How to Rename Your Master Branch to Main - <AUTHOR> https://www.kapwing.com/blog/how-to-rename-your-master-branch-to-main-in-git/ <comment><USER3> I don't think there is ANY slave connotation assosciated with git. Sure words do matter and your words are being used to see things that aren't there - <USER2> meaning of the word master has been added to by its use in git repositories and it was NEVER used in the way that is suggested here; the email thread claiming that it is used this way is dubious at best. Master, in addition to meaning "controller" means:

\- main; principal. "the apartment's master bathroom has a free-standing oval bathtub"

Because it's a master bedroom everyone understands and feels FINE that this is okay. EVEN in a master/slave hard drive setup (this adds a new meaning too) it isn't about subjugating disk drives, it's about slavishly copying another master (main, principal) disk. I'm very sorry if you're offended by words being used for very specific technology purposes but it isn't right that everyone has to conform to your way of seeing the world.

EDIT: damn, glad to see that article has been flagged and at this point I'm so happy that hacker news does not allow politics.

<comment><USER4> Don't be so fast though: the term "master bedroom" is similarly criticized (and probably with a stronger case for its removal). [https://yochicago.com/is-master-bedroom-a-racist-gender- bias...](https://yochicago.com/is-master-bedroom-a-racist-gender-biased- phrase/30070/)

<comment><USER3> Sorry, it doesn't mean that in any dictionary or in anyone's mind either when they use the term, so you can argue it is being used to oppress people but I say the term master bedroom is perfectly okay.

<comment><USER4> I bring it up because if you meant to point to an iron-clad use of "master" without slave connotations, then you in fact actually brought up an equally (or more?) controversial example and therefore I don't think it helps the case. No one who is skeptical of "master branch" will be swayed by "master bedroom".

<comment><USER3> Probably against the rules to use iron-clad as well. The first warship to be iron clad was used in the US civil war by the confederacy.

[https://en.m.wikipedia.org/wiki/Ironclad_warship](https://en.m.wikipedia.org/wiki/Ironclad_warship)

</comment></comment></comment></comment></comment><comment><USER5> At risk of treading into dangerous territory, I've never actually seen any minorities uncomfortable about master being named as such, just non-minorities uncomfortable on their behalf.

Master dates back to 12th century latin and has numerous definitions, most of which have no connection to slavery.

This seems very much like modern slacktivism - a feel good action which doesn't benefit anybody, least of all the group it was intended to benefit.

<comment> gjsman-1000 Honestly, we could really use a movement around slacktivism. It's lazy, helps almost nobody, and it discredits movements in the eyes of the general public.

</comment></comment><comment><USER6> The name 'main' feels overloaded, just like naming the default branch 'default' or 'development', with the risk of "Who's on first?" confusion, especially when branching off branches.

"What branch are you on?" "I branched off the main development branch for this fix." "Like...the `main` main branch or the main branch for the feature?"

I like redis' rename of their default branch to `unstable`. Just like commits are tagged with the release numbers, the latest code that isn't yet versioned is by default 'unstable'. If the industry as a whole is going to make this change, I would prefer we choose a name that can be unambiguously referenced in conversation.

<comment><USER7> > If the industry as a whole is going to make this change, I would prefer we > choose a name that can be unambiguously referenced in conversation.

It that case, though, we would name our default branch "stable". We don't allow pushes to master unless everything has passed our full test suite. I'm not sure if it's a good or bad thing to have the development model hardcoded into the name of the default branch - I've certainly worked in long-lived repositories where we've changed the model over time.

<comment><USER6> Sure. I don't know if 'unstable' is the best name for everyone, but if the industry decides to spend the engineering time to rename default branches, we shouldn't be just be switching to the first synonym in the thesaurus, but a word that's actually more fitting than 'master'.

'mastering' is an artifact of vinyl and boxed software. Now that a lot of software is continuously tested and shipped, 'master' is not the right word for those processes. Even if you're shipping on-premise software, there rarely is a single 'master' copy anymore.

[https://en.wikipedia.org/wiki/Mastering_(audio)](https://en.wikipedia.org/wiki/Mastering_\(audio\))

As a side note, I've seen people try this, but there is no amount of testing that can guarantee stability. So, 'stable' feels like a false promise. Also, in the event of a bug causing downtime, _someone_ always has the ability to push directly to master and it's always possible that a fix might break a new commit's tests, even if it fixes the downtime.

<comment><USER8> > As a side note, I've seen people try this, but there is no amount of testing > that can guarantee stability. So, 'stable' feels like a false promise.

Which, by the same argument, makes _all_ branches unstable. Why would you want to name, arguably the least unstable branch in the mentioned scenario - unstable?

</comment></comment></comment></comment><comment><USER9> "master" has meanings other than "owner".

I refuse to kowtow to political pressures that don't actually help minorities. What's next, Master Lock and MasterCard changing company names to Main Lock and MainCard?

<comment> gjsman-1000 Whenever I hear "master," I (and I believe most people) think of competence. Master Mason, Master Craftsman, Master Programmer, etc. That does not mean historically that those who worked for masters were slaves, as we had journeymen for example. You can take a look at the guilds in the Middle Ages as an example of this terminology.

<comment><USER10> This many times over.

</comment></comment></comment><comment><USER11> I refuse to even entertain the idea of this. "Master" has nothing to do with slavery and "slavery" is not unique to any group of people or race. Read a history book.

Renaming "master" to "main" helps absolutely zero people. It's just some pathetic, low effort, virtue signaling.

</comment><comment><USER12> I wonder how long until people start calling developers/projects racist because they don't make this change.

I'm curious to know who caused this change, but I have a strong idea at what kind of person it is.

<comment> gjsman-1000 It is really kind of shocking, because we had this whole book called 1984 where the party insisted that members use `newspeak` which was more politically correct. People thought it was insane and we used to have people and newspapers across the spectrum decry XYZ (whatever policy under debate) as being `like 1984`. Using `Orwellian` was a negative term.

And now, here we are, where we can't have an honest discussion about terms without automatically being slapped as racist despite multiple meanings of the same word.

<comment><USER13> And this is back to where I commented recently about the "problem with 1984";

"I don't like the terms master/slave, they make me uncomfortable with the connotations of my ancestor's slavery, can we change them?" -> "NO MORE CAN A MAN BE ENTITLED TO THE CHOICE OF ASCII CHARACTERS ONE WOULD DEMAND IN A FREE COUNTRY! THIS IS THOUGHTCRIME BY THE BACKDOOR! ORWELL! TYRANNY! HAS EVERYONE FORGOTTEN 1984 ALREADY?!"

> " _where we can 't have an honest discussion about terms without > automatically being slapped as racist despite multiple meanings of the same > word._"

Except we can have such a discussion, without being automatically anything, and many people do have said-discussions. There is no accusation of racism in The Article against people who aren't making the change, there is only a discussion of pros and cons and reasons. Same (so far) in these comments about the article.

Newspeak was not a "more politically correct" recommendation of words to avoid offending people, Newspeak was a reworking of the English language to make it _literally impossible_ to _think certain thoughts_ , and a combined _revision of all historical records_ to wipe those ideas out completely.

Asking people to change "master" to "main" like the opening tweet in the article, "I'm doing this. Join me" is not tyrannically oppressive insanity. It's not trying to wipe historical evidence of slavery. It's not trying to change what you can think about.

<comment><USER14> Sure, the article itself is not "tyrannically oppressive insanity" like you say, but when major corporations start picking up these articles because they seem en vogue, it can become a little tyrannical in the workplace.

For instance, if this became a D&I initiative, speaking out against it could be... dangerous. It can have a chilling effect on other people who would otherwise not agree.

I suppose that has a lot to do with the culture at a workplace. Given the current political climate with race relations though, it does make it a little scary to oppose measures D&I related, don't you agree? It would be nice to have an environment where you can respectfully speak your mind without getting labeled and/or canned.

</comment></comment></comment></comment><comment> gjsman-1000 I suppose then that we should rename Master's Degrees to Main Degrees. ;)

<comment><USER15> I would like to hear chess grandmains' opinions on this.

</comment></comment><comment><USER16> "The main argument for changing "master" to "main" is to reduce the occurrences of problematic terminology in a team's codebase"

It's not problematic terminology unless you have problematic thinking, which seems to be more infectious these days than COVID.

<comment> gjsman-1000 Here's the big question: Who is defining "problematic"? Furthermore, what will be "problematic" 5 years from now?

</comment></comment><comment><USER7> I don't have a problem making this change if it actually makes people of African descent more comfortable in the workplace and programming communities. I can understand it more easily for terms like "master/slave", and terminology that defaults white to "good" and black to "bad".

My problem with this, though, is that it feels like the ultimate in "slacktivism" mainly put in place to make white people feel better about themselves. I have rarely (or, actually, never, but to be honest I haven't scoured Twitter looking for posts) seen black people pushing for these kinds of changes (as opposed to many other areas where changes would actually make a difference in the workplace).

</comment><comment><USER17> Thanks I was devastated by the word "master" and now I feel very, very "welcome"

</comment><comment><USER18> I honestly don't know why people are resisting these sort of changes so much. I think it's due to Parkinson's law of triviality.

It's so easy for people to have an opinion on this, when I would rather change the offending name and move on to more important things.

Personally, I like the name trunk, since it makes more sense with the branching metaphor. But ultimately, call it whatever you want, I'll adapt.

</comment><comment><USER19> I work at a $BIGCO and am inclined to do this, not because it will make any difference, but because it is the sort of thing they will do eventually, and if I raise it as an issue, it will look good for me.

The company is extremely good at pointless tediousness anyway (our issue types in jira have been changed three times in the last year, and I could not even tell you what a bug is any more), so more busywork will be par for the course.</comment>


The Western Elite from a Chinese Perspective - <AUTHOR> https://americanaffairsjournal.org/2017/11/western-elite-chinese-perspective/ <comment><USER2> > _I studied economics at Cambridge, a field which has become more and more > mathematical since the 1970s. The goal is always to use a mathematical model > to find a closed-form solution to a real-world problem. Looking back, I'm > not sure why my professors were so focused on these models. I have since > found that the mistake of blindly relying on models is quite widespread in > both trading and investing—often with disastrous results, such as the > infamous collapse of the hedge fund Long-Term Capital Management. Years > later, I discovered the teaching of Warren Buffett: it is better to be > approximately right than precisely wrong. But our professors taught us to > think of the real world as a math problem._

This stuck out to me. In my limited physics education, I was taught to question the models we used and given the tools I needed to experiment and question them. In my limited economics education, I was not taught this, and the models were treated as axiomatic with no mention of how to question these models via experimentation. It felt like the science was stripped out of the field. I wonder if this is a broader trend and, if so, what caused it.

</comment><comment><USER3> This part resonated with me:

 _When I was an intern, in one of the training presentations, a senior banker told us to distinguish between the process and the results. He said that we should focus on the process, which we can control, rather than the result, which is subject to luck. And here at Goldman, he said, we don't punish people for losing money for the right reason. I have always loved asking questions, so I asked him, was anyone ever punished for making money for the wrong reason? After giving it some thought, he said that he had not heard of any such thing. And he was right. In fact, no one seemed to remember the reason I did the inflation trade at all. They only remembered that I did this trade and that it worked well._</comment>


Austerity and the rise of the Nazi party [pdf] - <AUTHOR> https://www.anderson.ucla.edu/Documents/areas/fac/gem/nazi_austerity.pdf <comment><USER2> All: if you comment in this thread, please avoid ideological tangents and political rhetoric. They are repetitive and lead to flamewar. Interesting discussions are able to stay specific.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment><comment><USER3> I'm not sure why, but a lot of these articles fail to properly distinguish between government fiscal austerity (government reducing deficit or debt) and monetary austerity (central banks reducing the growth of the money supply).

There are reasons to perform austerity but it's rarely a good idea to do it on both of these sides at the same time. When governments are trying to get out of a debt hole, monetary policy should be expansionary enough to allow for the private sector to grow and replace the economic activity that the government is halting.

The alternative double austerity leads to, on an economy wide scale, investors' attempts at building wealth, being transformed into hoarding of intrinsically valueless pieces of paper or electrons instead of being tied to something real, instead of being tied to factories, businesses projects and tools that allow people to work. It leads to people not working and not being able to subsist because the investment market is put into a gridlock.

The detrimental effects are not evenly distributed. It disproportionately and very nonlinearly affects groups that are economically vulnerable, the less educated, people working in commoditized industries where margins are thin, the inexperienced. The potential for livelihood for these people simply disappears when hoarding paper becomes more alluring than investing in these types of job creating projects.

The resulting desperation pushes people to extremes.

The ECB has been doing a mild version of this for the past decade, putting western civilization at risk. The US central bank is finally doing a better job but only after reasonable leaders were pushed aside and fanatics gained power. There is now a risk that the fanatics will get the credit for the better economy which might help them maintain power.

<comment><USER4> I'm Italian and I've witnessed this over the course of the past five to ten years. The whole county, fragile enough to begin with, has been subjected to an utter death-march of diminishing returns as margins decrease, no longer cover fixed costs, and cause businesses to fail while dropping prices all the way until whole swathes of the economy simply shrivel up and die.

I was struck by the parallels between what is described in this paper and the very recent (week old) national elections, the first to be held in five years. There was an overwhelming swing towards extremist parties (one in two voted either for the xenophobic nationalistic formerly openly racist Northern League or the wildly populist Five Star Movement). The disposition along the north/south axis correlates sharply with unemployment and other forms of economic/social duress and I cannot help fearing that this is the fate that will befall us.

<comment><USER3> It's all so sad... The ECB could solve these problems by a snap of their fingers at not cost. Almost everyone would profit. I'm stumped as to how to solve the problem of central bank incompetence.

<comment><USER4> It's not only the ECB and it wouldn't be at no cost, insofar as quantitative easing (which I think you're referring to) would cause inflation which in turn would diminish the real value (in terms of future purchasing potential) of creditors and consequentially would be unpalatable to creditor nations (such as the much-maligned Germany, for example).

<comment><USER3> Any gains Germany gets from overly tight money are temporary and transient.

If they want to get a better deal on their loans, they should negotiate the loans better. Running a disastrous monetary policy to indirectly improve their loan terms is an insanely destructive thing to do both to the indebted countries and to the weaker parts of their own economy.

Also, the loans they make are mostly with the countries' governments but as you probably know, euros are used by non government entities too. Germany shouldn't strangulate all of the eurozone's private markets just to manipulate terms of government loans.

On top of this, not allowing people to work and destroying their countries' economies greatly increases the chance these countries are going to default or restructure parts of their debt, again, not to Germany advantage.

Finally, having neighbors with poor economies is bad for your exports and your own businesses.

In the long run Germany has much to gain if people of Europe have functioning investment markets and the tools are available for people to work and produce.

<comment><USER4> Actually you're right. Italy at least is being totally ruined by this state of affairs. It seems that at some point this country is undergoing some kind of social collapse, and that once that has passed the critical threshold a financial side-effect will be inevitable.

I don't really see a way out of this. It seems that all the citizens are passengers in a crashing aeroplane, and that the pilots themselves are sitting up front but have been severed from the controls and stripped of all agency. The aviation the outcome would be obvious, and that's why you're essentially correct in saying that gravity needs to be switched off, at least temporarily, for the benefit of everybody. Again, I don't see this happening.

</comment></comment></comment></comment></comment></comment><comment><USER5> What I take from this is not "austerity allows extremists to take over" but you need the middle and upper classes support to take over a country. The austerity part was just the bit that persuaded the middle classes to put up with all the rest of Hitlers rhetoric.

The spending cut was dramatic in the paper - 25% drop in government spending. In the UK our austerity program at the height of 2010-15 was a reduction in the growth of spending (not a nominal cut). AFAIK only greece has seen such a dramatic reduction in GDP (and I am not sure the government spending cuts have been so deep).

Additionally it's worth noting David Runciman's comments on Greece and Nazi party (#) here - he posits the major difference is one of age - Germany and Europe were young (25 years on average) then but now greece is a muchnolder population- old guys riot less it seems.

This looks like a decent paper on an area of interest but Runcimans presentation above reflects my thoughts - if we do screw up the world again, the threat this time will look different, come from a different angle. We should not just avoid the mistakes of history - we are really good at coming up with whole new mistakes as well.

(#) Talking politics podcast cannot find the right episode.

<comment><USER6> Other than Greece, recent examples of brutal govenment spending cuts can be found in Estonia, Latvia and Lithuania. The cuts there were actually worse, both in relative and absolute terms.

Latvia for example had a 26% drop in GDP and a 55% drop in housing prices at the peak of the crisis. On many levels, 20-33% of public servants were fired, with the remainers' already low wages reduced by 20-33%.

<comment><USER5> Thank you - was not aware. That is stunningly bad any good sources on this ?

<comment><USER6> Sorry, reading your comment just now, and have to run soon, so... the obvious starting point:

[https://en.wikipedia.org/wiki/Economy_of_Latvia](https://en.wikipedia.org/wiki/Economy_of_Latvia)

</comment></comment></comment></comment><comment><USER7> Resist the temptation of applying this to other situations. Some caveats:

\- The US didn't actually embark on anything resembling austerity in 2008-2016.

\- The narrative that the current US Oresident was swept into office by economic complaints has not held up well. Among other things, it's become quite clear that Trump voters were not primarily those under economic threat. Race, education, and gender were far more meaningful predictors of voting (R)[0].

\- Any such causality also fails if you compare economic conditions in 2016 to, for example 2012. Or, if you want to focus on economic anxiety and not headline numbers such as unemployment, 2008.

\- Economic factors also fail to explain the decidedly different situations with similar outcomes we've seen in Britain, or Austria.

\- Even the poster child for austerity in modern politics, Greece, has somehow managed to keep it together, somehow.

[0]: [http://fivethirtyeight.com/features/education-not-income- pre...](http://fivethirtyeight.com/features/education-not-income-predicted- who-would-vote-for-trump/)

<comment><USER8> I agree - it is very hard to find the cause.

I'm thinking the raise of extreme nationalism and populism (i.e., nazis) seems to caused more by pace of changes (rate of it) in the society and economy than by economical problems or even immigration.

It seems like that Nazis are more a reaction on the pace of the changes. For example, science was rapidly changing (weird quantum mechanic and even weirder general relativity are both from Germany), society was becoming very liberal (religious tolerance, etc.), economy (fiat currencies, etc.) and so on.

In short, "change" anxiety causes this.

<comment><USER9> I wonder if it's just cyclical.

Nazism and similar ideologies are clearly attractive. They hook into some fundamental part of the human psyche. They are also repellant. Their success depends on which of these factors is stronger.

A big part of what makes them repellant is seeing what the real world consequences are. It's hard to find Nazism attractive when you've seen it produce genocide and the near total destruction of its country in war.

But that was a long time ago. There aren't many people left alive who remember that time. The horrors are going from concrete to abstract. I hope it's not true, but maybe we can't shift away from it until we have another example of how bad it is.

</comment></comment></comment><comment><USER10> RE: Austerity and economic analysis in general

>How Seriously Should We Take Economics?

>Economics is a science—it proceeds via hypothesis and empirical testing—but it's a soft and squishy one, and any argument to the contrary should be treated with great suspicion. Especially in macroeconomics, hard-and-fast laws are hard to find. So are stable parameters and reliable empirical studies. Often, about the best we can do is isolate general tendencies, and then look carefully to see whether they apply in the case under consideration.[0]

[0][https://www.newyorker.com/news/john-cassidy/the-reinhart- and...](https://www.newyorker.com/news/john-cassidy/the-reinhart-and-rogoff- controversy-a-summing-up)

I encourage anyone interested in austerity to read this article. It's relatively short and insightful.

</comment><comment><USER11> > ... austerity measures, measured as the combination of tax increases and > spending cuts...

Wikipedia defines the term as either or both of these things. Investopedia defines it as only the latter, and modern political discourse seems to do the same. At any rate the definition seems contentious, and the headline potentially misleading (increase spending to avoid the rise of a catastrophically evil regime).

</comment><comment><USER12> "...combination of tax increases and spending cuts..."

As of the moment we only have the political appetite for the spending cuts and tax _cuts_. The tax raises will come later when we realize how far we've bankrupted the social safety net programs, perhaps 10, 20 years from now.

<comment><USER13> >As of the moment we only have the political appetite for the spending cuts and tax cuts.

if you're about US then it is spending increase and tax cuts. "Spending cuts" in US is just a rhetoric in order to redirect money from some political opponents' programs into political allies' program while overall increasing the spending.

</comment></comment><comment><USER14> So, what's the solution to prevent such escalations? As per the discussion, there are at least some hints that some countries are heading in that direction again.

<comment><USER15> Mark Blyth has been trying to explain this situation ever since his warning about economic policy leading to a rise of populism, "Austerity: The History of a Dangerous Idea"[1]. For a very good overview of the problem - and some suggestions on how to fix it - see this[2] recent talk.

Briefly, the political situation can be fixed quickly _if-and-only-if_ the actual needs of the working classes are actually addressed. That means e.g. some type of single payer healthcare and paying off the student loan burden.

[1] [http://markblyth.com/books/austerity-the-history-of-a- danger...](http://markblyth.com/books/austerity-the-history-of-a-dangerous- idea/)

[2] [https://www.youtube.com/watch?v=BsqGITb0W4A](https://www.youtube.com/watch?v=BsqGITb0W4A)

<comment><USER16> The rise of populism is tied to student debt, a phenomenon that overwhelmingly impacts the upper middle class?

<comment><USER15> It's limiting who can even enter college. Blyth specifically recommends "Free College Tuition". I (perhaps unwisely) mentioned the milder goal only addressing _current_ student debt with the goal of avoiding being dismissed as "marxism".

I strongly recommend listening to Blyth's actual explanation (in this or his other talks & publications), not my poor-quality summary.

<comment><USER16> The idea that the solution to the core problem of toxic populism just happens to be the policy prescriptions of the Bernie Sanders campaign (I say this as a Democrat!) seems like a bit of a just-so story.

<comment><USER17> Well sure, it seems dubious if you frame it chronologically like that but that's not necessarily how it happened. "The idea that the solution to the core problem of X just happens to be the prescriptions of Y" is exactly the case whenever Y is purposefully and intentionally constructed to solve the problem X.

Who's to say social democratic policies (i.e. Sanders, FDR) don't usually arise in response to the toxic populism that austerity creates because they (anti-austerity) are the natural cure? Isn't that the story behind the new deal?

Is it so hard to believe that creating an entire generation of people who will have negative net worth until they are 40 fosters resentment?

<comment><USER16> That's a tautological argument. No good-faith participant in public policy debates aims to push whole generations into debt; they simply disagree about the best way to avoid that outcome.

I don't doubt that people who believe in single payer and subsidized tuition do so because they think it's the best way to keep generations out of debt. It would be weird for them to think otherwise.

What I'm doubting is that they can evoke public policy outcomes from the 1930s as a natural experiment proving that those are the best policy interventions. I think that argument assumes a whole variety of facts not really in evidence.

<comment><USER17> >No good-faith participant in public policy debates aims to push whole generations into debt

I agree, but I don't agree that even a majority of participants in public policy debates are acting in good faith. I think it's possible, but given the results and empirical evidence we have to the contrary you should provide some evidence or argument to back up this extremely controversial claim.

I don't think they actively wish to push generations into debt like mustache- twirling cartoon villains, but I do think they are not particularly concerned with this side effect of their other policy goals which are essentially a massive transfer of wealth and power to the private sector, like, e.g. privatization of the loan industry and education.

>I think that argument assumes a whole variety of facts not really in evidence.

The original argument was made by Blyth, who is a serious academic, not me, and you haven't made any attempt to engage with him at all. The crux of the argument is that "anti-austerity is the cure to the ills of austerity" which is honestly nearly tautological because of its obvious correctness, not because of a flaw in its reasoning. It's natural to look back at similar historical situations, like a gilded age of massive inequality and the destruction of working class power preceding a depression. The only real difference between then and now is that we've chosen to call our depression a recession, and pretended there was a recovery from it instead of creating one.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Reading the article I can draw some distinct comparisons to the United States colonies in the sixteen hundreds at the helm of people like Cotton Mather. He may have been a decent local leader if England hadnt insisted on bleeding the US dry to pay for war. Instead he rose quickly to power and not only doubled down on his west african savage rhetoric in order to preserve what would now be considered libertarian ethos, but helped to cement a 200 year old legacy of racist and prejudice thinking in the united states. Much of the reason interracial marriage was shunned throughout american history is due to prejudice he introduced intentionally to avoid marriage conditions rendering slaves automatically freed. Mather worked directly to oppose englands emancipation laws from being extended into the colonies, as it would have restricted the ability to trade on the open market (specifically cotton) and continued US dependence upon the crown.

</comment><comment><USER19> Not completely surprising, given that we saw similar effects in Greece, during the austerity measures there.

</comment><comment><USER20> I thought this was common knowledge, but it wasn't mentioned at all when it was pushed as a policy after 2008

</comment><comment><USER21> I'm surprised this paper omits any mention of the Bavarian Soviet Republic [1]. In a paper discussing precisely what would have given the Nazi's more support, I don't understand how they managed to omit this. Like the paper discusses there was an increasingly radicalized conflict between far left and far right groups. This first came to organized violence when a group of communists and anarchists overthrew the government of Bavaria, a German state, and declared it the Bavarian Soviet Republic.

It was a brutal country for all month long that it existed. Guns were seized along with money, food, and most other necessities of the times. People's houses were stolen and given to vagrants. Factories, farms, and other production facilities were stolen from their owners and given to the workers. And the country rapidly began to face food and supply shortages, similar to what would happen to China during its "great leap forward."

And these shortages were met with comments from the government such as, _" What does it matter [if we do not have milk]? ... Most of it goes to the children of the bourgeoisie anyway. We are not interested in keeping them alive. No harm if they die – they'd only grow into enemies of the proletariat."_ And on top of all of this, two of three of the leaders of the groups that overthrew the government were Jewish, at a time when many were already blaming Jews for Germany's defeat in WW1.

I'm certain there are many causes for the rise of the Nazis, but not even giving this event mention seems unreasonable. This is certainly one of the most important events in setting the stage for the political changes of the times.

[1] - [https://en.wikipedia.org/wiki/Bavarian_Soviet_Republic](https://en.wikipedia.org/wiki/Bavarian_Soviet_Republic)

<comment><USER7> I have no idea why this decidedly minor failed movement should figure prominently in any telling of the rise of fascism in Germany.

As you state yourself, it lasted for less than a month. I will add that this month in semi-power occurred before Hitler had even joined the Nazi party.

<comment><USER21> Imagine for a minute that in some moderate sized state in the US, radical left or radical right individuals organized and violently overthrew the government by force with tens of thousands of 'soldiers.' And then they started living up to every imagined stereotype of their ideology.

Can you imagine how that would change this country? How would you respond? I expect we would almost certainly end up going hard in the opposite ideological direction of whomever did it. This a crucial point in understanding how and why it was so [relatively] 'easy' for quite absurd views to start to take hold.

<comment><USER9> Why imagine? We experienced this in the 1860s. Unfortunately our reaction was not to veer hard in the opposite direction, and much of the rebels' ideology persists in our government to this day.

<comment><USER22> I'd like to understand your comment better but I really have a hard time understanding what happened in the USA in the 1860s. Just like TangoTrotFox was kind enough to assume that not everybody here knows Bavarian history by heart, can you not assume everybody here is American?

I googled for "USA 1860s" and followed some links but I can't get further than stuff like the "Dakota War of 1862" which I doubt is what you're referring to.

<comment><USER7> They're referring to the civil war.

<comment><USER22> Oh right, of course. Thanks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> > ... it has been speculated that radical austerity measures, including > spending cuts and tax rises, contributed to votes for the Nazi party > especially among middle- and upper-classes who had more to lose from them.

> Our analysis shows that chancellor Brüning's austerity measures were > positively associated with increasing vote shares for the Nazi party.

</comment><comment><USER24> > please avoid ideological tangents and political rhetoric.

I worry you may be asking for a bit much in a thread discussing austerity and the rise of Nazism.

<comment><USER2> Perhaps, but it's a high-quality submission, and worth seeing whether we can stick to the site guidelines in discussing it.

<comment><USER25> You should just start an econ and politics aggregator. This is about the most blatant of "naked politics" as you can get.

It is high quality... For another site.

From the guidelines of what off topic: "Most stories about politics". If this is allowed, the guidelines don't mean much.

<comment><USER2> I've asked you before to stop posting tedious harangues about HN. You've done it way too often, it's off topic, and has become annoying.

The site guidelines say _most_ and _probably_ for a reason. This article obviously clears that bar. The vast majority of political stories don't, so what you say downthread is far from true.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER16> I think you've overreacted here. I don't think that brief 'jnordwick comment qualifies as a "harangue" and I think it raises a reasonable point: lots of things are "high quality" but not really germane to Hacker News.

You might hope that a story like this is one we can all find intellectually interesting and discuss without falling into a political vortex. But it's a political topic that reacts with almost every other political issue on HN, from US politics to Greece and the EU.

I think he's right and you're wrong, for whatever that's worth.

<comment><USER2> It becomes haranguey if it happens often enough.

I'm not sure your point is borne out by the thread. Most comments are civil and substantive. It isn't the highest quality discussion but graded on a curve it's good.

My inclination was to penalize the article because of the triggery title. But I took a look and had to change my mind. The article is substantive and gratifies intellectual curiosity; that's the site mandate ([https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)), so I'd say it's clearly germane.

The topic itself is troll city, of course, which is why I posted the sticky comment at the top. We have to judge this by the article, not overall topic. Even if nearly everything on a topic is crap or flamebait, occasionally something isn't, and it's important to how HN works to treat those exceptions differently—even though having blanket rules would be easier, and a lot of people mistakenly think we do have them.

</comment></comment></comment></comment></comment></comment><comment><USER26> So...having failed to convince everyone that austerity would lead to the fall of Western Civilization now the Keynesians are saying that austerity is the cause of Neo-Nazism?

Not that I'm surprised, very little of their pseudo-scientific mumbo-jumbo (complete with equations) surprises me anymore.

What I don't understand is they claim austerity is the cause of Trump's rise to power when Clinton was pretty much the poster-child of the anti-austerity movement, I don't think anyone seriously considered she wouldn't continue following Obama's economic roadmap as opposed to Trump's claims of reigning in government deficit spending and waste.

<comment><USER27> > Trump's claims of reigning in government deficit spending and waste

Trump _also_ promised a huge infrastructure spending plan and a border wall. I wouldn't say Clinton was especially anti-austerity either, that was Sanders' thing.</comment></comment>


Ask HN: how do blackhats meet? - <AUTHOR>

to defend attacks one has to understand the mentality of an attacker. hence white and black hats are indistinguishable. I assume black hats have a certain circle of trust the way they spread information. how do white hats learn about black hat activity? Kevin Poulsen wrote a story about Max Butler's CC forums, which got infiltrated by the CIA. I assume in the last 10 years the underground economy has grown considerably.<p>the reason I ask is I need a very high secured linux server with some inbound connections, but there is not much structured information out there. <comment><USER2> If you are going to be doing sysadmin work, and you want to get a feel for the attacker mentality, there are a few things you could do.

If you have the money, know at least 1 scripting language, and have an aptitude for technology, the OCSP certification course is pretty good.

If you want to go the cheaper route, there are lots of books. One introductory text a lot of people like is Hacking: the Art of Exploitation.

If you want to learn about web security, the Web Application Hacker's Handbook is a great book. For something less intensive, The Tangled Web would suffice.

If you want to learn to harden Linux servers, reedit.com/r/linuxadmin, /r/linux and /r/linux4noobs are great resources. Before you post questions, however, I suggest using the search function because lots of people ask for hardening guides.

</comment><comment><USER3> Max Butler's forums got infiltrated by a task force composed of FBI and Secret Service personnel, not the CIA.

Black hats generally network on IRC. You sit on some public IRC channel, build rapport [1][2], and eventually get invited to private channels.

There are plenty of resources out there on how to _harden_ your server and reduce attack surfaces. You just need to spend more time familiarizing yourself with the landscape and quantify your actual goals.

1\. [http://guerrillamerica.com/2013/12/source- recruitment/](http://guerrillamerica.com/2013/12/source-recruitment/)

2\. [http://guerrillamerica.com/2014/01/source-handling-part- one/](http://guerrillamerica.com/2014/01/source-handling-part-one/)

</comment><comment><USER4> Blackhats are just people who abuse their Whitehat knowledge.

There is a plethora of IRC channels, forums, mailing lists and whatnot where people share that kind of stuff. Frankly, a bug report is something like sharing it, before its fixes it is a zero day exploit.

<comment><USER5> I think IRC is the easiest source. Although, a lot of the IRC channels are invite only and you will have to find a way to get invited.

Twitter is another source I've seen. "Blackhat" users will tweet about exploits they found.

<comment><USER2> A lot of anonymous channels are open to the public.

There aren't as many skilled anons as there used to be, but there are a few left. Just don't click on any links in the channel.

</comment></comment></comment><comment><USER6> A lot of them meet in private invite-only forums. Krebs had some success infiltrating those forums but eventually got discovered.

<comment><AUTHOR> thanks for the info. are other investigators doing the same thing. what is the spectrum here? for example anon is more political and sort of grey hat. but I find taking information in from MSM or even popular blogs is only scratching the surface.

<comment><USER6> What do you mean? As far as the forum members, they're as black as you can get. Though, some of them only sell the tools that enable illegal activities or exploits.</comment></comment></comment>


Overview of Text Extraction Algorithms - <AUTHOR> http://tomazkovacic.com/blog/14/extracting-article-text-from-html-documents/ <comment><USER2> This page is just a thin wrapper, with a link to the _actual_ overview: [http://tomazkovacic.com/blog/14/extracting-article-text- from...](http://tomazkovacic.com/blog/14/extracting-article-text-from-html- documents/)

And here's his list of resources: [http://tomazkovacic.com/blog/56/list-of- resources-article-te...](http://tomazkovacic.com/blog/56/list-of-resources- article-text-extraction-from-html-documents/)

<comment><USER3> I wonder why anybody from HN here read that article and decided to submit it and not the original source

<comment><USER4> The link is changed to pointing to the original article already.

For reference, this post is originally linked to <http://www.readwriteweb.com/hack/2011/03/text-extraction.php>

</comment></comment></comment><comment><USER5> Readability has a LOT of hand tuned heuristics for figuring out the most likely content of the page, but the primary indicator on whether a tag with text in it is part of an article or not is the number of commas in the tag. It's my favorite thing about the algorithm because it's a dumb idea that works. The comma rule gets the extraction correct on about 70% of the web, the rest of the heuristics are mostly there to cover screwy ways people structure their articles.

<comment> tha-dude I've been dabbling in content-scraping, what bugs me is that with all the AJAX trickery that's going on, merely analyzing the XHTML source doesn't get you very far in many cases. Executing the page (JS, DOM and all) via browser- programming is an option but of course quite expensive. A headless browser is what's needed!

<comment><USER6> Yeah. I think that is the challenge. A good way to get around the AJAX problem is to see if a site has an RSS feed and use that to extract content. I wish sites had a url for bots built in so you didnt have to do all this fancy stuff to extract the content.

<comment><USER7> Many of the big sites will feed you non-ajax content if you're the googlebot.

</comment></comment></comment></comment><comment><USER8> I studied a fair amount of NLP (a true passion of mine) at school and after I graduated I spent several months working on tech which did this (and other things). That was intended to be a startup, but sadly, at the time, my business sense sucked and I couldn't decide on a good product to fit the tech to (the fact that I was developing tech before I had a strong sense of my product is already telling).

I since have started a completely different (and profitable) company and the code has just been bit-rotting. I'm not sure what I should do with it. Keep it around in case I ever decide to do a business model like some of these companies (I probably don't have time for that)? Open source it (time- consuming to clean the code and what do I stand to gain from that)? I guess I could use the open-sourced stuff to help me find contracts for freelancing, but I just don't see a lot of NLP remote work being offered.

Still, I hate seeing the code rot...

<comment><USER3> dump it on github - someone will come around and clean it up for you

what is it written in?

<comment><USER8> Mostly Python. Some C. Some R to play around with datasets and prototype algorithms.

</comment></comment></comment><comment><USER9> When I started using the internet in 1992 Usenet (which BTW was almost always referred to as netnews or just plain "news" before Time magazine, etc, used their influence as explainers of the internet to the general public to change the name) was the social heart of the internet the way the web is now, and you did not need _algorithms_ to _extract_ the text from Usenet because the text was all dead-simple plain text files.

</comment><comment><USER10> I always wanted to generate a simple service that classifies websites. Something where you dump in the HTML/URL and it returns something like "agriculture"/"government"/"retail"/"education".

I already have a set of a few thousand classifications at hand. What would probably be a good algorithm to run it through? I assume I'd use something like webstemmer/boilerpipe/... to extract just the main text first.

What I am a bit uncertain is what I should do after that. My guess would be that I isolate the nouns/adjectives with the highest frequency and do a clustering with my already categorized dataset as training data.

Does that somewhat makes sense? If yes: any recommendations or alternatives for libraries (preferably ruby) or just algorithms themselves (k-means, svm, neural network...)

<comment><USER11> Hi,we are launching a service exactly like the one you were referring to. You can try the API already. Check out the docs [https://sites.google.com/site/thinkersrus/products-1/science...](https://sites.google.com/site/thinkersrus/products-1/scienceapialpha) and the demo <http://www.thinkersr.us/demo.html>

<comment><USER10> Oh nice, looks interesting and worked pretty well from my few tests. Sadly, with the amount of requests I'd be doing (10000+ just for training), I guess I should build myself something on my own

</comment></comment></comment><comment><USER12> Unless I'm missing something, all the methods he's talking about involve looking at web pages in isolation, or, alternatively across the set of all web pages.

To do "template drop out", it would seem productive to look longitudinally across pages on a single site, or in a subdirectory. For instance, almost all pages in Hacker News have the same chrome. Methods used for DNA clustering (such as Hidden Markov Models) could quickly find 'conserved' and 'unconserved' areas of documents.

This touches semantic technology because it links the ability to find nameless statistical patterns with meaningful semantic identifiers, such as domain names.

<comment><USER13> Methods that do clustering on similar web pages are mostly too CPU intensive for processing larger sets (we're talking millions of web pages). They are also harder to scale from data-locality perspective, you need to figure out which pages to put together and then get the data together.

Looking at pages in isolation is much more horizontally scalable. You can take a look at Webstemmer (<http://www.unixuser.org/~euske/python/webstemmer/index.html>) for a method exploiting similarities.

<comment><USER12> Great reply. However, I think something is only worth doing if it's impossible.

Your argument is like Chomsky's argument about the poverty of the stimulus, just in reverse. There are heuristics that let us radically prune the N^2 possible relationships between things into a much smaller set that will let us do things that would be otherwise unscalable.

<comment><USER13> Let me know if you know of this approach being used somewhere in production processing millions of web pages. I would be very interested to know how they overcome the difficulties!

I can imagine the cost/benefit of the approach is favorable for largest search engines like Google and Bing that are trying to squeeze last few percentage points of precision out of results. For everybody else, the engineering and scaling difficulties are probably too big. I'd love to be proven wrong.

<comment><USER12> Google and Bing are doing billions of web pages, not millions. I process millions of web pages myself with 3 computers -- millions aren't a lot these days, although I'm not currently using clustering methods.

Rather I'm selective with my inputs so I start with unscrambled eggs so I can improve precision not by "a few percentage points" but rather reduce the false positive rate by an order of magnitude.

My use of ML so far has been modest, limited to solving a few straightforward problems. Personally I think search is boring (on webscale, too big of a game for small players plus search as we know it probably can't get much better because the queries are not precise -- better performance will require changing the game) but I've been forced to put effort into it because end users expect it.

</comment></comment></comment></comment></comment><comment><USER14> I have been thinking there should be a way in html to mark the main part of a web page, as opposed to the header, navigation, footer, etc. It could be used when printing, by screen readers, search engines, Readability. I don't know if the W3C would approve such a tag, or if site owners would bother to use it though.

<comment><USER15> HTML 5 has the 'article' tag. There's also header, footer, and other semantic mark-up tags.

I've spent the last month writing scrapers for newspaper sites. No one uses any of these things.

<comment><USER7> Are the scrapers hand-tuned to each website? If not how did you do it?

<comment><USER15> We need to extract site-specific metadata, and I'm no expert at NLP, so it's mostly one scraper per site.</comment></comment></comment></comment>


Siri Will Never Open To 3rd Party Devs - <AUTHOR> http://robcortez.com/post/11513506147/siri-will-never-open-to-3rd-party-devs

<comment><USER2> Siri will be open to 3rd party devs IMHO. User will say to Siri, "[App Name], [command]."

"New York Times app, read me the 10 top stories."

"Pandora app, play Sugarland station."

Each developer can list a series of actions = verb + object. When the user installs the app, Siri will pick up all the actions and they will be available to the user. Again, it must be initiated by the user saying the app name first. I can see two main usage cases:

1\. Launch app into particular action - for example, "Pandora app, play Sugarland station." This opens Pandora and plays Sugarland station. Pretty straightforward. Devs just determine the verb + object and what Siri does with the action. In this case, Siri launches Pandora and sends over the verb "play" and the station "Sugarland," and Pandora knows what to do with it.

2\. Read/show data within Siri. So, in this usage case the app doesn't launch but rather gives Siri data. For example, "New York Times app, read me the last 10 stories." Siri sends "read" (verb) and "last 10 stories" (object) to New York Times app. New York Times app gets that action and does an API call to the server to return the 10 top stories and gives it to Siri to read. Siri reads them to the user.

#2 usage case is pretty mind-blowing if Apple can pull it off. Because it's taking apps and pulling off its cover and stripping them to it's core services. Users don't have to launch the app to get certain data. App become more services that Siri can access. Of course, the user can still launch the app and do other things in the app via touch. But the app has a voice interaction interface and Siri is the master of that.

<comment><AUTHOR> Again, this solution seems very practical on paper. It sounds perfect. But...

This involves Siri learning app names. Don't forget, under all the magic is voice recognition. Is Siri going to understand "Instagram"? How will it know the difference between "fourquare", 4x4 (four squared) and "four square"?

<comment><USER2> Just require the user to add "app" after the app name. Again only the apps the user installs are added to Siri's commands available to the user.

<comment><USER3> doesnt that seem to go against the entire natural speech model that apple is pushing with siri?

</comment></comment></comment></comment><comment><USER4> First of all, wether or not Apple decides to open an API to siri and wether or not it's possible are two separate things. None of his arguments are very convincing to me. Managing a 3rd party ecosystem is a hard problem but not _that_ hard; especially for Apple who really can call the shots however they see fit. Here's a scenario: all 3rd parties can plug into the siri API but they need approval and can be kicked out for whatever arbitrary reason Apple picks. That would suck for developers (see marco's post earlier) and yet most developers would jump through hoops to get into there.

<comment><USER5> Agreed.

I don't see the point in registering with apple a particular phrase. Wasn't part of the reasoning behind new hardware being required was that much of the translation is being done ON the phone, not in "the cloud"? Or is this now wrong?

I'm going under the assumption that Siri translates words to text/commands on the phone device. It then determines whether that command is "local" or "remote." If local, it does whatever it needs (create an alarm, add a calendar event). If remote, send it to the Siri servers for them to process.

In the case of apps, they'd all be local. The app could remotely access data required on it's own, not needing the Siri servers for that. So, just like the new notification preferences, Siri gets a preference that gives you a list of all commands, and for those commands you can select which application responds to it. Obviously there may be better ways to handle the interface, Apps may have their own preferences and you can tell the app to register it's commands. Regardless, there are better minds thinking of this stuff than my own.

So, in this particular scenario, there's no need to "phrase squat" or anything. The whole idea of this article seems ridiculous given how I interpret how Siri functions. Which again, could be wrong.

</comment></comment><comment><USER3> *"Why I think siri will never open to 3rd party devs"

</comment><comment><USER6> The only major issue I can see is that Apple favored apps will always take first pick.

If you want to say "Tweet blah blah", and use something that isn't the official Twitter client, you're probably shit out of luck. You'd have to say the app's name or something of the sort.

Another example is that Reminder will take precedence over any other third party todo app.

Otherwise I think there are ways around the whole 3rd party issue with a strict approval process and having developers somehow interpret their own text commands and provide some standard feedback about what Siri's response should be.

</comment><comment><USER7> Ok, but really, how do you know?</comment>


Open Sourcing Yelp's Data Pipeline: stream billions of messages a day - <AUTHOR> https://engineeringblog.yelp.com/2016/11/open-sourcing-yelps-data-pipeline.html <comment><AUTHOR> I'm on the team which put this together. Feel free to ask any questions, I will answer what I can!

<comment><USER2> Will Yelp ever address the plague of fake accounts?

<comment><AUTHOR> Fake accounts are against the Yelp's TOS [1]

[1] - [https://www.yelp.com/static?country=US&p=tos](https://www.yelp.com/static?country=US&p=tos)

</comment></comment></comment><comment><USER3> awesome !!</comment>


Why I told my friends to stop using WhatsApp and Telegram - <AUTHOR> https://medium.freecodecamp.com/why-i-asked-my-friends-to-stop-using-whatsapp-and-telegram-e93346b3c1f0#.skmm3v1fc <comment><USER2> Telegram is frequently updated, friendly to developers, and has a good track record of user experience.

The same cannot be said for many others in the market. Crypto is an interesting topic. Their demonstrated flexibility may allow for migration to more competent security. What they offer feels good enough for now, thought I am not a user of secret chats.

<comment><USER3> I agree. Out of all the messenger interfaces I've used, Telegram sucks the least. It's got the most features, which keep me around. The security isn't something I trust, but even as a non-secured messenger it beats all the rest just in terms of features, continuous updates, and native clients on many platforms.

</comment></comment><comment><USER4> Why I didn't:

\- Telegram stickers.

\- No Windows Phone support in either Signal or Wire (very relevant in my country, Uruguay).

\- Signal for desktop is a Chrome app, Wire for desktop is an Electron app; while Telegram desktop is a fast Qt app that doesn't require a Tesla battery for prolonged use nor requires a browser.

\- Network effects.

</comment><comment><USER5> Whether you believe it's real or not, it's interesting to note that the buzzfeed Trump dossier claims that FSB has broken Telegram.</comment>


JetBrains IDE Remote Code Execution and Local File Disclosure - <AUTHOR> http://blog.saynotolinux.com/blog/2016/08/15/jetbrains-ide-remote-code-execution-and-local-file-disclosure-vulnerability-analysis/ <comment><USER4> Wow. I'd like to quote the final section "Interactions with the vendor". It's been my experience as a user as well, of my very numerous bug reports - <USER2> because it's buggier than others but because I'm quick posting them - <USER3> have been solved within a very reasonable amount of time (I always provide a reproducible test case, which helps).

 _From here on it 's all a quote_:

"I'd like to specifically thank Hadi Hariri and the rest of the JetBrains team for their proactive response to my report. My email requesting a security contact was answered within an hour of my sending it, and the issue was resolved relatively quickly."

"They sent me a patchset against intellij-community and a binary build with their proposed solutions, and were receptive to my feedback when I mentioned potential issues."

"Lastly, even though Jetbrains doesn't have a bug bounty program that I'm aware of, and I definitely wasn't expecting anything, Jetbrains quite generously awarded a bounty of $50,000 for my report and help reviewing the patch. I've asked them to donate the bulk of this to the PyPy project to fund improved Python 3 support, fingers crossed for await/async support in PyPy :)."

<comment><USER5> Holy shit. I'm quite a cynical person, but this deserves the "restored my faith in humanity" trope. Mad respect for both JetBrains and the researcher. $50k is nothing to sneer at.

</comment></comment><comment><USER6> Kudos to JetBrains for awarding the very generous $50,000 bounty (and to the author for donating the bulk of it).

The YouCompleteMe project had a similar vulnerability[1]. I suppose a lesson here is that if your development environment/tools expose services over HTTP on localhost you should be really careful with CORS headers.

[1]: [https://github.com/Valloric/ycmd#is-hmac-auth-for- requestsre...](https://github.com/Valloric/ycmd#is-hmac-auth-for- requestsresponses-really-necessary)

<comment><USER7> No, that can not be at all the conclusion to make from this.

Security can not come from sending magic strings back and hoping whoever is facilitating the attack respects them.

<comment><USER6> I'm not sure if I follow this criticism. Having the server validate an HMAC of the request does not require the attacker to respect any magic strings. The attacker cannot craft a correctly authenticated request (since they do not know the shared secret used to construct the HMAC) and thus cannot issue requests that the server will honor.

<comment><USER7> I understood your comment to say they should do CORS properly, which amounts to just magic strings sent back to a potential attacker.

HMAC is separate from CORS, or did I miss something?

<comment><USER6> I think I'm confused myself. I was interpreting the main issue in the JetBrains case to be their use of very permissive CORS headers on the locally running server, but their solution added an auth token in addition to removing the CORS policies. ycmd also doesn't appear to set any CORS headers, in addition to validating the HMAC of the request.

Is a sane cross-origin policy not enough on its own to prevent evil.com from being able to communicate with a web server running on localhost? Or is the message authentication to protect from attack vectors other than the user navigating to a malicious site?

<comment><USER7> CORS seems like a nice-to-have. You're relying on other software to always indicate something is a cross origin request, browsers _should_ always do that but then there is a whole host of software that uses embedded web controls and the like and may navigate to webpages on the basis of external and not user input.

</comment></comment></comment></comment></comment></comment><comment><USER8> This is exactly why services that expose unnecessary network services drive me batty.

The extent of this vulnerability would have been significantly limited if it were only enabled for users using the feature (e.g., not Android Studio, PyCharm, or other users) and even more-so if it were enabled on-demand.

In recent memory, both CodeKit and Prepros _really_ want to have some live preview HTTP server enabled all the time. Simply enabling it when the user hit the "Open Live Preview" button in the app would significantly reduce the attack surface. As would giving users the option to enable/disable it at will.

<comment><USER9> FYI - WebStorm's features exist in PyCharm and you can count me as one user that finds them extremely useful.

I agree with the enabled on-demand comment however.

<comment><USER10> Enabling it on demand would also allow them to randomize the listening port and generate new authentication tokens more frequently.

</comment></comment></comment><comment><USER11> Little known fact: OS X has something quite similar to UNC paths, which can probably be used in the same way as an exploitation vector for this bug (and others). Specifically, there is an autofs mounted on /net which will try to mount an NFS share from any IP address if triggered by any process simply accessing a path starting with "/net/(host)/(sharename)".

Incidentally, I don't think this is accessible from an app sandbox, but I expect JetBrains' IDEs aren't sandboxed.

<comment><USER12> Interesting! I haven't spent much time looking at OS X internals, but I'll remember this for next time. Have any resources for other OS X quirks like this?

</comment></comment><comment><USER13> This was also present in Android Studio until version 2.1.1 - [http://tools.android.com/download/studio/builds/2-1-1](http://tools.android.com/download/studio/builds/2-1-1) (note: this is no longer the most recent version, so don't download from that page)

</comment><comment><USER14> >"No live PoC for the Windows or OS X RCEs 'cause I don't want to host public- facing SMB or NFS shares :)"

I wonder what the minimum amount of code / work would be to make a Samba-lite to do this kind of testing. I'm surprised it isn't in Metasploit already.

</comment><comment><USER15> This is why you need to isolate your applications. You never know what kind of services and other things are being exposed. Use subuser (subuser.org) or at least firejail. Simple isolation eliminates this type of security problem.

</comment><comment><USER16> When I played around with XMLHttpRequest to a locally running Jupyter server I got the following error:

No 'Access-Control-Allow-Origin' header is present on the requested resource.

It seems that should have prevented this exploit as well?

<comment><USER16> I did a test with packet capture just now and "Access-Control-Allow-Origin" does not prevent the request from being made, just preventing the JavaScript from getting the response back.

</comment></comment><comment><USER17> Three things standout to me that made this attack possible.

1\. JetBrains setting too broad CORS headers.

2\. JetBrains listening to 0.0.0.0 instead of only listening to localhost. Seems like YCMD is also listening to 0.0.0.0 instead of only localhost though.

3\. But the overlooked concern in my eyes is why web browsers support XMLHTTPRequests to localhost/127.0.0.1 at all. I can't imagine a valid use case for that outside of developers working against a local machine. Seems to me like XMLHTPPRequests to localhost should be rejected by browsers unless `--disable-web-security` or some other equivalent is used during startup.

<comment><USER18> _> I can't imagine a valid use case for that outside of developers working against a local machine_

it's very useful to talk to locally installed applications without having to write specific browser plugins for all browsers. Dropbox and Github are using it to detect the presence of their respective desktop apps.

And I'm personally using it (with restrictive CORS header, referrer signature checking and only listening on localhost) to read a barcode scanner and put the data into a web application. We only had to write one app per OS we support instead of one app per OS and one extension per browser (which also means that this works in all HTML5 compatible browsers, not just those we deem worthy of our support).

<comment><USER17> I should have been clearer about that, for extensions I agree that calling localhost is reasonable if you have a desktop app you want to talk to for example. My suggestion would be removing the capabilities of XMLHTTPRequests to localhost from websites wile retaining the possibility for extensions

</comment></comment></comment><comment><USER19> [https://www.eclipse.org/security/known.php](https://www.eclipse.org/security/known.php)

</comment><comment><USER20> This seems intentional from JetBrains to target unlicensed users/pirated copies.

<comment><USER21> Yeah, and Bush did 9/11 too...

</comment></comment><comment><USER22> A different experience: I'm working on an android project at the moment. I emailed JetBrains 10 days ago asking why the Intellij Ultimate IDE blocks the UI so generously. I characterized it as heavy handed and frequently unnecessary. I pointed out the workaround I use is to switch to a competing product during these moments. I suggested it diminishes developer productivity. I said that competing products have the same problem and solving it would be a big win for enterprise customers. I didn't get $50K (not expected) or even the courtesy of a response (expected).

<comment><USER23> A really bad security bug report is going to get a lot more attention than a feature request. Threatening them with "I will use a competitor" means loss of a single customer. Not quite the same as "my entire company was compromised and we lost millions of dollars due to a security bug"

<comment><USER22> It was written in a constructive way, not as a threat. For me, the competing product is vim. All I'm saying is, I think I deserved a response for trying to help them improve their product. Maybe that's too much to ask, idk.

<comment><USER24> > For me, the competing product is vim.

This sounds like a troll. I would expect that the guys at Jetbrains get screamed at quite often for their IDE's memory and CPU consumption (they even have a "low power" mode, which is quite telling). But on the other hand, users (I am in that group) of Jetbrains IDEs are there for the sheer awesomeness of their inspections and refactoring abilities. UI perfs notwithstanding, they have the best tools out there.

So you comparing their product to Vim shows how trollish (or really badly constructed) your argument is. You can't compare the two of them seriously, and I wouldn't be surprised if the Jetbrains team simply glanced at your email and classified it as "troll" or "don't bother with extremists".

<comment><USER4> The "low power" mode is for stopping running the many inspections on the code continuously while you are typing. That's hundreds of code checks and often an external code check tool as well (eslint in my case).

Obviously, running all those extra tools while typing uses quite a bit of extra power. It has nothing to do with "this IDE is fat" (it is, but that's a separate issue), but with the amount of features run continuously.

[http://stackoverflow.com/questions/11725605/what-is-power- sa...](http://stackoverflow.com/questions/11725605/what-is-power-save-mode-in- intellij-idea-and-other-jetbrains-ides)</comment></comment></comment></comment></comment>


The cover letter that won't go unnoticed - <AUTHOR> http://zackmdavis.net/blog/2013/12/cover-letter/

<comment><USER2> Why would I care about this cover letter? It wouldn't influence my view of the person in any way .....

I had a mobile app developer position ... a candidate sent me a TestFlight invite to an app they built that was a pseudo resume in app that fit the general context of our business .... was really neat.

THAT was topical, innovative, and got my attention AND DEMONSTRATED THE SKILLS I WOULD ULTIMATELY NEED THEM TO USE DAY-TO-DAY.

I fear we are telling people do these "creative" things when all they are going to do is waste time/effort and get bitter.

END $0.02

</comment><comment><USER3> The waffle cover letter: [http://www.general-forums.com/threads/job-hunting- heres-the-...](http://www.general-forums.com/threads/job-hunting-heres-the- waffle-cover-letter-to-help-you-out.18989/)

</comment><comment><USER4> And the cover letter that won't get you hired. At least not by HR drones.

</comment><comment><USER5> This is a cover letter that would more likely be caught by a spam filter than a resume filter.

</comment><comment><USER6> It would separate him from all the other resumes. I'd talk to him!

</comment><comment><USER7> lol, who would want to write jquery for a living?</comment>


US appeals court rejects business method patents - <AUTHOR> http://www.reuters.com/article/marketsNews/idINN3026126020081030?rpc=44

<comment><USER2> "[T]he Federal Circuit said the patent application in question -- a method for reducing the risk of sudden changes in energy costs -- was not a machine and did not result in a transformation." (FTA)

The article seems to say the method is not a machine, which doesn't make much sense. Business method patents are still allowable if the process "is tied to a particular machine or apparatus."

See here for more background: <http://www.patentlyo.com/patent/2008/10/in-re- bilski.html>

</comment><comment><USER3> This is just all around good.

<comment><USER4> I'd say the chances that SCOTUS will review this are pretty good, and I wonder whether it will hold. The idea that a method can't be a machine is pretty tenuous.

<comment><USER3> It's certainly worthy of their time.

</comment></comment></comment><comment><USER5> I remember hearing about "business method patents" a few years back when I was still working at Deloitte Consulting. They positioned it at this huge win and I didn't see how it was going to work. I'm really happy to see that it didn't.

</comment><comment><USER6> The Value of an idea is in its application.

Patenting a good idea prevents others from applying that idea to create value.

This is a good ruling for those of us who want to create value, not just sit around coming up with ideas.

</comment><comment><USER7> Interesting...</comment>


Show HN: Key/Value Store as-a-Service - <AUTHOR> http://keyvalue.xyz <comment><USER2> It looks like this has SSL configured and listening, but there is no certificate or private key loaded:

      [~] : openssl s_client -connect 22.214.171.124:443
      CONNECTED(00000003)
      140150585800568:error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error:s23_clnt.c:769:
      ---
      no peer certificate available
      ---
      No client certificate CA names sent
      ---
      SSL handshake has read 7 bytes and written 201 bytes
      ---
      New, (NONE), Cipher is (NONE)
      Secure Renegotiation IS NOT supported
      Compression: NONE
      Expansion: NONE
      No ALPN negotiated
      SSL-Session:
          Protocol  : TLSv1.2
          Cipher    : 0000
          Session-ID:
          Session-ID-ctx:
          Master-Key:
          Key-Arg   : None
          Krb5 Principal: None
          PSK identity: None
          PSK identity hint: None
          Start Time: 1486834426
          Timeout   : 300 (sec)
          Verify return code: 0 (ok)

<comment><AUTHOR> Yes, there were some problems due to certificates and they are updated for API server now. Thank you for your interest!

</comment></comment><comment><USER3> I'm not sure this solves a real problem developers have. I have never heard from anyone that storing key/values was a pain.

A wide range of popular key/value stores exist and are easy enough to manage. Cloud provider also offer cheap managed stores.

<comment><USER4> I never had the need to store key/value pairs, but I would definitely consider a similar service. Why not?

</comment></comment><comment><USER5> Typo in the terminal screenshot:

> > [http://api.keyvalue/xyz/c98ab8e0/myKey](http://api.keyvalue/xyz/c98ab8e0/myKey)

`api.keyvalue/xyz` vs. `api.keyvalue.xyz`

<comment><AUTHOR> Fixed, thanks!

</comment></comment><comment><USER6> >Do you need high available, flexible and dynamic key/value store for coordination, notification, feature flagging and more?

Doesn't exactly evoke confidence. Are they being explicit that the free tier won't have availability. Is there an SLA or even an estimate?

<comment><AUTHOR> Thank you for pointing this out! I have already updated the text for enterprise setup because that was not the intention.

SLA is in progress but the system is planned to be up & free with the current usage.

</comment></comment><comment><USER7> Where are the docs? SLA? Support for more complicated data? Support for WebSockets to alleviate TCP handshakes?

</comment><comment><USER8> Add SSL. With LetsEncrypt, it's table stakes.

<comment><USER9> If they don't know this much, what else don't they know? Not to mention they don't disclose anything about the team or company other than it is "Made with Love in Istanbul". No reason not to assume its a kid who has never hosted a production service in their life.

<comment><USER10> Exactly. Instead I would totally code up my own self hosted key/value store in a couple of hours than trusting this website.

</comment></comment></comment><comment><USER11> Since each new key request creates a uuid, wouldn't someone need to store that uuid in local key/value store in order to retrieve values from this k/v?

$ curl -X POST [http://api.keyvalue.xyz/new/key1](http://api.keyvalue.xyz/new/key1) [http://api.keyvalue.xyz/3b629f4d/key1](http://api.keyvalue.xyz/3b629f4d/key1)

$ curl -X POST [http://api.keyvalue.xyz/new/key2](http://api.keyvalue.xyz/new/key2) [http://api.keyvalue.xyz/3eea0e2c/key2](http://api.keyvalue.xyz/3eea0e2c/key2)

<comment><USER12> I guess their primary target isn't generating keys on the fly, but rather using already defined keys (set / get value). But I agree, it would make sense to have the ability for reusing an existing UUID.

</comment></comment><comment><USER13> Is this a joke or for real?

</comment><comment><USER14> I just ran a script to store about 20 keys/second and the counter is going up by 1-2 per second. Something is way off.

</comment><comment><USER15> I have a few questions:

\- how long will my data be stored for?

\- how big can a single key be?

\- how many requests can I make per hour/day?

</comment><comment><USER16> Also consider jsonbin, a "pastebin for JSON" service. The aim of the project is to provide a simplified data store for tinkerers.

[https://jsonbin.org/](https://jsonbin.org/)

<comment><USER17> Good site! Thank you.

</comment></comment><comment><USER18> It feels like this is a missed opportunity to use a content-addressable store. It would be super valuable to have the capability of hashing content and knowing when you don't need to re-download it.

</comment><comment><USER19> Is there a way to batch requests? I'd like to be able to get/set more than one value at a time. It'd also be nice to be able to get a list of all my keys just in case I forget.

</comment><comment><USER20> A web front end to memcache? I wrote one in Python 5 years ago. This is trivial stuff, although configuring your nginx proxy or whatever, takes some study. SSL can have 0 security if you do it wrong. I like the HIPAA advice from here [https://luxsci.com/blog/level-ssl-tls-required- hipaa.html](https://luxsci.com/blog/level-ssl-tls-required-hipaa.html)

</comment><comment><USER21> I think this shouldn't be used to store application or user data, but could be actually useful for less important data used by cron scripts and scheduled jobs for which you would otherwise use a small local database or text files.

</comment><comment><USER22> Any advantage over firebase?

</comment><comment><USER23> Didn't a similar service just shut down recently due to lack of profitability?

</comment><comment><USER24> So this is basically CouchDB?

<comment><USER24> But without TLS?

<comment><USER25> My thought too :-P could be a redis though with a rest API

</comment></comment></comment><comment><USER26> supports CORS?</comment>


What Is PIVX? The only privacy focused cryptocurrency using Proof of Stake - <AUTHOR> https://www.bitcoinbeginner.com/blog/what-is-pivx/ <comment><USER2> The one thing they need to fix is to make the privacy the standard function - like Monero.

There is a delineation between PIV and Z-PIV which shouldn't really be a "mode" of holding or transferring.</comment>


NSA denies my FOIA request - <AUTHOR> http://blog.erratasec.com/2013/07/nsa-denies-my-foia-request.html

<comment><USER2> And FISA court just rubber stamped the continuance of the phone records collection.

NSA will not be stopped, not without a bitter fight. I don't even think they will be stopped if Congress passes a law restricting this. They will just find another way around it.

The only way this whole thing will be stopped is by defunding the agency and shutting it down as if it'll happen.

Best recourse is to disrupt NSA's collecting by using technology against them. I do have hope and faith it'll happen eventually.

<comment><USER3> The fallacy is thinking the NSA is the problem, rather than the states ability to severely limit their legally liability for acting unconstitutionally thanks to the concept of "state secrets".

</comment></comment><comment><USER4> I heard a commentator on TV a little bit ago describe the US as the world's greatest democracy. I felt like crying.</comment>


'RuneScape' Can't Escape 2007 - <AUTHOR> http://digg.com/2016/old-school-runescape-history <comment><USER3> Botting was actually much more fun the playing the real game.

Back in the golden days, the bot frameworks rsbot/powerbot/rsbuddy gave you a Java API into the game. Your script gets called every game loop (by the API) and you can tell your character to walk to places, click on things, pathfind your way around the game world. The API could access your player's levels and experience and gave your script (a Java class) an onPaint event to draw a GUI.

Botters were spending their time learning Java, on the forums were people talking about more in depth programming concepts and ways to improve code quality. The bot frameworks were open source (with the exception of "modscripts" \- a series of regexes and what not to remap the bot APIs back into functions in the obfuscated Jagex client).

Jagex has also implemented turing tests - "random events" where your character get teleported a special area and has to perform a challenge. The bot framework has scripts to handle this as well and was generally not a huge issue.

The best part was that it was all real, if your code misbehaves, people will report you and you will get banned. If your code works flawlessly, it will run for days and you'll get rave reviews from fellow botters on the forums.

If anything it was a great environment to develop CS skills. And of course after you botted up your stats and unlocked new abilities the game becomes even more fun.

<comment><USER4> Semi-related I suppose, I'm building a game where botting is the whole point: [http://armoredbits.com/](http://armoredbits.com/)

<comment><USER5> I saw this yesterday but only now I realise it's (probably) about programming your mechs to fight.

I think you need some better presentation. I'm reading the main page again but I still don't have a good idea of how the whole thing is supposed to work. The FAQ is a bit more clear.

Anyway, if I got it right, it sounds interesting. I'll be keeping an eye out. Good luck.

<comment><USER4> Thanks for the feedback. I've been having trouble trying to convey exactly what it is in a clear an concise manner. I'll go through and give it another update.

</comment></comment></comment></comment><comment><USER6> Everyone who played MMOs talks with utmost fondness of their unforgettable time in their first MMO. Be it Everquest, Ultima Online, Runescape or WoW, it seems no other genre in video gaming elicits such fondness, or reaches immersion levels so deep as the MMORPG. The immense potential in having a virtual, persistent world inhabited by tens of thousands, hundreds of thousands or even millions of people, with the virtually inexhaustible possibilities of gameplay that arise from people inhabiting a shared, persistent world, make the MMORPG the king in this department: immersion and fan dedication.

Yet it seems that this doesn't happen anymore, that the cosy world of Ultima Online or Runescape 2006ish doesn't exist anymore. MMORPGs have found it more profitable to engage in a variety of design choices that, ultimately, destroyed what MMOs were about. The open endedness of Ultima Online, the thoughtfulness and deep worldbuilding of quests in Everquest, the charming aesthetics that left just the right amount to imagination, just like a book, of Runescape, all that was replaced by high action, cheap thrills, and a lot of shiny particle effects everywhere (and of course microtransactions, because why not). The charming, cosy, vast, deep world people remember from Vanilla WoW doesn't exist anymore. Now you got a conveyor belt to level cap and cheap end-game content.

For anyone interested, this is one of the most insightful videos I've seen lately, and it addresses this issue: [https://www.youtube.com/watch?v=nvK8fua6O64](https://www.youtube.com/watch?v=nvK8fua6O64)

<comment><USER7> I think your first point might be a much more important one than the one argued in the video you link. The first MMORPG experience is about as much fun as you can reasonably have in a video game but a great deal of the fun comes from it being first: the lack of familiarity, the unexpected, the 'emergent gameplay', the interactions with everyone from befuddled strangers to helpful friends.

Once WoW got everyone who was ever likely to try an MMORPG to actually try one, MMORPGs reached 'peak players'. There is (statistically) no-one left for whom any MMORPG is a first one and no amount of 'sandbox' or anything else can change that.

<comment> Altay- While nothing will compare to the 'first time', the bewilderment need not diminish to zero.

Ultima Online was my first and still favorite MMORPG back in the late 1990s/early 2000s but when I tried EverQuest for the first, the 3D world and depth of races/characters/NPCs blew me away.

Then I tried Dark Age of Camelot. The 1-world-but-3-continents/factions concept amazed me. There was always 'the others' and a sense of citizenship with the group of players I could actually interact with. Everyone in UO/EQ was a potential rival/friend. In DAOC I knew where my loyalty lied and the enemy was always clear.

Then I played Ragnarok Online -- my first Korean MMORPG. Again, blown away for totally different reasons. The music, the colors, the sprites, and GIRLS!! Lots of girls played Ragnarok. I didn't meet any girls on UO/EQ/DAOC -- 95% boys, 5% house wives.

Next up was Star Wars Galaxies. No more 'levels', back to skills ala Ultima Online but in a totally different and more complicated way! 3D persistent housing! Crafting! Dancing at the local cantina as a totally legit profession! Multiple PLANETS!! OMG!

Then came World of Warcraft -- nothing I hadn't seen before this time. But it was presented in the most streamlined manner and was the first MAINSTREAM MMORPG. Everyone my age was playing. I felt like the grizzled veteran of the genre/ I knew the mechanics. I taught my friends how to tank. How to heal. How to lead a raid, etc. Again, amazing for totally different reasons.

Sad to say, I haven't felt anything new since WoW. But I honestly don't think its because the genre is played out. Its just we haven't been shown anything different. That might change this year with plenty of promising games in the pipeline -- Shards Online, Albion Online, Camelot Unchained, etc.

If you still think the genre has hope, check out my ~1yr old website, [http://mmos.com](http://mmos.com) I hope to see you on my next adventure.

<comment><USER8> Hey Omer?

I used to watch your channel (previously MMOHut) a few years back. This was my favorite ;-)

<comment> Altay- This is his brother Erhan, but I'll pass on the kind words! Omer is back making first looks on the new MMOS.com YouTube Channel, check it out!

</comment></comment></comment></comment></comment><comment><USER9> The irony that this article, about how RuneScape is an anachronism of the mid 2000's, is hosted on digg.com is not lost on me.

<comment><USER10> Digg isn't much older than Reddit. (Nov 2004 / June 2005)

<comment><USER11> How much different is this version of digg from the original? I have only browse'd through this iteration of the website.

Being 21 years old this article hit quite a point of nostalgia remembering the days of summertime '04-07 RuneScape.

<comment><USER12> See for yourself:

[https://web.archive.org/web/*/Digg.com](https://web.archive.org/web/*/Digg.com)

</comment></comment></comment></comment><comment><USER13> RuneScape was a giant reason I got into programming and has a special place in my heart.

I was about 13 years old at the time. I recall reverse engineering the client, modifying existing Java private servers and interacting with a range of hackers that have taught me lessons that I still remember until this day. The race to see who could reverse engineer the client and implement a feature the fastest was amazingly exciting.

I remember the day I was messaging someone to send me the packets for spells in the game. They sent me the packet id, how to supply x,y,z coordinates for the opposite player, and I was suddenly shooting fireballs in my private server. Amazing!

I'm now working at a game development company and teaching at a local college (I did not finish high school.) and I'm thankful for the entire RuneScape botting and private server community

<comment><USER14> Exactly the same for me. This is how I got interested in programming. The fun part is that many of the people I met on the runescape private server forums 10 years ago I still talk to daily. Complaining about college and our day jobs in IRC. We all have the same history and all sort of ended up in the same place.

Big chance that I still know you as well if I know your old nickname. Especially the programmer community was pretty cozy.

</comment></comment><comment><USER15> It's a problem of economic inflation. The games start out easy at release, but developers see the need to tighten their belts to prevent game currency/abilities/skill from being worthless. So the template has been in MMO land for developers to let a few early adopters climb the ladder to the top until they patch the ladder away. Or the opposite, like WoW, just keep it easy and let everyone into the top.

Runescape has a good place to see this with holiday items: [http://runescape.wikia.com/wiki/Holiday_rewards](http://runescape.wikia.com/wiki/Holiday_rewards)

The right way to solve this problem is to keep the game as easy as it was at release, but to implement economic atrophy and redistribution of outcomes. I'm not aware of any game that does this other than Eve Online. I do not play these games but I like thinking about their economics.

<comment><USER16> And boy does Eve bring the redistribution of outcome-hammer down hard.

The incredible effort of groups to build up military strength as well as economic factories that also require skills to be able to do any of those things makes sure you never think Eve is too easy, but also not too hard. Thats why I quit. I learned from Runescape how horrible a well made game can be to your productivity and sanity. Better to obsess over algorithms and programming than MMORPGs

</comment></comment><comment><USER17> A similar phenomenon is happening with Everquest.

The current owners of the franchise are pushing "progression" servers - servers that start with only the original game and move on from there. Though their numbers are hidden, most of the interest in the game as it is now seems to be in these kinds of servers.

These legacy servers come about - runescape included - because owners recognize the success of emulators that try to recall the original game whatever that may be. All the popular MMOs have these emulator servers - <USER2> of warcraft, star wars galaxies, etc. Some have very large populations.

The question I have is whether it's all nostalgia or did MMO game designers collectively lose something as they tried to modernize?

<comment><USER18> Yeah I played recently on the new EQ phinny launch. I loved EQ back in 99-2004.

I would always reminisce about how EQ was the best game. I have so many fond memories.

Needless to say, playing again kinda sucked. It wasn't fun. It was a grind. Life is different.

Nostalgia is sweeter in the end.

P.s loved classic SWG too.

<comment><USER19> Yeah, I loved Everquest. But it was a different time. I was in college, had no job, had no wife, had no kid, and had no social life. I had the time to spend most of my waking hours in the game.

Edit: actually, it sort of was my social life. I played with a group of friends I met online that I had been playing video games with for 4 or so years.

</comment></comment></comment><comment><USER20> I was there at the launch of RS 2 @ 2004 then making the first bots and scripts' APIs in rsbot.org @ 2006. I learned to code and chose the CS career thanks to RS. Great times.

<comment><USER21> The first bots were based on the "autominer" shareware, if you could get your hands on it. That was in 2002 or so. It was a simple macro based bot system. It was before they made anything to stop people from doing that (beside occasional baning). At first they added a "sleeping" mode to the game where played had to sleep after too much work and there was a CAPTCHA to wake up. It worked, but played hated that as it made some things hopelessly long to do and gave massive advantage to players who had done them before the sleeping concept was introduced. It actually had the interesting effect of shifting the in-game economy from the normal "gold coins" to a bond like system that handled inflation much better. At the end of RS1, most transactions were done in coal and lobster (really!) certificates, worth about 1500 and 1200 cold coins each.

I lost too much time to this game (mostly RSC / RuneScape1) and liked it very much. I have fond memories of it, but as time passed it changed and I quited. The clans and forums were quite lively. I never (and will never, ever) played another MMORPG, but still, nice memories. I dropped my party hat long ago (only RS player can get that one) ;)

</comment></comment><comment><USER22> I lost too much time to the original RuneScape. Liked its depth of skills, community, and access from anyone's browser. Quit playing after my account was deleted during release of new game. I was like, "what a waste of a lot of time..." Briefly played WoW to realize it, like many, were endless variations of the same basic stuff. So, quit that genre in general.

I'd have actually used the bots I made if I knew that my account would be deleted anyway. Get adamantite everything with max spells and stockpiled lobsters haha.

EDIT: Also forgot to mention that the situation in this article is pretty retarded and maybe I didn't miss anything. I did meet a friend who was one of original to game the trading market and ponzi'd others gaming the market. Eventually got bored then started learning game for women. Smart, devious kid haha.

</comment><comment><USER23> When I was 16/17 years old I was clearing 500/1000 a week goldfarming for this game. Failed AP Calculus and stunted my social life.. and the money didn't last long.. but it sparked an interest in software engineering and entrepreneurship that continues to this day.

The margins for large scale botting operations on this game were absolutely ludicrous if you knew what you were doing. Gold coins were going for $5/million and a good bot could churn in about 7.2 million/day. The bot clients were a pretty un-optimized pile of java and could eat up about half a gig of ram each, but once you hit any sort of scale the vps's became a drop in the hat to the amount you were raking in.

That hardest part was actually managing the cash flow. Gold was usually sold through paypal transactions and charge backs were egregiously common. Paypal would basically tell you to go fuck yourself because they were "virtual transactions" regardless of how much evidence was provided. I had a partner from New Zealand (now working in finance) who would negotiate bulk rates, as well as purchase accounts in order to optimize our workflow.

Every now and then I look back and imagine how much I vould've made if I knew then what I knew now regarding scaling, coding, business, etc. I knew kids buying hundred thousand dollar sports cars with the money they earned. _Sigh_ to be young again..

</comment><comment><USER24> I'm not sure why, but I loved the mining/crafting part of RuneScape. It was so repetitive, I guess part of me really likes those numbers going up. I've never really found a game with a similar crafting system, although Minecraft comes close - any ideas?

</comment><comment><USER25> Selling rune scimi 30k

<comment><USER26> @ran@ lol nub

</comment></comment><comment><USER27> wc lvls?</comment>