The YouTube Contract for Indies - <AUTHOR> http://www.digitalmusicnews.com/permalink/2014/06/23/fk-heres-entire-youtube-contract-indies <comment><USER2> Transcription from comments on the site.

Key Points

1\. Removes windowing, unless you give youtube offers within reason (but what reason?). (Part 4/3b)

2\. Google forces you to offer them comparable offers.

3\. Parts of the contract are Illegal in many countries.

4\. Prevents future sales through multiple means.

Major Paragraph:

"Catalogue Commitment and Monetization. It is understood that as of the Effective Date and throughout the Term, _Provider's entire catalogue of Provider Sound Recordings and Provider Music Videos (including Provider Music Videos delivered via a third party) will be available for the Premium and Free Services_ for use in connection with each type of Relevant Content, (excluding AudioSwap Recordings, which will be at Provider's option) and set to a default policy of Monetize for both the Premium and Free Services, except as otherwise set forth in this Agreement. Further, _Provider will provide Google with the same Provider Sound Recordings and Provider Music Videos on the same day as it provides such content to any other similarly situated partners._ The foregoing will be subject to reasonable quantity of limited-time exclusive promotional offers (in each case, with a single third party partner) ("Limited Exclusives"), as long as a) Provider provides Google with comparable exclusive promotional offers and b) the quantity and duration of such Limited Exclusives do not frustrate the intent of this Agreement."

Meaning:

YouTube not only forces artists to make their entire catalogs available on its free service however, it also demands that it happens on release day, online AND off-line.

This prevents future sales — i.e. YouTube users can now download all songs for free, which means there's no need for anybody to buy music from iTunes anymore.

Side notes:

3\. Rate Change. To the extent that any major label agrees to any rates for the Google Services that are lower than the rates set forth in Exhibits C or D, including with respect to bundling, Google will have the right to reduce Provider's analogous rates accordingly, following thirty (30) days written notice (via email will be sufficient) to Provider.

Also, check below for some more in-depth links that convert to laymans more.

<comment><USER3> "YouTube users can now download all songs for free, which means there's no need for anybody to buy music from iTunes anymore"

More like: Users can pay for a service that allows them to cache songs for offline playback in their YouTube app. It's not free and it's not like users are downloading the MP3s.

<comment><USER4> It's easy to download any youtube as mp3 - try googling for it, there are multiple services that offer that for free. Anything on Youtube is basically free as mp3.

<comment><USER5> Certainly such services exist, but I don't see the relevance to either the OP or the post you replied directly to.

This is about an official service offered by Google/Youtube.

If there was a news story about a new video streaming service, would you reply "all the movies are already on the Pirate Bay"?

<comment><USER6> That's not the point swombat is trying to make. You can easily rip a Youtube clip into MP3, or just download the video for later playing. I even have an app on my iPhone, McTube, that allows me to do exactly that. YouView on Mac gives you the same option. I used these apps to cache my youtube subscription overnight, as I have unlimited internet after midnight, but otherwise I am limited to 15gigs/mo.

The point is, you can't just as easily rip content from Spotify, Pendora, or any of the other streaming services.

<comment><USER7> I can always play a song and record it. YouTube doesn't even allow downloading in 1080p anymore.

Enough with this idiotic copyright bullshit. If you don't want people to copy your stuff, stop publishing it! We don't need copyright. Why is the law enforcement that I pay for with my tax money working to prevent alice from copying something bob put out in public?

Now if bob took alice's secret documents, and put them out for the world to see I can understand. However, this copyright mess is out of control. Please... Let's put an end to this nonsense.

<comment><USER8> _YouTube doesn 't even allow downloading in 1080p anymore._

Offtopic, but what do you mean YouTube doesn't "allow" downloading in 1080p? If you can watch it in 1080p, you can download it in 1080p.

<comment><USER7> It might be possible, I don't know but it is definitely not convenient.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I hope this doesn't happen. With Google weakly policing illegal content, labels really do have a bad situation here.

They either take the deal Google has given them which is bad, or say no, and risk getting removed from YouTube and having their music uploaded by fans as lower quality streams. In other words, they take less money, or possibly lose everything while paying huge fees to send YouTube take down notices.

This is bad for the consumer in my opinion. I want indie musicians and labels to be able to make more money, not less. This further incentives musicians to look for another path of work.

Its disappointing that while technology is making it easier than ever to record and produce music, its becoming tougher and tougher to make a living off it.

<comment><USER10> "This is bad for the consumer."

I don't see how that follows, except for the terrible logic of less profit for the musician is automatically bad for the consumer because people will just stop making music if they can't get rich off it. It looks like they're fighting back against exclusives and bullshit restrictions like "you can stream the first 5 songs, but if you want more you have to buy the album for $14.99", just the sort of thing everybody was complaining about two weeks ago when amazon launched their streaming service.

I understand that musicians like money. I can empathize with that, i like money too. But trying to frame it as good for the consumer is silly.

<comment><USER11> Most indie musicians can scarcely eek out a middle class lifestyle. Only a lucky few ever get rich off it.

<comment><USER12> most indie musicians are WELL below middle class.

<comment><USER13> No that's not true.

<comment><USER12> well given that most indie musicians have jobs that allow them to support their music career, then I guess you are right.

but among professional full-time music only indie musicians - the majority are below middle class. they do not own a home, they have debt.

a minority have achieved enough success to live a normal middle class lifestyle.

</comment></comment></comment></comment></comment></comment><comment><USER14> The music industry is changing so fast. I feel sorry for the industry, despite their bad karma.

Illegal digital downloads disrupted everything, and cut profits substantially. Luckily, Apple and Steve Jobs showed up and offered a brief reprieve. But now, just a 10 years into paid digital downloads, when the new revenue is still a tiny fraction of the old revenue, the field is disrupted again by streaming. And as with previous disruptions, it appears revenue will again be cut dramatically.

I'm not sure what the takeaway is. Maybe the importance of owning your distribution channels?

<comment><USER15> > I'm not sure what the takeaway is. Maybe the importance of owning your > distribution channels?

Supply of all types of media content is way up. There are only so many hours in the day, so demand is comparatively inelastic. This means per-unit cost has to go way down.

This is the general trend for pretty much all media, including things normally categorized as something else, like news and stage productions.

On the plus side, distribution is basically free and gatekeepers are losing their monopolies and monopsonies, so creators and consumers of niche products can connect better than ever.

<comment><USER16> Connecting with more people is only as good as your ability to monetize those connections, though.

<comment><USER15> Unless you're a twelve-year-old showing off your Minecraft mods or your new styling tips. Then you're getting non-monetary value (friends, fun, reputation) from creating content, and you're unintentionally competing for the attention of kids and tweens that used to buy comic books and Backstreet Boys albums.

<comment><USER16> You said 'creators and consumers of niche products' which implies commercial intent to me, and we are having this discussion in the context of music publishing. You're not wrong, but I think this is a loss of focus.

<comment><USER17> Hardly. Commercial content has been challenged and displaced by non- commercial, purely cultural content like never before. Young people would rather see a goofy image macro that their friend made than some lame sitcom by old white guys in Hollywood. For the first time ever, this non-commercial content lives side by side with commercial content on massively popular portal sites like Faceebook, reddit, and YouTube.

<comment><USER16> That's not the point. This is a thread about a particular set of contract provisions YouTube is apparently offering to publishers, not a general shift in consumption patterns.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Could someone with better legal knowledge and familiarity with licensing help me make sense of how I should react to this?

</comment><comment><USER19> I guess this is exactly the kind of case where you'd have a chance to see whether RapGenius is actually useful?

</comment><comment><USER20> I'm actually happy about this. It will boost YouTube competition, which is sorely needed.

Indie music may not show up on Google's metrics as being all that important, but it's a gateway drug of sorts. The internal data analysis is probably missing that.

Some other video site will pick this up (Vimeo is so primed for it) and pick up a lot of viewers in the process.

<comment><USER16> There's no guarantee of that. Several other sites may offer more favorable terms, but if they don't have a fraction of the viewers that YouTube has then those terms will still be worth less than a shitty deal with YouTube. The laws of supply and demand are obvious under perfect competition, but network effects massively change that calculus.

<comment><USER20> Of course there's no guarantee.

But there's also no guarantee YouTube will retain its viewers.

The viewers are _only_ there for the content, not for YouTube.

If YouTube doesn't have the content, it won't have the viewers.

This is a market segment that can shift much more quickly than people (including Google, apparently) imagine.

Content is still, and will always be, king.

<comment><USER16> You underestimate the advantages of incumbency. YouTube is arguably the lowest common denominator in terms of quality (eg most Filmmakers prefer Vimeo because it gives more control over quality levels), but that hasn't stopped it being #1 by a mile. Getting a critical mass of people to shift to another platform is pretty hard.

</comment></comment></comment></comment><comment><USER21> Independent artists need to stop being independent and form up into groups that collectively have a large audience and then higher a lawyer to represent them, its the only smaller bands can have any leverage with streaming services. This is arguably the only reason for "record labels" to still exist.

</comment><comment><USER22> The big problem that the artists are having is the fact that YouTube basically is aggregating illegal content.

So, even if you want to start your own service, you are competing against the illegal copies on YouTube.

What's worse is that, technically, I'm not even sure how you do anything about this.

You could remove YouTube's safe harbor (which, to be fair, they really shouldn't have since they are monetizing the content), but I still don't see how YouTube would then police this.

</comment><comment><USER23> What's going to happen to all those existing videos which currently generate views? Discovery is important; personally I have stumbled into quite a few videos with a fair amount of "views" which led me to follow a band. If they take those those down according to this new contract, I can see why the smaller labels may be disadvantaged since they won't have the money to promote their videos.

<comment><USER24> Isn't this just about monetizing the videos? So they could still have videos there for promotion, but they won't get money (without directing the viewer to wherever they are selling their music at).

</comment></comment><comment><USER25> For anyone wondering what's all this about - check out the comments at the bottom of that page.

<comment><USER26> The comments explain nothing.

<comment><USER25> They give an idea of what's all that about without reading dozens of pages.

<comment><USER27> It appears to be a bunch of industry people who think that Google doesn't enforce the DMCA well enough...

<comment><USER28> There were only a couple of people discussing that, and only a handful of comments. Most of the discussion seemed to be about how terrible the terms were and whether there were any alternatives to YouTube.

</comment></comment></comment></comment></comment><comment> good-citizen can someone explain? is this secret?

<comment><USER29> This contract is probably behind an NDA and releasing it may also break other confidentiality agreements already in existence.

The summary is that these terms are very unfavorable according to the indie artists and the companies they are affiliated with. They feel they are being strong-armed by Google and that Google is showing a strong preference toward large media companies and making it very difficult for future indie artists to become successful with this agreement.

<comment> good-citizen if the author is reading this, please follow up here and let us know what happens to you from a legal perspective for having violated the NDA.

</comment></comment></comment><comment><USER30> Has someone OCR'd this or made it searchable

<comment><USER19> If you install Naptha ([https://chrome.google.com/webstore/detail/project- naptha/mol...](https://chrome.google.com/webstore/detail/project- naptha/molncoemjfmpgdkbdlbjmhlcgniigdnf)), there's an experimental search feature for images you can use.

</comment></comment><comment><USER31> kinda reminds me of [http://opendotdotdot.blogspot.com/2011/04/why-google- should-...](http://opendotdotdot.blogspot.com/2011/04/why-google-should-buy- music-industry.html)

</comment><comment><USER32> Is it time to break up tech monopolies? I think the writing is on the wall.

</comment><comment><USER33> Can't Hulu or even Netflix offer labels a better deal?

</comment><comment><USER34> All the more reasons for Baboom?

</comment><comment><USER35> A sane take on things, discusses some of the sticking details: [https://www.techdirt.com/articles/20140623/17084727661/more-...](https://www.techdirt.com/articles/20140623/17084727661/more- indie-labels-youtube-confusion-reigns.shtml)

It's worth noting that this is a negation process. This is Google's proposal and the labels aren't even willing to negotiate: [http://www.theguardian.com/technology/2014/jun/24/youtube- mu...](http://www.theguardian.com/technology/2014/jun/24/youtube-music- contract-indie-labels)

Also the fact that someone leaked this is most likely part of the negotiations.

<comment><USER36> Yes it would be like getting a sane take on copyright policy from TorrentFreak.com

The labels and Google were negotiating, the whole reason it went public was their shitty terms compared to major labels. No one said there wasn't negotiations taking place.

</comment></comment><comment><USER37> This is disgusting

<comment><USER38> Can you enlighten us what is so disgusting about this in your opinion, this seems to be a straight forward agreement to use the content provided to Google. Not worse than any other EULA I've read.

<comment><USER39> Not so, say those in the know: [http://www.theregister.co.uk/2014/06/24/notice_and_shakedown...](http://www.theregister.co.uk/2014/06/24/notice_and_shakedown_google_mafiastyle_contract_for_indie_music_revealed/)

<comment><USER40> If you want people to take you seriously, never cite The Register.

<comment><USER41> And in particular, citing them as "in the know" (as hilarious as it may be to do so).</comment></comment></comment></comment></comment>


From Callback to (Future – Functor – Monad) - <AUTHOR> http://tech.pro/blog/6742/callback-to-future-functor-applicative-monad

<comment><USER2> Very interesting article. Minor nit (just a typo I think): in the definition of flatMapError, shouldn't mapError be fmapError?</comment>


Lucky trig identity  - <AUTHOR> http://www.johndcook.com/blog/2011/11/09/lucky-trig-identity/ <comment><USER2> As someone pointed out in the comments, this identity is analogous to reducing 16/64 to 1/4 by cancelling out the 6's.</comment>


AMA with Max Schrems, who had the CJEU invalidate the Safe Harbor agreement - marten-de-vries https://www.reddit.com/r/europe/comments/7kklk6/i_am_max_schrems_a_privacy_activist_and_founder/ <comment> marten-de-vries Full title: "I am Max Schrems, a privacy activist and founder of noyb.eu - European Center for Digital Rights. I successfully campaigned to stop Facebook's violations of EU privacy laws and had the EU Court of Justice invalidate the Safe Harbor agreement between the EU and the US. AMA!"

The AMA is currently ongoing.</comment>


Encouragement in education - <AUTHOR> http://www.shenglong.ca/encouragement

<comment><USER2> This effect has been researched. Basically, praise for intelligence results in students getting discouraged when they fail, whereas praise for effort results in students trying harder (and ultimately doing better, by some measure of "better").

A quick search of Google yields this paper, which you can probably get through the library at Western:

Praise for intelligence can undermine children's motivation and performance. Mueller, Claudia M.; Dweck, Carol S. Journal of Personality and Social Psychology, Vol 75(1), Jul 1998, 33-52. doi: 10.1037/0022-35126.96.36.199

(Disclaimer: I have only read sensationalized news reports and second-hand accounts from others on the paper; I have not actually read the paper myself yet.)</comment>


10 controversial programming opinions? - <AUTHOR> http://www.pixelstech.net/article/index.php?id=1336838538

<comment><USER2> Alright, lets do this.

1) The only "best practice" you should be using all the time is "Use Your Brain". If working on individual projects, sure. The problem is that best practices are an opinionated collection of tradeoffs. There are often other alternatives that may be better tradeoffs to work with for the situation. Most of the time, these tradeoffs involve coding style rather than any real functionality changes. At that point, whichever you advocate - either your own thought, or a "best practice" is going to cause disagreements among people. The "best practice" then, is a good option simply because you have a lot of public support behind it for whatever reason, so hopefully the people who disagree with that particular practice will be convinced to work with it. Counter-arguments?

</comment><comment><USER3> I'm sorry if this is a stupid question... but what's wrong with "googling it"? I can see the flipside to most of the points made, but I don't understand this one.

<comment><USER4> As much as I don't like google, I must say that I find google to be a programmers best friend (you google for it and find the stackoverflow questions you were looking for. SO's search is much inferior to Google's IMO and I can never make it work)

<comment><USER3> Yea I mean, I feel like when people say "google it", they're conveying that you should search the internet/research about it, not necessarily use Google for it.

</comment></comment></comment><comment><USER5> XML is highly overrated

I don't think XML is overrated but certainly overused and misused.

<comment><USER6> Misused is key... The idea of a self-describing data set is pretty cool, and could have a good use if you had to dump a data-set to be consumed by some external 3rd party without any other documentation... (when has that ever happened)

What maddens me is when people use XML to communicate with themselves. It is the biggest waste of bandwidth and processing power, when there are much simpler formats.

Many years ago I took the XAjax library for PHP and re-wrote it without XML.. Using 2 simple delimiters instead, the code was 80% smaller.

</comment></comment><comment><USER7> "8)Your job is to put yourself out of work." is just another way of saying that laziness is one of the programmers virtues.

</comment><comment><USER8> Couldn't help noticing this article was right next to "Is it time to stop writing headlines that end in question marks?"

<http://news.ycombinator.com/item?id=3963685></comment>


German university issues 38k passwords by hand after malware infection - <AUTHOR> https://www.zdnet.com/article/more-than-38000-people-will-stand-in-line-this-week-to-get-a-new-password/ <comment><USER2> Honestly, I think this is pretty smart.

If someone has compromised your electronic systems, they can probably solve whatever electronic recovery means you've implemented, and they can probably do so on a large scale, re-compromising all the new accounts.

Adding an in-person step makes things harder for the attackers in two ways:

1: It relies on existing ID cards, which presumably the attackers can't telekinetically change while they sit in people's pockets or something.

2: It's hard to attack at scale. Conceivably someone could make a fake ID and pose as a staff member or something, but the same person wouldn't get away with that more than a few times before someone in the office noticed that they looked familiar. And it's slow -- humans work at a finite speed, so brute- forcing 38,000 visits to an office isn't as practical as spawning a bunch of threads to attack login sessions or something.

I think despite the inconvenience, this is a sane way to respond to a compromise, if your users are local and can visit an office to pull it off.

At a major automaker who I won't name, they have an interesting way of handling password resets: They generate a new random password for you, and send half of it by SMS to the mobile phone in your employee record. Then they email the other half to your manager. Managers have instructions that when an employee calls to retrieve this (or if the manager has a moment to call the employee first), they should spend a moment in conversation first, really make sure they recognize the employee's voice and stuff, and if there's any doubt, ask them to meet at the personnel building badging office, where the administrative folk can check IDs and stuff. It works pretty well -- it would be _very_ hard to attack this system, especially at scale.

<comment><USER3> > It's hard to attack at scale. Conceivably someone could make a fake ID

The "make a fake ID" step by itself is already hard. The identity card is not just a piece of paper. Take a look at [https://en.wikipedia.org/wiki/German_identity_card#Security_...](https://en.wikipedia.org/wiki/German_identity_card#Security_features) to see how many anti-counterfeiting features it has.

<comment><USER4> Nearly every feature in that list, save for maybe security strands, is commoditized and mass-produced in the USA's fake ID market. It would be kind of silly to exploit here, though.

<comment><USER5> I guess Germany's liberal drinking laws make for a much smaller fake ID market. You could still pull it off, especially since most people aren't really trained for spotting fake IDs. But a German fake ID is not exactly something you buy for $10 each at the drug dealer on the corner.

<comment><USER6> Especially considering it has cryptographically secured biometrics (iirc facial features and a subset of fingerprints) that can be accessed with credentials printed on the back. If they were to make use of that, any forgery would be be beyond the regular fake id market.

The German Personalausweis is basically a stateless ID-1 passport.

<comment><USER7> > The German Personalausweis is basically a stateless ID-1 passport.

And as property it belongs to the state, not the citizen. You are required and expected to have it on you at all times. You are also required to report it missing.

When I moved to the US, I was baffled that IDs are basically just driving licenses and you only have them if you... well have a driving license.

I guess it's about where you draw the line in the end. I understand that many US Americans feel threatened by the federal government as it is perceived autocratic to be forced to carry a government issued identification card at all times.

For me, it just guarantees that it is harder for someone else to walk around and impersonate me with some shitty fake ID.

<comment><USER8> > You are required and expected to have it on you at all times.

I'd be very surprised about that. That's a law most of formerly communist Europe has cancelled immediately after the revolutions

<comment><USER9> Prepare to be surprised then as optional IDs are pretty much only a thing western countries.

[https://en.wikipedia.org/wiki/List_of_national_identity_card...](https://en.wikipedia.org/wiki/List_of_national_identity_card_policies_by_country)

[https://en.wikipedia.org/wiki/National_identity_cards_in_the...](https://en.wikipedia.org/wiki/National_identity_cards_in_the_European_Economic_Area#Overview_of_national_identity_cards)

<comment><USER10> Bad reference. Again Germany: it's colored red, but the table clearly states that you don't need to carry it.

Which is the statement you tried to counter with your link.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> "As an added precaution, the university computing center decided to issue new passwords for all 38,000 JLU email accounts. However, the university was unable to do this online because of a quirk of German law, whereby the German National Research and Education Network (DFN) requires, in this case, JLU students and staff to obtain their new passwords in person from the university's IT staff, using as ID card to prove their identity."

<comment><USER12> I'm curious to know what law this is and why other organizations in Germany do not have to resort to a similar tactic to reset passwords.

<comment><USER5> I think this might be a misquote. DNF is a registered association/charity which is providing network services for universities and research facilities (originally German, but spreading across Europe and beyond). They are the ISP of most German Universities, and more relevant to the topic they operate Eduroam, a wifi where any student or staff member can access their internet using their login credentials (username/password login via WPA 2 Enterprise). It's really handy because even if you are at another university you can still access the wifi, and any misuse (==people getting sued for torrenting) is easy to track.

As such it stands to reason that they set rules for how credentials used to authenticate to their wifi are handled. And basically always those are the credentials for your university account.

tl;dr: almost certainly not a law, but rules most Universities have to abide to if they want to keep their ISP and wifi.

<comment><USER13> So basically the equivalent of requiring ID for getting a phone SIM, thanks for the clarification.

Did not make much sense otherwise for just email or even for active user accounts (as in unix logins), because if you have tens of thousands of them your security model surely cannot rely on the assumption that none of them are bad actors.

"Just like a phone SIM" is also where it definitely enters the realm of legal requirements. Certainly debatable, but there can't be much precedent and then it's the usual struggle between a perhaps careless group appealing to common sense and a maximum correctness camp that wants to go by the book, in its most pessimistic interpretation. When under a malware attack like that, even the slightest trace of neglect on the technical side can punish you hard. It's no surprise that the required mindset of extreme prudence carries over to the legal side. I still don't believe that the ID check would be the only correct way to handle this (e.g. snail mail still goes a long way in terms of checking legal boxes), but they surely are not in the mood for taking risks right now.

</comment></comment></comment></comment><comment><USER14> So they're just running some av software from a live system on all systems and call it a day.... Dec 8th has been a while and there's no information around which malware this actually was. If it's really a targeted attack with some previously unknown malware, I wouldn't really feel like that's sufficient.

Most companies have policies that require a full reinstall of infected systems or even just go ahead and replace the physical machine.

<comment><USER15> Most companies you know... For IT systems it is quite easy if you have money required. For OT-operational technology, I just got to know they keep infected machines running, they wall those off. Because you cannot just replace physical machine that is running some complicated chemical process just like that. Some factories also do not have money to replace some Win XP or they cannot replace Win XP because all the drivers for specific hardware are not working on new stuff. Life time of systems in OT is 20 years not like IT 5 years.

</comment></comment><comment><USER16> I'm a student at that university, though I don't have any contacts to the IT department or other sources of inside information.

I went to collect my new password already. The process was pretty smooth with only a little confusion where the queue split up alphabetically (not quite enough room, although it took place in a large gym; I guess they rightly prioritized giving the people behind the desks enough room to work).

It's interesting to see which systems of the university are more or less robust to the network blackout. Email is down, which has the nice side effect that people who would otherwise only communicate in written form now make calls or physical visits (as they cannot look up phone numbers on the web) to each others' offices. The library catalogue is not working, though apparently they successfully switched to a paper-based system for lending books after a few days (haven't tried it yet). The electronic payment system of the canteens appears completely unaffected. (I read on a sign recently that it is considered "obsolete" and subject to renewal – good thing they hadn't done that yet, I guess). The web platform with reading material for seminars is down. In some cases seminar presentations have to be given without slideshow projection because the designated presentation laptop got a red sticker. I don't now how labs with data on the central servers are doing (I'm in the humanities).

</comment><comment><USER17> I thought that this is always the case. At METU when you register to the university they give you password by hand (printed inside of a letter). In case your account is compromised they block your account and you have to go to the computer center so that they give you a new password. There is no "I forgot my password" button. It is like this for at least from early 2000s. Probably from 1990s.

<comment><USER18> Somehow with my german bank account I undergo through the same process. If I happen to fail the online banking password 3 times, I must go in person to the bank to unlock my account.

</comment></comment><comment><USER19> typically, better security practices tend to lead to more discomfort for users

<comment><USER20> That's not entirely true. Adding too much discomfort to users reduces security by encouraging people to workaround or otherwise undermine the system. Many of the best security practices ideally make doing the secure thing easy.

When this is not possible you have to try to at least limit the discomfort caused and make it resistant to subversion by even trusted individuals.

</comment></comment><comment><USER21> Does anyone know whether password+key is a supported WebAuthn use case? I don't mean whether the standard supports it (it does), but whether it's planned. I would love to use my Yubikey + PIN to log in to sites passwordlessly, but it seems that so far the only thing that anyone uses WebAuthn for is as a second factor.

<comment><USER22> [https://www.passwordless.dev/usernameless](https://www.passwordless.dev/usernameless) lets you try this flow out but I'd be surprised to see any significant adoption for the Web generally unless FIDO itself takes off first, because FIDO2 capable devices are more expensive. I can't justify telling people to pay extra when the core feature is not yet widely used.

<comment><USER21> Thanks, that's very useful! I've been trying for ages to get my Yubikey to ask me for my PIN that I've set on it when authenticating, to no avail. It doesn't seem reasonable to have a site authenticate me with no PIN, since someone could just steal my yubikey and log in as me everywhere. Would anyone happen to know how I can force asking for a PIN?

<comment><USER22> The flow you're asking for (PIN required to do ordinary FIDO not just for FIDO2 passwordless auth) seems like a weird choice and I doubt it's possible.

This hypothetical person has to get your password from somewhere. The mode most (essentially all non-test sites I've seen) used has FIDO only as second factor, so the bad guy needs your first factor (invariably a password) as well as the stolen Yubikey.

You're asking for a three factor system, with two factors you know, plus a final factor you have. The improvement in threat resistance is small and the added inconvenience is large.

<comment><USER21> Oh no, sorry. I'm asking for FIDO2 passwordless. Right now I can do that (e.g. at [https://www.passwordless.dev/passwordless](https://www.passwordless.dev/passwordless)), but the Yubikey doesn't ask for a PIN, which is insecure, since anyone stealing it can auth as me. I simply want passwordless auth to ask for my PIN.

EDIT: It turns out Chrome does ask for the PIN (Firefox doesn't), but only when registering (not when logging in). This raises the question, why can the browser log me in without a PIN? Then the thief can simply use one of those browsers.

<comment><USER22> The site you're looking at offers a variety of different WebAuthn flows. I linked the one that behaves how you described, requiring a PIN (and yes it requires the PIN to log in) but now you've found and linked a different flow that doesn't require PINs and sure enough it doesn't require PINs.

I guess you could say the site is badly labelled. The true FIDO2 flow that I linked you to above is labelled usernameless rather than passwordless.

The flow they've called passwordless works with an ordinary FIDO key it doesn't need FIDO2. Because it simply doesn't have a password. Passwordless. Simple.

<comment><USER21> Trying it on Chrome, it works as you say. On Firefox it just failed to auth, I assumed it was because my Yubikey lacked onboard storage for storing the user details but it looks like it's because of the lack of PIN support. Thanks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> Been in a similar password reset situation at a university and it's pain!

I hope they implement 2fa two factor authentication since that will stop between 70-99% of password attacks.

<comment> m-p-3 If the malware managed to compromise the authentication server, including the shared secret (ex: Google Authenticator) tied to each account that will not help much.

<comment><USER24> That's why you should use a HSM for that.

</comment></comment></comment><comment><USER25> Thing is as far as I can Google they have not identified how the network got compromised in the first place?

So they are issuing bootable USB sticks for scanning computers and manually providing new email (I guess University account) passwords, but how would that prevent the same thing happening again in the same unpatched way next week?

</comment><comment><USER26> Is there any more detail on this "quirk of German law" really is?

<comment><USER27> I think it is just policy of the German Research Network (DFN) for accounts. These accounts are valid Europe-wide for WLAN access in educational institutions for example.

<comment><USER26> That's kinda how it reads.

I didn't think of that as "law" and that is what sort of piqued my interest, that there would be a law about this specifically.

</comment></comment></comment><comment><USER28> You can't hack pen and paper :) - I don't hate it.

</comment><comment><USER29> Why no simply reset the passwords and enforce 2FA?

<comment><USER30> It would violate a (stupid) law.

<comment><USER31> no, it has nothing to do with a "stupid" law, it seems to me the article is misleading. It has to do with being a trusted source of identity information and fscking up very thoroughly:

The university of Giessen is providing it's members identity services for the DFN Network (German Research Network) with a high degree of reliance called _advanced_.

This degree requires that "for identification, users must present themselves in person with an official ID. The enrolment and recruitment procedures established by the universities are considered as equivalent." ( see [https://doku.tid.dfn.de/en:degrees_of_reliance](https://doku.tid.dfn.de/en:degrees_of_reliance) )

It seems to me that this university's services are a very interesting target.

<comment><USER32> The university website mentions student ID cards with chip. Is that not sufficient to provide strong authentication towards a self-service portal for password reset?

<comment><USER33> > The university website mentions student ID cards with chip. Is that not > sufficient to provide strong authentication towards a self-service portal > for password reset?

In theory it should be sufficient. In practice there is very little awareness of the capabilities of these smartcards and that they could, in theory, be used as a 2FA token. These cards are mostly used for physical access control, library pass and cafeteria payment.

There's left a lot to be desired in most (german) university networks. Yes, there is usually some sort of Radius and 801.1X infrastructure in place, but it's only used for WiFi login and eduroam, not for machines plugged into wall sockets. Yes, there usually is some sort of Active Directory and/or Kerberos infrastructure in place (yes, I am aware that AD is essentially LDAP + Kerberos), but it's often used only for the student computer pools, but not office workstations.

There seems to be zero awareness, that if you have AD and/or Kerberos authentication working in place (one can only dream of it being coupled to the student / staff smartcards), you can use it GSSAPI for web single sign-on which would instantly neuter any attempts of phishing.

Also you will still often find the preconception of there being such a thing as a "secure network" and an "insecure, hostile" internet. The notion of lateral movement and treating _every_ network segment as insecure, no matter where or how it's managed in your org, is more or less nonexisting.

<comment><USER34> > There's left a lot to be desired in most (german) university networks. Yes, > there is usually some sort of Radius and 801.1X infrastructure in place, but > it's only used for WiFi login and eduroam, not for machines plugged into > wall sockets.

When I was a student and later staff member at the Technical University of Kaiserslautern, Eduroam authentication infrastructure (801.1X) was also used to authenticate at ethernet ports in the walls of public rooms.</comment></comment></comment></comment></comment></comment>


Rails - Django Comparison - <AUTHOR> http://www.scribd.com/doc/121814/RailsDjango-Comparison

<comment><USER2> On the one hand, you really miss the talk that these slides were attached to. Browsing the slides by themselves is kind of tedious and lame.

But the split-screen format really drives home the message that Rails and Django -- apart from a few minor differences that will probably converge over time -- are _the same thing_ , implemented in different languages. There's just not a lot in there to hang a flame war on. Emacs vs vi, this isn't.

</comment><comment><USER3> Slide 68 indicates latest Rails version is 1.1.6. The document was uploaded on 19 June (I'm guessing 2007). Is this really relevant now?

I will tack on that the framework will not make or break your idea. The advantage of one framework over another should be weighed in how long it takes your team to go to market; this translates into asking your development team (or yourself) what they (or you) can handle in the coming months in anticipation of the project taking off. Also your code should be done in such a way that you can ditch whatever framework you currently use for something better suited for what your future requirements might be.

I will add that I believe TurboGears to be the better platform all around, but am sticking to Rails because:

1) I like Ruby/Rails

2) I don't have the time/energy to dive into Python/TurboGears

3) I can implement something by myself confidently in Rails RIGHT NOW, as opposed to a few months down the road after getting comfy with Python (while at the same time maintaining my day job and OTHER life responsibilities)

</comment><comment><USER4> I went with Django because I could read its codebase, but found the Rails codebase too cryptic. Rails magic, epitomized by the pluralization rules, was also a turnoff - the prospect of debugging in that world seemed scary.

The case for Django is the clean, modular architecture, making it possible to split a project into reusable applications. With Rails DHH took a strong anti- component stance, deciding that it was better to make everything easy to reimplement. As a result, even common things like the registration gem have too many integration points. This decision will matter in the long run.

Django has access to all the mature Python libraries, but its ORM is limited. Pythonic model specification and automatic model validation against the SQL metadata is great for the DRY philosophy; but there is no migration metaphor (yet), there's no table inheritance metaphor (yet), and even pessimistic locking requires a hack (so far). The best hope is an effort under way to make the Django ORM a wrapper for the infinitely more powerful SqlAlchemy, which some people use on top of Django anyway, foregoing its data-related tools including Admin.

And of course Rails is integrated with every concievable Ajax technology, allowing a hundred ways to implement the <blink> tag.

The Rails community is growing from an influx of ex-PHP scripters, bringing with them less disciplined coding styles, which the more Perl-like overly- concise features of Ruby encourage. The RoR environment is going to be the new Perl - a powerful tool for certain applications, applied far more broadly than intended, with a CPAN full of one-off solutions for every concievable problem, but no culture of solidly engineered modules.

</comment><comment><USER5> I wrote my app in Python/Django. My reasons were short:

1\. I wanted to learn python, but was not really interested in ruby 2\. Rails is too hyped. The problem here is that people pigeonhole you when they hear that you are a rails developer. If someone ever came to me and told me he was a rails developer, I would immediately perceive this guy as someone who jumps on technology bandwagons. The type of guy who listens to top40 charts. 3\. Django just had a way better argument when it came to performance

and the most important reason of all

4\. When I created a new Django project, it just created 3 files. Rails (when I tried it) created a bunch of folders and files. People have to understand simplicity in all its facets to be effective programmers, in my opinion!

</comment><comment><USER6> My question would be why did rails' models take so long to do compared to django. The examples they gave the rails were shorter (granted neither were complex) I'm going to assume that they have the same number of models (5ish) so it can't be that.

</comment><comment><AUTHOR> I especially liked the fact that they did not seem to have any bias going in or coming out. And, they actually built the same site using both frameworks and took notes along the way - all in all, very commendable.

</comment><comment><USER7> They're comparable enough that the individual programmer matters much more.

I say pick one, learn it as well as you can, don't worry that you picked "the wrong framework", and go with it.

</comment><comment><USER8> Slightly unfair comparison when it comes to admin pages. When it comes time to modify the Django admin pages to do something the framework doesn't supply, I bet the graph gets a bit more even, if not in the favor of Rails.

This is true of any framework: the second that you go outside the bounds of what it was designed to do, you are going to spend lots of time bending it to your will.

<comment><USER9> Indeed. You can probably infer this is the case when they show the graph with the admin component removed.

</comment></comment><comment><USER10> When Rails and Django compete... we win!

</comment><comment><USER11> What's the _original_ format of this presentation? Why can't I just save it as a PDF or view as HTML?

</comment><comment><USER12> Good to see some actual experiments with the different frameworks, not just expert thoughts.</comment>


Get.docker.com: invalid certificate? - <AUTHOR> Seems like https://get.docker.com doesn't have a certificate anymore for some reason:<p>openssl s_client -connect get.docker.com:443 -showcerts </dev/null <comment><USER2> The certificate expired a few hours ago.</comment>


What does this code do? - <AUTHOR> http://www.johndcook.com/blog/2010/07/21/what-does-this-code-do/ <comment><USER2> I don't think the answer to this questions is "comment your code", it's "give your functions meaning full names".

Commenting is great, but you need to know how the program is put using meaningful function and method names not only when they are declared, but also when they are called/passed.

I use comments when I've taken a non-obvious path with the code, and I explain why in comments. I think that is what comments are for.

<comment><USER3> Meaningful function names are a good start. But they can only answer "what" and not "why."</comment></comment>


Today is special day if you like marijuana and odd radixes - <AUTHOR> A little lighthearted Friday javascript for you:<p>new Date("2016-08-05T23:42:11.177Z").getTime().toString(36) <comment><USER2> I don't get the ref

</comment><comment><USER3> "iriebrah"?

<comment><USER4> I believe it's supposed to be "Irie, brah", where irie is a Jamaican word closely associated with the Rastafarian movement that basically means "cool", and "brah" is a permutation of "bro".

[https://en.wikipedia.org/wiki/Irie](https://en.wikipedia.org/wiki/Irie)

[http://www.languagejones.com/blog-1/2015/9/11/bruh-breh- brah...](http://www.languagejones.com/blog-1/2015/9/11/bruh-breh-brah-bro)</comment></comment>