MacRuby 0.5 beta 1 Released - <AUTHOR> http://www.macruby.org/blog/2009/10/07/macruby05b1.html <comment><USER2> MacRuby is extremely impressive, even if you aren't much of a Ruby guy (like me.) It lets me do nearly everything I'd want to do in a Cocoa application, but much more easily than with C/Objective-C. It really is fantastic, and a lot of work has been put in to make it easy to integrate with other software (both as a host and a guest – there's a direct object mapping, no bridges or anything.)

I'm sure a lot of people think "yeah but what about performance?" and from what I've seen, direct calls/messages on objects are _faster_ in MacRuby than Objective-C. Writing with just C (and no Obj-C messaging) is still going to be a lot faster, though.

But you rarely hear people complaining about messaging not being fast enough in Objective-C. You probably wouldn't be using messaging in those situations anyway.

Edit addendum: Since I know there are a lot of fellow functional programmers here on HN, I'd like to add that MacRuby has added real tail-call optimization, and (I was surprised to find this out recently) that Ruby has continuations with callcc. It's very, very nice. It's not exactly Lisp, but it's damn good and the platform integration blows anything existing away.

<comment><USER3> _you rarely hear people complaining about messaging not being fast enough in Objective-C_

There was a big spate of it ~4 years ago -- people had been using method dispatch in tight loops, and boggled a bit at the numbers when they started using Apple's fantastic Shark profiler. objc_msgsend is as cheap as dispatch can be without static linking (way faster than Python or Ruby), but it's still much more expensive than a C function call, and there's nothing keeping you from trading your square brackets and colons for parens and commas.

</comment></comment><comment><USER4> Grand Central Dispatch is included! And with a super clean and simple api (see the code snippet on the blog post).

Laurent (the lead developer of the project) is a friggin genious. 0.5 is definitely the first step to MacRuby catching on in a big way.

If this doesnt come to the iphone in the next year or so, I'm going to be extremely disappointed. All thats needed is the ObjC 2.0 garbage collector, which Apple has on their roadmap. And yes, it'll be optional for non macruby iphone apps (like it is for Mac desktop apps currently)

<comment><USER5> I don't see any reason to assume this will show up on the iPhone. Apple has a very strict policy about interpreters running on their platform, why would they suddenly change that?

(You might still be able to AOT your macruby program and ship the binary on the iPhone)

<comment><USER2> You can run interpreters on iPhone. You just can't allow the user to load code in externally to be interpreted.

And you can build binaries with MacRuby anyway.

</comment></comment></comment><comment><USER6> Looks like Apple is really putting a lot of dynamic language hopes into this project.

When I talked with Ted Goldstein, then head of Apple developer tools, at WWDC a few years back (he happened to sit at my lunch table), he said their eventual goal for Objective-C was a full, Smalltalk-like runtime IDE. (Ted was at PARC for many years, working on Smalltalk.) And they're clearly getting there, slowly but surely. (LLVM is key to those plans.)

But MacRuby promises a shorter path to a dynamic language completely integrated with the Objective-C runtime environment.

Quite interesting to watch.

Another good point he made was that MS still isn't using C# for any of their built-in or system applications, while Apple is using Objective-C/Cocoa for all of their major apps. (Well, except for a few Carbon laggards like their audio/video high-end apps.) That told him Apple was doing something right.

In that vein, he also noted that people looking in from the outside would never "get" the power of Objective-C/Cocoa (which is just "Smalltalk in C" with a fantastic runtime library)--the language is just off-putting enough at first glance that people don't understand--, and that made it a good secret weapon.

</comment><comment><USER7> I am not very familiar with MacRuby, anyone know if it plays well with Rails and its libraries?

It's really cool that 0.5 uses LLVM. Does anyone know how this it stacks up against the other Ruby implementations?

<comment><USER8> How many Rails apps run on an OSX server?

<comment><USER9> More if macruby worked and was significantly faster.</comment></comment></comment>


Go ahead, pass the Internet tax. Your (foreign) competitors thank you. - <AUTHOR> http://blog2.easydns.org/2013/05/07/go-ahead-pass-the-internet-tax-your-foreign-competitors-thank-you-in-advance/ <comment><USER2> In EU internet purchases were always taxed, and yet online-only competitors still manage to compete with brick-and-mortar stores very successfully. So this article is quite bollocks.

<comment><USER3> Everything was taxed, equally (with a few exceptions like food). No wasted time figuring out which tax to use, keeping up with tax changes, arguing why the brick & mortar store has a 5% rate while the online shop has 10%, etc.

Over the pond it's the same for everybody. Doesn't seem so in the US.

<comment><USER4> I think you misunderstand. The proposed changes are simply to remove the tax exemption. State sales tax will apply to internet purchases, just like they do for mail order. The confusion comes from the weird sales tax systems in place. I live in Colorado where the sales tax rates change according to a maze of Byzantine laws.

<comment><USER5> The main thing the EU did to simplify that is require one set of VAT rules per country. They can differ. For example, Denmark charges VAT on books, while the UK doesn't. And, like with the proposed US legislation, it's based on destination: if you order from amazon.co.uk to a Danish address, you pay VAT based on Danish rules.

But what can't happen is a situation where Herning, Ishøj, and Copenhagen charge different rates for different products. That simplifies the system considerably.

</comment></comment></comment></comment><comment><USER6> EasyDNS.. the company that closed my company's paid account over a month before the term ended because I informed them we didn't want to renew. If they think paying a modest sales tax is going to offset their terrible service, they are dreaming.

<comment><USER7> I think I just sent you an email, if you don't get it can you drop me a line at markjr [at] you-know-where

What you're describing isn't supposed to happen and I want to figure out how it did.

<comment><USER6> I got it... I'll get back to you in a bit.. I still have the emails from the ticket.. I'll forward them to you.

I had a very positive opinion of EasyDNS before it happened.. I was lucky enough to have already moved to another service a few days before so there wasn't any site disruption... but your rep didn't know that.

Have 18 domains @ DME now....

</comment></comment></comment><comment><USER8> This post seems to imply that we're considering a special Internet tax here. Last I heard, the proposed bill was simply about removing the special exemption Internet and mail order purchases currently enjoy. Since when is there an additional, special Internet tax being proposed?

<comment><USER9> So re-frame it as the removal of the exemption. Makes no difference how you spell that out, it adds up to an increase in taxes on goods sold / bought for American companies.

<comment><USER10> > So re-frame it as the removal of the exemption. Makes no difference how you > spell that out, it adds up to an increase in taxes on goods sold / bought > for American companies.

No, it doesn't. US buyers were already responsible for local use taxes for remote purchases. This just shifts who is responsible for the taxes to the retailer (if the taxing states opt-in, which requires them to adhere to certain tax streamlining provisions and other requirements that make the process simpler for retailers.)

This is a tax _simplification_ and _collection efficiency_ measure that doesn't change the amount of tax due on any sale.

</comment></comment></comment><comment><USER11> This post is idiotic for at least 3 reasons I can think of:

1\. The tax is not "specific to the internet" but is designed to make it so that internet-only businesses are required to collect the same taxes that bricks'n'mortar businesses are required to.

2\. EasyDNS's right to sell to US customers is regulated under a giant freaking, bureaucratic law known as NAFTA. If they every got large enough to compete with large US corporations, they could become subject to all sorts of mechanisms to ensure that US corporations can compete with them (countervailing duties for starters). They should shut the hell up.

3\. Everything they say also applies to US companies selling to Canadian customers.

<comment><USER12> Brick-and-mortar businesses collect, at most, two sales taxes. Even if a customer from every single state walks in their door. They can engage one local accountant and pretty much have all their questions about tax classification of different products/services, filing requirements, etc. covered.

Online retailers will have to collect, at most, 53 different taxes, under 53 different tax codes, remitted to 53 different entities all with audit rights. That's not really _the same_.

<comment><USER10> > Online retailers will have to collect, at most, 53 different taxes, under 53 > different tax codes, remitted to 53 different entities all with audit > rights.

More than that, actually; I have no idea where you get 53 from; the relevant entities ("states" as defined in the MFA) include the 50 states, the District of Columbia, 5 named territories, and "any other territory or possession of the United States."

But its not just "online retailers", its any remote seller. Including anyone who does online and/or mail and/or phone sales, which includes lots of entities that are also brick and mortar outlets. But only if they choose to sell into each of those jurisdictions: you choose where you will accept orders from, and as a consequence of that choice you choose which tax laws you will deal with. Just like with a brick and mortar business, where you choose where you open outlets, and as a consequence of that choice you choose which tax laws you will deal with.

And each of those jurisdictions is required to provide free-of-charge software to calculate tax rates _and_ hold retailers harmless for any errors due to the software.

</comment></comment></comment><comment><USER13> Absolutely agreed here, this is just going to give an edge to companies outside the US.

Worse still, it's going to hit small businesses worse because they will simply have no choice but to pay it. The mega corps have their accounting down to an art, they'll figure out a way past it given how many gray areas are inevitable in a completely new form of tax like this.

<comment><USER10> > The mega corps have their accounting down to an art, they'll figure out a > way past it given how many gray areas are inevitable in a completely new > form of tax like this.

Its not a new form of tax. Its permission for states to opt-in to a more efficient _collection method_ for existing sales and use taxes if they also agree to certain streamlining requirements for those taxes _and_ certain support mechanisms for the retailers that would be required to collect and remit the taxes.

</comment></comment><comment><USER14> Just wait for the "foreign transaction fee" on the credit cards to become federally mandated 15% instead of 3%. Then you'll see.

<comment><USER7> That's where Bitcoin comes in :)

<comment><USER15> That's where federal regulations on Bitcoin comes in. How would you like to live in a world where Bitcoin is a black market product?

<comment><USER16> Where I live, kids under 15 have to wear a helmet while biking. But I never see any kids wearing helmets. Because laws that cannot be enforced will be ignored freely. Piracy is supposedly illegal, but look at the attitudes towards it: it's not considered a crime because it's impossible to enforce.

Perhaps bitcoins while be regulated, but will it not get green-stamped by the general public just like piracy?

<comment><USER15> Let's put it this way: if it is a crime to exchange USD for Bitcoin, where are you going to get your Bitcoin money? Bitcoin would die overnight if exchanges went away, and most people are not going to send an envelope full of cash to some shady person on the Internet.

<comment><USER17> People would exchange from USD to GBP or EUR an dthen to BTC. U see no problem there.

</comment></comment></comment></comment></comment></comment><comment><USER18> The legislation now before Congress simply allows states to collect sales taxes (if the states have sales taxes) on transactions to residents of their states by online retailers. (There was a special act of Congress that exempted online retailers that don't have "nexus" in a particular state from such taxes.) The immediate effect of this legislation, in my opinion, is that Amazon will open a distribution center in my metropolitan area, located in a state with sales tax, and offer same-day delivery for Prime customers. And I will probably take up Amazon on that offer rather than shop in my locally owned retail chains such as Target (walking distance from my home) and BestBuy (which I loathe shopping at, and hardly ever visit). The United States Senators from my state support allowing states to impose sales taxes on online retail transactions, because Target and BestBuy (and some other large retailers) employ a lot of their constituents, and because new tax revenue for Minnesota will be spent by a governor and legislature who belong to the same political party they do. But I will shop at Amazon if this happens. The new law is not going to hurt my favorite online retailer at all.

</comment><comment><USER19> A few years ago, there was a big case where Massachusetts tried to force (non- internet) retailers in New Hampshire to collect Massachusetts state taxes from people who purchased things in New Hampshire that might in the future be used in Massachusetts. The case got thrown out by the state supreme court because to enforce it would require Massachusetts to force New Hampshire businesses to violate their customers' privacy about where products would be used. New Hampshire in turn passed a law prohibiting retailers from sharing private customer information with Massachusetts auditors.

Trying to make the citizens of one state liable for enforcing the laws of another seems ridiculous by itself. Making them enforce the thousands of arbitrary, convoluted, constantly changing laws of 49 other states and all of their localities is way beyond reasonable.

At least there appears to be a clause that states will have to simplify their tax rules and provide free software to manage it. Although the idea of integrating an e-commerce system with 50 separate bureaucratically-designed systems doesn't really seem that appealing either... If the states also had to pay for every integration and the maintenance of all e-commerce software, then it would be a little more reasonable.

<comment><USER20> 24 states have already certified 6 sales tax service providers. It is expected that most states will certify these same providers. The providers have already integrated their service/software with a significant number of the major e-commerce platforms. After all the integration drives business to them. Depending on the service provider and the features used there may or may not be a fee for the retailer.

</comment></comment><comment><USER21> This tax could make Oregonian consumers pretty popular: nothing to collect, no tax, no hassle.

<comment><USER22> On the flip side, it'll remove a major reason to start a business in Oregon or another state without a sales tax.

<comment><USER23> Recent transplant to California, and I now have to go back to Oregon whenever I make a major purchase. A weekend trip to see friends, have an Amazon order shipped to them.

<comment><USER24> You still owe use taxes on that.

</comment></comment></comment></comment><comment><USER25> I am slightly bemused by the fact that the US - which in Europe is often seen as very lax on taxes - is doing this and it is not even being considered in Europe. That might change, sure, but Europeans tend to like taxing things. And if this haven't even made a consideration among European lawmakers, just how far from the pack have the US lawmakers gone?

<comment><USER20> The author and you are confused. There is no internet specific tax being discussed in the US. The "Internet tax" bill just allows states to require companies to collect state sales tax when they sell an item to someone in the state. This is the same tax which is collected by brick and mortar stores within the state. Currently if I buy items online each year when filing my state taxes by law I must declare the value of my online purchases and pay the sales tax on them. As you can guess many people don't declare the purchases as required. The "Internet tax" bill is really a bill to change allowed tax collection methods to ensure that all currently applicable taxes are collected.

<comment><USER26> So as a hypothetical business owner in Washington who sells things online, I have to keep track of the tax laws of the other 49 states, and remit 50 checks quarterly (or maybe annually)?

<comment><USER10> > So as a hypothetical business owner in Washington who sells things online, I > have to keep track of the tax laws of the other 49 states, and remit 50 > checks quarterly (or maybe annually)?

Well, you have to either keep track of those laws for the states you choose to sell into, or use the free software provided by each state that has opted into the arrangement (the MFA provides an opt-in regime for states, with conditions including the provision of free software, with retailers not liable for any failure to collect and/or remit tax that is due to errors in the software.) But, yeah, you have to pay each taxing "state" (which will probably be less than 50 initially, but more than 50 in the limit case, since "states" under the MFA include the the 50 states, DC, plus other US territories and possessions.)

Or, instead of using the State-provided software and doing it yourself, you can pay a "certified software provider" to do it, and be immunized against liability for any errors that are the fault of that provider.

</comment></comment></comment></comment><comment><USER27> Will be pretty funny when we get a matching duty for their services thats twice as much as typical salestax. :)

</comment><comment><USER28> Essentially, the article is saying that if you could save money by buying a physical product from a foreign country, domestic businesses would suffer.

Those conditions exist today with the ability to buy things from China, and all of the accompanying downsides will apply to buying something from Europe. It takes weeks instead of days to ship overseas at acceptable rates. Who do you call to complain/return/get service? Do they even speak English? Does this product meet safety standards? Do I even have legal standing to sue the company if I am defrauded/injured?

All of these go away buying domestically, and are not a fair trade off for a marginally lower price.

</comment><comment><USER29> > _What lawmakers fail to understand is that taxation specific to the > internet, ostensibly to boost revenues into government coffers, in practice > will probably diminish them as US businesses lose competitiveness against > foreign companies._

And what you fail to understand is that if everything is sacrificed in the name of "competitiveness", then every country will be in a race for the bottom.

It already happens, with outsourcing, cheap foreign labour, tax heavens etc. A successful US company used to benefit American society at large (beyond merely paying some wages) -- and this is what made the US rich with a large middle class etc.

Now (with outsourcing, factories in China, money kept in foreign accounts that never make it back to the US, tax havens enabling the company to pay almost nothing in taxes etc) a company can be American in name, but of no more benefit to the US as a country than Toyota or Samsung.

And no, places that are strongholds of industry and innovation don't help much either. A 100 billion new innovative product out of Silicon Valley can be as lost a boon to the country as any innovation coming from Tokyo or Europe.

Hence, shrinking middle class, hence budget and trade deficits, hence trouble.

Of course, for those owing or running companies and benefiting from the whole thing, business hasn't been better. But those benefiting are increasingly fewer (and the few tend to benefit all the more, hence huge imbalances in inequality).

I'm not saying that amazingly successful companies cannot come out of this situation. I'm saying that this success trickles down to the overall country/society, far less than what it did in the past. Coming to a point where it will be possible to be the host of the worlds greatest companies AND having a population living like in a third world country.

The only reason everything has not collapsed already is because there are other advantages beyond "cheap" that keep companies throwing a bone to the US. The infrastructure, the engineering savvy, and of course the inherited middle class and large market, from better times. But those things are rooted in the past and are transient.

> _To our American friends, easyDNS is a foreign company, so don't let us stop > you._

And how about you aren't let to serve customers in the US unless you pay taxes too?

How would you feel about losing the rich US market then?

And how about people in Europe and other affluent societies conspired so that you cannot sell your crap without paying proper taxes to someone?

(I'm not even arguing in favor of the internet tax. Just against the arguments easyDNS used here against it. Heck, I'm not even American. I just know that those same issues affect my country too).

<comment><USER30> The world, sir, will get along just fine as the US slinks into its sunset years. As an American citizen, I can assure you the writing is, and has been, on the wall.

<comment><USER31> As an American citizen, I can assure you this guy is talking out of his ass, and America will continue to be a leader in many cutting edge fields for years to come. American economic prowess may decrease relative to the rest of the world as they finally catch up, but "the writing is on the wall" is sensationalist bullshit. I will never understand the correlation between technophiles and Libertarian pseudo-economic bullshit; 0 empirical evidence to back it up, yet the same stupid causal chain of events is brought up all the time.

<comment><USER30> > American economic prowess may decrease relative to the rest of the world

Not just decrease but get overtaken by.

\- Our public K-12 education is a pile of shit and our colleges are riding on a public dollars bubble that makes the housing crash look like spilled water. Any attempt to deal with the problem ignites fury over teachers' rights, causing policy makers to run shitting their pants to the nearest podium to apologize.

\- At every possible juncture, policy decision is leaning on pervading status quo: patents, bullshit municipal license bureaucracies, congressional players pandering to businesses, not constituents

\- Health is a disaster, and even with Obamacare, it's looking like it got neutered just enough to do precisely shit for the long term. People go bankrupt to get care, if they can even get it.

\- Culturally, a sweeping wave of anti-intellectualism has taken hold and bolsters everything above. We can't get anyone to care about any of these issues if they're fucking retarded.

\- All the while, the smartest, very smartest people in our country are jacking each other off in silicon valley inventing the next cat-picture collection app, while the economic, technological and social divides keep growing. They're more interested in becoming their idoled psychopathic CEOs than actually fucking solving real problems. They're living in an absolute bubble, unaware of what 60% of the country cares about or actually needs.

How are we supposed to be the leader of anything if we're in a constant state of regression?

<comment><USER32> I agree that America is doing many things wrong, and has many challenges facing it now and likely well into the future. However, I would also like to remind you that America is as a nation, _237 years old_. It is a country that was founded by rebels and is often in some sort of crisis and or revolution at any given time. Despite(because of?) this, great things and great people consistently grow from here, and I have no doubt that will continue well into the future.

I am surprised when I hear people talk of our current issues as if they will be what does us in. Think of the big picture here, do you really think America is going to get "overtaken" in the 21st century when in many ways we are leading it? And I do agree we are behind in some ways as well, but we don't have to be number 1 at everything to be successful, or at the least survive and progress as a nation.

<comment><USER30> These aren't "issues of the day." These are systemic and fundamental problems that lead to downfalls of nations.

During our greatest advancements, we maintained a well oiled machine of an educated constituency, a public-private partnership and a middle class bursting at the seams with potential and opportunity.

Those things have all either been stripped, scammed or atrophied out of the public, and what we're left with is a paralyzed public sector and a private sector that's racing to the bottom of the moral barrel. I just don't see any hope in anything short of some sort of awakening. Call me pessimistic and dismiss me, or at least recognize that something has to change.

<comment><USER31> People in Silicon Valley are making cat picture apps, haha right. You fucking idiot, gtfo people like you are shitting up the forums. America is more intelligent and wealthy than any nation in the history of the universe, stop crying on the internet and go be a part of it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER33> > What will probably happen is that affected businesses will have to "eat" the > tax and drive their margins down...

Or e-commers will do what they always have done when legislation change. They "move" their cloudy servers to somewhere where said laws do not exist.

We saw this exact thing each time EU passed some new data privacy law. People stayed in their country, but the servers suddenly poped up in NA, or Ireland, or some small Caribbean island that no one has heard of. Trying to enforce taxes or privacy laws on e-businesses is like trying to shut down the Pirate Bay. It simply moves on to a new IP under the same domain name.

</comment><comment><USER34> Sorry, but this is asinine.

Easy DNS charges $19.95 CAD/yr for its basic package of DNS services for a domain. Amazon's Route 53 charges $0.50 per month, or $6.00 USD/yr. Given the OP claim to be "traditionally anti-big government, pro-free market, pro- capitalist whack jobs," they are offering a service 3x more expensive than a comparable service US company. Maybe EasyDNS has some extra goodies that Route 53 doesn't to justify the higher price. Either way, _that_ is what drives Mr. Smith's invisible hand, and _acting like US states enforcing their 6% or 8% or even 8.75% sales tax is some sort of game changer is absurd._

The OP seems to woefully misunderstand that this is _not a new tax._ This requires any internet business with over $1 million in sales -- which I'm guessing doesn't apply to a _lot_ of startups whose founders/employees read HN, btw, mine included -- to collect any applicable state/local sales tax at the point of sale, just like pretty much every local business. And if these businesses are getting squeezed by internet retailers, I'm guessing it has nothing to do with sales tax. Recently I needed a DisplayPort/DVI adapter, and impatiently went to Best Buy, where the only one I could buy was $30. Then I saw this one on Amazon for $4.95 on Amazon -- <http://www.amazon.com/gp/product/B003BHHIA4> \-- promptly ordered it, and returned the Best Buy one, even though Amazon sales tax meant I actually paid $5.45. Best Buy is getting destroyed because retailers can sell similar products at a 84% discount, _and that would still be true if it was only a 78% discount._

So, to the OP and all the other people I've seen on HN lamenting that this bill is akin to exhuming Adam Smith's corpse and urinating on it: can we please stop acting like this is the end of the world? Making sweeping states predicting economic outcomes without practical considerations (e.g. many internet retailers have a pricing advantage that dwarfs sales tax) and human responses (an effective 6-10% increase on purchases -- _'effective' because this is a tax they should have been paying anyway_ \-- is not really accomplishing much. There are times to get infuriated about the government fucking up the free markets and disincentivizing capitalist innovation and production, but I don't think this is one of them.

</comment><comment><USER35> I must have missed the memo. Why are we ranting and raving about collecting sales tax on internet purchases? Is there some other internet tax I'm not aware of?

<comment><USER12> Yes, the "internet sales tax bill" (marketplace fairness act) passed the Senate this week. It has White House support, so only needs to pass the House to become law.

A summary: [http://www.dangrossman.info/2013/04/24/what-startups-need- to...](http://www.dangrossman.info/2013/04/24/what-startups-need-to-know- about-the-internet-sales-tax-bill/)

<comment><USER35> What's bad about it?

<comment><USER12> I don't have time to read 50 states' tax codes, file 50 tax returns and potentially be audited 50 times a year. What small business does?

<comment><USER36> Most of them. As soon as you have any real cash flow, you engage accountants.

<comment><USER12> My accountant would not be able to handle a XX-fold increase in the number of tax codes, forms and filings he has to handle per-client. We're going to have to train more accountants.

<comment><USER36> I don't agree. Maybe you could ask your accountant? I guess at some point I could ask ours too.

<comment><USER12> I have to make an appointment to see my accountant at least 1-2 months in advance if it's anywhere near tax time (late January-May). He's definitely no time to take on more forms per client, let alone advise me properly which states will tax which products at what rates.

I run the online store for my father's retail shop, with several hundred SKUs. We sell fancy health water bottles for example -- some states this is not taxed, some it is, some it is depending on bottle size and whether it meets their definition of water or some other kind of beverage. _Someone_ will have to reconcile every SKU against every state's sales tax classification changes every 90 days. That's not something any accountant does for small businesses operating in a single state right now.

<comment><USER36> Maybe get a better accountant? I'm being serious. I definitely don't need to ask a month in advance to talk to my person accountant or our business's.

<comment><USER12> We'll obviously need one (where today this accountant meets all our needs, and has been a family friend for decades), but a small business accountant that can do what's going to be required doesn't exist yet. Only national chains have had to worry about such things.

<comment><USER36> Again, and respectfully, I don't think handling sales tax filings for a small business is a huge hurdle compared to some of the craziness that even small business accountants are routinely called on to do.

Your point upthread was "no small business person can handle filings to 50 states". I'll stipulate that! My response is just, people with real businesses usually don't (and shouldn't) DIY their taxes anyways.

<comment><USER37> They dont? And shouldnt? Why not? The point someone here is trying to make is that what was once simple is potentially going to become inordinately difficult. Not impossible but very difficult.

And by who's determination is my business "not real" if I do my own taxes??? At least I do my taxes more accurately than Geithner does or did AND HE got to sign our dollar bills! Was his business "not real"?

Once again, thanks to GovCo, life is getting worse, harder not easier, asinine not smart. There is absolutely NO THOUGHT WHATSOEVER put into anything coming from DC lately. None.

<comment><USER35> What exactly is your complaint here? Are you opposed to sales taxes on principle? If not, what's your complaint? Properly accounting for sales and business taxes, as well as following other laws, in a jurisdiction in which you do business is a basic cost of doing business. The U.S. just happens to be a country of 50 sovereign jurisdictions, each with autonomy in how they structure their sales and business taxes. Does this make accounting for taxes complicated? Sure. It makes lots of things complicated. But we did it on purpose. Why should Congress insulate you from that reality?

The internet certainly makes it easier to say take orders from people in many different jurisdictions at once, but why should you get to avoid the other business realities of operating in multiple jurisdictions just because you're an internet business? You might see everyone as just an IP address, but in the real world, groups of those IP addresses are parts of sovereign entities called state and national governments, and each of those groups are governed by different laws. Just being an internet business shouldn't insulate you from the reality that exists once you break through the IP address abstraction.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER38> The US government will just mandate that any online business doing business with US citizens has to collect that tax on behalf of the IRS.

Quarterly deposits will be acceptable.

<comment><USER12> How would the US government mandate a non-US business do anything? They can't prohibit US citizens from buying from these companies without violating their own free-trade agreements. That'd be a bad idea, since 41% of the country's exports go to countries we've signed those treaties with.

<comment><USER39> I imagine the US government could just add said non-US business to an embargo list of some sort. Prevent them from doing any business whatsoever with US citizens.

</comment></comment></comment><comment><USER40> Sounds like taxation without representation to me.

<comment><USER41> Are you saying that Network Solutions and GoDaddy should have seats in Congress?

<comment><USER12> I think he's saying that individuals that sell online shouldn't be taxed by state legislators they didn't elect. Congress won't be setting the internet sales tax rates, nor administering the tax, nor conducting its audits -- the 50 individual states will be imposing their individual rules.

<comment><USER42> It's the person that's paying for the product being taxed, and the merchant is merely collecting that tax. At least, that would be my interpretation.

<comment><USER12> If a foreign state I've never stepped foot in can set laws I have to obey, force me to remit money to them, and audit my accounting under penalty of imprisonment, it doesn't really matter who's doing the paying. Today, only people within the state can be forced to obey and be audited by that state. This bill gives the power for a state to create and enforce arbitrary laws on non-citizens. It's at least a sufficiently different situation to debate.

Boy would I prefer a single federal sales tax with the fed doing the distribution to the individual states.

<comment><USER43> That's what happens when you do federalism only when it's convenient. Right now since "interstate commerce" is extended to cover any activity that may be imagined to be related to commerce (including growing plants in your own garned for your own benefit) it means federal government can force commercial entities to do anything. Including complying with foreign laws (including non- existant foreign laws: [http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx#La...](http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx#Lacey)).

Single federal sales tax with distribution would result in either grotesquely complicated calculation system or some states sponsoring other states for political reasons. And, of course, all local governments blaming federal governments for the lack of funds and their inability to do anything.

</comment></comment></comment></comment></comment></comment><comment><USER44> Do you think the US government is unaware of this? I, for one, do not. I bet they will do SOMETHING (not sure what, but @jedmeyers gives a possibility) to ensure that US online retailers will not be defeated by foreign retailers that easily.

</comment><comment><USER45> Is the Internet tax on goods only? (This article speaks as if it is on services as well.)

<comment><USER12> The bill allows states to force out-of-state retailers to collect their sales tax, rather than requiring the end-customers report and pay them with a use tax return. Each state will still set its own classes of taxable goods, and services are already taxed in many states.</comment></comment>


Ask HN: How can I find a good mentor? - <AUTHOR> How did having a mentor change your career/life? Where and how did you find that mentor? <comment><USER5> The book "Mastery" by Robert Greene does a deep dive into mentorship, including the process of finding mentors. I highly recommend it. I won't attempt to summarize it all, but one of the strategies outlined in the book involves building a relationship over time by making yourself useful to the person who you want to be mentored by.

Many of the most high-powered people aren't going to have time to just mentor people out of generosity, so I wouldn't rely on the kind of advice that involves hoping that you'll get a reply from a cold call request for mentorship. Make yourself useful to that person, save them time and they'll mentor you in order to keep you around.

But I recommend reading the book itself to get a better idea of how this works.

[https://www.amazon.com/dp/B007V65PBK/ref=dp-kindle- redirect?...](https://www.amazon.com/dp/B007V65PBK/ref=dp-kindle- redirect?_encoding=UTF8&btkr=1)

<comment><USER6> I have little respect for this guy, who seems to write (in my opinion) slightly more learned than average self-help books for people who want to feel smart/amoral. Apparently he is a favorite author among prison inmates.

</comment></comment><comment><USER7> This may be a controversial opinion, but I think people put too much stock in mentors. They can be extremely valuable, no doubt. But often the advice they'll give is out in the world if you just know where to look.

I've found that carefully controlling the flow of information reaching my brain - reading books (not just business books - the classics, history, psychology, etc.), cultivating a Twitter feed of people that you look up to, blocking time on my calendar for thinking & deep work, etc. - has had an impact in my life greater than the impact that my mentors have provided. My problems are not as unique as I once thought they were; far more valuable to read someone's carefully considered written thoughts on a topic than fight to get 5 min of face-to-face time to hear the most general version of that advice.

But to answer your original question, you have to provide value to any potential mentor. The absolute worst thing that you can do is reach out and directly ask for someone's mentorship. This is like asking someone to marry you on a first date. The potential mentor has no idea if you're someone who is worth spending their valuable time on; someone they will be proud of and will want to be associated with going forward. A mentorship is a relationship - it's a two-way street. What do you bring to the table? Also, at the end of the day mentors pick people who remind them of themselves, so best to focus on what connects you (alumni networks come to mind as a strong example of this).

\- Ryan Holiday has some more good advice on finding mentors here: [https://ryanholiday.net/finding-a-mentor/](https://ryanholiday.net/finding-a- mentor/)

\- And Tim Ferriss on contacting busy people: [https://tim.blog/2008/05/19/5-tips-for-e-mailing-busy- people...](https://tim.blog/2008/05/19/5-tips-for-e-mailing-busy-people/)

<comment><USER8> The advice is out there, yes. But without a mentor, people tend to practice what they are already good at, so they seek our small improvements to their strengths instead of large improvements to their weaknesses. A good mentor will help you identify your personal areas of weakness, and guide you to improvements. A great mentor can do so in a positive way that feels empowering.

<comment><USER9> Also top talented people often can give you advice of the kind: "if you could only improve one aspect, you should choose this one", that IME is very useful.

</comment></comment></comment><comment><USER10> I learned how to be a machinist from the owner of the local tool shop who was an ex-tool and die maker. I learned systems programming from various helpful people in IRC and people who have advised my internships. I learned physics from other grad students and my professor.

Just make friends with people who have the bandwidth. I also strongly disagree that mentors are overrated. They're necessary in some disciplines, and helpful in most. Learning without a mentor is like running open-loop. As a new student, you often won't even know the right questions to ask. How will you know what to google? How will you know if you're developing a bad habit?

</comment><comment><USER11> Reach out to people whose career path you admire on LinkedIn. Sure someone is going to be too busy, but there will be others who are generous. Remember, you don't want 'one' mentor, you want a village. I found my mentors via LinkedIn, talking to people at work I admire and also keeping in touch with professors long after I finished school. Good luck !!!

</comment><comment><USER12> this is a designer's perspective: your mileage may vary.

I find it helpful to differentiate between a mentor and a sponsor, even if the line does blur between the two as a lot of times people are specifically talking about one. Of the two - a sponsor is better for career advancement, while a mentor guides you as a holistic person. Having both is ideal - <USER2> they can be separate, different, or the same people.

(people contain multitudes, as the saying goes).

Mentors were better for me in the early years immediately after college - <USER3> few art directors who sawed off some rough edges of the "design eye", taught me the basics of how corporations (and their politics) worked, gave me a variety of projects so I could slowly figure out what I liked/was good at (versus not). Good managers are essentially mentors for the whole team.

One of those previously mentioned art directors became a true sponsor - <USER4> continued to give me more high profile projects and strategically dropped my name in VP/EVP meetings so I could snatch up those coveted projects with the reasonable skill level I had. Survived two rounds of layoffs due to him, as well. These are the people that you can and must be loyal to - watch their back, and they'll watch yours and groom you in a good way. There's a lot to the art of soft power behind closed doors.

The where/how question is trickier because other than looking within my org, it was just a matter of vibes and who I connected with on general chemistry level. If you find yourself in water-cooler talks with an authority figure fairly often and both of you enjoy each other's company, odds are that they would make a decent one. Look for someone with integrity, who doesn't gossip but has that sixth sense for being right about org changes, and skilled in their own specialties.

</comment><comment><USER13> I've been looking for a good mentor for 7 years and haven't found one yet. I think it really comes down to time and not many wanting to invest that much.

In a way it helps with growth not to have a mentor because you have to learn how to learn what you don't know yet, which creates more independence.

That said, still would have loved to have a mentor all these years, wish you the best!

<comment><USER14> Exactly my thoughts on all grounds!

Have been going independent since 2013 but would've loved to have had a mentor along the way, or even now for that matter.

But I guess I'm old enough now to know what I don't know and then to learn it.

</comment></comment><comment><USER15> My list of potential mentors has more ideas in it than just my list of actual mentors, so here's both:

\- A boss who regretted giving up coding to become a manager

\- The most senior/productive engineer on my second project

\- Lead Devs that understand delegation (really anyone who exhibits willness to groom you for success)

As far as broadening your horizons, there are a lot of non-devs who can teach you useful skills. Some of these relationships tend to be shorter but important:

\- A boss with enough Agile experience to write a book

\- Senior QA and NOC and UX people (your counterparts can teach you about collaboration)

\- Senior QA people (test automation, and talking about test automation)

\- Senior NOC people (how maintenance concerns and physics should inform software design)

\- Multilingual people (grammar, internationalization)

Also look for anti-mentors. Wise men learn from the mistakes of others. If someone insists that certain work doesn't need to be done but the team keeps paying for those decisions, you should take a hard look at that.

I like to teach but my skills aren't that rounded and I'm usually juggling a lot of different things (I have trouble letting the ball drop so I tend to accumulate too many responsibilities.) If some junior person is already asking a lot of good questions I'll tend to scoop them up, because they can often be made into a primary contributor within 18 months with the right encouragements. I don't know how to teach instincts, or even if you can. I still try, and I help people be better, but with many I give up on them ever being _good_ , and instead I focus on finding tasks they can be trusted with. My mentoring experiences are probably all cases of "when the student is ready, the teacher appears", both giving and receiving.

</comment><comment><USER16> When I was coming up, "mentor" wasn't a thing. This was pre-internet. Nowadays there's a lot of wisdom published freely on various platforms like here, some sub reddits, etc... There are at times more or less chaff to sift through on one site or another so it's not entirely "free" ie takes time.

With the increasing prevalence of the idea I have wondered how a having a mentor may have influneced me over the years. Instead of finding my own way with the meager tools I've been able to discover on my own, could a mentor have allowed me to attain some goals more quickly? Then I look back and consider that any particular year or 5 year period my goals changed drastically (both professional and private). In retrospect I don't know that I'd have done anything different. Getting good advice is far different than following good advice.

</comment><comment><USER17> I am mentoring two guys myself and know a couple of friends who also have their mentees. If you are determined, you can achieve it by cold emailing people (this is how I got my mentees). Find a person, which has some skills or achievements that interests you (eg. he/she is a startup founder) and ideally you have something in common with them (eg. alma-mater, hometown, nationality, niche hobby etc.).

Then simply reach out on linked-in, introduce yourself, expand on something which you have in common to establish some familiarity and clearly state that you would be interested in some advice/mentoring to achieve your goals. You will likely get a reply that your mentor is too busy for this, but maybe he/she can spare an hour every other month, which would already be plenty and super useful.

<comment><USER15> I'm not sure how much good feedback you can get from someone who never watches you work. You can absolutely get advice from people that helps you, but is it really that much better than reading books and blogs?

</comment></comment><comment><USER18> Some people go through education and work never getting a mentor. They are just a face in the back of the class, making up the numbers.

Other people can't make a step through life without having a quality mentor who wants to nurture them on to bigger and better things.

It is a bit like having people that are sexually attractive or not. Some people have no problems finding a partner, to be pestered wherever they go. Others can go their whole life without anyone expressing an interest. Due to human nature we don't tell the less desirable amongst us the awful truth that they are 'ugly/dull/boring/whatever' because we don't want to or need to hurt their feelings.

In mentorship there is often no benefit to the person putting in the time and effort. That teacher isn't going to get paid more or necessarily get any other return. That person on work placement picking up a mentor during a year out from their degree isn't going to return to the company doing the placement so there is no point in overly investing in them - but mentorship happens.

There are advantages in having mentors but there is also freedom in not having mentors or attracting them.

I also think that a formal, official mentor is never going to be a real mentor. The best mentors don't set out with prior experience and training in 'being a mentor' to mentor someone, it just happens. Sometimes it can only be after the fact that mentorship is recognised, a boss could be a boss whilst working for them but only later in another life chapter can the true extent of the working relationship be recognised.

Equally, someone doing the mentoring might not realise that is what they are doing. It can be an accidental thing. Imagine some loser kid who is an embarrassment to their mother and an academic loser joins a team for some work experience. They might get babysat by someone that has a hands-off approach, not into disciplining their charge. The change from fear of punishment and retribution to just having the space to do stuff professionally might make all the difference for the previously written off junior hire to flourish. The babysitting employee might not be trying to be a role model and great mentor but they could be perceived to be those things by their underling.

This does not do anything to answer your question, however, some people will naturally attract great mentors at every step of their development, others will go through life never finding anyone wanting to mentor them. My only advice is to change the variables, e.g. to do a new job or course, then show enthusiasm and confidence.

</comment><comment> zupa-hu I think the hard part is finding your questions (you want to ask your mentor). Once you have them, finding answers is pretty easy. The best source may be books, because authors have thought hard about the answers. 2nd blog posts, because those people too had something to say on the topic. If you ask a random person anything you will likely get a random answer. 3rd find an expert on the topic of your question. Finding a mentor first and your questions only then seems backwards.

</comment><comment><USER19> I think this is one of the areas in which an academic relationships are strong. Most (granted, anecdotal) examples that I've witnessed are a teacher/professor/advisor either moving into or with strong ties in industry mentoring a student (later possibly a direct employee). These relationships seem to be stronger and last for entire lives (well, at least as far as I can tell).

</comment><comment><USER20> I've never really had a mentor and I'm honestly not sure what sort of professional relationship is even being described here. Is this like a professional parent who teaches you stuff and checks in on you and keeps you steered in the right direction, and steers you away from wrong directions? I don't think such a person exists, and if they did, I'd question both their motives and advice. Maybe this is a common sort of long-term professional relationship in other cultures or fields or something?

I understand why people who are in the early stages of learning about a career would want to know someone like this. How awesome would it be to have someone to help you make career choices. I guess I just assumed that it was always (understandable) wishful thinking on the part of high schoolers or CS undergrads who weren't quite sure how to get to where they want to go, or who don't know where they want to go yet and are seeking advice.

On the other hand I've learned an utterly tremendous amount from just about everyone I've ever worked with, including people way older than me and way younger than me. You can learn useful stuff about tech and life and careers from most people that you encounter in your desired career, and a lot of people you encounter outside of it. Nobody's going to have the answers you need for your own life, the best you can hope for is to absorb whatever kernels of wisdom you can from people you encounter that you respect. Maybe some of those people were micro-mentors, or just good people to work with, and hopefully at least some of them felt like they learned something from me too but who knows.

You can also learn tremendous amounts just from Internet forums like HN or Reddit. There's also tremendous amounts of BS or things that are irrelevant to you, but being able to sniff out the good stuff from amongst the garbage is a required skill these days.

The only dogmatic thing I'll say is don't believe anyone who's dogmatic about anything. If anyone tells you that there is One True Way to do anything, immediately doubt everything else that person has ever told told you (including me and what I just wrote). That you have to use this or that programming language, that you have to use this or that editor or tool or OS or API. There's no shortage of people in tech that aren't wired up to make the distinction between personal preferences and immutable laws of the universe. Just find what you like and dive into it headfirst. No amount of training or advice will substitute for self-motivated passion, interest, and curiosity, especially in the early stages of one's education or career.

</comment><comment><USER21> Check out platohq.com

I participate as a mentor there. Good community.

</comment><comment><USER22> I've found it to be incredibly rewarding to let the relationship develop organically. I try to have insightful conversations on Twitter and Linkedin. A very small portion of these conversations turn into strong relationships. Some people are on the lookout for "rising" talent and would initiate the relationship if they see you as one...</comment>


Ask HN: 'Unknown or expired link' - <AUTHOR>

Why does the 'more' link at the bottom give 'Unknown or expired link' at certain times? <comment><USER2> This has been discussed many, _many_ times. Try searching for it in the search box at the bottom of each page.

However, short answer:

The ordering of items on a page can change, so when you open the page the ordering is created, and continuation pages are generated by closures in the code. These closures are garbage collected after a while, so if you don't access one in a timely fashion, by the time you ask for it, it might no longer be there.

Garbage collections will happen more often when the system is more heavily loaded, so the time limit is effectively shorter.

Now, here is some background reading:

[https://hn.algolia.com/?q=unknown+expired#!/story/forever/0/...](https://hn.algolia.com/?q=unknown+expired#!/story/forever/0/unknown%20expired)

You could have looked that up for yourself. Did you?

</comment><comment><USER3> The overall ranking is updated every few minutes. Each front-page has a different `?fnid=xiJqLAhmD8VrsD2p21gUKn` parameter to ensure page 2 displays that ranking. Clicking the `more` link after HN has updated shows you the expired link message.

I guess this means they don't have to store all the old rankings, but it does seem curious not to allow people to view old rankings.</comment>


Attorney general: Americans should accept security risks of encryption backdoors - <AUTHOR> https://techcrunch.com/2019/07/23/william-barr-consumers-security-risks-backdoors/ <comment><USER2> Barr is just the latest to advocate backdoors at the DOJ. Here's an incomplete list:

Rosenstein: [https://www.justice.gov/opa/speech/deputy-attorney- general-r...](https://www.justice.gov/opa/speech/deputy-attorney-general- rosenstein-delivers-remarks-2017-north-american-international)

Sessions: [https://www.justice.gov/opa/speech/attorney-general- sessions...](https://www.justice.gov/opa/speech/attorney-general-sessions- delivers-remarks-association-state-criminal-investigative)

Comey: [https://www.theguardian.com/technology/2015/jul/08/fbi- chief...](https://www.theguardian.com/technology/2015/jul/08/fbi-chief- backdoor-access-encryption-isis)

Comey engaged in a long running campaign on this from at least 2014, until he was fired.

Lynch: [https://www.networkworld.com/article/3040224/attorney- genera...](https://www.networkworld.com/article/3040224/attorney-general- doesn-t-budge-on-apple-and-encryption-in-rsa-talk.html)

Holder: [https://www.washingtonpost.com/news/the- switch/wp/2014/09/30...](https://www.washingtonpost.com/news/the- switch/wp/2014/09/30/holder-urges-tech-companies-to-leave-device-backdoors- open-for-police/?utm_term=.7b88f6d106d3)

Let's all hope they continue to fail.

<comment><USER3> It's almost as if access to high levels of intelligence has an influence on ones perspective.

Not that I'm taking a position on things either way really. The likes of apple should be able to do what they please — just not be surprised when they find the government installing the backdoors themselves.

<comment><USER2> I can't tell if you're for or against backdoors with that statement. Either way, I disagree. I don't think those for or against it are dumb people.

They're just in a different position... In the DOJ, encryption gets in the way of their job--catching criminals... while the penalties for a backdoor fall on others (those responsible for the data). There's no downside to them personally (and very little for the DOJ itself) for getting a backdoor.

The opposite is true for those not in the DOJ... the protection for our data is compromised.. and in exchange, the DOJ is able to prosecute some criminal we've never known, met, or had any contact with.

To those in the DOJ who deal with criminals everyday, their ability to prosecute criminals is of the upmost importance to them personally... and for the rest of us, unless we're a victim of a crime, there's only downsides to a backdoor.

<comment><USER4> >There's no downside to them personally (and very little for the DOJ itself) for getting a backdoor.

There is if the people in the DOJ suffer from identity theft and get their bank accounts cleaned out because some nefarious people exploited the backdoors.

<comment><USER5> Except legislation requiring backdoors will either exempt systems used by government workers of a certain level, or provide much higher penalties if those workers experience a breach.

<comment><USER4> That only works if the government is going to set up its own bank for use by government employees.

</comment></comment></comment></comment></comment></comment><comment><USER6> > _But law enforcement says encryption thwarts their access to communications > they claim they need to prosecute criminals._

I think I have more to fear from the government than I do from the types of criminals that encryption backdoors would thwart.

<comment><USER7> It is fair to assume that the general public knows very little about how many dreadful criminal activities they were able to avoid because they could tap into some conversations early on: massive shootings, terroristic activities, nuclear weapon programs of countries that should not be trusted with them, drugs that may have killed users and mere stupidity that may have started new wars.

I think that the only way agencies were able to keep postponing the end of the Patriot act and related laws ( [https://en.wikipedia.org/wiki/Patriot_Act](https://en.wikipedia.org/wiki/Patriot_Act) ) is presenting massive evidence to the congress of the tragedies they were able to avoid with the power granted by those laws.

Somebody that was publicly martyred by a country of great power makes more noise than a war that was avoided.

Weakening strong cryptography is not the solution but I think we sometimes grossly underestimate the other face of the coin.

<comment><USER8> Cryptography and secure messaging systems are not all under US jurisdiction. If access to backdoors alone has kept multiple massive criminal activities from being executed, then surely we should see some being successfully executed by the groups not using backdoored encryption.

The fact that we don't suggests either that (1) backdoors aren't that essential to thwart them or (2) there are no such regular massive attacks.

Further, as people like the US Attorney General helps to publicize those backdoors, more criminals will choose alternative messaging systems (fewer of which are backdoored), making the US less safe.

<comment><USER7> That is why I wrote "Weakening strong cryptography is not the solution."

</comment></comment></comment></comment><comment><USER9> > The risk, he [Barr] said, was acceptable because "we are talking about > consumer products and services such as messaging, smart phones, e-mail, and > voice and data applications," and "not talking about protecting the nation's > nuclear launch codes."

Two things about this odd quote, which dances on the edge of the Orwellian "nothing to hide" argument:

1\. I'd put the odds that current president has in fact stored the nuclear launch codes on a "consumer product" at 50:50. He's shown a shocking disregard and disdain for protocol. The way in which diplomacy is carried out through Twitter suggests he's not capable of evaluating the threats posed his uses of consumer-grade technology.

2\. Barr assumes a threat model involving petty criminals. The real threat is the US federal government, which has demonstrated repeated disregard, under multiple administrations, for search and seizure boundaries set by the Constitution.

<comment><USER10> I highly doubt that any president has any authority over the storage medium of nuclear launch codes.

<comment><USER11> It's not hard to imagine him snapping a picture with his phone.. you know, just in case.

<comment><USER12> Aren't they sealed? As soon as the Secret service would detect codes to be unsealed, they'd probably have to be replaced immediately.

</comment></comment></comment></comment><comment><USER13> "Some argue that, to achieve at best a slight incremental improvement in security, it is worth imposing a massive cost on society in the form of degraded safety," he (U.S. attorney general William Barr) said

Benjamin Franklin once said: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."

<comment><USER14> That's not a logical argument by Franklin, it's his opinion. There's no axiomatic reason why Ben Franklin's opinion is more correct than anyone else's, even William Barr's.

<comment><USER15> Benjamin Franklin is a Founding Father and has been generally accepted as an authority for more than 200 years, especially on the subject of freedoms and rights. He was a renown political theorist, politician, civic activist, statesman, and diplomat in his own day, not to mention the fact his reputation has stood the test of time.

William Barr is none of these thing.

<comment><USER16> So... Appeal to authority then?

<comment><USER17> Can you call it that though?

One is a person with a well-earned a reputation, the other.. well you get the point.

<comment><USER16> >Can you call it that though? >One is a person with a well-earned a reputation, the other.. well you get the point.

Yes

>An argument from authority, also called an appeal to authority, or argumentum ad verecundiam, is a form of defeasible argument in which a claimed authority's support is used as evidence for an argument's conclusion

You're not defending the point logically; you're only supporting argument is that someone with a good reputation supports it as well.

<comment><USER18> > You're not defending the point logically;

He absolutely is

The annoying thing about "logical fallacies" is that if anyone season argument they disagree with that resembles a "fallacy", that quote it and act like theyve won.

He is not saying that everything Benjamin Franklin has ever said is true. Obviously. However, if a well renowned and respected Authority has an opinion that some evil schmuck disagrees with, it provides evidence as to who is more likely to be correct. That's not what an appeal to Authority is

<comment><USER16> >He absolutely is

Show me where that happened.

>The annoying thing about "logical fallacies" is that if anyone season argument they disagree with that resembles a "fallacy", that quote it and act like theyve won.

That is annoying and I agree, but that's not what's going on here.

>He is not saying that everything Benjamin Franklin has ever said is true.

No one said he was.

>However, if a well renowned and respected Authority has an opinion that some evil schmuck disagrees with, it provides evidence as to who is more likely to be correct.

No it doesn't. It absolutely _does not_. Reputation isn't irrelevant in so far as it lends credibility to a person's statements, but the discussion doesn't stop there. If you're going to defend a quote then defend it. Saying "this is true because X is trustworthy and Y is an 'evil schmuck'" is not an argument.

If this is not a prime example of Appeal to Authority then show me why it's not and provide an example. You're just throwing out your opinions as if they were fact.

<comment><USER15> This is not an example of Appeal to Authority because Ben Franklin is an accepted authority. If all parties agree on the reliability of an authority in the given context it becomes a valid inductive argument. Otherwise every Citation or Source or Bibliography would be a "logical fallacy". An Appeal to Authority would be if the quote was attributed to someone like James Polk. Sure he was president, but he has no authority on this sort of subject.

<comment><USER16> >This is not an example of Appeal to Authority because Ben Franklin is an accepted authority.

...huh?

>If all parties agree on the reliability of an authority in the given context it becomes a valid inductive argument.

No, it doesn't. Why do you believe that? How do you feel about quantum mechanics? Do you realize that Einstein fought tooth and nail against it for years?

>Otherwise every Citation or Source or Bibliography would be a "logical fallacy".

Citations link to works, not authorities. A citation may link to, say, an academic paper which provides evidence to support its assertions. No one is linking to random comments made by so-called authorities, that would never be accepted (unless the citation was to literally show that a quote is legitimate, i.e., made by the person claimed to have made it.)

<comment><USER14> But given a hypothetical question like "What play should a football team run when they are on 2nd down and 3 with 2:19 in the 3rd Quarter while leading by 3 points" — wouldn't a professional NFL coach's opinion be given more credence than mine? Einstein may have been wrong on quantum mechanics but if you had 1000 physics question it would be hard to think of a better person to ask.

<comment><USER16> You're proving my point. When examining an argument you should do so based on the merits of said argument. That's literally the basis of Appeal to Authority. It doesn't get more clear cut than this.

I'd also like to point out you have yet to provide a single fact in support of anything you're saying.

<comment><USER14> I'm not the person you've been talking to earlier

<comment><USER16> Sorry, lost track. Doesn't change my point though.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> In a perverse way, this is progress: At least the false premise of "we can have both secure encryption and key escrow" has finally been dropped and Barr is making the more blunt assertion that the need for eavesdropping outweighs all other needs in cybersecurity.

</comment><comment><USER20> This will be a taboo and unpopular option. My theory is that these discussions are theater. More often than not people store and access their data from their cell phones. Between CarrierIQ and OTA updates/access, there is no such things as end-to-end encryption on a cell phone. People get really upset when I bring this up. I suspect it is a matter of denial and not providing links to public documents, which will never exist. I would suggest that very few people have the patience to implement proper OpSec with their own data.

You don't even need "backdoors" in encryption. Existing lawful-intercept on Slack, Discord, Facebook, Google and all the wireless carriers will net just about anything you could ever want to know.

<comment><USER21> Is there somewhere I could read some more on this point?

I was under the impression that iMessage was end-end encrypted. So unless Apple has a secret backdoor built into their systems, nobody should be able to access those messages correct? Wireless carriers are just sending my encrypted messages over their networks.

What am I missing?

Do you believe my cell service provider could decrypt my HTTPS connections to my bank?

<comment><USER22> It doesn't matter if the apps try to be secure. If any point in the communication holds the key-data in memory and is not on a //user// trusted device then the key is compromised.

Since cellphones have a BMC that isn't user owned, which does have access to the full system memory (rather than being an isolated peripheral modem), and since OTA firmware updates can be pushed by the "infrastructure" (including fake 'towers' setup by TLAs, criminal hackers of other sorts, and hobbyists) containing code to compromise and silently ex-filtrate any data (including those keys, or even just the conversation directly); it is an inherently insecure environment.

<comment><USER23> What should the average security-conscious person do then? Resort to one-time pads? Is there any way to be truly secure, or should we just stop trying?

<comment><USER22> If we want secure tools for democracy then that's going to mean a completely open and thus verifiable (audit-able) platform.

This needs to be from the PCB traces, all of the component tolerances, all of the chips, all of the firmware (even the ROMs that are actually baked in ROMs on the chips), the bootloader, OS, and entire userland.

This is required not just for the host system but also the human interfaces and peripherals.

I hope we will be able to reach that point with a RISKV system at some point; but the various proprietary interfaces that require licences for implementation/etc might make this problematic. I am for standards, preferably completely free, but FRAND and non-restrictive on meeting the above goals might be good enough. The platform has to be fully open-book, but some of that book can be covered by reproduction limitations for a limited time. (I'd prefer standard patent duration at most, as this stuff NEEDS to become the digital version of paper at some point; and within my lifetime would be nice.)

</comment></comment></comment></comment></comment><comment><USER24> Mr. Barr,

Unfortunately such a mechanism requires that we trust the government. That trust was broken with the Revelations from Snowden.

For now, the average citizen fears the government more than criminals and this is the easy calculation folks are making and will continue to make at the ballot box.

-An American

<comment><USER22> More clearly phrased:

Snowden provided evidence (to the fourth estate) proving that trust has been already been broken.

</comment></comment><comment><USER25> Ah, the clipper chip from the 1990s debate over again. They didn't get it then and the world is still ok (kinda, but encryption seems to be low on the list of pressing problems)

The only place they seem to have gotten their way is anti-counterfitting thats injected into scanner silicon.

" From the moment Diffie and Hellman published their findings in 1976, the National Security Agency's crypto monopoly was effectively terminated. In short order, three M.I.T. mathematicians -- Ronald L. Rivest, Adi Shamir and Leonard M. Adleman -- developed a system with which to put the Diffie and Hellman findings into practice. It was known by their initials, RSA. It seemed capable of creating codes that even the N.S.A. could not break. They formed a company to sell their new system; it was only a matter of time before thousands and then millions of people began using strong encryption.

That was the National Security Agency's greatest nightmare. Every company, every citizen now had routine access to the sorts of cryptographic technology.....

The genie was out of the bottle. Next question: Could the genie be made to wear a leash and collar? Enter the Clipper chip."

[1] [https://www.nytimes.com/1994/06/12/magazine/battle-of-the- cl...](https://www.nytimes.com/1994/06/12/magazine/battle-of-the-clipper- chip.html)

<comment><USER26> Interesting to see RSA portrayed as a foe of the government and a thorn in the NSA's side here, knowing what's been reported about their involvement with "Project Bullrun."

Leash and collar indeed...

<comment><USER27> Right especially given their 20-year advance understanding of differential cryptanalysis ...

My impression is the NSA of today is very different than that of the 70s and 80s.

</comment></comment></comment><comment><AUTHOR> So when the backdoor is hacked, as it inevitably will be, whom will I have legal recourse against to recover damages? I'm assuming that any company incorporating such a backdoor would be afforded some immunity against civil lawsuits arising from successful hacks. Also if such compensation is forthcoming won't I essentially be contributing towards it with my own tax dollars?

</comment><comment><USER28> "Some argue that, to achieve at best a slight incremental improvement in security, it is worth imposing a massive cost on society in the form of degraded safety,"

And I expect some would argue that the "slight incremental" and "massive" are incorrectly placed in that statement.

</comment><comment><USER29> > The risk, he said, was acceptable because "we are talking about consumer > products and services such as messaging, smart phones, e-mail, and voice and > data applications," and "not talking about protecting the nation's nuclear > launch codes."

There's a good reason not to use encryption schemes that have backdoors, they aren't safe and this pull quote betrays the fact that Barr knows that.

I'd be willing to wager that the government isn't going to use backdoor-able encryption because the risk of failure is too great. While not being critical to national security, safety in storing your medical, financial records and your conversations with other is mission critical to citizens. Hopefully folks on capital hill see that.

<comment><USER30> >While not being critical to national security, safety in storing your medical, financial records and your conversations with other is mission critical to citizens. Hopefully folks on capital hill see that.

They aren't going to see it. The government will just use the non-backdoored version. If a company gets its data popped because of the backdoor, the government will just blame the company, or it's acceptable losses because they catch some bad guys.

Everyone should be super, super, super pessimistic that attempts like these will be handled in the interests of citizens.

</comment></comment><comment><USER31> I made this comment in a previous thread, but I think it applies here as well:

If you ask the government to do something impossible, such as provide COMPLETE safety and security, they will try to do that. I think the news media bears some responsibility in this regard, as they always blame or call out whatever agency that fails to maintain safety and security, thus leading to severe measures to try to mitigate the previous failure.

</comment><comment><USER32> I'm afraid even Senator Ron Wyden misunderstands it. It isn't that we give them the "power" to break encryption, its that we fundamentally weaken it. We must build the encryption with tissue paper in order to let a person walk through it.

<comment><USER33> Most discussion of backdoors these days is no longer about weakening the encryption itself, but prohibiting its private use. It's about data retention, key escrow, key disclosure and man-in-the-middle attacking everyone like Kazakhstan is trying to do.

Cryptography technology is public knowledge now; there's no putting the cat back in the bag, so now it's about making the non-government approved use of it criminal / basis to assume guilt.

</comment></comment><comment><USER34> One could make a good case that strong encryption is a form of Arms (certainly the US did, as "Auxiliary Military Equipment"[1]). So if encryption is a form of Arms, then Barr should probably keep his mouth shut or else he's making a case against the holy Second Amendment.

[1] [https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...](https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States)

</comment><comment><USER35> Australia has already passed draconian secret mass-surveillance laws, and also is part of five eyes so everyone (including American citizens) are subject to draconian mass-surveillance which is shared with the US when their data goes through any computer on Australian soil.

Australian Federal police are busy attacking journalists right now for exposing a coverup of their soldiers murdering children.

Americans should fight this with everything they have.

Make no mistake, the "free" world is well on its way to becoming a surveillance dystopia.

The nazis could only have dreamed about having the secret and unfettered surveillance apparatus politicians have created, and they are targeting that apparatus towards journalists and citizens.

It's not about terrorists or pedophiles, it's about you and I, and anyone else who could potentially expose government or military incompetence/wrongdoing.

</comment><comment><USER36> Without encryption backdoors, how will you know if people are illegally using high-strength encryption? Everything must be decrypted on demand to determine if illegal cryptography is being used.

<comment><USER4> That doesn't seem hard: just make sure everything is plaintext (i.e., a known and approved protocol, like FTP, telnet, HTTP/HTML, etc.), or make sure it's an approved encryption protocol that has a built-in backdoor (and the data within, again, being one of those approved protocols). Of course, people could be hiding high-strength encryption within the backdoored protocol, but they could do random checks for that.

Basically, the only way to really hide data is to either use steganography, or to use an unapproved data-transfer protocol (and using unapproved protocols can be banned).

</comment></comment><comment><USER37> I've seen this posted several places. It's a bit of a clickbaity title because it sounds like a quote. As far as I can tell, it can't be attributed to him.

The exact quote is:

"Some argue that, to achieve at best a slight incremental improvement in security, it is worth imposing a massive cost on society in the form of degraded safety"

I'm purely making a statement on the article title.

<comment><USER28> If you follow the next few quotes from him in the article, the article title sounds accurate.

<comment><USER37> You completely missed my point. It's not a quote

<comment><USER28> I don't think I did. The title is not a quote, but it seems to be a reasonable summary of what he said, directly from more than one quote. What is it that you are objecting to, you think the formatting of the title makes it look like a direct quote? Fwiw, in that case I don't agree.

</comment></comment></comment></comment><comment><USER38> > The risk, he said, was acceptable because "we are talking about consumer > products and services such as messaging, smart phones, e-mail, and voice and > data applications," and "not talking about protecting the nation's nuclear > launch codes."

When the government stops caring about my race, where my ancestors came from, my sexual orientation, my religion, my gender, my political leanings, and probably a few more I'm forgetting, and puts robust steps in place to ensure that it won't start caring about them again later, then _maybe_ I'll consider entertaining the idea of allowing the government to peek at my messages.

</comment><comment><USER39> Study cryptography now, because at the rate we're going, even teaching/studying it will be restricted in the near future.

<comment><USER40> Considering the export controls on cryptography in the not so distant past [1], I think things have been worse for cryptography. This isn't to say I don't think Barr's comments are alarming, but he is continuing a push by DOJ that has been going for years now and has made little progress.

[1]: [https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...](https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States)

</comment></comment><comment><USER41> I really want someone who is testifying in congress to put this in terms that affect the congressmen _personally_ , explaining to them that it will make it easier for state actors to gain compromising information from their email addresses and personal devices.

<comment><USER42> I think government officials would obviously want to have access to non- backdoor versions of software, so they can exchange their highly sophisticated and ultimately important state business discussions on WhatsApp secure.

<comment><USER4> Government officials still have their bank accounts with privately-owned institutions, which wouldn't have these non-backdoor versions.

</comment></comment></comment><comment><USER43> I'd rather accept the security risks of not having encryption backdoors

</comment><comment><USER44> Passing over for a moment the (lack of) ability of the government to keep secret the means of using the backdoor...

Most encryption software (including crypto libraries) is open source. Is he proposing banning open source or just mandating that it only be distributed as binaries by compromised companies?

Does he, and does anyone else proposing this, have the slightest notion what banning good encryption would actually entail?

<comment><USER45> Banning open source software is probably not feasible (you can distribute the code as a printed book after all). They would have to:

\- ban all Internet traffic that uses non-backdoored encryption (all ISPs would be required to report it)

\- ban all amateur radio equipment, including all products one could use to build a satellite dish (like aluminium foil?..); keep a fleet of radio- direction-finding vans circling the streets

Eventually, maybe also ban general-purpose non-backdoored computers.

<comment><USER46> Also ban hashing algorithms ?

Ban random data ?

And ban the universe from being quantum ?

</comment></comment></comment><comment><USER47> Surveillance 2030: It is now illegal to own or operate your own home server for the purposes of distributed communication

</comment><comment><USER48> > "we are talking about consumer products and services such as messaging, > smart phones, e-mail, and voice and data applications," and "not talking > about protecting the nation's nuclear launch codes."

Talk about putting the cart before the horse! The USA is made of people, not hardware.

</comment><comment><USER49> Am I wrong to believe the government is, in fact, capable of cracking encryption on individual bases, but not on _many_ cases? Isn't this what we want? For the limits of encryption to keep mass snooping at bay?

In other words, I think the "ticking time bomb" scenario often used to justify a backdoor is a fallacy. If the government really wanted or needed to, they could easily decrypt or break into a device (rubber hose method comes to mind).

Don't let fear rule your life, and convince others not to as well. That is our job.

</comment><comment><USER50> This is ultimately bad for people. It gives too much power to the government. It is same as saying government can disable all guns remotely.

And also no matter how much regulation and monitoring there is a big risk from government employees. It will be exploited by others.

And at the end of day, criminals are going to find a solution for themselves when they have to and this will only leave people vulnerable. And usually government itself will use a different tech for obvious reasons and leaves this for citizens only.

</comment><comment><USER51> It is at least slightly ironic that the person saying this is from the very same group a lot people are concerned with being protected from.

</comment><comment> ga-vu This is not what he said. You can read his speech here: [https://www.justice.gov/opa/speech/attorney-general- william-...](https://www.justice.gov/opa/speech/attorney-general-william-p- barr-delivers-keynote-address-international-conference-cyber)

TC piece takes a way to harsh stance. He made some good points in there.

<comment><USER52> This is exactly what he said. I've read Barr's speech, and if anything I think the TC article went to easy on him.

</comment></comment><comment><USER53> Are there any existing cryptographic algorithms which allow for two keys to un-encrypt a piece of cipher text?

<comment><USER54> Government generates a public/private key pair Gpub/Gpriv, and publishes the public part. It also requires the following scheme to be used: if you want encrypt a message M with a key P, you generate random key K, encrypt M with K to obtain Enc_K(M), encrypt K with Gpub to obtain Enc_Gpub(K), and encrypt K with P to obtain Enc_P(K), and then send this triple (Enc_K(M), Enc_Gpub(K), Enc_P(K)). This way, either of the P or Gpriv can be used to decrypt M (you just use it to first decrypt K, and then decrypt M). This scheme is as strong as the scheme used for encryption is, and no cryptography is weakened by its use, except of course a huge negative impact in case Gpriv leaks. With stakes this high though, you could bring likelihood of leak to be very low, and you could modify the scheme to mitigate the impact of the leak.

I don't like it as much as anyone else, but unfortunately I think this is viable in practice. Of course, nothing stops you, a hacker, from using non- backdoored encryption, but government is fine with that, as long as Google, Apple, Facebook etc. are forced to use backdoors.

<comment><USER52> > Of course, nothing stops you, a hacker, from using non-backdoored > encryption, but government is fine with that, as long as Google, Apple, > Facebook etc. are forced to use backdoors.

Which just goes to show that this isn't actually about catching hardened criminals (who will just use non-backdoored encryption, either alone or layered on top of the compromised channels) but rather about enabling pervasive surveillance of ordinary citizens.

<comment><USER54> Not necessarily. There is a middle ground between the two: common criminals that simply use the tools that Google, Apple etc create to make security for normal people easy. If it's effortless to enable full end to end encryption on your phone, then not only will your grandpa enjoy benefits of it, but also a cocaine dealer or a burglar trying to fence stolen goods.

But yes, I think that there are lower-hanging fruits available for pick up here. I wish we lived in a reality where backdooring encryption was the best available path to reduce crime.

<comment><USER52> The lazy sort of criminal that relies on commonplace, corporate-controlled communications apps would be caught using a traditional investigative approach regardless of any end-to-end encryption. It's the more sophisticated ones that they're using as justification for these backdoors—exactly the type that _might_ be mildly inconvenienced _at most_ by backdoors in standard communications services.

If what these criminals are doing is causing actual harm then there must be sufficient offline physical evidence to track and convict them by without direct access to their communications networks. Far from reducing crime, the enforcement of compulsory backdoors would itself _be_ a crime committed by the government against its own citizens on a massive scale.

</comment></comment></comment></comment></comment><comment><USER55> Year is 2040. Candidate for Senate was linked to foreign agent for some innocuous reason. FISA court grants warrant. Justice find nudes, because obviously. Incumbent administration leaks to Twitter.

This is such a bad move the tragedy/comedy writes itself.

</comment><comment><USER56> Right because that wouldn't become a massive problem at the worst possible time.

</comment><comment><USER57> Question.. if you make encryption illegal would that actually stop a "criminal" from using it? This seems like making guns illegal, it only stops law abiding citizens.

<comment><USER58> The advantage of making something illegal that a lot of law-abiding people would otherwise use, is that, even though criminals by definition ignore the law, law enforcement now knows anyone using that thing is a criminal. It has a tremendous effect on how easy it is to identify the criminals.

</comment></comment><comment><USER59> I'd just as soon not accept those risks, thanks.

</comment><comment><USER60> Explains why they always make electronic voting blackboxes instead of an open source blockchain.

</comment><comment><USER61> We will get access to all of Bob Barr's communications if this passes right?

<comment><USER62> As we Russians bitterly say in such situations, "why shouldn't we trust our comrade major?" ("Нет причин не доверять товарищу майору").

</comment></comment><comment><USER63> Encrypted data that can be decrypted without the key is merely obfuscated.

</comment><comment><USER64> are there any countries who aren't clamoring for backdoors/weakening encryption/etc?

i'm interested in knowing the attitudes other governments have.

</comment><comment><USER65> Gimme you house keys Billy, I promise, I'll be good.

</comment><comment><USER66> "fuck off", said the slightly above average, technically inclined American.

</comment><comment><USER67> He should accept the risk of giving everyone his house keys to show he's serious.

<comment><USER68> Or at least give them to the house over-site committee for safekeeping.

</comment></comment><comment><USER69> Would you trade another 9/11 for backdoors? Genuine question.

<comment><USER70> Declaring it a "genuine question" does not change the fact that you are baiting people with a logical fallacy.

<comment><USER69> In all probability, some sort of 9/11 will happen again and this is the question that will be asked.</comment></comment></comment>


Scientists Crack a 50-Year-Old Mystery About the Measles Vaccine - <AUTHOR> https://www.npr.org/sections/goatsandsoda/2015/05/07/404963436/scientists-crack-a-50-year-old-mystery-about-the-measles-vaccine <comment><USER2> (2015)</comment>


8ninths' Holographic Workstation for Citi Financial Trading - <AUTHOR> https://www.youtube.com/watch?v=2h2ulk1_GKg <comment><USER2> Nice demo, but it will never get real adoption for the same reason that 3D viz never got trading floor buy in: [https://etrading.wordpress.com/2006/05/31/visualizing-the- ma...](https://etrading.wordpress.com/2006/05/31/visualizing-the-markets/)</comment>


The alleged NSA malware developers are at risk to be identified - <AUTHOR> https://www.yousry.de/the-nsa-malware-developers-are-at-risk-to-be-identified/ <comment><USER2> This post seems lacking in the data required to make such a claim; I do not understand how it has gained so much traction.

Where is the actual research, and where are the probable identified candidates? Did I miss a data analysis part somewhere that explained the methodology, and probable attribution to actual people? This appears to be a basic string search of the code and some simple syntax analysis.

There are learning algorithms for stylometry, and they can probably be adapted to code. This article appears to state that "it might be possible to use these anomalies as clues", but does not elaborate on, how, why, or what any hypothesis is other than this.

<comment><USER3> Haven't analyzed author's claims, but in general programmer identification is solved problem:

[https://www.youtube.com/watch?v=YMa04HovKfs](https://www.youtube.com/watch?v=YMa04HovKfs) [De-anonymizing programmers 32c3]

<comment><USER4> My first thoughts were about the demo you linked and about this one: [https://www.youtube.com/watch?v=xipI-0HU010](https://www.youtube.com/watch?v=xipI-0HU010)

</comment></comment></comment><comment><USER5> _However, in contrast to 3.5 billions Internet users, only a few hundred experts have to be identified._

This is the sentence that lets you know the post can be safely ignored. Anyone who thinks there are only a few hundred people in the world capable of writing Linux exploits doesn't have a grip on the scale of the world at all.

<comment><USER2> Agreed. There are probably 5-25K (yes, large range, but still order of magnitude higher) people in the Bay Area alone that are capable of writing exploits.

<comment><USER6> Also, there's a huge difference in the number of people capable of secretly building exploits alone in their bedrooms at night (probably committing a crime), and those building them as a day job, where you can solicit feedback and advice from peers, reference well-organised documentation and study the original source code of previously successful exploits and freely discuss ideas and approaches with colleagues over lunch.

Which of course partially challenges this assumption in the article:

 _The developers of the malware [..] were discovered and not trained._

<comment><USER7> _people capable of secretly building exploits alone in their bedrooms at night (probably committing a crime)_

No, that isn't how exploit research works. I don't understand why one would think that writing exploits is associated with being a criminal.

<comment><USER6> Research, no, but turning it into malware is.

<comment><USER7> Do you consider exploits to be malware? If so, then no, you couldn't be more wrong.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> I'm currently working on anomaly detection algorithms and used the good opportunity (the Shadow Brokers release) to analyze a number of malware applications at once.

<comment><USER8> I'd love to see your results once you're ready to share them!

</comment></comment><comment><USER9> The author appears to run "strings" on the binaries and then goes on to shoot a few theories in the dark:

> The developers of the malware are leading experts in the area of Linux, > Network and Security development.

> They were discovered and not trained.

> Because the archive contains a collection of applications, the calculated > result-set is reasonable small for further investigations.

<comment><USER10> Also:

> LinkedIn will show you the professional discipline, GitHub the shared > libraries and their publicity.

I would _guess_ that NSA has a firm grasp on this sort of basic OSINT problem and code attribution techniques.

<comment><USER11> Retroactively scrubbing a programmers published work and social media participance is a red flag in itself.

<comment><USER12> Indeed from what we also know or is suspected at least this is a group which is external to the NSA.

It could consist of former NSA employees and military personnel but it's not clear if this is a fully sanctioned group or just really good hackers for hire.

</comment></comment></comment></comment><comment><USER13> After seeing this post, the malware devs may have unfollowed/unstarred the repos used in order to evade discovery.

It would have been interesting to have GitHub's star/follow history...

<comment><USER14> Github has a comprehensive open dataset [1]. I'm not sure if it keeps historical data, but I'm sure there are people hitting the API's and keeping the data archived :)

[1] [https://www.githubarchive.org/](https://www.githubarchive.org/)

</comment></comment><comment><USER15> Nice forensic analysis and tutorial.

Note that parsing out strings from a binary and finding names from it gives you mainly false positives. e.g. from glibc

[https://fossies.org/dox/glibc-2.24/C-identification_8c_sourc...](https://fossies.org/dox/glibc-2.24/C-identification_8c_source.html)

</comment><comment><USER16> TLDR: Assumptions: "The developers of the malware are leading experts in the area of Linux, Network and Security development." and "They were discovered and not trained."

</comment><comment><USER17> Why is it a problem if they are identified? It is probably the only case where writing Malware doesn't get your in trouble with the government because they paid you to do it.

</comment><comment><USER18> a naive question: would sending this code through an obfuscater not mess up this methodology? (other than lib identification)

It clearly hasn't happened here, but wouldn't that be a reasonable step to cover tracks given this kind of analysis?</comment>