Show HN: I built a Chrome extension to donate to charities while on Amazon - <AUTHOR> http://www.smilealways.io <comment><USER2> This is a great cause. Just one concern: I understand the desire to quantify the difference you're making in the world, but seeing the counter that (currently) says "66 redirects have been made with this extension!" actually influenced me to not install the extension. It seems like the implementation of that could easily leak the list of things I look at on Amazon to you or others, and it shouldn't need to "phone home" like that to function as an extension. If you remove that you'll have another happy giver. :)

<comment><AUTHOR> I completely understand - this was one of our major concerns when we were deciding whether or not we should count redirects. If you look at the function incrementCounter() in the code ([https://github.com/Jdhaimson/smilealways/blob/master/chromep...](https://github.com/Jdhaimson/smilealways/blob/master/chromeplugin/request.js)) you can see that all we are doing is pinging the server without passing any information along to increment a counter each time someone is redirected.

That being said, I think I will take it off of the site because it can be scary if you don't look at the code. Thanks for the suggestion!

<comment><USER3> Without rate limiting it looks be to susceptible to abuse.

<comment><AUTHOR> Yeah, I realize this method is open to abuse. I just figured that the counter really was more of a "nice-to-have" so I can see how many times it was working, but if someone really wanted to abuse it than it wouldn't be that big of an issue. I'd have an incorrect count, but that's about it.

At the end of the day, it wasn't worth spending the initial effort to build against that. I intend on doing this in the future, but for now I'm willing to accept the risk of having an incorrect redirect count and get it out to more people in the meantime.

</comment></comment></comment></comment><comment><USER4> Be VERY careful with this - it may end up hurting the charities you want to help. If Amazon dislikes this they may not be able to do anything to you (or to get you to stop it) but they may be able to shut down charities that are receiving money because of you. I wouldn't be at all surprised to find language in the affiliate agreements that bars this kind of thing and kills accounts of charities that use it.

<comment><USER5> I've made a few comments but you're at the top currently so I'll piggy back:

To OP, in the words of Hank Williams "I've been down that road before..."

I wrote a FF extension for our site that did something (I'm guessing similar), look at the site, and do the appropriate redirect with some ids and what not so i could track the charity for CJ/LinkShare/Amazon/whatever flavor. Theicon would turn green if you were affiliate shopping and I was taking redirects from Slickdeals and sites like it and making them my own transparently. You may have a newer, better method that gets around agreements sites make but from my experience, the affiliate houses (and retailers) much prefer actual driven traffic to a scraper like mine (and maybe yours). In retrospect, I can see that it was essentially a leach. I wasn't really encouraging many people to do shopping they otherwise wouldn't have done (well that would be the retailers point I guess). If I had any influence it was only marginal and I was taking revenue directly from direct traffic sites which, most likely, weren't happy and might not continue to drive traffic to certain retailers if commissions went down by a noticeable margin (or link jacking was allowed in the TOS).

I haven't read your code, I'm purely guessing as to what it does, so if I'm offbase let me know and I'd be very interested in your approach).

EDIT: After finishing that novel, I actually looked at the site. Does it just redirect any link to Amazon? I was expecting some link-jacking and ID insertion, so maybe nevermind. Mine was charity based as well (similar to Goodshop) but a bit more aggressive (in the charity's favor) which is where I believe the downfall to be.

<comment> stp-ip Still I think @atwebb is right and as [http://socialvest.us](http://socialvest.us) and [http://aflattr.com](http://aflattr.com) were already shutdown Amazon is just not that happy with someone taking their revenue to charities. If it's just redirecting to smile.amazon.com it could be alright as it's the "sane" revenue share of only 0.5% and Amazon is promoting it itself, but still the automatic redirect will perhaps let them kill it.

</comment></comment></comment><comment><USER6> But then... why doesn't Amazon always donate? Free PR it seems.

</comment><comment><USER7> Is it really necessary for this extension to "access your data on all websites" and "access your tabs and browsing activity"? That's asking a lot.

Shouldn't it only need to access amazon.com? E.g. once it detects my browser is on amazon.com, just redirect to smile.amazon.com. What else does it need to do?

<comment><USER8> Pretty sure chrome requires all extensions to state that. It's not that the application needs to, but in the event that it does, chrome wants a catch-all phrase.

<comment><USER7> That's not true. Look at the first example in the docs: [http://developer.chrome.com/extensions/permission_warnings.h...](http://developer.chrome.com/extensions/permission_warnings.html)

</comment></comment></comment><comment><USER9> I understand this is for a good cause, but isn't this just stealing money from Amazon? You are exploiting a program that is designed to encourage additional sales, not give money away from any random Amazon transaction.

<comment><USER10> No, it's not stealing from Amazon. They offer the referral system as a service to those who wish to refer people. It's a relic of their 'growth-hacking' days. If they thought it was stealing, they'd simply discontinue the service. It's easy to argue that they don't need it anymore.

But, as someone who's looked into the legality of this (I was building something very similar, but with a narrower charity set than the OP's), it _is_ against their terms of service.

</comment></comment><comment><USER11> Just out of curiosity - if a charity has an affiliate account, won't they get like 4%+ of the purchase? ([https://affiliate- program.amazon.com/gp/associates/join/land...](https://affiliate- program.amazon.com/gp/associates/join/landing/referralfees.html))

This chrome extension is really cool, and good for just forgetting to use charity affiliate links, but if your charity has an affiliate account that's the best way to do it right?

<comment> stp-ip 4-10% actually. And there were projects actually using these percentages to donate to good causes, till Amazon burned them and copied the idea to make it more financially positive for them 4-10% vs 0.5%.

</comment></comment><comment><USER12> Neat idea. I did something similar except it was meant to support your favorite podcasts or websites through Amazon Affiliate sales and I didn't build a plugin, I used an existing one in a different way.

[http://tortillasinbed.com/post/60098833373/spreading-the- lov...](http://tortillasinbed.com/post/60098833373/spreading-the-love)

</comment><comment><USER13> Reminds me of Daniel Gross's first product (before Greplin/Cue) [http://www.lostinmobile.com/home/daniel-gross-and- greplin.ht...](http://www.lostinmobile.com/home/daniel-gross-and-greplin.html)

</comment><comment><USER14> I do love the idea of this. Even immediately downloaded it to my torch browser, but I did want some input before actually using it. Seems like there is some hesitation. How safe is this? And will it be bad for Amazon or the charities involved?

</comment><comment><USER15> I tried your extension but it caused Chrome to get stuck in an infinite redirection loop.

I used the eBook link to amazon.com on this page: [http://37signals.com/remote/](http://37signals.com/remote/)

<comment><USER16> I made a very similar extension last week ([https://chrome.google.com/webstore/detail/always- smile/fpaap...](https://chrome.google.com/webstore/detail/always- smile/fpaapignoneonaghhkoddkghglbppdmg)) and encountered this issue, too. You can resolve it by going to [http://smile.amazon.com](http://smile.amazon.com) and choosing your charity. After that, the extension should work as expected.

</comment></comment><comment><USER17> I hadn't heard of Amazon Smile until now. Why doesn't Amazon do this for every transaction? Would it hurt business to give 0.5% to charities automatically?

<comment><USER18> Amazon already operates at very small margins ([http://ycharts.com/companies/AMZN/profit_margin](http://ycharts.com/companies/AMZN/profit_margin)), so any amount given to charity hurts the bottom line.

</comment></comment><comment><USER19> I'm guessing this affects affiliate redirects, right?

<comment><AUTHOR> Yes, this will also redirect affiliate links

<comment> stp-ip I don't want to discourage you, but socialvest.us and aflattr.com both did redirect via affiliate links and were burned from Amazon.

<comment><USER20> And it absolutely makes sense.

Amazon isn't just giving out free money. Affiliates are meant to drive traffic to the Amazon website. This service doesn't seem to do that.

</comment></comment></comment></comment><comment><USER21> How about a browser extension that tries to find local/national alternatives to Amazon while viewing articles on Amazon?

<comment><USER22> You can give my extension a try : [http://www.shoptimate.com](http://www.shoptimate.com)</comment></comment>


This is why cognitive behavioural therapy works so well - <AUTHOR> https://aeon.co/essays/this-is-why-cognitive-behavioural-therapy-works-so-well <comment><USER2> " 'It is what it is' ... this phrase represents what psychologists call an emotion-regulatory strategy.

...

It's an efficient means of distancing ourselves from difficult experiences, to create mental space and, potentially, to ignore – in a good way – percolating negative emotions.

"</comment>


Restic – Backups Done Right - <AUTHOR> https://restic.net/ <comment><USER2> Also check out Borg: [https://www.borgbackup.org](https://www.borgbackup.org)

And some resources on how they're different:

\- [https://github.com/restic/restic/issues/1875](https://github.com/restic/restic/issues/1875)

\- [https://stickleback.dk/borg-or-restic/](https://stickleback.dk/borg-or- restic/)

\- [https://sysadministrivia.com/episodes/S4E5](https://sysadministrivia.com/episodes/S4E5)

The general concensus seems to be that restic is borg with more whistles (backing up to various places), but borg is the more trusted tool with the longer history (just use SSH and be done with it). I personally recently used borg for a migration between computers and it worked great for me.

<comment><USER3> Borg's encryption is questionable at best. Performance wise it's not particularly good and probably will never get better because of the large, somewhat complex Python codebase.

<comment><USER4> What's questionable about it? It seems that they use modern AEAD ciphers in a reasonable way.

I'm more concerned about the repository format and config file (i.e. attack surface, since the repo is potentially untrusted).

Performance is actually better than Restic, and performance-critical parts of Borg are written in C or use C libraries.

<comment><USER3> > What's questionable about it? It seems that they use modern AEAD ciphers in > a reasonable way.

No, using one key per repository and a persistent message counter is not a reasonable design.

[https://borgbackup.readthedocs.io/en/stable/internals/securi...](https://borgbackup.readthedocs.io/en/stable/internals/security.html)

<comment><USER5> For what threat model does this matter?

<comment><USER3> "When the above attack model is extended to include multiple clients independently updating the same repository, then Borg fails to provide confidentiality (i.e. guarantees 3) and 4) do not apply any more)."

Edit: I've posted this a bunch of times here, pretty much every time it caught my eye when someone said this tool has good crypto, and by now I'm used to people just downvoting it and saying it doesn't matter because obviously no one ever would use it like that and the design is fine etc. (isn't the point of deduplication to save disk space?)

</comment></comment></comment></comment></comment></comment><comment> mike-cardwell I started using Restic recently. It's good and I'm going to continue using it. That said, there are a couple of bad problems with it:

Firstly, if you want to prune old backups, e.g keep the last N1 hourly backups, and the last N2 weekly backups, etc, then it has that ability, however whilst it's doing it, the client has to download and upload a tonne of data in order to repackage the backup files that contain some data that needs removing and other data which doesn't.

Secondly, I've set up an "append only" system, where my various hosts can append to their own backups, but not overwrite or delete them. I wanted the backup server to be unable to read the backups (easy enough, don't supply the encryption keys to the backup server), however at the same time I wanted the backup server to be able to automatically prune old backups. It can not do that without the key. I don't want to give it the keys to the backups as then a compromised backup server means _all_ of my hosts data are suddenly compromised.

<comment><USER6> How would you expect the backup server to be able to prune old encrypted backups if it can't decrypt them? How should it know what to delete?

<comment><USER7> ZFS does that with snapshots already. (ZFS is not encrypted, but the principle is the same)

I believe immutable trees would be the correct algorithm here.

The algorithm relies on a tree structure, where the leaves are the files. Every time a new snapshot is written, every leaf node changed writes a new path to the root node, while leaving the rest of the tree intact.

When a snapshot needs to be deleted, you just remove all the old root nodes and have a garbage-collection like-process delete all the old files.

EDIT: Look at example here: [https://en.wikipedia.org/wiki/Persistent_data_structure#Tree...](https://en.wikipedia.org/wiki/Persistent_data_structure#Trees) . When xs is deleted, nodes a,c,f can also be deleted.

EDIT2: I feel like I can never make posts like these while keeping it short and sweet, and adding enough details. ZFS can be encrypted, but accessing any files is right at its fingertips, not over a slow network connection. And there are caveats about how to encrypt the metadata, but you do not need to decrypt the whole backup to figure out what to do delete.

<comment><USER8> AFAIK that is exactly how restic works. You use `restic forget` to remove the roots (snapshots), then `restic prune` garbage collects unreachable blobs.

ETA: However, nearly all data in restic is encrypted. This includes the index files. So you still need to have the encryption key to look at snapshots and walk their trees.

</comment></comment></comment></comment><comment><USER9> Restic is probably my favorite pure open source backup solution, but I've been using Duplicacy for years now and have been very happy with it. On the GitHub page ([https://github.com/gilbertchen/duplicacy](https://github.com/gilbertchen/duplicacy)) for Duplicacy you can find a comparison to Restic (along with other backup solutions), which I found informative.

</comment><comment><USER10> Unfortunately the primary author has mostly moved onto other things, and hasn't elected any maintainers. It's been three months without any commits, and there's 60+ open PRs.

The biggest missing feature of Restic is no support for compression.

Ah, well.

<comment> aleph- As far as I'm aware from the IRC channel the primary maintainer is mainly busy moving.

I do concede it is annoying having to fold in upstream PRs to my own build of it.

</comment></comment><comment><USER11> This seems very similar to Borg Backup [1], so I'm interested to hear from others who have used both on how it compares.

More generally, I've been looking for a solution that helps distribute backups in a peer-to-peer way. I have a few friends with their own home servers, and we want to replicate backups across each other's servers for geographical redundancy. Currently, I have a script that uses rsync to copy some tar archives over daily, but this doesn't scale well as more peers want to join our backup-sharing group, since it requires them granting me SSH access.

What I need is a decentralized network to share and retrieve backups from peers. I tried using dat [2] with a Borg Backup repository inside it, but ran into some nasty issues with dat which would cause it to regularly crash and one time even corrupt the data.

Does anyone have any suggestions for such a situation?

[1] [https://www.borgbackup.org/](https://www.borgbackup.org/) [2] [https://github.com/datproject/dat](https://github.com/datproject/dat)

<comment><USER12> This might not be quite what you're looking for, but Syncthing[1] is a popular P2P file sharing solution. You could use Restic to make backups to a shared Syncthing folder.

[1]: [https://syncthing.net/](https://syncthing.net/)

<comment><USER11> Thanks for the suggestion. I've tried Syncthing, but it seems to still require that users are explicitly added (i.e., no public access [1]). I'd prefer a solution where anyone could decide to start helping replicate backups, without me having to add them in some way.

[1] [https://github.com/syncthing/syncthing/issues/1942](https://github.com/syncthing/syncthing/issues/1942)

<comment><USER12> Then you should look into IPFS :)

[https://github.com/ipfs/ipfs](https://github.com/ipfs/ipfs)

<comment><USER11> As far as I know, IPFS objects are immutable. Is your suggestion that I publish some sort of index containing all of the IPFS links to my backups, and then my friends can automate pinning those links? I think that could work, but it would be pretty bandwidth intensive since there would be no deduplication (I'd have to also encrypt since I wouldn't want everyone to have my files).

<comment><USER12> I'm not suggesting anything specific. Personally, I think allowing permanent public access to your server backups sounds like a terrible idea, but it's your data and you choose your threat model.

</comment></comment></comment></comment></comment></comment><comment><USER13> I've been using Restic recently for backups online (to Backblaze, which it natively supports) after using Duplicity for a while. I'm really, really impressed so far; the hash-based deduplication means:

\- I don't have to think about deduplicating my own data, which works well with my packrat tendencies (e.g., multiple copies of music library on snapshots of old laptops);

\- Full-disk backups of multiple machines will share a lot of storage (all system files from my desktop and laptop, both running the same Linux distro);

\- Restarting a long upload doesn't depend on some finicky state regarding an interrupted previous backup; it can just rescan the whole disk and skip uploading blobs that are already there, which feels much more robust to me.

<comment><USER5> FYI those are all functions of any deduplicating backup software, of which there are several out there, Restic being only one of them.

<comment><USER13> Yes, indeed; Restic just happened to be an easy-to-use deduplicating backup program that supports various cloud storage backends, including the one I happen to use (Backblaze). Not needing to patch together some sort of pipeline of dedup --> upload to remote storage is a nice selling point.

</comment></comment></comment><comment><USER14> There's also Duplicacy which I feel is a bit more mature than restic (I felt it more performing and it also has a web interface but the lack of mount capability that restic has is what I miss and retention policy is quite easier to specify for restic too), though it's a paid software for non personal usage.

But paid is good that the author has less reason to move away from it. (As mentioned elsewhere, restic hasn't been updated in a while but they recently changed their pricing to be much more agressive which I hated. I wish they give it a softer pricing model than cost per machine.)

[https://duplicacy.com/](https://duplicacy.com/)

Their comparison of cloud storage providers gave me a good insight on what to choose in terms of performance.

[https://github.com/gilbertchen/cloud-storage- comparison/](https://github.com/gilbertchen/cloud-storage-comparison/)

I use both restic and Duplicacy, so my backups are done by multiple implementations toward multiple destinations not to get bitten by one of their bugs to avoid the saying "backups aren't working when you need it the most".

</comment><comment><USER15> This looks great. I've been using Arq for years and no complaints but I might switch.

I've also been using Syncthing for syncing machines. It's pretty great. i've got it setup so 2 laptops sync to a server and no issues so far.

<comment><USER16> I'm a long time Arq user too. I looked at Restic but was a little disappointed it didn't support compression. There is an old, still open issue with a ton of comments: [https://github.com/restic/restic/issues/21](https://github.com/restic/restic/issues/21)

</comment></comment><comment><USER7> Glacier Storage/Cold storage, which usually takes ~6h to retrieve files, on Cloud providers are really cheap (I know Azure has $0.99/TB/month), but I have a hard time finding any free backup solutions to support the very-high latency natively.

I remember reading a long time ago that Restic was not going to natively support cold storage solutions. Has anything changed?

<comment><USER17> You should not backup directly to Glacier, you should backup to S3 and move from S3 to Glacier by retention policy configured for an S3 bucket.

<comment><USER7> And when I have to do incremental backups or retrieve a single file, do I have to move the whole backup from cold storage, and then back again?

<comment><USER17> I did not understand "back again" part. Glacier allows you to retrieve individual files.

</comment></comment></comment></comment><comment><USER18> Restic works very well for me, and I've successfully used it to restore lost files.

The one issue I've encountered with it: it uses a _lot_ of memory, proportional to the size of the repository indexes, so if you're backing up a lot of data on a machine without a lot of RAM (such as a virtual server), you may run out of memory. Setting GOGC=20 can help slightly, but ultimately, restic needs fixing to support working on indexes larger than memory.

</comment><comment><USER19> Filippo Valsorda (Go's current crypto maintainer) took a little bit of time to look at the cryptography used by restic: [https://blog.filippo.io/restic- cryptography/](https://blog.filippo.io/restic-cryptography/)

</comment><comment><USER20> Borg Backup (for similar reasons as Restic) essentially shifted backup from my "I-don't-but-I-should" list to my "solved problems" list. Is there anything similar for binary distribution?

Here's what I mean. I develop a software/firmware stack that is typically delivered to users as a set of large (100M) tarballs and binary images. Even though the vast majority of the payload does not change from release to release, it really has proven necessary to distribute just the final blobs.

Technologically, it's almost identical, but distribution implies a different set of access controls and an Internet-friendly user interface.

I see the idea floating around in e.g. NextCloud forums but this seems like a relatively compact problem without a obvious candidates to solve it.

<comment><USER21> Perhaps something like OSTree?

<comment><USER20> Thanks, OSTree sounds like a good place to start.

</comment></comment></comment><comment><USER22> There are a few downsides to using restic:

No support for compression yet

No support for deleting data from snapshots

No support for continous backups (restic walks the directory tree for each backup).

No support for resilience from disk errors using par2 or similar

Backing up millions of small/empty files uses a _lot_ of memory

<comment><USER23> Some more:

Not too many storage backends.

No GUI tool.

Hard to implement lifecycle policies like "keep N last hourly backups and M last weekly backup"; and not optimized for this usecase (needs quite a bit of data transfer to accomplish due to the zero-knowledge server-side encryption).

</comment></comment><comment><USER24> I use and like Restic but I wish I could easily have "write only" keys like I do with tarsnap so an intruder can't delete all my backups.

I heard there's a way to have an "append only" backup or something like that. Is it possible to still prune old backups from time to time?

</comment><comment><USER25> Restic can operate over (among other methods) plain old SFTP[1]. Therefore, it does - and always has - work perfectly with an rsync.net account[2].

I personally find it reassuring that even though I might be creating and maintaining backups with sophisticated tools like borg or restic or duplicity or rclone ... at any time, and _from any system_ I can grab those backups with dumb old SFTP.

[1] [https://www.rsync.net/products/sftp.html](https://www.rsync.net/products/sftp.html)

[2] [https://forum.restic.net/t/restic-commands-for-rsync- net/216...](https://forum.restic.net/t/restic-commands-for-rsync-net/2162)

</comment><comment><USER5> For a very good introductory read on what all this deduplicating backup software is all about and how it is a "new school" to the "old school" of incremental backup softwares (where duplicity (which you might want to either also check out, or migrate from) is the king) and its full/incremental model, and about the advantages and disadvantages of the two, I recommend this surprisingly well written guide from Backblaze: [https://www.backblaze.com/blog/backing-linux- backblaze-b2-du...](https://www.backblaze.com/blog/backing-linux- backblaze-b2-duplicity-restic/)

</comment><comment><USER26> I moved from borg to restic because of the native support for B2 buckets (a lot cheaper than dedicated rsync/ssh type cloud file systems). My use case is backing up daily snapshots of my Onedrive (synced locally via rclone). As my important files are mostly immutable (photo library, pdfs), I don't have to prune snapshots. Pruning is really slow compared to borg.

I never backup workstations or home directories, as I can always generate them again using NixOS and home manager. For source code, nothing beats git repos.

</comment><comment><USER27> I've been using Duplicati, which has been doing a great job at keeping my backup sizes low and has a handy interface.

I've been keeping encrypted remote backups for ~300 Gb worth of data, which occupies ~150 Gb. On Backblaze B2, it's costing me ~$10CAD/mo, which is a _lot_ cheaper than Tarsnap.

I might try Restic (always good to have a backup backup system), but I'm not sure how ergonomic it'd be on Windows.

[https://www.duplicati.com/](https://www.duplicati.com/)

<comment><USER28> My duplicati experience has not been great - I found that it couldn't recover well from backup corruption (multi-day recovery times for ~1TB of data when everything was local and USB-connected!).

The web interface is what keeps me on it.

<comment><USER29> Same here. Duplicati works great until you actually have to restore. It took me 3 hours to restore a 12GB backup. After that I quit using it.

Now I just made my home folder a shared folder on Syncthing, in send only mode, so it constantly backs up to my Nas. Much faster and the backup is directly readable.

<comment><USER27> Agreed, backup is slow (although recent versions are leveraging multi-core CPUs, so that's given a modest speed-up).

Syncthing in send-only is not a sufficient back-up strategy for 90% of use- cases, however. Without incremental back-ups, you're still susceptible to ransomware and data-loss should syncthing update after the event. I do, however, like to keep a "verbatim" copy in addition to my incrementals since they are less likely to have a "restoration" problem.

</comment></comment></comment></comment><comment><USER30> I've been using restic to backup my workstations for quite some time now and it works well enough.

At work I have a systemd service which runs every 10 minutes and use a nfs repository. Performance is good. It has saved me once already after a botched Ubuntu upgrade.

At home I have a identical service but it runs every 6 hour and use a backblaze b2 repository. Performance is not great. However I've been backing up ~20 GB for over a year now and it has cost me less than $2 _in total_ so I'd say it's worth it.

</comment><comment><USER31> I recently set up Restic to backup my server to my local Synology and it was actually surprisingly easy. Before that I was using Duplicity which broke after a while and it all felt a bit more tricky to get going.

Documented it a bit here, mostly so I can go back and copy / paste commands if I have to:

[https://blog.notmyhostna.me/backup-cloud-server-to- synology-...](https://blog.notmyhostna.me/backup-cloud-server-to-synology- nas/)

</comment><comment><USER32> I've been looking for a solution for something like this and not sure if Restic can do this, so please chime in.

Does anyone know of an open-source solution that acts just like Dropbox/GDrive where it detects for any changes in a specified folder and then once detected it automatically uploads to an S3 folder?

<comment><USER33> Syncthing and s3-fuse to create a local pipe to s3.

[https://github.com/s3fs-fuse/s3fs-fuse](https://github.com/s3fs-fuse/s3fs- fuse)

<comment><USER34> S3-Fuse has been really unreliable for me (hard-hangs, and similar) ... is that your experience as well, or has it been reliable?

<comment><USER33> I haven't used this combination, I haven't used FUSE in awhile, and I forgot to add a disclaimer. FUSE in general has been flaky for me, too. Syncthing has worked pretty well for me though, so I looked to see if Unix Philosophy™ could be used to smash a couple things together. I think that at the end of the day, they are both deceptively complicated technologies.

</comment></comment></comment></comment><comment><USER35> The biggest problem I've had with backup software is being able to verify when using aws s3 glacier with and without a data pull. Is this possible and efficient with restic? The only software I've found that does this well is Arq

<comment><USER36> I've been researching this use case and it sounds like Restic doesn't handle it well without adding more layers.

[https://forum.restic.net/t/restic-and-s3-glacier-deep- archiv...](https://forum.restic.net/t/restic-and-s3-glacier-deep- archive/1551/2)

I've largly decided on Duplicacy over Restic, Borg or Duplicati.

</comment></comment><comment><USER37> I've been using this and it is the best I have found so far.

The only issue I encountered was with trying to back up 2.5TB of new data over a shitty German internet connection, which first took forever (restarting 20 times because they force your IP address to change once a day), and then when trying to prune the backup, ran out of RAM memory and actually corrupted it.

I'll continue to use it, just not repeating those specific steps, but it was not immediately apparent that the backup was completely unusable. _Always test your backups_ (regardless of whether it's about restic, borg, examplecorp expert enterprise backup, or something else)!

<comment><USER38> Restic has that option with "restic check", I have it run weekly and email me the results.

<comment><USER37> That sounds like a good system! I check every now and then by mounting and checking that a recent file is there, not sure why I didn't think of doing this instead.

</comment></comment></comment><comment><USER39> Is backing up still a thing? I prefer to keep my laptop stateless:

* I use Ansible to configure a vanilla Ubuntu 18.04 into my workstation [1]

* I keep everything that is "source code-y" in some Git repo

* I keep non-source-code-y stuff in Dropbox or Seafile (both have a restore to previous version)

I prefer everything else to be lost (e.g. some AWS, K8s credentials).

I wipe my laptop between customer projects and it works great.

[1] [https://github.com/cristiklein/stateless-workstation- config](https://github.com/cristiklein/stateless-workstation-config)

<comment><USER40> I do this too, and am surprised not to see more recommendations for it. It's simpler than a traditional full system backup, lessens security risks like copying credentials into a backup, and IMO keeps things better organized as well. I know Dropbox or git repos are just syncing the files I care about, in a way that I want them organized and can browse on a web interface, on mobile, sync to another device even if it doesn't have all the same software installed, etc. Whereas with a full system backup, there's not always a clear line between system configuration and data files, so depending what apps you're using the data that you're backing up might only be able to be accessed again on an exact copy of the machine running all the same versions of the same apps, which is often not what I actually want.

<comment><USER41> I don't back backup my machine states, just home directory and other data.

</comment></comment></comment><comment><USER42> I understand that Restic is using deduplication but what's the advantage over rsnapshot? There's AES encryption but how do you handle the credentials with automated backups?

<comment><USER43> I've been using rsnapshot for a decade or more. For a modest amount of data (a few TB) the performance is adequate, and it is easy to verify the backups. It is also easy to restore files, just go into the directory corresponding to the date of the backup. I could try to run compression in the filesystem itself to save space, but haven't done that so far.

</comment></comment><comment><USER44> What you think about Restic vs Duplicati? Any personal experience?

<comment><USER45> I've been using Duplicati 2.0 beta (aka "stable") builds, not canary/testing, for 2+ years, and at least three times, on three different machines each with different backends (two using ZFS, scrubbed regularly with no data issues), I've encountered issues with database corruption which wasn't fixable with repair and rebuild. There are lots of things I really like about Duplicati (OSS, backend flexibility, dedup, encryption, active development, etc.), but I'm going to be moving to another solution for a little while until a super stable release is available. Restic was at the top of my list even before this most recent HN nod.

<comment><USER36> Check out Duplicacy. It seems very solid, none of the Duplicati like issues.

</comment></comment></comment><comment><USER46> Tangentially related but I'll lay out a problem I have for a small office I run. I want to backup and sync my files cheaply somewhere, say GDrive. I want a Uzi that gives me snapshot/versions of files it backed up. Is there a good open source solution for this? Restic and friends are a little too technical for my non-technical office. Thanks

</comment><comment><USER47> How does it compare to Rclone? [https://rclone.org/](https://rclone.org/)

<comment><USER48> Afaik, restic does incremental backups (diffs) and encryption. This is great if you need to go back in time and it's safer if something for example corrupts your files (the backups don't get overwritten with corrupt versions). But it is more difficult to restore, the files are split into chunks for deduplication, so you are not able to actually see your backed up files — you need to run the restore process first. I am using rclone right now, and have it set up to archive old file versions (--backup-dir). It's simpler and covers my needs for now.

</comment></comment><comment><USER49> I really would like to use Restic, but it seems that their repos randomly break and it seems that it is still not resolved. [https://forum.restic.net/t/recovery-options-for-damaged- repo...](https://forum.restic.net/t/recovery-options-for-damaged- repositories/1571)

Any news on this?

</comment><comment><USER50> Solid piece of software, I use this every day!

One small issue which I need to figure out is the hosts directory being empty when using "restic mount": [https://github.com/restic/restic/issues/1869](https://github.com/restic/restic/issues/1869)

</comment><comment><USER51> But does it come with sharepoint integration? Because if you claim to do that right, then this is surely snake oil.

</comment><comment><USER52> I put a tutorial together for this not too long ago, a very good tool and great when paired with Minio/s3 - [https://github.com/alexellis/restic-minio- civo-learn-guide](https://github.com/alexellis/restic-minio-civo-learn-guide)

</comment><comment> mike-cardwell I recently set this up using Nginx as my restic backend server. Not as a proxy to a backend server, but the actual backend server. No other applications required:

[https://www.grepular.com/Nginx_Restic_Backend](https://www.grepular.com/Nginx_Restic_Backend)

</comment><comment><USER53> Fantastic software. Fast, locally encrypted before being shipped to the cloud (or a usb disk), just works.

<comment><USER54> I've been using it for about 6 months now, backing up my home directory 3-4 times per week to an external HD. Would also agree that it's fast, easy to use, and also easy to recover files. I'd add that the documentation is really well written.

</comment></comment><comment><USER55> I would argue that the 2nd most important part of a backup is the restoring. Many products don't focus on that enough because it's not the part that most customers will experience until there is an emergency.

</comment><comment><USER56> from what i read restic has memory scaling issues for certain areas (large amounts of small files, pruning operations).

that said, i do use it personally for private and small stuff.

</comment><comment><USER57> I like HashBackup. It's not open source unfortunately, but I like the incremental encrypted backups while also being able to pull out a single file easily.

</comment><comment><USER58> > Easy: Doing backups should be a frictionless process, otherwise you are > tempted to skip it. Restic should be easy to configure and use, so that in > the unlikely event of a data loss you can just restore it. Likewise, > restoring data should not be complicated.

So does it have a GUI Version?

<comment><USER59> Yeah also interested in a GUI?

<comment><USER58> I was unable to find one so I guess it's just "easy" for a certain narrow group of people.

</comment></comment></comment><comment><USER60> Learned about this program when pwning Registry on HackTheBox

</comment><comment><USER61> Metadata?

</comment><comment><USER62> Just so I understand right and out of curiosity, what does that offer more than the likes of Nextcloud: [https://nextcloud.com/](https://nextcloud.com/) or Duple: [https://www.duple.io/en/](https://www.duple.io/en/)

Since if I understand correctly both provide backup in addition to other functionalities?

<comment><USER53> Nextcloud is a different product. restic is for backup.

<comment><USER62> May you elaborate? What does it offer more? Since Nextcloud and Duple do offer backup as well.

<comment><USER53> Nextcloud is a web app that lets you work with files and offers lots of other plugins too, like e-mail, calendaring, office, contacts. It's not a backup program. See [https://nextcloud.com/](https://nextcloud.com/) or [https://en.wikipedia.org/wiki/Nextcloud](https://en.wikipedia.org/wiki/Nextcloud)

<comment><USER63> You might, for example, use restic or borg to back up your Nextcloud's installation and storage.</comment></comment></comment></comment></comment>


Field Notes from my Dementia - <AUTHOR> http://lithub.com/field-notes-from-my-dementia/ <comment><USER2> My father had Alzheimer's for quite a few years before he died. He did not go at all quickly. He continued to be able to fool strangers into thinking he had his faculties, but he would talk to me on the phone, clearly not knowing I was his daughter, and try to be glib and witty and make small talk. This no doubt worked on strangers, but the fact that he did not know I was his daughter was a bit hard for me to miss.

His death was very slow. He basically starved to death ever so slowly. The one photo I saw from his funeral was unrecognizable. He had always been a big man with a round face. He was basically a skeleton.

I think the entire family was basically glad to see his suffering at an end. We had already lost him years earlier, but now he could finally rest.

</comment><comment><USER3> I've just gone through an, admittedly short, HN commentary and felt compelled to hit the UV button on every single comment - I'm usually pretty stingy in that regard.

The article is beautifully written and I defy anyone to read the quote below to not be touched in some way. To then realise, later on, that the writer is also afflicted with Alzheimer's is very poignant.

This is a very touching and tender reflection of what a mind and intellect can be and what the gradual and cruel destruction of self means to the sufferer.

"As Murdoch's illness continued to crumble away her language and reason, she gradually abandoned attempts to write. Soon sense departed from her speech as well—except to him who loved her deepest and longest. There came a day when Iris laid her hand on Puss's knee and said, "Susten poujin drom love poujin? Poujin susten?" Bayley needed no more help than her hand gentling his cheek to distill from this jumble the grammar of love."

<comment><USER4> i have to certainly agree. the article itself was a thing of beauty, so poignant as to be a work of art in and of itself. the suffering that individuals experience with alzheimers is a great sorrow in this world, and it's always so awful to hear of it, but yet it fed such a powerful expression and brought so many disparate people together in the HN comments section for the article to express such beauty and vulnerability with regards to their own suffering and experiences in life related to the topic at hand. i am fairly stingy with up votes too but I think just about everything said here deserves one as well :)

</comment></comment><comment><USER5> I admitted my mother to a care home the day before yesterday. Went to see her after her first night and she seemed shocked to see me initially, but settled after a few minutes. She knew who I was and asked where she was and why she was there, I told her she'd been getting more confused and wandering, and leaving the gas hob on with no flame. It was for her safety and better care, and more interaction with people and staff, with activities and regular meals. A little later, she asked if I had a mother or siblings in the area.

I've been living half way round the world for the last 15 years and other than irregular visits have watched her decline from afar. From getting confused on the phone, to not knowing (from what her home carers said) that the phone ringing meant anything other than an annoying noise. To getting picked up wandering the street by the police at 3am in her nighty.

A friend called not long after I left the care home, he has a way of putting a lot of things into a single sentence and said, "ah yes, an emotional rollercoaster, wrapped in guilt".

</comment><comment><USER6> If there is anything that scares me it is dementia. My grandmother suffered from a mild case of this and it really affected me. I seriously hope to side- step this later in life, either by luck or by choice.

<comment><USER7> I was grieving for my "lost" father for a couple of years before he died. Fucking heartbreaking for me, but whoever he'd turned into seemed at peace and satisfied with life for almost all of that time.

<comment><USER8> >Fucking heartbreaking for me, but whoever he'd turned into seemed at peace and satisfied with life for almost all of that time.

I've witnessed the flip side of this: a grandparent with a hard life plagued by worry amplified by the confusion of Alzheimer's. Slowly wasting away for a few years. She did love her sons and grandkids playing piano up till the end, though.

It is truly a beastly disease.

</comment></comment></comment><comment><USER9> I find articles written by people in early stages of dementia almost too sad to read. Few conditions rob us our humanity like dementia.

<comment><USER10> Agreed. I have tears in my eyes after finishing this one. I cant imagine living through it myself. My mind is my everything... I would likely consider suicide, and I don't know whether that makes me weak or silly, but I can't see much of a way out with a disease like this.

<comment><USER8> >I would likely consider suicide, and I don't know whether that makes me weak or silly...

Up till the end of his life after suffering from early onset Alzheimer's, Terry Pratchett argued that such an option is certainly not weak or silly.

Here's a reading of his essay called Shaking Hands with Death [1] by a good friend of Pratchett's. His whit and charm and spirit really shine through this essay dictated to his assistant years after he had lost the ability to type.

Terry Pratchett has long been my favorite author, but his bravery while battling Alzheimer's has made him my hero...

[1] Terry Pratchett: Shaking Hands With Death

[https://m.youtube.com/watch?v=90b1MBwnEHM](https://m.youtube.com/watch?v=90b1MBwnEHM)

<comment><USER11> Terry Pratchett also made a great documentary called _Choosing to Die_.[1] Here's a trailer for it: [2]

[1] - [https://en.wikipedia.org/wiki/Terry_Pratchett:_Choosing_to_D...](https://en.wikipedia.org/wiki/Terry_Pratchett:_Choosing_to_Die)

[2] - [https://www.youtube.com/watch?v=xsvwhuOSApI](https://www.youtube.com/watch?v=xsvwhuOSApI)

</comment></comment></comment></comment><comment><USER12> Just FYI for this thread,

The Alzheimer's association [1] deals with forms of dementia and brain diseases outside of just Alzheimer's. If you or anyone you know has concerns feel free to call their help line. A good chunk of their services revolve around helping the less fortunate with medicare applications and finding appropriate care for those who can't afford it.

[1]: [https://www.alz.org/](https://www.alz.org/)

</comment><comment><USER13> Is the last paragraph just a poetic ending or a demonstration of wandering mind affected by dementia? The sentence can be parsed and seems to have a discernable meaning but the associative leaps and comparisons seem highly unusual to me.

I honestly can't tell. Perhaps because I'm a non-native English speaker with a lack of subtlety when it comes to literature.

<comment><USER14> It's a bit purple, but it reads fairly cogently to me; it's just a very long run-on sentence.

That might be attributable to dementia, or a deliberate style choice; I'd kind of lean towards the latter given that plenty of the preceding article is expressed in clipped, curt statements without much excessive detail.

It is sad, though. The writing of Terry Pratchett puts this on somewhat depressing display, with many of his later novels lacking the punchy dialogue and tight focus of his early and mid-career works. They feel a bit more floaty, out-of-focus, and characters are more likely to pontificate than demonstrate a point through action or indirect reference.

They're still good stories written by a very talented and creative author, but you can tell that he was having more difficulty with it towards the end.

<comment><USER15> Similar to Pratchett's later books -- and Iris Murdoch, as mentioned in another comment -- are the late works of the composer Iannis Xenakis. As long as a decade before he was forced to withdraw from public due to dementia, his music underwent a very peculiar stylistic change where the immense complexity of the earlier pieces (Xenakis built his career on combining music with his work as a modernist architect and erstwhile student of maths) gave way to a very repetitive, single-minded sort of texture.

</comment></comment></comment><comment><USER16> > During the year Murdoch was diagnosed with Alzheimer's, she composed a note > that was downright ominous. "My dear," she wrote, "I am now going away for > some time. I hope you will be well . . ." She set aside the sheet, took up a > second one, and wrote, "My dear, I am now going away for some time. I hope > you will be well." A third sheet consisted of pen marks that did not add up > to any intelligible lines.

Reading this part sent chills down my spine. If anyone has seen the movie Antichrist, they might recall a particular scene that echoes (and was perhaps inspired by) this anecdote. I truly think losing ones mind is one of the most terrifying things to imagine -- the very fabric of reality coming apart at the seams.

</comment><comment><USER17> It's great that somebody studied her writing to map the progress of the disease but it's a pity they only sampled three books so it gives no insight into the rate of decline or how early it began to diverge from normal age related mental decline.

".. linguistic creativity dwindled markedly over an almost 20-year period" is based on comparing one book at the beginning of that period and one at the end. We have no idea if it really dwindled over 20 years or all happened quickly on the final year. This is what's most interesting to me - both the possibility of very early diagnosis and being able to predict the rate of decline so you can make informed decisions about how to manage your life if you've been diagnosed.

</comment><comment><USER18> These day I struggle to name things, everyday mundane things. My vocabulary is seriously diminished. It could be sleep. I am pretty sure lack of quality sleep is playing a role, but it is worrisome nonetheless. What gave me some reassurance was coming to know that such symptoms are not that rare.</comment>


Taking a look at Linear Regression - <AUTHOR> https://medium.com/technology-nineleaps/linear-regression-ae0b4b4fbbc9 <comment><USER2> Linear regression is considered "machine learning" now?

And, no mention of the fact that gradient descent is unnecessary as there's a closed-form solution?

It could be a good illustration of how machine learning ideas apply to things the reader hopefully knows, but calling it machine learning itself seems a bit dubious to me.</comment>


Bank of Japan to be top shareholder of Japan stocks - <AUTHOR> https://asia.nikkei.com/Business/Markets/Bank-of-Japan-to-be-top-shareholder-of-Japan-stocks <comment><USER2> America by comparison [0]. Japan has a declining population, the pension scheme is considered to be running on fumes by most, and now the stock market is propped up by government itself.

[https://www.businessinsider.com/who-actually-owns-the- stock-...](https://www.businessinsider.com/who-actually-owns-the-stock- market-2016-5)

<comment><USER3> Same situation in US in my opinion. It's crazy to not be all in on equity index funds, since everyone is invested in them via 401k and pension funds, of course the government is going to do whatever it takes to prop up the value.

<comment><USER4> You're getting it backwards my dude.

Baby boomers turned 65 this year, the peak retirement there will ever be in the history of the world.

Individuals selling small amounts of stock, each for slightly below midpoint, actually has a much larger negative effect on prices than one large sale at slightly below midpoint does. Think about what the order book looks like over time.

People expect a sudden recession. The ride to the bottom is going to be a-historically long and slow, as retirement accounts unwind contractually slowly, and big institutional investors wait out lower capital gains taxes.

<comment><USER3> I think the government will be incentivizing stock ownership much more via state sponsored 401k, or HSAs, or 529, etc. Even now, we're only at just above 50% of population having a stake in public companies:

[https://www.chicagotribune.com/business/ct-americans- dow-220...](https://www.chicagotribune.com/business/ct-americans- dow-22000-investing-20170803-story.html)

Also, number of public companies is decreasing, with the bigger players getting bigger and bigger. And finally, I would expect even more international funds to flow in to the large conglomerates as their efficiencies of scale take over.

</comment></comment></comment></comment><comment><USER5> I enjoy defending capitalism; I think the principle of funneling resources to people who create more resources is sensible.

It needs to be underscored that whatever this is, it isn't capitalism. Exactly which -ism it is I know not; but it is a terrible idea.

Central banks interfering in markets can only be to raise prices long-term. They aren't going to interfere to drop prices, the political pressure is unbearable over the medium term. I'l jump to the American Fed because I know a bit more about it - they haven't been able to sustain interest rate rises in my lifetime [0], there is a very clear downtrend.

This sort of activity in turn disables all the signals used to vent incompetent companies from the system. A direct result of these policies by the BoJ will be companies that take in resource, and churn out value that is less than the inputs. It is unsustainable, stupid and destructive. There are no excuses for it.

I lump the US Fed's QE programs into the same basket, but at least they muddy the waters enough that the links aren't obvious to a neutral observer. The Bank of Japan's activities are sick.

[0] [https://tradingeconomics.com/united-states/interest- rate](https://tradingeconomics.com/united-states/interest-rate)

<comment><USER6> Funneling resources to people who create more resources does make sense, provided the assumption that those specific individuals are the key ingredient to the resource creation.

From what I understand, the people you defend capitalism from tend to assume that those individuals themselves are less relevant than is their place in the larger system.

Does this summary of the arguments line up with your experience?

<comment><USER5> Genuinely productive people are pretty rare (1 in 100 type numbers). I can't claim to know exactly what a debate opponent is thinking, but usually I assume:

1) Most people are more involved with the famous and common 'bullshit jobs' instead of the much fewer super-productive jobs - like a couple of farmers who can feed orders of magnitude more people than just themselves. Maybe they haven't interacted with the parts of the economy that do genuine wealth- creation and don't understand it.

2) They don't accept that incentives matter more than inherent nature, so they believe the productive will continue producing even if the incentives to do so are reduced, so resources can be redirected to 'those with needs'.

The second is a pretty defensible position, although obviously I disagree most of the explicit and implicit assumptions.

As an aside, this has already become one of my fastest down-voted comments. Could someone stop by and explain what they don't like about it? I didn't think it was very inflammatory.

<comment><USER6> Capitalism has become pretty controversial lately, so if I had to venture a guess I would say that's likely why.

Can I ask why you put quotes on 'those with needs'?

<comment><USER5> It is language that leads to hot debate and that I don't personally like. I wanted to keep it isolated from the rest of my paragraph because it isn't my frame, it is the frame of people I don't agree with.

<comment><USER7> I assume you're alluding to: "From each according to his ability, to each according to his needs."

</comment></comment></comment></comment></comment></comment><comment><USER8> If the companies they buy end up making money, might this be an interesting alternative to taxes as a way to fund the government?

<comment><USER9> Corporate profits come from somewhere. It would be a switch from an income tax to a (hidden) federal consumption tax.

The initial money to pay for stock has to come from somewhere, and that somewhere would be more debt or traditional taxes.

The federal government would control the companies (assuming it acquires majority shares), even if government employees aren't staffing them. That's socialism.

Socialism/communism is bad because if given the opportunity for direct control, government can't help tinkering in business affairs to score political points, rather than because it makes the business better.

<comment><USER8> Other than raising the money, that doesn't seem too hard to solve. The Federal Reserve could buy index funds and be a passive investor like everyone else.

I'm reminded of Matt Levine's running joke (?) about whether or not index funds are socialism.

</comment></comment></comment><comment><USER10> Partially off topic: if the US Fed bought publicly traded equities, would we know about it?

<comment><USER11> It's widely suspected that this is part of the job of the Working Group on Financial Markets...

<comment><USER7> Also known as the Plunge Protection Team.</comment></comment></comment>


Defeating a Laptop's BIOS Password - <AUTHOR> https://github.com/skysafe/reblog/blob/master/0000-defeating-a-laptops-bios-password/README.md <comment><USER2> I "cracked" my father's laptop's password when he passed away 15 years ago by buying a similar, broken laptop on eBay for cheap, and unsoldering and switching the ROM/EEPROM containing the BIOS.

Probably one of the coolest things I've done as a teenager.

<comment><USER3> Why re-solder the chip? It seems as though it would be easier to recover data by just yanking the drive, especially since full-disk encryption was quite rare fifteen years ago. Failing that, couldn't you have used a SPI flasher with the existing chip?

<comment><USER4> Can't you still just remove the battery on the mother board for a few seconds? I used to do that all the time back when I was a repair tech...

<comment><USER2> EEPROMs are non-volatile. They don't need power to keep their data. AFAIK removing the battery just resets the real time clock.

</comment></comment></comment></comment><comment><USER5> A lot of passwords can be derived from the serial number. This website will do a lot of the work for you.

[https://bios-pw.org/](https://bios-pw.org/)

<comment><USER6> That's a great re-implementation from some stuff I did eons ago [0].

BIOS passwords are indeed a complete joke as means to secure access. There are a bunch of vendors out there who moved the authentication off from the BIOS/CPU to the KBC (keyboard controller) - Toshiba and Lenovo are among them. Still, it's ludicrously easy to circumvent these.

[0] [https://dogber1.blogspot.com/2009/05/table-of-reverse- engine...](https://dogber1.blogspot.com/2009/05/table-of-reverse-engineered- bios.html)

<comment><USER7> The linked article did not have info about Thinkpads. I wonder how nowadays one can skip BIOS password of a T series thinkpad. So far it has always ended up with a motherboard change for me.

<comment><USER8> There is a trick that work for some (most?) models in the T-series: if you short the pins of some chip with the right timing, you can bypass the password check. See, for example: [https://amp.reddit.com/r/thinkpad/comments/b7jbqq/reset_bios...](https://amp.reddit.com/r/thinkpad/comments/b7jbqq/reset_bios_password_on_thinkpad_t420/)

<comment><USER9> I believe you force BIOS to think that it had been lucky but checksums don't match and EEPROM save is corrupt, then load default and let password go.

Works for straightforward ones like most Lenovo, but not for weirdos like Toshiba. Sometimes I see lots of Toshiba office laptops with locked BIOS waiting to be recycled as the result.

<comment><USER10> Older Toshibas have pins near the RAM that can be shorted to clear the passwords. There's a big list here: [https://biosbypass.com/how-to-clear- toshiba-bios-password/](https://biosbypass.com/how-to-clear-toshiba-bios- password/)

</comment></comment></comment></comment></comment></comment><comment><USER11> Way back in the first years of the 00's, working IT support in college, BIOS passwords were common (though not mandatory) on the Faculty/Staff desktops. So, forgetting passwords was common as well, and at the time we could reset them by opening them up and swapping a jumper to another set of pins. It struck me as fairly useless to have a BIOS password at the time.

Forever after, on bootup, "Warning! Case has been opened!" would flash up on the screen. I assumed that was for warranty purposes, but our IT department was certified for repairs so it didn't really matter.

<comment><USER12> The BIOS should have a reset option for the case open switch. It's just a warning you toggle off in the BIOS. The idea is that only a tech would know the BIOS password to turn it off, so that's how you know that someone knows about it.

It's also unusual that discharging the CMOS removed the boot password. It shouldn't do that. I also worked on similar desktops (they were IBM desktops from before they were spun off) and they didn't have this problem that I can recall. Very few systems had boot passwords, however.

I'm certain that the BIOS passwords didn't clear this way, however, because we had a few systems that had old passwords that nobody knew. Instead, we had a copy of the tech software used to program the BIOS. You had to boot that program and use it to clear the password. HP had a similar program, but that stopped working around 2010 when the computers started to ship with a TPM and you could no longer just clear the content.

<comment><USER13> > HP had a similar program, but that stopped working around 2010

Can I obtain this somehow? I have a business grade HP laptop from 2006 (nw8440 I think) and I forgot my BIOS setup password. I need to enable the NX bit to upgrade from win7 to win10! Removing the CMOS battery overnight (and all other power) did not help.

<comment><USER14> You place a file you _may_ be able to get from support (called SMC.bin) onto a FAT32 USB drive, and then:

1\. Power off.

2\. Hold the Windows, Up arrow and Down arrow keys all at the same time. Only then hit the power button to start.

3\. Release all buttons and press F10.

4\. You should see something about "SMC Command" starting.

5\. Press File, press "Reset BIOS security defaults" or similar.

The only way to get the SMC.bin file, that I know of, is directly from HP Business Support.

</comment></comment></comment></comment><comment><USER15> For my Lenovo Helix 2nd Gen I just need to wait until the battery runs out. This clears the BIOS, including the password.

</comment><comment><USER16> > _Even today 's modern 64-bit CPUs begin execution in 16-bit mode. In UEFI, > this is called the SEC phase._

Is that true even for the T2 Macs and such?

<comment><USER17> Apple has been moving their defenses earlier and earlier in the boot process. According to this talk[0] they are even able to foil malicious option ROM[1] and other early boot attacks. I don't recall if they mention boot passwords specifically, but they claim to lead the industry in this regard.

[0] [https://youtu.be/3byNNUReyvE](https://youtu.be/3byNNUReyvE)

[1] [https://www.blackhat.com/us-19/briefings/schedule/#behind- th...](https://www.blackhat.com/us-19/briefings/schedule/#behind-the-scenes- of-ios-and-mac-security-17220)

<comment><AUTHOR> Verification of option roms as a part of secure boot is a part of the normal uefi spec, however some vendors forgot to implement it

[https://docs.microsoft.com/en-us/windows- hardware/manufactur...](https://docs.microsoft.com/en-us/windows- hardware/manufacture/desktop/uefi-validation-option-rom-validation-guidance)

</comment></comment></comment><comment><USER18> There are quite a few laptops on ebay at considerable discounts because the seller doesn't know the BIOS password. This could come in handy.

<comment><USER19> I'm not sure buying stolen laptops is really the direction we want to go in here.

<comment><USER20> Stolen? I wouldn't jump to that conclusion so fast. A large source for these are mass sell-offs of old corporate or government gear after the usual 2-5 year upgrade cycle or government sales of impounded devices.

<comment><USER21> Funny story, I bought a system board on eBay that had a BIOS password on it. The seller didn't answer my messages asking for the password, so I assumed he knew there was a password, but didn't know it (and didn't say in the item description). He just ghosted me. Returning it seemed like a hassle, I really needed it and this was the only one on sale in Europe.

Found the former owner of the laptop where the board came from thanks to the corporate/user name displayed on the password prompt. It was a small IT company.

Contacted them on LinkedIn asking for the password and detailing the situation. Didn't get the password, but the CEO/owner of the company certainly had a surprise.

Turned out one of their guys was selling parts from their laptops/hardware without permission.

Suddenly, the seller on eBay found the message feature and wrote to me, saying I got them in trouble. Shouldn't have ghosted me, then? Just a "sorry, didn't know it had one" and I would've just proceeded to replace the BIOS chip, which was my plan B and it's what I ended up doing.

</comment></comment></comment></comment><comment><USER22> Question: how secure are BIOS passwords, really? If you have full-disk encryption anyway, is the BIOS password adding anything?

<comment><USER23> The BIOS does control the boot order sequence for instance.

I guess if you have access to it, you could force boot from a malicious USB stick, or the network, that would simulate the disk decryption prompt.

I guess you could also remove security measures that your company put in place to e.g. prevent the usage of USB to prevention information leak.

<comment><USER22> But to do that you could also just (say) clone the disk drive and install the fake prompt on the disk drive itself, right?

<comment><USER23> Not if secure boot is enabled, your boot loader most likely would not have a trusted signature.

</comment></comment></comment></comment><comment><USER24> I'm curious if TPM measurements would catch these kind of manipulations. It's probably system specific but the configuration of the BIOS should (as far as I understand it) be captured as part of the measurement process.

If requisite credentials or remote attestation is sealed against a certain measurement value it should protect the system.

<comment><AUTHOR> The way locking a TPM to firmware config works is that the TPM has several registers called PCRs that contain a hash value. Anything can send data to the TPM and have it update the hash value, and you can lock TPM keys to the PCRs such that you can only use the key when the PCRs you choose have a specific value. The TCG spec defines some of these PCRs to be sent certain information [0], but it's up to the firmware to send it, the TPM doesn't magically know what the state is. If there's even a single setting or nvram variable that you can change to gain code execution that isn't part of the data that's sent to the PCRs that the crypto key is locked to, it's game over.

[0]: [https://trustedcomputinggroup.org/wp-content/uploads/TCG- EFI...](https://trustedcomputinggroup.org/wp-content/uploads/TCG-EFI-Platform- Specification.pdf)

<comment><USER25> BIOS code is PCR 0, config is PCR 1. Software can "extend" certain PCRs as well. Look up Core Root of Trust for Measurement (CRTM) - lot of articles out there. BitLocker can use the capability you describe to protect the hard drive encryption keys. The TPM helps make sure the correct software is in control of the platform before releasing secrets.

<comment><USER26> It helps but unless you are using the secure channel setup (no one is to my knowledge) attackers can intercept the PCRExtend operations and replace the data being extended.

</comment></comment></comment></comment><comment><USER27> I was of the impression that BIOS passwords were in general not something one should rely even as a layer when assuming physical access. In the (not that) old days it was usually just a matter of removing the internal battery to reset it. Has this assumption changed in past years?

<comment><USER28> A bit, as posted in this blog, but for most part having physical unlimited access to a device it's game over. Hence why encrypting your sensitive data should be the norm (I am aware that is not the norm, not by far)

<comment><USER27> Sure, it's just that the only situation I see a BIOS password making sense is in the presence of some intrusion-detection mechanism that would perform some kind of destruction/lockdown/alarm so that attempting to bypass it would not be without consequences.

<comment><USER29> They are good for stopping people fiddling in large scale corporate deployments where someones nephew knows how to make the work laptop go faster.

</comment></comment></comment></comment><comment><USER30> Does this also hold for Macbooks?

Edit: A more precise question would be: What is the analogy to Secure Boot and the hardware being locked on a Macbook?

<comment><USER31> Is there anything actually different? A Macbook is a relatively standard Intel laptop that happens to run MacOS.

The only additional complication might be the T2 chip in the same way that TPMs might be an additional issue in other business laptops.

<comment><USER30> I don't know. The reason why I ask this is that I want to replace my Macbook's startup chime with something else.

</comment></comment></comment><comment><USER32> we just use this on the dells at work [https://bios-pw.org/](https://bios- pw.org/)

</comment><comment><USER33> can someone tell me which flash programmer is used here? I also want to play around with UEFI.

<comment><USER34> Not sure what they used, but even a Raspberry Pi + a Pomona clip will do the trick. Have a look at the flashrom wiki, see [https://flashrom.org/ISP](https://flashrom.org/ISP).

<comment><USER35> Careful though, and read the datasheet first! AM4, for example, uses 1.8V SPI flash chips. Connecting them to Raspberry Pi directly will at the very least fry the chip, if not the whole board.

</comment></comment></comment><comment><USER36> TL;DR but why not "open laptop, disconnect BIOS battery for 10 sec, reassemble, done"

<comment><USER37> I think the article explains that the state they needed to change was stored in flash.

</comment></comment><comment><USER38> TLDR; remove battery.

<comment><USER39> This is about laptops, not desktops. Battery removal only resets the clock, but the password stays on.

<comment><USER9> Doesn't matter if it's laptop or desktop, depends more on how old PC is. I think UEFI machines use NAND or NOR ROM as actually nonvolatile NVRAM.

</comment></comment></comment><comment><USER40> > We found a laptop laying around the office that had BIOS password enabled.

I really wanted to be a laptop from someone on vacation and that at his come back finds this post instead of the laptop xD

</comment><comment><USER41> Oh sure, to defeat a BIOS password I'm supposed to have IDA Pro lying around, with license.

<comment><USER42> So use ghidra or radare2 or free other alternatives instead?

</comment></comment><comment><USER43> This is cool, but if this is how SkySafe engineers spend their time, they're not gonna be a business for long. There's absolutely zero way that NUM_ENGINEERS * SALARY_PER_HOUR * HOURS_SPENT for this task is even remotely sane compared to just tossing the laptop and buying a new one.

I get that this is kind of content marketing for their engineering department, but damn if they could've prooooobably spent that money on something with more impact

<comment><USER44> According to crunchbase they've been around since 2015 and had their last funding round in mid 2017. I doubt they're in such a crunch that they can't spend a few days for the team to focus on a fun and common interest without breaking the company.

<comment><USER45> But if you let them have fun once, they're going to want to have fun ALL THE TIME. ;D</comment></comment></comment>


Mere - <AUTHOR> https://hedgehogreview.com/issues/eating-and-being/articles/mere <comment><USER2> Two other words I would like to see given more usage by English speakers are overmorrow and ereyesterday. For two days after/before today. They aren't ancient and you can find usages in books from the 20th century, but most people don't know them.

</comment><comment><USER3> Really interesting. The whole article feels like an argument against his point; pointing out the varied meanings, implications and stigmas of 'mere' or 'able' just reminds me how great that ambiguity is for literature.

The line from Yeats' 'Second Coming' works with both meanings, mere meaning pure anarchy reflecting the nightmarish time and being a great oxymoron, and mere meaning small, less noticeable anarchy fitting the subtle terror of 'the falcon cannot hear the falconer.' Even without that as an initial intention, it shows how language and great writing both evolve together over time.

</comment><comment><USER4> The title is almost certainly a reference to CS Lewis's famous book "Mere Christianity".

<comment><USER5> .. mentioned in the article.

</comment></comment><comment><USER6> The Hedgehog Review itself is a wonderful publication. I recommend subscribing!</comment>


Ask HN - Do you use hunger for productivity? (Life Hacking) - <AUTHOR>

Background: I've been meditating for a while and I have a good feel of myself and what's happening within. I can focus on things like feeling my blood circulation to toes / fingers, feeling heart beat etc.
Okay now I've realized that being a little hungry (not starvation) keeps me sharper and more focused especially while coding.
I think I'll try and remain slightly hungry as much as possible without risking nutrition and conduct a little self experiment to see how this goes.
The challenge is:
1. I don't know off a scientific way to define various states / stages of hunger
2. I don't know how to measure programming productivity
3. Obviously I don't know how to co-relate these two.
What I'll first do is ask you for your experience?
Have you noticed your work focus while hungry and after a meal?
Do you have a similar or contrary experience you want to share?
Do you think I'm crazy? <comment><USER2> Look into intermittent fasting diets. They go by various names leangains, renegade, warrior diet, but all follow the same principles of 12 - 20hours of fasting and then a small eating window at night to get in all your nutrition. I've been doing various forms of intermittent fasting for about 3 years with great results. During the workday, which is the middle of your fast, I experience lots of energy and great focus.

<comment><USER3> These IF programs, like leangains, do not require you to fast during the day and only feed at night... it's up to you when you would like to do it; That's the beauty of it.

</comment></comment><comment><USER4> I definitely find that my focus is greater prior to eating. In fact, on days when I'm coding, I usually end up skipping lunch because, though I'm hungry, my brain is much more engaged in the process at hand.

Here's an idea: write a simple script to record key strokes during the time that you're coding; monitor your calorie intake; graph that shit. Science!

<comment><USER5> I am going to use that idea, if you don't mind

</comment></comment><comment><USER6> I fall to an extreme, but I do not eat much during the day on weekdays. Much higher alertness.

</comment><comment><USER7> I know it certainly slows me down to be full, but I'm often very distracted when hungry.</comment>


Microsoft retires Groove Music service, partners with Spotify - <AUTHOR> https://www.theverge.com/2017/10/2/16401898/microsoft-groove-music-pass-discontinued-spotify-partner <comment><USER2> Wow, this is a huge change. I have used Groove Music Pass in the past, and found it decent, though I realized I save a lot more money buying MP3s than paying for streaming. (I add less songs to my playlists monthly than the cost of a sub.)

This article also doesn't mention: Will they continue selling music in the Windows Store? I am assuming this just ceding the subscription model only. Will they keep the existing "Groove" name for the app, or will this someday once again be "Windows Media Player"?

EDIT: To answer my own, Microsoft's original blog post says they will stop selling music altogether: [https://blogs.windows.com/windowsexperience/2017/10/02/micro...](https://blogs.windows.com/windowsexperience/2017/10/02/microsoft- to-bring-spotify-to-groove-music-pass-customers/#6U0oqqc0FoXLy2uA.97)

</comment><comment><AUTHOR> My first reaction to this announcement is disappointment and "well, it was only a matter of time". I'm going to miss the OneDrive integration which lets you stream whatever music you have in OneDrive. I'll also miss the app itself, although maybe I'm alone there being one of seemingly few that enjoys UWP apps. Granted, Spotify recently released an app for the Windows Store [1], but it's not a UWP app. Rather it's just their regular desktop app packaged up for the Store with Project Centennial.

[1]: [https://www.microsoft.com/en- us/store/p/spotify/9wzdncrfj4wk](https://www.microsoft.com/en- us/store/p/spotify/9wzdncrfj4wk)

<comment><USER3> The Groove/ music app appears to be staying. It will still support playing music from OneDrive and local files (apparently the iOS/ Android apps won't be going anywhere either).

The things that are going away after Dec. 31st are the streaming service and music store (i.e. purchasing albums/ individual tracks). You won't be able to download any music from the store after Dec. 31st.

Here's the FAQ: [https://support.microsoft.com/en-us/help/4046109/groove- musi...](https://support.microsoft.com/en-us/help/4046109/groove-music-and- spotify-faq)

</comment></comment><comment><USER4> Microsoft gave up on Groove years ago when they themselves wrote the "official" Spotify client for Windows Phone. Spotify couldn't be bothered to invest a dime of resources into the development. Free is free.</comment>