> Their quick pay is literally called "Quick Pay with Zelle". Seems to be the same thing.

<comment><USER19> That's interesting. They can include anyone that uses Chase Quickpay in their "Zelle" metrics. Mind you, I'm referring to people who use QuickPay in the Chase app and not those who have downloaded the newer Zelle app.

</comment></comment></comment></comment><comment><USER20>
      PayPal... which has long been the standard for these sorts of anonymous transactions

No sane seller would use PayPal for such a transaction. PayPal offers _no seller protection whatsoever_ for items that are not shipped via a common carrier and with tracking.

<comment><USER21> Except if you sell on eBay. I have a friend that is routinely ripped off and eBay and PayPal basically tell him to fuck off. He does a 500k in revenue through them and just has to suck it up. Both those companies are scum in my opinion

<comment><USER20> The only eBay difference is that eBay effectively forces you to accept "returns".

</comment></comment></comment><comment><USER22> It strikes me that Zelle is basically repackaging of wire transfers. And banks have always been reluctant to reverse wire transfers. Because, I think, they're _intended_ to be irreversible, and executed between knowledgeable parties.

<comment><USER23> I believe it's ACH payments

<comment><USER22> OK, but aren't those just as readily reversible as checks? I've read that banks readily reverse even cashier's checks. Which was the basis of a common Craigslist scam. Maybe it's just the Zelle doesn't care to be bothered.

<comment><USER23> Every transaction you make with a credit card is an ACH payment behind the scenes, so yes they are readily reversible. The banks are hands off with Zelle though, any payment is like giving call, they have no duty to reverse funds over disputes between you and receiver unlike PayPal type services. You have to trust who you are giving money to.

<comment><USER24> Zelle is for PERSONAL payments only. It's for sending money to friends and family and people you trust and know. It's free for both the sender and receiver BUT you won't get any protection. Once it's sent, it's sent.

Don't people read? It's on Zelle's website "send money in minutes to your friends and family". I also asked my bank about that and got told there's no protection unless somebody hacked into your account. Yet, if you sent the money, it's your responsibility.

Nonetheless, I do accept Zelle for payments and also pay for goods BUT I know the people I deal with and it's mostly below $100. You can check out this link below. [https://www.zellepay.com/support/im-unsure-about-using- zelle...](https://www.zellepay.com/support/im-unsure-about-using-zelle-to-pay- for-goods-or-services-from-someone-i-dont-know)

BTW: PayPal really sucks if you receive a lot of personal payments. I got my account frozen because PayPal got nosy and wanted to know more about 15 transactions. It took me a while to get my account unlimited. So, that's why I use Zelle for personal payments and use PayPal only for purchases. I would ditch PayPal but I don't have any option for now.

</comment></comment></comment></comment></comment><comment><USER25> Banks don't care about customers but care a lot about being compliant with plethora of regulations. Non-compliance for a bank means the lights can a will be turn off by a governing bodies, of which are many.

Hence - offering a money transfer service within the bank infrastructure and services without consumer protection - is highly likely is a violation of some regulation. Or more than one even.

Supplement the complaint with a proof of "misleading marketing practices" \- and this adds couple extra zero's to potential damages.

Someone just need to dig it deeper and then push the button where it hurts. Problem solved. Regulators will be on consumer side.

<comment><USER26> Except that'd probably fall into the CFPB remit, which has just been significantly reduced in scope and veracity due to the current administration... :(

<comment><USER25> Sending bank fails to disclose irreversability of a transaction implying that typical consumer protection takes place.

Receiving bank fails to detect simple fraud pattern: Within short period of time: New account opened, Zelle transfer received, Money withdrawn.

Let it rinse and repeat for long enough - and class action will take place.

</comment></comment></comment><comment><USER27> I guess its all about expectations. If this were cryptocurrency we'd be blaming the victims.

</comment><comment><USER28> Funny story. Someone, let's call him Mr. Unlucky, sent me $1700 via zelle a few months ago. I called my bank and asked them about it and they had no info. About a week later, a guy emails me saying he meant to send the money to his land lord email@example.com but instead sent it to me, email@example.com. Both me and this unlucky dude called the banks, called Zelle, etc trying to get the charges reversed. No luck.

So lucky for this unlucky guy, I had been receiving John.D.Doe's email for about a decade on and off. I had sent the guy mistaken emails and sort of had a dialog with him. I knew he was in real estate. I emailed him and he confirmed that this unlucky guy was indeed renting from him, and his rent was this $1700 amount. So I took a leap of faith that this guy hadnt been playing a long con on me and forwarded the money. It was reckless and probably stupid but it wasn't my money and I felt bad for Mr. Unlucky. Zelle was no help, had no protection, and allowed this silly mistake to be made. Mr. Unlucky sent me a nice note and we both commiserated about the flaws in Zelles systems. I don't think I would use them.

</comment><comment><USER29> People below are rattling off lists of alternatives, PayPal (fees), Venmo (requires another account setup), Google Wallet, Apple Pay, and so forth.

I'd hate to be that guy, but the cryptocurrency blockchain technologies have some potential for something none of these other technologies have, which is elimination of vendor lock-in. It's annoying to have such a variety of places where I have username and passwords to apps which store my account credentials. I forgot LevelUp which I use for (it turns out) just ONE coffeeshop. I have accounts on all the others (linked to my bank account) minus Venmo because I guess I decided, enough is enough.

The account proliferation due to inefficient competition and lock-in of vendors is absurd. So in comes Zelle, perfectly positioned to solve that problem, but for 'friends and family' only? My tenant pays me through it, and I don't think we're related.

Banks are slow, conservative dinosaurs allowed to constantly play CYA with consumers.

<comment><USER5> You don't need a username and password to pay by PayPal. For Apple Pay you only need to use your username and password when setting it up, if I recall correctly. When you use it to pay you only need your fingerprint (or face if you have a phone with FaceID?).

Cryptocurrencies (at least the currently popular ones) only sort of match what Venmo does from your list. The rest do things that cryptocurrencies do not do, and that most consumers want.

PayPal (if you pay with a credit card), Google Wallet, and Apple Pay provide you the protections that a credit card provides. Seller doesn't provide the goods? Call your card company and they reverse the transaction. If you have a PayPal account as a buyer and pay through a balance on the account, I think you still get protection.

With Bitcoin and I think the other popular cryptocurrencies in actual use for real world purchases you don't have protection. Like Venmo (and Zelle) they are like sending cash, except unlike Venmo and Zelle cryptocurrencies are essentially a foreign currency which adds some headaches to using them.

Zelle doesn't say it is for friends and family only. What they say in their FAQ is:

> Zelle is a great way to send money to family, friends, and people that you > are familiar with such as your personal trainer, babysitter, or a neighbor. > If you don't know the person, or aren't sure you will get what you paid for > (for example, items bought from an on-line bidding or sales site), we > recommend you do not use Zelle for these types of transactions.

Presumably your tenant is familiar with you, and so Zelle is fine for him to use.

It's essentially equivalent to paying in cash. They should say that somewhere prominent on their site. That would probably clear up a lot of confusion, as I think most people in the United States have a good intuitive understanding of when you should and when you should not use cash.

</comment></comment><comment><USER30> I don't know enough about this to comment authoritatively, but I would expect KYC/AML rules to apply here. If I send money via any means to a bank account, I think the bank should be able to produce information about the identity of the account holder in response to a subpoena. If they can't, regulators might be rightfully annoyed.

Also, shouldn't Regulation E apply to Zelle?

</comment><comment><USER31> So some people use a payment platform that looks like using cash, don't use any of the common sense they would using cash, get scammed and complain ?

It's PEBCK in it's purest form.

Zelle is secure, as way to wire money. People can't put a gun in your face and still it while you send it.

It's exactly what it advertises.

I don't see how anybody could be confused by "easy, fast, secure, done" here.

</comment><comment><USER32> The last time I looked the iOS app had the worst user reviews I've ever seen. When I looked at it a few months ago it had a 2 Star average, but I just checked and found its shot up to 4 stars. Curious, I read the user reviews and ...

Just as bad as ever. Can anyone say "gaming the app ratings system"?

Specifically to Apple?

</comment><comment><USER33> So Venmo doesnt have real fraud protection either? Any stories of Venmo users being scammed?

Interesting to see that the only real form of fraud protection offered by Venmo is a warning in their copy.

<comment><USER34> Oh yeah they've been having the same problems.

[https://www.theverge.com/2017/11/21/16681292/venmo-scam- ipho...](https://www.theverge.com/2017/11/21/16681292/venmo-scam-iphone- payment-fraud-andy-mai-paypal)

</comment></comment><comment><USER35> Zelle is basically a thin wrapper over ACH transactions. In fact, my understanding is that Zelle is basically just "One-day ACH". I never really considered the fraud aspects, but clearly a modern payment processor needs to have a proper escrow involved somehow. ACH and Zelle don't look like they'd do the trick.

Dwolla was a good middleman for this sort of thing, but it seems like Dwolla pivoted to different services unfortunately.

Overall, this is why the USA has credit cards. A Credit Card company is the middle-man that you trust to handle these issues.

<comment><USER36> Even ACH has a clawback mechanism for fraudulent transactions. It's ridiculous Zelle does not provide the same protections.

<comment><USER35> I don't think its "ridiculous". Cash, Wire-transfers and Checks (especially Cashier's Checks) do not really have a reversal mechanism IIRC.

Once a Cashier's check goes into someone's account, there's basically no way for it to come out.

But the thing is: we all know these details already. When working with Cashier's checks, we know its insanely dangerous and to keep track of those little paper-slips. It seems like the general public doesn't know that about Zelle yet.

<comment><USER37> Checks and cashier's checks can be reversed. It is common scam to send forged cashier's check, have victim deposit, and send some of the money by irreversible wire transfer. When the bank, or account holder, discovers the fraud, it will be reversed and the victim is out the money.

<comment><USER38> A _forged_ check yes, but not a valid one. That is not a direct comparison as these stories are not about forged Zelle transfers.

</comment></comment></comment></comment></comment><comment><USER39> I've never used Zelle and was quite annoyed when they were injected into my banking data. Very shady nonsense from the big banks. I ended up closing my Bank of America account for other reasons, but suffice it to say BofA is horrible. All major banks are engagd in rampant thievery with their high fees and perverse incentives. The Wells Fargo scandal demonstrates that perfectly.

</comment><comment><USER40> Federal Reserve Note users are finding out the hard way that there's no fraud protection.

</comment><comment><USER41> LOL Zelle. Never heard of it until a month ago until a massive market push bythr massive banks started shoving it down my throat. I've never wanted to avoid an app more

</comment><comment><USER42> Whoa, whoa... people use Zelle and Venmo to buy things??? Everyone I know uses those to send money to friends.

Banks not protecting mah fraud... better switch back to Western Union for my Nigerian prince money!

</comment><comment><USER43> Zelle's biggest hurdle will be growing their community. Currently, there's insufficient feature differentiation from Venmo to warrant migration. None of my friends are on Zelle, so there's no reason for me to be.

<comment><USER44> Alternatively, I never started using Venmo because I never trusted a third party to have my banking data. Now I use Zelle because it's backed by my bank, and since basically everyone I know now has it by default from their bank, I have seen pretty high adoption rates with my friends.

<comment><USER45> > I never trusted a third party to have my banking data

How do you pay bills? I know some banks offer their own bill pay services, but I've never tested them out, and use the utilities' sites.

<comment><USER46> Reading this makes me realise how good Australia is in this regard.

We have 'BPay', which every* bank supports from within their apps, and almost all bills support. We have instant intra-bank transfers and next-day inter- bank transfers.

Additionally, the big 4 banks (yup, we have just 4 big banks) have mobile payments, so you can link your mobile number to an account and receive payments into it. It's painful if you're with different banks, but the net result is that no-one* here uses PayPal, et. al, to transfer money to each other.

And now, we've just had PayID roll out, which is instant payments based on email or phone number to any of the banks (I think most banks in AU are participating, but it's backed by our Reserve Bank), which is a huge game changer and pretty much negates the need for a third-party to do this for us.

<comment><USER47> > Reading this makes me realise how good Australia is in this regard.

I'm from Sweden, I started paying bills through my internet bank over 20 years ago. And it was never difficult or a big deal, because the existing giro-based bill system that _every_ vendor uses and has been using since the 1960's, slotted right into it, with zero technical integration required from the payees.

Moving to the US was like stepping into a time machine when it comes to dealing with banks and bills, it's ridiculously backwards. And Americans generally have no idea how behind they are. It's so fucking frustrating having this discussion every single time.

<comment><USER48> LOL. Spend some time dealing with French banks and then we can talk about American banks. France is a place where people actually write checks for things and you have to physically visit your specific branch to accomplish certain transactions. The concept of "branch banking" hasn't made it to France yet. Even withdrawing cash from a bank requires an appointment (if you want to withdrawal over a few hundred Euros for instance.)

French banks are a nightmare conpared to American ones.

</comment></comment></comment></comment></comment></comment><comment><USER49> I think it's a little odd that they chose a name so close to the name of the Nazi in the movie "Marathon Man."

<comment><USER50> Zelle roughly translates to "cell," as in a room or a component or a group of people. (It's also a town near the Austrian border.)

<comment><USER49> It's not the same, no, but visually it's close.

</comment></comment></comment><comment><USER51> Just like there are no "buyer protections" with checks or handing someone cash.

It's an expectations issue, not a technology issue. Can't get your money back with Western Union or TransferWise either if you're not making intelligent decisions.

Edit: _Do not send payments to a stranger unless it's through a payment system that offers you protection. That is not the role of person to person money transfers._

<comment><USER52> > It's an expectations issue, not a technology issue.

Nobody said it was a technology issue.

<comment><USER51> I believe my point is Zelle can't fix users doing stupid things.

<comment><USER53> Yes, they can. They can make the correct use case clear on their website and in their UI. A warning could be added when sending payment that there is no fraud protection.

I blame both the banks and Zelle for implementing this poorly.

<comment><USER45> Why wouldn't "add in fraud protection since that's many people's reasonable default assumption" be the most desirable thing for them to do?

Why do we let people get away with such crappy ideas, and then just blame users or implementers (UI designers, in this case)?

<comment><USER54> Because fraud protection costs money, and it's useful to have an electronic payments medium that doesn't have it, and therefore avoids those costs.

<comment><USER45> So if Paypal can give it to me for free, per the article, the answer just seems to be "we should tell everybody as loudly that we can that this is a shit product."

<comment><USER51> PayPal takes 2.9% and change off the top. Banks do not charge for person to person transfers. There is no skim for expensive fraud prevention to come out of.

<comment><USER45> PayPal doesn't take that off the top for person-to-person. They haven't in... five years? I don't know. It's been a while. You used to have to do some sort of "it's a gift" thing, but I haven't seen that in a long time.

[https://www.paypal.com/us/selfhelp/article/What-are-the- fees...](https://www.paypal.com/us/selfhelp/article/What-are-the-fees-for- PayPal-accounts-FAQ690)

> There are no fees within the U.S. to send money to family and friends when > you use only your PayPal balance or bank account, or a combination of your > PayPal balance and bank account.

<comment><USER37> Paypal doesn't provide fraud protection for free friends-and-family payments.

There is scam where sellers will request select friends-and-family payments both to avoid the fee but also to avoid the protections.

<comment><USER45> Ah, thanks, that's not obvious from the original article. Or from Paypal, either, to me. Very obnoxious, that.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


What would you suggest a 'must have skills' for a Designer in 2019 - <AUTHOR> What would you suggest a 'must have skills' for a Designer in 2019 given the world tech and design trends?<p>#UX #IxD #CxD #UI #VR #AR #MR #XR  #AI #fintech #healthcare <comment><USER2> UX is really about the whole experience. Consistency and process design, not so much delivering pixel perfect individual buttons.

A great designer who is able to incorporate new features in an existing product while maintaining consistency will go a long way.</comment>


11 hiring mistakes I made in the first year of my startup - <AUTHOR> https://www.techinasia.com/talk/11-hiring-mistakes-i-made-in-first-year-of-my-startup <comment><USER2> > Nothing beats great attitude. Period.

>This especially impacts the work environment. In startups, you have to sometimes work 16 hours a day, seven days a week.

You just sound like an exploitative employer (possible also illegal in many places).

Single digit equity, or less doesn't compensate for this. You mention elsewhere you pay below market rate. You can try and "sell the dream" but you actually just exploiting your staff...

<comment><USER3> He also posted it himself, which makes me think he was proud of it all. All this blog made me think was how I would never want to work for such a company, even remotely.</comment></comment>


Come on over Facebook Introduces Messenger Rooms - <AUTHOR> https://messengernews.fb.com/2020/04/24/come-on-over-facebook-introduces-messenger-rooms/ <comment><USER2> Err... No Thanks. You can count me out.</comment>


Disable Facebook Chat Seen Status - Chrome Extension - <AUTHOR> https://chrome.google.com/webstore/detail/facebook-chat-privacy/gfpgaanechfneiboempkfjghninbibjn extension is open source, it just blocks a simple connection to http://www.facebook.com/ajax/mercury/change_read_status.php <comment><USER2> OP: I'd advise you to be careful producing extensions which adjust facebook in any way. The author of one of the most popular facebook extensions had his account revoked as it's strictly against Facebook's ToS to adjust the page or experience in any way: [http://thenextweb.com/facebook/2012/12/19/facebook- bans-crea...](http://thenextweb.com/facebook/2012/12/19/facebook-bans-creator- of-fb-purity-a-browser-add-on-that-lets-users-customize-the-site/)

<comment><AUTHOR> extension is open source, it just blocks a simple connection to [http://www.facebook.com/ajax/mercury/change_read_status.php](http://www.facebook.com/ajax/mercury/change_read_status.php)

<comment><USER3> Unfortunately Facebook won't care about any of that in their determination over whether to try to punish the op.

<comment><AUTHOR> are you from Facebook ;)

</comment></comment></comment></comment><comment><USER4> No need for a Chrome extension.

Just block the /ajax/mercury/mark_seen.php, change_read_status.php and /ajax/messaging/typ.php URL's via your firewall ruleset.

The utility of a kernel space firewall is not limited to Facebook privacy. It's very easy to stop mobile apps from "phoning home" using such a firewall. Could users find this desirable?

Maybe there's a market for a pre-configured firewall you can carry in your pocket? Think small PCB (say, RaspberryPi or something that could fit in an Altoids tin) as a headless wifi gateway/firewall for your branded, infinitely functional, graphical mobile device.

It might sit between the user's mobile device and the wifi access point and redirect certain IP addresses (e.g., those for www.facebook.com) to a proxy listening on localhost. The proxy can perform Layer 7 filtering.

tcpdump/ngrep running on the PCB could show the user what apps are phoning home. The user could then choose to add them to the firewall.

Internet service subscribers with modest technical know-how routinely configure and run wifi routers in their homes. Or someone does the config and setup for them. Running a similar "router" in your pocket is not unfathomable.

Does privacy have value?

</comment><comment><USER5> Curious why it needs access to all your websites? I thought you can do wildcards in Chrome?

Edit: OK looked over the Chrome .crx file. Apparently it does the filtering internally inside the script instead of declaring it in the manifest (or wherever Chrome puts those settings now).

<comment><AUTHOR> i just reviewed the source code and it only blocks a simple connection to /ajax/messaging/typ.php, /ajax/mercury/mark_seen.php, and /ajax/mercury/change_read_status.php.

good catch to reduce permissions.

<comment><USER6> Oh, it probably will get an update where it can access anything after a lot of users have installed it.

</comment></comment></comment><comment><USER7> Regarding Facebook Chat:

Does anyone know why I need to "Turn Off Chat" every time I login to Facebook. It is clearly designed to login automatically, Facebook doesn't respect the user's wishes to remain "offline". It keeps logging in, as if they think my FB web engagement is going to increase for being available to chat. As a result I use FB less. Anybody knows why FB is becoming so unusable?

<comment><USER8> That means u r signed in from some other place, like your Smartphone, or some IM client like Trillian etc, or u have Facebook Messenger installed on ur phone, due to which u r always online when u sign-in.

<comment><USER7> I thought about this, but I don't have any FB app on my mobile, nor use an IM client (except HipChat for work).

<comment><USER8> Did u use a IM Client like IMO by any chance? Because with IMO, even if u remove it (while ur status was online from IMO client), u r still signed into Facebuk. I eventually had to download it again, sign-in, changed my status to offline. And since then, I haven't faced any issue.

</comment></comment></comment></comment><comment><USER9> [https://dl.dropboxusercontent.com/u/14314213/no- thanks.jpg](https://dl.dropboxusercontent.com/u/14314213/no-thanks.jpg)

"access your data on all websites" "access your tabs and browsing activity"

NO THANK YOU!

<comment><USER10> Yes that is how extensions work

</comment></comment><comment><USER11> It adds an [http://developer.chrome.com/extensions/webRequest.html#event...](http://developer.chrome.com/extensions/webRequest.html#event- onBeforeRequest) handler that prevents requests to /ajax/messaging/typ.php, /ajax/mercury/mark_seen.php, and /ajax/mercury/change_read_status.php.

Copy-pasta from some YouTube ad block extension.

</comment><comment><USER12> I wouldn't mind it if it actually worked as expected. I often go through the tabs including that of facebook and people think I read the messages but decided not to respond. I also really hate the blink (name) wrote a message on the tab name. Facebook should get its shit together.

<comment><USER12> I just realized that what I wrote sounds like it has been written by a particularly slow-witted toddler. What I was trying to say is that I found very distracting and annoying the whole "Johnny messaged you" blinking thing while I'm reading something. Isn't it obvious that if I wanted to read someone's messages I would be ON Facebook instead of reading another tab?

</comment></comment><comment><USER13> Is the purpose of the "seen" message to encourage people to keep a conversation going (that they would otherwise have abandoned) out of guilt? If someone knows that their friend knows that they have read their message, I think that they are more likely to respond so that they don't seem like a bad friend. I guess the goal would be to get people to stay on the site longer.

<comment><USER14> The purpose of seen is IMHO to make FB messaging more reliable than other service like text msgs or E-Mail.

Obviously there are many people that like to not give responses, including me sometimes. But I guess that shouldn't make you change that behaviour?

<comment><USER15> It's seems very rude and arrogant to the other party in the conversation.

On the other hand when the 'seen' thing wasn't happening the other party could at least think that you just haven't checked the message yet.

</comment></comment></comment><comment><USER16> Curious what exactly includes the "seen" feature? If I have 30 tabs opened in my browser, facebook being one of them, does that mean every message would be marked as "seen" even though I haven't visited that tab for hours? How does it work on mobile? Do push notifications also count in the "seen" since I can see and read the message on the lock screen itself.

<comment><USER3> I believe it means it would never get marked as seen to the user on the other end of the chat. That is, they would never know that you saw the chat text.

I assume it's interrupting or misleading whatever Facebook is using (focus? mouse movement?) to determine whether you've seen the text in the chat box.

</comment></comment><comment><USER17> Why? Does it matter whether or not people can see if you have read their message? I will answer your question when I have time, and if you're on my friends list I guess you should know me well enough to know that.

</comment><comment><USER18> Facebook should implement a setting where you can disable this feature, so others cannot see if you have read their message, but at the same time this info is hidden for you as well.

<comment><AUTHOR> yes, unfortunately the don't care and force you to always reply asap, when you have read the message. otherwise it would be nicebook or fairbook ;)

</comment></comment><comment><USER19> Nice, gonna try it now. I hate that damn thing, and was dismayed when I couldn't disable it in Facebook's settings. Now if only I could do the same for the app.

</comment><comment><USER20> Much more annoying feature is the sidebar, where all my contacts can see my real time activity. Damn I don't like it at all.

</comment><comment> mike-cardwell Anyone know of a Firefox equivalent?

<comment><USER21> It would be nice!

</comment></comment><comment><USER22> Not a Facebook addict , don't mind such small settings.

<comment><USER23> The parent comment isn't relevant to me</comment></comment>


Activision reveals the most realistic animated human - <AUTHOR> http://mashable.com/2013/03/28/activision-uncanny/

<comment><USER2> Why are they releasing this over a week after NVIDIA's announcement of this exact same topic?

[http://www.tbreak.com/news/nvidia-unveils-faceworks-the- most...](http://www.tbreak.com/news/nvidia-unveils-faceworks-the-most- realistic-facial-animation-engine-so-far)

</comment><comment> D-Train Anyone else a little worried that our shooting games are looking more and more like real-life? I mean, for sure it's neat, but it's also somewhat disturbing.

Next, it'll be: upload your hated enemies so you can "shoot" them in COD.</comment>


Show HN: Coffee Grind Size Distribution - <AUTHOR> https://play.google.com/store/apps/details?id=grind.front.end <comment><AUTHOR> Coffee tastes better when all of the grounds you use for brewing have a uniform size. Use this tool to get the size distribution of your grounds and a recommendation for brewing method based on size.</comment>


Ask HN: Programmer/Producer Happiness - <AUTHOR> In what regard is programmer happiness important to you guys ? E.g in my case I drag my feet when I have to do assignments in Java, but I can work with Swift anytime of the day with quickness. <comment><USER2> Stay with Swift, grasshopper I keep dragging my feet with Java all days... May I become happier in a year or two if I get rid of it</comment>


Ask HN: Is it a good idea to comment on US political issues? - <AUTHOR>

I am not a resident of US but I have been planning to move to US for work in some time. My political views on some of the international issues don't align with US.
For example on http://news.ycombinator.com/item?id=4052719 I wanted to comment something that could be marked as anti-US foreign policy. Now I don't have any strict reservations about the intentions of US government; on the other hand it doesn't often mingle well with benefit and security of the country that I belong from. I wrote this huge comment explaining my views and in parts taking a Anti-US policy stand and just before I post it, I realize something of this sort can be marked against me. From what I have known US authorities do a solid background check - and if they have a way to weed you out of the process, they will be very happy to do it.
Are my fears justified? Should a foreign national who wants to enter US as a tourist or as an employee of an US firm take a public stand against US? Does it compromise he/her chances of getting a VISA?
PS: Just to make it clear, even if it does comprise the chances, I see why that stand would be taken. And if I were running a country and had to choose between two candidates: one who absolutely loves my country and the other that doesn't do it with that much completeness - I would have had made such a filtering process. But I want to know if that is the case with US.
Thanks! <comment><USER2> Several of the most esteemed commenters here on Hacker News have advised, when I have brought up the issue of what's on topic here, that posts or comments that are strictly about politics should be ruthlessly discouraged here. There are other places for political discussion (for example, my Facebook profile for my Facebook friends, who have a great diversity of political opinions and live in various countries).

To sum up, we shouldn't be bringing up political topics here on HN, even if the political views expressed agree with my own [smile].

For your specific question about how a foreign resident of a country should behave in regard to that country's politics, I used to do that as an American living abroad--that is, decide how to respond to the policies of another country, which was a dictatorship the first time I lived there and occasionally engaged in political assassination by government agents. I kept my American habit of speaking freely over there. I would never give up that habit of freely speaking my political opinion for anything. Here on HN, I try not to practice that habit out of respect for what is on topic here.</comment>


Someone paid $2.6M in fees to move $134 worth of cryptocurrency - <AUTHOR> https://mashable.com/article/million-cryptocurrency-ethereum-fee-paid-by-mistake/ <comment><USER2> This seems like an easy thing to test for? "Like, are you sure you wanted to pay 19,403x in fees over what you're transferring? Please submit again if yes." Unreal.

<comment><USER3> Where would this test happen? There's no official interface. Sure, it can be (and probably is) implemented in different wallets but if you're interacting with the blockchain directly no-one can prevent you from doing stupid things like this.

<comment><USER4> A smart contract wallet like argent could easily prevent this.

</comment></comment></comment><comment><USER5> Sounds like vanilla money laundering.

<comment><USER6> I am not expert in blockchain but how can you wash money with transaction fees, you can't know where the fee are going, right ?

<comment><USER7> The fee goes to the miner of the block with the transaction in it, the "next block" in a simplified sense.

If you've already mined the next block yourself, you can publish the transaction directly in the block itself instead of loose out to the network like a pleb. Then you'll be effectively guaranteed to get the transaction fee yourself.

<comment><USER8> Can we see if this particular transaction was broadcast to the network?

</comment></comment></comment></comment><comment><USER9> > Ethereum users can dictate the terms of their transactions, setting both the > amount of ETH they want to send and the amount of fees they are willing to > pay. The higher the fee, the thinking goes, the more likely their > transaction will be included on the next block — i.e. it will go through > more quickly. It's possible, therefore, that someone attempted to send $2.6 > million worth of ETH with $134 in fees and simply reversed the two fields.

Having to set up the fee for the transaction to hope the transaction would happen faster? Yeah, I don't see crypto replacing banks.

edit: forgot the quote

</comment><comment><USER10> > Coindesk reported at the time that the South Korean blockchain firm behind > the error admitted to the mistake, contacted the mining pool that had > benefitted, and worked out a deal where the firm got half of the > accidentally sent ETH returned. Notably, that partial happy ending 100 > percent relied on the goodwill of the mining pool, as ETH transactions are > non-reversible by design.

If cryptocurrency use increases it will eventually approach how real currency is used with defacto Know Your Customer and reversibility.

</comment><comment><USER11> It's strange that with major currencies having these high fees, people haven't moved to Nano since their entire premise is around being feeless.

<comment><USER12> the lack of awareness around nano is puzzling to me. I assume its because nano became known around the end of 2017 along with many scam coins, and thus became associated with them.

but today if you described implementing a gossip protocol with nanos features (permissionless decentralization, 0 fees, <1s tx), many people would say it is impossible, but here we are with a 4 year mainnet with no serious issues

</comment></comment><comment><USER13> Who is the fee paid to in this case?

<comment><USER14> In Bitcoin it would be paid to the miner of the individual block where the transaction appears; I assume the same is true for Ethereum. (The miner, as part of the mining process, specifies an address where the network mining reward as well as the fees in the block are deemed to be sent.)

Edit: yes, Ethereum uses the same concept here and there is a field in the block header for the miner's address, which is how the miner gets paid for mining.

Edit 2: In this case a parsed version of the Ethereum block in question, linked to from the article, is at [https://etherscan.io/block/10237208](https://etherscan.io/block/10237208) and shows that the miner was "Spark Pool" (a mining consortium based in China, [https://www.sparkpool.com/en/](https://www.sparkpool.com/en/)).

Mining pools aren't required to identify themselves, but identifying themselves may create goodwill, for example by slightly assuaging fears that one entity secretly controls mining on an entire chain, and might help pools to market themselves to prospective members or investors.

<comment><USER13> Thank you.

</comment></comment></comment><comment><USER15> Given that this was apparently a "switched two fields" error, does anyone want to comment on them apparently intending to spend $134 in transaction fees to move the money?

</comment><comment><USER16> Would the following theoretically work?

1\. Monitor all transactions in the public pool for their fees.

2\. As soon as their is a public transaction in the pool that has over 1M$ in fees, spin up as many cloud resources as possible and mine for the block.

3\. As soon as the block is mined, stop mining and go back to step 1.

<comment><USER14> Yes, but you have to worry about several things, at least:

* what's your latency for noticing and spinning up those resources (especially in chains where the average time between blocks is very short)?

* can you cost-effectively confidently outcompete ASIC miners with rented GPUs, even given a reward that's much larger than normal? (probably, given this very extreme anomaly, but you have to do the calculation)

* can you actually rent enough GPUs in practice to outcompete the ASIC miners?

* will it be worth it to ASIC miners who know or speculate that you're doing this to speculatively mine for a while on a shorter chain in which they receive the reward instead of you, in the hope that they can make it longer than yours?

Edit: Finally, do some of the ASIC miners have offline capacity (e.g. old equipment, or equipment located in places where electricity got more expensive) that is physically present in a datacenter but just powered off that they can _also_ spin up quickly in response to these conditions?

</comment></comment><comment><USER17> Why do you manually enter your own transaction fee at all? Is it not just a percentage of the transaction amount? What happens if you enter too small a fee?

<comment><USER18> I'm not entirely sure if you've used Bitcoin before, but the transaction fee is basically a way to pay a miner to put your transaction into the block they're mining. A higher fee gives miners a higher incentive to add your transaction. But it's generally just a flat value, not tied to the amount being transferred in the transaction - don't think of it as a tip, think of it as paying the miners to take your transaction. Depending on the digital currency you're using, adding too small of a fee may mean your transaction is never added to a block and thus never actually happens.

For Bitcoin in particular I haven't been paying too much attention recently but I do know transaction fees have been getting much higher the past few years, like 5 to 10 dollars or so (Which means you have to pay 5 to 10 dollars to transfer any amount of Bitcoin from one address to another).

<comment><USER17> I have not used it before. I just assumed that - whether a percentage or a flat fee - the amount would be... deterministic at least? That the entity being paid the fee would at least state their price somehow, instead of the user having to just, like, guess what their tribute should be and hope it's accepted. What you describe sounds incredibly bizarre to me.

<comment><USER18> Well keep in mind, your transaction basically just floats out in the void until a miner adds it to their block, so you have no idea who's actually going to add it (if anybody does) because due to how Bitcoin works you have no idea who's going to mine the next block(s). It's also basically another market to a degree - It's not really about how much a miner wants as much as how many transactions there are with a particular fee. The blockchain only supports so many transactions per block, so if you send a transaction with no fee and there's enough transactions with fees to fill every block (like with Bitcoin), your transaction will likely never get picked up because there's no reason for a miner to take it.

That said, I agree I'm not a huge fan of a system, but it makes some sense from the standpoint of how Bitcoin works - miners are paid for their work via new bitcoins created as part of their block. But, Bitcoin itself is designed to be deflationary and eventually the number of new bitcoins per block will go to zero, leaving the fees as the only way miners get paid. And the fees thus aren't deterministic as a way of allowing the amount miners are paid to vary over time.

Still, I don't think it's quite as bad as you're thinking - it's not really hard to figure out what an acceptable fee value is with a quick google, and it doesn't really change that much day to day.

</comment></comment></comment></comment><comment><USER19> Sounds like a developer error with Truffle and gas denominations Wei gwei etc

</comment><comment><USER20> Cryptocurrency won't work as a general use currency as long as this is possible and irreversible. So basically, it won't work.

<comment><USER21> I'm not convinced that is true. Tools can be written to validate amounts carefully.

Wire-fraud is also relatively common and often not reversible but people and businesses still wire money frequently.

Also happens with HFT: [https://www.bbc.com/news/magazine-19214294](https://www.bbc.com/news/magazine-19214294)

<comment><USER22> It is reversible. If you make a mistake like this oftentimes you can rely on law enforcement/bank to force the money to be given back. Not sure if this is possible with crypto.

<comment><USER7> Often it's not reversible in practice, if the destination bank/jurisdiction is not cooperative.

This is why you hear people losing their life savings to scammers in Nigeria, instead of just successfully suing them to get it back.

<comment><USER22> Yeah but usually that's not the case. Usually you can get it back.

I would say more often than not it's reversible.

</comment></comment></comment></comment></comment><comment><USER23> From the article:

> In February of 2019, someone accidentally paid 2,100 ETH in fees to move .1 > ETH. Coindesk reported at the time that the South Korean blockchain firm > behind the error admitted to the mistake, contacted the mining pool that had > benefitted, and worked out a deal where the firm got half of the > accidentally sent ETH returned.

Who wouldn't want to live in a cryptocurrency powered world economy, right? No mistakes allowed, no insurances, so many nice guys like these. What could go wrong?

<comment><USER24> Like cash, these properties are also desired in many cases.</comment></comment>


Show HN: Find hotel with the best pub. transport connection to your destination - <AUTHOR> http://www.hotelroute.org/ <comment><AUTHOR> This is a proof-of-concept we did on the latest hackathon of the Deutsche Bahn (German Railways) - [https://www.mindboxberlin.com/index.php/3rdhackathon.html](https://www.mindboxberlin.com/index.php/3rdhackathon.html).

HotelRoute extends hotel search results of hrs.de and adds information on public transport connection between the found hotels and the travel destination. So that you don't just get the distance in kilometers, but also how much do you have to walk, ride and change to reach you goal with the public transport.

It's just a prototype/proof-of-concept. The backend API searches for the "best" connection betwenn each of the hotel and the travel destination; a Chrome extension adds this information to the hrs.de search results.

We'd be happy to hear, if you think it's useful and should be developed further, beyond proof-of-concept.</comment>


Should we have a national park on the moon? - <AUTHOR> http://www.washingtonpost.com/blogs/innovations/wp/2013/07/10/should-we-have-a-national-park-on-the-moon/?Post+generic=%3Ftid%3Dsm_twitter_washingtonpost

<comment><USER2> I'm pretty sure you (whoever that is) don't have jurisdiction over the Moon, and as such, have no business passing laws concerning it, or establishing national (sic!) whatever there. See also: Outer Space Treaty and whatnot.</comment>


The Crowdsourcing Debate: Egalitarian or Evil? - <AUTHOR> http://thomvest.com/blog.html?fb_15675306_anch=15840255

<comment><USER2> I thought this article was going to be about the controversial theory of crowdsourcing in the wider sense--not just design. With these deceiving headlines, you attract a lot of people like me who rain on your parade and unfortunately, think your article is a snooze.

</comment><comment><USER3> My take on this debate (would love to get a hole or several punched through this reasoning, so please give it your best):

* People being concerned about the prevalence of crowd-sourced or spec work are right to speak loud and clear about their concerns, and campaign against it wherever they get the chance.

* People not sharing those concerns are right to set up or participate in competitions/spec work if they want to, and draw their own conclusions from their experience.

But are there any objective reasoning to apply beyond the subjective concerns? At no-spec.com people campaigning against spec work have had years and years to formulate their reasoning, their FAQ probably lay down the facts best: <http://www.no-spec.com/faq/>

The entire FAQ, although verbose, basically boils down to two assertations:

A. Spec work often gives out false promises about further, "real", employment opportunities once the competition is won.

B. If you give out spec work, you can expect inferior results because proper care will not be spent on research prior to carrying out the work.

There is also the conclusion that as a designer you should always try to retain the rights to the work, but that seems to apply to all projects and not only spec work.

To sum up, the conclusion I draw from the No-spec campaign FAQ is: It is ok to arrange spec work competitions as long as you don't give out false pretentions about the rewards going to the winner, and you find the risk of inferior results acceptable.

Seems reasonable, doesn't it?

</comment><comment><USER4> I actively _hate_ Crowdsourcing of this nature ... but we shouldn't demonize people for asking for something ... especially when lucid adults respond favorably to their requests. This are just good old market forces at work ... and the market is trying to commoditize a product (the service of design).

What needs to happen is, the industry has resist that push.

Figure out how to make sure the people providing services in this industry understand their worth, how the effect of their participation in these competitions cheapens the industry, and heightens the expectations of customers to ridiculous levels (Show me a lawyer that'll participate in a crowdsourcing contest for their services)

I suspect that since that is a much harder task than flaming people who choose to crowdsource logos and website design though, that we'll just have more of the later.

</comment><comment><USER5> Who says being egalitarian and being evil are mutually exclusive?

</comment><comment><USER6> I read this right after another story I found on HN - The Youth Unemployment Bomb: [http://www.businessweek.com/print/magazine/content/07_52/b40...](http://www.businessweek.com/print/magazine/content/07_52/b4064058743638.htm)

It's relevant because one of the methods for reducing unemployment was encouraging entrepreneurship. Considering the small chances of startup success, isn't the relationship between Crowdspring client / designers exactly the same as Venture Capitalist / startup founder? Most of the designs are losers, just like most startups. You could even extend this logic to social media participation - lots of people make YouTube videos, a few get huge and earn a share of the advertising dollars, same with blogging.

When there's an oversupply of skilled labor, you can switch to a contest model instead of an employment or contractor model, driving down the costs even more. This problem affects young, relatively well-educated Westerners, and as the Business Week article points out, this is the root of the current political violence in Egypt. Companies trying to find new ways to grow will demand tax cuts, governments will cut benefits to give it to them because they want to see improved unemployment numbers, and this will further enrage the struggling unemployed. If this trend continues, it's a downward spiral that could bring increased political violence in the West.</comment>