Exceptional failure: breaking the STM32F1 read-out protection - <AUTHOR> https://blog.zapb.de/stm32f1-exceptional-failure/ <comment><USER2> IMHO unlike the tone of the article, this is cause for celebration, like every other time DRM is broken. Now all the proprietary firmware in those otherwise useless/insecure IoT devices etc. can be more easily reverse-engineered and replaced, possibly driving more hardware reuse and reducing e-waste.

[http://www.gnu.org/philosophy/right-to- read.en.html](http://www.gnu.org/philosophy/right-to-read.en.html)

<comment><USER3> DRM can be used for good as well as bad; it is about control. Most DRM is used for corporations to control you. But you can use things like this readout protection and Restricted ("Secure") Boot to get control over your own devices. If the BIOS lets you use your own keys (many do), Restricted Boot prevents attackers from booting unauthorized software on your computer. Similarly readout protection just hides the code on the device; this is useful for anyone who wants added security (security through obscurity is not perfect but it is always helpful).

In that regard this news is bad since it means a security tool has been broken. But it is good in that the security tool was very often used by evildoers.

Of course both of these examples rely on you trusting the bios & rdp implementation - ideally they would be open source.

<comment><USER4> > Similarly readout protection just hides the code on the device; this is > useful for anyone who wants added security (security through obscurity is > not perfect but it is always helpful).

Trying to hide your code is a stupid thing to do. Trying to hide cryptographic keys is more useful (though still often only used for DRM applications) but preventing people from dumping your firmware is misguided.

<comment><USER5> > Trying to hide your code is a stupid thing to do

That's not what I hear from reputable reverse engineers, at least for IoT devices.

Even though security by obscurity should be frowned upon, and being understood that hiding code might give a false sense of security, most RE workflows assume availability of firmware, and it is a giant pain to start breaking platforms where the unknown firmware must be manually extracted first, especially the boot loader.

<comment><USER6> I agree.

I've said before on this site, obscurity is a totally valid tactic to impose additional costs on attackers. It's best to think of it more as a preemptive strike than a defensive layer. Thinking of it as a defensive layer can lead to complacency, but thinking of it as an opening gambit is totally fine.

One shouldn't be obsequious to heuristics like "never use security through obscurity," one should understand the systems they're building and make considered choices.

Additionally, preventing people from dumping your firmware is usually not about security as much as it is preventing some fly-by-night company from reversing your product & selling it as their own. Why engineer a product when you can steal someone else's IP?

<comment><USER7> > obscurity is a totally valid tactic to impose additional costs on attackers

But there's the rub: you'll only impose additional costs to the least sophisticated/determined adversaries. While that works to keep random scriptkiddies/scans out, I'd argue it has little to no effect if you require serious security guarantees.

<comment><USER6> It imposes costs on all attackers. The value of that cost is skill dependent, but no one has unlimited time on their hands. In other contexts, like hiding an admin login page, shutting out low skill attackers means your log files have better signal to noise, and you can focus more resources on the more significant threats.

The reason I say to think of it as a preemptive strike rather than a defense is that you still do need strong defensive layers.

This is basically just setting a compiler flag. It's free for you and costs something for the attacker.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> To be fair, "restricting" flash readout while allowing hardware debug access always seemed like a minefield, and I would hope that anyone with a security sensitive application would have seen this from a mile away.

You could have a completely bug-free, constant-time, constant-power cryptographic library running on one of these microcontrollers, and debug access would allow you to reliably extract encryption keys just by examining the execution path.

The amount of processor and system state that you have access to with a hardware ARM debugger is crazy, but that isn't really the problem -- you can extract a ton of state with a minimal debugger too. Just a log of instruction pointer values would get you 90% of the way there.

I think it's reasonable to assume that microcontrollers with exposed debug interfaces simply cannot be made secure, just as people generally assume that it's game over once someone has physical access to a computer.

<comment><USER9> Modern cryptography libraries make sure that the execution path (and memory access patterns) do not depend on sensitive data. Usually this is what is meant with 'constant-time'.

If a debugger can read out registers or memory you can just read out the sensitive material of course.

<comment><USER8> Whoops... Yeah, you're right. You wouldn't expect to see instructions like bne, bge, etc. that depend on key material directly, so you wouldn't be able to rely the instruction pointer alone.

Instead, you might see instructions like addlt, so you'd also need to inspect the value before and after, which, as you correctly state, the debugger will happily let you do.

</comment></comment></comment><comment><USER10> I've talked to Johannes Obermaier in the past... very nice guy. It's not their first bypass, and hopefully not the last either.

PS. I actually have yet another STM32F1 RDP bypass in my archive, waiting to be published. It used a technique where the MCU writes its own debug registers... pretty crazy stuff. If only I had some free time to write a proper publication about it...

<comment><USER2> _If only I had some free time to write a proper publication about it..._

You could just drop some hints on a hardware forum and let the community figure out the rest.

</comment></comment><comment><USER11> I think you can thank this sort of hack for the widespread availability of cheap cloned "ST-Link" debuggers. They use STM32F103 or F102 chips inside, with firmware that was probably lifted from the debuggers on ST's evaluation boards.

As recently as a few years ago, it was unusual to see standalone debugging hardware in the $2-20 range. Sometimes I wonder if ST bristled at the...reuse...of their IP, but it probably did more to promote STM32s as a learning platform than anything that ST did in that time period.

<comment><USER12> I am not sure if it was always the case, but at least with ST and NXP/freescale you can download the firmware for their debugger from the website for free. I suspect that it was a strategic decision by ST to release their dev kits for cheap (<$10 for a stm32 dev board with programmer!) to drive developer/hobby/edu interest in hopes of people using their chips in production.

Come to think of it, I think it was actually TI and the MSP430 that started the trend with the $4.30 kits with a socketed msp430 micro and onboard programmer. ST was the first to try it with an ARM as far as I know...

<comment><USER13> Both were likely a response to Arduino presumably increasing the adoption of AVR without Atmel having to do anything. I recall the MSP430 kits being pitched that way in any case.

</comment></comment></comment><comment><USER14> tl;dr: The processor protects data accesses to the internal flash while the hardware debugger is connected so people with hardware access can't read out the code and config. But this protection only applies to the data side of the Harvard architecture buses. The instruction bus is used by the hardware to fetch the reset vector on a hardware reset. But the vector table is under software control. So by changing the reset vector to point to an arbitrary address in flash, then resetting the CPU under the debugger, you can get it to load your desired word from memory into the PC.

Pretty clever.

</comment><comment><USER15> I'm curious how they managed to get in contact with STM. I once discovered a silicon error in their STM32F0 but failed to get in touch at all.</comment>


CSS for Back end Developers - <AUTHOR> http://10clouds.com/blog/css-for-backend-developers-part-i/ <comment><USER2> Don't use #id in CSS. Use .class instead. Then you can use the #id for scripting, and you can separate concerns. For example: not having to update your CSS code when you change #id, or vice versa.

Using HTML5 semantics as much as possible instead of div.class is a good advice, as it will make the CSS more simple.</comment>


Learning to Deal with the Impostor Syndrome - <AUTHOR> http://www.nytimes.com/2015/10/26/your-money/learning-to-deal-with-the-impostor-syndrome.html?_r=1&utm_source=YNAB+Weekly+Roundup&utm_campaign=2d6f225c23-Weekly_Roundup_10_30_2015&utm_medium=email&utm_term=0_8929890d04-2d6f225c23-102579533&ct=t%28Weekly_Roundup_10_30_2015%29&mtrref=undefined&gwh=01B73C24C8AC89465EDA99BC203546D8 <comment><USER2> After landing a highly prestigious position at a company with a great reputation, I spent the first months thinking that every person I spoke to, worked with, or passed on my way to lunch knew I didn't belong. I thought I would be found out at every turn. This added to an already stressful transition. Only gradually did evidence from positive interactions with others chip away at my self doubt. I never truly believed that I was as capable as my peers, but then again they were some of the most intelligent people I've ever met.

Truthfully, I'd rather face perpetual self doubt than be overconfident. People who consider themselves exceptional usually turn out to be under delusions of grandeur and the truly gifted are often surprisingly humble. Wanting to catch up to the latter group creates the drive that keeps me learning new skills rather than coasting.

<comment><USER3> I totally agree. We just finished our perf cycle here at the Goog, and in my self evaluation I rated my impact as "medium" on the various projects I worked on. (I started back in June, so I haven't been around very long, and I'm very much still ramping up.)

The peer evaluations I got all rated my impact as "important" to "critical". I don't feel like I did anything too outstanding; just doing what anybody would do, and I feel like I still have a tremendous amount to learn, and the senior personnel are still way ahead of me.

I definitely feel like a touch of impostor syndrome can be a help toward excelling, as long as it doesn't cripple you.

<comment><USER4> A little imposter syndrome keeps you hungry. A lot of imposter syndrome is paralyzing.

I had a very similar experience to you during my first performance review at Microsoft. Thought I was just scraping by, ended up getting a promotion.

<comment><USER5> The 'lack of confidence' led me to mentally enjoy competitions because I then don't have to query people to know my place.

<comment><USER6> A very interesting humble brag thread. I'm not sure it's imposter syndrome if you think you're doing well when presented with evidence and then believe it. Not by definition anyway.

The performance reviews remind me of this little joke (actually a common real experience) -- "I got rated Above Average!" _' What was the average rating?'_ "Let me check... Oh. It's Exceptional".

</comment></comment></comment></comment></comment><comment><USER7> Neat read, but the moment of zen if you already know a bit about imposter syndrome is towards the end:

"One day, Buddha was teaching a large group, and Mara was moving around the edges, looking for a way into the group. I envision Mara rushing frantically back and forth in the bushes and trees, making plans to wreak havoc. One of Buddha's attendants saw Mara, ran to Buddha and warned him of Mara's presence. Hearing his attendant's frantic warning, the Buddha simply replied, "Oh good, invite her in for tea."

This story captures beautifully how we should respond to the impostor syndrome. We know what the feeling is called. We know others suffer from it. We know a little bit about why we feel this way. And we now know how to handle it: Invite it in and remind ourselves why it's here and what it means. "

<comment><USER5> Quite often I have to willingly do the opposite of my reflexes to understand or evolve. Accepting weirdness, fear, and diving into it to get more data.

</comment></comment><comment><USER8> As an autodidact software developer, I've been lucky enough to avoid these self-doubts.

I still experience them, but the difference is I don't wonder what my peers think: For the first few years I was teaching myself how to code, the harsh open ego of my online community tore me down every step of the way. Mainly hackers and engineers on IRC.

There's nothing like hearing a peer or mentor tell me my work is utter crap, with full unabashed honesty. One of my most vivid memories is a fellow developer telling me my abilities were amateur and I wasn't qualified for the job, straight to my face, in front of all my peers. This is only possible in a pseudo-work online environment, with non-coworker peers. The impersonal pragmatism of online social groups has been a valuable crucible for suspected impostors, and it forces me to examine myself and see my failings. Harsh, and often false, but no longer a question lingering on my mind.

<comment><USER9> Sounds horrible. I came across the following quote earlier today that sums up my reaction pretty well: "Honesty without empathy is cruelty."

<comment><USER8> It was. On the other hand I feel like I know exactly my skill level and limitations.

</comment></comment></comment><comment><USER10> Slight rant. This is currently a major problem for me that I'm not entirely sure how to handle still.

I'm young, never went to college, and my experience is entirely through work in the financial area (with side projects). In a lot of ways, I've fallen into the "Jack of all trades, master of none" spectrum. Give me any complex problem and I can generally solve it, even if I don't have experience with it. I have a very good track record and most previous bosses regard me very highly. My skills aren't entirely traditional, but they work pretty damn well.

That changed when I followed a senior colleague into a new position as a newly minted senior linux admin. As soon as I joined, I received an asinine amount of anger of nepotism or where suggestions are generally viewed as naive, then ignored. Two of those naive things were, "why does QA have root access? Why are the root ssh keys the same as prod and QA?" and "can we fix the DNS setup so that we don't need a CAB approval to run four root-owned scripts to push /etc/hosts to 95% of prod servers?". If it weren't that most of the environment isn't documented and makes our lives hell, I wouldn't bring these things up. On top of that, we're a large web company, so it's insane that these things are trivialized.

I'd like to get out of it, but at the same time, I feel like if I can get out of if, I can get out of most things. It's a complete brainfuck and killed most of my confidence at this place.

Imposter syndrome is difficult.

<comment><USER11> In regards to the Jack of all trades quote, the full thing is: "Jack of all trades, master of none, though often times better than a master of one."

</comment></comment><comment><USER12> The other extreme is described in "Assholes, a Theory", by Aaron James. This is a serious book on organizational behavior. From a review: _" James proposes a theory of assholes (a person is an asshole when his sense of entitlement makes him immune to complaints from other people) that explains not only why assholes are a vital part of human society, but also how to recognize them and coexist with them."_

Note the definition: "a person is an asshole when his sense of entitlement makes him immune to complaints from other people." This is the clear opposite of impostor syndrome.

 _O wad some Pow 'r the giftie gie us, To see oursels as ithers see us!_ \- Robert Burns

</comment><comment><USER13> I came to the conclusion (which I later confirmed by reading a quote by someone famous, can't remember right now), that most intelligent people will realize that no matter how intelligent they are, there always someone else more intelligent. And even if you look up to THE most intelligent people of mankind's history (think polymaths, the DaVincis, Eulers, Leibnizs, etc), they STILL knew they couldn't know everything/be the best at everything. There's even a famous scene in a Simpsons chapter where Homer looks up to Edison as an inventor and then he realizes that even Edison looks up to someone (I think DaVinci in the cartoon).

So at some point when my impostor syndrome gets to me, I remember that in the end it's really never going to go away and secondly, it will keep me reminding me that there's still a lot to learn and that helps me stay humble because I know any day I might meet the most improbable of persons, that will teach me something that I didn't know.

In other words, I have found that keeping my impostor syndrome alive (but not letting it paralyze me as another poster suggests) helps me keep my ego in check. On one hand my ego let's me enjoy the painful fruits of frustration and experience and then my syndrome avoids that from letting me float so high that I burn with the flames of ego.

In the end, that still doesn't negate the fact that it's a constant drain of energy having to balance the two. I guess that's part of the reason why they say ignorance is bliss... although I'm not sure it's a particularly enjoyable bliss.

</comment><comment><USER14> In my opinion and experience startup founders, whether singly or in small groups, suffer the opposite of imposter syndrome: they know exactly what they are doing, but the world does not take them seriously, or believe it. In essence founders of projects are considered imposters; and closing one or two financing rounds doesn't materially affect this.

</comment><comment><USER15> What if she doesnt have Impostor syndrome and is an impostor?

<comment><USER16> Well, that leaves either intentionally being fraudulent, or Dunning-Kruger.

</comment></comment><comment><USER17> very common among software developers too:

[https://www.reddit.com/r/programming/comments/2dqrmo/the_imp...](https://www.reddit.com/r/programming/comments/2dqrmo/the_imposter_syndrome_in_software_development)</comment>


Uber has terminated its self-driving car operators in Pittsburgh - <AUTHOR> https://qz.com/1326155/uber-has-terminated-its-self-driving-car-operators-in-pittsburgh/ <comment><USER2> The title says "operators", not "operations", which I misread about three times :-(. I.e., there's still a sizable self-driving effort, but they've re- organized the humans doing the actual day-to-day driving of the cars:

 _> Uber confirmed it laid off about 100 autonomous vehicle operators in Pittsburgh and eliminated the position. The company plans to replace these jobs with about 55 "mission specialists"—specialists who are trained in both on-road and more advanced test-track operations, and who are expected to provide more technical feedback to self-driving car developers. Uber said affected operators could apply for these positions._

</comment><comment><USER3> It killed them?

<comment><USER4> Termination is an HR term; title could be more unambiguous.

<comment><USER5> Pretty sure that was a joke

<comment><USER6> But humor is incongruous to HN. ;)</comment></comment></comment></comment>


37signals suite: All 37signals apps for one price - <AUTHOR> http://37signals.com/suite

<comment><USER2> It's strange that pricing is only available to customers (for now?). There are three plans, starter, pro and elite and they all include Basecamp, Highrise, Backpack, Campfire, unlimited employees (users) and e-mail support.

      Starter - $99/month
      * 35GB of file storage
      * 35 Basecamp projects
      * 20,000 Highrise contacts

      Pro - $149/month
      * 100GB of file storage
      * 100 Basecamp projects
      * 50,000 Highrise contacts

      Elite - $249/month
      * 300GB of file storage
      * Unlimited Basecamp projects
      * 100,000 Highrise contacts

There's no mention that I can see whether Basecamp includes time tracking (available only on the $49 and higher Basecamp plans) or how much, if any, conference call minutes are included with Campfire.

<comment><USER3> Time tracking is included on all Basecamp plans that are part of the Suite. It's the fully-featured Basecamp. You get everything.

We'll be adding Campfire conference call minutes and # of simultaneous chatters to the chart shortly.

<comment><USER4> Please do so sooner than later as something like the limit of simultaneous chatters in Campfire has been an issue for us in the past. I've got our HR guy looking into upgrading but we've got little in terms of comparisons to go on.

</comment></comment></comment><comment><USER5> Basecamp has one major limitation for me and that is only people within your company can track time against projects. I work with a lot of independent contracts and I wanted to put them in separate companies, but still have them track their time in Basecamp. I have talked with support and this is a "feature" which they are sticking with, very frustrating.

</comment><comment><USER6> Curious wording: "Can I sign up for the Suite if I don't already own a 37signals product? Currently the 37signals Suite is only available for people who already own Basecamp, Highrise, Backpack, or Campfire accounts."

If you pay to use a webapp, do you "own" it? Maybe they're trying to make 37signals' "apps" seem more like App store apps.

<comment><USER7> "people who already own Basecamp, Highrise, Backpack, or Campfire _accounts_."

You own the account. although it can be taken away from you like anything in life.

</comment></comment><comment><USER8> _We've priced the 37signals Suite aggressively. It'll often be cheaper to purchase the whole four-app Suite than to purchase two products separately._

Interesting. I'd be interested to see the metrics that made them decide this is a good idea.

<comment><USER9> It's a great way to increase the amount of money they're extracting from their best customers while simultaneously giving them an increased perception of value. Seriously, they're going to print money hats.

<comment><USER10> Surely their best customers will already be paying separately for the products individually? How does charging them less for the same increase the amount of money they are going to get from these customers?

<comment><USER11> This is actually the tactic that Microsoft used to own the Office market, I believe... they first released a "Microsoft Office" that included Word, Excel and so on, all in one, for less than two of those products sold separately.

That, of course, completely wiped out single-products that couldn't be sold in a suite, e.g. WordPerfect. Once the market was clear of competitors, they then proceeded to slowly but surely increase the price of the suite (and the price of the standalone products along with it).

</comment></comment></comment></comment><comment><USER12> I really like this because I've personally been stressing over creating a single, full-featured web app versus creating multiple, simple apps.

This is good proof that it doesn't really matter.

</comment><comment><USER13> I just upgraded and they made more money off me than before. Here was my situation:

Campfire: $12 Backpack: $12 Basecamp: $24 Highrise: $24

I folded one of each into the $99 suite. I'm paying $99 now instead of $72, but I've been knocking against the Basecamp limits for awhile now.

The limits for all the accounts are higher than with my previous payments. And now I get one invoice instead of four.

</comment><comment><USER14> Why aren't they allowing new customers to take advantage of this? I wonder if it's for technical or business reasons.

<comment><USER15> If you sign up as a new customer, can you then not upgrade to the suite?

<comment><USER8> According to the link, you can immediately upgrade after signing up.

</comment></comment></comment><comment><AUTHOR> I wish it offered combined pricing on any two apps (say Backpack + Highrise) for those who don't want/need all 4 apps...

<comment><USER16> Why not, 37Signals is basically Comcastic!</comment></comment>


Astronomers may have identified what may be the smallest known star - <AUTHOR> http://www.slate.com/blogs/bad_astronomy/2014/06/11/the_brown_dwarf_limit_astronomers_have_found_the_smallest_star_known.html

<comment><USER2> Nice. If grand scale and unimaginable heat are what make stars impressive, then this must be the least impressive star. In fact, we might never find a star less impressive than this one, because this is close to the _least impressive star that 's physically possible._ At least we got it out of the way.

<comment><USER3> > _J0523 has the lowest possible mass for fusion, so it's taking its sweet > time using up its hydrogen fuel. [...] It could literally still be fusing > merrily (though feebly) away even a trillion years from now!_

The good thing about astronomy is that there's _always_ something impressive.

<comment><USER2> Absolutely. This star has an impressive feature. But it is the least observable of all such impressive features. Thus fitting the least impressive star. :)

</comment></comment></comment><comment><USER4> I wonder how hot such a small star gets and how long it lasts. The big blue stars burn out relatively quickly, this thing must keep on trucking for a long time. Maybe before the heat death, all whatever's out there will have are these things.

<comment><USER5> The 'heat death' being something asymptotic we will never arrive there. And the period between when the last stars wink out and the time when all the energy is spread out so evenly that it is indistinguishable from being in that 'heat death' state will likely be dominated by chunks of matter that slowly des-integrate as the protons in the nuclei of the various molecules decay.

This will take 'a while' for rather large values of 'a while'. (10^33 years according to the latest info...)

So stars will not go after ordinary matter has gone but the other way around, just like ordinary matter (just hydrogen and helium, actually everything else we have came out of other stars) preceded star formation.

The embers of the universe will take a long time to stop glowing.

</comment></comment><comment><USER6> So how is this different than Jupiter that it fuses and Jupiter doesn't?</comment>


Digital Health Records' Risks Emerge as Deaths Blamed on Systems - <AUTHOR> http://www.bloomberg.com/news/2013-06-25/digital-health-records-risks-emerge-as-deaths-blamed-on-systems.html

<comment><USER2> A datapoint from a friend in the field: the stimulus bill, which mandated this change, includes the simple phrase "meaningful use" as I recall to define when a healthcare provider satisfies the requirement. That ballooned that into 6-700 pages of regulations and a very healthy, shall I say, consulting business to help providers demonstrate their "meaningful use".</comment>


13 great examples of Box2d Flash World Construction Kit + Alchemy Port - <AUTHOR> http://www.sideroller.com/wck/ <comment><AUTHOR> It is great what you can do with box2d, i want to know if some has experience with this?</comment>


In-Q-Tel - <AUTHOR> http://en.m.wikipedia.org/wiki/In-Q-Tel

<comment><USER2> Mods, please change the link to the non-mobile Wikipedia page.

</comment><comment><USER3> I was at a tech Meet Up in DC a couple of years ago and there was an investor there who said he was from In-Q-Tel.

</comment><comment><USER4> It's more of a federal grant program than a VC. The fund operates a huge annual loss.</comment>


Ask HN: Books for writing a data-intensive Python webapp using CouchDB? - <AUTHOR>

What are the go-to books for gaining comprehension of Python web frameworks (like Django), modern web (and web app) design, and dealing with large amounts of data and analytics, possibly using CouchDB as the database?<p>It's a broad request, I know, but I'm hoping there's some good advice out there. <comment><USER2> Check this for CouchDB: <http://books.couchdb.org/relax/></comment>


Paypal is holding over 600,000 euros from the minecraft developer - <AUTHOR> http://notch.tumblr.com/post/1096322756/working-on-a-friday-update-crying-over-paypal <comment><USER2> We've been going around in circles with stories like this for years. In spite of all the horror stories, people are still using PayPal. That would indicate to me that either PayPal are exploiting a monopoly position, or there is a massive gap in the market for a fast, easy payment system that doesn't treat serious customers like dirt.

I completely understand the Googley argument that you can't provide much customer service if you have millions of users with a tiny average revenue, but what sense is there in treating a €600,000 account so poorly? Surely they must know that they have lost him forever as a customer.

The only logical answer I have as to why PayPal do this to big customers is that they know that as soon as anyone gets big they leave for a cheaper merchant account, so their account freeze is just a way for them to hold on to a customer long enough to make some real money out of them. I can't believe that they would, but I'm struggling to work out why else they would act like this.

<comment><USER3> _That would indicate to me that either PayPal are exploiting a monopoly position, or there is a massive gap in the market for a fast, easy payment system that doesn't treat serious customers like dirt._

You're missing the third possibility, which is that efficiently doing what PayPal requires requires "treating serious customers like dirt."

PayPal is in the business of efficiently detecting and not paying for fraud. One type of fraud that they need to deal with is fraudsters getting control of an established account, sticking lots of fake payments in, then withdrawing the "money" before PayPal notices that it isn't real. Their strategy for this seems to be to make people jump over a low paperwork barrier, then wait long enough that the payments have all cleared before they pay out. Given this, paying for a dedicated customer service representative for the victim on top of that strategy is an inefficiency.

The last part of that decision ignores the effect of pissing people off on their reputation, and so may be shortsighted. But the rest of their strategy makes sense to me.

<comment><USER4> > Their strategy for this seems to be to make people jump over a low paperwork > barrier, then wait long enough that the payments have all cleared before > they pay out.

I wonder why they don't just do this by default? Personally I would not be offended at all if they just had a status on the payments called "waiting for payment to clear."

<comment><USER5> Consumers can reverse credit card payments up to six months out.

<comment><USER6> That's a product insurance system though isn't it, it's not clearing or failing to pay.

<comment><USER7> If a transaction can be reversed, it hasn't cleared.

<comment><USER6> What I'm saying is that my impression is that the transaction is not reversed but that a subsequent insurance claim is made.

IMO if the money is available for you to spend then it has "cleared". Money that has cleared may be recouped, eg when you sell something fraudulently and get nabbed.

<comment><USER7> If you fraudulently sell something and then spend the money, how does paypal recoup it?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> At least he's a known internet guy, it's pretty clear where the money is coming from and this post alone will get paypal to sort it immediately.

But why do you have to be a celeb to get decent support from paypal? Freezing over half a million euros and they don't even assign him a dedicated support person? They don't call him? Disgraceful.

<comment><USER9> > it's pretty clear where the money is coming from and this post alone will > get paypal to sort it immediately.

I wouldn't bank on that. It's possible, but by no means sure.

> But why do you have to be a celeb to get decent support from paypal?

Consider the fact that he _is_ a celebrity and does not get decent support, you can imagine how it is for the rest of the world.

Especially when you're not in the US.

> Freezing over half a million euros and they don't even assign him a > dedicated support person? They don't call him? Disgraceful.

Business as usual for PayPal, see below.

<comment><USER8> Minecraft games sales.

Unless the whole minecraft thing is a cunningly disguised money laundering scheme for the illegal sale of fjords to rich American businessmen...

We've heard this one before, a surge in sales triggers Paypal's fraud systems.

<comment><USER9> So what? In my case it was a bunch of newspaper articles about our website that made us grow quite a bit in a short time. A surge is not always fraud related and in the case of an account with long history of being 'in good standing' it is not entirely unexpected to do a bit of follow up after you've frozen the account 'just in case'.

Unfortunately paypal and courtesy only appear in the same sentence when there is a negative in there somewhere.

<comment><USER8> Ah, sorry, misunderstanding what you meant, you meant paypal sorting it out, I thought you were talking about where the sales were coming from.

</comment></comment></comment></comment></comment><comment><USER10> Another Paypal horror story added to the list. If someone was wondering (as i did), no, he didn't let 600k on his paypal account. That's what he's earned since they limited his account 25th august.

See <http://twitter.com/Toucanator/status/24089600756> and <http://twitter.com/xnotch/statuses/24089647124> .

EDIT: Minecraft complete steam sales data,amazing: <http://m00d.net/minecraft/sales/>

<comment><USER11> So he's sold 60k prepurchases at EUR 9.95 in a little over two weeks?! Holy cow.

Found some stats - <http://www.minecraft.net/stats.jsp>

<comment><USER12> Prepurchases? Pretty sure that could be the problem - - PayPal doesn't permit charging someone for goods that aren't going to ship immediately.

<comment><USER13> It's not exactly a prepurchase since for 13$ you get access to the alpha version.

</comment></comment></comment></comment><comment><USER14> The "paypal blocked my money" stories are frequent.

I'm curious to which extent this is legal. I'm pretty sure a bank isn't allowed to block access to your accounts without a formal request from a legal entity.

Paypal doesn't "own" the money. This sounds to me as extremely abusive.

Is that this frequent?

<comment><USER15> That's the rub--Paypal _is not a bank_. They can do whatever they want with the virtual money that is exchanged on their servers. Which is why a real merchant account is the only serious option for a larger-scale business.

<comment><USER8> They are a bank in Europe, just not the US. Sounds like the whole legal status in the US is a bit of a mess really:

<http://en.wikipedia.org/wiki/PayPal#Regulation>

<comment><USER16> While that may be true, Luxembourg is known as a tax haven. I note that Amazon also registers its European operations there. From the same source as you cited:

"Concern about Luxembourg's banking secrecy laws, and its reputation as a tax haven, led in April 2009 to it being added to a "grey list" of nations with questionable banking arrangements by the G20." [<http://en.wikipedia.org/wiki/Economy_of_Luxembourg#Banking>]

So, in effect, Paypal is probably a bank in nominal terms only. They can still do pretty much whatever they want with your money and get away with it. That is why my company went with WorldPay even when we started out. We don't get charged any fees, just commission, and we get free fraud insurance on the major credit cards.

<comment><USER17> Paypal is a bank in Europe, as stated. I was one of those who lobbied to achieve this. I was burned by this odious outfit more than five years ago. You don't get two chances with someone else's money in their lifetime.

You can't be a bank "in nominal terms only" in Europe. Once registered as a bank you are bound by EU and Member State laws. There's no sidestepping that. Governments can't sidestep them.

The fact that Paypal is registered as a bank in a European Member State means that they must abide by these laws and the regulation that goes with it.

Remember, loser pays in European courts. So when a bank steps outside the law, it will be liable for costs and "damages". It is not in their interests to break or even "stretch" the law.

Regardless, I wouldn't do business with Paypal if you paid me. Well, perhaps I would, but pay it straight to my bank, and not via Paypal.

P.S. My fight goes on: this week I have been active again in the European Parliament with MEPs fighting to get the appalling ACTA spiked. Something we should all be aware of and striving to kill.

</comment></comment></comment></comment></comment><comment><USER18> I'm building a website that I would like to launch soon and were planning on selling digital goods. My initial idea was to just use the PayPal shopping cart, since I already have a PayPal account and it so easy to set up(I definitely don't want to go through the hassle of setting up a merchant account).

But all these horror stories I have read on HN the last few days have scared me a bit. I also seems that its even worse if you're not a US citizen, especially if you live in a "suspicious' country (I'm South African, not really a country with high internet fraud cases, but all African countries are painted in a bad light for some reason). But are there really any good alternatives?

<comment><USER19> I run BitBuffet.com where we enable end users to sell digital downloads and we use PayPal exclusively. These horror stories are somewhat uncommon (we've never experienced one or heard of a customer experiencing one).

My advice: go with PayPal until you are making well over $2-4k a month, then switch to a dedicated merchant account once you have proven volume. There are 100 other more likely points of failure than not getting your money from PayPal.

<comment><USER20> That's what we have done. Paypal horror stories freak me out, so I regularly withdraw to my bank account and then transfer to another account so paypal can't go after the withdraw. Paranoid, yes, but better than nothing.

Now that we have $1.5k a month in donations, we are using Braintree. Wasn't worth setting up before proving financial viability, but definitely worth the peace of mind with a proven business. Great piece of advice.

</comment></comment></comment><comment><USER21> What.. just bought Minecraft last week, awesome :)

Hope he gets this sorted out.. Also i think it's quite interesting to see one person making such an amount of money with an alpha version of a game that has not much content and graphics from the last century but fun gameplay. EA and friends should learn from this.

<comment><USER22> Fun gameplay is the key. For the rest, we have our imaginations. (I can't remember the last time a game scared me as much as when I fell down a pitch black cave and heard the groaning coming from all directions! :eek:)

Edit: Sorry, I'm not trying to make a counterpoint, I agree with your statement.

<comment><USER23> Re: Fun/Imaginative gameplay.

Jason Rohrer

<http://hcsoftware.sourceforge.net/jason-rohrer/>

</comment></comment></comment><comment><USER24> I run a browser based MMO that once upon a time earned a fair amount of money (not at Minecraft's astonishing levels though!) and Paypal is my only method of payment. The first time I made a large withdrawal (10s of thousands) they did something similar.

I think people are being very knee-jerk with their reactions about all of this. Yes, it's annoying to have your money frozen temporarily, but Paypal is basically on the line for all of that money if it turns out to be fraudulent. All they need is a series of business documents proving you really are who you say you are, and then they will hand over the money.

Let's face it, few people show up out of nowhere and earn a million dollars in a month!

Notch even knows this, if you read his blog post he says he's sure it'll get sorted out. Once you go through this process once they will not do it again.

<comment><USER25> It sounds like they screwed you too, and your defending them?

It sound suspiciously like they just want to keep the money for as long as possible. Collecting interest on your assets is a clear profit motive.

<comment><USER24> I don't consider myself screwed at all. They held my money until I gave them proper documentation. When you run a business this kind of thing happens all the time. Just paying taxes to the government was way more complicated and intrusive.

Yes they can earn interest on money, but it's much more likely to me that they are covering their asses about the money rather than earning a small amount of interest on it.

Paypal has to deal with a lot of fraud. If you listen to the owners in interviews they say they lost a ridiculous amount of money in the early years to fraudulent users. It is reasonable for them, in my opinion, to make sure the money was owed to you before giving it to you.

<comment><USER26> In my ING Direct account (savings) I earn 1.1% APY currently, on 600.000 that is 6.600, that is 550 a month. If they freeze your accounts for two months, they have "earned" 1.100.

Now think of the amount of money going through paypal or sitting in paypal accounts, that is a fair chunk of change.

</comment></comment></comment></comment><comment><USER27> I wonder what someone's legal recourse is in a situation like this. I mean what gives Paypal the right to claim 'suspicious activity, your money is ours' without having to provide some kind of evidence.

And IF something is a legitimate case of fraud, aren't they required to simply freeze the assets and turn the account holder over to the appropriate authorities ?

It's hard to imagine that this type of due process can be waived simply by having agreed to certain terms & conditions.

</comment><comment><USER28> We ditched paypal because:

1\. Their site is very slow which hurt conversions. People who may have simply paid using a regular credit card went down the PP funnel and got frustrated and simply left.

2\. Retention for monthly subscribers was 10 to 20% lower than credit card subscribers.

3\. Refund policy sucked. It would take several days for our customers to get their money back if we refunded them.

4\. Tools to manage bulk recurring subscriptions sucked.

So glad we're free of them.

<comment><USER29> Their site really is slow as can be. I dread not being able to dig something up in my email, that means I have to go use Paypal's search - each page can seriously take 10-15 seconds to come up.

</comment></comment><comment><USER30> I had a similar case with PayPal, back in 2001, but the sums were much smaller. I was doing freelance work, and most of my clients paid me via PayPal. Then PayPal froze my account, when I had about $2,500 in it. I needed that money to pay rent. It took about 6 weeks before they re-opened my account. To pay rent I had to borrow money from friends and family. PayPal was very hard to deal with. They kept asking for proof that I was me. They wanted me to send bills that verified my address, but I was subletting an apartment for 3 months and had very little evidence that I was really me.

At another time some friends of mine started a business with me and we had a PayPal account for awhile. At some point we stopped using it, and then someone sent us $200. I've no idea what happened to that $200. Possibly it got auto- refunded at some point. Possibly it is still sitting there, in the account. Whatever email address we used for that account was tied to the company we had, which had a domain name we gave up on years ago.

All the same, PayPal is the easiest way to go when you are starting up a new site. And PayPal has aggressively bought up some of the competition that used to be a lot better than PayPal. (PayFlow Pro, for instance)

</comment><comment><USER31> I bought Minecraft so I guess part of this money is/was mine.

I never understand why people still use Paypal. There are so many horror stories and so many alternatives. Just don't use them.

<comment><USER32> What alternatives?

<comment><USER33> There's Google Checkout and Amazon Payments, neither of which work outside the US. There's also AlertPay, which is apparently used by IPREDator and which is sometimes used by 7chan. I'm not sure whether I trust them more than PayPal.

<comment><USER10> Do you mean that you can't register to checkout and amazon as a seller if you are not an US resident? Because as a buyer i've used checkout a lot of times from Italy, same thing should be possible in other european countries.

<comment><USER34> It works for buyers as long as you have an international card. But to register as a seller a US bank account is a must. Given the new features added to Checkout By Amazon and all the Paypal stories, they might get traction if they remove that "US only" tag. Not sure how easy it is though.

</comment></comment></comment></comment></comment><comment><USER35> We operate a large site with thousands of PayPal payments per day. This is a sample email we just got from PP:

Hello ....,

We were recently notified that a payment you received was reversed by the buyer's bank.

As a result, we have reversed the following transaction: Transaction date: xxx Transaction amount: xxx USD Buyer's email: xxx Buyer's name: xxx Your transaction ID: xxxx

PayPal is committed to maintaining a safe environment for our buyers and sellers. You can help protect yourself against claims and reversals by following the guidelines of our .

Thanks,

PayPal

Note that their email template has a bug: it says " following the guidelines of our ."! Cannot they fix their email templates? They are dealing with f..ing real money! The Viagra spam that I get has less bugs in their email templates!

</comment><comment><USER36> I keep wondering why there isn't a Ycombinator-funded paypal killer.

I'm not a developer/coder/anything close to one, or I would do this myself.

Come on, guys! Get on this!

<comment><USER37> Paypal was once losinf $100 million per month. Who is going to fund that in these non-2000 AD days?

</comment></comment><comment><USER38> Google is trying to create their own payment system. It hasn't gotten much traction. Why don't they go ahead and support countries throughout the world (if they want to leave out a FEW places like North Korea that would be fine)? Seems to me that then they would have a ready-made constituency. Not to mention pleasing a huge number of Android developers. Yet they don't do this... Why? There must be something difficult or dangerous about it, but what? Does anyone know the answer?

<comment><USER39> Is it also worth pointing out that Google isn't exactly known for it's high level of customer service. Is there any reason to think they won't be just as bad as PayPal if they had the same number of customers.

I can't believe there isn't a _better_ option yet, it's not like PayPal have suddenly become worse. Stories like this have been around for years.

<comment><USER40> google does many things well. customer service, not well at all. i had a torrid time dealing with them when i bought a nexus one when it launched.

</comment></comment></comment><comment><USER41> How do people not know that Paypal does this by now? Wouldn't you want to avoid Paypal?

<comment><USER42> The problem is that it's difficult to find a better solution.

If all goes well, Paypal is generally by far the best option.

If all goes poorly... not so much.

But for most, it goes well.

</comment></comment><comment><USER43> Paypal has the most customers of any financial institution in the world, they have some of the largest challenges of any financial institution in the world. Not the least of which being that everybody who is capable of using paypal is simultaneously connected to the biggest and most efficient megaphone ever invented (the internet) and the unique consequences for bad press that situation entails.

You can decry paypal's customer service, no doubt, but recognize that the root cause of these problems are all of the very real scammers who have abused the system and never make the news. Consider an analogous situation, check fraud. There are many stores and restaurants that do not accept checks, is this because banks are evil and hate honoring checks? No, it's because of repeated abuse from fraudsters devaluing checks as a method of payment. The same is happening here with online payments. You can get around the problem by paying more money for a merchant account but that only protects you from the immediate effects of the problem for a little while.

<comment><USER44> _You can decry paypal's customer service, no doubt, but recognize that the root cause of these problems are all of the very real scammers who have abused the system and never make the news._

If you discover that you have processed a fraudulent transaction, undoing it is quite understandable, but keeping the money for yourself (as per the link) is a pretty shady solution.

<comment><USER43> Fraud is not so simple. Step 1 is identifying a _potentially_ fraudulent transaction. Most financial institutions put the breaks on any funds transfer in that case until a further investigation has completed, rather than merely reversing the previous operation (indeed, that would lead to an even greater adverse impact on false positive cases and would aid the fraudsters as well).

If withdrawals from your bank account is frozen due to suspected (or actual) fraud, few people jump to the conclusion that the bank is out to snatch up their money. Why not extend paypal the same courtesy?

<comment><USER44> _Why not extend paypal the same courtesy?_

From my previous post: "keeping the money for yourself _(as per the link)_ "

<comment><USER43> I addressed that. Do you not appreciate that when a bank freezes an account for fraud that it too is "keeping the money for itself"? Indeed, this is the appropriate course of action until a better determination of whether or not fraud is involved is made, whether you're Chase or PayPal.

Let me be more clear: what, precisely, makes you believe that when paypal freezes an account due to suspected fraud that it is more likely _actually_ due to nefarious purposes on their part than when Chase or Bank of America or any other bank takes exactly the same actions for exactly the same reasons?

</comment></comment></comment></comment></comment><comment><USER45> I work at PayPal, though not in fraud detection, and it always seems interesting how much bad publicity the company is getting lately. I personally wish they would address the social part of doing business on the web.

There's a reason why the hold explanations are vague but it has nothing to do with questionable intentions.

</comment><comment><USER46> We've experienced this issue in the past. If you're gonna use PayPal, here are some tips:

1) Use your full legal name when creating the account.

2) If you're creating the account for a company, make sure the owner of the account is an officer of the company (CEO, Vice President, etc).

3) Have only one account. If you're creating an account for your business, and you already have a personal account, you're gonna run into problems.

4) Make sure the mailing address you give is actually accessible. PayPal's gonna mail a verification code to you once you start making a sizable amount.

And just in general, once you start getting money into your account, PayPal's always gonna come knocking. At one point, PayPal prevented us from even receiving payments. But eventually, after a while of working with them, they got off our backs and we stopped having problems with them.

</comment><comment><USER47> Most of the paypal horror stories always relate to paypal users not providing or not willing to provide valid information to identify their accounts.

In Luxembourg (and paypal is a registred and regulated bank in Luxembourg), the government requires the bank to know it's customers identities, otherwise the bank is not allowed to do business with their customers. And an email will not be enough. You have to provide passports/identity cards.

And I guess that's what happens here. After a certain transaction amount, paypal requires more information than just an email address.

</comment><comment><USER48> When will:

1) Companies learn that to cheap out on the payment process and go through PayPal is stupid and things like this WILL happen. You deserve what happens when you go through PayPal as it means you either didn't research it's history or didn't listen to the warnings.

2) Customers learn not to do business with a company that is too cheap to setup their own payment process and not go through PayPal. By supporting business' that are using PayPal we allow the cycle to continue.

</comment><comment><USER49> I never realized how easy it was to setup a merchant account / processor until paypal scared me into doing it.

</comment><comment><USER50> We need some way to force paypal to stop defrauding honest people (as well as being faster, but that isn't such a big problem).

Unfortunately there doesn't really exist a good alternative outside the US.

Anybody knows how to start lobbying against paypal?

</comment><comment><USER51> Why on earth would you keep 600K on your paypal account anyway?

<comment><USER52> <http://twitter.com/xnotch/statuses/24089647124>

<comment><USER53> actually this tweet explains it a little better: <http://twitter.com/xnotch/status/24100656191>

<comment><USER54> You are funny. Tweets are only a line long or so, so you might as well have copied the thing (with attribution).

<comment><USER29> Directing to the original source is more authoritative and informative.

<comment><USER55> Quoting and linking back to the tweet seems like a nice compromise.

</comment></comment></comment></comment></comment></comment><comment><USER56> It's a small consolation, but at least this business with PayPal is giving him some good publicity. I'd never heard of Minecraft until now.

</comment><comment><USER57> Why has no one mentioned WePay.com?

<comment><USER58> Thanks for the shout-out!

Unfortunately, we don't do international (non- U.S.) transactions...yet

</comment></comment><comment><USER59> Wtf I just bought his game yesterday, and he can't even get his money??

</comment><comment><USER60> Why US Administration is not converting Paypal into a bank?

</comment><comment><USER49> same happened to me recently - though my balance was under 10k, so it was less scary. I called and asked nicely until I got the restrictions removed.

</comment><comment><USER61> Disgraceful...

</comment><comment><USER62> Everyone has known for years that Paypal is awful, regularly steals large amounts of money held by perfectly legitimate customers, and does it all through inscrutable, unfriendly, customer-service processes.

 _I know this, man._

Yet Paypal is bigger than ever, and there's no glimmer of improvement on the horizon.

So either we assume Ebay, the parent corp, is so clueless about milking Paypal for profit while reinvesting as little as possible back into it, or we assume Ebay has a reason for not improving Paypal in any significant way in the past 5+ years.

I'm starting to suspect there's a great financial reason for Ebay to keep doing this. And it might be a similar financial strategy that Amazon has famously used from day 1. Amazon collect payments immediately, yet ships items much later. This means their cashflow is always more than their inventory expenses at any given moment. For however much time there is until that gap closes, Amazon is in a great position—essentially getting a short term loan, and if you consider their volume of transactions, that is billions of cash being held in floating pools.

 _What if Paypal provides a similar benefit to Ebay's bottom line?_ Paypal isn't a bank, so they can do whatever they want with the held funds. I suppose what actually happens to the held funds is a corporate secret they guard carefully. But I bet it props up Ebay's cashflow in a major way. If Ebay changed ways and forced Paypal to provide better guarantees, much like a bank, then their cashflow would take a hit.

Good idea or am I off?

<comment><USER63> Amazon doesn't bill you until an item ships, even for third parties that sell items through them. I've verified this on my credit card statement.

</comment></comment><comment><USER64> PayPal recently pulled this stunt on me. While very frustrating at the time, especially since there was no phone support available for the next 3 days due to labor day weekend, at least now I have scanned copy of my Passport on my computer.

<comment><USER65> can you elaborate on this passport issue? are you in a foreign country?

<comment><USER64> no, but paypal wanted me to scan some form of identification to prove my identity. since my driver's license is expired and i'm no longer living in california, all i have is a paper driver's license that they mailed me, so i use my passport for identification purposes. if i am ever traveling in a foreign country in the future, it will be useful to have a digital copy of my passport in case i lose it and have to deal with embassy issues. i have not requested the dmv mail me a new driver's license since the picture was taken when i'm 15 and the inevitable "you look so different!" conversations are kinda lame

</comment></comment></comment><comment><USER66> While on the face of it this sounds outrageous, it is probably a symptom of PayPal's anti-fraud measures.</comment>


An Illustrated Guide to Useful Command Line Tools - <AUTHOR> https://www.wezm.net/technical/2019/10/useful-command-line-tools/ <comment><USER2> I quite like this list, there are a number of utilities here that I already use on a daily basis. There are also a few utilities that I like that weren't on this list, or some alternatives to what was shown. Some off the top of my head:

\- nnn[0] (C) - A terminal file manager, similar to ranger. It allows you to navigate directories, manipulate files, analyze disk usage, and fuzzy open files.

\- ncdu[1] (C) - ncurses disk analyzer. Similar to du -sh, but allows for directory navigation as well.

\- z.lua[2] (Lua) - It's an alternative to the z utility mentioned in the article. I haven't done the benchmarks, but they claim to be faster than z. I'm mostly just including it because it's what I use.

[0] [https://github.com/jarun/nnn](https://github.com/jarun/nnn) [1] [https://dev.yorhel.nl/ncdu](https://dev.yorhel.nl/ncdu) [2] [https://github.com/skywind3000/z.lua](https://github.com/skywind3000/z.lua)

<comment><USER3> And regarding ncdu, there are static binaries for Linux. Just put them in a folder and use them.

<comment><USER4> Nice. I've missed the static binaries on the homepage and should have tried static compilation myself. Now my little python2 and find-based scripts exporting ncdu-compatible outputs[1] on systems without ncdu seem a bit redundant. On the other hand, there are some examples of filtering the output with jq.

[1]: [https://github.com/wodny/ncdu-export](https://github.com/wodny/ncdu- export)

</comment></comment></comment><comment><USER5> An observation: I have always taken the meaning of the word "illustrated" to specifically refer to non-lexical graphics. Searching the dictionary definition of the word, I find a looser definition that applies to "examples" intended to aid an explanation.

This is a similar cognitive dissonance to when I first learned that "Visual Basic" and "Visual Studio" meant that the syntax of the displayed code was highlighted, not graphically represented in a non-lexical way.

<comment><USER6> I've always assumed that the "Visual" in VB and others refers to the WYSIWYG drag'n'drop interface for creating GUIs.

<comment><USER7> Same here—though for the same reason I always thought "VSCode" was a strange name since it doesn't have any of those interfaces.

</comment></comment></comment><comment><USER8> I'm gonna sound like an old person here. As much as these tools are gorgeous and ergonomic, remember that the others are standard, which means they're available (almost) everywhere.

Still though, these alternatives seem great for productivity locally, even if they're not usable in a script.

<comment><USER7> I've actually found myself using these to get me much more proficient in the Shell overall. fd in particular is so much easier to use I find myself doing things like:

      fd .log$ -x mv {} {.}.bak

      (Rename *.log to *.bak)

Can I do that with xargs, awk, and find? Yes, but every time I have to look up the man page to at least one of them and it's enough friction that I might just open it in finder if it's a handful of files.

Having some of these utilities around is a crutch that let me leverage the entire ecosystem much more when I don't have it. And when I do log into a shared enviroment and don't have my crutch, then it's easy to fill in the missing puzzle piece because it's one part that's missing and I've got the rest of the environment down.

Of course if all you do is shared environments I wouldn't suggest these, but I would encourage people to use these to get more familiar with the CLI ecosystem.

<comment><USER9> bash/zsh: for f in *.log; do mv "$f" "${f/%log/bak}"; done

a bit more generic, `for` loops and parameter expansion are good to know for proficiency, and also I dislike typing curly braces.

<comment><USER10> This doesn't move files in subdirectories? Or am I missing something?

<comment><USER11> You are right, it does not. But the find command is not too complicated, or different from the one above.

<comment><USER7> find has awful ergonomics that are completely unlike any other common unix tool. I can never remember the syntax, how the flags work, or what order things need to be in.

Let's use an example I just dug up of using find:

To list and remove all regular files named core starting in the directory /prog that are larger than 500KB, enter:

      find /prog -type f -size +1000 -print -name core -exec rm {} \;

OK first, how in the hell is 1000 == 500kb? Is that a bug in my example[0]? What does `-print` do exactly? And that backslash at the end? I have no clue what that signifies. I'm never going to remember this madness. I'd probably have resorted to writing a bash script in a file by now. But with fd it becomes manageable and memorable for future tasks:

To list and remove all regular files named core starting in the directory /prog that are larger than 500KB, enter:

      fd --type=file --size=+500k ^core$ ./prog -x rm {}

Now that's something that makes immediate sense even if you've never touched the tool before. Not to mention, it doesn't end up in my .git and other ignored directories.

[0] [https://kb.iu.edu/d/admm](https://kb.iu.edu/d/admm)

<comment><USER12> Your fd command:

Why type=file and a size? What else has size in 500k range on a filesystem, except files?

=+500 isn't how math works, that's implying it could be -500 or using equals for an inequality because the commonly used greater than symbol is off limits, it's a learned bodge.

500kwhats? Bits? Bytes? Base2? Base10? Can I put a suffix on, is it kB and kb case sensitive?

Why is your filename on the left of the folder you want to look in? That's so backwards to the left to right order /folder/files are normally written.

Why do you have some arguments with double dash, some with single dash, some with no arg name at all, what's the pattern for any of that?

What's -x and why is it short for a word beginning with E?

Why is the find command executing anything at all?

It's no more immediately sensible than find, it's inconsistent scribble and workarounds you've learned instead of the same that you haven't learned.

<comment><USER13> > _Why type=file and a size? What else has size in 500k range on a filesystem, > except files?_

Directories. They have a size depending on the metadata list of included files they contain. And can retain their size even if their inner files are deleted (until some cleanup style process is run).

> _It's no more immediately sensible than find_

Oh yes, it is.

The same nitpicking for find would take 10 days, and wont be as contrived...

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER2> A number of the utilities mentioned here (bat, fd, hexyl) are made by the same author, who makes a number of additional command line utilities in Rust. They're all rather easy to use and aesthetically pleasing, I'm a fan of their work: [https://github.com/sharkdp](https://github.com/sharkdp)

<comment><USER14> This man is also creating awesome tools: [https://github.com/BurntSushi](https://github.com/BurntSushi)

</comment></comment><comment><USER15> I always find exotic command-line tools cool but they never stick because Im constantly sshing/using/targeting a variety of systems I don't own that don't have them readily istalled

<comment><USER16> If you have access to the build tools, you can compile and install stuff in your home directory.

A bit tedious, but you would still get to use your favourite tools.

<comment><USER7> Encryptable, portable home directories is one of the goals of systemd. I can't wait until one day when I just ssh in and it's all there

</comment></comment></comment><comment><USER17> I would add

[https://github.com/drbig/snb](https://github.com/drbig/snb)

[https://github.com/dandavison/delta](https://github.com/dandavison/delta)

[https://github.com/MitMaro/git-interactive-rebase- tool](https://github.com/MitMaro/git-interactive-rebase-tool)

</comment><comment><USER18> As much as I do use a number of these tools, there's something to be said for being able to use any box you ssh or log into that has the default tools available on any *nix system. ls, cat, find, etc. I'm hypocritical a bit in that I do use rg, and fd, but I just can't bring myself to deviate too far from the 'default'.

<comment><USER8> I often use the term "standard" in place of "default" there.

</comment></comment><comment><USER19> really bad name for "dot", it has always been the graphviz interface

<comment><USER20> Indeed, and graphviz's dot is really useful, too. It makes it really easy to make all sorts of graphs. For example, if I wanted to make a dependency graph of all the packages I have installed in Archlinux, I can use it like this:

      pacman -Qq | xargs -r pacman -Qi | awk '
        BEGIN { print "digraph deps {" }
        /^Name/ { n = $3 }
        /^Depends On/ {
          for (i = 4; i <= NF; i++)
            print "  \"" n "\" -> \"" $i "\";"
        }
        END { print "}" }
      ' | dot -Tsvg > package-deps.svg

</comment></comment><comment><USER21> The guide mentions a dotfile manager, but here's something I found[0] on HN a while ago that's really cool: just make your home folder a git repository.

[0] [https://news.ycombinator.com/item?id=11071754](https://news.ycombinator.com/item?id=11071754)

</comment><comment><USER22> Amazing how many of those are written in Rust and Go.

<comment><USER23> I don't think it says much about the tools themselves though, it just makes sense when you look at the author's GitHub and see a bunch of Rust projects.

<comment><USER24> I think there are a couple of relevant factors

\- Can be distributed as a single binary, not requiring an interpreter and virtual environment. \- Being more fun to make a hobby tool in due to minimal footguns compared to C/C++. \- Really good dependency management and build tool making it easy to compose these CLIs out of powerful building blocks (at east for Rust). For example, ripgrep is broken up into a lot of packages that you can compose together to make your own custom tool.

</comment></comment></comment><comment><USER25> Can someone explain the misuse of cat, which bat solves?

<comment><USER26> Catting a file will your terminal make interpret escape codes in the file.

For instance:

        $ echo -e "\033]0;${USER} is an unfriendly person\007" > test-file.txt

Then, many days later:

        $ cat test-file.txt

will change your terminal title.

With less, you _can_ interpret escape codes, but usually you don't, and I consider this the correct default.

<comment><USER19> in your example it is not cat who "interprets" the escapes, but echo

<comment><USER26> Neither one interprets the sequence, but cat will print the file unfiltered to stdout, and stdout is processed by your terminal, and then the terminal will interpret it. less filters before printing to the terminal.

<comment><USER19> I meant that "echo -e" transforms the four characters "\033" into a single byte, for example. Thus, the sequence is "interpreted" by echo. Then, the cat program just copies the bytes without looking at them. If you want "cat" to escape these bytes so that they are not seen by the terminal you can use the "-v" option.

<comment><USER27> The sequence that translates to an escape code is interpreted by echo. The escape code is passed unfiltered by cat for the terminal to interpret.

</comment></comment></comment></comment></comment></comment><comment><USER28> No mention of things that have gained a lot of traction, like `ag` and `fzf`

ag: - silver searcher, fast parallelized recursive grep that can abide by things like `.gitignore`

fzf: - fuzzy finder

powerline-shell - $PS1 on steroids

<comment><USER24> It does mention rg which is in the same category as ag and, maybe this is my own bias, seems to have more mindshare now.

<comment><USER29> Agreed - I used to use Ag but switched to Ripgrep. Better in every single way, in my opinion. It's obscenely fast and has good defaults

</comment></comment></comment><comment><USER30> What about yq, for parsing the increasing amount of yaml? Though there seems to be multiple competing tools by the same name...

[https://github.com/mikefarah/yq](https://github.com/mikefarah/yq)

[https://github.com/kislyuk/yq](https://github.com/kislyuk/yq)

</comment><comment><USER31> in order to avoid having to unlearn commands like cat and ls, I use aliases to invoke bat and exa.

Here's a screenshot of my fish config: [https://twitter.com/mxschumacher/status/1168993005744918528](https://twitter.com/mxschumacher/status/1168993005744918528)

<comment><USER7> I would do

      alias ls "exa"
      alias ll "exa -ll"

That way you get the nice shorter output which comes in handy for piping ls things like:

      ls -d | xargs ls

Lists the files in subdirectories.

<comment><USER31> good idea - thank you!

</comment></comment></comment><comment><USER32> Nice post! Surprised to not see httpie mentioned.

</comment><comment><USER33> Lots of cool stuff in here. I'm going to have a long look at Restic and Syncthing.

I'd like to know why Skim instead of FZF. They are pretty similar but I've been using the latter for years and would like to know of any possible advantages to it.

<comment><USER17> There's _a lot_ of these pickers and they are indeed similar. I've been using [https://github.com/jhawthorn/fzy](https://github.com/jhawthorn/fzy) since it's not fullscreen and has a really good matching algorithm.

<comment><USER34> fzy is cool and probably underrated. It's the preferred fuzzy utility for file manager nnn too.

</comment></comment></comment><comment><USER35> My code editor does a fair job of finding things for me, I know I won't use ripgrep/fzf that often :shrug: On the other hand I would recommend fish shell (replacement for bash) with z plugin and http (replacement for curl).

</comment><comment><USER36> An alternative to z, which I find a little bit "smarter" is autojump.

</comment><comment><USER37> What's the terminal prompt shown the graphics?</comment>


Apple adds much anticipated TRIM support in latest OS update - <AUTHOR> http://www.appleinsider.com/articles/11/06/27/apple_brings_trim_support_to_all_ssd_based_macs_in_mac_os_x_10_6_8.html

<comment> matthew-wegner This is still for Apple-sold SSDs. You can use TRIM Enabler to enable for 3rd party brands: <http://www.groths.org/?p=308>

I run TRIM Enabler on two machines with no ill effects (Intel and Mushkin SSDs).</comment>