Bulgaria writes new chapter in long story of demographic decline - alberto-m https://balkaninsight.com/2020/07/09/bulgaria-writes-new-chapter-in-long-story-of-demographic-decline/ <comment><AUTHOR> Bulgaria is a disaster due to being on the crossroads of the East, West, Russia, and Turkey and the multitude of geopolitical and economic interests andalso on the way of the drug channels from the Middle East to Europe. The Balkan mentality, greatly twisted in the half millennium of Ottoman rule, does not help much either. Things are much worse than what the numbers show, unfortunately! The kleptocratic governments are covered up by the US and EU just so that we can limit the influence of Russia in Bulgaria. Anyway, the moral, mental, and health decline is much worse than the demographic one! From a great example in the Soviet Bloc, we turned into the worst example in the EU! Neither the West, nor Russia has interest in Bulgaria being a modern country, because poor slaves are pulled by the nose much better!

Edit: I'm Bulgarian, I live in California since 1999, but I spend 2-3 months every summer in Bulgaria and witness the constant decline every time.

<comment><USER2> Ottomans have been gone for 200 years now, haven't they?

<comment><USER3> The Ottomans have been gone for less time than the US has been free of slavery. African Americans, as a group, are still struggling. I don't see why an entire nation should be recovered.

<comment><USER4> Comparing Bulgarians 200 years ago to african slaves in Usa is quite weird. Blaming Ottomans for the todays Bulgaria's all problems is beyond ridiculous, and maybe the sign of the real problem.

<comment><USER3> Would you prefer a comparison to Haiti, which gained independence 100 years before Bulgaria?

<comment><USER2> Did Bulgaria have huge indemnity to pay like Haiti?

</comment></comment></comment></comment></comment></comment><comment><USER5> Starting with the first sentence, I have 1 single word for this - bollocks.

> Google "Bulgaria" and "demography" and you will rapidly learn that > journalists and analysts have for years been reporting that the country's > population is one of the fastest shrinking in the world.

Looking at our press and journalists, the first thing you need to keep in mind is that they rely solely on sensationalism: "everything is getting worse, we are the most miserable and oppressed nation in the entire multiverse". Essentially fox news, bild and daily mail. Because this is what sells best. This is what gets facebook shares, comments and likes, simple as that. It appears as if everyone has forgotten what the 90's looked like and what queuing at 4 in the morning to get a bottle of milk was, daily shooting in the streets and hyperinflation. Because this is what most of the 90's were. None of which is happening anymore.

The population decline is a phenomenon which can be observed in most of Europe, the big difference is that there is very small migration from anywhere here which makes the issue more obvious (on paper) then in other countries. There are a million and one reasons for this, like bad reputation(see the paragraph above), language barrier which is a problem when it comes to daily life and realistically racism, which may be a problem outside the capital(even some large areas in the capital as well).

Families in most modern societies are shrinking. And while there was a lot of immigration in the late 90's and 2000's, in recent years, the numbers have gone down drastically and there is a factor which no journalist will dare speak of because it goes against the "everything is worse than ever" rhetoric. The number of people who have returned after a certain amount of time spent abroad(me being one of them). I was one of the first that fled back for multiple reasons. And while the question "but why" was pretty common back then, no one has asked me that question in over 5 years.

<comment><USER6> While you can take umbrage with the tone of the piece, it seems your concern for the 'bias' in the article has maybe led you astray with respect to the fundamentals.

Bulgaria unquestionably has a demographic problem related to emigration that is completely different from 'the rest of Europe'. Since 2000 (after the 'ugly times') Bulgaria has gone from 8 -> 7 million.

This is not derived from 'family sizes' \- this is squarely a problem of _emigration_ and it has everything to do with the social and economic conditions there vis-a-vis other places in Europe.

What needs to be considered is how the EU of the last 20 years, which is a merging of Rich/Poor Europe has resulted in the obliteration of healthy working people and educated class from E. Europe overall, to the benefit of the 'rich west'. There may be some neoliberal advantages, in that, those people are perhaps able to achieve better employment and income with a 'greater net productivity for Europe' \- but it's not going to benefit Bulgaria a whole lot.

Much like businesses make short term decisions on employee work spaces because the 'sticker price' of cubes or offices is so much greater than 'open tables' and whereupon the productivity if private spaces is hard to measure ... it seems the 'free money' flowing from the EU is just too tangible to consider in the face of the more 'strategic' concern of mass emigration.

As soon as you start to value those intangibles, it would seem that an economic union might actually have made more sense than a social one.

<comment><USER5> This is a very simplistic view. Keep in mind that before 2007 emigration was borderline impossible. The first time I set my foot on foreign soil was in 2002 in Greece. And that was for a holiday with an invitation which went through the Greek embassy and a copy of my parents' income to verify that our intention was indeed to go on a holiday. A process which took around 4-5 months. So once the gates were opened, understandably, many fled. I know a few people who fled before that and many of them spent years living in migrant camps and this isn't for everyone.

I'd argue that the vast majority of the people who have left/are leaving are not educated. Statistically most of them are construction workers, taxi drivers and so on. Yes, arguably some of them have education. I know one which was an electrical engineer but I'm not joking when I say that he has no idea what the difference between direct current and alternating current is. Hence the reason why he ended up delivering pizzas. Which is not to say there aren't educated people who have emigrated but that's not a real issue:

And the counter argument - people like me who went there young, studied abroad and returned afterwards. Which was the case for many of the people around me. 60 people out of 90 in my class from school went to study abroad. 59 returned. And believe me, when I left I had no intention of returning and neither did most of the others. But things have changed and at a certain point it made more sense to make that step. Which is arguably one of the best decisions I've personally ever made. And for those 59 people, we were the early adopters of a huge wave of people to do that. The one that didn't return? Well honestly, a tiny country has very little to offer to a world class cancer researcher. I see nothing wrong with that, on the contrary - bravo.

At this point I'd say the biggest problem the country is facing is not economical, or political but... I can't even call it social. Mental is probably the right word. The notion that the grass is greener everywhere else. The idea every country has it better. And annoyingly that comes from people who have never lived anywhere else or even worse-never even been anywhere else. The problems you face elsewhere are simply different and as an alien, they are much MUCH worse and often you have even less people to rely on. Been there, done that.

</comment></comment></comment><comment><USER7> I am confused by the negativity expressed in this comment section. This article presents a fairly positive outlook on how things are changing in Bulgaria (when you wrap your head around the idea that for a small country it is not the total number but the structure of the population that matters). The article mentions a number of serious outstanding challenges, but it also lists multiple reasons to be pleased with how things have changed.

<comment><USER8> this is because the Bulgarians, unlike the Germans for example, are capable of (social) self-criticism and self-irony.

<comment><USER7> Are you saying the negativity is ironic or sarcastic? That sounds like a cheap excuse.

Self-criticism and self-irony are also extremely important, but they need to be constructive, not just self-flagellation.

But your claim that Germans are not self-critical now makes me think your comment was sarcastic and I missed the sarcasm. I apologize if that is the case.

</comment></comment></comment><comment><USER9> No young bulgarian-australians would go home permanently, based on the experience of the one who did, tried to helm a Rom, wound up on a stabbing murder charge, and has been held against high court judgements he should be allowed to go home, all because the dead person was the son or relative of a senior Bulgarian minister. Revenge politics writ large.

If they want to reverse a demographic decline, they will need to respect fundamental rule of law.

<comment><USER10> Due the the typo (helm a Rom => help a Roma), I couldn't follow, but some Googling turned up Jock Palfreeman [0].

[0] [https://en.wikipedia.org/wiki/Jock_Palfreeman](https://en.wikipedia.org/wiki/Jock_Palfreeman)

<comment><USER9> The same source, if explored for Roma/Romani:

 _In the Romani language, Rom is a masculine noun, meaning 'man of the Roma ethnic group' or 'man, husband', with the plural Roma._

</comment></comment></comment><comment><USER11> People in HN might be interested to know that Bulgaria has one of the (second place I think) biggest difference between average salary in IT and average salary for everybody else.

Being part of the EU it's easy to find an IT job, with all the work from home initiatives now more than ever. SO being the poorest country in EU you can get to some ridiculous standards of living if you are in IT.

And in the recent five years or so the bigger cities in the country have upped their game quite a bit. Before the covid crisis I liked to hang out with foreigners visiting the country and all of them mentioned it being a very positive experience. They often start researching rent prices and such.

<comment><USER12> I guess that is true for any Eastern European country, especially if there's an easy way to avoid taxation.

The cost of life is low for anyone working in IT, especially remotely. However, I wonder if the infrastructure makes it worthwhile. The roads in Sofia have probably not been repaired since 90s. And there's no public transportation routes available in Google Maps.

<comment><USER13> > And there's no public transportation routes available in Google Maps.

I don't think this signifies anything though. It's up to the cities to decide if they want to publish the routes and timetables, and many choose not to. Including western cities, such as Montpellier and others in France.

<comment><USER12> But also ordering a taxi didn't work for me, since you have to call a phone number, where they promise a taxi at the airport, and it doesn't arrive. I assume Amazon or anything like that isn't present as well.

</comment></comment></comment></comment><comment><USER14> At some point, the EU has to see a pattern of degradation and corruption, and start engaging actively with the people of the countries, instead of just expecting places such as Bulgaria and Romania to wake up and decide to be rich and developed out of nowhere.

<comment><USER15> The EU knew the state of Bulgaria and Romania before inviting them to join.

The general idea was that a certain amount of nation-scale wealth transfer (e.g. via infrastructure projects, ag subsidies) and individual wealth transfer (e.g. remittances of people working abroad) would help bring the former Eastern Bloc countries up to speed, gradually remove corruption and transform towards democracy.

Let's keep it at "the idea was nice, the actual execution was... flawed".

<comment><USER16> Just out of curiosity, when you say actual execution do you mean the execution done by EU bodies or the execution of the government(s) of Bulgaria?

<comment><USER15> Both to be honest, and that's not just for Bulgaria/Romania but all former Yugoslavian and USSR countries, and even Western-allied countries such as Greece and Italy.

The EU failed to predict local government's corruption or outright destructive behavior (e.g. Visegrad blockade in refugee questions), its foundational assumption was that member states were all aligned towards one common goal and not behave actively destructive. Local governments failed to uphold their values and more often than not saw the EU as a cash cow waiting to be exploited.

</comment></comment></comment></comment><comment><USER17> Back in the late 80s when I was spending days hacking on USSR-made clones of Apple II in my school, lots of components (floppy drives and diskettes, monitors) was made in Bulgaria. I wonder what happened to then most technologically advanced country of Eastern Block?

<comment><USER18> If you played around with the Agat you should write some blogs. Agat seems really interesting from what I've been able to learn about it - it was like a 32-column Apple II with SECAM color.

<comment><USER17> Yes, it was. Not in the mood for retroblogging yet, maybe 5-10 years later, thanks for the idea)

</comment></comment></comment><comment><USER19> Some insights: after the communist regime fell, the country was taken over by mafia organizations and most of the old secret services took many places in politics. i.e. there was a seeming democracy serving mostly the people playing against the law and same old and corrupt guys that used to be part of the communist party. As a result, many capable and smart people just left as soon as they could. Unfortunately, that is still the fact - the country is run by the mafia and it has the highest level of corruption in EU.

<comment><USER20> And that's the problem with the EU. It will happily turn a blind eye to corruption as long as the exports keep flowing.

<comment><USER21> The fact that Bulgaria, Hungary and Romania were given membership to the EU is baffling.

Fast forward to today, Liviu Dragnea is serving time for abuse of power, Bulgaria is still dealing with corruption and the Hungary government continues its assault on democracy.

It's beggar's belief why any of these nations membership has not been suspended.

<comment><USER2> Isn't EU's top anti corruption official Bulgarian? I don't think she got there by being bad at her job

<comment><USER22> No. She is Romanian. As a result, Romania's GDP was going in a much better trajectory before the local politicians tried to stop her and bring the country back on the old corruption path.

<comment><USER23> The old elite fighting back was inevitable.

I am optimistic however. These things happen in a two steps forward, one step back fashion. And unfortunately for the corrupt in this country the geenie is already out of the bottle.

You'll see in the following years.

My Romanian bretheren tend to be more pessimistic. I recommend this book: [https://www.goodreads.com/book/show/34890015-factfulness](https://www.goodreads.com/book/show/34890015-factfulness)

</comment></comment></comment></comment></comment></comment><comment><USER24> I read the article but I didn't see a definition of the problem. Fewer Bulgarians means what?

<comment><USER25> It means whole towns with no children, and older people wasting away in agony because there is no one left around to care for them.

<comment><USER26> I am a Russian who moved to Australia. My parents kept voting for Putin for last 20 years, were never politically engaged and never supported the opposition.

If Bulgaria situation is any similar then for those older people that agony is of their own creation.

</comment></comment></comment><comment><USER27> it seems to me things get better as the population reduces, i'm not sure why there is a focus on maintaining it or increasing it.

in fact one of the most interesting parts of that article is that discrimination was no longer tenable given that the value of each worker had gone up

</comment><comment><USER28> The main problem with Bulgaria is mobsters and corruption. Bulgarians tend to be hard working and there are a lot of successful Bulgarians abroad but inside of the country one always has to live in fear that too obvious success will attract the wrong attention and the mobsters which more or less control the courts will just take everything they want from him.

So a lot of the smarter and more ambitious people leave to try to make a living in the west, while the rest try to live and work while being careful not to piss off the wrong person.

On top of that you have the West screwing over the country the usual way the west screws over developing countries. By buying out infrastructure and then raising prices, etc. This they do glove in hand with the mobsters and the corrupt government.

So the result is that most major businesses are oligopolies of some type or another. Either because they have been taken over by the mob or a couple of western conglomerates have bought out all the options. Or combination of the both. Prices are high in comparison to salaries and most Bulgarians live in what one would consider poor conditions. Thus family formation is low.

The EU membership has been very beneficial in putting in infrastructure and the sort. However, EU membership has also brought in a lot of real estate appreciation without a commensurate raise in ability to pay rents.

I think things are improving. Mostly because of software and technology. In my experience Bulgarians seem to value education and hard work so there are a lot of programmers. Also, the mobsters who at this point own all the important real estate, have decided to more or less leave technology companies alone. They have figured out that this will maximize the value of their existing holdings.

Thus there seems to be an unwritten license to run a tech company in Bulgaria. The industry seems to be thriving with native Bulgarian startups and R&D offices being open by major western companies. Lately I have even noticed a trend of expats from western countries going to Bulgaria to do a start up where life is cheaper. Most Bulgarians in the big cities speak some English.

The tech industry also tends to give out decent salaries, so people in that industry do not quite live in poverty. In trendy bars and restaurants in Sofia and Varna you can usually see the mobster crowd and the tech crowd living side by side uneasily giving each other furtive glances.

Thus far the government seems to value and encourage tech business. For example, in contrast to the crumbling roads, Bulgaria seems to have some of the best internet in the world. But the government and their friendly mobsters run the show and they can do anything they want in the future. So my optimism is very measured.

<comment><USER29> Same is true for most developing countries like India, Pakistan, etc...

The people have control over others through muscle power and threats and law can't reach them as they also control all guardians of law.

</comment></comment><comment><USER30> "dramatic", "pessimistic".. Hey, isn't it beautiful to have less dense human populations and more room for nature? I mean it's not as if humans were an endangered species

</comment><comment><USER31> If you can't get past the splash image like me:

[http://archive.is/LGCzt](http://archive.is/LGCzt)

</comment><comment><USER32> I've never bought into the ruse of an increasing population implying a higher standard of living. Politicians love this as a stagnating economy can appear to be doing better, by pointing to an increased GDP that usually rises with an increased population. They'll never mention how much per capita adjusted for inflation it is. When inequality rises, they'll pretend it's unrelated. Of course the extra stress on the infrastructure, housing, hospitals and schools are all things that their predecessors will have to worry about. They're the first things that conservatives will conventionally not increase funding for.

We measure GDP as it's traditionally an indicator for a standard of living.

</comment><comment><USER33> why is a declining, human population bad?

</comment><comment><USER12> Bulgaria is the EU imperialism poster child. Make it impossible to find a job inside the country and blame everything on communists.

Beautiful country though, and the food beats everything I've seen elsewhere.

</comment><comment><USER34> "All other countries have a mafia, in Bulgaria the mafia has a country."

<comment><USER35> Can we say the same thing about Mexico and the cartels?

<comment><USER36> The Mexican federal government seems to be fairly independent. All the various high-profile corruption cases prove this out, as they generally seem to have been singular installations and conversions of corrupt officials from below, however numerous. I think the problem in Mexico is the sheer inability of the federal government to effectively project its power across the country, both because of lack of resources and because of systemic corruption at the local level. Sometimes this seems to rise to the level of complicity, but I think it's more a reflection of the fear that exposing their impotence through failed enforcement operations would only worsen the situation.

By contrast, the allegations are that Bulgarian political leadership isn't simply in the pocket of the mafia, they _are_ the mafia leadership. It's sort of like in a military coup where the General-cum-President installs all his lieutenants into government office and otherwise changes the system so that the military controls all the levers. That's a quite different situation than in Mexico, and I'm not aware of any analogous situation anywhere else unless you play semantic games--e.g. consider as "mafia" the oligarchs and aristocrats of kleptocratic regimes. Such gross equivocations are great for manipulating outrage, including diversionary outrage--e.g. whataboutism--but not particularly constructive.

<comment><USER35> > political leadership isn't simply in the pocket of the mafia, they are the > mafia leadership

If the mafia becomes the government, technically you can't call them the mafia anymore, because they have become legitimate once they gain political power.

</comment></comment></comment></comment><comment><USER37> Oh just import few million of refugees, worked everywhere else. /s</comment>


Explaining why America's healthcare is so expensive - <AUTHOR> https://greyenlightenment.com/explaining-why-americas-healthcare-is-so-expensive/ <comment><USER2> I don't like how the author dismisses some hospital expenses as "hey, the patient isn't obligated to pay, at worst it goes to debt collection".</comment>


Upverter Launches Teams Collaboration, Free for Open Source - <AUTHOR> http://blog.upverter.com/174535119

<comment><USER2> FYI, the upverter homepage looks like this to me <http://i.imgur.com/SFD01HX.png> on os x using chrome Version 24.0.1312.52, firefox/safari work fine. Clicking any of the Simulate|PLM|Manufacture buttons does nothing.

<comment><USER3> Do you have any extensions that might mess with the Javascript? I've seen it working with this exact configuration.

<comment><USER4> It does this for me too... I use Ghostery. The google+ & analytics requests fail, so you end up calling "gapi.plusone.go();" on an undefined gapi.

<comment><USER2> That was it exactly, sorry I didn't have time to draw the proper conclusion myself. Glad tcwc figured it out quickly though.

</comment></comment></comment></comment><comment><USER5> Here's a very recent audio interview of its founder: [http://techzinglive.com/page/1269/223-tz-interview-zak- homou...](http://techzinglive.com/page/1269/223-tz-interview-zak-homouth- upverter)</comment>


If you love automation, why is your development environment manual? - <AUTHOR> http://sidekicksrc.com/post/if-you-love-automation-why-is-your-development-environment-manual/ <comment><USER2> >If you love automation why is your development environment manual?

Because I usually do it once in 5 years :-)

My setup: Linux, Kubuntu LTS. Entire system is backed-up with rsync, so I have daily snapshots for last 6 months. There is also weekly backup to cloud and external hdd.

I have primary 250GB SSD which usually sits in my workstation. Whan I travel I physically move SSD to laptop (takes 10 minutes).

If something went wrong and my primary SSD would die: I just boot from Livecd, copy 200GB, setup bootloader and reboot. No need to 'reinstall' system from scratch.

Every six months I take one afternoon and update all my tools (IDE, OS, apps...). I dont use automated updates except critical stuff such as browser.

<comment><USER3> I think an important point in this post was more about not trying to setup a dev environment in your base Mac install (or similar). Use Virtual Machines.

<comment><USER2> In that case I just find it better to wipe MacOS and replace it with Linux.

<comment><USER4> It's not always a good solution for your entire team. I run Linux on my desktop, but have found that the touchpad drivers (even the experimental ones) just really suck on Linux+Macbook Pro to the point where it's either external mouse (not always possible) or decreased productivity.

I have a feeling this is going to devolve into a "well, just use vim and a tiling WM or X other thing", but the point is that just replacing Mac OS with Linux isn't always going to be good for your whole team.

<comment><USER5> When you're targeting Linux, it's easier in the long-run to just use Linux. The base system isn't the same between the two because Mac OS X uses BSD versions of important things like SED, grep, etc. There are subtle differences that most Mac OS X users I've met don't know and can lead to weird problems like "why doesn't X work; it works fine on my mac!!".

If everyone's on Linux, the dev and productions systems are more similar, so less scripting issues can arise. I personally use Arch, other coworkers use Mint or Ubuntu, and only one developer uses Mac OS X (others switched because of above problems; he couldn't switch because of EFI problems). Even devs new to Linux (from Windows) love Mint, and all is well and good in the world. Servers run Debian or Ubuntu, so I test my changes in a VM because Arch has noticeably newer software in the repos, but that's because I can't stand Debian as a desktop system (package manager too slow).

Also, the Mac OS X user uses his Mac like a Linux box. He only ever touches his trackpad to use non-keyboard friendly apps (uses Vimium for Chromium, tmux/vim for terminal/editing, etc). Our devs not familiar with the keyboard generally use Sublime on Linux, which is a fantastic editor as GUI editors go.

The trackpad drivers aren't that bad, but may require some configuration in the xorg conf (I got multitouch working, but disabled it because I find it annoying).

We don't standardize on a single dev platform because each developer is different. The developer understands that using Linux is going to be easier in the long-run, but he/she must understand that his/her choice of OS must not negatively impact productivity. We've had a few developers try starting on Windows, but we'd refuse to support any dev environment besides Ubuntu Linux, and when they ran into problems, they switched to Mint/Ubuntu.

I've never seen a developer be more productive on Mac OS X than Linux. In fact, those gesture usually end up slowing him/her down from what should be easy using the keyboard (and all that switching from trackpad to keyboard is _not_ productive).

<comment><USER6> There are advantages to using VMs even if you've installed Linux as the base OS on Mac hardware.

The VMs provide isolation for testing and developing the server components. (I'm assuming you are developing server code). Through synced folders, you can still use your favorite $EDITOR on the host machine -- vim, emacs, sublime text, whatever. Onboarding is faster, and you can manage multiple node setups.

Further, you have the additional advantage of being able to replicate staging or production systems on your local box. This reduces time spent round- tripping to a staging server.

This lets you standardize the server code without requiring all developers to standardize on editors/ide/etc.

Personally, I am more productive on OSX than on Linux. But that's because my actual dev environment is tmux+vim. I let OSX and Mac hardware handle the stuff that it does much better than Linux: being able to talk to anyone, anywhere, with anything. (Networking) Being able to reliably suspend and wake.

</comment></comment></comment></comment></comment></comment><comment><USER7> I think the general idea of running a vm with all your dev setup in is great, but I've often found the small niggles (such as speed of switching quickly between browser and vm terminal, the fact you need a fairly good computer to run even quite a modest server with a gui and if you don't use a gui, you're limited to 256 colours) all a bit more trouble than the benefits.

My solution is to set up my perfect dev environment in linux (I use Fedora) on a partitioned usb pen drive. Then either boot from it (if i'm on a crappy computer) or boot a vm direct from the usb if the computer is more competent. It's also quite nice if there's an emergency and you're away from your computer -- you can just rush into an internet cafe, plead/bribe them to let you boot from your usb then have everything, ssh keys inlcuded ready for urgent repairs!

<comment><USER8> I think the point here is that it took you time to set up that dev environment.

It shouldn't matter _where_ your environment is (a VM, a laptop, etc), you should be able to recreate it easily and reliably. This is what the automation tools are for. I prefer salt stack and have a salt config for my work laptop. If something happens to the laptop or I get a new one I just need to run salt, wonder off for an hour and when I get back my entire environment is set up. I also use it with vagrant so that when a new dev joins the team they can run one command and have a copy of the project setup in a vagrant box, databases and all, ready to go.

You could set up a similar thing so that if you lose that USB key you can have your prefect setup reinstalled with minimal fuss.

<comment><USER9> Would you be able to share at least some of your current salt config? This is one idea I've been thinking a lot about lately, but never managed to get beyond the obvious package names, which is trivially installable with one command on a good Linux distro.

</comment></comment></comment><comment><USER10> I don't want dev to be exactly like stage and prod.

Yep, you read that right. I deploy to Debian servers but develop on Linux Mint or OS X. The key is that the environments are very _similar_ but not _identical_. The payoff comes when you break yourself of the habit of relying on accidents of deployment instead of building a general-case solution that works in multiple environments.

You scan /proc to look at running processes? That's great, until you're on a machine without /proc. Better to spend an hour learning how your dev platform (Python, Java, whatever) abstracts that away for you. Trying to send an email by shelling out to /usr/bin/sendmail? Oops! That's broken in lots of places; better learn how your dev platform handles it!

The big win comes when you upgrade your stage and prod environments to a newer distro - or a different one altogether - and your stuff keeps working because you'd relentlessly whittled away all the OS-specific dependencies.

<comment><USER11> This strikes me as an example of an unnecessary/premature optimization. Unless you know that your product will need to deploy on an unknown variety of server environments, there's no advantage in taking the extra time to 100% abstract away the server environment.

And really, how trustworthy is that abstraction? You've basically outsourced responsibility for your server environment to your language community. What if they create a bug that is exposed on Debian, but not on OS X?

<comment><USER4> Yeah, for certain things your abstractions can either add a good bit of overhead or increase the amount of code you need to maintain. No real point unless your product really needs to run in a mixed environment in prod.

</comment></comment></comment><comment><USER12> Your don't need to give up your GUI editor to do this. Vagrant sets up a shared folder automatically in the virtual environment under /vagrant that maps to the folder where your Vagrantfile is located on the host machine.

I do all my development now using Vagrant running Ubuntu VMs but I still do all my editing with the same Windows editor I've used for years running on the host machine.

<comment><USER13> Or, you know, ssh -X. Oh, but wait, they're trying to get rid of that in Wayland, "because nobody uses it" . . .

I suppose there's always RDP or VNC, if you can stomach their limitations.

<comment><USER14> That has never been accurate. Wayland has planned X support for a long time, it just won't be in the core

</comment></comment></comment><comment><USER15> The author missed a golden opportunity to discuss battery life. Your laptop will run longer if you SSH/VNC/whatever into the virtualized development machine if you don't host the virtualized image on the laptop.

Also I can SSH/VNC/Xwindow/whatever into a server machine with performance stats far beyond any currently imaginable laptop. Its like owning a laptop from 2023 today in 2013.

<comment><USER16> The latency is a pain. I like being able to work from anywhere by tethering my iphone5's LTE connection.

Easier and more reliable to have everything working locally (With local dev environments using vagrant/virtualbox) and use the internet connection for syncing git changes or doing research.

<comment><USER17> There's the Mosh project (<http://mosh.mit.edu>) which seems fit for your use case. I don't have personal experience with it but it looks promising.

<comment><USER16> wow looks very cool. never heard of it...

<http://mosh.mit.edu/#techinfo>

How Mosh works Remote-shell protocols traditionally work by conveying a byte- stream from the server to the client, to be interpreted by the client's terminal. (This includes TELNET, RLOGIN, and SSH.) Mosh works differently and at a different layer. With Mosh, the server and client both maintain a snapshot of the current screen state. The problem becomes one of state- synchronization: getting the client to the most recent server-side screen as efficiently as possible.

This is accomplished using a new protocol called the State Synchronization Protocol, for which Mosh is the first application. SSP runs over UDP, synchronizing the state of any object from one host to another. Datagrams are encrypted and authenticated using AES-128 in OCB mode. While SSP takes care of the networking protocol, it is the implementation of the object being synchronized that defines the ultimate semantics of the protocol.

</comment></comment></comment></comment><comment><USER18> I fully agree with this. 'Before', the dev team used a mix of, well, I'd rather not say. It was just not very pretty and eventually everyone got their work done. A while back I built a vagrant+puppet configuration for everyone and the team has since transitioned to using that.

It's nice to have at least semi-parity with the production environment. This is possible because we can utilize most (not all, due to no central Puppet server) of the same Puppet modules which we use (or I built), in the VM.

Essentially what you gain is not worrying about if a developer will break their machine/VM and go 'Whoops, can you fixor it?'. Additionally, you no longer have to worry about such things as php/node/ruby version issues with the dev/production side of things. We've gone from having sometimes issues with certain code not running the same as in development, to just throwing it up on the staging environment through deployment tools and it just runs!

</comment><comment><USER19> obligatory xkcd: <http://xkcd.com/1205/>

<comment><USER20> "xkcd #1205 says I don't need it."

</comment></comment><comment><USER21> We do this using Vagrant and Puppet and actually just blogged about it yesterday: [http://blog.serverdensity.com/many-projects-with-vagrant- and...](http://blog.serverdensity.com/many-projects-with-vagrant-and-puppet/)

</comment><comment><USER22> I've heard of Salt Stack[1], though I've never used it. From what I can tell, it can be used to do the same thing.

[1] <http://docs.saltstack.com/>

<comment><USER23> The Salt Stack team also has a plugin built specifically for provisioning environments in Vagrant called Salty Vagrant:

<https://github.com/saltstack/salty-vagrant>

(I haven't used it, but I have used -- and love using -- Salt Stack.)

</comment></comment><comment><USER24> It's funny that this article proclaims to combat yak shaving while it actually promotes it.

<comment><USER25> I take your point, but I would say that the article really encourages shaving the yak one time, instead of using scissors to beat it back occasionally.

</comment></comment><comment><USER26> There is something to be said for running your software on multiple environments. There is also something to be said for stubbing out pieces of your stack for testing and development purposes. There is often a lot to be learned. That said, I've used the VM approach on projects with high turnover. It is usually not the same as production deployment, so it does take effort, but depending on the team it might be worth the effort.

</comment><comment><USER27> I tried this on a recent couple projects and it failed miserably on both of them for completely different reasons. On one, the architecture of the project dictated really really fast network connections and the overhead from the VM choked the project. That's probably an unfair example because this was actually a toy project that was never meant to run in a serious environment (hence the requirement of a huge bandwidth virtually 0 latency network connection). The other failure however is more serious. Our company (and at least one project) dictates a Windows based development environment, and the abysmal performance of NTFS combined with a massive project code base meant it was taking 2+ minutes just to run a status check on the version controlled code.

I think given a Linux host environment this might work better, or a smaller code base, but at least in these two situations it was a failure.

<comment><USER28> Note that the recent release of VMWare support for Vagrant may at least partially mitigate the problems in your second scenario.

</comment></comment><comment><USER29> I prefer having a VM built with Vagrant (and in our case puppet) which runs the same configs as our servers while having my development tools (editors etc) installed on the local machine. That way all my apps run at native speed, and the server replicates (almost exactly) the production environment.

</comment><comment><USER30> Issue: What about VPN? If you're connecting to your corporate network with OpenVPN, and you are restricted to one connection (common sense security policy) then you need to get your infrastructure team to issue you a separate key for each VM that you're running that you want to be able to access a tunnel and get on your corporate network.

I realize that this isn't an issue for 99.9% of startups, but in the non- startup corporate world where there are security implications to keeping everything in a publicly accessible code repo (healthcare, government, education in some states) then you've got another complication.

The only thing I've been able to work up so far is sharing a folder on my desktop through to the VM and running commits from my desktop.

<comment><USER18> I would say that you probably shouldn't be doing VPN to your development boxes in general. I'd see this as a security risk. I generally don't let anything 'production' touch directly anything which might not have the same security standards as the production gear.

</comment></comment><comment><USER6> Vagrant + Chef is great!

Vagrant + Chef + Berkshelf is better!

You can define the cookbook dependencies in the Berksfile and version it along with Vagrantfile. Berkshelf is like bundler for your cookbooks. It assembles cookbooks from a variety of sources and loads them into your Vagrant-managed vm. Check it out at <http://berkshelf.com>

To help get things going in that end, I've been working on Kamino (<https://github.com/hosh/kamino>). It's intended to generate a Vagrantfile+Berkshelf file for use in your project. Right now, it only supports a basic Rails stack.

Pull requests welcomed :-)

</comment><comment><USER31> The first reason is, people who build tools mostly don't think that the tools will or should be used as components of other tools for more in 'automation'. The result is that it's tough to build on such tools.

The second, and more specific, reason is that location of one of my most intense love/hate dilemmas, Xerox PARC that pushed the first 'graphical user interface' (GUI) instead of what came before, usually typing text into a command line. Command lines are mostly easy to automate. GUIs are mostly a total PAIN to automate.

I'm wanting to automate, willing to automate, waiting to automate.

</comment><comment><USER32> Cloud development like www.nitrous.io (previously action.io) is the future. I've played around with it am quite impressed. Basically no setup for standard platforms like rails and node - choose your dev environment, install your dependencies if not already there and get coding. It's a Linux environment so your dev is same or close to production. And the IDE is quite nice. Caveat: Yes, you have to have a connection. But, for those few precious unconnected moments, I don't want to be coding anyways.

</comment><comment><USER33> Any comments on what people use to manage the chef cookbooks (and why)?

Librarian or Berkshelf seem to be the two main contenders to make updating cookbooks similar to updating gems with bundler.

<comment><USER34> I've tried both Librarian and Berkshelf to manage cookbooks for my Vagrant VMs for use with Vagrant's chef-solo provisioner. They both have nearly identical core features. Both can grab cookbooks from the Chef community site, local path, generic Git repository (which includes getting a single cookbook from a subdir) or Github. Their syntax is nearly identical. The only difference that I can think of is that Berkshelf has pessimistic version matching support (a la Bundler), while I'm not sure that librarian-chef does.

Where they differ is in where they put your cookbooks, and what additional features they offer. Librarian-chef puts your cookbooks in a "cookbooks" folder in the project root, while Berkshelf keeps a global cache of all the versions of each cookbook you've installed outside of the project. Both provide support for uploading your cookbooks to a Chef server, librarian-chef through plain knife and Berkshelf through it's own upload command.

Berkshelf also features scaffolding support for Vagrantfiles and new cookbooks, and generally has extra features specifically for rapidly iterating on cookbooks themselves. It also provides a vagrant plugin to manage bundling/uploading cookbooks to a Vagrant VM, since they need to be copied out of the central repo and made available.

Overall, I've found that I like Berkshelf better. It feels a little more idiomatic, and I like having my cookbook versions shared between projects rather than duplicated everywhere. If you have any specific questions about either, I'd be happy to answer them.

<comment><USER28> I've never tried Berkshelf, didn't even know about it. librarian-chef works great for our needs; I doubt it's worth investigating alternatives.

I will note that the librarian-chef also has a vagrant plugin: vagrant- librarian-chef.

<comment><USER6> Berkshelf is worth investigating simply because there's a lot of momentum behind it, even though it came out after Librarian. By "momentum", I mean that since the session introducing it en mass at the Opscode Community Summit in 2012, it's being adopted by the community.

No hard numbers, but the main thing is that Berkshelf could not have really happen without enough standardized community cookbooks. By putting the cookbooks into a global directory, it works more like Ruby gems and Bundler: instead of focusing on your customized (and probably divergent) cookbooks loaded into your project directory, you focus only on the few cookbooks that are specific for your needs. It comes out of a bigger theme in the 2012 Summit, that of creating "library cookbooks" that gets assembled by your "application cookbook". If it's a library cookbook, you don't necessarily need it in your project library any more than you need to import a Ruby gem into your Rails directory during development.

Test-kitchen is also worth looking into, though as far as I know, that still uses Librarian under the covers. Berkshelf support for test-kitchen is pending (<http://tickets.opscode.com/browse/KITCHEN-9>).

In summary: Berkshelf is part of the overall trend in modularizing these cookbooks and developing tighter engineering discipline.

<comment><USER28> I guess I'm still confused -- that's pretty much exactly why and how I use librarian-chef. After all, it's explicitly modelled on Bundler

</comment></comment></comment></comment></comment><comment><USER35> I've often thought that it would be nice to have a script that rebuilt the software installation on a developer's workstation from scratch, completely automatically, using only configuration files and scripts checked into version control somewhere. Such a process could run every night while the developer sleeps. This would ensure that it's dead easy to bring a new developer fully up to speed on a team.

<comment><USER6> I know a couple guys who do that. Their Steam app is also managed by Chef.

We got our dev setup partially automated like that. Even the partial setup was better than what I heard -- took a week to set up a laptop with the tools and the whole platform. When I was onboarded, it took about day, more or less hands off.

</comment></comment><comment><USER36> if you use an ide you can do something similar, but use the vm client directly. i do this all the time, and virtualbox's seamless mode means that you can mix windows from client and host on the same screen (except ubuntu unity?).

it's particularly good when different clients have different OSs. and you can even do hardware development - i have tested usb drivers in a vm client that talk to hardware connected to the host.

the only drawback is initial startup time (particularly pulling latest updates after install) and archiving the vms (they're large, so fill up a laptop ssd). i export to ovas on my backup system and then wipe the vm. another worry is that virtualbox has been flakey recently (<http://www.acooke.org/cute/VirtualBox1.html> <http://www.acooke.org/cute/UbuntuonVi0.html>) - but ovas can be imported into other hosts...

</comment><comment><USER37> For OS X tool see <http://boxen.github.com/>

<comment><USER18> Well, but the article was actually speaking out against Boxen a bit. Essentially, you're still shoehorning all of the dev stuff onto your local machine with Boxen. It's much better than installing it all manually, but still not a separate dev environment.

</comment></comment><comment><USER38> How about the best of both worlds? A common VM image with CLI tools and dev server inside the guest OS, with VirtualBox folder sharing to permit a GUI IDE and the git repo to live on the host OS?

<comment><USER39> This is what we do now - It gets to be a bit of a pain later. I'm looking forward to switching to Vagrant in the future (On the backburner for now as I have other things on my plate) - Vagrant allows you to easily nuke and re- setup your entire environment, and change things easily for the next go around - while if you're using a VM image you'd need to re-image every time you make changes that you want to stay persistent.

</comment></comment><comment><USER40> How is this different from Boxen (<http://boxen.github.com/>)? You have exactly copied the central idead around it and made a blog post.

<comment><USER41> The two ideas are very different, but complementary.

Boxen is about getting your MacOS environment set up with tooling.

The author of the original blog posting is talking about how to automate the creation of a production-like environment in which to do your development.

The creation of that environment requires a few tools installed on your physical Mac, which could be managed via Boxen. For example, you might use Boxen to automate the installation/upgrade of Vagrant or your IDE of choice.

</comment></comment><comment><USER42> I have used Vagrant in the past, and I had to stop using it. Shared folders were just too slow. 2 seconds to refresh a page was too much when you're trying to be productive.

<comment><USER6> Huh, that's interesting. How old is your hardware?

</comment></comment><comment><USER43> Points towards generative programming?

</comment><comment><USER44> has anybody tried Vagabond (<https://github.com/chrisroberts/vagabond>) to do the same thing without a VM ?

</comment><comment><USER45> No no no, I don't like automation; I like automating things :)

</comment><comment><USER46> Couldn't this be shown without a blasphemy?

<comment><USER47> Where is the blasphemy? The terrible restoration of the fresco?

<comment><USER46> Shown in the context of this article.

<comment><USER47> I re-read the article and still don't know what you're talking about.

</comment></comment></comment></comment><comment><USER48> Monoculture used to be a dirty word.</comment>


Ind.ie crowdsource campaign - <AUTHOR> https://ind.ie/

<comment><USER2> There are already alternatives to Google, Facebook, Yahoo and Microsoft. After reading several pages on their web site, it's not clear to me what this organization wants to do that's new and different, or what the money they're trying to raise will actually be used for (staff salaries? hosting expenses?).</comment>


Stuxnet Likely Constituted Illegal Act of Force, Study Says - <AUTHOR> http://www.securityweek.com/stuxnet-likely-constituted-illegal-act-force-study-says <comment><USER2> You guys know me. I'm the first to run around with their hair on fire when we're talking about illegal or dangerous use of technology by the state.

But there are a couple of things to consider here.

1) " a team of international law practitioners and scholars" -- International Law is an attempt to use treaties and legal customs to resolve disputes among international actors. I won't say that it's a fiction, but states have a tendency to interpret these things in the way that suits them.

2) While I have no doubt that these scholars did a bang-up job inside their own discipline, the field of unconventional internet warfare (which I suppose differs from "regular" internet warfare) is really, really new. The big boys are going to decide how this plays out, not the lawyers

3) Even assuming that the scholars have it right, and that the field is mature enough for their opinions to be useful and/or valid, states do things all the time that are illegal. The problem here is that they got caught.

I have no idea where this is headed. I'm guessing this low-level stuff will morph into large numbers of civilians being killed at some point. Only then will the players decide if and how to ratchet it down a couple of notches.

(I am reminded by this story that WWII was highly illegal. <http://en.wikipedia.org/wiki/Kellogg%E2%80%93Briand_Pact>)

<comment><USER3> That is the elephant in the room - that whole "no such thing as international law" concept that people find hard to grasp.

<comment><USER4> International law is a thing now, but it won't be respected until there are teeth behind it. And there won't be teeth behind it until there is actually a functioning world government with military and police power. Most currently powerful countries are too self-interested and enjoy their freedom and autonomy too much to actually want such a thing to exist. The UN is an attempt at it, but it is not powerful enough because the powerful member states undermine its authority by vetoing everything that goes against their individual interests. So it gets used as a mere tool for powerful countries to police weak countries' internal and neighborly disputes.

<comment><USER5> The UN fails at it because that is not what it is designed to do. It is supposed to be an organization to drive international cooperation. Any attempt or hope to make the UN anything else is a waste of time. It is not a government body with its own legitimacy. It never will be without radical reform.

<comment><USER4> Fair enough; then the point stands that declaring an action "illegal" under international law is meaningless because no party has a legitimate mandate to enforce international law.

</comment></comment></comment></comment></comment><comment><USER6> Words, words, words...

It's only illegal if you lose the war.

</comment><comment><USER7> If the roles were reversed, it would not even have been up for debate...

<comment><USER8> Yeah, but we've known that since Thucydides

</comment></comment><comment><USER9> Reading the report summary [1], I was especially struck by this line:

> the State itself will be responsible under international law for any actions > of individuals or groups who act under its direction. For instance, a State > that calls on hacktivists to conduct cyber operations against other States > will be responsible for those actions as if it had conducted them itself.

This seems to be an indirect dig at the Comment Crew and other similar groups that many security professionals believe to be indirectly associated with the PLA in China [2].

1\. <http://www.acus.org/files/tallinn_fact_sheet_20130322.pdf> 2\. [http://arstechnica.com/security/2013/02/unusually- detailed-r...](http://arstechnica.com/security/2013/02/unusually-detailed- report-links-chinese-military-to-hacks-against-us/)

<comment><USER10> Comment Crew might be today's example of that, but the general policy of having States be responsible for the actions they direct of contractors has always been in effect in international law, even back to the days of sail when privateers roamed the seas carrying Letters of Marque authorizing them to act for the State.

</comment></comment><comment><USER11> Very interesting analysis. The central legal principle that we are talking about here is under the UN Charter which of course all members of the UN agree to abide by.

Article 2(4) provides that all members will refrain from the use of force against the territorial integrity of any state.

I think the question narrowly put is whether the cyber attack is equivalent to a physical attack. In this case, I think you could argue that the Stuxnet worm, at least to my knowledge, had an effect broadly equivalent to a physical attack, say by planes akin to the previous Israeli sortie against Iraq's reactor.

Anticipatory self-defence is a developing topic but I don't think in this case, and borrowing from general self-defence principles, I don't think the threat was imminent enough, particularly in light of Iranian hyperbole.

Of course, the reality of what would actually happen in the case of a breach would still be subject to the desires of individual countries, particularly on the UN Security Council, but for me it is still interesting to assess whether a cyber-attack would constitute a breach of Art 2(4).

</comment><comment><USER12> When did the USA come out and say they made Stuxnet?

<comment><USER13> Last june.

[http://www.nytimes.com/2012/06/01/world/middleeast/obama- ord...](http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave- of-cyberattacks-against-iran.html?pagewanted=all&_r=0)

<comment><USER12> Im looking for more of an official document/announcement. I wasn't able to find anything of the sort in the provided link.

<comment><USER14> As far as I know, the US has not publicly admitted it created Stuxnet. But at this point both security researchers and journalists have concluded that it was created by the US and Israel, so it's essentially a well known non-secret.

<comment><USER12> The only reason i ask is because publically concluded and legal fact are far from the same.

For NATO to come out and accuse the US of illegal acts you would think they would need more then hearsay to stand on.

<comment><USER5> Oddly enough, in international law you normally accuse them if you only have hearsay. If you have proof, then normally you are beyond any sort of international intervention either because you will let it slide anyway or you already plan to strike back regardless of international favor.

</comment></comment></comment></comment></comment></comment><comment><USER15> > The argument has been made that Stuxnet was self-defense, but anticipatory > self-defense, which makes it a valid use of force. But that is open to > debate, because depending on stance made, Stuxnet's usage could be seen as > justifiable defense given Iran's statements of hostility, or as an act of > war against Iran itself.

So... basically Stuxnet is an illegal act of force iff this argument is unsound? Isn't that the case with any use of force?</comment>


Is Al Gore asking permission to spam from your social networking account? - <AUTHOR> http://nakedsecurity.sophos.com/2011/09/05/al-gore-spam-social-networking-account/ <comment><USER2> ...what?

I can understand wanting to spread a message, but this is a bit much. When you give up access to your account you give up the ability to agree or disagree. You are basically saying "I am a mouthpiece for your views, regardless of whether I agree with what you might say".

This doesn't go for Al Gore either; it goes for any kind of political movement. Innovative, but rather disturbing too.

<comment><USER3> "When you give up access to your account you give up the ability to agree or disagree."

Presumably, you're not going to "donate" your accounts unless you're already a strong supporter of the cause, so I'm sure whether or not you agree is not an issue at that point. If there does happen to be a message you disagree with, nothing's stopping you from deleting it and revoking the app's permission.

</comment></comment><comment><USER4> They need to rethink this. Obama saw a 40k drop in twitter followers last month after posting 100 tweets in 6 hours. People like being connected and involved, but not played.

<comment><USER5> It's worth noting, though, that Obama currently has 9,944,903 followers on Twitter. 40,000 lost followers would represent a change of less than half a percentage point.

<comment><USER4> You are correct, but it's worth noting that having 9.9M followers didn't make news last month. Losing 40k followers in a single day did. Stasis doesn't make news in politics and causes. Movement does. If Al Gore ends up irritating a large number of social network users, it could backfire and be counter- productive to his goals.

</comment></comment></comment><comment><USER6> This sounds like "Import your email contacts" 2.0. I feel the urge to mention that that just didn't work well, it built entire businesses.

</comment><comment><USER7> This isn't new by the way: <http://donateyouraccount.com>

I listen to political podcasts that use this service. They give the option of signing up for once a day, week or month so that your timeline isn't overwhelmed. It's sort of like a forced retweet where they can get their most important message out.

Al Gore hijacking your timeline for an entire day would be a bit too much.

</comment><comment><USER8> Express your individuality by being one of the millions with the same looking account on someone else's networking site while they deeply mine your online activities.

What happened to people making their own blogs and slowly learning how to make their own websites?

Pingbacks, trackbacks and openid are all flawed but I'll take them anyday over Facebook and Twitter.

</comment><comment><USER9> I'm really sorry Al Gore is associated with this. I feel as if it is going to skew the response. I really wish we could have the conversation completely divorced from the politics, which aren't relevant.

The more I think about it, the more it doesn't sit right with me either. Here's the thing: if I'm reading your stuff on a social network I'm doing so because it's _you_ \-- it's a real person. Even if the only thing you do is retweet things people tell you to, you are still the one doing it. If I'm annoyed, I'm annoyed at _you_. I might email or message you and complain; because I know there's a real person I can speak with.

This is exactly like giving people a script and having them call up friends and read it to them, like one of those telephone marketers. Would you volunteer to be a telephone marketer to all your friends for a cause? And even if you would, would you then automate the process so that whatever their feedback is, it wouldn't matter?

I have friends that post things I find annoying. I know I post things other folks find annoying. But that's the way it's supposed to be -- having a friend is having some weird assortment of styles, opinions, and foibles that you enjoy.

This isn't illegal, immoral, or any of that. It's just sad. I wonder if the people doing this have thought it through -- would they be happy with dozens of organizations all doing this continuously? Could social systems even function in such an environment?

<comment><USER10> "Would you volunteer to be a telephone marketer to all your friends for a cause?"

No, but I wear my EFF shirt all the time.[1] It's a continuum, and what is socially acceptable is highly dependent on your social class, and also your particular social circle.

[1] The old one, I probably wouldn't wear the ones they currently make.

<comment><USER2> > No, but I wear my EFF shirt all the time. (The old one, I probably wouldn't > wear the ones they currently make.) It's a continuum, and what is socially > acceptable is highly dependent on your social class, and also your > particular social circle.

I'd say this is different however. You can always choose which EFF shirt you wear and whether to wear it or not. With this, you give up access and any means to choose what is said.

Think of it like wearing an EFF shirt where there is an e-ink display that changes the message at any time and you can only take the shirt off after the message has been said and the damage is done.

</comment></comment></comment><comment><USER11> to save energy !

</comment><comment><USER12> Well since An Inconvenient Truth was debunked, no-one believes Al Gore himself anymore.

<comment><USER13> Nobody debunked "An Inconvenient Truth. What part of "ALL Nobel Prize winning scientists agree global warming is threat to humanity." do you not understand?

There is no more controversy about global warming in the scientific community than there is about evolution. Both concepts are considered settled.

There lots of discussion in the corporate owned media because oil companies buy a whole lot of television time falsely claiming the science on global warming isn't settled.

<comment><USER12> Nobody? How about the UK government? <http://news.bbc.co.uk/1/hi/7037671.stm> Incidentally, outside of their own field, every scientist is a layperson. Their opinion counts no more than yours or mine.

 _oil companies buy a whole lot of television time falsely claiming the science on global warming isn't settled_

And scientists are not swayed at all by the eternal quest for funding, I suppose? Al Gore doesn't own a carbon offsetting firm? Or live in a 12-bedroom mansion with a heated swimming pool?

Climate change is real, sure, anyone who pays attention to the weather can see that. But beware those who are exploiting it for their own political careers. Oh and "global warming" is NOT settled - that is why we now say "climate change" instead. Especially here in the UK where summer has been cold and wet!

<comment><USER2> I do agree, the debate has not been settled at all.

There continues to be vigorous and divisive debate over the conclusions and we obviously do not have (1) sufficient data to draw meaningful conclusions and (2) do not know enough about the actual physical mechanisms of the planet's climate to make meaningful projections.

I firmly believe we should all be responsible citizens of this planet; being mindful of the environment is the right thing to do. However, the debate over climate change - and the policymaking as a result - are obviously quite politicized.

The current movements for and against climate change are more about protecting fiefdoms, building empires, exploiting subsidies and crushing opponents than it is about being a mindful steward of the planet.

<comment><USER13> The primary guy the oil companies use to claim the science on global warming isn't settled is a geologist who has taken money to testify as a expert in courtrooms for both cases related to global warming and a court case about Intelligent Design/evolution. He doesn't believe in evolution either. Surprise!</comment></comment></comment></comment></comment>


Apache Kylin: open-source, distributed analytical data warehouse - <AUTHOR> https://kylin.apache.org/ <comment><USER2> The fact that the copyright year at the bottom of the page still says "2015" has me concerned.</comment>


Is there a ceiling on what our brains can understand? - <AUTHOR> https://waitbutwhy.com/table/intelligence-ceiling <comment><USER2> Humanity is periodically faced with the fact that it is not special [0] and that it lives on an insignificant little blue planet [1]. I don't see that trend changing anytime soon.

What comes to mind of course is Artificial General Intelligence, or AGI. Although I only believe in _eventual_ AGI many years from now, I think it's very interesting to foresee the potential impacts of a machine sitting on the step above in that ladder. See Nick Bostrom's Superintelligence [2], a great read.

\---

[0]: [https://tvtropes.org/pmwiki/pmwiki.php/Main/HumansAreSpecial](https://tvtropes.org/pmwiki/pmwiki.php/Main/HumansAreSpecial)

[1]: [https://tvtropes.org/pmwiki/pmwiki.php/Main/InsignificantLit...](https://tvtropes.org/pmwiki/pmwiki.php/Main/InsignificantLittleBluePlanet)

[2]: [https://www.goodreads.com/book/show/20527133-superintelligen...](https://www.goodreads.com/book/show/20527133-superintelligence)

</comment><comment><USER3> If there are things we can't conceptually comprehend, then definitionally we _don 't understand what they are_, so of course we can't answer this question. We won't know one way or another unless we consult with something a step or more "above us on the scale" and they tell us.

(And even then- how do we judge if something is "above" us? Chimps would have about as much trouble understanding IQ or the even the abstract notion of "intelligence" as they do skyscrapers, I'd imagine.)

</comment><comment><USER4> Assume, that the universe is finite. Assume further, that there is a finite way for matter and X number of forces to interact. Assume that there is a quantifiable range over which uncertainties of electron positions (and other matter) can be, when down to the quantum level. Given these assumptions, the only thing that stops us (all of our brains) from modeling the universe and all within it, is the span of our lifetime(s).

</comment><comment><USER5> I don't understand the question.

</comment><comment><USER6> "Yes"

</comment><comment><USER7> In my opinion, absolutely. Our brains are incredible machines, but they're still limited physically. The limit is much higher than we think it is today, as expressed by several cases of enhanced sensorial perception, like remote viewing, as disclosed in CIA papers for example. But it's still limited;</comment>


GitHub supports Universal 2nd Factor authentication - <AUTHOR> https://github.com/blog/2071-github-supports-universal-2nd-factor-authentication <comment><USER2> A few U2F details worth mentioning

Browser support is currently limited to Chrome, and possible Windows Edge*

For now it only works with USB. Bluetooth and NFC specs are out, browser support is the bottleneck

The protocol is public/private key based, with the private key strongly encouraged to be in tamper resistant/evident storage.

The protocol is authentication method agnostic. It doesn't care if you use a USB key, a retinal scan, a pin or divination.

You could write a software only authenticator if you wanted, but servers could detect that (and reject it if they chose to) through the attestation certificate you provided. You can't pretend to be a brand X authenticator, because only company X will have the private key(s) matching the attestation certs to sign (batches) of model X authenticator.

Yubikeys are just one implementation of a U2F authenticator. In theory GitHub now works with any present/future authenticators that talks U2F (modulo browser support) e.g. an iPhone+TouchID+NokNok SDK, a Pebble watch+app, an Android Phone+$your_app, an NFC implant, m-of-n wearables

* Microsoft announced something U2F related for Windows 10, I never got to the bottom of what exactly

For more detail I did a talk at EuroPython this year [https://moreati.github.io/passwordspain/#/](https://moreati.github.io/passwordspain/#/) [https://www.youtube.com/watch?v=YSTsgldazSU](https://www.youtube.com/watch?v=YSTsgldazSU)

<comment><USER3> Thanks for the link to your presentation. I'm currently implementing this in a Rails app and had a bit of a hard time to grok U2F with only the info from Fido site. Your talk will make it easier for my colleagues to understand U2F :)

<comment><USER2> Have you seen [https://github.com/castle/ruby-u2f](https://github.com/castle/ruby-u2f)? As linked from [https://developers.yubico.com/U2F/Libraries/List_of_librarie...](https://developers.yubico.com/U2F/Libraries/List_of_libraries.html)

<comment><USER3> Yes and I am using that. Thanks!

</comment></comment></comment></comment><comment><USER4> If you want to try for one of the 5,000 $5 Yubikey with everyone else currently killing the server...

1) sign in with github at: [https://www.yubico.com/github-special- offer/](https://www.yubico.com/github-special-offer/)

2) buy now: [https://www.yubico.com/github-special-offer/github- yubikey-s...](https://www.yubico.com/github-special-offer/github-yubikey- special-offer/)

3) checkout: [https://www.yubico.com/checkout/](https://www.yubico.com/checkout/)

Once you complete one step successfully you should be able to skip to the next. Good luck vs. the 504's!

<comment><USER5> The second link is now giving me "yubico site under maintenance". Same for [https://yubico.com/](https://yubico.com/)

<comment><USER6> I got 'down briefly for scheduled maintenance, please check back in a minute.'

Scheduled? Yeah right.

</comment></comment></comment><comment><USER7> "Note: FIDO U2F authentication is currently only available for the Chrome browser." [https://help.github.com/articles/providing-your-2fa- authenti...](https://help.github.com/articles/providing-your-2fa- authentication-code/#using-a-fido-u2f-security-key)

<comment><USER8> Here's the issue for the feature in Firefox [https://bugzilla.mozilla.org/show_bug.cgi?id=1065729](https://bugzilla.mozilla.org/show_bug.cgi?id=1065729)

<comment><USER9> Yeah this stuff won't be "universal" until at least all browsers support it... which would be GREAT

</comment></comment></comment><comment><USER10> You can still order:

1\. Go to [https://www.yubico.com/github-special- offer/](https://www.yubico.com/github-special-offer/)

2\. Add the special edition security key to cart

3\. Apply the "GITHUB" coupon

4\. Check out

Once you get it, don't forget to also use it with Dropbox and Google, which both predate GitHub in the U2F support. If you know any other provider, comment below, please!

<comment><USER11> Looks in the meantime it was overwhelmed, only 1 hour since your post.

> We are experiencing difficulties and the GitHub Special Offer is temporarily > unavailable. We are working hard to fix the issue and appreciate your > understanding.

> Keep an eye on Twitter (@yubico) for updates on when we will have the GitHub > Special Offer available again.

</comment></comment><comment><USER12> This is fun:

      Notice: load_plugin_textdomain was called with an argument that is deprecated since version 2.7 with no alternative available. in /nas/wp/www/cluster-50027/yubico2/wp-includes/functions.php on line 3510
      Notice: Use of undefined constant WOOCOMMERCE_VERSION - assumed 'WOOCOMMERCE_VERSION' in /nas/wp/www/cluster-50027/yubico2/wp-content/plugins/woocommerce-wootax/woocommerce-wootax.php on line 552
      Fatal error: Class 'WC_Payment_Gateway' not found in /nas/wp/www/cluster-50027/yubico2/wp-content/plugins/yubico-payment/yubico-payment.php on line 16

</comment><comment><USER13> This seems less convenient to me than 2FA using Google authenticator. I always have my phone with me. I don't want to bother bringing a USB key between home and work.

Is a separate USB key meaningfully more secure?

<comment><USER14> I've used a YubiKey for 2FA for a year or so now. It just sits in my USB port and it feels too convenient - steal my laptop and you get my key. At least my phone has a PIN.

<comment><USER15> I think the (relatively) small overlap between knowing your password and stealing your computer is important here.

Passwords are weak vs. many types of hacks, U2F is strong. And vice-versa (easy to steal the Yubi-key + computer, but they still need the password).

</comment></comment></comment><comment><USER16> Although I think Yubikey is great, I use Plug-Up key to test U2F. [http://sk.happlink.com/plugup/en/](http://sk.happlink.com/plugup/en/)

It was cheaper but is more fragile, worked well to test it out.

Now when U2F is getting more support, I think I will buy a Yubikey with U2F.

</comment><comment><USER17> Uh. U2F feels incredibly limited compared to PKCS#11 I really wonder why it was chosen (and somewhat disappointed by the choice.)

With a smartcard that can hold an key pair, one can both authenticate (sign) and encrypt messages, using a same single key (or multiple keys if wish for multiple identities). With U2F all one can is authenticate, using a distinct securely-stored PSK for each remote party.

<comment><USER18> The infrastructure around smartcards is designed for one enterprise to pay another enterprise millions of dollars to roll out Active Directory-based authentication for a Windows domain with hundreds of thousands of users, for a multinational corporation to roll out a payment card, etc.

A single hobbyist maintains an open-source tool that allows applets to be loaded on to GlobalPlatform-compliant cards. It's pretty fragile and requires some trickery and tribal knowledge. You have to hope some forum somwhere has the unlock key to allow applet loading on whatever card you bought. Another single hobbyist maintains a PKCS#11-compatible card applet, PKIApplet. It requires a relatively modern JavaCard version and compatible JavaCards are not always available for individual purchase in the U.S. If you're prepared to _really_ get down and dirty with DIY trickery, you might manage to load PKIApplet onto a JavaCard with GlobalPlatformPro.

Actually using it requires OpenSC, not a shining example of usability or code quality. It requires specific drivers for different cards, each having slightly different personalization procedures. Many of the drivers in it are for cards that can no longer be purchased. PKIApplet appears to have a driver in OpenSC but I haven't gotten an opportunity to test it yet. Much of the tooling you'll find references to in documentation turns out to have expired domains and abandoned SourceForge projects last updated 2002.

The OpenPGP route appears to be a little less sad than the PKCS#11 route, since at least Yubikey maintains a modern OpenPGPApplet.

If your Fortune 100 company's CTO wants to play golf with Gemalto, smart cards are for you. Otherwise, probably not. It makes sense that a modern _personal_ 2FA solution would want to be free of all that legacy.

<comment><USER17> Makes sense. Enterprise shit is, indeed, terrible. However, I didn't mean there is any reason to support every JavaCard out there and existing (enterprise) software - and I suppose this is where it all really starts to smell. On the other hand, they have designed a whole new standard, protocol and devices.

I've edited this for quite long time and finally figured out what I really had in my mind. I'm not disappointed it's a new standard or anything like this. I'm disappointed by the fact that this stuff isn't extensible and nothing new can be build upon this.

Not in a sense that no new software can be added to a token, but when you use U2F you just have a means to prove you know some PSK. And that's it. Would the token hold a keypair and use digital signatures instead, it could bring much more possibilities in the long run. Like sending encrypted emails to the token owners, or building a global identity system where identities are something user possesses, not leases from the "identity providers".

</comment></comment></comment><comment><USER19> I like this because I keep a U2F Neo-n device permanently in my laptop USB port. It's just more convenient for services that support it. In the future, I would like to require it for employees on our app.

However, when I go into Github to turn it on (in chrome using U2F devices I have already used with Google) it says "This device cannot be registered." Even when I remove the device it says that. I'm disappointed that the feature is not working.

<comment><USER20> I had this problem too, and it turned out my system wasn't configured correctly. I had to download [https://github.com/Yubico/libu2f-host/blob/master/70-u2f.rul...](https://github.com/Yubico/libu2f-host/blob/master/70-u2f.rules) to /etc/udev/rules.d and then udevadm control --reload-rules . Worked fine after that. HTH.

<comment><USER20> Gah, just noticed you are using a different brand of device. Anyway, if you're on Linux, poking around the USB stack might point to a solution. It did for me.

</comment></comment></comment><comment><USER21> Just a warning with the yubikeys. I had to use a solution that had these for a few months. The USB port of my laptop (2011 MBP) was pretty much worn out due the physical insertion and removal - other stuff would just fall out. Eventually this port blew entirely stopped working.

This is not specific to the MBP as a colleague's ThinkPad had the same problem.

</comment><comment><USER5> The "Special Offer for GitHub Users!" link is giving me a 504 error (took too long to complete).

[https://www.yubico.com/github-special-offer/](https://www.yubico.com/github- special-offer/)

</comment><comment><USER22> Good to see that. Hope more services will support it also soon.

</comment><comment><USER23> It's always exciting to see the list of services supporting U2F for 2FA grow. It now includes Google, Dropbox, and GitHub.

<comment><USER9> Duo also supports it.

</comment></comment><comment><USER24> When will Amazon get U2F/2FA? I have heard it's good for AWS but what about for us plebs who just buy stuff?

</comment><comment> mike-cardwell Sod the Yubikey. Get a Pebble Time watch and install the QuickAuth app. One press of a button on my watch and I get a list of two factor auth codes for my various services, now including Github. Doesn't require plugging anything into my laptop. Doesn't require my phone to be near me or on. Doesn't require Internet access.

<comment><USER25> TOTP is vulnerable to phishing and MITM attacks. U2F (assuming that you are not MITMed when registering the device) is not.

</comment></comment><comment><USER26> I would have used it if it used Google Authenticator.

<comment><USER27> You've been able to use Google Authenticator with Github for years.

<comment><USER26> I dug through 2 links and found it, thanks for letting me know:

[https://help.github.com/articles/about-two-factor- authentica...](https://help.github.com/articles/about-two-factor- authentication/)

</comment></comment></comment><comment><USER28> I can't think of a single compelling reason to use this over Google Authenticator.

<comment><USER29> It's faster. No typing. No worry about malware stealing your OTP secret. It's easy to revoke a single device if you lose it without having to change your Authenticator secrets everywhere. And it looks cool.

<comment><USER30> Also, phishing and Man-in-the-Middle protection.

</comment></comment></comment><comment><USER31> How do you know the YubiKey isn't going to attack your machine through the USB port?

<comment><USER32> How do you know your mouse or keyboard isn't going to attack your machine through the USB port?

</comment></comment><comment><USER33> I never understood the point of 2-factor authentication, and moreover, certain agencies (e.g. banks) that force using it. Can't we just pick good enough passwords?

Personally I hate being {attached to|associated with|being required to carry} a particular piece of hardware; I much prefer that information freely flows with me as I move between the various devices I interact with over the course of a day.

There are many times I don't carry my phone around with me or do not wish to, simply because I have a terminal that loads my personalized environment everywhere I go. Information flows with me, not hardware.

<comment><USER34> You're expressing a preference for convenience over security. The truth is that most people pick bad passwords, and even good passwords can be cracked.

2FA with a physical component is generally the best way to achieve the goal of "information flows with me". With a password only, you can more aptly describe the situation as "information flows with anyone who knows my password".

<comment><USER33> In that case, can we do 2FA with something biometric? Or even 2 passwords?

A physical component has a lot of issues:

* It can be stolen or robbed at gunpoint. Torture, drugging, and hypnosis aside, your mind is much more secure.

* It can run out of batteries.

* It's one more thing you can lose. It's already annoying enough to have to remember to carry 7 or 8 things every day, including a phone, bike light, smart watch, tablet, battery pack, reusable utensils, and so on. I don't want to have to add more things to this list.

* It can be damaged by the elements.

* It can be difficult to give access to others who you _want_ to give access to.

* It may have security holes of its own, both in hardware and in software.

* When damaged or robbed, the user is highly inconvenienced, to the point that they are unable to access their own money/accounts/etc. How do get food, water, and get home from the middle of nowhere _after_ your wallet and phone have been taken from your person? With password-only methods, you could theoretically find a nearby public terminal, log in with a simple username and password, and get an ride/call a friend/file a report/do whatever you need to do.

* If it relies on cellular service, it may not work internationally if the user changes SIM cards or devices. For many that live near border towns and cross borders every day for work, this becomes a massive inconvenience.

<comment><USER16> The Yubikey does not run on batteries. It requires no cellular service. It can be damaged by the elements but not easily. Most electronics would break before it does. Of course you can lose it, but you can lose anything. Attach it to something you care about, such as your regular keychain. If you want to give access to someone, register a second key and lend that key to them. Then revoke when they don't need it.

<comment><USER33> What if I don't want to carry keys around? My house door can be opened with a password. I only need to carry myself.</comment></comment></comment></comment></comment>


BasicAttentionToken Roadmap 1.0 - <AUTHOR> https://basicattentiontoken.org/bat-roadmap-1-0.html <comment><USER2> Who would run a browser specifically designed to track and show ads? I can't imagine it ever being enough to support the ecosystem.

Edit: And how is the locally gathered "attention" monitoring not exploitable by the people who get paid for the attention? Running a bunch of VMs that "pay attention" to the ad seems like a cheap thing to rig up.

<comment><USER3> I have been hoping for a long time that browsers could use cryptocurrency to monetize publishers through methods other than advertising.

Was very glad to see Brave pairing a browser with cryptocurrency (though I don't know how they will handle the scalability issues), and then very disappointed to see that it's not actually replacing ads, but instead encouraging users to watch them.

<comment><USER4> Why do you need a cryptocurrency to make the model work? If people wanted to do this, couldn't Chrome build a "Google Token" that does the same thing?

<comment><USER3> Interoperability I think is the biggest hurdle. There's nothing particularly special about blockchains here except that it's really easy to move between currencies once you've got accounts on the right exchanges.

Without cryptocurrency, you'd need some way for a user to pay all websites they visit. Ads can go on any browser and be served from any company. Ad networks don't need to interoperate. But if a user is paying publishers, it's a huge hurdle to have to pay a new publisher payment processor every time you visit a new site. Sure, 70% might accept Google payments, but what about the rest of them? And what about the users who are not on Google's payment platform?

Not that cryptocurrency solves all these problems. It's still a hard thing to do. But I think it at least lowers the barrier.

<comment><USER4> > it's really easy to move between currencies once you've got accounts on the > right exchanges.

wait so the users are going to need more than one kind of token? And they're going to need to open accounts on an exchange?

> Without cryptocurrency, you'd need some way for a user to pay all websites > they visit. Ads can go on any browser and be served from any company. Ad > networks don't need to interoperate. But if a user is paying publishers, > it's a huge hurdle to have to pay a new publisher payment processor every > time you visit a new site. Sure, 70% might accept Google payments, but what > about the rest of them? And what about the users who are not on Google's > payment platform?

Hold on, BAT is 1 kind of token. All the ad publishers need to integrate with the BAT. How is this different than having all ad publishers integrating with Google Token?

If there is a competing token, let's call it CAT, how is that different than the AppleToken competing with the Google Token, from the user's perspective?

<comment><USER5> >How is this different than having all ad publishers integrating with Google Token?

Presumably you wouldn't want to be locked into a proprietary platform that can raise fees once it has an effective monopoly.

<comment><USER6> @hudon - it's a blockchain protocol, so BAT will be bound by the rules of the token as well. I.e. it won't be able to do any gatekeeping on who uses the system and for what purpose, or do any other monopolistic practices.

<comment><USER4> > " it won't be able to do any gatekeeping on who uses the system and for what > purpose"

Agreed. This is actually something the blockchain has that existing systems do not: censorship resistance. The ability to participate and not be shut down, fined, or jailed by the rule of law.

However, if you remove the need to be censorship resistant and assume that no one will use the ad publishing system for illegal activity, I'd be really curious to hear what you mean by "other monopolistic practices".

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> > BAT Gemini (fall 2017/winter 2018) > KYC (humint + machine learning), rate, > and flow control for anti-fraud

Brave - first browser that not only force you to pay for browsing Internet, but also force you to do it with your identity proven. Privacy nightmare.

<comment><USER8> Brave is not forcing anyone to pay for anything (I work at Brave and on the BAT project).

Brave is, and will be free to use.

BAT will be opt-in, and users will not be required to pay for anything.

Users that opt-in when BAT ads become integrated will be awarded BAT from the user growth pool (user growth pool is 300m BATs).

Users that opt-in and wish to remain anonymous do not have to KYC.

Users that choose to exchange BATs for fiat or remove BAT from the system will have to go through KYC if they setup a new wallet as a part of the opt-in.

Again, Brave is not forcing anyone to pay to browse. Brave will continue to block ads and tracking by default, for free. BAT will be integrated and opt- in.

BAT FAQ: [https://basicattentiontoken.org/faq.html](https://basicattentiontoken.org/faq.html)

BAT blog: User adoption and extending the BAT Platform [https://basicattentiontoken.org/driving-user-adoption-and- ex...](https://basicattentiontoken.org/driving-user-adoption-and-extending- the-bat-platform.html)

BAT white paper: [https://basicattentiontoken.org/BasicAttentionTokenWhitePape...](https://basicattentiontoken.org/BasicAttentionTokenWhitePaper-4.pdf)

</comment></comment><comment><USER9> The usual trouble with micropayments applies - all the interest is from people who want to _collect_ micropayments, not those who want to _pay_ them.

<comment><USER5> Isn't the end-user the party collecting micropayments in this case?

<comment><USER8> There are a few pieces to this (I work at Brave and am on the BAT project).

The BAT project has set aside 300M BATs in the User Growth Pool, which will be used to award users that opt-in to the BAT integration with BATs.

Amounts in the user growth pool, including the address, are listed in the BAT FAQ: [https://basicattentiontoken.org/faq.html](https://basicattentiontoken.org/faq.html)

We also released a post on the user growth pool and extending the BAT Platform beyond the Brave browser, which is continued in the roadmap: [https://basicattentiontoken.org/driving-user-adoption-and- ex...](https://basicattentiontoken.org/driving-user-adoption-and-extending- the-bat-platform.html)

The existing Brave Payments beta that uses bitcoin will be migrated to BAT as the roadmap indicates ([https://basicattentiontoken.org/bat- roadmap-1-0.html](https://basicattentiontoken.org/bat-roadmap-1-0.html)), which will initiate flow for users that choose to opt-in and contribute to verified publishers.

We've posted about this here: [https://basicattentiontoken.org/bat-a-natural- way-to-contrib...](https://basicattentiontoken.org/bat-a-natural-way-to- contribute-to-publishers.html)

The post above also contains a review of the Google Contributor reboot, which filters ads in exchange for micropayments for participating publishers.

As communicated in the roadmap, trials will initially be with ads in private user channels (separate from the current blanner blindness problems that exist - I worked in ad ops and product integration for 5 years prior to joining Brave last Dec - blanner blindness is a problem). Examples: rich push notifications, private tabs, new tab page.

In later phases, verified publishers will be included in the rev share, with additional options for premium content and ala carte content available for BAT for publishers interested in the utility.

That said, verified publishers will be included earlier in the process through the microdonation/patreon option mentioned above.

</comment></comment></comment><comment><USER4> The use of a blockchain here is going to slow them down... The business model is really interesting but if it ends up working, Google will see it, build a Google Token that doesn't rely on the blockchain, undercut them severely on costs and transfer times, and call it a day.

<comment><USER3> I don't see Google jumping into this market. Also, it's a lot easier to pay someone in cryptocurrency than in Google token -cryptocurrency is accepted as valid payment in a much more diverse set of places.

The blockchain doesn't need to slow them down if they scale correctly. You'd do most of this stuff through payment channels or a lightning network. And, the lightning network can be made to be cross-chain. You wouldn't even need to pay everyone in bitcoin or ethereum, you could pay them in whatever currency they prefer.

<comment><USER4> Google wouldn't even need to create a "token", just let you store USD in your Google Wallet and let you cash it out when you want (venmo style). The user already has a way to pay online: their credit card. So: no new merchant integration to build, $0 fees, no security deposit (vs lightning network), no verification documents to submit (crypto exchanges), no network backlog (due to full blocks or ICOs happening).

It would just work.

</comment></comment></comment><comment><USER10> Isn't the BAT/Brave concept a response to what is essentially the same problem as email spam? That is, unwanted/irrelevant advertising at near-zero cost to produce, and that increasingly relies on brute force to overcome countermeasures?

If so, it might be worth evaluating it in terms of the myriads of email spam solutions that have been proposed over the years. Specifically, those solutions based on users adopting different client/server platforms and digital money. Both of which have been shown to be next to impossible to get ordinary people to do as part of their already-established use of the Internet. The general public barely knows what a browser is, much less the concepts involved in a weird new payment system.

</comment><comment><USER11> its so refreshing to actually see roadmaps after token launches.

</comment><comment><USER12> BasicPonziToken - The lifeblood of Ethereum

</comment><comment><USER13> Is it too late to change the name? Something like "Basic Interest Token" (BIT) sounds less Orwellian

</comment><comment><USER14> Is BAT traded anywhere other than Bittrex and liqui.io yet?

</comment><comment><USER15> Converting from Bitcoin to an ERC20 token. Bitcoin is going to die; Ethereum is the future.

<comment><USER16> How does it help Ethereum users to have a different currency, BAT tokens, bloating up Ethereum's blockchain?

<comment><USER5> Ethereum is a platform. The more assets use it, the more they can interoperate, and thus the more useful and valuable the platform becomes.

</comment></comment></comment><comment><USER17> " _from the co-founder of Mozilla_ "? <checks article> Yep, it's Brendan Eich.</comment>