On the nature of time [BBC] - lobo-tuerto http://www.bbc.co.uk/dna/h2g2/A3577241 FWIW after reading this I felt like the time I finally got C pointers right.<p>If you pay attention you can even feel your mind expanding a little bit... ;) <comment> lobo-tuerto FWIW after reading this I felt like the time I finally got C pointers right.

I think you can even feel your mind expanding a little bit... ;)</comment>


Most of us feel sleepy in the afternoon. Why can't work fit round that? - <AUTHOR> https://www.theguardian.com/commentisfree/2019/may/29/sleepy-afternoon-work-fit-lull-flexible <comment><USER2> Perhaps we could propose a new name for that sort of thing .... I know, let's call it a 'siesta'.

Unfortunately, modern cities with long commute times preclude that sort of lifestyle where people went home for a meal and an afternoon nap. A lifestyle which worked exceedingly well in the past.</comment>


Facebook adds corrective label on user's post under new Singapore fake news law - <AUTHOR> https://www.reuters.com/article/us-singapore-fakenews/facebook-issues-first-correction-notice-at-singapores-request-idUSKBN1Y4043 <comment><USER2> So, Singapore bureaucrats decide what is fake and what is the ultimate truth.

What is facebook going to do after it bends to multiple state actors whose ultimate truth would contradict each other? Each country would have it's own corrective label like some western media do?

<comment><USER3> Isn't this what Sacha Baron Cohen asked for in his speech? That there be state mandated rules on what's fake vs not. I don't think this issue has any good solutions - damned if you do, damned if you don't. The only 'okay' way to solve for this is to crowd-source a variety of opinions on the issue and show what else people are saying about it - not as the ultimate truth, but rather to broaden people's perspective on it that there are different ways to look at the same issue.

<comment><USER4> I've always wondered how Wikipedia has solved this... Isn't it essentially the same problem?

<comment><USER5> Wikipedia built a culture in which editors who lean towards truthful informative are encouraged, and a userbase which values that. This is only possible with non-profits having strong voluntary and academic participation. Nobody will dedicate quality time for a closed for-profit network like Facebook.

But I feel that the bigger problem is that people want fake news. Most people have a hard time living their everyday lives; fake news which supports their choices and viewpoints is a release, and it makes them feel good. And networks do a good job of surfacing similar content once they gauge one's interests.

<comment><USER6> The sheer volume of user-generated traffic on Facebook suggests that plenty of people are willing to dedicate quality time to it.

</comment></comment></comment></comment></comment><comment><USER7> I believe this is the post: [https://www.facebook.com/SingaporeHerald/posts/2400459390172...](https://www.facebook.com/SingaporeHerald/posts/2400459390172238)

For me it isn't showing any notice, but I'm not based in Singapore.

<comment><USER8> Nothing with my Singapore VPN location either.

<comment><USER9> This is what it looks like: [https://imgur.com/a/yLD5sLn](https://imgur.com/a/yLD5sLn)

</comment></comment></comment><comment><USER10> A clear example of how speech on Facebook has everything to do with power and money and nothing to do with the principled defending of speech because (as Zuck said) "The ability to speak freely has been central in the fight for democracy worldwide".

Facebook might have actually had its hands tied here, but the point is that content on Facebook is subject to the influence of power and money, _not_ the influence of principles.

At least the notice is "X says Y is false" rather than "Y is false".

<comment><USER11> What exactly are Zuck's options in this situation?

If anything this shows he's right: look at what happens when you have no freedom of speech.

<comment><USER12> Freedom of speech has nothing to do with private platforms that are subject to market effects. Zuckerberg's claims that corporations can and will guarantee free expression is obviously not true.

<comment><USER13> Freedom of speech as a legal concept certainly impacts platforms. Platforms can choose to enforce their own rules that are more restrictive than strictly what the law requires, and in doing so they are making market-based choices. However, they can't choose a set of rules _less_ restrictive than what is legally allowed in a jurisdiction and expect to still be able to do business for long. You could claim that's a market decision too, but it's one driven by laws around freedom of speech.

</comment></comment></comment></comment><comment><USER14> What is this secret channel governments use to reach Facebook? And why only some governments can do it? Germans have won dozens of court cases against Facebook, for example in election meddling, while in smaller countries there simply is no legal entity called "Facebook" you could sue in local courts. I just wish Germans would win one case in European Union election meddling, then we would have EU-wide legal precedence.

</comment><comment><USER15> Does Facebook have an office in Singapore? How is FB "legally required" to do something because of Singapore law?

<comment><USER16> Yes. [https://opencorpdata.com/sg/201004959C](https://opencorpdata.com/sg/201004959C)

</comment></comment><comment><AUTHOR> Discussion about Singapore making the request: [https://news.ycombinator.com/item?id=21661958](https://news.ycombinator.com/item?id=21661958)

<comment><USER17> Also [https://news.ycombinator.com/item?id=21626540](https://news.ycombinator.com/item?id=21626540)

</comment></comment><comment><USER18> I wonder if the government of Singapore has created a Ministry of Truth to go on Facebook and mark posts as fake.</comment>


Hands on with Apple Pay Competitor CurrentC - <AUTHOR> http://johnszumski.com/blog/hands-on-with-apple-pay-competitor-currentc <comment><USER2> I really don't understand what the companies involved with MCX are thinking. They build an app that is going in the opposite direction of where the market is heading and limit the amount of payments they accept.

I was in line at 7-11 at my university, where an girl was trying to use the currentc app. She was 2 people ahead of me, when I went up to pay she was still trying to pay with the app. At first her screen was to dim, and the scanner would not read the QR code. Eventually she was able to pay, but I was already long gone by that time. If you look on the google play store it has a rating of 1.1 starts.

This is straight from its website,"Merchant Customer Exchange is the only merchant-owned mobile commerce network built to streamline the customer shopping experience across all major retail verticals."

With an app that rates 1.1 stars and no improvement, I don't think it cares about the shopping experience, and people will see this eventually.

<comment><USER3> A clue to what the companies are thinking from the article:

"Its payments are also routed from the retailer to the ACH system instead of the credit card system, which saves retailers from having to pay interchange fees (typically around 2% of the transaction amount)"

<comment><USER2> Yea I realized that when I was thinking about it. Which is a financial smart reason, but in the end it limits them.

If I only have my phone which I have android pay on and I need to get something from a drug store, I would go to CVS but they don't accept NFC. So I will have to go to Walgreen's instead which is usually near a CVS. So I don't get why they don't offer NFC, because keeping 98% of the transaction amount is better than 0.

<comment><USER4> If your margin is only a few percent, 2% is a big deal.

What matters to a retailer isn't the revenue, it's the difference between costs and revenue.

<comment><USER5> Walmart is also smart about this. They algorithmically determine how many cashiers to have at certain times of the day, under the assumption that even though some people may give up and leave instead of waiting in line, its still more profitable for that to occur than to staff more cashiers for everyone to complete their purchases in a timely manner.

In the real world, its about profits, not volume.

</comment></comment></comment></comment></comment><comment><USER6> In Australia retailers have supported NFC in the form of Visa's payWave and Mastercard's PayPass for years now and I've got to say, it's fantastic compared to the experience in the US.

Walk into a supermarket/retailer/cinema/restaurant in Melbourne and payment is as simple as waving your card at the terminal. If the purchase is less than ~$100 you don't need to enter a PIN and don't need to sign anything (we outlawed signatures for domestic payments mid last year). It's just done. Visa/Mastercard/banks generally cover any fraudulent purchases using the system so you don't need to worry too much about fraud.

In addition to this, since the US tech companies generally don't appear to have cared about the rest of the world until now, our banks have provided us with contactless payment apps for our phones and unlike the numerous standards being developed in the US, the banks' apps work with the existing payWave/PayPass systems that are already supported.

The reason I'm bringing this up is to show just how behind the US is when it comes to payments. I'm currently living in the Bay Area and the only places I've been able to successfully complete a purchase using a contactless payment method are Office Depot and Whole Foods. Most fast food places don't accept it, most retailers don't accept it, most businesses in general don't accept it. In Melbourne at least nearly everywhere accepts it, from coffee shops to supermarkets to tech retailers.

Even the US's move to EMV is backwards. The country has the second highest credit card fraud rate in the world yet when moving to a "more secure" system, signatures are still being retained as "authentication" or "authorization" despite being literally attached to the back of the card.

The US is fantastic when it comes to technology but when it comes to banking and payments it's incredibly dated and behind.

<comment><USER7> I don't understand why you praise NFC but condemn EMV on the basis of fraud. In both cases, the possession of some physical item is considered sufficient for authorization. Copying that physical item is sufficiently difficult that it's probably not an avenue for fraud, so you have to actually steal somebody's card.

If physical card theft is actually a big deal, then NFC would be just as bad. If it's not a problem and fraud comes from copying the information, then EMV is just as good. No?

<comment><USER6> Yes, now that you point it out it does seem odd. The physical presence of the card and lack of authentication are common to both methods but:

\- NFC reduces risk by limiting transactions to $100.

\- EMV is slower (much slower) and more cumbersome due to the requirement that a signature still be collected and the card be inserted into the terminal. This takes a minimum of 15-20s while exchanging receipts etc compared to NFC's ~1s.

NFC has the same level of security while reducing risk and increasing convenience.

<comment><USER7> It's pretty common not to require a signature on smaller purchases. It depends on the merchant and the card, but most purchases under $50 are just swipe and go. Presumably they'll change to be insert and go.

I totally agree with you that NFC wins for convenience and speed. I just don't see much of a security advantage, and it looks to me like EMV should substantially reduce in-person fraud, since you won't be able to copy them the way you can copy magnetic stripes. The card companies seem to think this way, at least: the way they're pushing EMV isn't to require it, but simply to say that if you _don 't_ have it and you participate in a fraudulent transaction, you're liable for it.

<comment><USER6> That's true but it's still possible to make a completely unauthenticated $4000 purchase with a physically stolen US credit card.

I didn't mention this earlier but NFC payments over $100 generally only require a PIN be entered but this is a relatively (to signatures) painless process and comes with the benefit of requiring something not printed on the credit card.

For small payments, NFC is faster. For large payments, NFC (at least as implemented in Australia, with PIN), is significantly more secure.

<comment><USER7> That certainly does sound better for fraud, but that's just a policy choice, not anything inherent to NFC or EMV. NFC could be without limits (I think that's how it is in the US) and EMV could require a PIN (as is typically the case in Europe).

It would be interesting to see the breakdown of different types of credit card fraud. How much fraud is physically stolen card versus copied card versus online purchases? I have no real idea myself.

</comment></comment></comment></comment></comment></comment><comment><USER8> Between the privacy concerns and the fact that it's ACH only, it sounds like it has a tremendous benefit for retailers.... and precisely none for me.

</comment><comment><USER9> I believe CurrentC's (Paydiant's) QR code tokenization works the same as you've described Apple Pay tokenization - the merchant POS does not see any payment info other than a one-time-use token.

This was another decent teardown of Paydiant's Subway app - but it looks like someone high up has had some of the code redacted :) [http://randywestergren.com/reverse-engineering-the-subway- an...](http://randywestergren.com/reverse-engineering-the-subway-android-app/)

Functionally, it looks like CurrentC only has two advantages over *Pays - loyalty integration and big box retailer backing. Not likely enough, but will be interesting to see how it plays out in the lower end market where a flagship device is not required...

<comment><USER10> As far as loyalty integration, there is some of that in Apple Pay -- it supports my local supermarket and drug store (Wegman's and Walgreen's, respectively).

<comment><USER9> Any chance you can point me to a good demo? I haven't seen a good single-scan loyalty/payment demo for ApplePay yet, and the SamsungPay demo seems to imply it but isn't very clear...

</comment></comment></comment><comment><USER11> I have to say, just because of the privacy implications, I'm much more inclined to use Apple Pay than CurrentC.

<comment><USER12> I'm not an Apple Pay user -- is their privacy policy any good? Does it not collect metadata?

The article highlights CurrentC's brazen lack of privacy. From their policy:

> We share your information across our network of merchants and with our third > party service providers. MCX may share...To third-party analytic providers > and advertising partners to help us deliver, track and analyze the > operations and effectiveness of our marketing campaigns, promotions or > advertisements.

<comment><USER13> Apple Pay's privacy is much better. AIUI:

Apple knows nothing about your cards (they are all encrypted on-device), and nothing about your transaction except that there was A transaction (since Apple just sees a token that gets passed from you to the card provider).

The merchant doesn't see your real cc number, just a one-use token. So they can't track you unless you choose to add a loyalty card.

The card provider sees all details of the transaction. Just as now, and what you want.

And the real cc details are stored in dedicated silicon on a fingerprint- locked device.

<comment><USER14> > The merchant doesn't see your real cc number, just a one-use token

It's worth noting that the token is one-per-vendor, rather than one-per- payment. This is what allows TFL to match your tap-in to your tap-out on the London Underground, and what allows them to apply daily/weekly capping on fares.

</comment></comment></comment></comment><comment><USER15> Just the name ("CurrentC") seems like it's going to lead to numerous Who's-On- First kinds of interactions...

A: "Do you take CurrentC?"

B: "Of course we take currency."

A: [Pulls out CurrentC app.]

B: "Oh, no. We don't do that."

Might do better if it sounded distinct when spoken. Like "Apple Pay."

A: "Do you take Apple Pay?"

B: "No, we only accept payments in currency, not in fruit."

A: [Pulls out CurrentC app.]

B: "We don't take that, either."

[Audience laughter, applause, and scene.]

<comment><USER16> First time I tried Apple Pay in a McDonald's drive thru I ended up with an apple pie added to my order.

</comment></comment><comment><USER17> "...retail customer's money is on the line in the event of fraud..." is a good point that may just slide by. The fact that corporations have significantly moved to evading any kind of responsibility through various means from regulatory capture to force arbitration and market monopoly; it strikes me that the factor of risk to the retail consumer aspect will play a huge role. It is a huge competitive disadvantage, to both not develop something well and with vigilance towards security like Apple Pay is, while also then setting in place a framework for conveying to customers that "if there is fraud because of our poorly designed and developed system, we are going to duck and weave like champions".

Do you want to keep away customers, i.e., revenue, because that's how you keep away customers.

</comment><comment><USER9> Did more research - it seems like this article is wrong about fraud liability (in addition to QR tokenization). There are plenty of things wrong with CurrentC, no need to make stuff up...

 _To further protect CurrentC™ consumers, our zero-liability policy protects consumers in the event unauthorized or fraudulent charges are made to their checking account as a result of unauthorized ACH transactions processed through BIM._

[http://finance.yahoo.com/news/mcx-adds-bim-guaranteed- ach-17...](http://finance.yahoo.com/news/mcx-adds-bim-guaranteed- ach-170000793.html)

<comment><USER8> Even with a zero-liability policy, the money is coming directly out of your bank account, and will be put back in eventually, after investigation.

Since the only person that's out money is you, no one has financial incentive to speed the process.

</comment></comment><comment><USER18> The article seem to suggest that your phone requires a working internet connection in order to make a payment. This seems like a huge limitation compared to Apple Pay (and presumably Android Pay?), which does not.

</comment><comment><USER19> > 3 security questions

Why are these still a thing? Is it regulations or something?

</comment><comment><USER20> Sounds great!</comment>


Show HN: A Firefox Extension "Quick Update Checker for Hacker News" - <AUTHOR> https://addons.mozilla.org/en-US/firefox/addon/quick-hacker-news/ <comment><AUTHOR> I guess that's not as interesting or as impressive as others Show HN but this is my modest contribution to a problem that I think I'm probably not the only one to face. Opening a new tab to check HN a dozen times a day can be painful so here is an alternative.

<comment><USER2> I do most of my HN tuning in GreaseMonkey. Then again, that's not an ideal way to share it.</comment></comment>


"What took us a weekend to do, has taken 18 months here." - <AUTHOR> http://radar.oreilly.com/2008/11/building-the-legacy-systems-of.html <comment><USER2> > "While I agree that the enterprise is about control and the web is about > emergence, I don't think this negative characterization is all that useful. > It seems to imply that the enterprise's orientation toward control springs > fully formed from the minds of an army of petty controlling middle managers. > I don't think that's the case."

Control and closed-ness is far more endemic. It stems from marketing and sales, which are much more important to the profit-driven stock owners who are really in charge. For example, Amazon tries to get users to stay on their site longer and buy more. It has little to do with technology coolness or a sincere connection with users. Contrast that with a web company trying to fain a foothold with innovation and collaboration.

I don't get the rest of the article. Could he not plainly state that there is a difference in openness and closedness between the two cultures? He already mentions APIs, which sums up the point pretty well. Maybe he's trying to say we can learn from the bumbling insincerity of enterprises?

My take is to stop writing about differences or produce more muck. Just focus on sincerely making good things. Lead by example without bullshit. I see great things happening all the time in this direction.

<comment><USER3> Strange that you left out the follow-up for that, I thought it was the most insightful part of the article:

 _It seems to imply that the enterprise's orientation toward control springs fully formed from the minds of an army of petty controlling middle managers. I don't think that's the case._

 _I suspect it's more likely the result of large scale system dynamics, where the culture of control follows from other constraints. [...] Once you have GAAP, Sarbox, domain-specific regulation like HIPAA, quarterly expectations from "The Street," decades of MIS legacy, and the talent acquisition realities that mature companies in mature industries face, the strange attractors in the system will pull most of those shards to roughly the same place. In other words, the IT enterprise is about control because large businesses in mature industries are about control. On the other hand, the web is about emergence because in this time, place, and with this technology discontinuity, emergence is the low energy state._

</comment></comment><comment><USER4> I agree with some of his points, but he ignores the economics of starting something when he says that "all the cool kids will have moved on to building sea floor geo-thermal something-or-others".

No teenage coolness will ever overcome the fact that starting industrial ventures requires lots of capital whereas computer programming (hacking as it's called here) does not. Powerful tools combined with low capital requirements is always going to attract a lot of experimentation.

</comment><comment><USER5> This writing in this article reminds me of the science fiction Charles Stross writes. It has lots of interesting points on enterprise IT versus web 2.0, but imho would have been a better read if it was a little bit more straightforward.

</comment><comment><USER3> While some parts here are interesting, this is pure silliness:

 _...it's a realization that the fun part of the web is probably more behind us than ahead of us_

tehehe. I guess, with time, we'll see...</comment>


Airlines Make More Money Selling Miles Than Seats - <AUTHOR> https://www.bloomberg.com/news/articles/2017-03-31/airlines-make-more-money-selling-miles-than-seats <comment><USER2> "A soldier will fight long and hard for a bit of colored ribbon" \- Napoleon.

What strikes me about this is the behavioral decision making aspect. The airlines - and many other loyalty rewards programs - have tapped deeply into the human tendency to accumulate currency, however meaningless. And as someone who is well aware of this tendency, I still gleefully watch my credit card points balance increase every month, even though it really means I'm spending a ton of actual money. I don't begrudge the airlines at all for this technique. It intrigues me than in our advanced society, we are easily fooled by simple measures.

<comment><USER3> I'm currently at 512 karma and counting...

<comment><USER4> 512 karma ought to be enough for anyone.

</comment></comment></comment><comment><USER5> I don't understand. I read about half of the article and it doesn't explain how that works.

I mean money has to come from somewhere, I assume the tens of millions of credit card holders. But credit card holders do their usual spending, and in fact save between 1% and 3% on their monthly bills instead of paying more.

Unless.

\- They increase their air travel frequency.

\- They get addicted to collecting airline miles, because it gives them the feeling of free air travel.

\- And as a result they increase their average spending (so no longer the 'usual' spending), and buy useless stuff, just so they can collect more and more miles.

Is that the real story or something more/different?

<comment><USER6> One way normal credit card companies makes money is this way: They charge the merchant a fee (1 to 4%), and in exchange they give a 1-2% cashback to the customer. They make profit on the difference.

With a deal with an airline, the company doesn't have to do the 1-2% cashback, instead they give 0 to the customer. The airline company will give them miles though. Now the airline company can say to the credit card company: "look these thousands of customers you have them only thanks to me, so let's split your profits from the merchant 50/50 (or at least give me that 1% cashback you don't have to pay the customer), plus at some point I'll have to actually offer a plane ticket to those customers who earn enough miles"

What a customer gets usually is something like 7 miles per dollar. Consumer website estimate[1] that in the best of case, a mile is equal to ~$0.01, so they're also saving money there. (Plus the money the credit card company give them is today, whereas the plane ticket might be in one year or more, so the present discounted value of that ticket is even less)

[1] [https://thepointsguy.com/2017/04/april-2017-monthly- valuatio...](https://thepointsguy.com/2017/04/april-2017-monthly-valuations/)

<comment><USER7> > What a customer gets usually is something like 7 miles per dollar. Consumer > website estimate[1] that in the best of case, a mile is equal to ~$0.01, so > they're also saving money there.

Your math is way off. If it's 7 miles per dollar spent on the card, that is 7% back by your math, compared to 1-2% cashback, this conflicts with "they're also saving money there."

With that math, you're saying that it's a great deal for the consumer. Perhaps the other things you mentioned still add up to being in the airlines favor, but whats really going on?

<comment><USER8> The marginal cost of a single passenger is fairly low to an airline. That's why they have blackout days, and restriction on where you can actually fly with earned credit-card miles... in order to make sure the cost of your flight is _always_ to their benefit or at worst break even.

</comment></comment></comment></comment><comment> tuna-piano 1\. There's a reason high margin businesses are so rare- generally, competition will bid the prices down to more reasonable levels of profit. I understand each airline has their own branded credit card, which they have pricing power over. But besides branded cards and direct mileage purchases, why would mileage margins stay so good? Surely the mile buyer would have negotiation power between the airlines. Why can't these mileage buyers (banks, rental car companies, etc) get lower prices for the miles, given the high margins? Is it possible there is mileage price collusion among the airlines?

2\. How do airlines account for the cost of mileage seat redemptions when calculating their margins? Do they just use their marginal cost of carrying that passenger (very small)? In my mind, the cost of selling a seat with miles should be at least as much as the lowest price they charged other paying customers. If a plane flies 100% at capacity with mileage redeemers onboard, certainly the airline could have sold the mileage seats for at least about the same as the lowest ticket price paid onboard. I'm skeptical that this how they account for it though...

3\. Like others have mentioned, the miles game really is fun for many people. It's fun to collect points, to win things, and get the satisfaction of free travel. In general for me psychologically, the price of airline tickets is the bar for whether a trip is worth taking or not- regardless of the other trip expenses. When you get a vacation with free redeemed airline tickets, it somehow feels so incredibly satisfying.

<comment><USER9> 1\. It's a matter of reference. Even with the 40+ margin airlines put over the miles price, banks put even more. In the end the one who is paying for it is the consumer. Also, this mileage programs are made by contract over a period of time, and airlines usually don't have contracts with different banks. This lack of "liquidity" makes it harder for banks to have an upper hand in negotiations. 2\. Airlines have different ways of calculating the cost, but usually they use the normal price as a proxy for the redemption price. Airlines actually can charge less than the cheapest fare because they segment their consumers by travel patterns and (sort of) split the flight total seats into this different segments. So they have a certain quantity of seats alloted for redemption passengers at X price, another for Y price. This would become a long reply if I explained in detail, but I suggest you search for "Revenue Management" or "Yield Management", as it is very interesting to see how airlines do their pricing. 3\. Yes. Absolutely! Even after being in the industry (I worked with Revenue Management for a Latin American airline), I still love a good mileage program. I even choose my banks over it.

</comment></comment><comment><USER10> I think this industry won't last for very long. Mile-earning cards are dependent on merchants paying high fees. In most of the developed world, interchange fees have been capped (e.g. 40bp in the EU). Once that happens, these rewards credit cards disappear overnight (which is what happened in the UK shortly after the IC regulation).

Eventually, I think the US will have its own cap on interchange fees. Credit card rewards will then cease to exist. It's fundamentally inefficient.

(But perhaps lobbyists are more powerful here than in the EU / Australia?)

<comment><USER11> I don't think that will happen for multiple reasons: 1\. Australia and UK still have mile earning credit cards. In fact, in my experience, countries that cap the maximum amount of late fees and interests tend to have lower mile earning possibilities through credit cards than countries that cap the interchange fees. 2\. Lobbies in the US are powerful and consumer protection in the US are traditionally less strong. 3\. A move to reduce credit card rewards would likely be unpopular (it's very easy for lobbyist to spin any move to cap interchange fees as politicians taking away the rewards from credit cards)

I believe that credit card rewards are a form of tax on people who mismanage their money to benefit the ones who are good at managing their expenses and money. It's subsidized by all people paying interest on their balance, paying late fees and the interchange fees.

I was going to say that it's a tax on the poor to benefit the rich but I know people with high income that never seem to manage to pay their credit card balance in full and I believe it's really those people that generate revenue for the banks.

<comment><USER12> Credit card rewards are also indirectly subsidized by people who pay with cash or debit cards, since merchants effectively charge these people more than the people who pay with credit cards.

</comment></comment></comment><comment><USER13> If you use these airline cards thoughtfully, they're a great deal for the consumer. Last year United offered both myself and my wife 50K miles to sign up with no annual fee for the first year. Then they threw in some club passes and more miles when we added each other, spent some amount, etc. We ended up each getting 55K miles or so. Then United had a mileage sale for tickets to Australia - 60K miles per roundtrip ticket. Combined with the miles we already had, we ended up with two free round-trip tickets from the US to Australia. Of course we never carried a balance on the cards and cancelled them before the yearly fee came in. Now we'll wait a year and sign up again.

</comment><comment><USER14> I've never found the airline credit cards to be the best deal for purchases. I can get 1.5-2% cash back on some cards (even higher on certain types of purchases), but the best value is either Chase Sapphire Reserve (essentially 3% back on travel/dining, and potentially more if you redeem for miles), or SPG Amex (2.2-3%, minimum, and sometimes higher).

Airline cards are worth it for status, and for the bonus for on-airline purchases, but not for general purchases.

<comment><USER15> _Airline cards are worth it for status_

Of the big three US airlines -- American, Delta and United -- no credit card that I'm aware of grants automatic elite status in the frequent-flyer program.

There are cards available which, if you hit a spend threshold, will convert some of the redeemable miles into status-qualifying miles, and this can _assist_ with reaching status, but the thresholds are set high enough that this is out of reach of many people.

The closest any card that I'm aware of comes to automatic status is the Delta Reserve Amex; if you spend $60,000 on the card in a calendar year, it converts enough redeemable miles into Delta MQMs to award the lowest tier of status in Delta's frequent-flyer program. But the cost of this is spending $60,000 each year on the card, and all you get in return is near-worthless Silver Medallion status.

In general, the airlines have learned their lesson on this one: redeemable miles are an inflationary currency they can give away by the millions and not have to worry since they can adjust the redemption charts any time they like. But genuine elite status in the frequent-flyer program is more expensive to give away, and they've worked to make that hard to get.

\--

For those unfamiliar with the world of airline programs, the general idea is (again, in terms of the US big three -- America, Delta and United):

* Elite status is what gets you things like free first-class upgrades, access to the fancy lounges, etc.

* There are two classes of miles you can earn. Redeemable miles are simply what the name implies: you can exchange them for a ticket to fly. Redeemable miles are handed out like candy.

* Qualifying miles ("Elite-Qualifying Miles" or "EQM" on AA, "Medallion-Qualifying Miles" or "MQM" on Delta, "Premier-Qualifying Miles" or "PQM" on United) are how you get to elite status. Within the frequent-flyer community they are often referred to as "BIS" miles, short for "Butt-In-Seat", as actually purchasing a ticket with cash and flying is the primary way they can be earned. There _are_ other ways to earn them, but not many and the amount you can earn is usually too limited to be a viable way to earn/maintain status.

* All three now also impose a requirement of qualifying _dollars_ ; remember I said the airlines learned their lesson? There is now a minimum dollar amount per year you must spend on tickets in order to obtain each level of status, and that amount is weighted by fare class to prevent hitting the threshold from super-discounted fares.

* Airline-branded credit cards which earn miles will only earn you redeemable miles. Some high-end cards (as mentioned above) convert fixed quantities of redeemable miles to qualifying if you spend a _lot_ of money on the card. Most cards will also either get you a credit toward a qualifying-dollar threshold, or waive the qualifying-dollar threshold, which can make qualifying for status easier.

* Airline-branded credit cards can give you some perks which resemble those of elite status -- priority boarding, free checked bag, etc. -- but this is not the same as having status and many of the nicer benefits are not available in return for simply holding a credit card; you must actually fly enough to achieve the upper status tiers.

* Low-level status (AAdvantage Gold, Delta Silver Medallion, or United Premier Silver) is close to worthless. Your upgrade privileges -- for both first-class and for extra-legroom economy seats -- are largely theoretical at this level, the additional redeemable miles earned are not enough on their own to justify maintaining the status, and the other benefits typically are all available to credit-card holders.

<comment><USER16> Nice summary; thanks for taking the time to write this.

I'll never qualify for a first class upgrade, but I am willing to spend redeemable miles to do so if it's say a vaction trip with my spouse. It's a wholly different flying experience.

</comment></comment></comment><comment><USER17> TLDR: Airlines make large profits from the credit card loyalty programs; the specifics are typically hidden from outsiders.

</comment><comment><USER18>
        Beyond the cash, carriers reap something else from the cards: These deals remain lucrative in both good times and bad, as they are immune to economic cycles. That's because of the addictive nature of miles, a dubious commodity that tens of millions of Americans, particularly those who fly for their jobs, will probably never quit.

        "In a recession, that [bank] business will go down, but it should provide a very high cushion to the airline," DeNardi said in an interview. "That's the real benefit here: It speaks to downside protection for the industry better than anything else."

So they earn money by selling miles to the CC companies who give the miles to customers who spend. So if spending goes down won't there be fewer miles to buy?

Or is the point that general spending with CCs isn't correlated with people buying airfares?

<comment><USER15> Indenting to get fake-blockquote style makes your comment completely unreadable on mobile, and in this case also on desktop without a lot of annoying horizontal scrolling. Please consider not doing it. If you need to indicate a quote, you can always do paragraphs _in italics_ , or use quotation marks, or just _say_ you're quoting and indicate where the quote ends.

</comment></comment><comment><USER19> Heh, I just bought a ticket from SLC -> CHI for around a $100. AA had a nice little add(?) showing it would cost me $0 (minus tax and other fees) if I got their card. I was just thinking how crazy that was.

I've personally never found the use for a credit card from a specific airline to be useful for a casual traveler. I generally like to shop around for the cheapest price between all available carriers. There is no incentive for me to stick with a single carrier to get those miles simply because I can't afford to travel that much.

I also don't have those credit cards from walmart, Khols or <insert business name here> though. When I first came to USA, someone told me having multiple cc can lower your credit score and credit score is life. So I am still scared of credit cards.

<comment><USER20> > When I first came to USA, someone told me having multiple cc can lower your > credit score and credit score is life.

That's strictly the opposite of true.

Now, _carrying a balance on_ multiple credit cards, or paying multiple cards _late_ , is worse than the equivalent with a single card. And _applying_ for lots of credit cards _quickly_ can hurt you.

But just _having_ multiple credit cards, that get paid off every month—or don't carry a balance at all— _helps_ your credit score: the "positive side" of your credit score is computed as (effectively) the amount of money that people are currently contractually obligated to give you if you ask (i.e. the limit of all your credit accounts + loans + equities added together.) If you can get more companies to extend you credit, that has the same positive benefit as getting your limit raised on a card you already have.

<comment><USER21> I'm not sure that the "don't carry a balance at all" helps your credit score. I've heard some places say that a utilization of 1%-9% and the balance being paid at end of each billing cycle will help increase one's credit score more than 0%.

> On the other hand, using a low percentage of your available credit can have > a positive impact. In some cases, a low credit utilization ratio will have a > more positive impact on your FICO Scores than not using any of your > available credit at all. [1]

[1] [http://www.myfico.com/CreditEducation/Amounts- Owed.aspx](http://www.myfico.com/CreditEducation/Amounts-Owed.aspx)

<comment><USER22> FICO score in excess of 820 here.

The difference in credit score if I were to have a small balance at a statement is literally < 1% of my score. I've done it as an experiment (having a non-$0 balance on statements to show utilization, not carrying a recurring balance and paying interest), and the difference has been typically 2 or 3 points. In my case, that's a fraction of a percent improvement.

That is not a meaningful difference that would affect interest rates I could get from a lender. I would get the same rates at 828 as I would with 825 as I would with 790 as I would with 770. There is no meaningful positive difference that having a non-zero utilization provides to your FICO score.

</comment></comment></comment></comment><comment><USER23> "These deals remain lucrative in both good times and bad, as they are immune to economic cycles." So were tech stocks and real estate until they weren't. This time is different because loses will only affect banks, no big deal.

</comment><comment><USER24> At the end of the day, it is the merchant that pays upto 4% of their transaction as fees to these banks, and that money travels through several pockets before some hits the consumer back. I know I'm about to move out of the US. So I signed up for several high rewards credit cards and racked up their signing bonuses and travel rewards. The hit on credit score is not bothering me either :-) Essentially free money to me for using credit cards for stuff I would have done anyway. ~$3500 in free money so far and counting..

Oh and I pay those bills in full on time. So no fees to them. Feels good to score against the banks :-)

<comment><USER22> > _Oh and I pay those bills in full on time. So no fees to them. Feels good to > score against the banks :-)_

It's weird, but the reality is the rewards from credit cards can be ridiculous, whether percent-cash back, miles (for heavy travelers) or signup bonuses. For those unaware, there are people who try to maximize the signup bonuses in particular through a process called "churning", mostly to travel for near or at no cost at all. There's very detailed guides on how to maximize the signup bonuses.

I don't churn, but I do try to maximize what I can get back for things I buy anyways.

* One card gives me 6% cash back at grocery stores. I do eat food after all (I cook 99% of my meals, and rarely eat out). I also use them as my pharmacy. 6% off food and medication -- two things I can't live without -- is pretty good. There is a fee for this card, but the cash back puts me at +$285 back a year after the annual fee.

* Amazon gives me 5% back off what I get through them. Sure, I'll take another 5% off.

* One gives me 5% off gasoline. I tend to need gasoline at the moment. Sure, I'll take that!

* Two have rotating 5% categories, that tend not to overlap. So sometimes I can get 5% off something I needed anyways. Great!

* One gives me 2% back that goes into my IRA. If I had kids, I could put it in their 529 instead. Automatic planning for the future on anything where I'd normally get just 1% instead. Sweet!

* This year I moved and planned on getting a new dishwasher, washer and dryer. So I searched for cards with a cash-back on spend signup bonus. Found one that best matched, which was $300 back if I spent $3000 in the first 90 days... plus 1% cash back on the card. Got $334 back in total on money I was going to spend anyways, which was a 10% discount. Sure thing!

I realize merchants pay higher fees to give me these rewards. If these huge rewards go away, that won't bother me. I'll still use the cards with lower rewards, because something is better than nothing, the issuers fight harder than my bank would if I used debit and things happened, and I haven't ever paid a cent in interest on a credit card.

<comment> nommm-nommm I know what each card you mentioned is except the gas one. Which card gives you 5% on gas?

Also, with the Fidelity card you can, if you choose, open up a cash management account (totally free) and get that 2% in cash without any restrictions at all.

<comment><USER25> PenFed has a card that does 5% on gas (although there are more strings attached now versus the card I have) [1]. Additionally it has no foreign transaction fee. It's well worth becoming a member if you will ever want to finance a car, their rates are typically very good.

Otherwise, the only card that I regularly use that isn't on the parent comment's list is from Golden1 [2]. 3% on restaurants and grocery.

Both of these are a little more work than usual to sign up for (especially Golden1) and their websites are pretty basic, but as they're both credit unions their terms are a bit friendlier. The cash back is immediately credited to your account each month, and their phone support is typically quite helpful.

I have the 2% Fidelity card deposit into a Fidelity Cash Management account, which is just a checking account with no restrictions or fees. It refunds ATM fees, which has been huge for me.

[1] [https://www.penfed.org/affinity-cash- rewards/](https://www.penfed.org/affinity-cash-rewards/)

[2] [https://www.golden1.com/CreditCards/Cards#tabs-2](https://www.golden1.com/CreditCards/Cards#tabs-2)

</comment></comment></comment></comment><comment><USER26> It's rather simple -- don't use credit cards, don't borrow money.

<comment><USER27> Sure, if you like leaving money on the table that's a simple thing to do.

<comment><USER26> I'll tell you a secret -- you can keep your money in a bank and have a _debit_ card.

<comment><USER28> The parent isn't talking about not using banks. They are saying that using debit cards (or cash) to do transactions when you could be doing the same transaction on a credit card and getting free points is akin to leaving money on the table.

This year I made several hundred dollars worth of points for which I did not have to alter my spending behavior at all. I am buying plane tickets and staying in motels and filling gas and renting cars and eating out and blah blah, credit card or not, points or not. It's ridiculous to not want to get back 1-3% of that money as long as you have even a bit of control on your spend. If you actually have a decently paying job so that you don't have to rely on credit cards to borrow money that you can't return, it's perfectly rational to have credit cards and pay the points game.

</comment></comment></comment></comment><comment><USER29> The credit card company is probably getting the miles at a steep discount, but I wonder how many people actually use their miles before they expire.

<comment><USER15> Airlines don't really use expiration as a way to control this anymore; while they haven't all moved to non-expiring setups, it's usually easy enough to keep current that it won't matter (i.e., in many cases miles expire based on a period of inactivity on the frequent-flyer account, but adding miles through card usage counts as activity).

The way they prevent it being too large a loss is by periodically devaluing, so that the cost in miles/points to purchase a ticket goes up over time.

</comment></comment><comment><USER30> The other great thing here for airlines is that they can devalue the miles at any time, which they do on a regular basis.

</comment><comment><USER31> Collecting miles is an art. (See Flyertalk). In my experience:

\- You can collect the miles but it is very difficult to use them. I think I had this problem with AA, if I remember right. They were rated last in a Frequent Flyer Miles Ranking I once saw.

\- It is easy to use the miles (Lufthansa, can use for every flight, even pay taxes with miles) but they don't give you the miles. Lufthansa was #1 in the ranking. I flew something like 100k miles and they credited 10k miles based on Booking Class and cross carrier miles crediting (Star Alliance).

</comment><comment><USER31> Also, sometimes the employer pays for the miles.

If you get reimbursed for your flights, some airlines give you much more miles if you buy a ticket (Economy has many sub classes) that is slightly more expensive (e.g. 100 Dollar more, double miles). This is a "nice" way to collect miles and have somebody else pay for it.</comment>


Criminal investigation at Austrian ski resort where hundreds were infected - <AUTHOR> https://www.telegraph.co.uk/news/2020/03/24/criminal-investigation-austria-ski-resort-hundreds-infected/ <comment><USER2> The following page from ORF has great information going back to February and is updated twice a day.

[https://orf.at/corona/stories/3157533](https://orf.at/corona/stories/3157533)

<comment><USER3> Note website is non-english.

</comment></comment><comment><USER4> Non Paywalled: [http://archive.is/8V7yo](http://archive.is/8V7yo)

</comment><comment><USER5> Health services of different countries should simply send invoices to Isgil, Tyrol and Austria..

</comment><comment><USER6> Paywalled

<comment><USER7> Prefix the URL with outline.com/

Mods please let me know if this not allowed

<comment><USER8> Copyright does not deserve voluntary submission anyways. It is an unjust and ever stricter becoming legal framework to give life support to an industry that is unwilling to adjust to new technological realities.

<comment><USER9> You're suggesting copyright is obsolete because technical means of protecting content are so easy to circumvent.

That's absurd, considering laws protecting rights that are easily protected by, for example, physical means are entirely unnecessary.

The only reason we have laws against burglary is to allow us the benefits of not living in a personal fortress. To turn this around and deny anyone going out in public without a personal protection detail the benefit of laws against being robbed or raped is indistinguishable from just scrapping all criminal law.

The other, more common and less interesting (but equally wrong), assumption you're making is that there is some secret business model that thousands of publications and journalists have somehow missed to see. Or, alternatively, the strange situation of gleefully enjoying the decline of journalism, coming up with all sorts of accusations to deny that their work has any value for you or society, while simultaneously spending 8+ hours these days reading their work.

<comment><USER8> I'm saying that copyright is unjust. It violates fundamental individual freedoms of people like freedom of expression to achieve goals that do not justify that mean, and is therefore illegitimate.

The comparison to laws that protect people is invalid because copyright does not protect people. It grants governmentally enforced monopolies. Copyright has a legitimate goal. There is a value in certain activities for society and copyright is a governments intervention to increase that activity.

There are other things that are considered so important that the government takes action to provide them, like for example social security, health services and infrastructure. That is realized by taxation. I'm suggesting that the state should use taxation to ensure the activity of those who rely now on copyright so the restrictions of individual fundamental freedoms is gone.

Note that copyright has become even more restrictive with time. There are situations where people are forbidden from singing a song on a birthday party in public. This is an example of where the unjust restriction of individual freedoms becomes apparent.

And I'm saying that this injustice in some situations is so grave, that we should show civil disobedience and try to break and mock copyright when possible as a form of protest.</comment></comment></comment></comment></comment>


Google Has Secret Interview Challenges Based on Your Search History - <AUTHOR> http://thehustle.co/the-secret-google-interview-that-landed-me-a-job

<comment><USER2> " For my interview, I spent a day at Google headquarters in Mountain View solving problems on a white board."

2015, with a laptop in every lap and a large screen/projector in every conference room, and we're still scribbling code on a whiteboard at one of the largest software companies in the world.

This might have been fine twenty, fifteen years ago when even at Microsoft my machine was a 30 lb. tower under my desk, and I had a 14" CRT monitor. Even if you can't reserve a conference room for your interview, you can use one of the 22-27" monitors on your desk. _Anything_ is better than scribbling and correcting code on a whiteboard like a monkey performing tricks.

</comment><comment><AUTHOR> Just verified this myself... pretty cool! I searched for the following:

      * Mutex lock (from the article)
      * Mutex lock C++
      * Python list comprehension

Third time's a charm! The prompt came up, and now I've got a simulated shell of sorts that looks a bit like linux but doesn't have most commands.

The main command is "request", which lets you request challenges through this shell. Requests are defined as follows:

      foobar:~/ guest$ help
      [snip]
      request	- request new challenge (of type 'tag') [tag]

      foobar:~/ guest$ tags
      Requesting tags...
      algo         	algorithms
      data_struct    	data structures
      low_level      	low-level representation (binary representations, endianness)
      math           	math
      crypto         	security and cryptography

Had a 2nd friend try the same who's not a coder, and it didn't work, so they're looking at more than very-recent search history.</comment>


WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents - <AUTHOR> https://www.nytimes.com/2017/03/07/world/europe/wikileaks-cia-hacking.html?action=Click&contentCollection=BreakingNews&contentID=64996424&pgtype=article <comment><USER2> I wonder how often and extensively these tools are shared between intelligence agencies.</comment>


Google Maps for Android lose offline Maps - seriously? - <AUTHOR> http://www.droid-life.com/2013/07/09/new-google-maps-7-0-0-goes-live-in-google-play-here-is-the-new-ui-we-saw-at-google-io/ <comment><USER3> I suspect this might be down to the 'dynamically generated' maps feature in the current maps.google.com preview.

Either way, unless Google has somehow managed to bypass extortionate data roaming charges, spotty local coverage, and absurd latency It's pretty much made maps useless for me.

At least before, when my phone has decided to not connect to the network, or latency has spiked up to 30s I could still look at the map and get places.

<comment><USER4> Yup. It's frustrating for me since I used a winmo device 7 years ago with TomTom that provided flawless offline maps. There doesn't even _exist_ a comparable offline maps program for newer Windows Phone OSes... Google abandoning offline maps in the Android OS is another reflection of this trend, but the world's infrastructure just isn't there yet, especially when you leave California - here in Southern Ontario, coverage is good but the cost of data plans for all is prohibitive once you've got a family full of people with phones.

Of course, Google has been eschewing offline support throughout Android - <USER2> the anemic and non-expandable storage on their entry-level Nexus devices, pushing their cloud-based music service instead of the traditional "just load songs onto the device" approach, and so on.

This massive technological regression on disconnected mobile software is really disappointing.

<comment><USER5> Windows Phone 8 has offline maps via Nokia Here, you can also use Nokia Drive to get offline navigation. Both are free and have helped me navigate without a data connection in Europe, Asia and North America.

<comment><USER4> Oh, right. I forgot that Nokia had made their exclusive thing. My phone is just a Samsung WP7 device that's getting really long in the tooth.

<comment><USER5> Yeah unfortunately for WP7 you needed a Nokia device to get the Nokia apps, all WP8 devices get them though.

</comment></comment></comment></comment></comment><comment><USER6> You can cache the current map area that you're looking at by searching for 'OK Maps'. [1]

[1] - [http://googleblog.blogspot.in/2013/07/a-new-google-maps- app-...](http://googleblog.blogspot.in/2013/07/a-new-google-maps-app-for- smartphones.html)

<comment><USER7> Does that strike anyone else as a weird thing to do? They write

"Instead we've created a new way for you to access maps offline by simply entering "OK Maps" into the search box when viewing the area you want for later."

err.. Simply?

<comment><USER8> Weird is an euphemism here. It's totally incomprehensible change.

My wild guess it's targeting voice commanding, which I practically never use as voice recognition is still not reliable enough (and I'm not always comfortable with shouting at my phone in public).

<comment><USER9> The "ok" prefix is the one that Glass uses. I wonder if there's some implied integration there. That the feature is hidden from the UI makes me think this was supposed to not be in use until Glass is out, until someone internally kicked off and said "WHAT DO YOU MEAN OFFLINE MAPS WON'T BE AVAILABLE UNTIL GLASS IS OUT?!"

</comment></comment></comment></comment><comment><USER10> It is a very useful feature when you're abroad. To uninstall the update : open the launcher -> drop the maps icon on the "App Info" label -> Uninstall updates

<comment><USER11> I 2nd this...

</comment></comment><comment><USER12> Osmand for android will let you download the the OpenStreetMaps maps for states or countries for offline use.

<comment><USER13> I've found OsmAnd to be a great app and it being powered by OSM just makes it better.

(btw, it's OpenStreetMap, not OpenStreetMap _s_ )

</comment></comment><comment><USER14> There are tons of alternatives to Google Maps, maybe not as complete but decent enough. Just switch to one of them and that's it. I'm using MapsWithMe.

</comment><comment><USER15> Did anyone use offline maps really anyway? I know I never have. I bet the number of people that actually used the offline feature was a small percentage anyway.

<comment><USER16> Just use OpenStreetMaps (aka [https://play.google.com/store/apps/details?id=net.osmand](https://play.google.com/store/apps/details?id=net.osmand) ) and download half of Europe if you wish. Just works, and the navigation was for me (at least in Italy) better than with Google Maps.

<comment><USER17> Thanks for the tip!

<comment><USER18> also check out Oruxmaps. not free software but free of cost and very feature heavy and fast.

</comment></comment></comment></comment><comment><USER19> Perhaps this update was launched by a conscientious objector within the Googleplex.

</comment><comment><USER20> It never occurred to me to even try using Maps offline.

</comment><comment><USER21> Meh. The only useful thing (for me) in there is the navigation; for everything else (offline maps, route recording, geocaching, tens of map providers), there's Locus ;)

</comment><comment><USER22> Type 'OK Maps'

</comment><comment><USER23> Couldn't they just cache some ads as well instead of limiting features. They could also log GPS and send it back later so they don't lose location data.</comment>


Show HN: HRCloud2 v1.0 – A full featured home hosted cloud and app launcher - <AUTHOR> https://github.com/zelon88/HRCloud2/ <comment><AUTHOR> Hi there! I posted an alpha version of this app but I think my over-reaching title then pushed a lot of people away. It's a couple months and about 10k LOC later so I'm ready to try again. I hope you all enjoy the project as much as I have, or at least walk away with something of value. Thanks for the clicks!

Repo: [https://github.com/zelon88/HRCloud2/](https://github.com/zelon88/HRCloud2/)

Wiki: [https://github.com/zelon88/HRCloud2/wiki](https://github.com/zelon88/HRCloud2/wiki)

YT Development Playlist: [https://www.youtube.com/playlist?list=PLVbKN4o8V_4OSXI0SGGBM...](https://www.youtube.com/playlist?list=PLVbKN4o8V_4OSXI0SGGBMxRvXTZJT3YM_)</comment>


WiFi deauthentication attacks and home security - <AUTHOR> https://mjg59.dreamwidth.org/53968.html <comment><USER2> In Norway/Oslo there is a lot of people with equipment sending deauthentication packages, jamming neighboring equipment, and one of the main reason for slow Internet (lot of jitter). Did some research on this together with The Norwegian Communications Authority (NKOM) to isolate the problem.

If you want to check for yourself if someone close by i sending deauthentication packages; fire up a Mac and:

1\. Open Wi-Fi-diagnostics and change to 'Sniffer' from the Window-tab

2\. Dump 30sec-1min of data. The dump is saved to /var/tmp ending with .pcap

3\. Open the .pcap file in WireShark and search for wlan[0] == 0x0C

For all the different WiFi packages to filter for: [https://www.willhackforsushi.com/papers/80211_Pocket_Referen...](https://www.willhackforsushi.com/papers/80211_Pocket_Reference_Guide.pdf)

The router Synology RT2600AC is the only one I have found that guard against deauthentication packages by supporting WPA3 and PMF (encrypt management frames). iOS 13, Mac OS Catalina and Windows 10 support WPA3 so it comes down to your router.

<comment><USER3> > by supporting WPA3 and PMF (encrypt management frames).

OpenWRT 19.07 adds wpa3 support and the linux kernel supports 802.11w so probably many more APs could be secured.

<comment><USER4> You don't have to have WPA3 to have PMF though. You just have to search more which APs support 802.11w.

<comment><USER5> Just to clarify: the attack depends on reading (unencrypted) management packets going from the AP to the device, and if PMF is enabled on the AP, it will only send encrypted management packets so the attack is not possible. Is that it?

</comment></comment></comment></comment><comment><USER6> I am NOT a laywer, but I checked how much of what the article describes is illegal in Germany. The answer is just about everything.

Installing a doorbell with a camera that looks into the hallway is illegal. You may not record what happens in public spaces on security cameras. And even inside your home, you still have to ask for consent to make an audio recording. Otherwise, this constitutes a crime.

Also, sniffing Wifi for data not aimed at you is illegal. The law is quite broad and covers unencrypted data. Sniffing MACs of devices that don't communicate with your own network falls under that. Sending deauthenticarion packages using those MACs proves the intent to deliberately obtain that data. Thus might even result in a prison sentence. Deliberately interfering with the operation of a Wifi network may also constitute computer sabotage, but the bar for that is higher.

EDIT: I also forgot: creating the program that is intended to specifically interfere with the doorbell is also punishable. This is one of the rare cases where the preparation of a crime constitutes a separate crime in itself. The same goes for the distribution of such tools.

<comment><USER7> You might find it interesting that some German universities [1] actively send out deauthentication packages to clients that connect to SSIDs that are not on their internal whitelist to "protect" the clients from "rogue APs".

A lecturer from my Hochschule was fired for protesting this practice.

[1]: [https://meinehochschulebehindertdaswlan.de/](https://meinehochschulebehindertdaswlan.de/)

<comment><USER8> From a network admin's perspective- this is necessary to protect the integrity of the air space. It discourages the use of rogue AP's which wreck the channel utilization for everyone. It's common to find this feature in enterprise wifi systems. Some actively spoof the SSID of the rogue AP in order to draw the client back to the institution's network.

<comment><USER9> And what about the people who don't/can't use the institution's network? Why should the institution be allowed to effectively monopolize the unlicensed airwaves?

<comment><USER10> If I was in some kind of debate club or moot court or something like that and got assigned to side that is supposed to argue for allowing this, I'd probably look into some kind of property rights approach and make a distinction between radio waves transiting the property and radio waves that originate on the property.

The property owner could make not operating an access point on the property a condition of granting permission to enter the property. Someone who then operated an access point would be trespassing and they (and their access) point could be evicted. In other words, the property owner is already allowed to monopolize those unlicensed airwaves on their property.

If they choose to exercise this monopoly by using technical measures to stop other access points from working, rather than by physically evicting those access points, why should that make a difference as long as those technical measures do not interfere with access point not on their property?

<comment><USER9> >If they choose to exercise this monopoly by using technical measures to stop other access points from working, rather than by physically evicting those access points, why should that make a difference as long as those technical measures do not interfere with access point not on their property?

By the same argument, can I also ban cellphones from my property and set up cellphone jammers to enforce this ban? You're free to set up arbitrary "rules" and ban people from your property for it, but that doesn't mean you're deputized by the government to do whatever you want to enforce those rules.

<comment><USER11> Emergency calls are given a lot of special protections, and for this reason, you cannot.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> I need help with something much more nefarious. I know of a location in a downtown area where someone has set up a malicious wifi "thing". I'm guessing the PWNAGOTCHI since the device changes patterns and comes and goes? It has learned how to use deauth to do man-in-the-middle attacks and absolutely closed down wifi in a half block radius by sending RTC packets of 12 second wait times and also waiting for others to send RTC packets and transmitting over them. Businesses close to it have no wifi. As you move away, wifi starts to improve. And no, it's not flooded as there is plenty of open air time not being used by the many devices there.

Steps taken: \- Have talked to multiple business owners nearby and they can't figure out why their wifi won't work. \- Comcast Business is worthless and weeks of calls by business owners and multiple tickets have led to nothing. \- Have talked to the mayor of the town and their tech guy agrees something is wrong. \- A "smart guy" that works for the government doing security did a quick scan and said it was because one wifi was on a channel between 1 and 6 so the overlap was causing the problem... that wasn't it. \- Have approached university researchers to see if their students would be interested in looking at/for it. No response. \- Have walked with laptop watching signal strength and know roughly which building it is coming from.

From what I understand, there is NOTHING one can do to attack it, other than sending massive RF interference, which would be a crime in itself.

How the heck does one get rid of this thing? Any suggestions?

<comment><USER13> Confused, it seems you realize this might be a crime, but you've talked to everyone except the most obvious point of contact—law enforcement. Is there a reason that's not an option?

<comment><USER12> Agreed. But evidence? I've tried to convince the businesses to talk to the police. But, what they heck do the police/businesses do? How do you prove that there is a crime? They probably would believe me and would probably knock on doors and probably get a warrent. Then what? I'm not a professional cyber security person so how do I prove that device if found is causing damage?

Also, the device is intermittent. I can collect traces, but who do I send them to?

<comment><USER14> I called the police once when I noticed a wifi AP that was MiTM'ing traffic at the local Kroger. They sent someone out and said it was a misconfigured system in the Deli.

Guy was real nice and seemed to understand what I was worried about.

<comment><USER15> In the US, what law makes it illegal to MitM network traffic using a WiFi evil twin or other technique? I'm genuinely curious because I was under the impression there are generally no such statutes and that the only thing that would be illegal is if the MitM used found credentials.

<comment><USER16> Possibly the CFAA?

<comment><USER15> The CFAA only applies to protected computers and intrusion into those computers. Watching network traffic or modifying network traffic in a MitM possition, without using found credentials doesn't seem to rise to the level of a computer intrusion. Of course, it's unlikely a protected computer is going to be connecting to a public WiFi AP in the first place..

[https://en.wikipedia.org/wiki/Protected_computer](https://en.wikipedia.org/wiki/Protected_computer)

<comment><USER13> > The only computers, in theory, covered by the CFAA are defined as "protected > computers".

> In practice, any ordinary computer has come under the jurisdiction of the > law, including cellphones, due to the interstate nature of most Internet > communication.

[https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#P...](https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#Protected_computers)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Seems widespread; sad state of affairs... wonder how many locations suffer from (mis)configured APs battling each other..

[https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortig...](https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate- wireless-54/suppress-rogue-ap.htm)

"In addition to monitoring rogue APs, you can actively prevent your users from connecting to them. When suppression is activated against an AP, the FortiGate WiFi controller sends deauthentication messages to the rogue AP's clients, posing as the rogue AP, and also sends deauthentication messages to the rogue AP, posing as its clients."

<comment><USER18> Rogue APs are generally defined as APs that you don't manage but have been connected to your wired network. Obviously this could be a significant security risk. I don't think they're sending deauth messages to every client/AP they see.

[https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortig...](https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate- wireless-54/monitor-rogue-ap.htm)

<comment><USER19> It looks like it allows you to mark any AP as "rogue" even if they're not detected as "on-wire" despite that not being the purpose of the feature.

</comment></comment></comment><comment><USER20> Did I read the article correctly in that it is possible to disrupt WiFi networks to make devices disconnect from it, without breaking its encryption? Wow.

<comment><USER21> Regardless of any encryption, wireless can always be disrupted via jamming. Even if management frames were encrypted you can still disconnect devices by jamming the signal.

<comment><USER22> The power requirements for jamming are much higher. Making it much easier to detect a jammer, and harder to run one. Also quite a bit more illegal.

Besides, jamming has a much less targeted effect than a de-auth.

<comment><USER21> When talking about home security I doubt the attacker cares much about legality, and detection requires specialised equipment, by the time it is brought in the robbery has already been committed and the attacker is long gone.

</comment></comment></comment></comment><comment><USER23> I think the title should be changed to something like "how to protect your privacy with Wifi deauthentication".

Incidentally, I was considering one of these devices as an addition to my home automation setup, then I realized that it would not be cool to monitor every person getting out of the elevators on my floor.

<comment><USER24> I suppose the idea of the article is to resist your neighbours monitoring you as you come home? That is actually a pretty good idea.

Also, deauth isn't anything new and you don't have to 'hack' anything in aircrack-ng since all of the tools for this are available out of the box, with nice configuration to select what has to be included and what excluded from deauth.

<comment><USER25> If you want to do this against arbitrary endpoints without knowing the channel they're on you can't just parse airodump-ng output and pass that to aireplay- ng - it takes too long. The hack is just to automate this within the same process.

</comment></comment></comment><comment><USER26> Does deauthing it actually stop it from recording and later uploading?

Wouldn't the Ring just buffer and send once it rejoined the network?

<comment><USER27> I doubt Ring devices have the local storage to do this.

</comment></comment><comment><USER28> > The industry doesn't seem to have learned from this.

I think industries follow the money. If the end user doesn't absolutely demand security features, then there won't be such features. Typically people who obsess about security build a product that provides security as a product (vs. a camera as a product).

The guy who wrote Minix makes this argument (and no, he doesn't dislike Linux Torvalds): There are solutions to security problems, but you need to be interested in them in the first place. The military for example is interested in microkernels because in their case security is critical. Minix I believe is written more for reliability (e.g.: uptime) and (better) security comes as a added benefit.

</comment><comment><USER29> People send deauth packets just for fun, as part of social networking. While it is fun for the sender, the those that are affected, are probably very annoyed.

[https://pwnagotchi.ai/](https://pwnagotchi.ai/)

<comment><USER30> Just beware that in many jurisdictions using that thing on other people's devices is punishable by serious jail terms. Sometimes even possession of such a device.

</comment></comment><comment><USER31> > The most interesting one here is the deauthentication frame that access > points can use to tell clients that they're no longer welcome. These can be > sent for a variety of reasons, including resource exhaustion or > authentication failure. And, by default, they're entirely unprotected. > Anyone can inject such a frame into your network and cause clients to > believe they're no longer authorised to use the network, at which point > they'll have to go through a new authentication cycle - and while they're > doing that, they're not able to send any other packets.

Anyone has background info on why the hell WiFi spec is designed this way?

<comment><USER12> A man-in-the-middle attack is what can happen here. Deauth and then the device tries to reauth. At that point, the attacker can pose as the router and collect the password hash. The WiFi spec has serious problems.

<comment><USER32> WiFi doesn't work the way you're claiming. You can use Deauth to be obnoxious/DoS but MITM could be accomplished without Deauth (via higher signal strength + cloned SSID) and WiFi Auth doesn't involve sending a "password hash" over the air that can be "collected."

WiFi is protected via PSK (pre-shared [encryption] key), public cryptography (via CA generated key-pairs), or RADIUS. With RADIUS auth you may be able to harvest the username but the password is used as a PSK which is a shared secret between the client and RADIUS server. This is a two way check (i.e. the client confirms the RADIUS backed WiFi AP has the password too). After they both confirm each other has the password, a different encryption key is used.

There's no WiFi Auth protocol that I know of that involves sending a password over the air (hashed or otherwise).

<comment><USER33> Absolutely false, the PTK is sent over the air and is constructed from a hash of the PMK, client/ap MAC, and client/AP Nonce. The attack the parent comment is describing is exactly why WPA3 was made with SAE. One need only capture 2 packets of the initial handshake to start offline cracking by comparing MICs and then you can decrypt the entire conversation since there was no perfect forward secrecy in WPA2 and older.

Also what you describe with RADIUS is incorrect as well but there are too many ways to configure 802.1x and RADIUS to cover all of why in a comment. Overall it is considered safer than WPA2 though so the conclusion is sound.

<comment><USER32> > Absolutely false

Let's first off go back to what I was replying to:

> At that point, the attacker can pose as the router and collect the password > hash.

By claiming my correction is "absolutely false" you're asserting that the above statement is "absolutely true." But even your technically unsound correction doesn't actually address the underlying inaccuracy of the original statement or why you seemingly believe it is "absolutely true."

It is also pretty clear from your reply that you're attempting to muddy the waters by conflating the PTK with the PSK or any other "password." The PTK isn't a password. It isn't like a password, and in order to derive it you need additional information which you need to attack (which is easier than attacking the PSK itself, thus WPA3's improvements, but doesn't make the above statement technically sound or true).

Your post reads like you decided to correct before having any corrections to actually make then tried to muddy the topic as much as possible in the hope that others would be fooled. Plus is "collect the password hash" really a hill worth dying on for WiFi Auth? That's obviously an unsound technical claim, that isn't how the protocol works at all (and you seemingly must know that given your knowledge).

> Also what you describe with RADIUS is incorrect as well but there are too > many ways to configure 802.1x and RADIUS to cover all of why in a comment.

So it is "incorrect" because I simplified it rather than describing the process in intricate technical detail? And you won't point out why it was "incorrect" because it is too technically difficult..? K.

<comment><USER33> > > At that point, the attacker can pose as the router and collect the > password hash.

> By claiming my correction is "absolutely false" you're asserting that the > above statement is "absolutely true."

Correct.

> technically unsound correction

Please explain how.

> It is also pretty clear from your reply that you're attempting to muddy the > waters by conflating the PTK with the PSK or any other "password."

The PMK is part of the PTK hash. When using a PSK the PSK = the PMK. Not much to conflate, the PTK is a hash of the password with other variables. Exactly as I explained.

> in order to derive it you need additional information which you need to > attack

I already explained how the rest of the information needed to derive the PTK is sent in the handshake frames.

> Your post reads like...

Please stick to talking about WiFi authentication.

> Plus is "collect the password hash" really a hill worth dying on for WiFi > Auth?

Prior to WPA3, yes - as explained already.

> So it is "incorrect" because I simplified it rather than describing the > process in intricate technical detail?

It was incorrect because the password isn't used as a PSK so cracking the PTK gets you a nonce instead of the user password.

> And you won't point out why it was "incorrect" because it is too technically > difficult..?

Given we are still trying to agree how the 4 way handshake works and what parts get hashed in it, yes - it is.

.

[https://www.wifi-professionals.com/2019/01/4-way-handshake](https://www.wifi- professionals.com/2019/01/4-way-handshake)

[https://security.stackexchange.com/questions/66008/how- exact...](https://security.stackexchange.com/questions/66008/how-exactly- does-4-way-handshake-cracking-work)

[https://www.aircrack-ng.org/doku.php?id=cracking_wpa](https://www.aircrack- ng.org/doku.php?id=cracking_wpa)

</comment></comment></comment></comment></comment></comment><comment><USER34> The proper thing to do here would be to call a HOA meeting to decide whether or not devices like these should be allowed in the common spaces. Typically a HOA will have pretty strict rules in the articles and household rules about what you can and can not do in common areas. Another angle is that you may live in a place where two party consent is required for recording, this is not a public space ('the street') nor is it a private area (the dwelling of the owner of the device).

Running this software is likely illegal depending on the jurisdiction might be anything from a misdemeanor to a crime.

</comment><comment><USER35> Does that mean you can monitor when someone is pushing your neighbors' ring bell?

<comment><USER25> You can certainly detect when your neighbour's doorbell is streaming video, yes.

<comment><USER36> Interesting, you could use it to turn your neighbors devices into unintentional motion detection sensors without them ever knowing. You could use it for foot traffic analysis or something.

</comment></comment></comment><comment><USER37> He doesn't describe an attack, he describe literally what 802.11 was designed to do. An attack is forcing a deauth and then stealing the 4-way handshake data and, say, cracking WEP. Which is why WEP was decommissioned ... _checks notes_ ... 15 years ago.

No need to edit aircrack-ng, WireShark does what he did natively (filter out and set channels), and a good realtek chipset allows you to set the scan interval so you can cover more channels (which is why the new ALFAs suck).

Also the DTIM and keepalive can be set such that the MCU can sleep while the phy link maintains a connection without a costly handshake, esp. if using TLS <1.3 to talk to the cloud. Reconnecting costs a shit ton of energy so they usually don't disconnect.

Hacking Wi-Fi has become exceptionally more difficult, as noted by the slow dating of materials at DefCon's WiFi Village over the past 8 years: cracking WPA2 is basically so hard no one bothers, even in CtF games.

<comment><USER5> Denial of service is also a type of attack.

</comment></comment><comment><USER38> Does anyone here believe there is now a market for securing the masses against the obvious gaping security issues associated with these devices?

"Smarter Home Networks" and creating a business around bolstering security on the slew of IoT devices available today.

</comment><comment><USER39> I'm not familiar with these devices. Are they not capable of caching a little (15 seconds or so) of recorded video (or much more audio) for sending later when it re-auths with the access point?

<comment><USER40> Probably, but it would block the alerting feature they highlight in their ads. That said, I find motion detection alerting to be useless on outdoor-facing cameras due to vegetation, weather, and wildlife. The false positive rate makes it annoying.

</comment></comment><comment><USER41> I've said it before and I'll say it again:

20+ years ago when I was a Windows sysadmin, you could immediately discern the technological savviness and technological _maturity_ of an individual by looking at their system tray:

The number of little icons in their system tray was inversely proportional to their level of this kind of technological maturity.

The system tray of 2019 is connected/smart/cloud devices in ones home.

</comment><comment><USER42> Depending on where you live, your neighbors recording audio may be illegal and you should confront them about it [https://www.southerncaliforniadefenseblog.com/2018/04/do- rin...](https://www.southerncaliforniadefenseblog.com/2018/04/do-ring- doorbell-cameras-violate-wiretapping-laws-pc-632.html)

<comment><USER43> Unlikely. Devices installed for security purposes cannot trigger wiretapping charges since there's no reasonable expectation of privacy in a public place and no intent to record confidential conversations in the first place.

Either way, it's not a well written post. I'd shred it here but the comments below it already cover what I would have said.

<comment><USER44> > Devices installed for security purposes cannot trigger wiretapping charges > since there's no reasonable expectation of privacy in a public place

These ring devices are also installed outside of the US. The law is entirely different in other countries. A statement as "no reasonable expectation of privacy": why not? Just because people could record and film you doesn't mean it's allowed or that it's ok.

For Netherlands: You cannot just have a camera recording the public. Though there's a bit of leeway, meaning if you have a camera recording your property it's logical that it'll record a bit of the road. You just have to minimize that bit. Interestingly enough, police actually encourages the installation of Ring camera's (so specifically Ring over anything else). It seems you can install these if it's just in front of your door and property. However, if they're on a flat (where neighbours need to walk by your door to get to your door), then you cannot have these.

<comment><USER45> > For Netherlands: You cannot just have a camera recording the public. Though > there's a bit of leeway, meaning if you have a camera recording your > property it's logical that it'll record a bit of the road. You just have to > minimize that bit.

This is simply not at all true. You can film anything you want in public. I believe the laws around publishing photographs or films of other people is a bit more complex though.

<comment><USER22> Pointing a permanent security camera at a public space as a private person really is illegal.

This is different from occasionally using a handheld camera.

Because one is surveillance that is meaningfully different from what you could do just by watching someone, and the other is not (this is my argument, not sure whether this is the legal argument in NL)

<comment><USER45> Well that scenario is prohibited by the GDPR (though I'm not sure if different authorities would have differing views on that). But the statement that you cannot film public scenes or the people who happen to be in them is simple false.

<comment><USER44> This article is about a Ring camera and something installed on a door. These things are static and do not move around. That is what I was referring to.

You could read this as something else, but IMO it was pretty obvious what I was referring to. And for static cameras I'm entirely correct. For other cameras there's been various new restrictions for them as well.

Your summary of "cannot film public scenes or the people who happen to be in them is simple false" for one distorts what I wrote, secondly, if you do this with a static camera, you will have a problem and your statement is _not_ true. Friends had a "crazy lady" with cameras pointing at public space. It took a while, but eventually the cameras were removed. Something similar you can find via Google, plus (work) building security mentions the same.

</comment></comment></comment></comment></comment></comment></comment><comment><USER46> It's surprising how easy it is to perform a deauth attack, you can also gain some information just by scanning the airwaves about the devices connected to a particular router.

I created a little tool as a test of this a while back: [https://github.com/dom96/deauther](https://github.com/dom96/deauther)

</comment><comment><USER47> If you go to /r/esp8266 there are far too many posts from kiddies asking for help with their deauther projects.

</comment><comment><USER48> >Finally, none of this is even slightly new. A presentation from Def Con in 2016 covered this, demonstrating that Nest cameras could be blocked in the same way. The industry doesn't seem to have learned from this.

Well that's a kind of fundamental flaw of Wifi networks, so you're kinda stuck with this if you use Wifi, nope ?

<comment><USER49> Says in the article "unless you use 802.11w" So, fixable; just not supported by everything.

<comment><USER50> Even 802.11w doesn't fix the fundamental problem... WiFi runs in an unlicensed band, and anything else in those bands might disrupt it. There is no service guarantee. You should never rely on it working, especially not for security or safety.

<comment><USER25> Anything running over rf is vulnerable to jamming. It's really just a matter of how much disruption an attacker is willing to cause.

<comment><USER51> > Anything running over rf is vulnerable to jamming

Yeah, and the same sentence can be changed to "Anything running anywhere is vulnerable to something" and it's still true. I guess the valuable lessons are "There is never any service guarantee" and "something will always go wrong" when you want to built something reliable.

</comment></comment></comment></comment></comment><comment><USER52> Owner of wired cameras that do not store data in the cloud unaffected.

<comment><USER53> Yep. Wired is always best. You get (almost) the entire electromagnetic spectrum to yourself for each device. There's no reason to share a single spectrum if you don't have to.</comment></comment>


OSTIF, QuarksLab, and VeraCrypt E-mails Are Being Intercepted - <AUTHOR> https://ostif.org/ostif-quarklab-and-veracrypt-e-mails-are-being-intercepted/ <comment><USER2> While their emails may well be getting intercepted, I find it somewhat implausible that a nation-state-level actor would go to all the work of intercepting their messages, but do so in such a way that they disappeared in transmission. That doesn't make a ton of sense. Sure, anything's possible, but have they really considered simpler explanations?

My recollection of how Gmail works is that posting messages to the "Sent" folder is a bit odd: in contrast to other email providers, where the SMTP server is completely separate from the IMAP / incoming server, Gmail has them connected so that if you send messages out via Google's SMTP, a copy of the message is automatically put in your "Sent" folder. (At least, this is how it worked for me, last time I checked.) This normally gets noticed because if you have your MUA set up in a sane way, where it files a copy of each sent message via IMAP into the "Sent" folder, you'll end up with duplicates. Thus, you have to suppress the normal MUA behavior when using Gmail and Google's SMTP servers.

Cf.: [http://superuser.com/questions/224524/sending-mails-via- mutt...](http://superuser.com/questions/224524/sending-mails-via-mutt-and- gmail-duplicates)

I wonder if perhaps someone had this Gmail configuration in their MUA, and then sent messages via an alternate SMTP server. Doing this would cause the messages not to show in Gmail's "Sent" box, and if that SMTP server was badly configured or behaving, could easily cause the messages to 'disappear'.

Since many MUAs will roll from one SMTP server to another if the first one is unreachable, it's not hard to imagine this happening 'mysteriously'.

<comment><USER3> NSA would definitely never make this mistake. PRISM works directly with Google to intercept emails. So this would assume Google made the mistake in Gmail, which is questionable. So that only leaves some other countries (assuming it is a country and not technical anomaly or human error).

China has been known to be sloppy like this when monitoring activists but that was probably not their top level secret services who monitor hacker groups - those people are usually going to be good.

Not using gmail is probably a good start regardless though.

</comment></comment><comment><USER4> These folks are probably smarter than me, but they might not be less paranoid.

I have previously been 100% sure something nefarious was going on, (somebody edited this file!!) and then discovered that I was connected to the wrong server, for example.

This is only meant to help them think clearly as they investigate.

</comment><comment><USER5> Why do I feel like I'm being trolled here? But maybe I'm missing something. Why are they using Gmail? Did they not get the various memos from Snowden? Are they not familiar with what happened to CIA director Petraeus?</comment>


$40k a year to attend Harvard University as me - <AUTHOR> http://pittsburgh.craigslist.org/wrg/4244720190.html <comment><USER2> Funny to think that the experience gained by attending Harvard for 4 years wouldn't be worth anything if you couldn't tell people you attended Harvard (due to the NDA).

Just goes to show that the degree, not the education, is what really matters.

<comment><USER3> Its one of the reasons I am "anti" university. I would love to go to university to learn, but I don't have the money and I refuse to put myself deeply in debt just to get a piece of paper to prove to that I have an education.

<comment><USER2> I guess I rationalize spending the money for University in two ways:

First, the cliché: You are almost guaranteed to make enough money coming out of college to pay off debt incurred in a reasonable amount of time. Anything extra from that point is profit.

Second: Use college as a time to not only learn what is being taught, but also to explore your crazy interests that would never get the time of day if you weren't being fed, housed, and taken care of. There is so much about college that you really do gain aside from the degree.

Definitely look into financial aid if you haven't already. I had many friends attend their first year of college without exploring financial aid, only to discover that their next 3 years could be 50% cheaper.

</comment></comment></comment><comment><USER4> Let's say that you pulled this off for four years (as the actual student). What is stopping you from telling Harvard that you actually did the work and hoping they recognize your effort by giving you a diploma instead of the guy who was hiring you? I assume only contractual terms about non-disclosure. Since the contract itself is probably in violation of the law in some way -- I'd guess that you've committed fraud -- is the NDA agreement enforceable? What happens to the $170k you've been paid? Do you have to return this? Would you both face criminal punishment?

<comment><USER5> Perhaps the knowledge that someone with the means and motivation to perpetrate a $170K fraud like this also has the means and motivation to pay $15-20K to have you harmed or killed.

[http://en.wikipedia.org/wiki/Contract_killing](http://en.wikipedia.org/wiki/Contract_killing)

"Make it look like an accident."

Actually, that's a risk even if you plan to abide by the NDA.

For what it's worth, I think this offer is an entertaining troll and not actually real.

</comment></comment><comment><USER6> I'd get an appointment just to know a bit of the story there.

</comment><comment><USER3> you know, if you go to Harvard for a law degree, you might be smart enough at the end of this to beat whatever case he tries to bring against you when you reneg on the nda.

<comment><USER7> Just set up a meeting, show up to find out who he is, and don't sign the NDA.

Then pass the info along to Harvard.</comment></comment>


Programmer and mathematician talking with each other - <AUTHOR> Programmer: Your mathematical verbiage in that shitty Russell-Whitehead notation is ambiguous. It cannot be verified by a machine. How do we know that it is not just a pile of bullshit?
Mathematician: That will be confirmed by another mathematician.
Programmer: How do we know that this other mathematician is not lying?
Mathematician: That will be ascertained by yet another mathematician.
Programmer: Theory of deception says that your Russell-Whitehead notation is gradually but surely turning you into a colluding gang of liars and impostors. In other words, none of you cannot be trusted. May I ask you: You do not really desire to solve the problem, do you?
Mathematician: True. We like things to be this way. There is simply no problem, and that is why all of us strive to find a job at the NSA. As I told you already, the problem that you are talking about, is just an illusion. <comment><USER2> a brief overview of the notation:

[https://en.wikipedia.org/wiki/Glossary_of_Principia_Mathemat...](https://en.wikipedia.org/wiki/Glossary_of_Principia_Mathematica#Symbols_introduced_in_Principia_Mathematica_volume_I)</comment>


WannaCry Sinkhole, Two Weeks and 16M Averted Ransoms Later - <AUTHOR> https://blog.kryptoslogic.com/malware/2017/05/29/two-weeks-later.html <comment><USER2> The fact someone tried to DDOS the killswitch is straight out of a Hollywood plot!

<comment><USER3> And that the floods lasted exactly 420 seconds and 666 seconds, those script kiddies are pretty creative when choosing numbers.

<comment><USER4> I mean, I _would_ expect script kiddies to be fans of both weed and Doom, so, not surprising.

</comment></comment></comment><comment><USER5> I am saddened by this.

WannaCry was doing a great job of partitioning data from people that should never have been "managing" it in the first place. I was really hoping that a significant portion of my data had been encrypted into the abyss for eternity.

<comment><USER6> > I am saddened by this.

> House fires were doing a great job of partitioning houses from people that > should never have been owning them in the first place. I was really hoping > that a significant portion of my house had been burnt to the ground.

WannaCry damaged heathcare systems and caused real suffering for many people. This is way beyond people deserving a nuisance for being incompetent. Creating it was a dangerous and criminal act that should be seen on par with physical sabotage of important systems. Should derailing a train be ok because the tracks are "just lying there in the open"?

<comment><USER7> While dangerous, it was waiting to happen. I think if we look back on this in 10 years we'll consider it a wakeup call and we'll be glad it didn't get far worse (as it could have, if the creators were competent).

<comment><USER8> Like how derailing a train is waiting for it to happen?

Exploiting weaknesses is still cybercrime, even if the target system was insecure. That's why there's black and white hats, and why white hat hackers can still get into trouble.

<comment><USER5> A better analogy would be bacteria in your mouth.

For years, you had billions of bacteria in your mouth, slowly disintegrating the enamel of your teeth and slowly burrowing cavities into your teeth. They consume the food you eat, then urinate acidic waste that destroys your teeth and gums. They do this so slowly that you don't even feel the acidic damage.

Then, one day, you use a very strong mouthwash that contains alcohol. The alcohol instantly kills billions of bacteria, all of whom urinate instantly all at the same time, in excruciatingly painful death. The acid level is so high that it causes a burning sensation in your mouth, you are like, "damn, this mouthwash burns, I'm not using this crap again!"

You saw the mouthwash as the bad guy. In reality, the bad guys were there all along.</comment></comment></comment></comment></comment>