Hackers Hijacked Asus Software Updates to Install Backdoors - <AUTHOR> https://motherboard.vice.com/en_us/article/pan9wn/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers <comment><USER2> Does anyone know of any company being found liable for negligence after a hack like this? Is it somehow possible to sue them for being so bad at security?

I have an asus laptop that I use for gaming, most likely it had their cruft running at some point. What would be the most viable path to sue?

It is so frustrating and frightening to take security seriously yourself, to have taken precautions, to find out that your idiotic manufacturer has screwed it up in an idiotic way.

Their update system should never have been designed in a way to make this possible. The negligence it in the design of the system.

<comment><USER3> > The negligence it in the design of the system.

Not sure. It seems like a fairly generic update approach. eg a central server(s) provides available updates, with client software on the PC checking for them.

As a concept, that's what MS and Apple's update approaches (for consumers) do too.

It's just ASUS are extremely incompetent with anything software related, not just security.

Hopefully this, plus the previous fine for their incompetence, gets their leadership to change things in a positive way.

<comment><USER4> > It's just ASUS are extremely incompetent with anything software related, not > just security.

Hardware companies are extremely incompetent at anything software related, we see this in everything from PC's and phones (touchwizz, htc sense) right down to TV's and various IoT devices. I can't imagine what the PC industry would like like if luck hadn't delivered us an open platform.

<comment><USER5> yes, free software and open-source did wonders and I am so thankful for all the devs who made it possible, thank you!

On the other hand, there is a growing number of insecure and closed IoT garbage devices. It will be common to see a wifi attack coming from a breached water kettle.

</comment></comment></comment></comment><comment><USER6> Interesting hack, but not really a surprise that attackers are continuing to look at supply chain's to get into targets that might otherwise be quite hardened.

From what I've seen of PC laptops, in many cases (especially with companies that don't usually have large corps as customers) they don't provide the option for corporates to enforce downloads of firmware/utilities from a company controlled source, so they'll come from the vendor's central location.

So Asus' risk profile isn't going to include good defences against high- end/state-level attackers, so it's a nice vector for one of that class of attacker to get into companies who are customers of Asus'.

It would _seem_ like the attacker must have had some foreknowledge of what systems they wanted to target (i.e. that their target used Asus laptops) but that's not impossible to achieve.

<comment><USER7> This reminds me of the Runaway Evidence episode from the Ghost in the shell series. An employee with access to the codebase for a military weapons manufacturer manipulates it for their personal reasons

<comment><USER8> Indeed, this scenario is so ubiquitous that it will certainly continue happening as far into the future as there are human beings, for whatever definition of "human being" you can come up with. One of the first things I learned in the military was that many _many_ things -- which are so shocking as to be almost unbelievable -- never see the light of day and become news stories. It happens so often that I would be willing to bet a hundred United States dollars that your local police department has some not-insignificant percentage of employees (think five or ten percent) that _regularly_ use their patrol car computers for personal reasons, or quasi-personal reasons. I've met more than one police officer personally who genuinely saw nothing wrong with it. They think that it's harmless, or worse, that they're justified in doing so because their intentions are good.

</comment></comment></comment><comment><USER9> > Buried in those malicious samples were hard-coded MD5 hash values that > turned out to be unique MAC addresses for network adapter cards.

Having access to those MAC address (or their MD5 hashes) could be interesting. I would like to verify if my MAC was among those target to do deep inpection in my whole infrastructure. I'm not sure Kapersky was able to determine all those 600 MAC addresses to contact specific companies.

<comment><USER10> It's a MD5 hash according to the article. I wonder how long it would take to hash 281,474,976,710,656 MAC addresses into MD5? Well wouldn't have to do all those, find the vendor id's for ASUS and "just" hash those.

EDIT: Looks like Kaspersky have published tools to check if your MAC was one of those targeted - [https://securelist.com/operation- shadowhammer/89992/](https://securelist.com/operation-shadowhammer/89992/) don't think they have published the whole list. Just a checker app and a webform to check. The checker app _may_ contain the whole list.

Looks like they there updating the list of MACs over time (rules out my initial thought of them targeting an purchase order to get hand full of people who would of gotten machines from that order) as it seems that Kaspersky pulled the list of MACs from about 200 samples.

<comment><USER11> It would take a few seconds (at most) to brute force all of them.

The vendor IDs in a laptop/desktop would be a limited set (Realtek, Intel, Atheros, Broadcom are the big names off the top of my head), each company has a few vendor IDs but still it's a small search space. Here are my notes from the calculation:

48 bits / 6 bytes per MAC

Vendor ID is 6 hex digits = 3 bytes / 24 bits

[https://www.brandonfoltz.com/2014/09/how-fast-is- md5/](https://www.brandonfoltz.com/2014/09/how-fast-is-md5/) 2014/09: Core 2 Duo e6550 @ 3 GHz does 427 MB/s with one process, DDR2-800 RAM

Modern cpu: 4.5 ghz @ 8 cores * 1.25x IPC and RAM improvement (RAM has come a long way since DDR2, but in the article he was CPU bound so that's probably still the bottleneck)

= 427 * (4.5/3.0) * 8 * 1.25 = 6.4 GB/s

24 bits of actual MAC left per vendor = 16,777,216 MACs/vendor

16.8 million * 3 bytes = 50.4 million bytes per vendor

6.4 GB / 50.4 MB = almost 1300 vendor prefixes per second

The website listed above provides MD5 hash rate in MB/s (on a CPU, too). A few other sources I found provided hash rates in hashes/sec instead, such as this StackExchange saying that 1.3 billion SHA-1 hashes/sec are possible on a old GPU. SHA-1 is more complex than MD5, and GPUs are still following Moore's law very well, so it would be trivial to brute force this.

[https://security.stackexchange.com/a/8609](https://security.stackexchange.com/a/8609)

Source for vendor IDs: [https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd...](https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd3e4)

<comment><USER12> A Nvidia GTX 1080 can do about 20-25 GH/s of MD5. This makes the whole searchspace even without taking the vendor prefixes into account, quite brute forceable. Here is a benchmark of hashcat that gives some insights into the speed of the different hashing algorithms.

[https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...](https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40)

A recently released tool also allows you to do all this on AWS for quite cheap without any big investment in hardware. [https://github.com/Coalfire- Research/npk](https://github.com/Coalfire-Research/npk)

</comment></comment></comment></comment><comment><USER13> Some dude who works in an office in Maryland or Georgia is reading this and thinking "yup, that's us".

The details here scream "state actor".

<comment><USER14> Or Hawaii or Texas

<comment><USER15> I don't get it. China Israel n Korea Iran Russia uk France are not shy violets in aggressive hacking. There is also a bunch of up and comers in India and Saudi that are flexing

</comment></comment></comment><comment><USER16> > Motherboard's reporting said the backdoor was scanning for some 600 MAC > addresses, matching what TechCrunch has learned, and was likely targeted to > infect only a small number of victims rather than cause infections on a > large scale.

It would be interesting to know what companies/orgs those mac addresses belong to. This sounds very targeted against something specific.

</comment><comment><USER17> Only 600 were targeted. Stupid question, but is there a scenarios where this isnt a state actor? Who would throw away already infected machines.

<comment><USER18> I find the precision sort of comforting. One danger of the growth of state- actor malware is that a lot of us could be collateral damage caught in the crossfire. This sort of precise targeting seems at least reasonably responsible. Stuxnet also had careful target selection.

<comment><USER17> >Stuxnet also had careful target selection.

The NSA also had stuff like eternalblue lying around instead of getting it patched, the polar opposite being responsible. I doubt that there is such a thing as responsible hacking by state actors. They know of and are actively exploiting weaknesses that are a danger to all of us.

<comment><USER18> Yeah, and also NSA has forever compromised part of their mission; to secure US infrastructure. No American company will trust their "help" any more since they've spent so much time subverting our own security.

<comment><USER19> This talk is all well and good between us here on Hackernews but I don't think your Joe Plumber really cares that these things are going on behind the curtains enough to vote about them, protest, or write his congressman. Look at the "uproar" Snowden caused - it just pushed these activities further under ground within US cyber intelligence.

</comment></comment></comment></comment></comment><comment><USER20> Why would they only be interested in 600 MACs as oppose to the numerous others? This is casting a rather large net. Wouldn't this imply the attacker had knowledge before this hardware was shipped? (why only 600 MAC!?)

<comment><USER21> Perhaps rolling out the full attack gradually, to see if it flies under the radar. The knowledge required might be simply a modulo of the mac.

<comment><USER22> Why not do it deterministically then? 600 hashes of MAC addresses suggests that it's a very targeted group of machines, it's the size of a moderately large company, for example.

</comment></comment></comment><comment><USER23> "Asus has not informed customers of the vulnerability after it was discovered earlier this year."

This is typical of Asus, isn't it? After that Windows update last year or so broke their ROG motherboard software and it wasn't fixed for over a month, you'd think they would have learned by now.

</comment><comment><USER24> According to the article, "The researchers estimate half a million Windows machines received the malicious backdoor through the ASUS update server." I use an Asus computer, but I use GNU/Linux and almost never boot into Windows. Am I affected by the malware? How can I check?

<comment><USER3> > I use an Asus computer, but I use GNU/Linux and almost never boot into > Windows.

It probably depends on whether your computer came with windows pre-installed (not good), or you've ever installed the ASUS provided "ASUS Update" utility software for Windows.

It's a specific download, that you'd need to manually install.

AFAIK, most (tech) people consider it bloatware, so don't.

If your computer came with windows pre-installed though... uh oh.

</comment></comment><comment><USER21> > the attack, which Kaspersky Lab has dubbed ShadowHammer

I see we're already hitting a deficit of new names for vulnerabilities.

<comment><USER25> We need some sort of security vulnerability name generator.

A google search later and of course it already exists, hahaha:

[https://paulbellamy.com/vulnerability-name- generator/](https://paulbellamy.com/vulnerability-name-generator/)

<comment><USER21> Not sure if I should call dibs on "iLoveCRIME".

<comment><USER26> Better than PoodleLeak.

</comment></comment></comment></comment><comment><USER27> It's probably easy to frame this as closed source versus open source, but honestly this _can_ happen to anyone and I think we have numerous examples of Linux distributions also having their core servers compromised leading to similar risks in distributing malicious software.

That said I'd rather be running an operating system with reproducible builds based on open source software. I suspect problems like this would have been more quickly discovered, before hundreds and thousands of users were affected.

<comment><USER25> I also prefer the open source concept, but I always have--in the back of my mind--the case of Azer Koçulu:

[https://qz.com/646467/how-one-programmer-broke-the- internet-...](https://qz.com/646467/how-one-programmer-broke-the-internet-by- deleting-a-tiny-piece-of-code/)

I recognize that it's a leap to go from deleting a repository to converting it toward malicious intent (although sometimes it's likely not as big of a leap as we think), but as open source continues to build libraries on top of other libraries we do open ourselves to the risk that one of those innocuous libraries, at some point in the future, could end up causing issues.

The other problem is that open source users often expect that the "crowd" will discover and identify issues fairly quickly because everyone is looking for them. But not everyone __is __looking for them. I can probably count on two hands the number of times I 've gone through the source code of the libraries that I use, and I suspect most others are in a similar position. We all expect some bored soul in the world is doing the looking, but the truth is that they'll only start looking if something breaks.

<comment><USER28> I've noticed how obvious security problems get "discovered" over the years, when people already knew about them. What happens is, someone new finds the bug and makes a big stink about it being exploited. Everyone realizes the bug is a huge problem and then, one by one, every software project with that bug incorporates a fix or mediation. What should have never existed soon becomes another in a line of "standard fixes" that every system afterwards has to account for.

There are things that (in retrospect) should be a standard part of all open source supply chains. Basic code vuln scanning, code signing+verifying, reproducible builds, redundant copies of code, and licenses permitting keeping code around to prevent breaking other code. But they're not standard - _yet_. So one by one, we have to run into these problems and break things before they're addressed and later become de-facto standards.

I've noticed that this mirrors real life. In real life you can notice that an intersection is dangerous and needs a stop sign. But until a schoolbus full of children is plowed into, nobody lifts a finger. It's the same in technology. You can't just mention the big potential problem; you have to wait for the explosion.

I spent months trying to get websites on the internet to mention that the default options they suggest for _ssh-keygen_ are fundamentally insecure and dangerous, and while all of them acknowledge this is a fact, _most of them won 't update their guides_. Not until someone creates a virus that finds and exposes vulnerable ssh key passwords around the world. Then all of a sudden whatever implicit bias they had against doing the work will disappear, as fear of impending consequences takes over.

<comment><USER29> _> I've noticed that this mirrors real life._

This is because taking additional or remedial actions is _work_. That work has to be justified against a hierarchy of needs. Until that justification is credible enough, work will be allocated elsewhere.

</comment></comment></comment></comment><comment><USER30> Does anyone know where to get and verify a known good version if Asus's software, or identify and clean a system of backdoored software? I ask as an owner of an Asus motherboard.

<comment><USER10> Depends on what the other payload did. The infected updates checked your MAC and if it matches a list of targets downloaded and executed the 2nd payload. The payload from ASUS itself seems to be pretty tame asking as you were not one of the target machines...

Check you MAC here [https://securelist.com/operation- shadowhammer/89992/](https://securelist.com/operation-shadowhammer/89992/) (which also contains infor about some of the payloads, apparently there was over 200 samples found by Kaspersky). If you dont match you "should" be fine. But who know where the "update" was installed to to purge it from the system. A full wipe may be in order (or wait a short while and allow the various AV engines get hold of the signatures of the first stage malware and allow them to scan your machine).

If you were on the target list then who knows what the secondary payload contained... Though as it was just a small number of MAC's targeted and if you were targeted the device maybe more valuable to you and others untouched so it can be analysed then the cost of a replacement and trying to figure out why you were targeted.

As for where to get known good software. ASUS used to have an ftp site with all their stuff on it, dunno if they still do. This attack seems to be targeting the live update method so downloads from the support page for your model are probably fine... But it would be on ASUS to come clean and report on what and when got infected to be sure. They have revoked the certs used to sign the updates, you could check any downloads from ASUS to see if the cert matches just in case MS has yet to push the irrevocation to everyone or just stick with the stock drivers from MS until everything is sorted out.

<comment><USER31> Where are you reading that they've revoked the certs? I've not seen anything that says indicates they've done so.

<comment><USER10> Sorry, I was sure I read somewhere that ASUS themselves had requested the cert to be revoked but I can't find that site I read that from now to cite other than "ASUS are no longer using that cert" with Kaspersky are saying.

ASUS are using a new code signing cert though, but it is dated from earlier today so maybe it was "ASUS are due to revoke the cert".

</comment></comment></comment></comment><comment><USER32> I have an ASUS laptop but fortunately the first thing I did was to replace Windows with Fedora.

</comment><comment><USER33> The behavior they describe reminds me of Stuxnet: only certain machines seem to be executing a specific payload.

</comment><comment><USER34> I don't understand why one would allow untrusted IPs to upload software to be spread like this.

Putting new updates on such a system should be part of a process with many checks on the way to verify the authenticity of the software?

<comment><USER35> Well, the certs were legit. So I guess yeah, in hindsight only allowing certain IPs to be associated with a cert or something would be cool, but damn if I know how to do that on a Windows machine.

<comment><USER34> No I mean on Asus' side.

Like you should have a very specific procedure to put files on the server not let a random computer on the internet do it without an approval process.

<comment><USER36> The update service inside ASUS was broken, so it doesn't matter what ASUS intended or implemented; the attackers would have just changed that. The second stage installer was totally owned by the attacker. Perhaps interesting to note: this is a situation where a blockchain could have been helpful.

<comment><USER34> Yeah I understand that, but how is it possible for a company to put such a service on the network so that it _can_ be breached, that was really my question.

It shouldn't have the place where you put the update files exposed to the internet at all. Unless it was an inside job somehow.

The way it's described it almost sounds like the service exposed to the internet had write access to the files.

<comment><USER3> > The way it's described it almost sounds like the service exposed to the > internet had write access to the files.

A service exposed to the internet gets to decide what it sends to end users. Compromise that, it can replace the stuff sent on the fly.

Not saying that's what happened here, just pointing out that not having "write access to the files" isn't a guaranteed win either.

Depending on what else the attackers had access to (executables key signing pieces?), likely determines the approaches they took.

</comment></comment></comment></comment></comment></comment><comment><USER37> Few interesting bits that are buried at the very end of the article and many might have missed it:

> _They said they found similarities between the ASUS attack and ones > previously conducted by a group dubbed ShadowPad by Kaspersky. ShadowPad > targeted a Korean company that makes enterprise software for administering > servers; the same group was also linked to the CCleaner attack. Although > millions of machines were infected with the malicious CCleaner software > update, only a subset of these got targeted with a second stage backdoor, > similar to the ASUS victims. Notably, ASUS systems themselves were on the > targeted CCleaner list._

> _The Kaspersky researchers believe the ShadowHammer attackers were behind > the ShadowPad and CCleaner attacks and obtained access to the ASUS servers > through the latter attack._

> _"ASUS was one of the primary targets of the CCleaner attack," Raiu said. > "One of the possibilities we are taking into account is that's how they > intially got into the ASUS network and then later through persistence they > managed to leverage the access … to launch the ASUS attack."_

These attackers have planned this for a very long time. CCleaner was just collateral damage in NSA's quest to infiltrate high-value OEM targets. The NSA probably also got HDD firmware source code and certificates through a similar "shotgun" approach.

I also found this part interesting (from [0]):

> _Although precise attribution is not available at the moment, certain > evidence we have collected allows us to link this attack to the ShadowPad > incident from 2017. The actor behind the ShadowPad incident has been > publicly identified by Microsoft in court documents as BARIUM. BARIUM is an > APT actor known to be using the Winnti backdoor. Recently, our colleagues > from ESET wrote about another supply chain attack in which BARIUM was also > involved, that we believe is connected to this case as well._

Which leads to a copy of the lawsuit filed by Microsoft against BARIUM actors [1].

I wonder what the status of this lawsuit is when the defendants are probably the NSA employees. Even Microsoft gives lots of hints about BARIUM being the NSA. They even filed it in Eastern District of Virginia, Alexandria Division, Federal Court... which is one of the favorite places where intelligence agencies file criminal complaints. I bet the US Gov will stonewall and ask the MS to drop it.

[0] [https://securelist.com/operation- shadowhammer/89992/](https://securelist.com/operation-shadowhammer/89992/)

[1] [https://www.courthousenews.com/wp- content/uploads/2017/11/ba...](https://www.courthousenews.com/wp- content/uploads/2017/11/barium.pdf)

</comment><comment><USER38> Can someone please tell me how I can find out if I'm infected and how to remove it?

</comment><comment><USER39> Will they be banned just like Huawei?

<comment><USER40> Looks more like the work of the San Antonio CIA hackers, not Chinese. So most likely not. But the Chinese might try to ban it then. First the Russians will analyze the targets and then you know who did it.

</comment></comment><comment><USER41> A very good reason to shut down any automatic update software, moreover on a commercial OS.

The whole "signing infrastructure" thing stops working when the amount of parties involved exceeds n=2.

When you have 10+ parties involved, the chance of missignage gets very real. Even if the signing is done on a "black box" as per best practice, it offers no protection if signing decision is made by a party with blind trust in incoming packages as happens in a big company setting.

<comment><USER42> > A very good reason to shut down any automatic update software, moreover on a > commercial OS.

This is dangerous and irresponsible general advice. 99.9999…something percent of users will be better off getting updates on a schedule more recent than "never". Following your advice would simply mean that millions of people get rooted because they postponed the updates for things which were known threats in the wild.

The very small percentage of high-value targets are the ones who can consider this because they also have defense budgets measured in the millions and can afford to do things like inspecting updates and aggressively monitoring for changes in network activity, etc.

What it does tell you is that there is a cost to using software from companies with lax security practice such as ASUS:

> Kamluk said ASUS continued to use one of the compromised certificates to > sign its own files for at least a month after Kaspersky notified the company > of the problem, though it has since stopped. But Kamluk said ASUS has still > not invalidated the two compromised certificates, which means the attackers > or anyone else with access to the un-expired certificate could still sign > malicious files with it, and machines would view those files as legitimate > ASUS files.

That's a good cue to suggest that if you're security conscious you want to pick vendors who share that value.

<comment><USER41> The one logic that is dangerous here is that of blind faith in signing ecosystem.

MITM on windows update with forged certificate few years ago was just few minutes away from being a global emergency for Windows users. The only thing that kept it contained was that attackers did not figure out to hijack routing to real windows update servers.

For 99% of users using windows update, that would've been an instant virus install - so much for security.

The only security measures that are worth implementing are, obviously, the ones which work.

<comment><USER42> > The only security measures that are worth implementing are, obviously, the > ones which work.

Which is why I don't think the right answer is taking steps which ensure users won't install security updates. The scenario you mentioned is better addressed by other means — CA pinning, certificate transparency — and, unsurprisingly, those are the measures being implemented on a wide scale.</comment></comment></comment></comment>


Ethereum: Rise of the World Computer - <AUTHOR> http://www.svds.com/ethereum-the-rise-of-the-world-computer/#.Vs3MJboMMl0.facebook <comment><USER4> Crypto has come a long way since Ethereum was first conceived and what was impossible only a few months ago is now 100% practical. Today there are A LOT of new techniques that allow us to largely implement decentralized autonomous applications on any blockchain (no matter how limited) - a fact I feel often gets missed out in all of the Ethereum hype.

If you have a lot a techniques like zero-knowledge proofs, homomorphic computations, multi-party computation, indistinishability (sic) obfuscation (not quite practical yet), and various threshold schemes - you will quickly realize we could basically already do everything that Ethereum was designed for from the start. In fact - a lot of the new crypto techniques make it possible to scale DAC applications even better than what blockchains would allow since you can implement a lot of crypto-application protocols outside of the blockchain and keep only the hash-locked payments on the chain (which I honestly think is preferable.)

It just seems to me like Vitalik largely invented Ethereum because he didn't want to bother messing around with all the crypto-hacking that's required to implement self-enforcing, autonomous contracts (which is half the fun.) My biggest problem with this is people act like this isn't possible with Bitcoin when we had working smart contracts (and special coins for smart contracts) before Ethereum even existed. Interestingly enough - there's even ways to make the answer to any computable problem the keys to unlock a Bitcoin payment which means if you structure your crypto-protocol right you can essentially implement any self-paying, and self-running corporation as a never-ending complex chain of future problems.

(I would speculate that it's even possible to build a universal turning machine on top of any bitcoin-style blockchain that can compute any problem off-chain and allow these computations to be proven and self-enforcing but that is a topic for future research.)

<comment><USER5> There were tons of techniques to preserve home-made foods - canning, vacuum drying, salt curing, fermentation, etc. - and then someone invented the fridge. What is widely adopted?

As an average developer, I can launch a smart contract with 20 lines of code in Ethereum. I have no idea in earth how to even start writing those things on classic blockchains, let alone prove they work as I expect.

<comment><USER6> > I can launch a smart contract with 20 lines of code in Ethereum.

Meanwhile, everyone is waiting for the first smart contract that is actually useful for something.

<comment><USER7> Never heard about Arcade City[0]?

0\. [https://arcade.city/](https://arcade.city/)

</comment></comment></comment></comment><comment><USER8> Previous discussion [https://news.ycombinator.com/item?id=9987142](https://news.ycombinator.com/item?id=9987142)

Give me any ethereum use-case & I'll tell you how to do it with bitcoin.

Is it advantageous if a DSL is turing complete? It is not that bitcoin 'cannot have' a turing complete script but that it is unsafe & there is no need to do so. Turing completeness can be applied on an upper abstraction.

There is nothing that ethereum can do that bitcoin cannot! The proof of it is RootStock which is ethereum implementation using bitcoin.

Ethereum is full of buzzwords and the key one of them is DApps. Here [0] is how to build a dapp using bitcoin. Basically you can tell me any application of ethereum and I'll tell you how you can do it with bitcoin. Skynet type input requiring applications can't be done inherently by either ether or bitcoin but can be done by both using third-party oracles.

Then are bitcoin & ethereum equivalent. No, they key is origin of money. Bitcoin is mined, ether was sold.

The recent rise in price has attracted all kinds of attention but talk to any of the core-devs and they'll tell you that Vitalik used to come up with complicated explanations which they spent time studying and responding & then he'd come back with something even more complicated until they stopped caring.

[0] [http://startupboy.com/2014/03/09/the-bitcoin-model-for- crowd...](http://startupboy.com/2014/03/09/the-bitcoin-model-for- crowdfunding/)

<comment><USER9> > Give me any ethereum use-case & I'll tell you how to do it with bitcoin.

Is this your opinion because you truly believe it or because you have a horse in the bitcoin race? I'm not saying that Ethereum is superior to bitcoin but at least from a brief look over it, it seems to make quite a bit of sense. Whereas my experience with bitcoin is that it's an incredibly hacky and questionable system that primarily survives because of the collective investment into it, not on its technical merit.

<comment><USER10> Yep ethereum has been out for what 6 months and look at all of development on top of it already. BTC has tons of VC money and I see nothing interesting beyond a few regulated exchanges.

But oh ya we are all suppose to believe BTC can do all of this but apparently nobody really knows how. It's really just a bunch of people that think BTC is special because it was first, but it lost it's first mover advantage.

[https://www.reddit.com/r/ethtrader/comments/43fm3w/the_core_...](https://www.reddit.com/r/ethtrader/comments/43fm3w/the_core_value_proposition_of_ethereum_is_synergy/)

[http://dapps.ethercasts.com/](http://dapps.ethercasts.com/)

<comment><USER8> Please give me an ethereum use case & I'll try to tell you how you can do it with bitcoin.

I have previously answered a few use cases here [[https://news.ycombinator.com/item?id=10846788](https://news.ycombinator.com/item?id=10846788)]

<comment><USER11> Last week I built an dapp called 'GameOfTrolls', it is an attempt recreate the /r/GameOfTrolls subreddit which was banned by reddit. The idea was to make a game out of trolling people(as in just lying and making up stories).

I did it in one week, it uses Oraclize.it (which I believe is also available for bitcoin, so that's nice), and I am sure it can be built on bitcoin too, but the biggest problem remains this:

* While doing development in Solidity, and using HTML/CSS/JS for client, I am able to rapidly build a dapp.

* Writing the code in a higher level programming language created for the purpose of blockchain apps, allow me to think at a higher level abstraction.

* Training people to write in Solidity is far easier than training them to write in C/C++.

* Faster and rapid dapp development(RDD) will unlease a new age in blockchain innovation, and if you have been in tech for a while, you know that 'crack up boom' of innovation we see when Rapid application development became possible.

Case in point, Augur. Paul Sztorc has been doing development of Truthcoin for far longer than Augur people and even has funding from Roger Ver, but Augur has managed to rally a lot more people around it by delivering working prototype sooner than later, and now they're already in Beta, targetting 2016 election.

Look, I love bitcoin and I was one of the earliest adopters of bitcoin (2009 Dec era). But I have been a software developer for far longer than that, and I can tell you, bitcoin's code is not made to make the things we desire to make now.

BTW, here is an argument against Ethereum. Any app built on it, will be inherently slow because of the price they'll pay for building it in a higher level abstraction platform. This means, that Augur will eventually hit performance wall, at which point, every successful Ethereum app will have to be developed in C/C++ and natively to get more performance.

<comment><USER12> Generally agree, app development is great. Regarding your last point, apps in Ethereum run on Ethereum's specialized VM. Every opcode has its own transaction fee. There's no way to write an Ethereum app in C++.

<comment><USER11> "by Ethereum app in c++" I mean writing that logic in C++, of course it won't run on Ethereum network anymore after that point.

<comment><USER12> Ah makes sense, sorry for my confusion.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> The article is pretty light on technical details. Does Ethereum suffer from the same design limitation as Bitcoin, where every operation must be verified by every node? If so, I have a really hard time believing it will scale. Look how much difficulty the Bitcoin network is having with just a couple of transactions per second.

<comment><USER14> One key difference with Bitcoin is that, unlike Bitcoin, Ethereum has an account based architecture. In other words, you have an account that is credited or debited, and you then have a current balance for that account. If you need to get your balance or send ether, you just look up a single number.

Bitcoin on the other hand uses an "Unspent Transaction Output" architecture. Basically your balance is made up of all of the credits and debits (inputs and outputs) you've made with that account. So sending bitcoins requires referencing "unspent outputs".. which may be lots and lots of different transactions.

That's one difference, and there are others, such as the time taken to confirm blocks (current block time on ethereum is 16s). But there are still lots of scalability issues to be addressed, which are actively being worked on.

Vitalik Buterin has a great couple of posts on some of the issues:

[https://blog.ethereum.org/2014/09/17/scalability- part-1-buil...](https://blog.ethereum.org/2014/09/17/scalability- part-1-building-top/)

edit: Not sure why this was getting downvoted. Just to clarify, in case it seemed like I wasn't answering the parent. The points above are one of the ways in which "every operation must be verified by every node" is less costly on Ethereum. Obviously if it takes less compute time per transaction, you can scale to larger numbers of transactions per second. Ethereum has already passed Bitcoin in this regard, and has hit at least 8 transactions per seconds at one point, while Bitcoin's ceiling is 7 transactions per second. In addition, prior to launch I believe they managed to push the test network up to 25 transactions per second.

<comment><USER15> But Ethereum's raison d'etre is "X for the blockchain".

VISA does 56,000 tps.

So it's really simple. How are you going to hit 56,000 tps on the blockchain. The Bitcoin community, which is far bigger and generally more experienced than Ethereum's just spent 18 months vigorously debating this question. Do you suggest Ethereum has come up with a better answer?

And the criticism here is around the selling point of Ethereum: "everything goes on the blockchain". You're telling me after 18 months of debate, the best you've got to say about that is: "an account based architecture"?

What is it about widgets fully encapsulated in a blockchain-native smart contract on Ethereum that makes it so much more scaleable than a similar widget on Bitcoin's blockchain?

<comment><USER16> "VISA does 56,000 tps."

That's what I keep telling them. The whole of credit processing and banking... even the Fed... runs on centralized, transactional architectures with redundant datacenters and optionally redundant checks from mutually- distrusting parties. What people want to do can be built on a highly- efficient, log-based system with distributed checking run by a foundation (or international collaboration) in a neutral country. It would be simpler, more secure, use less energy, faster, and so on. Additionally, we can choose what level of detail we want in reporting or auditing to reduce data overload.

These blockchain models want everything to go on a blockchain whose operational hurdles even they can't agree on. It's like this subfield of IT is ignoring simple solutions to simple problems while pushing complex solutions with complex problems.

So, I add to your own question: what is it about a smart contract on Bitcoin or Ethereum that couldn't be done with a signed email or website document optionally run through a few cryptographic notaries? The latter is not only simpler and more efficient: it's in use commercially with many courts already approving of concepts and some implementations.

<comment><USER15> Ironically, the only people who have made money on smart contracts - <USER2> Ethereum - did it by convincing other investors to part with their money subsequent to selling those investors on the idea of smart contracts. That whole sub-niche industry is just a big cess pool of people chasing investment gains that we're told can be had by pointlessly tilting at windmills.

Conversely, Bitcoin never promised smart contracts. To the extent Bitcoiners take part in Ethereum debates, we're only doing it because we know the real game Ethereum is playing is diverting investment capital away from Bitcoin.

<comment><USER17> > diverting investment capital away from Bitcoin

Even if that were true, that would necessarily be a bad thing in the interests of not putting all your eggs in one basket.

<comment><USER16> I take it you meant to word that as "wouldn't necessarily be a bad thing." As in, diversion would be good to avoid monoculture risks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> The way i think about Ethereum is that it's a cloud computing platform upon which the whole world can see which program the server is running. The usefulness of this is that if you want to run a computing service that administers something of great value to others (such as a vote-counting service or a property registry), other people might be suspicious that you will use your administrative access to the server to corrupt the system. With Ethereum, the service provider doesn't have any admin access (and neither do the people upon whose hardware the program is ultimately running on); the cloud computer just runs the program you upload, and everyone can see what program that is.

In addition, it runs your service robustly, and preserves the entire history of the computation forever. The downside is that these transparency and robustness features make the service a lot more expensive than ordinary cloud computing, as well as more difficult to program on.

It doesn't really have much to do with Bitcoin or currency (except that (a) like Bitcoin, Ethereum uses blockchain technology to achieve these things; but that's an implementation detail (b) a Bitcoin clone is one of the many things you could build as an Ethereum application (c) for technical reasons you buy Ethereum server time via purchasing server-time-credits called "Ether").

As a project, Ethereum is very technically ambitious (they are not just working on a cloud computing platform, but also trying to advance blockchain technology in general, eg developing a new proof-of-stake algorithm, and eg developing a way to not have to replicate computations on every node on the network). They are trying to do a lot of new things at once, which is risky (but awesome).

</comment><comment><USER19> This thing needs a use case that gets used. Try putting fantasy football betting on Ethereum. You need an oracle or oracles to get game results into the system, but those can use a voting scheme to prevent payouts based on phony results. Of course, it has to be packaged up as an app usable by the typical football fan.

Possible YC startup.

<comment><USER6> If you can create user-friendly app for betting and it is legal, why would you use blockchain for that instead of just using traditional way? I would bet my ass off that the end-users (gamblers) don't give a crap whether it is on blockchain or not, they just want it to be easy, quick and possibly cheap. And of course trustable. And by latter I don't mean "mathematical proof" trustable, they want brand that they know to trust.

<comment><USER10> > they want brand that they know to trust.

like fulltilt or leehman brothers!

<comment><USER6> You have to take in account that for every failed banks there is something like 20 banks that have worked good enough. For full tilt, there has been many gambling services that haven't failed yet.

When using banking services, you have a risk of a bank run. How big that risk is? How much work are you willing to do, or how much money are you willing to spend to migitate that risk?

</comment></comment></comment></comment><comment><USER20> I get spammed daily on Reddit from bots supporting Ethereum (currency) - <USER3> the name causes hatred for me already.

<comment><USER21> Side note: Ethereum is the technology, ether is the currency.

</comment></comment><comment><USER22> Have built a demo app with Ethereum in November. The tooling was ok, but not amazing.

IMO one of the main problems is that you need trusted inputs for most "interesting" or "valuable" computations.

<comment><USER23> Developing on the platform right now is akin to writing software to run on a VM that has no operating system. The services that are being written right now can be thought of as the operating system (foundation) that everything that will come next is built on. To do the really interesting stuff you have to first build all of the really low level tooling to support it.

There's a lot of talk about replacing Uber/AirBnB/Facebook/etc with decentralized applications but I believe those things are still at least a few years away. Complex applications like those are going to require significant base infrastructure that just doesn't exist yet.

The "Trusted" inputs problem is complex and I don't believe there will be a single solution. Some applications will be fine using trusted oracles. Others will need a more trustless model which is going to require on-chain reputation systems which in-turn is going to require some level of identity/anti-sybil system.

<comment><USER6> > There's a lot of talk about replacing Uber/AirBnB/Facebook/etc with > decentralized applications but I believe those things are still at least a > few years away.

At least a few years? LOL. I would give it 20 years.

</comment></comment></comment><comment><USER24> i see a browser plugin/app like "Cloud to Butt"[0]

that detects phrases like "I would bet my ass off" or "I bet you that" or "I wager" and converts them to a prediction market link - creating the market if it doesn't exist or just linking to it if it does.

[0][https://chrome.google.com/webstore/detail/cloud-to-butt- plus...](https://chrome.google.com/webstore/detail/cloud-to-butt- plus/apmlngnhgbnjpajelfkmabhkfapgnoai?hl=en)

</comment><comment><USER25> I've said it before and I'll say it again: the missing piece for the crypto- anarchist spiritual lineage of fintech to take off is a business-level transaction protocol (and associated open source server) that is generic enough to embrace all of the different settlement mechanisms and transaction types out there, as well as incorporating an adequately comprehensible means of markup for risk models. Not "send <amount_of_bitcoin_portions> to <bitcoin address>", but rather "invoice X for service Y settle by datetime Z, available modes of settlement ABC, after which service Y (or good G) will be rendered. policies for various types of transaction failures are DEF. proposing node's risk model: R.".

The idea is not to supplant Bitcoin/Ethereum but in fact to give them more market share by enabling them to be considered on a properly equal, pragmatic basis with conventional financial services or assets. This would encourage their selection (automatically or otherwise) versus some defined risk model (temporal, legal, etc.), over conventional financial services or assets.

Things that come for free or almost for free when you adopt dynamic financial routing include settlement path redundancy, multi-path settlement, RFQs/bids, multi-hop routing, financial system reliability, etc. Something like real world aware IPv4, for money. I've already suggested an endpoint identification scheme - [https://sites.google.com/a/ifex-project.org/wiki/our- proposa...](https://sites.google.com/a/ifex-project.org/wiki/our- proposals/iiban) \- which is the native account identifier at Kraken.

If anyone would be keen to work in this direction, I started [https://sites.google.com/a/ifex-project.org/wiki/our- proposa...](https://sites.google.com/a/ifex-project.org/wiki/our- proposals/ifex) years ago, but had to give it up due to competing concerns.

I'm ready to jump in again but don't want to go solo.

</comment><comment><USER26> Is there a "Hello World" version of a DAC?

What is the simplest contract I can make? And do I need a 3rd party oracle to confirm anything?

<comment><USER27> It would look something like:

contract Hello { string greeting; function setName(string name) { greeting="Hello "+name; } }

The solidity compiler will automatically produce a "getter" function to retrieve the greeting.

<comment><USER28> It will only be exposed automatically if you mark it public, i.e., 'string public greeting'

</comment></comment></comment><comment><USER29> I'm no expert in bitcoin or other decentralized blockchain technologies, or in the theory of computation for that matter, but I have a nagging question:

When they claim that the Ethereum network would function as a global, decentralized "world computer", then what should I assume to be the hardware architecture running its instruction set or, in other words, what is the basic, atomic unit of computation that the network (or other blockchain technologies) can perform. If we think of regular computers, then no matter in which language an application ( i dislike the word 'app' :) is written in, eventually we end up talking about the x86 instruction set, the microcode that makes up each instruction, and, finally, the actual transistors logic that run them.

I somehow feel this is important to ask because we have to take into account the energy efficiency of computation. For example, if we think about the x86 ADD instruction, there is an approximately fixed amount of energy it dissipates when it is performed. ( This is a pretty interesting subject in intself: [https://en.wikipedia.org/wiki/Landauer%27s_principle](https://en.wikipedia.org/wiki/Landauer%27s_principle) )

What would be an equivalent ADD instruction or other basic unit of computation on the Ethereum computer and how expensive would it be? If it involves one or several distributed blockchain operations, then it seems to me that this model would be neither energy efficient, nor performant, especially if we take into account the _distributed_ factor, which means that such an operation would be very costly since getting one bit of information from one end to the other requires an arbitrary number of routers along its path, and those consume energy to operate.

So I guess what I'm trying to ask is if this is practical in any useful way.

<comment><USER30> Check-out the Ethereum Virtual Machine instruction set by reviewing Gavin's Yellow Paper. It start on page 22:

[http://gavwood.com/Paper.pdf](http://gavwood.com/Paper.pdf)

<comment><USER29> Thanks for the link, I'll take a look

</comment></comment></comment><comment><USER31> What are the costs like for building resource intensive apps on ethereum? Would be interested in comparing with centralized compute providers.

<comment><USER32> A lot more expensive. There will be no comparison in cost, or at least that is the wrong comparison to be making.

<comment><USER31> I'm not sure if I'm reading ethereum right, but it sounds a lot like mesh computing, where a user can bid for unused cycles on a bunch of networked computers, or one "world computer" if you agree with the author's characterization.

If that is correct, then ethereum and Amazon spot instances could be interchangeable - low availability, but potentially lower cost due to the bidding process if there is a lot of excess compute power on the network.

<comment><USER21> Sorry, thats not correct. The only person who gets compensated for performing computations are the miners. Everyone else performs computation so they can have an up-to-date blockchain, but are not compensated.

Ethereum is the most expensive computational environment you can imagine. However, it is also the highest trust. Its not for computationally-limited (gaming/data analysis) its for trust-limited (financial applications/privacy)

There is an effort to build a computation market on top of Ethereum, but the computation happens off the chain.

[https://github.com/pipermerriam/ethereum-computation- market](https://github.com/pipermerriam/ethereum-computation-market)

<comment><USER31> For some reason I thought Ethereum was different than a flavored blockchain, but I guess it's just the branding/dev ecosystem that is different.

</comment></comment></comment></comment></comment><comment><USER33> I wonder to what extent is the price rise a bubble, and to what extent it's valuation of the potential.

<comment><USER34> It was a pump'n'dump. Lots and lots of people on the Reddit bitcoin-related subs reported PM spam about Ethereum, for instance.

<comment><USER35> Pump and dump the way you phrased it, seems to auggest the entire thing is a pump and dump scheme.

Either way, the price fluctuates woldly as people try to do this scheme, but the company raised $15m and appears to be actively developing the tech. So whether it works(it appears promising) or not, they seem to be svidly trying

<comment><USER34> I'm speaking specifically of the price rise then fall in the last couple of weeks.

The fundraiser, of course, was a pre-mined altcoin.

<comment><USER35> Interesting take. To summarize, you believe that speculators manipulate markets and prices decouple from value because self interested parties force it to communicate information incorrectly?

Also, you point out that the announcement of the intention to premine ether ended up leading to the Ethereum project implementing a plan to premine ether and sell it at a known and predetermined rate?

Riveting conclusion, surprised more people aren't talking about this.

I for one don't buy into the "conspiracy theory" that our society is built on debt, and monetary and fiscal policy have been managed poorly such that capital can not be incentivized to loan. Instead, rates will penalize banks for _not_ lending, as economists try to force staples like food and oil up to introduce inflation into the system as they have lost control on spending as well as flooring rate levels thus losing both measures to fix the problem.

If that were true, it would be bad.

 _All above was obvious satire_

</comment></comment></comment></comment></comment><comment><USER36> One issue with Ethereum is that smart contracts are expensive and must run on every node. These days a VPS with 2GB RAM costs $4 so Ethereum would not be competitive even in short term.

Another issue is the blockchain size which is already 8GB and growing faster than the Bitcoin blockchain.

<comment><USER27> Ethereum smart contracts have abilities far beyond a VPS, particularly around security, reliability, and trustlessness guarantees- Whether you think those abilities have value and justify a new platform is a separate question, but the argument that "this is like a VPS" is a misunderstanding of what ethereum is offering with its technology.

The large blockchain size, on the other hand, is a legitimate problem with ethereum (as with all blockchain systems.) Hopefully the devs will be able to solve this problem- They are hard at work on a potential solution as we speak.

<comment><USER36> Ethereum has been out for 7 months already and so far there have been no useful or popular dapps. This would mean that for most applications trustlessness is not very useful. And for those apps where it would be generally useful, such as exchanges, betting. etc, the expensive nature of gas would mean that operating on Ethereum would be cost prohibitive and they would lose to their centralized competitors. And how is Ethereum is more secure than a properly setup VPS?

<comment><USER27> > Ethereum has been out for 7 months already and so far there have been no > useful or popular dapps.

I think that's a valid criticism- I, too, am a bit disappointed that there are few contracts yet with obvious utility.

However, as someone deep in the community and talking to lots of people, it seems there's going to be tons of interesting dapps deployed in the next 6 months. Hopefully there will be a "killer dapp" among them.

> And how is Ethereum is more secure than a properly setup VPS?

If I store money on your VPS-based app, how can I be assured you can't steal it from me? If I use a feature on your VPS, how can I be sure you won't disable it tomorrow? Ethereum can provide these sorts of guarantees.

</comment></comment></comment></comment><comment><USER37> Need somebody to shed lights on this: my understanding is Ethereum started with pre-farmed ethers and opened for sale in bitcoins.

My two questions:

1) Any info on how many ethers the founders/founding company had farmed and holding in vault?

2) If Ethereum takes off (financially), and these early members start to dump the ethers for cash, will it crash the Ethereum economy?

Bitcoin could have exactly the same issue, but I feel the difference is most people then wasn't sure if crypto currency would fly, and it is fair to reward on the risk for those who trusted and held bitcoins.

Ethereum sounds like a more refined and polished business endeavour, and I feel it gets too much hype lately.

</comment><comment><USER38> I've dabbled with the dev tools ethereum provided for a while and I can't imagine that the computations ethereum does will ever be fast enough for a general purpose, distributed computation platform. If I had to wager on yet another cryptocurrency™ I'd bet on Zcash ([https://github.com/zcash/zcash](https://github.com/zcash/zcash)). They promise a real differentiator for cryptocurrencies with their zero-knowledge proofs.

<comment><USER23> Have you read up on the proposals and information on plans for Proof-of-Stake (Casper) and Scaling/Concurrency via sharding? Both of those are directed at fixing the "fast enough" problem.

</comment></comment><comment><USER6> "The Ethereum network is a distributed economy like Bitcoin, except it is much, much more powerful. The essential difference is that Ethereum is programmable. In fact, it only takes a few minutes to program a whole new currency like Bitcoin."

AFAIK it takes 5 minutes to fork Bitcoin and create a new altcoin. Why would I use ethereum for my altcoin instead of doing a new altcoin?

<comment><USER39> They don't mean fork ethereum and create a new currency. They mean create a new currency running on the ethereum platform. A bitcoin fork means you have to build up a group of miners sufficiently large and diverse enough that everyone trusts it. Making a currency on ethereum means it inherits the trust that ethereum has.

Here is the tutorial about creating your own coin on ethereum. It's pretty short and interesting: [https://www.ethereum.org/token](https://www.ethereum.org/token)

People like to think of ether as another cryptocurrency like bitcoin but the ethereum currency is intended to be more like a commodity that is used to fuel the platform that runs all sorts of stuff (including currencies).

<comment><USER6> I know what they mean.

> A bitcoin fork means you have to build up a group of miners sufficiently > large and diverse enough that everyone trusts it.

Of course, you need miners. However the mining is the easy part, otherwise you need marketing, use cases, etc, for the currency to get any traction. I think an altcoin working on top of the ethereum blockchain would not be as convincing as invidual altcoin.

However of course if we are speaking about some other kind of asset, it might make sense to do it on ethereum.

> Making a currency on ethereum means it inherits the trust that ethereum has.

No. Maybe mining security or something, but trust? Why would anyone use these crappy in-ethereum tokens, when you can just use ether itself. Or bitcoin.

You can make tokens as well inside bitcoin via colored coins and similar methods. They haven't gained much traction, I doubt that they will inside ethereum.

<comment><USER40> Tokens created on Ethereum can have very niche use cases. Digix has tokens that are pegged to a gram of gold sitting in a warehouse. Augur uses tokens to track user reputation. Free My Vunk uses tokens as currency to buy and sell items in video games.

The developers can focus entirely on their business use case for the currency (and the marketing) without the need to create an entirely new cryptocurrency.

</comment></comment></comment></comment><comment><USER41> I'm still not getting this. Let's say I have a node server that can serve up some sort of front end application. How would something like that run on etherium? Are a number of computers in the network going to get a copy of my source code copied onto them so they can 'distribute' it effectively? That doesn't seem very practical to me.

<comment><USER27> > That doesn't seem very practical to me.

Ethereum has the highest uptime of any computing platform ever developed. It's probably something like 99.99999% uptime (assuming a 0.00001% yearly chance that the earth is destroyed in a given year from a giant asteroid impact)

What would be a "practical" way of getting the same results with your node server?

</comment></comment><comment><USER42> Has it been six months since the last Ethereum post already?

Is Ethereum still "engendering positive disruption"? I see they've updated their site to make it more approachable and read less like proecdurally- generated Venture Capitalist jargon. That's nice.

I see they've added a javascript environment. Yuck.

<comment><USER43> They had the javascript environment for awhile now.

</comment></comment><comment><USER44> Awesome Ethereum [https://github.com/btomashvili/awesome- ethereum](https://github.com/btomashvili/awesome-ethereum)

</comment><comment><USER45> We need something like Ethereum or Bitcoin but built on a common platform such as web assembly which is an AST supporting multiple programming languages, with semantic versioning and an npm-like registry. This way it can evolve easily.

<comment><USER46> We're only one transpiler away from that.

</comment></comment><comment><USER47> Does Ethereum provide any solution to the [ever growing Blckchain]([https://blockchain.info/charts/blocks- size](https://blockchain.info/charts/blocks-size)) ?

<comment><USER39> Yes. See Vitalik's post from last year about State Tree Pruning:

[https://blog.ethereum.org/2015/06/26/state-tree- pruning/](https://blog.ethereum.org/2015/06/26/state-tree-pruning/)

</comment></comment><comment><USER48> I built a PoC for a social benefits platform on this a while ago. It was not ideal; mostly tasks that needed to be guaranteed to run at certain times was a pain. Because of several of those issues the project was cancelled.

<comment><USER46> Were you using Ethereum Alarm Clock? If you were then I'd be curious to hear about issues with it and if not then taking a second shot at your PoC could be worthwhile.

</comment></comment><comment><USER49> I still don't understand how anyone can believe that paying ten to a hundred times as much for algorithmically provable trust or whatever will get any market traction ever.

<comment><USER50> There are many services in this world which require a trusted intermediary between users. The fees these services charge are _not_ a function of compute cycles. They are, however, often a function of pricing power derived from competition (or lack thereof). Where decentralized computation is less expensive than the fees charged by incumbents in the trusted intermediary business, there is the opportunity for a new entrant to leverage the tech to profit on the spread.

</comment></comment><comment><USER51> Actually, you can turn it off in every way that counts as long as you turn off the Internet, which is entirely possible.

</comment><comment> rodrigo-mx Let's everybody use our home electricity so that big companies save big money managing their big data!

</comment><comment><USER52> So this thing is live yet? I thought they were having problems with the algorithms and so on.

<comment><USER21> Its technically in the "frontier" stage, which means that its in "beta" of sorts. There are lots of developers working on Ethereum dapps and it is more than useable, however consumers should be aware there may be loss-causing bugs around.

</comment></comment><comment><USER53> Heated my apartment two winters ago with litecoin and dogecoin mining.

Too late for ether.

</comment><comment><USER54> What happened overnight ? Why am I seeing so much ethereum this morning ?

<comment><USER21> I often notice HN topics come in groups. I think its because people read about a topic, get interested, do some research, and then start submitting articles they find.

</comment></comment><comment><USER6> Are there examples of in/use DAPPS?

<comment><USER55> Augur, a decentralized prediction market, is the biggest anticipated release on the horizon.

</comment></comment><comment><USER56> Unfortunately, I'm trying to obtain a small amount of ethereum currency to experiment with this..

And I just killed my thread doing 1M hashes a sec, because I found out that 6MHash/sec = 5 Eth/month on average.

I'll spend my time learning other things, mainly because this is inaccessible to me.

<comment><USER57> You can buy the Ether on an exchange.

<comment><USER56> I was hoping for a roughly low barrier of entry, rather than try to figure out who will trade USB for ETH, as I have no BTC.

In all honesty, I'm looking at distributed applications as well, which from what I read Ethereum says it does and doesn't do. It's a bit fast and loose from what I read about, about Ethereum's capabilities.

I'll go back to my experimenting with TOR and how it might be possible to make your own distributed applications within the Hidden Services. That's free to use, and as low bar as I can think of. (Add machine, shows up as HS.)

<comment><USER14> As other posters have mentioned, you can download the Mist client and test things on the testnet.

And you don't have to mine, you can get free testnet ethereum via the wei faucet:

[https://zerogox.com/ethereum/wei_faucet](https://zerogox.com/ethereum/wei_faucet)

Gas prices to run code on ethereum are fractions of ethereum, so even a small amount will get you pretty far.</comment></comment></comment></comment>


GIMP doesn't rotate correctly - <AUTHOR> http://graphicdesign.stackexchange.com/questions/28172/why-doesnt-gimp-rotate-correctly

<comment><USER2> I suggest you file a bug at Gimp's bug tracker for an official answer. [http://www.gimp.org/bugs/howtos/bugzilla.html](http://www.gimp.org/bugs/howtos/bugzilla.html)

</comment><comment><USER3> Gimp abstracts differrent frames of animated gifs as layers. You may like it or not, (as well as the inability to link layers) but not call it "incorrect".

<comment><USER4> I think he's talking about how the image before he commits to the rotation is vastly different from the image after he commits to the rotation - not that the arrows are doubled.

<comment><AUTHOR> Yes, evan_ is correct.

<comment><USER4> fwiw Photoshop also has this behavior, it's maybe not as drastic though.</comment></comment></comment></comment>


Ask HN: Anyone ever use Fiverr for SEO?  - <AUTHOR>

Hi, I am considering using some of the fiverr jobs on offer to give my website a bit of a traffic boost. Anyone have any experience doing this? Any particular jobs better than others? <comment><USER2> There's a saying that the farmer's footsteps are the best fertilizer.

I've never seen a third party linkbuilding service, based on humans, that was worth 1/3 of what they charged for it.

I'm not against semi-automated services that can get you into 200 directories for $5; even the best sites have large numbers of trashy links.

If you want a real traffic boost you need to build top quality links. This is tough.

Let's say you've got 1000 visitors a day. A site like that can make enough money on AdSense that you get a monthly check, enough to pay the server bills, but it won't cover your car payment. You want more.

According to quantcast, that puts you at roughly the top 100,000 of all web sites. If we guess there are 20 million web sites, that puts you in an elite club of the top 0.5%

Let's imagine that Google is still using PageRank. If you look at the theory behind it, PageRank simulates a web surfer making a random walk. So the PageRank of a site ought to be proportional to the traffic it gets.

If you're at the 1-in-100,000 level, you get very little PageRank from sites that are at the 1-in-1,000,000 level. To really move up, you need to get links from sites that are bigger than you -- but these are just 0.5% of the sites! It doesnt hurt to get links from small-fry sites, but the bulk of your effort needs to go to recruiting powerful allies.

For every site I've successfully SEOed, I've

(1) written at least one really good sales letter to persuade people to make links to this site

(2) worked harder at promoting the site than I worked at making it (and I'm a VERY technical guy)

(3) had keywords in the domain name

At this point I wouldn't even start a project without (3). Some sites suck so much that you just can't do (1). Most people won't work hard enough to do (2) and that's why it's possible to win.

<comment><AUTHOR> Paul,thank you very much for getting back to me with the above.Some very good advice which has got the creative juices flowing.

I thought google had down graded the importance of keywords in the domain name? This was meant to combat people registering exact match domains to rank for specific terms.

<comment><USER2> All I can say is do a few queries and look at the SERPS and come to your own conclusion about the keywords.

Bing and Google will nuke a content-free site with good keywords, but if you make a good site with clear quality indicators the keywords definitely give you a tail wind.

<comment><AUTHOR> Okay that makes sense,thanks Paul.

</comment></comment></comment></comment><comment><USER3> Just a quick insight. I work with someone who runs a small online business selling health products over the web. He swears by ffiver for SEO in addition to more well known techniques. One way he found to legitimize his business was to buy Facebook likes, Youtube subscribers, and Twitter followers. I consider this modern/social SEO. Having a social following as a business can legitimize it in other people's eyes. His business has about a 100:1 follower to following ratio, and ever since he purchases followers, hes had a large increase in real followers. This follows the herd mentality. People are more likely to follow your business and interact, if there is proof others have done so. Hope this helps

<comment><AUTHOR> Thanks. Buying facebook and twitter followers is something I considered as well. Will keep this in mind!

</comment></comment><comment><USER4> Don't do it. It wrecks your site. Those link building packages just cause your site to become awash with spam. To the point I've had to turn comments off on the one affiliate site I tried it with.

700+ junk comments every DAY and no discernable difference in search engine results. Lingering somewhere on page 3. Plenty of traffic, several thousand per day, none of it genuine users though.

I built another site that I've carefully optimised myself, I'm constantly in the top 5 results for my phrase on Google, 300+ uniques per day which has lead to a genuine community and just 1 spam comment in 6 months which was actually an advert for a link building service!

<comment><AUTHOR> Thanks for the warning. I was considering only taking jobs which offered less than 100 links and/or manually link building. Do you think this makes a difference or will they just tell you they did it manually?

<comment><USER4> I think they'll still add you to places/directories you don't want your site to be in.

Building good links yourself can take time but it's really worth it. Aim for 5 a day for a few weeks.

You care the most about the success of your site. No SEO service will take the time & trouble to do it properly.

If you'd like help specific to your website, my email is in my profile.

</comment></comment></comment><comment><USER5> Traffic is worth sh*t.

You need targeted traffic which converst (buys your product, clicks the ads, whatever your conversion is) and that's something these guys can never give you.

If you want to spend money on traffic, you're better off learning how to do PPC advertising. At least that way you get traffic from people who have some interest in your site. You can easily find a voucher from Google for 50$ free PPC advertising to get you started.

</comment><comment><USER6> You can't really generalize, there are some good gigs, some bad gigs. Most of the "most popular" work either temporarily or superficially. I would not recommend using fiverr unless you have a solid understanding of SEO (you can HARM your rankings if you are not careful). Also, the good gigs I mentioned are good, not great. In other words, they are worth $5, but probably not $6. Good luck!

</comment><comment><USER7> I don't use fiverr, but now i use some of the services on fiverjobsite.com instead. They are fantastic!!

Give them a try.

</comment><comment><USER8> I do not really see how you would do this... care to explain a bit further?

<comment><AUTHOR> Thank you for getting back to me. Fiverr offers a lot of link building jobs that promise a massive boost in traffic for your site. See links below for examples: <http://bit.ly/O0hSTe> <http://bit.ly/O0i3Ot>

I realize a lot of these are just going to automatically build links on low PR sites. However, I was wondering if there are any legit SEO services on fiverr? Has anyone ever seen a positive result from any of the link building services on offer on fiverr?

<comment><USER9> I bought a few packages from fiverr for a site that I built 3-4 years ago with a minor benefit.

My recommendation would be to build your own 2.0 sites like squidoo / hubpages link back to your main site and then blast those squidoo / hubpages with fiverr.</comment></comment></comment>


TLS Client Puzzles Extension - <AUTHOR> https://www.ietf.org/id/draft-nygren-tls-client-puzzles-00.txt

<comment><USER2> [https://en.wikipedia.org/wiki/Hashcash](https://en.wikipedia.org/wiki/Hashcash) proof of work Works great for Teamspeak3. Required 'level' to join server is 22. New identity takes roughly two seconds of compute time to reach 22. Spammers never bother after first ban.

</comment><comment><USER3> Wouldn't any kind of puzzle be too slow for embedded devices, yet trivial for a botnet?

It would be intresting if this could be used to do something useful, or even as a source of revenue for servers.

<comment><USER4> Bear in mind a smart TLS server could adjust the puzzle difficulty based on some kind of IP score.

It's no replacement for application level DoS filtering. But it wouldn't hurt to have such a feature either.

</comment></comment><comment><USER5> Are they putting bitcoin mining into the TLS protocol?</comment>


Clojure 1.11 planning - <AUTHOR> https://insideclojure.org/2019/10/06/journal/ <comment><USER2> Clojure had kept the core lean and simple and has grown through the years with libraries for features like spec. It makes the language as a whole stable with features developed and tested like spec being a library in alpha.

</comment><comment><USER3> Spec is very useful, but please implement it without macros. Metosin did a great job to make it more usable, but we still struggle because specs could only exist in Namespaces. We want to use spec as EDN with pure functions. (+ recursive specs would be awesome)

<comment><USER4> Spec 2 can be used without touching any macros if desired and has a lot more programmatic options.

<comment><USER3> Awesome!

</comment></comment></comment><comment><USER5> I enjoy Clojure and spec is very interesting; but it remains uncertain if I have any problems that spec will solve. I'm not really that interested in the generative testing aspect since I write mostly amateur code.

So I can't figure out if it is more like a debugger for targeted location of difficult bugs or more like compiler error messages where it becomes a pervasive part of the workflow.

There is obviously something to this spec if it warrants a v2. It just isn't obvious whether it solves my problems, library maintainer problems or professional problems. It is very different to the immutable-everywhere design where a Clojure beginner is forced in to understanding it to even try trivial experiments.

<comment><USER6> Spec is great for validation. For example, we have a HTTP API built using [https://github.com/metosin/reitit](https://github.com/metosin/reitit) where we have specs for each endpoint. We have a coercion middleware that checks each request (and optionally response) conforms to a spec (and coerces things like integer ids from path to the correct type). And there's a swagger handler that automatically generates a full documentation of the API just from the route tree and specs, including samples of input and output for all routes.

Similarly you can do HTML form validation, etc.

We even use honeysql with nice helper functions that ensure that data-changing SQL queries are of the expected form. Say, you want to update just one row, you have a helper function that checks the honeysql data has a where clause with a unique column and only then runs the query. Someone should maybe blog about that sometime.

What I've found, though, is that trying to use spec like type checking is usually not a great idea. I expect better from static analysis / compile-time checking, with clj-kondo being the most promising tool atm.

<comment><USER7> I remember spec being pitch for something you only use at dev time and turn off in production because it makes your runtime very very slow, what has change? Seems users are using it for everything now.

<comment><USER8> Spec has numerous uses. We use it heavily in production for data validation/conformance: [https://corfield.org/blog/2019/09/13/using- spec/](https://corfield.org/blog/2019/09/13/using-spec/)

</comment></comment></comment></comment><comment><USER9> > Spec 2 has been kind of stalled out as Rich is thinking through some of the > work we were doing on how to rework function specs and the use case of > automating form/map versions of the specs.

It's fascinating to watch a major enterprise language with a Steve Jobs figure at the top, who maintains a firm grip on the wheel, keeping it on track with his clear vision even as its community grows in scale, to the point where he alone would be a bottleneck in its design process.

I mean it's clearly working out - as it worked out for Jobs - it's just highly unusual.

</comment><comment><USER10> I'd love to see more focus on non-JVM impls other than JS -- .Net Core 3.x specifically. (ClojureCLR is pretty much dead, right?)

<comment><USER11> It gets regular commits, but I've found it impossible to use practically, somewhat to my regret (I have plenty of use for a LISP that can do .NET interop).

<comment><USER12> You might want to check out Arcadia[0], a Clojure library for Unity game development. It's all done with ClojureCLR and it's pretty cool. Not saying you want to do game development, but they've definitely got a working product and you can see how they've set up their project.

They just got a round of funding this year, and they've got several good talks posted on their homepage about the quirks of working on .NET.

[0][https://github.com/arcadia-unity/Arcadia](https://github.com/arcadia- unity/Arcadia)

<comment><USER11> I did, but it was a bit stale a year or so ago (as in it wouldn't even work with the Unity build at the time). Which is too bad, since one of my kids is doing Unity micro-games and I would like to have alternatives...

<comment><USER13> Development has picked up again AFAIK, saw one of the developers give a short demo/talk on it recently and it seems neat.

Godot is a decent OSS alternative to Unity, but no Clojure/Lisp so far as I know :(

<comment><USER14> Yup, Ramsey gave a talk at Clojure/north [1] about Arcadia. I got a chance to briefly chat with him, and it looks like they actually managed to raise funding to develop it further.

And somebody made Arcadia bindings for Godot [2], but the project isn't actively maintained. Would be great if somebody picked it up again.

[1] [https://www.youtube.com/watch?v=LbS45w_aSCU](https://www.youtube.com/watch?v=LbS45w_aSCU) [2] [https://github.com/arcadia- unity/ArcadiaGodot](https://github.com/arcadia-unity/ArcadiaGodot)

</comment></comment></comment></comment></comment></comment><comment><USER15> Cool, cool. When is full compatibility with Java 8 be available? I mean Java 8 SAMs, Java 8's Stream, Optional and CompletableFuture...

<comment><USER6> What parts of compatibility are missing? The interop works just fine, as with all other Java.

      ; example: Stream.of(1,1,2,3,5).map(x -> 2*x).collect(Collectors.toList())
      user=> (.. (java.util.stream.Stream/of (to-array [1 1 2 3 5]))
                 (map (reify java.util.function.Function
                        (apply [this x] (* 2 x))))
                 (collect (java.util.stream.Collectors/toList)))
      [2 2 4 6 10]

Of course it's not practical to convert lists and functions to their Java counterparts like that, but if you need to work with Java objects it's possible.

<comment><USER16> so no Java Function to clojure Function automating mapping ? do people use macros to make it nicer ?

<comment><USER17> you'd use Clojure not Java for an example like the above

<comment><USER7> I think the context is when doing interop.

<comment><USER17> yes but I got the feeling the grandparent was confused so I tried to clarify that the only reason for the verbosity is interop - the Clojure code is much more concise than the Java - the interop code is like listening to a speech being translated between English and Spanish</comment></comment></comment></comment></comment></comment>


Ask HN: How to excel in English? - <AUTHOR>

I'm not a native English speaker. I'm good at English. I can write, easily understandable text. However, I didn't reach the point of excellence. The hard point is "How to reach it?"
Reading can be a way to that, but I'm actually reading a lot (around 20 articles per day and also active in few good forums and discussion sites). I started massive reading (20-25 articles per day and also printing PG, Joel and other interesting authors articles and read them offline) around 40 days ago.
I don't see a big difference from where I started. So is it just a time process, or are there other ways how I can become fluent in English?
Thanks for the advice. <comment><USER2> The first thing to do is define clearly what it means to be "fluent" or at least what it means for you (i.e. determine what level of proficiency you want to achieve and how you will measure that) It may seems obvious but usually this is the hardest thing to do for someone learning a language. How i'm doing? What i need to improve? What i can do to improve? All stuff that comes as a consequence of defining a goal clearly.

So, even if you can't immerse yourself in a "native speaking environment", i suggest first and foremost to understand you current state for area of usage of the language:

\- Can you understand spoken english/american english/fereigner english? Just watch some movie/tv show and you'll know the answer. With this you can also check your pronunciation.

\- Does reading english text slow you down too much? Do you sometimes forget if you read something in eng or your native language? If yes this is a good sign imho.

\- How is your vocabulary? Try reading different material, reading only IT oriented stuff is not enough and not indicative of how good your comprehension is, try reading books with completely different argument and see how it goes.

\- Writing. Are you able to produce a good non technical short/long text? Do you notice errors in the paper/etc written by others?

\- Speaking skill? Just register yourself to one of those language exchange sites and see hot it goes.

Once you identify where you are,what need to be improved and where you want to go (language-wise, e.g. speaking- being able to converse on the news of the day with a good english), just go on and check how it goes once in a while. (40 days are not enough to evaluate anything, i'll suggest at least 3 months... seems more reasonable)

</comment><comment><USER3> I think you underestimate yourself. IMO, had you not come right out and stated you were not a native speaker, I might have overlooked the couple of very minor mistakes you made. Seriously, go read some comments on digg, youtube, reddit, or slashdot to get an idea how far above the "average" English speaker you are already. You communicated your point effectively, which is a lot better than most writing on the internet does.

As for what you should do to continue to improve, you're on the right track with the reading program. But, you must supplement it with conversation (preferably with native speakers) and writing (which you should also preferably share with a native for critique). If you continue to do this, I can practically guarantee your English will improve.

</comment><comment><USER4> Practise, practise, practise! In Real Life.

Couchsurfing.org is good for this - you're not obliged to offer your couch. You can just meet up with people, hang out, speak English.

Don't pitch it as "I want to practise my English with you" - that's off- putting. Be interested in _the person_ \- and as a side-effect of the fun, you'll be practising your English!

Now, if only I'd practise what I preach...

</comment><comment><USER5> The best thing to do when you are learning a new language, would be to start thinking in that language. Trust me, it makes a world of a difference.

</comment><comment><USER6> Surround yourself with English text, English audio or English video 24 hours a day. That's how native speakers learned it.

<comment><USER2> Yep, second that.

</comment></comment><comment><USER7> Writing may help you more than reading, especially if you can find somebody to give feedback. Maybe start a blog or contribute to a magazine?

I'm not a native English speaker, but here's some feedback for you: I would say "advice" (always singular) rather than "advices".

</comment><comment><USER8> If you define "point of excellence" as "talk like a native English speaker", then I'm sorry, but that will take a LOT of time. Reading lots and lots will not make you a better speaker.

My advice would be, if you want to become a better speaker, to seek out English-language programming available internationally (sadly, that may limit you to CNN International, but better than nothing), and focus on things like intonation, and the flow of discussion. Two things you won't learn from reading articles.

Of course, the alternative is to spend 20+ years in an English-speaking country, then you'll probably have better pronunciation and diction ;)

</comment><comment><USER9> Hmm. Upon reading your post I'd say that you need to further tweak your grammar and choice of words.

\- The placement of your commas is often incorrect.

\- "I didn't reach" should be "I haven't reached".

\- "The hard point is.." should probably be "The hard part is" etc...

So three things to work on:

\- Grammer, especially the placement of commas - when to pause in a statement.

\- Use of correct choice of words - this will come from more practice.

And finally: \- Try listening to more rock / alternative music. For the first few years, it will mostly sound like gibberish. This is partially an exercise to train your ear =)

</comment><comment><USER10> Feedback, as somebody says, is important. Nagging from parents and teachers smoothed out the rough spots in the native speakers' English. If there's somebody you can trust to review your writing, ask him or her to do so. Conversation will get you a long way on the rest.

</comment><comment><USER11> Don't just read articles (I'm assuming from the internet). Pick up some literature, maybe Dickens or something. That will help expand your vocabulary as well as get you used to different styles and syntactic constructs.

They'd be fun to read too.

</comment><comment><USER12> Start subscribing to the Language Log (<http://languagelog.ldc.upenn.edu/nll>), and click on links to previous posts, ad infinitum.

But what do you mean by "I don't see a big difference from where I started."? What are you doing to measure this?</comment>


Researchers find a western-style diet can impair brain function - <AUTHOR> https://www.theguardian.com/science/2020/feb/19/researchers-find-a-western-style-diet-can-impair-brain-function <comment><USER2> I've had pretty significant health gains once I totally gave up dairy. I'm now in the process of eliminating all refined sugars and processed foods, which is a bit harder to do. The urges are very strong though. It's fascinating to me how much we're poisoning ourselves.

<comment><USER3> IIRC there is a consensus forming that small amounts of white cheese (Mediterranean style feta) is allegedly substantially better for you than other cheeses, regular milk or butter consumption. Perhaps someone with a medical background can weigh in.</comment></comment>


Rampant misattributed paternity: creation of an urban myth [pdf] (2002) - <AUTHOR> https://pdfs.semanticscholar.org/f0e6/8a18bd173a390c97a8c49e678852eebb8f64.pdf?_ga=2.8148529.289584704.1561381037-1516775518.1561381037 <comment><USER2> Researchers could use the Swedish bio bank to get fairly accurate numbers as the database was established in 1975 and include all that was born between then and now.

As for the numbers in the study there is several factors that either increases or decreases the rate. Those that decrease the rate are studies that requiring informed consent, marriage, and high social economic status. For groups where all three is true you get rates around or below 1%, and for paternity testing labs which has the opposite of demographic you get around 20%. The true average is thus hard to establish as almost all existing studies has biased sampling from all of those factors.

</comment><comment><USER3> Huh. I think I've run into the same 20-30% figures a lot and just sort of filed them as Internet fact in the back of my head. It's heartwarming to know that __actual __studies put the number around 0,5-3%

It doesn't take much thought to figure out why the 20-30% numbers are trumpeted loud and wide: The implications are nasty and visceral and when there's a number like that you feel like there's a point behind it, so you start to wonder. Of course, it's the same as with any fear peddler; if you get an emotional response to a news that seems to touch your life, you can be pretty sure you're being sold snake oil for someone else's benefit.

Why not take the message of this research in a positive manner: Of those who suspect false paternity, less than a third are correct.

<comment><USER4> I suspect that it isn't just an "internet fact" (something made up and then copied so many times it starts to look more truthful because of how many times it is seen, because not all those sources can be wrong can they?).

The higher figures may well be real, but have been taken from biased sources. If the figures come from paternity testing lab results then you are automatically biasing the data towards those that are suspicious of a paternity matter due to other correlated factors. People with no such suspicions are excluded from the results because they don't take the tests, and they would pull the average figure down if they took part in a test (but why would they think to?).

<comment><USER5> There is one or two internet communities that would likely have an interest in spreading this "internet fact"

<comment><USER4> True. Though that doesn't mean the figure didn't have some basis in truth, just with a collection of caveats (that those groups chose to, err, not confuse their sheep with).

</comment></comment></comment></comment><comment><USER6> It makes sense that it would be hard to get reliable data on this: Paternity testing labs would be biased towards people who were suspicious; studies requiring informed consent would be biased against people with something to hide; and any study at a hospital or suchlike would be biased by patient demographics.

</comment><comment><USER7> We have twice as many female ancestors as male. That's not a myth. It's an uncomfortable truth.

<comment><USER8> Citation?

Also, why an "uncomfortable" truth? Doesn't bother me in the slightest. I suspect there's an axe being ground here.

<comment><USER7> New York Times The Missing Men in Your Family Tree, 2007 You might be right. My partner got herself pregnant by another man and tried to convince me that I was the father. If the woman who you thought loved you did this to you, it might bother you slightly.

<comment><USER9> I feel like there might be a significant difference in emotional response for false paternity ten generations up your family tree versus instances that affect you personally.

<comment><USER7> Fair. My understanding is that in each generation HALF of the males have their genes exterminated. In "12 Rules for Life", Jordan Peterson says that human female choosiness is the reason why humans evolved faster than chimpanzees, so I guess this is for the best.

I suspect this is why rates of male suicide are so much higher than female suicide. Why bother to live if you are genetically unfit?

Women know this. I suspect this is why the rates of postpartum depression in women is nearly twice as high when the baby is a boy. They know there is a high probability that their baby is destined for a life of suffering.

<comment><USER8> Peterson is a hack, and 12 rules is trash. Don't get taken in by that crap.

<comment><USER7> Yeah. Personally, I think Peterson is in the business of offering false hope to the condemned. A useful service to the elites. But the evidence is the evidence. Suppressing the truth is not a good long term strategy in the age of the internet.

<comment><USER10> Do you really think "false hope" is more common than "false hopelessness"?

(Related: [https://slatestarcodex.com/2013/06/09/all-debates-are- braver...](https://slatestarcodex.com/2013/06/09/all-debates-are-bravery- debates/) )

<comment><USER7> Have you experienced having a woman you loved and who genuinely seemed to be in love with you get pregnant by another man and try to convince you that you that you are father?

There is nothing "false" about the hopelessness that you feel when this happens to you.

<comment><USER11> Do you not realize your reality might be a bit warped by this life altering event?

<comment><USER7> ~50% of males have their genes exterminated each generation.

Their experience of reality is probably very different than yours.

That does not mean that their reality is not real.

If you are not part of this group, congrats on winning the genetic lottery.

Their reality may indeed seem very "warped" to you.

But the probability is high that either your sons or your grandsons will experience this warped reality as well.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> This should be labelled 2005, as indicated in the footer and by the text irself that references events in 2005.

Don't know why the copyright statement on the first page says 2002, that's a bit weird.</comment>