Ask HN: How likely is a US revolution? - <AUTHOR> Many countries have undergone revolutions or schisms in the past century: Arab Spring countries, Soviet Union, Cuba, China/Taiwan, Korea, Yemen, etc.
Recently there have been major catalysis for social unrest, including: increasing economic inequality, novel technological shifts (automation, social media disinformation and censorship), and climate change affecting industries and migration.
What are your thoughts on the likelihood that the US will experience a massive upheaval and what precautions can be taken? <comment><USER2> Very unlikely. The constant outrage from reporters and verified twitter accounts does not reflect the majority. The average American doesn't really care about the issues you listed. They may virtue signal and say "oh it horrible that tech platforms are censoring people" but they won't stop using those platforms. With unemployment benefits that pay more than working, the unemployed aren't going to be upset when they can't find work.

The average American is content with letting the government and corporations fuck them in the ass while they are told and believe that they have freedom.

<comment><USER3> I love this and I agree completely with the added caveat that "freedom" be replaced with "comfort".

</comment></comment><comment><USER4> Almost all of the examples you listed occurred following a war, an intervention/support by foreign powers, or an unsustainable system collapsing.

For the US, the first two are extremely unlikely to happen, while the third is still essentially harmless if the US is the global hegemonic power and if Americans in general continue to desire national unity. While people are critical of aspects of America, most still believe in the fundamental idea and structure of the country (unlike say, the constituent USSR states.)

I don't see any of these things changing anytime soon, so no, I would say there will not be a revolution in the next 20 years. There may be massive democratic change, but this is expected. The media and Reddit specifically is not reality and I'd be skeptical of basing your analysis on such sources.

<comment><USER5> I'd agree there won't be a revolution as we've seen in other countries in the past decade or so. But I wouldn't put away some points so lightly. We're seeing signs of foreign interference in US politics that fit the Russian playbook, e.g. the domain registrations of those presidentially retweeted reopen-campaigns came at least partly from outside the US. Also there is an increasing divide internally, especially between rural and urban America.

</comment></comment><comment><USER6> The appetite for revolution is wildly overblown by reporting and the internet. And people are underestimating the commitment it takes to have a true revolution.

On the right, even the angriest keyboard commando uncle still wants To be home before dark.

On the left, there hasn't even been the commitment to even stage a single 1-day general strike.

The truth is we're still angry as a hobby. Most people are angry about aesthetic concerns, about the way the country should feel or look. That's not revolution material.

</comment><comment><USER7> > Many countries have undergone revolutions or schisms in the past century: > Arab Spring countries, Soviet Union, Cuba, China/Taiwan, Korea, Yemen, etc.

The US is nothing like those countries. As a matter of fact, all the "schisms" in the countries you listed are due to the US.

> Recently there have been major catalysis for social unrest, including: > increasing economic inequality, novel technological shifts (automation, > social media disinformation and censorship), and climate change affecting > industries and migration.

Most of the population is in the eastern hemisphere ( 6 billion people ). Whatever problems occur with climate change, migration, etc they are going to have to deal with it, not the US or the western hemisphere. As for social media, most of it is under US control so not much to worry about there. It's europe, india, china, middle east, etc who have to worry about social media destabilizing their countries. And I suspect, it will be the US spearheading the destabilization.

> What are your thoughts on the likelihood that the US will experience a > massive upheaval and what precautions can be taken?

Pretty much zero. The Arab Spring countries, Soviet Union, Cuba, China/Taiwan, Korea, Yemen, etc. all experienced upheavals because of major foreign interference by a much stronger nation - aka the US. We are the ones that put pressure on the soviet union until it cracked. We are the cause of the isolation and suffering in cuba. The china/taiwan conflict is entirely a US creation. Same with korea. Even yemen is a result of our interference via saudi arabia.

We have no equal to even challenge us, let alone destabilize us to the point of revolution. There is a reason why during times of trouble, the world - including china - buys dollars/us treasuries/etc.

In other words, we create schisms around the world, we don't suffer from it.

</comment><comment><USER8> Democracies have a built-in pressure valve to allow unrest to disperse, that is voting. Instead of feeling the need to resort to violence to have political agency, people _vote._

Dislike growing inequality? You probably voted for Sanders. Want a return to the pre-Trump days? You likely voted for Biden. Dislike the quarantine measures? There are lawmakers who represent your perspective.

Once a critical mass of disaffected people is reached, they wind up having their candidates win elections, which subsequently disperses that pressure. While the most passionate people are still wearing campaign badges for their favorite representative, the chances of "revolution" seems unimaginable.

<comment><USER9> It appears that the voting process has failed.

The electoral college was supposed to prevent someone like Trump from getting elected, but even that failed to do its job.

After the Civil War, Lincoln and the Union did not eliminate the Confederates, and allowed them to continue to exist as a scourge on society. They have been slowly dividing the country, and it appears they have finally succeeded.

And the prevalence of social media, has not helped the cause. Instead, it appears to be the spark that is lighting the fire, leading to a pile of dynamite.

At this point, the country is just too large, and too diverse. The political outlook of the west coast, is far too different from that of the Deep South.

Maybe it's time to consider, that they should go their own way.

The problem is the nukes. What should we do about the nukes?

<comment><USER10> > Lincoln and the Union did not eliminate the Confederates, and allowed them > to continue to exist as a scourge on society. They have been slowly dividing > the country, and it appears they have finally succeeded.

What would you suggest, a pogrom? The Union devastated the South, going well beyond battle related damage. Hooker destroyed vital infrastructure and brutalized the people. To suggest further destruction and persecution is inhumane and barbaric.

<comment><USER9> No, nobody is suggesting a pogrom.

But, they could have been prevented from resuming power, and attaining future positions of influence. Otherwise the Civil War was a sacrifice made for nothing.

Lincoln should have made a law to oversee the southern states, and put in Federal leadership, that was loyal to the Union cause. And he should have instituted the law for 100 years, in order to wipe out any future separatist activities from the Confederates.

But honestly, who knows. The Civil War was a long time ago, and it's doubtful that even this idea could have succeeded.

Which leads us to where we are now. It's too late to do anything like that anymore. The divisions are now too deep. We need a new solution.

</comment></comment></comment></comment><comment><USER11> Nope.

Most of what you see in social media and mainstream media is intended to spark discussions, get eyeballs/likes/follows and go 'viral' (in the digital sense).

Most people that disagree with the politics of people in office can vote them out. None of the countries you listed, to my knowledge, are places where every citizen has that capability.

There have been massive differences in the US since foreigners came here (i.e. non Native Americans). They all brought their own cultural, religious and other beliefs with them.

You should check out the book American Nations by Colin Woodard [0] it goes into detail about how these different areas formed and who settled those areas pretty much dictates present day politics. These aren't new concepts either - political parties use these to decide where to campaign for decades now. A map that represents the areas in question. [1]

0 - [https://www.amazon.com/American-Nations-History-Regional- Cul...](https://www.amazon.com/American-Nations-History-Regional-Cultures- ebook/dp/B0052RDIZA)

1 - [https://www.businessinsider.com/the-11-nations-of-the- united...](https://www.businessinsider.com/the-11-nations-of-the-united- states-2015-7)

Edit: answered the question.

</comment><comment><USER12> A US revolution is an almost certainty over the coming decades - the American identity has never been weaker.

The peoples are so different region to region - and are often politically hostile to one another - what keeps everyone together?

The real question is how violent will the revolution be? I hope there is peaceful secession.

<comment><USER13> If nothing keeps everyone together, how can there be a revolution, how can they put the differences aside and unite against the government and political elites? On the contrary, pushing people against each other is how people are kept from revolting. Plus throwing everyone in prison for the smallest things (especially those likely to unite against the government), making people very afraid of the police, controlling narratives in mass media and media platforms, etc.

I'd say US is one of the few countries where power is not just really well protected, but that protection is future proof. Look how all the new ways of spreading information, new media platforms ended up in the hands of few big domestic corporations who are obviously big supporters of the system they exists in and are very cozy with the government, with spreading propaganda, with censorship of pretty much whatever the government asks to the point of censoring literally all views on certain subjects if they do not parrot official government propaganda.

<comment><USER12> > how can they put the differences aside and unite against the government and > political elites?

I doubt we will see a revolution of the people vs the elites.

More likely a group of elites at the state level will want their state to leave the union.

</comment></comment></comment><comment><USER14> A country where people give excuse such as "second _amendment_ " on the topic of gun control when kids get slaughtered in schools I don't think US citizens have the ability to think of a revolution. Revolutions require amalgam of intelligentsia and people with courage. The elites in US(and some other countries) have successfully dumbed down the general populous and rendered them ineffective of revolutions. The people in US will be sold more guns and underground bunkers to hide and kill intruders than to join a revolution.

</comment><comment><USER15> With politics so tribal and voters so easily influenced by adtech, one might argue that the revolution has already quietly happened.

</comment><comment><USER16> Massive upheaval yes, revolution no. I would say there is a reasonable chance that the USA dollar will lose reserve currency status in the next 10 years. When/if this happens then everything will change - for an historical parallel look at Great Britain before and after the Great War.

<comment><USER4> What will replace it as the reserve currency? The other options are not particularly strong. In fact, the COVID situation has only made the dollar stronger (as a reserve currency).

[https://www.cnbc.com/2020/04/29/why-the-us-dollar-is- still-c...](https://www.cnbc.com/2020/04/29/why-the-us-dollar-is-still- considered-such-a-safe-currency.html)

<comment><USER16> If I knew this I wouldn't be posting in HN :)

China is the obvious answer, but I have this feeling that some sort of synthetic currency (not bitcoin) will be created to fill the void.

<comment><USER4> Unlikely that the yuan will be _the_ reserve currency unless China makes major reforms. They seem to be headed in the opposite direction, so I don't think this is likely in the near future. Long-term (50-100 years) it definitely could be, though, assuming China democratizes at some point.

</comment></comment></comment></comment><comment><USER17> You might have civil disobedience, maybe even on a mass scale with some politicians or states joining in or condoning it. I don't think there will be an actual revolution.

</comment><comment><USER18> I think we are 50-50 we will have widespread riots before the end of the year. People were already primed for revolution with Black Lives Matter, #meToo, Occupy movements, etc. With the recent rise in hate groups, we were already on a path toward what happened in 1992 with the Los Angeles Riots [1]. I think the lockdowns due to COVID-19 and the related effect on the economy, we might be accelerating the pace.

1\. [https://en.wikipedia.org/wiki/1992_Los_Angeles_riots](https://en.wikipedia.org/wiki/1992_Los_Angeles_riots)

<comment><USER8> While there are genuine issues that BLM and Occupy have organized around, the movements certainly appear largely rudderless. I don't say this to dismiss their position, however if you ask 50 protesters what it would take to bring about the change they would like to see, and you will get 50 different and often contradictory answers.

Historically, successful revolutions were organized around a larger structure, a party usually. If these groups of alienated and disaffected people had such organization, they'd almost certainly use it to gain electoral wins, not wage war against the government. Absent such organization, it doesn't seem likely anything other than riots or protests will be accomplished.

<comment><USER19> > Historically, successful revolutions were organized around a larger > structure, a party usually.

French revolution was massive confusing clusterfck of fighting parties. The same goes for Russian revolution where there were like five armies fighting against each other.

The fall of soviet union was also not about single larger opponent party building power.

</comment></comment></comment><comment><USER20> A revolution is highly unlikely, but I give the odds of some irreversible structural change (eg fragmentation) within the next 10 years >50%.

<comment><USER21> Fragmentation in what way?

<comment><USER20> A regional breakup/Balkanization.

</comment></comment></comment><comment><USER22> I think the state has enough disparate forces that are both reactionary and armed so that no revolution can succeed.

</comment><comment><USER23> check out "it could happen here"</comment>


Ask YC: Study theory, or keep coding? - <AUTHOR>

So, I've been learning how to program, with Python last summer, and Django up until now, and I'm actually in the process of coding my first app in Django. One thing always comes to mind, though. Being a beginner without any academic education on CS, I feel that there are many theories and facets to CS to learn other than programming languages and their syntaxes, which will ultimately make me a much more skilled programmer.
I want to ultimately be a proficient web app coder, and at times I think about whether my attempts at creeping closer to this goal are futile without the proper launch pad. Are there any resources I should look into to give me a stronger foothold in CS and its theoretical foundations? Am I just talking gibberish? Or will continued practice in programming be sufficient?
Thanks. <comment><USER2> Consider the Dewar & Schonberg article which has been causing so much stir this week: [http://www.stsc.hill.af.mil/CrossTalk/2008/01/0801DewarSchon...](http://www.stsc.hill.af.mil/CrossTalk/2008/01/0801DewarSchonberg.html)

They argue that a good theoretical grounding is indispensable for writing good code, and that it inoculates you against future unemployment by making it possible for you to learn any programming model, and even to apply multiple languages to a single system when appropriate. Merely writing applications isn't enough, or maybe it is, but it can take a decade of personal trial and error to discover rules that can be digested in a semester with a qualified teacher.

I take issue with some of their tone. They seem to dismiss all of the cool things people have made using rapid development tools, only valuing the contributions of military grade correctness provers. I think there's room for both in our industry.

However, if you're young, and you can go without sleep, use your energy to lay the groundwork for a lifetime of code writing. It's easier to learn theory now than to unlearn bad habit later.

Finally, don't get tricked into thinking you have to choose one or the other -- you will be coding regularly if you study theory.

And don't get tricked into thinking geniuses don't need to study. Those aren't geniuses pushing that theory.

<comment><USER2> Adding in some practical pointers too. If you're not in a position to enroll in an accredited CompSci program, look at MIT's free online courses:

[http://ocw.mit.edu/OcwWeb/web/courses/courses/index.htm#Elec...](http://ocw.mit.edu/OcwWeb/web/courses/courses/index.htm#ElectricalEngineeringandComputerScience) * Start with 6.001 * Make sure to hit one (or all three) of 6.042J. * I was about to claim the 6.171 (Software Engineering for Web Applications) was too out of date to bother with, being dated Fall 2003, but scanning the topic list of the course, everything listed there is still a concern in my day to day work. * Dewar and Schonberg would have you stress compilers. I would have you stress analysis of algorithms.

</comment></comment><comment><USER3> You have started with Python. You are already on the right track. Don't stop practicing -- you can't get anywhere without practice.

If you're curious about CS you should just go ahead and read SICP. I recommend the printed version, but the whole thing is online here:

<http://mitpress.mit.edu/sicp/>

Perhaps there are people who love CS and yet hate this book, but I have yet to meet one. It's not the easiest book in the world, but it is the real thing, and not an imitation.

There are, of course, lots of things you could learn which are not exactly "CS" but which will make you a better web programmer. Study SQL. Study emacs (read Steve Yegge for inspiration) or another killer editor. Learn to use a really decent version control system (the SVN book -- just google "SVN book" to find it -- is easy to understand, but Linus Torvalds is right when he claims that Git is much nicer!) Read "Mastering Regular Expressions". Read Bruce Eckel's _Thinking in Java_ so that you know enough about the world's most popular language to understand where it sucks, ;) and so that you can follow the conversation of much of the rest of the software world. Read K&R.

</comment><comment><USER4> Some books to read:

[http://www.amazon.com/Algorithm-Design-Jon- Kleinberg/dp/0321...](http://www.amazon.com/Algorithm-Design-Jon- Kleinberg/dp/0321295358)

[http://www.amazon.com/Design-Patterns-Object-Oriented- Addiso...](http://www.amazon.com/Design-Patterns-Object-Oriented-Addison- Wesley-Professional/dp/0201633612/)

[http://www.amazon.com/Refactoring-Improving-Existing- Addison...](http://www.amazon.com/Refactoring-Improving-Existing-Addison- Wesley-Technology/dp/0201485672/)

<http://www.artima.com/shop/forsale>

</comment><comment><USER5> Just code towards your goal. Most of the theory of computer science that you'll need implemented along the way will be done for you via something low- level that you don't really need to worry about because it'll come for free (in python or in django).

If you run into things that you find you're curious about them in a deeper level, that's when you should look for more technical material to support that.

</comment><comment><USER6> Hey man. One thing you could try, if you're having a tough time with the sheer amount of things to learn out there, is to try to find a project to work on that's going to apply some external pressure on you to solve problems and learn new things. That way, you can sort of chip away at things.</comment>


Show HN: A dating app that matches people based on their password - <AUTHOR> https://wordsofheart.com/ <comment><USER2> This is a fascinating premise. I wonder what "02rcV@gwBiE14N2e" says about me...

It should go without saying, but don't use your regular password for this site. There's no way they're using a unique salt for every password in their database, because otherwise it'd be impossible to match people based on the password. Without a unique salt, they're much more vulnerable to a rainbow table attack.

<comment><AUTHOR> Yes, I am not using salt to decrease the time complexity of matching people. And I do agree that using your regular password here is a terrible idea :-)

<comment><USER3> Wouldn't that effectively render the whole 'matching people based off the passwords they hold dear' premise pointless then?

</comment></comment></comment><comment><USER4> So if I match with someone we now both know each other's passwords?

<comment><USER5> This ensures you can never ever break up.

</comment></comment><comment><USER6> This would be a great addition to my other sites. One finds matches based on your mothers maiden name, and the other finds matches based on your social security number.

</comment><comment><USER7> This submitter has basically no history on this site. Smells like a honeypot to me.

<comment><USER8> You'd have to be a moron to use a password that already you use anywhere else. Then again, people are generally morons. (Or, more charitably, they know very little about technology and opsec. Granted, that doesn't seem to be the Hacker News target audience.)

<comment><USER9> You'd have to be a moron to use your password AND give some other information that can be traced back to you or your accounts by the creator, passwords by themselves are practically useless.

<comment><USER10> I think you'd have to be a moron to give your password even if you don't knowingly give some information that can be traced back to you.

Even if nothing at all traces it back to you, it would be easy to add every received password to a dictionary for later consultation.

But besides that, the data can be linked to you if you ever knowingly give any identifying data to another website that the attacker here has control over (or, at least, can observe). If he sets a cookie, or remembers your ip address, or your browser fingerprint, there's every chance that he might later be able to find out your real email address.

Do not give your real passwords to this site.

</comment></comment></comment></comment><comment><USER11> Haha.

You could use something akin to the principle behind the Socialist millionaires problem, to compare two values without revealing them to another party.

</comment><comment><USER12> Does this mean that they don't hash your passwords? They save it in plain text somewhere? ... Also, this is a terrible idea...

<comment><USER13> No, they can still hash it. Just not with unique salt, I believe.

</comment></comment><comment><USER14> I use entirely random, machine generated passwords. I assume my matches would also be similarly random?

<comment><USER15> Well, random only in the set of people who use machine generated password!

</comment></comment><comment><USER16> I don't care if it's a honeypot, it's the best laugh I had today. Also, I'd be so interested in a large-scale study if this single data point correlates with anything.

</comment><comment><USER17> Soooooo... if people use their standard password on this you'll be able to login as them as soon as you get any personally identifiable info - like email or FB account, right?

</comment><comment><USER18> this must be the first polyamory matchmaker. the '12345678' village and the 'password' megacity are waiting just around the corner

</comment><comment><USER19> In order to maximize my pool, should I choose 123... variants? Would I be lowering my chances of success by reducing the median quality of members?

</comment><comment><USER20> Y'all could just use a previous password.

</comment><comment><USER21> Can I have an app based on 23andme data already?

<comment><USER10> Are you trying to match against people who share your DNA? That doesn't sound like a brilliant idea!

<comment><USER21> Ha, no I was more thinking along the lines of a ML approach based on successful couples.

</comment></comment></comment><comment><USER22> Seems like a really bad idea for a honeypot.

</comment><comment><USER23> This website seems a little fishy.

<comment><USER24> I think you misspelled "phishy".

</comment></comment><comment><USER25> camaro69... is that you???</comment>


Google PageRank visualized - <AUTHOR> http://ww.com/pagerank.php

<comment><AUTHOR> A small demo of how google pagerank works, this throws up a fictive 8 page 'web' with a bunch of links between the pages and then calculates pagerank.

Sometimes pagerank can be very counterintuitive, I've found cases where adding a single outbound link to a page actually increased(!) the pagerank of that page.

The numbers next to the arrowheads are the pagerank contributions coming in to that node.

To make the display easier to read there are no bi-directional links in the networks generated.

Pages without outgoing links have their outputs evenly distributed across all the other pages.

I hope I got it right :)</comment>


If You Can't Break Crypto, Break the Client: Recovery of Plaintext iMessage Data - <AUTHOR> http://www.bishopfox.com/blog/2016/04/if-you-cant-break-crypto-break-the-client-recovery-of-plaintext-imessage-data/ <comment><USER2> For the depressing truth on the crypto wars: [https://news.ycombinator.com/item?id=7757978](https://news.ycombinator.com/item?id=7757978) (Crypto won't save you either [PDF])

...or to paraphrase Jeff Atwood: "I love crypto, it tells me what part of the system not to bother attacking"

<comment><USER3> That's my favorite quote from Atwood! People are so prone to forget that while cryptographic algorithms are provably secure (under practical constraints) in a mathematically rigorous way, their implementations are subject to all of the shortcomings of any engineering practice. Makes quick work for an attacker trying to figure out where to start.

<comment><USER4> It's my understanding that most (all?) public key cryptographic algorithms aren't provably secure, but are conjectured to be. They are reliant on some problem being hard to solve (factoring of large integers, discrete log, etc.).

Something like a one time pad is provably secure, however.

<comment><USER5> This is a common misconception. The _algorithm_ itself is provably secure, in the sense that violating the stated security guarantees of the algorithm is equivalent to solving a problem that's considered to be computationally intractable. The only part that isn't 'provable' is the basic assumption that the problem is intractable in the first place.

<comment><USER6> Didn't you just agree with him but substitute 'hard to solve' with 'computationally intractable'?

Yes based on our understanding today these things are computationally expensive (e.g not feasible), but they could theoretically be easy to crack given a mathematical breakthrough.

Am I misunderstanding?

As the field of mathematics advances there's a chance that current crypto will be broken. Why is this a misconception to point out?

Why is it not, on some level, conjecture to say these systems are secure?

<comment><USER7> What you are saying was true until this February when this paper came out [https://eprint.iacr.org/2016/170](https://eprint.iacr.org/2016/170)

It hadn't been implemented yet I'm any practical crypto system that I know of, buy it certainly seems like we are finally going to have actually, provably hard problems to build out security om.

<comment><USER8> I believe you made an unfortunate typo, substituting "probably" when you meant "provably".

<comment><USER7> Even auto correct finds it surprising :-)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> The fake URL in a JavaScript comment in the the JavaScript URI is a hilarious and neat trick.

        javascript://bishopfox.com/research?%0d%0aalert(1)

gets interpreted as:

        //bishopfox.com/research?
        alert(1)

Fortunately most browsers prevent you from pasting JavaScript URIs in the URL bar these days.

It's a little surprising Apple overlooked not one but two fairly obvious major holes: allowing JavaScript URIs, and the lack of same-origin policy. I wonder how many other applications are similarly vulnerable.

<comment><USER10> Well the lack of SOP is by design, since it's not a browser visiting multiple sites the idea of an "origin" doesn't always make sense. This is part of a larger body of work we've been researching, we found much more than this one (all known bugs have been patched, that's why we've been waiting to release this). We'll be submitting the full body of work to DEFCON/Blackhat, and a few other cons, hopefully we'll get accepted, be on the lookout if we do!

</comment></comment><comment><USER11> This is the article that years ago convinced me it's not worth obsessing about my own technological privacy: [http://www.gaudior.net/alma/johnny.pdf](http://www.gaudior.net/alma/johnny.pdf)

I despise the "if you have nothing to hide..." argument for the surveillance state. And I argue against it every chance I get.

But, practically speaking, I _don 't_ have much to hide. I also realized that one can draw _more_ attention to oneself by taking drastic measures to preserve one's own privacy.

I know, citation needed... I believe FB (or a related party) released some research about detecting "holes in the social network". Browser fingerprinting is another front on which I've probably made myself more unique to trackers.

<comment><USER12> Don't we all want to hide our payment information when we buy stuff online? Modern commerce is built on identity assertion and securing payments between two parties over the wire.

<comment><USER11> No doubt. I'd prefer my information stay private. But that liability lies with the party that loses my data.

</comment></comment></comment><comment><USER13> Apple use a web view for messages? I would've thought they'd use native UI. I guess it's easier to handle text properly with HTML.

<comment><USER14> Yes, surprisingly the OS X Messages app doesn't seem to share a lot of UI code with the iOS version. You can easily tell that it's a simple WebView from the way text selections behave.

<comment><USER15> Meaning how you can select text across messages?

<comment><USER14> Yes, that and how some of the whitespace between the messages gets selected as well.

</comment></comment></comment></comment><comment><USER16> Man, that's depressing. It's fairly easy to prevent this particular kind of injection—you just have to add a Content Security Policy to the HTML page. The appropriate value for web pages running from file://, with no expectation of downloading and executing remote JavaScript is: `script-src 'self';`

Really sad to see that Apple is using embedded web views without these sort of basic protections. I bet worse exploits than this are possible, given that they probably expose parts of the ObjectiveC layer through the JavaScriptCore bridge.

<comment><USER10> It gets even scarier with frameworks like nw.js where you can just execute native code directly from the DOM.

</comment></comment><comment><USER17> It looks like the code was pulled from Github

[https://github.com/BishopFox/cve-2016-1764](https://github.com/BishopFox/cve-2016-1764)

<comment><USER10> Sorry about the mix up, the code available here: [https://github.com/moloch--/cve-2016-1764](https://github.com/moloch--/cve-2016-1764)

and here: [https://github.com/BishopFox/cve-2016-1764](https://github.com/BishopFox/cve-2016-1764)

</comment></comment><comment><USER18> Simplified POC:

      javascript://%0aprompt()

<comment><USER10> You need the full a://a.a/%0a to match the URL pattern, but that's the jist of it.

<comment><USER19> I thought so too but a quick test showed that the code from Capira does indeed work

<comment><USER20> Where did you test it? In a VM?

If you have a Mac that's on OS X 10.11.3-, then you shouldn't be running unpatched systems.

</comment></comment></comment></comment><comment><USER19> Does anyone know how they managed to open the console / inspector inside iMessage.app?

<comment><USER10> We used JSConsole and Weinre

JSConsole -[http://jsconsole.com/](http://jsconsole.com/) Weinre - [https://people.apache.org/~pmuellr/weinre/docs/1.x/1.5.0/](https://people.apache.org/~pmuellr/weinre/docs/1.x/1.5.0/)

</comment></comment><comment><USER21> We'll see a lot more of this soon, considering more and more software is moving to webkit UIs, often with similar flaws.

<comment><USER22> Implementing CSP and other mitigations for these types of same origin bypass attacks is relatively easy. I'm shocked that Apple didn't check this. I couldn't imagine Google ever making this mistake, their web security teams are solid.

Apple really needs to invest heavily in bug bounties and internal security audits. This is 101 type of stuff when implementing any user-controllable embedded web content.

The bar should never be this low for critical OS apps like iMessage.

<comment><USER21> > I couldn't imagine Google ever making this mistake, their web security teams > are solid.

You haven't seen their XML bugs in Google Toolbar's web gallery in 2013, have you? Full access to the whole file system _of their servers_ via XML includes.

A bunch of security researchers managed to dump /etc/passwd as a sample to get the bug bounty.

Google's security isn't that much better either...

</comment></comment></comment><comment><USER23> In case of Android what you only need is that your application can read notifications (and has notifications/accessibility permissions). E.g. all whatsapp messages go through it...

<comment><USER24> A typical fanboyism argument when one's favorite company screws up. Just mention the other rivals and add zero insight into the original idea being discussed.

> In case of Android what you only need is that your application can read > notifications

This "only" is much harder to do than sending a Javascript URL.

</comment></comment><comment><USER25> that's pretty much the approach on all crypto. crack the implementation, not the algorithm.

<comment><USER23> It's rather "steal the message after decrypted" scenario, rather than cracking the implementation.

<comment><USER26> I think they were referencing, "Most crypto is bypassed rather than broken."

<comment><USER23> exactly

</comment></comment></comment></comment><comment><USER27> "Never do anything against conscience even if the state demands it." \--Einstein

</comment><comment><USER28> I had a similar thought with WhatsApp's Signal announcement. I believe that on iOS, by default all WhatsApp messages are backed up to iCloud Drive. So that would seem to be an easier attack vector.

<comment><USER2> Not just the messages - the key too. Just imagine the outcry from someone breaking his iPhone not being able to restore his messages because of the introduction of end-to-end.

That way, you don't even have to attack WhatsApp itself and they have all the plausible deniability they needed.

<comment><USER29> Why would the key be backed up to iCloud? Do you have a source for this?

<comment><USER30> Does iOS have a way to designate parts of app data as secret/transient/do_not_back_up? I suspect not.

EDIT: It appears that I was incorrect.

<comment><USER31> Yes, the NSURLIsExcludedFromBackupKey file property.

</comment></comment></comment></comment></comment><comment><USER32> This isn't the only thing you can do without breaking crypto. If exploits are too hard because you are lazy like me: check out CreepyDOL.</comment>


Show HN: Project Management Tool with GitHub - <AUTHOR> https://ship-it-app.herokuapp.com/ <comment><AUTHOR> Hi, I'm Federico and I'm creating a Lightweight Project Management tool for Github.

This MVP is being tested from some friends and myself. There are 3 major features that I'm testing.

* Notes: To enhance the ability to create issues and product backlog from user feedback, ideas or simply "online post-its".

* Board: To automate Sw iteration from issues and pull-requests. This is where progress is done.

* Suggestions: To recommend actions from your product backlog and board. This are suggestions made by ShipIT that improve how you develop, deploy and test features. Even adding resources like blog posts and articles about important topics.

I'd love to hear your feedback. Thanks!

</comment><comment><USER2> I just got "Something's not working. Try again in a few minutes"</comment>


Alibaba's Jack Ma Wants Serious Jail Time for Counterfeiters - <AUTHOR> https://www.bloomberg.com/news/articles/2017-03-07/alibaba-s-jack-ma-wants-serious-jail-time-for-counterfeiters <comment><USER2> But that is literally 2/3 of what I ever find there. He must be well diversified by now.

Serious question, if Kim Dotcom is responsible for infringement, does this not make Ma equally, or moreso guilty of profiting from stolen IP?</comment>


Telegram turns go-to platform for test-prep in India but has a piracy problem - <AUTHOR> https://factordaily.com/telegram-turns-go-to-platform-for-test-prep-in-india-but-has-a-piracy-problem/ <comment><AUTHOR> Telegram has over 40m users in India, making the country its largest user base. Telegram groups and channels, with their free pirated content and supergroup feature, are becoming popular in India for test preparation</comment>


Ask HN: How do you keep your interesting bookmarks - <AUTHOR> <comment><USER2> Try my [https://histre.com/](https://histre.com/)

It gives you rich bookmarks with highlights, notes, tree-style web history, and collaboration.

</comment><comment><USER3> For content on webpages that I want to keep I use this bookmarklet ([http://pdf.fivefilters.org/simple- print/url.php](http://pdf.fivefilters.org/simple-print/url.php)) to save the page as a nicely formatted PDF then I save the PDF to my cloud drive for permanent storage / reference.

I used to use macOS file metadata to also include the download location of the PDF to be able to go back to the source site, but found little use for that bit of file system metadata.

</comment><comment><USER4> I use Pocket for Firefox. It's a great tool on laptop since bookmarking with tags is just a click away. Also, these bookmarks can also be accessed from their mobile app.

If it's a piece of article that I absolutely treasure, I use clean-mark[0]. It converts the page into markdown seamlessly, which I then send it as a PDF to my Kindle or read it on laptop.

[0]: [https://www.npmjs.com/package/clean- mark](https://www.npmjs.com/package/clean-mark)

<comment><AUTHOR> Oh wow thanks for suggesting pocket. By the way do you have to pay to use pocket

<comment><USER4> No, it is free.

<comment><AUTHOR> Really i thought you have to pay some monthly fee but thanks for letting me know

</comment></comment></comment></comment><comment><USER5> 1\. Delete if possible (there's no time to consume ALL the interesting content). Probably the most important point to tackle information overload.

2\. Store in either "read" or "watch" Firefox bookmarks folder.

3\. After consuming the content, if I think I might need the resource in the future, I store it in Static Marks [1], an open-source tool that I wrote.

[1] [https://darekkay.com/static-marks/](https://darekkay.com/static-marks/)

</comment><comment><USER6> Subreddit

[https://www.reddit.com/r/macoovacany](https://www.reddit.com/r/macoovacany)

<comment><AUTHOR> Just curious how do you use a subreddit to keep interesting bookmarks

<comment><USER6> Create your own subreddit.

Submit links to subreddit of the websites you want 'bookmark'.

Done: an online bookmark list.

<comment><AUTHOR> Oh wow i never thought about that and the best thing is i can even share that with other people Damnn thats a good idea thanks for bringing it up man !!

</comment></comment></comment></comment><comment><USER7> Pinboard.in</comment>


David Tisch: The Man Who Brought TechStars to NYC - <AUTHOR> http://mixergy.com/david-tisch-techstars-interview/

<comment><USER2> Never even knew there was such an incubator in my city. This list of mentors local to the NYC area is intense.</comment>


Twilio Client Lets Developers Integrate VoIP Calling Into Any Application - <AUTHOR> http://techcrunch.com/2011/07/26/twilio-client-lets-developers-integrate-voip-calling-into-any-application/

<comment><USER2> I got to try this out at a little mini-conf Twilio organized some months ago. It is, if anything, even more fun than "Hey you can reimplement Skype in 3 lines of code", because one of the parties to the call can be a computer. You can use the client as a "programmable audio pipe" direct to the user's browser.

We all got to do little weekend project demos. I made a website for learning the Japanese numbers where the computer would audibly quiz you, drill to kill, etc.

You can also make more intuitive interfaces for those underrepresented demographics in the world by having the computer programmatically narrate what they need to be doing on your website. (If you haven't tried this before, I recommend it: it works even better than the standard popup-based product tour.) Say you're eBay. Somebody is trying to list a antique China doll and can't seem to find the submit button. Why don't you ask if she would like you to walk her through it? If people aren't going to read on the Internet _don't force them to read_.

Or those lovely little "Heya I see you are browsing our website why don't you chat with me" applets. How's about making that vocal? "It's OK ma'am, just talk at your computer. You're looking for the buy button? Try the purple one on the top left of your screen. Yes, we _do_ offer free shipping. You have a good day now."

You can also do the usual Twilio magic for business process automation. "Oh look, we can provision an entire call center with everything they need to do inbound or outbound work for the cost of headphones. No gazillion-dollar VoIP contract or phone lines required."

<comment><USER3> I also got to hack on this API before public release at a probably the same hack-a-conf as patio11. Twilio has put a lot of thought and work into this and even the alpha preview was very solid.

Let's just say, my next weekend project will be a voice chat that wraps a flash game. Imagine being able to choose to jump into a Twilio style conference room with other people playing the same level of a tower defense game!

<comment><USER4> _Imagine being able to choose to jump into a Twilio style conference room with other people playing the same level of a tower defense game!_

I can imagine it:

\- Shitcock!

\- Shitcock!!

\- Shitcock...?

\- Can you hear me?

\- Shit what is this I -

\- No we can't hear you speak up NO I AM STILL GAMING DAMNIT

\- Are you talking about Hitchcock?!

\- My little guys are stuck! What the hell do i do??

\- Like I said two minutes ago: you need to click "Run" _sighs_

\- ... so basically she cheated on me because I didn't give her all my gold and stuff when I closed my account

\- HAHAHAHAH

\- Shitcock!

<comment><USER5> I don't make comments like this that often, but that is hysterical (and, off- topic :). I don't have any insight into the modern gaming generation, so this is an especially interesting comment because I often feel like I'm missing something, but my underlying suspicion was that their was nothing but a vapid notion, at most.

<comment><USER6> There is no "gaming generation", and while you are not missing out on philosophical discourse by avoiding the Halos and Call of Duty's out there, I think you might be surprised by the intelligence and depth available in other places.

</comment></comment></comment></comment></comment><comment><USER7> Seems to me Twilio is quickly going to become the 37Signals of the Telephony world, and should they continue to play their cards right, they're likely to be a dominant force in a very short space of time. I wish them well and hope that someday soon we can do away with our complex voip infrastructure and move over to theirs.

<comment><USER8> Surely for Twilio to become the 37Signals of the telephony world, they'd need to stop releasing new features and just let the product stagnate, while occasionally publishing bitter screeds on their blog about how worthless other companies are?

<comment><USER9> LOL ... well played.

</comment></comment></comment><comment><USER10> Seems a neat idea, bt it isn't exactly seamless to the user -- I get the Flash security dialog asking for permission to access my speaker & microphone, and the default was to deny.

Many users probably won't have a clue what to click there.

The lag time on actually calling through to my phone was rather long (over 10s) but maybe that is just because their servers are busy.

<comment><USER11> Lag time dialing your phone number or audio lag?

EDIT: In regards to the Flash issue, the security dialog is a necessary evil. It's an unfortunate UX, but the opt-in model for accessing your devices is important.

<comment><USER10> Dialling ... though I never got the audio to work, but I blame that on the USB headset I have as the only (working) microphone.

Flash probably defaulted to the soundcard mic.

<comment><USER11> It currently uses the default system mic. We'll be adding complete microphone support (changing, etc) in a future release.

</comment></comment></comment></comment><comment><USER12> ..just as long as the users are in the US/Canada, or happy calling the US/Canada..

Hopefully they'll expand into Europe sooner rather than later, as it looks like being a really useful service.

<comment><USER11> We support calling calling over 170 countries: <http://www.twilio.com/pricing/international-calling-rates>

In addition, you can make client-to-client calls that never touch the traditional phone network and will work anywhere in the world.

<comment><USER12> Sure, but then you start hitting lag issues, right? Plus we cannot route the data through the US due to data laws.

Hopefully you'll come to Europe in a year or two, because your product really does look fantastic :)

<comment><USER5> I am a fan of flowroute.com, but they apear to cater to a more wholesale crowd. Maybe get your close family and friends to create a cooperative?

</comment></comment></comment></comment><comment><USER13> I wonder how <https://www.tropo.com/> is doing. They seem to be a bit of an underdog in the telephony api world.

<comment><USER14> I was doing some dev testing with Tropo. It works pretty well, but I think I'm going to use Twilio. Twilio just seems to be more on top of things.

</comment></comment><comment><USER15> I thought I'd take the liberty post a comment from a user in the techcrunch comments. I'm curious to hear reaction from those more familiar with telephony than I am.

<comment>

 _PhonoSDK (<http://phono.com>) is a far superior implementation of this same concept that has the advantage of being released almost a year ago - close to 10,000 developers are now using it.

The number of advantages that PhonoSDK has over this is pretty impressive:

\- Phono supports enterprise-grade open standards for VoIP and IM (SIP and XMPP). Phono supports HD audio (much better caller experience).

\- Phono supports in-browser IM functionality as well as in-browser phone functionality, using the same library.

\- Phono is open source.

\- There is no charge for Phono -> Phono calls or IMs.

Noticeably absent from this offering is the use of any of the generally accepted standards for telephony or communication. You can call this "VoIP" but but it is that in only the loosest sense of word.

The lack of open standards and the inability to interoperate with systems that suport them make this little more than a toy for developers to play with between real projects.

Enterprise customers won't touch this with a 10-foot pole._

</comment>

<comment><USER16> Hmm, so Phono is free and open source. It sounds like I'll have to do a lot more than sign up for Twilio, give them my CC#, and drop four lines of JS into my app.

<comment><USER2> Twilio is frequently _aggressive_ with describing how much work integration is. Literally, yeah, you can ring a phone in one line of code but you _really_ don't want to. It starts getting powerful when you can push full features - tested, with UI/UX, production-ready - in about a day, and you could write a telephony business in about a month, from scratch. Those aren't exaggerations in the slightest.

See my upcoming free guide on productizing Twilio apps for why using the sample code in a live environmwnt is almost always a vewwwwwwy bad idea.

<comment><USER17> Well now I'm curious. Just this weekend I had a great time texting myself with the official Python and Ruby libs from Twilio in only a few lines [1].

Sure there were rough edges like "which and how many phone numbers do I have access to" and "am I going to run out of credits and cost myself a jillion dollars accidentally" but on the whole it was a great starting experience.

 _Edit_ : I'm guessing you mean I need to build my own TwiML wrappers and scripts so that my customers can have a meaningful interaction with the computer rather than simply getting called by a useless one-line proof of concept that can't talk or listen to them?

[1] <https://gist.github.com/1102938>

<comment><USER2> Wait for the whole story later, but in general: what happens in terms of user experience if you input a wrong number? What happens if you input someone else's number? What happens if 4chan discovers your site and uses it to input a particular someone else's number 8,000 times? etc, etc</comment></comment></comment></comment></comment>


CIA Doc on Time Travel, Consciousness, and Existence of the Absolute (1983) [pdf] - jules-jules https://www.cia.gov/library/readingroom/docs/CIA-RDP96-00788R001700210016-5.pdf <comment><AUTHOR> Any reasonable government needs to have a small outlet for things that seem crazy. In other words, you need X Files.

Not because you believe everything, most things, or even any thing in them, but because having an open mind is important. If you think you know everything, you will miss a lot. Being open minded means spending some time at the tail edges investigating things that look like utter garbage woo, even if the result is that they are invariably utter garbage woo.

Also, it is not complete nonsense.

Altering conscious states is absolutely real and there are many avenues to it. Altered consciousness is also solidly in the interests of an intelligence agency and research is only natural.

There is definitely a flavor of pseudoscientific nonsense that comes along with altered consciousness experiences, but you can look past that.

Reports like this look to me very similar into pre-flight experiments. There were a whole lot of people making patently ridiculous flying contraptions but with hindsight many of them had some important ideas right.

See also: alchemy as a precursor to chemistry

Studying and treating the brain by developing methods to alter conscious states is, I think, going to be a major achievement of the 21st century, and things like this are precursors.

<comment><USER2> > If you think you know everything, you will miss a lot.

However, searching for low probability events in a large search space is not necessarily going to be a fruitful experience. For example, imagine that there is non-zero probability of a 20 karat diamond being on the beach somewhere, buried in the sand. You can look for it as much as you want, but you will _still_ probably miss it.

Having a small outlet for things that seem crazy because they might turn out to be true is the same kind of logic as buying a lottery ticket because you can't win if you don't play. Yes, you _will_ miss things, but you will almost certainly miss them anyway unless you expend more resources than they are worth -- and then you _still_ aren't guaranteed to make progress.

On the other hand low probability risks that are likely to happen _sometime_ are often worth investigating. For example, if there is a 1 in 1000 year earthquake event, it's highly unlikely to affect you in your life. But it will eventually affect _someone_ so it may be work the effort to study what might happen. To get more esoteric, perhaps we can talk about large meteorites hitting the planet. Do we need a contingency plan for it?

To me, that's the main question you need to ask before you start: are we building up an understanding of something that will almost certainly affect us one day, or are we simply sifting through grains of sand on the beach hoping to find a diamond?

<comment><AUTHOR> >low probability risks that are likely to happen sometime are often worth investigating.

>buying a lottery ticket because you can't win if you don't play

These are the same situation

<comment><USER3> What? Expectation or risk-adjusted expectation are specified in neither case, they are the defining characteristics and you can't make statements about either of the cases without knowing or estimating them.

</comment></comment></comment></comment><comment><USER4> If you go on some of the CIA FOIA tools you can also read about their experiments with astral projection. One of the more famous ones is about some guy astrally projecting on mars, in the past, and seeing aliens and buildings: [https://www.cia.gov/library/readingroom/docs/CIA- RDP96-00788...](https://www.cia.gov/library/readingroom/docs/CIA- RDP96-00788R001900760001-9.pdf)

The CIA back then was all kinds of fucked up. Doing illegal experiments on US civilians, installing dictators, and selling drugs. Makes you wonder what terrible shit they're doing now that hasn't come to the surface yet...

<comment><USER5> Probably something with manipulation of large populations using social media or predicting the future using user data and metrics.

<comment><USER6> It categorically seems much more innocent if that's the case. Effective sure, but it just doesn't feel as advanced as as injecting subjects with brand new chemicals or exploring some advanced technology.

My point is, I am pretty sure that's not _the_ flagship project at the CIA or NSA.

<comment><USER7> I dunno, social manipulation is a pretty powerful tool. The difference between a peaceful loving society and an aggressive and warlike society is in large part controlled by social pressures and perceptions.

<comment><USER8> >in large part controlled ompletely controlled.

The intents of Nazis, Imperial Japanese, Crusaders, etc., can only be explained by their social pressures. Same people born in different place and time would have different intents.

Control what people see and hear and you control what they think.

Einstein quote: >Few people are capable of expressing with equanimity opinions which differ from the prejudices of their social environment. Most people are even incapable of forming such opinions

</comment></comment></comment></comment></comment><comment><USER9> While people say the CIA invested in woo woo, I believe science progresses this way. Reported edge cases of established theories need to be checked, validated and proved/disproved before moving on to modifying the theory or dumping the case as woo.

As scientists we should not be pre-disposed to shutdown things we do not understand without putting said phenomena through a testing phase.

<comment><USER10> > _Reported edge cases of established theories need to be checked, validated > and proved /disproved before moving on to modifying the theory or dumping > the case as woo._

There are literally an infinite number of possible violations of established physics. Momentum is not conserved inside this cubic inch. Momentum is not conserved inside this other cubic inch...

The only reason one might prefer astral projection as a theory over the cubic- inch-ism of any particular volume is that astral projection fits a few preconceived notions about how the universe should conform to our psychological expectations. It might be surprising to hear, but exploding a goat with your mind is actually more psychologically familiar than any particular fact about quantum field theory. It involves explosions, minds, the exertion of will, and goats, while QFT involves unfamiliar components following unfamiliar rules to unfamiliar ends.

In short, if your idea is to test for a violation of the known laws of nature, great. If your idea is to test for a violation of the laws of nature _that is only motivated by the predispositions you acquired in the cradle_ , that's not so good.

<comment><USER11> I think they were checking culturally popular predispositions. I may claim this one cubic inch is special, but who cares? If 5-10% of the country believes it, it sorta makes sense to look into.

<comment><USER10> If someone believes something that all people are naturally predisposed to believe (compared at least to other competing beliefs), then within the palette of explanations for why they believe it lies, "just because they're predisposed." As a result paranormal theories are actually less credible than cubic-inch-ism.

<comment><USER12> Are people also predisposed to believing that people are predisposed to some belief without actually investigating the belief or understanding why people might be predisposed to it?

</comment></comment></comment></comment></comment><comment><USER13> They weren't 'taken' by it. It was likely to investigate it on the off chance it was possible. They had to try because if an enemy did and it turned out to be real, the advantages they would have would be huge. It's easy to look back from 2019 and roll our eyes, but I think the truth was less obvious then and it's likely our now easy dismissal of these things came from those very studies.

<comment><USER14> Alternatively, it's handy to create and leak documents to get the other guys to waste resources competing with your supposed advances.

<comment><USER13> That's certainly a possibility. I believe they did something similar with UFO sightings by publicly giving them more credibility to mask testing of experimental aircraft's?

<comment><USER15> They did some research on "red mercury" and leaked plausible info on it, such that the other side would try it out, sink resources and get themselves killed (in the lab) in the process.

</comment></comment></comment></comment><comment><USER16> In 1983 the United States was spending 250 billion dollars on defense. Not sure if CIA spending is included in that piece of the spending pie, but regardless.. Lots of money gets dumped into the economy via that route. It's well known that some government agencies have a "spend it or lose it" funding model. If all your main budgetary needs are met and you have a few million dollars at the end of the year, why not throw some at researching wizard shit? No one wants to be the last super power to discover magical brain lasers.

Weird stuff like this doesn't bother me probably as much as it should. Sure, I'd prefer if we spent that money on more reasonable endeavors, but this was probably a cheap waste of time all things considered. And who knows? Maybe the moonshot will pay off, and Americans everywhere will gain powerful psychic shields to reflect communist hexes.

Government spending is a primary vector for new money into the economy. If it passes through a coven real quick, meh. Many think we should be spending more money on the arts, and I think the dark arts should count.

<comment><USER17> There are a million better long-shot scientific experiments that could be done with better rigor and better theoretical/experimental foundation than what's in that paper. The ideas there are 'not even wrong' in the Wolfgang Pauli sense; it is scientific-sounding words jumbled into a picture that isn't even coherent, let alone in agreement with reality.

Just because you can think of it, or can imagine it being true, or are _afraid_ of it being true, doesn't mean it's worth investigating. Should the CIA engage in leprechaun research?

</comment></comment><comment><USER18> some of the document is "out there", but there's one section I've had some experience with: biofeedback.

Many years ago I tried a friend's biofeedback device - it used Galvanic Skin Response.

It seems you can still buy approximately the same device my friend owned on amazon: [https://amzn.com/B01IPSUIZ0](https://amzn.com/B01IPSUIZ0) (this is not a referral link and I have no association of any kind with them)

So here is the idea: you lay down on the bed, put your fingers across the contacts and move the knob until you get a medium high-pitched tone from the device. If you relax, the tone will decrease in pitch. You cannot cheat. If you _think_ you are relaxing but are not, the tone will not budge (or will rise in pitch). If you continue to decrease the tone you will eventually relax so much you will fall asleep.

The first time I used this (~20 years ago) I learned how to relax in about 30 minutes. I have carried this ability all my life.

<comment><USER19> The $76 investment is worth it if there is a 50% chance I could gain an ability to relax within 30 minutes.

</comment></comment><comment><USER20> 1\. Try and see. 2\. Leak program. 3\. Get USSR to waste resources trying it themselves, and/or spying on the American program.

<comment><USER21> This exactly.

The cold war was ended by the Strategic Defense Initiative - not because it worked but because we forced the USSR to pour resources into matching us and it bankrupted the country.

<comment><USER22> What an horrid war of attrition. The only winning move is to have deeper pockets.

<comment><USER23> It was less horrid than the alternative.

</comment></comment></comment></comment><comment><USER24> The author quotes Niels Bohr who says "you are not thinking you are merely being logical." sounds like a nice saying, but what is really the difference between being logical and thinking? What does Bohr do when he thinks? (I was just reading Polya's How to Solve It, maybe Bohr had in mind methods of investigations studied by Polya).

</comment><comment><USER25> Well this is kind of crazy. I saw the title and instantly thought "oh wow, this is totally in line topically with a recent activity".

Read 1 page in and instantly realized they were going to the Monroe Insititue - where I just was.

Great place TBH.

</comment><comment><USER26> I get the feeling that the budget for this project was actually spent on something nefarious and they only produced this document to claim they actually spent it on the task.

<comment><USER27> +Yes. The obvious answer is probably correct: it was just a front to fund more contras.

<comment><USER28> more likely hookers and blow

</comment></comment></comment><comment><USER29> Nazi's certainly had their $0.02 to contribute -

[https://en.wikipedia.org/wiki/Die_Glocke](https://en.wikipedia.org/wiki/Die_Glocke)

They say Heinrich Himmler was a practitioner of Occultism and had influenced SS to a considerable extent.

</comment><comment><USER17> Utter garbage woo. I'd say it's indicative of something, but should we be surprised that even large government organizations can be taken in by BS?

<comment><USER30> I think it's less "taken in by BS" than "eliminating possibilities."

<comment><USER31> Exactly this. They had to at least say they TRIED knocking goats out by staring at them.

<comment><USER32> Bingo! And it works two ways.

The far-fetched worst case scenario is that this actually works, and that some enemy figures that out first.

The realistic nightmare scenario goes is a congressman going "DCI Casey, we've heard rumors that the Soviets/Qaddafi/Al Qaeda/baddy of your choice have developed methods for controlling minds. Yet we've heard little about how you plan to protect the US from such a threat."</comment></comment></comment></comment>


PayPal adds "non-discouragement" clause to their User Agreement - <AUTHOR> https://www.paypal.com/us/webapps/mpp/ua/upcoming-policies-full?locale.x=en <comment><USER2> «In representations to your customers or in public communications, you agree not to mischaracterize PayPal as a payment method. At all of your points of sale (in whatever form), you agree not to try to dissuade or inhibit your customers from using PayPal; and, if you enable your customers to pay you with PayPal, you agree to treat PayPal's payment mark at least at par with other payment methods offered.»

If you have to add that to your User Agreement, what does that say about your service?

<comment><USER3> "you agree not to mischaracterize PayPal as a payment method"

English is not my first language, does this mean that by calling PayPal a "payment method" i mischaracterize it? (is it a .. payment service .. whatever?) Or does it mean that I agree not to "mischaracterize" PayPal in general because I don't like it? (then why would I offer it)

<comment><USER4> Your english is good. It's very unclear what it means as the sentence can be parsed different ways. That suggests that either their lawyers are incompetent and shouldn't be let near a contract, or they are are competent and therefore are intentionally trying to fool their customers.

It's probably incompetence though since this can work both ways. If PayPal tried to bring legal action with this clause, the first defense one would look at is to simply respond, "Where did I say it was a payment method? The clause says I can't mischaracterize it as a payment method, and I didn't."

In any case as it reads most simply it says you can't call PayPal a payment method. I doubt that's what they really meant to say.

<comment><USER5> It can only be parsed different ways under incompatible assumptions about whether PayPal is a payment method.

If it actually is a payment method (as their lawyers undoubtedly take as a given), then it limits mischaracterization to aspects of PayPal that do not involve its character _as a payment method_.

Only if you already believe it is somehow "not a payment method" does the other reading make any sense.

<comment><USER6> I also interpreted it as "PayPal is not a payment method" when reading. Legal statements shouldn't rely on out-of-contract context to parse

<comment><USER7> IANAL, but it's not exactly "out-of-contract." The term "payment method" appears 49 times in the User Agreement[1].

Having said that, a quick skim suggests the term is used inconsistently. Sometimes it refers to PayPal as a payment method, other times it refers to the information you enter into PayPal (ie credit card, bank account, etc) as payment methods. This is because PayPal is both a payment method itself and a wrapper service for many payment methods. For example:

      Your PayPal balance, if you used your PayPal balance as the payment method or a bank account as the payment method, once the money clears the bank.

So while it is confusing, I don't think you'd get very far with the "PayPal is not a payment method" interpretation.

1: [https://www.paypalobjects.com/webstatic/ua/pdf/US/en_US/ua.p...](https://www.paypalobjects.com/webstatic/ua/pdf/US/en_US/ua.pdf)

<comment><USER4> That is not correct. When one contracting party is in a superior position, courts consistently rule against the drafter of the agreement when there is ambiguous language. It's a long held legal principle taught in contract classes at law school.

<comment><USER8> Glad to hear that.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I'm amazed people will still use Paypal. The horror stories about it are legion online; I had my own, many years ago, when I did some editing work for someone who then disputed the charge on their credit card. Paypal then retroactively decided that _I_ had a negative balance on my account!

At the time I was young and stupid and idealistic and principled enough to waste a lot of time suing Paypal and the collections agency in small claims court (suing anyone in small claims court can be a pretty bad idea, even if you are technically in the right: [https://jakeseliger.com/2010/08/28/dont- rent-an-apartment-fr...](https://jakeseliger.com/2010/08/28/dont-rent-an- apartment-from-navid-abedian-in-tucson-arizona-or-how-i-learned-to-be-wary-of- lawsuits) , if your time and attention are worth anything). Still, I did definitely, definitively learn that you cannot trust and should not use Paypal.

<comment><USER10> I've used PayPal to take payments for my side business, for upwards of a decade -- well over 1000 sales. I've never had a single glitch.

Every once in a while, I look into alternative services. So far, PayPal is the only service that lets me run my business using a static web page. They provide the checkout system and handle the card payment for me.

If I use Stripe, I have to create and maintain some kind of active server to process the transactions. With other services, there's always something that makes it onerous to use.

In the long run, I think the buyer protections are more of a benefit than a risk to me. They reassure the customer that I won't screw with their credit card number, or just vanish overnight with no recourse to them.

Note that as a manufacturer, my cost-of-goods is a small fraction of the selling price, so my risk is less than someone using PayPal for a pure cash transaction such as getting paid for work. Also, a physical good that can be returned kind of sets the bar for any customer who wants to hassle me.

So far, the only disputes I've received have been when somebody orders my gadget by accident, and enters a dispute so I can cancel the transaction.

<comment><AUTHOR> You can set up a web hook somewhere. [https://www.webscript.io](https://www.webscript.io) is "unlimited" for $5/mo, and AWS Lambda probably also works.

<comment><USER11> That's still more work than it takes to serve a static web page. Plus, you have to be a programmer.

<comment><USER10> Indeed. In fact, I'm an avid programmer, but I'm not a programmer of _that_ stuff. And I'm somewhat fearful of doing it wrong and creating some kind of massive security nightmare for myself or for my customers.

</comment></comment></comment></comment></comment><comment><USER12> PP froze my account. (concentrated buyer exposure) They asked me what im selling, i said i offer software services , they asked what is the product , what do i deliver, i said i deliver code , they asked for the service agreement, i said well you'd have to ask the buyer that. They asked me to send them the last 4 invoices , i did. long story short , It was PITA to refund my bread , getting paid with STRIPE is better now. WHAT a damn hassle! I got the buyer on the phone W/ PP.PP said to me only thing i can do i is refund the last 4 invoices and get paid outside PP. Buyer said there is NO issue at all we are very happy with seller services. PP said to buyer: "nothing you did or can do". PP said to " they'd hold my bread for 180 days" then said hold for 90 days OR i can refund the 4 invoices , each time i called i spoke to someone different, they said it was their system, not my fault or the buyer , buyer made no claims at all.. Luckily, the buyer was cool enough to help me. I had to call PP each time todo a refund. Lift HOLD, refund, with then on the phone, repeat. What a damn HASSLE! i set up stripe the next day and its all good to go now! good lucky with PP. they can hold your shit without informing you and you can't do jack shit. And i had people to pay! I am kinda pissed but happy i got paid all my invoices. Does this mean i can't write a blog post about what happ to me? maybe this type of shit is normal with PP.

<comment> angry-hacker Write a blog post but use few paragraphs ;) the story is interesting but difficult to read.

<comment><USER12> dyslexia. ;-)

<comment><USER13> PayPal froze my account (for concentrated buyer exposure). They asked me what I'm selling, I said I offer software services. They asked what is the product, what do I deliver, I said I deliver code. They asked for the service agreement, I said "well, you'd have to ask the buyer for that". They asked me to send them the last 4 invoices, so I did. Long story short, it was PITA to refund my bread.

Getting paid with STRIPE is better now. WHAT a damn hassle! I got the buyer on the phone with PayPal. PayPal said to me only thing I can do I is refund the last 4 invoices and get paid outside PayPapl. Buyer said there is NO issue at all we are very happy with seller services. They said to the buyer: "there's nothing you did or can do". PayPal told me "they'd hold my bread for 180 days", then for 90 days, OR I can refund the 4 invoices. Each time I called I spoke to someone different.

They said it was their system's fault, not mine or the buyer, the buyer made no claims at all.. Luckily, the buyer was cool enough to help me. I had to call PayPal each time to do a refund. Lift HOLD, refund, with them on the phone, repeat. What a damn HASSLE!

I set up Stripe the next day and it's all good to go now! Good luck with PayPal. They can hold your shit without informing you and you can't do jack shit. And I had people to pay! I am kinda pissed but happy I got all of my invoices paid. Does this mean I can't write a blog post about what happened to me? Maybe this type of shit is normal with PayPal.

\- - -

If you'd like to write a blog post, feel free to reach out to me for editing help. Email in my profile.

</comment></comment></comment></comment><comment><USER14> Paypal is offered a lot as an option for virtual goods, such as virtual items or services for games. There is always a lot of caution around it, because anyone that has used it in this area for longer than a day realizes that they can be scammed nearly arbitrary amounts if they decide to trust payments from Paypal.

For this reason, it's generally required either that you do out of bound methods to help verify your identity (i.e. show us a picture of your ID and we will make sure it matches your Paypal name after you pay us), and/or that you have a lot of reputation within whatever community you're working from.

If you do this verification wrong as a merchant, you will find yourself charged back with absolutely no recourse after you have only sold to a few customers. I've seen this happy many times, sometimes with $10 and sometimes with $1,000. Even if you do this verification correct, you can still find yourself charged back with no recourse, so it's advised not to do this with large payments or sketchy customers, especially in the area of virtual goods. This is also commonly done in areas wiht donations, such as Twitch donations of thouands of dollars being charged back after the sender has already recieved their desired reaction/fame/etc.

Given what I have seen, I read this clause as a requirement that you are not allowed to fairy inform users about the risks of Paypal, and depending on how this requirement is enforced, it could mean the end of Paypal as a method in the virtual goods area, as new methods like Bitcoin slowly take over due to the lack of chargebacks.

</comment><comment><USER15> I can't believe PayPal and the credit card cartels can get away with this shit. Card fees eat up an astounding amount of profit from low margin items, retailers should be able to encourage whatever payment method they want.

If customers knew how much they were actually paying to these card companies indirectly (thousands of dollars a year) most people would switch to cash

<comment><USER16> True. At the same time, don't forget that banks charge business a small fee to deposit cash into their bank account. For example: [https://www.tdcanadatrust.com/products-services/small- busine...](https://www.tdcanadatrust.com/products-services/small- business/fees.jsp)

<comment><USER17> In Canada the Interac debit card network has transaction fees on the order of a few cents. It's crazy how much money US payment processors manage to skim off.

<comment><USER15> It's crazy that having a couple huge companies that silently collude to maintain their existing market share somehow isn't antitrust

</comment></comment></comment></comment><comment><USER18> Just under the non-discouragement clause:

We are changing the standard transaction fee for sellers selling goods or services online to buyers outside the U.S. from 3.9% to 4.4% plus the existing fixed fee based on the currency.

<comment><USER19> holy hell, that is getting ridiculous

</comment></comment><comment><USER20> I run a two-sided network. Our providers sometimes ask if PayPal is possible. It's helpful they include draconian language like this in their contracts; giving me something to reference, other than the myriad horror stories, when saying No.

They're their own worst enemy.

<comment><USER21> I read that draconian language myself back when the buzz first started about Paypal, too. I don't understand how convenience is so valuable that you'd put your whole account at risk.

</comment></comment><comment><USER22> "At all your points of sale (in whatever form)"

Does this not mean that any bricks'n'clicks business has to offer Paypal at their physical counter? And that they can't levy variable card processing fees, at least not where the fee for Paypal is higher?

<comment><USER23> Thank you for "bricks-n-clicks"

</comment></comment><comment><USER24> People will continue to prefer PayPal alternatives when the costs are so much higher to use paypal and I would assume this is generally difficult to enforce because it relies on a user telling paypal that a vendor asked them to use an alternative method. I would make paypal my last payment option offered to a buyer.

<comment><USER25> There's sites where they openly ask buyers not to use PP for some items that are high fraud risk and allow PP for less risky items. This means retailers will just drop PP as an option completely. I generally use it for most of my online buying as it's become difficult lately to use prepaid cards for some reason, I used to be able to effortlessly convert cryptocurrency into a virtual visa and buy anything but alas. Paypal, for buyers, is an easy experience now there's no waiting for your account to be loaded from a bank.

<comment><USER26> As a buyer, I would rather send in a check or not make the purchase before using Pay Pal.

</comment></comment></comment><comment><USER27> Prior posting, 45+ comments:

[https://news.ycombinator.com/item?id=13591601](https://news.ycombinator.com/item?id=13591601)

</comment><comment><USER28> Why is eBay so protective of PayPal? PayPal has been a separate company from eBay since 2015.

<comment><USER29> They still got binding contracts. For example they have to have PayPal as a payment option till 2020 and a decent amount must be processed through PayPal. It might change after 2020.

</comment></comment><comment><USER30> Disclaimer: PP employee--below opinions are my own and do not represent PayPal.

Things I have actually seen myself:

* Charging a fee to use PayPal that is not charged otherwise.

* Modal dialogs before PayPal describing PayPal as slower / riskier / less customized / etc.

* Disallowing PayPal for certain items.

I'm sure there are a lot of others. As patio11 mentioned in a comment below, this sort of boilerplate is common for Payments and I don't see it as unreasonable to ask for equal treatment to be given.

<comment><USER31> Charging extra for any payment method while offering other common ones is not a problem at all. You have to consider the trouble that a massive number of merchants have with paypal. The risk of dealing with something odd is financially relevant. The time spent on conflict resolution (between merchant and paypal that is) consumes time, which delays payments and has a cascading effect on other operations. This time costs money, which many add as a fee for people that want to use paypal.

I don't know a single commercial seller that once offered or still offers paypal payments and doesn't have a horror story that resulted in serious financial and operational trouble for them.

PP could introduce this if they had a good image. Right now it's considered by many to be the ... Oracle of payment processing.</comment></comment>


Bjarne Stroustrup Answers C++ Questions - <AUTHOR> https://news.codecademy.com/bjarne-stroustrup-interview/ <comment><USER2> Question #1 was misunderstood. This is not about _sorting_ a sorted vector, it is about _processing_ a sorted vector, in general. The example code of the question sums the values. The example code of the answer does `sort(v.begin(), v.end());` in run(). It is obvious that sorting something that is already sorted shouldn't take much effort. Not so that adding all the values together should be faster if the values are sorted.

<comment><USER3> The already sorted collection is a classic example for Quicksort's worst-case scenario -- specifically for implementations where the pivot point is the first element.

It's not obviously easy either. You won't know if an arbitrary collection is already sorted unless you check each element.

<comment><USER4> I noticed that when I wrote a visulization. Plain quicksort on equal values is by far the slowest.

[http://greggman.github.io/doodles/sort.html](http://greggman.github.io/doodles/sort.html)

<comment><USER5> Interesting things happen on that page when you click on one of the sorts to see it in a bigger window, then you close it, then click it again. You can end up with multiple sorts running at the same time.

</comment></comment></comment></comment><comment><USER6> Would it not be better to just link to the actual interview? - [https://news.codecademy.com/bjarne-stroustrup- interview/](https://news.codecademy.com/bjarne-stroustrup-interview/)

This blog post literally adds nothing.

<comment><USER7> (From that article, thanks)

> port the compiler to an early 640MB Windows machine.

Probably meaning a 640 kB MS-DOS machine - the first C++ 'cfront' tapes were going out by 1986, if memory serves.

<comment><USER8> cfront testing run on MacOS in 1987, from "floppy disk"; confirm

</comment></comment></comment><comment><USER9> As far as I am concerned, Stroustrup's greatest contributions to programmer are these three quotes, all from thre 2nd Edition of The C++ Programming Language:

"The most important single aspect of software development is to be clear about what you are trying to build."

"There are no 'cookbook' methods that can replace intelligence, experience and good taste in design and programming."

"Design and programming are human activities; forget that and all is lost."

So true, so important, and so universally applicable.

<comment><USER10> It's a bit ironic that he could have used that advice on himself, especially the first quote when designing C++.

<comment><USER11> My impression is he would have wanted to but he was limited by that era's technology. Quoting from the article:

> If you could go back in time and change one thing about the original > implementation of C++, what would it be?

> I don't have a time machine and I shouldn't try to second-guess 1983-vintage > Bjarne—he knew the conditions at the time better than I do now, and any > significant change probably wouldn't have fitted in the 1MB memory I had to > work with, and if it had maybe I wouldn't have been able to port the > compiler to an early 640MB Windows machine.

</comment></comment></comment><comment><USER12> C++ cannot be greater than C... Because the ++ is post-increment

He created a great language though

\--

And agreed on the linking: every snippet on stackoverflow is effectively gpl

Requiring attribution/license change --- Unless you've already hyperlinked every author name, stackoverflow, + the page it came from, AND those links are not nofollow

[https://stackoverflow.blog/2009/06/25/attribution- required/](https://stackoverflow.blog/2009/06/25/attribution-required/)

""Stack Exchange Inc; user contributions licensed under cc by-sa 4.0 with attribution required.""

EDIT: see cc by-sa text. It considers itself gpl equivalent

<comment><USER4> IANAL but I put in my S.O. profile that all my contributions are public domain / CC0. I suppose that makes them dual licensed?

<comment><USER13> nope, because when you post content on SO, you are transferring ownership of that content to stack overflow. you don't own it anymore, so you can't license it.

> All materials displayed or performed on the public Network, including but > not limited to text, graphics, logos, tools, photographs, images, > illustrations, software or source code, audio and video, and animations > (collectively "Network Content") (other than Network Content posted by > individual "Subscriber Content") are the property of Stack Overflow and/or > third parties and are protected by United States and international copyright > laws ("Stack Overflow Content").

[https://stackoverflow.com/legal/terms-of- service#licensing](https://stackoverflow.com/legal/terms-of-service#licensing)

of course, if your answer replicates content from another source that you link to in your answer, that other source still owns the content. so perhaps if you self-publish first and then replicate and link to your original source, you might be able to side-step this and license the original source as you like.

<comment><USER14> No, this is incorrect. Note "(other than Network Content posted by individual "Subscriber Content")"; this refers to the stuff that users create and post. See the "Subscriber Content" heading below.

You _license_ the content you create to them:

> any and all content [...] that you provide to the public Network > (collectively, "Subscriber Content") is perpetually and irrevocably licensed > to Stack Overflow

You still own the copyright to what you've written.

<comment><USER13> oh, that's great news! thank you for correcting me.

</comment></comment></comment></comment></comment><comment><USER15> We would have better questions and answers if the community proposed and voted for questions knowing that they would be answered by Bjarne Stroustrup. Not just picking the most voted questions in Stack Overflow.

<comment><USER16> Probably not, unless you really want to hear Stroustrup's opinion on spaces vs tabs.

</comment></comment><comment><USER17> If you're going to ask a language designer questions, how about these[1] or these[2]?

[1]: [https://stackoverflow.com/questions/tagged/language- design?t...](https://stackoverflow.com/questions/tagged/language- design?tab=Votes) [2]: [https://cs.stackexchange.com/questions/tagged/language- desig...](https://cs.stackexchange.com/questions/tagged/language- design?tab=Votes)

</comment><comment><USER18> Some of these questions were silly and should have been filtered. Others were asked before at CppCon and other conferences. Missed opportunity here.

</comment><comment><USER19> > [...] after days of grueling interviewing, it turned out that they had a > position after all

Not even Bjarne is safe from interview hell.

<comment><USER20> He wasn't famous back then. Today would probably be a little different.

</comment></comment><comment><USER21> Hi, it's Sonny from Codecademy. Super awesome to see that this made it to the front page of HN. Here are a few questions that didn't quite make it to the original Codecademy blog post (written for our learners):

\---

 _What's your perfect Saturday?_

Have a slow breakfast, do a bit of work – maybe writing. Maybe visit the grandchildren. Run a few miles. Eat a good dinner out with friends. Settle in for the evening with a good book.

\---

 _How was the 2019 C++ Standards meeting in Germany?_

It was a rather good meeting. The venue was great and we voted out a "Committee Draft" for review by the national standards bodies. There is now a feature freeze.

In February 2020, we'll have the final vote C++20. It was a lot of work and there were 220 attendees – a new record.

C++ is going to be great!

\---

 _What are some of the C++20 updates that you are especially excited about?_

\- Modules – to improve code hygiene and significantly speed up compilation.

\- Concepts – to simplify generic programming by allowing precise specification of a template's requirements on its arguments.

\- Ranges – to finally be able to write sort(v) rather than sort(v.begin(), v.end()), to get more general sequences, and more flexibility and better error messages through the use of concepts.

\- Coroutines – to get simpler and faster generators and pipelines, simplifying asynchronous programming.

\- Dates – being able to efficiently and elegantly manipulate calendars; e.g., weekday{August/1/20/2019}==Thursday.

\- jthreads and stop tokens – threads that joins on scope exit (doing proper RAII) and a mechanism for terminating them if their result is no longer needed.

These changes – and many smaller ones supporting them – are major in the sense that they will fundamentally change the way we program and think about our designs.

C++20 will be as big an improvement over C++11 as C++11 was over C++98. It will change the way we think about writing our code. I said "C++11 feels like a new language." I will be able to say the same about C++20.

Our code will become smaller, simpler, run faster, and compile faster.

\---

 _What newer languages or language paradigms are exciting to you?_

I don't easily get excited and the field of languages doesn't really develop all that fast when you keep an eye on it.

Most changes are incremental and re-emerge repeatedly in different languages with minor differences. I think the word "paradigm" is overused and misused. If it means any more than "my latest bright new idea", we don't see a new paradigm every decade. Maybe object-oriented programming, generic programming, functional programming, and machine learning. That took 50+ years.

I tend to look for techniques that can be widely used. Over the last decade or so, my main work has focused on generic programming and compile-time evaluation. Maybe this will feed into a static reflection mechanism for C++ over the next few years. I like the idea of functional-programming-style pattern matching and did a bit of research on that in the previous decade.

<comment><USER22> This answer makes me excited for C++20 too. I'm not currently using C++ for any projects; I might have to make one up.

</comment></comment><comment><USER23> Well it's good that he answers C++ stuff, a bit like Walter Bright here (or wherever) answers questions related to D - but the more important question is this:

In the face of more competition, e. g. python, Rust, Go etc.., what is the future of/for C++?

<comment><USER24> Stroustrup is the beloved creator of C++, but C++ is decidedly _not_ governed by a benevolent dictator; a very large and active Committee guides its future: [https://isocpp.org/std/the-committee](https://isocpp.org/std/the-committee)

<comment><USER25> I have to say that I have a lot of respect for the man.

Many project leaders/creators position themselve "authoritative god" on their project, and finished often disconnected from their community taking arbitrary wrong decisions.

Bjarne has been smarter than that, giving the community (a very diversified community ) the opportunity to drive the language together.

And it worked, C++ survived 40 years, stronger than ever, evolving from a primitive "C with class" to a modern language present in almost every electronic device nowadays.

It might not be "perfect", "pure", but it does not matter. It fucking work... and evolve in the right direction... That's the C++ way.

<comment><USER24> In addition to benefiting from _many_ smart people at the helm, instead of just one, it also benefits from having no real single points of failure. It has a multitude of cooperative leaders, support from many large and even small corporations, and many implementations as well as its formal Standard (which after the long wait for C++0x, has had a number of good, well-adopted updates).

</comment></comment></comment></comment><comment><USER26> I'm surprised this isn't closed as "not constructive".

<comment><USER27> or opinion based

</comment></comment><comment><USER28> How is the top C++ question not "undefined behaviour: what the hell?"

<comment><USER29> "Undefined behavior" is a quirk of the C++ ISO standard legalese, not some property of computing or of the C++ language.

Briefly, the C++ standard defined three classes of stuff that isn't covered by the standard:

 _Implementation-defined behavior_ \- "behavior, for a well-formed program construct and correct data, that depends on the implementation and that each implementation documents".

 _Unspecified behavior_ \- "behavior, for a well-formed program construct and correct data, that depends on the implementation".

 _Undefined behavior_ \- "behavior for which this document imposes no requirements".

So 'undefined behavior' is stuff that isn't mandated by the standard and also may or may not be an error.

Some UB stuff is bugs (like accessing arrays out of bounds), some isn't bugs but just processor/OS dependent stuff that is out of scope of the C++ standard. (Like what happens when integers overflow.)

In short, the existence of UB is a good thing; having a standard that clearly states what is part of it and what isn't is vastly better than a standard that mandates too much or is too vague.

(And it goes without saying that having no standard at all, like is usual for other programming languages in 2019, is worse in every way.)

<comment><USER30> I'd rather have a language with no standard and no UB than one with a standard and UB.

<comment><USER31> since the language has no standard, from the point of view of ISO, using the whole language itself is UB :-)

<comment><USER30> If ISO want to come round and do some programming for me, i will be happy to discuss it with them!

</comment></comment></comment></comment></comment><comment><USER32> Hah, he mixed up milliseconds and microseconds!</comment>