Unhackable: New chip stops attacks before they start - <AUTHOR> https://news.umich.edu/unhackable-new-chip-stops-attacks-before-they-start/ <comment><USER2> I was expecting something with a little more substance from an .edu domain. This didn't really give much detail. Randomly storing data in memory is not a new idea, this has been done for many years on game consoles to prevent people reverse engineering raw memory/disc dumps.

The "Unhackable" title is obvious clickbait and very easily proven wrong. Lets say you run nginx on this chip. You accidentally configure nginx so it is serving your config file on a route. The someone finds this out and breaks in by requesting that resource and then logs in to your server. No amount of memory shuffling will do anything about this unless nginx is totally broken every 50 milliseconds and in that case you may as well run your program on a rock from your back yard.

The only possible thing I see this fixing is when you have direct access to the memory at some kind of hardware level like if you have probes on the memory chip which can read and write but you don't have any way of accessing the memory mapping that allows programs to actually work on the chip.

<comment><USER3> I don't think they care about that type of attack, they specifically call out control flow attacks.

From the abstract:

> Morpheus defenses offer strong protection against control-flow attacks

<comment><USER4> So, i get the concept of CF attacks, I just don't get how it can protect against them when if valid applications need to look up memory locations, how this would be different than current CF side-step attacks like ret2libc and friends ?

<comment><USER4> I can't get the pdf due to lack of subscription or paying for a document that likely will sidestep my questions anyway.

<comment><USER5> [https://sci-hub.tw/https://dl.acm.org/citation.cfm?doid=3297...](https://sci- hub.tw/https://dl.acm.org/citation.cfm?doid=3297858.3304037)

</comment></comment></comment></comment></comment><comment><USER2> I had a skim over the full PDF (Thanks scihub)

From what I can tell the researchers have found that many attacks on C code involve using undefined behavior or very rarely used features. For example out of bounds array access. They seem to have some system that is looking out for these things which normal programs almost never do

"Morpheus similarly makes use of tag checkingpolicies to provide additional security guarantees via itsattack detector. This detector watches for suspicious oper-ations that are indicative of ongoing attacks and responds inone of two ways: raising an exception or triggering a churncycle. Morpheus raises security exceptions on a few grievousoperations, listed under the "ABORT" rules"

It seems like this chip is purely focused on trying to make C code safer.

</comment><comment><USER6> How to get free marketing for your product:

Step 1: claim it's unhackable.

Step 2: wait for the InfoSec community to lose their shit & share it widely.

Step 3: wait for tech journalists to write a piece about it.

Step 4: goto step 1

Win.

(Borrowed from Azeria @Fox0x01 on Twitter)

</comment><comment><USER7> >> even if a hacker finds a bug, the information needed to exploit it vanishes 50 milliseconds later.

What if the exploit runs in 25ms ? What about partial attacks like heartbleed ?

Just scrambling a bunch of registers is supposed give us a sense of security ? Eliminate CVE digests once and for all ? Doesn't sound very serious to me. Nice cube, though.

<comment><USER8> I noticed that issue in the headline it had on reddit, why would an expert in the subject think that 50 ms is so little time to a machine that _runs_ at 2-3 GHz...

</comment></comment><comment><USER9> The article is garbage so I skimmed the paper. Here's what I gleaned (apologizes for any mistakes).

So they created a modified RISC-V architecture and added a tagging infrastructure. 64-bit registers become 66-bits. L1/L2 cache are expanded to hold 2 extra bits per qword, etc. In DRAM, every process gets a chunk of memory where all the tags are stored in one area. So for example, if your virtual address space is 32-bits then you have 2^32/64 * 2 bits of storage or ~16MiB of storage.

That's the storage overhead. Now, their architecture also does a sort of taint tracking. When you compile your C code with their modified llvm compiler, it outputs a 2-bit tag for every pointer. So every qword is tagged with "code pointer" "data pointer" or "data" or "code". When the processor operates on a qword, it propagates the tag. For example "pointer + data = pointer" and "pointer & data = data" for example. At any point in time, that tag storage in DRAM will also store if everything in memory is a code/data pointer or code or data.

Periodically, it will traverse through the tag storage and for every code pointer and data pointer it finds, it will obfuscate it (I think it can relocate stuff too). For code/data it can encrypt it. Of course because all this stuff is transparent to the program, there's no extra work for the developer. (E.g. if you load data from a pointer, it tracks that it's a piece of data and decrypts it transparently with a key that can be changed during the "churn"). It's very similar to GC.

They also detail some optimizations such as accounting for context switches during the "churn" process. And how to not have to keep the process halted while DRAM is being churned. They claim the performance impact isn't too bad but of course we'll have to see how it works with something like Chrome.

tl;dr: Basically from what I gathered, it's an architecture extension to RISC-V (it can be introduced to other archs as well) which tracks basic type information for all memory locations. Periodically, the system will transparently shuffle code and data around safely by using the type information. It's harder to exploit vulnerabilities because addresses and data keep changing around.

<comment><USER10> So it sounds like it's CHERI-style, only "randomizing" things over time?

(no paper access for me)

e.g. let's say you went whole hog (E.g. 128bit CHERI 64bit pointer + 64bit metadata) and periodically traverses the heap and swizzles/reencrypts/whatever the meta data? Seems to assume that it can traverse the heap, but I'll ignore that for now

</comment></comment><comment><USER11> Abstract:

> Attacks often succeed by abusing the gap between programand machine-level > semantics– for example, by locating asensitive pointer, exploiting a bug to > overwrite this sensitivedata, and hijacking the victim program's execution. > In thiswork, we take secure system design on the offensive bycontinuously > obfuscating information that attackers needbut normal programs do not use, > such as representation ofcode and pointers or the exact location of code and > data.Our secure hardware architecture, Morpheus, combines twopowerful > protections: ensembles of moving target defensesand churn. Ensembles of > moving target defenses randomizekey program values (e.g., relocating > pointers and encryptingcode and pointers) which forces attackers to > extensivelyprobe the system prior to an attack. To ensure attack probesfail, > the architecture incorporates churn to transparently re-randomize program > values underneath the running system.With frequent churn, systems quickly > become impracticallydifficult to penetrate.We demonstrate Morpheus through a > RISC-V-based pro-totype designed to stop control-flow attacks. Each moving > target defense in Morpheus uses hardware support to indi-vidually offer more > randomness at a lower cost than pre-vious techniques. When ensembled with > churn, Morpheusdefenses offer strong protection against control-flow > attacks,with our security testing and performance studies revealing:i)high- > coverage protection for a broad array of control-flowattacks, including > protections for advanced attacks and anattack disclosed after the design of > Morpheus, andii)neg-ligible performance impacts (1%) with churn periods up > to50 ms, which our study estimates to be at least 5000x fasterthan the time > necessary to possibly penetrate Morpheus.

</comment><comment><USER12> Glorified ASLR at runtime?

<comment><USER3> That's how it reads. one important distinction is that it continually randomizes itself not just one time like ASLR.

Without access to the paper it's hard to say how granular the randomization is, and what is static. It's apparently transparent to software but there needs to be some source of relative location information that can be accessed.

It also mentions detecting imminent attacks and increasing randomization rates.

</comment></comment><comment><USER13> The battle of sex in evolutionary game is precisely along this angle. Well it is a better defense as the surface of attack change. But then the virus/bacteria evolve as well. Just like firewall, it block a bit but all attack now concentrate on html/click-bait/social ... all legitimate path. Never unhackerable.

</comment><comment><USER14> This would only seem to protect from memory corruption vulnerabilities that are exploited. I don't see how this would protect from the most common vulns: SQLi, command injection, crypto implementation weaknesses, OWASP top 10. Would this even protect against sensitive data leakage like the Heartbleed vuln?

</comment><comment><USER15> This seems a lot less exciting than CHERI ( [https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/](https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/) )

</comment><comment><USER16> So now we will have buggy systems that defend themselfs, what ever could go wrong here? What's next? giving laserguns to psychopaths?</comment>


Apple's Cash to Exceed $300 billion by 2015 - <AUTHOR> http://bullcross.blogspot.com/2011/05/apple-is-sitting-at-equivalent-of-78.html

<comment><USER2> There are very, very, skilled investors, hedge-fund owners, traders, and speculators that are intimately familiar with every nook, and cranny of Apple's Cash Flow, Income and Balance Sheets.

Now - You can trade against these people based on your intimate industry knowledge of trends regarding IOS, Apple's new markets, Apple's unique position in terms of mind-share, Microsoft's Weakness, or Google's potential problems with market fragmentation on the Droid platform - these are all skills/knowledge that may give you a unique advantage.

But trust me when I say people (much) smarter than you with regards to all matters financial have declined to bid-up Apple, despite it apparently having a tsunami of cash about to come its way.

Once again - I'm not saying don't invest in Apple, I'm saying don't invest in Apple because you think you've identified some financial aspect that has somehow escaped the eyeballs of the ten-thousand odd people who make a living crunching these numbers every day and can afford to speculate and otherwise arbitrage these (seeming) value opportunities across hundreds, if not thousands of company's that are in this (or simliar) positions.

<comment><USER3> I doubt there are ten thousand Apple anaylsts. Maybe ... ten.

And they'll know each other. They'll read each other's papers, pressers and blogs. They'll be in the same analyst's tours and on the same conference calls. They attend the same parties, have friends in common and possibly went to Wharton, Harvard, Stanford for Yale together.

In short: they could easily be suffering from groupthink.

<comment><USER2> Oh, don't get me wrong - betting against the Apple _analysts_ makes absolute sense - In particular, for anybody on HN, I'd trust your insight as much, if not significantly more than the Apple "Analysts" - Very few people have Gruber's track record in terms of understanding where Apple is going to go, and even he has been off a few times (misjudged how successful the iPad was going to be).

I'm not talking about Apple Analysts, I'm talking about _financial_ analysts, who all see Apple's balance sheet, cash flow - and can make the same Analysis that the OP did, which is "Apple will have $300 Billion in Cash by 2015."

That's a decision to invest for financial reasons, nothing inherent in Apple itself. If those investors have declined to invest in Apple, it's because they have greater knowledge, understanding, and ability to comprehend what is likely to happen to the cash flows that Apple is experiencing right now than we do.

So, if you want to invest in Apple the "Company" because you think you understand it's future as a "Company" - great, I think you have a chance to out-perform the market.

But, if you want to invest in Apple the "Financial Statistic" because you think you understand how to value it's future based on NPV of future cash flows - realize the people you are going up against have been doing that type of analysis on companies for 8-10 hours a day for the last 20 years, and have declined to bid up Apple.

<comment><USER3> I misread you, then.

Investing based on ratios, like any other approach, has its pros and cons. The pro is that it is largely immune to subjectivity (assuming proper bookkeeping...); the con is that cross-company comparisons can be difficult because different industries can have radically different typical ratios.

I think that ratio analysis can serve two useful purposes:

* Detecting funny buggers. One or more ratios will often becomes skewed out of band when somebody is being creative with bookkeeping. * Reality checking. This is a more general case of detecting funny buggers.

Finally, active share traders won't calculate purely on NPV, cash per share, etc. They'll be looking at share price growth and other shares may seem more attractive, for various reasons good or bad, regardless of the fundamentals.

</comment></comment></comment></comment><comment><USER4> I doubt Apple will want cash reserves that high. Investors criticize companies that have too much cash and just sit on it, ie microsoft and now apple.

The reason is the company should be using some of that cash to invest in growth opportunities or their future, either acquisitions, R&D or new projects. If they don't do anything with the cash and just sits on it, this action is a signaling mechanism that essentially says that Apple doesn't see any growth opportunity worth investing in. Traders will sell the stock because there is no recognizble opportunity to grow revenue and they are not investing in their future so they can be vulnerable to competition in the future.

</comment><comment><USER5> Of course, this 0.00% assumed growth rate omits the obvious, which is that a company as successful as Apple has a lot of competition brewing in each of its markets, and a negative growth rate is certainly possible.

Technology is an industry where you run to stay still. Apple's cash flows are far less predictable than, say, Procter and Gamble's. What's Apple has done in the last ten years could continue for another ten, or reverse entirely.

</comment><comment><USER6> It's nearing a year old but here are some points to consider if you're an apple long: <http://aaplbear.com/>

</comment><comment><USER3> I can see at least 4 reasons why Apple isn't paying dividends.

1\. Tax: the cost of repatriating foreign profits to the US is high. The USA has a higher corporate tax rate than most countries, and with switcheroos like the "Dutch Sandwich" and the "Double Irish", bringing that money home makes no sense.

2\. Tax again: capital gains vs income tax, to be precise. Many shareholders would prefer the stock price to go up over receiving dividends. A growing cash balance puts upward pressure on the stock price.

3\. Buy-up fuel. Like large most tech firms, Apple has a split personality. Part creator, part hedge fund.

4\. For dick-waving rights. Never underestimate this motivation. Here in Australia the dick-waving contest between the executives of the two largest mining companies has led to outbreaks of profoundly expensive bugger-ups.

<comment><USER7> _4\. For dick-waving rights. Never underestimate this motivation_

Related: Steve Jobs has already publicly committed himself to not paying any dividends. It's difficult to go back on something like that even if it does make sense.

It's hard to know what Apple could do with a cash pile of $100B, $200B, $300B, because nobody has ever had a cash pile of $100B, $200B, $300B. As a shareholder I'd rather sit around and find out what they can do with the money rather than collect my $2.50 a share or whatever.

<comment><USER3> I imagine that once Apple's sales growth slows, shareholders will want buybacks to support the price. That's what happened to Microsoft. What Steve Jobs wants is one thing, what the shareholders can do if they get hungry is another thing entirely.</comment></comment></comment>


Homeowners Use Airbnb to Dodge Foreclosure - <AUTHOR> http://www.bloomberg.com/news/2010-07-18/homeowners-use-airbnb-room-renting-site-to-pay-mortgage-dodge-foreclosure.html?utm_source=twitterfeed&utm_medium=twitter <comment><USER2> Unsurprisingly, using residentially-zoned space for commercial purposes is profitable. Don't most full-time bed-and-breakfasts have to get licensed? (I'm assuming that making $4,500/month implies being nearly full-time; maybe I'm wrong.)

To me, this seems fine when rare. So let's say I rent out a room once a month or something along those lines - no big deal. If I'm treating it like a real b-n-b, though, it seems like I'm engaged in some real commerce that is probably regulated. Presumably Airbnb behaves agnostically on this issue, allowing the responsibility to fall to the property owner?

I'm delighted for the specific homeowners being discussed here, but concerned about the general case.

<comment><USER3> Sydney used to have a problem with unscrupulous entrepreneurs who would (say) buy up a bunch of three-bedroom apartments in a fancy inner-city building, stuff sixteen beds into it, and rent the beds out to foreign backpackers for (say) fifteen bucks a night. For the backpackers, it was better than the regular hostels, and for the owners it was a license to print money, but for the other residents of the building, who would find the pool and gardens filled with drunk poms at all hours of day and night, it was pretty annoying. Eventually I think they came up with some new law to stop it.

Anyway, if airbnb is smart they should try to stop people from abusing their system by trying to set up pseudo-hotels, since it's these people who are going to bring down the regulatory hammer on the entire system.

<comment><USER4> "Hotel Toshi" in NYC does exactly this. The fact that the guy is operating somewhat high-profile and attracting attention to himself is probably what brought knowledge of this problem to the NYC media and regulators.

<http://ny.curbed.com/tags/hotel-toshi>

<http://www.airbnb.com/users/rentals/8194>

<http://www.myspace.com/toshifilms>

</comment></comment></comment><comment><USER5> Airbnb is amazing at PR. See their interviews for examples, but in general they've got a wonderful sense for spotting a narrative the media cares about and inserting themselves into it.

</comment><comment><USER6> New York can go fuck itself. It's insulting to the people that in a time of economic turmoil the politicians are still taking big fat campaign checks from the hoteliers and passing arbitrary bullshit laws that dick people over who are trying to make ends meet. Who the fuck do they think are to even suggest they can come into my home and tell me how "sanitary" it is?

Sorry for the rant, but this is industry after industry, entrepreneurs like AirBNB try to create efficiency and wealth and the establishment comes along and buys off politicians to eliminate the competition.

Democrats hate corporations, Republicans hate the government. Or maybe they just pit us against each other while they all laugh their way to the bank.

<comment><USER5> If you feel strongly about this, you might want to read Cato regarding licensing for e.g. cosmetologists and taxi drivers. It is the same story -- pretexts about the public safety justify anti-competition laws, whose effects are felt mostly by poor would-be entrepreneurs and the communities who they can't legally service.

<comment><USER2> The taxi thing seems totally like a pretext, but cosmetologists engage in a lot of quasi-medical stuff that seems reasonable to regulate. Perhaps I'm mostly thinking of spas and their ilk, and honestly I'm probably mostly just thinking about the rise in community-acquired MRSA (which, to be fair, has not been shown to be driven by cosmetological practices at this point).

<comment><USER7> Is it really necessary for the government to regulates?

Why not have voluntary associations that people can join but have rules on business? If the organization have honest inspectors, their reputation will show. Businesses will pay for that kind of exclusive brands. Risk-averse customers will flock to it.

If you have an organization that everyone must join by law to practice certain field, then it could be a breeding ground for corruptions. The government is now intertwined with a professional organization, and then create an illusion of safety which none shouldn't exists.

Associations that has been around for years will have more trusts than new associations that pop up. The new associations will then prove that they're not kooks that been rejected by incumbent associations.

<comment><USER8> _Why not have voluntary associations that people can join [..] their reputation will show_

This is an illusion. Are you going to check with what association your taxi driver is registered and have you done the necessary research upfront to judge the credentials of the association? If a taxi stops and it's from the 'wrong' association, but you know it's relatively cheap, are you going to send it away and wait for the next one?

Especially services that an individual uses only very infrequently, such as a taxi, can get away with very poor performance. The businessman will tell everyone that the taxis in StateCapital suck, but a few months later, when he's there again for a one-off trip, he will have forgotten the name of the taxi service that rendered him such a bad service last time. However, commerce in StateCapital is harmed by all the gossipy remarks concerning one of their taxi services (which are remembered as concerning _all_ taxi services in the city). Requiring taxi drivers to be licensed and checked on by the government could very well be a net advantage for all commerce in StateCapital.

<comment><USER9> Do you check to see if electrical appliances are UL listed?

UL is private company that sets safety standards and tests products that manufacturers voluntarily submit for (and pay for) testing.

Does a small mid-west town have the resources and and expertise to inspect the traveling carnival rides to insure they are set-up properly? Or does the carnival's insurance carrier handle that responsibility?

There are private replacements for coercive regulation that are not theoretical but are actually working.

<comment><USER8>
      UL is private company that sets safety standards and tests products that
      manufacturers voluntarily submit for (and pay for) testing.

Why do these manufacturers do that? Perhaps just as a lawsuit hedge: they can always claim to have been 'certified by the _de facto_ testing standard', in which case it's the reasonable expectations laid down by the law that drive the interest in this 'independent' testing. I.e.: the government.

Another explanation is that large brand A initially wanted to distinguish itself as 'the safest' and brand B just followed the lead so it didn't seem less safe. When they control a substantial part of the market, others will soon follow. After that, the actual contents behind the logo don't matter anymore. It's a perception-driven protection racket, the actual value of which cannot be determined by consumers. But it doesn't even matter how it comes about: after most of a market sports a certain logo or association, what's to stop that organisation from growing lax and pleasing their clients? There is hardly any room for competition in that market: who's going to start a UL competitor and why on earth would a brand be interested?

Or, the more fundamental question: who tests the testers? How do you know the UL is not theoretical and actually working? Even the government suffers from corruption; I doubt such companies are any better.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> There is one high profile illegal hotelier in NYC who is probably solely responsible for all the media attention and ruining it for everyone else: Hotel Toshi. He's a wannabe actor who was the asian chippendale gag on Conan a few years back. The guy even advertises for cleaning staff and has his own vans and trucks painted with his logo. I found AirBNB unusable in NYC because half the listings were from Hotel Toshi.

<http://ny.curbed.com/tags/hotel-toshi>

<http://www.airbnb.com/users/rentals/8194>

<http://www.myspace.com/toshifilms>

</comment><comment><USER10> Shouldn't banks be lobbying against legislation like the one passed in NYC? If it helps people to pay mortgages, it's their best interests, right?

<comment><USER3> The total amount of money, as far as they're concerned, is probably less than it takes to buy one lobbyist lunch.

<comment><USER10> But since they have lobbyists on payroll, I assume there would be no need to secure extra funding.

<comment><USER3> Yes, but their lobbyists are working hard on other things, like the complete damn re-regulation of the entire financial industry, at the moment. Whether a handful (hundreds?) of extra mortagees go into foreclosure isn't a big deal for them.

<comment><USER10> Oh, but it would picture them fighting for the small guy. That's something representatives like. It would be far easier to de-regulate an industry that fights for the small guy, wouldn't it??

</comment></comment></comment></comment></comment><comment><USER11> If I were AirBNB, I'd be sending this to whichever organization coordinates lobbying for the lending industry to fight the law against this sort of activity. Mortgage lenders have a serious interest in having their customers pay mortgages, if this sort of activity helps them they'd be fools to not support it.

</comment><comment><USER12> What's funny is how many people in America think (large) corporations = capitalism.

But in reality what these enterprising homeowners are doing is real capitalism.

So politicians are protecting the former (corporations) and destroying the latter

\- they are actually working against capitalism!

<comment><USER13> If we're being technical, capitalism != free market, though the terms are often used interchangeably. Capitalism means the rule of those with capital (in this instance, corporations) while a free market is a system which guarantees the free exchange of goods.

</comment></comment><comment><USER14> Those bastards! How dare they dodge their foreclosures and stop us from taking their houses!

<comment><USER15> I think that's rather missing the point entirely.</comment></comment>


Viacom sues Cablevision over iPad streaming - <AUTHOR> http://www.reuters.com/article/2011/06/23/us-viacom-cablevision-idUSTRE75M4XD20110623

<comment><AUTHOR> While _Viacom And Time Warner Take A Break From Legal Battle Over TV On iPads_ [http://paidcontent.org/article/419-viacom-and-time-warner- ta...](http://paidcontent.org/article/419-viacom-and-time-warner-take-a-break- from-legal-battle-over-tv-on-ipads/)</comment>


The Golden Grid - CSS Framework - <AUTHOR> http://code.google.com/p/the-golden-grid/ <comment><USER2> View source on this page: <http://www.allapis.com/The-Golden- Grid/golden7.html>

... and tell me what I could possibly be gaining from this system. They've defined a table, with some code that doesn't really look like a table, and they've had to hand-split the text for that specific page so that it would fit into the cells.

I honestly can't tell what part of this is supposed to be an improvement over anything we have already. I had assumed that they had found a way to make content flow into multi-column layouts, but they haven't. They've just discovered {clear:none;float:left;}.

Or am I missing something?

</comment><comment><USER3> Practically none of the grid systems accommodates the most common ad widths (120, 160, 180, 300)px well (<https://www.google.com/adsense/static/en_US/AdFormats.html>). I use malo (<http://code.google.com/p/malo/>), incidentally by the same author as this post's framework.

It's simple enough to grasp in a few seconds and it allows me to use a grid that fits well enough around most ads. It's also so small that cross-browser breakage is easy to detect.

</comment><comment><USER4> Is this a parody site? Surely... This can't be for real.

<comment><USER5> I don't think this is a parody site. The same author created the Hartija print css framework and a few other css frameworks. There is also good documentation and demo code available for the Golden CSS framework. It looks very interesting.

</comment></comment><comment><USER6> I've looked at many CSS grid frameworks and first thing to mind is always "looks like a printed magazine".

I suspect that is why certain designers are attracted to them. But is also why I click away wondering "why would anyone ever do that?"

<comment><USER7> You're looking at it too literally. A grid is meant to be a basic visual system -- a framework in itself really -- that brings order to 2D design and usually gets obscured by graphics. All of these are based on exacting grids: [http://www.webdesignerwall.com/trends/best-of-css- design-200...](http://www.webdesignerwall.com/trends/best-of-css-design-2008/) some more apparent than others. Of course, the value of a framework of a framework is another question.

</comment></comment><comment><AUTHOR> Interesting comments. Thank you all for commenting. @Axed: I worked long and hard for The Grid System. Parody site? I don't get it!? @njharman:Good observation. It does look like print magazine :) @all: This is not tabele v.s css article or project. CSS is just the tool. It is about web grids, dimension, geometry and my personal quest to better web layout.

</comment><comment><USER8> Has anyone tallied up how many of those grid systems there are out there at the moment?

Also, do any of these systems work for email?

<comment><USER9> I think tables are still best for email. Here's a nice resource on the subject: <http://www.campaignmonitor.com/design-guidelines/>

<comment><USER10> Yes, because most mail readers don't come close to any sort of rendering compliance.

</comment></comment></comment><comment><USER11> GPL License? No thanks. Stick with YUI which is the same but more flexible, BSD licensed and far better documented (although admittedly, higher weight).

</comment><comment><USER12> looks interesting. goodie but first i need to read the documentation :)

</comment><comment><USER13> Why is this up rated? Why not just use tables and get the job done instead of "hacking" tables in CSS _sigh_

<comment><USER14> I'm a "use tables for layout occasionally" kinds guy, but this isn't the same. This isn't a CSS replacement for tables, this is a standard set of styles to assist in doing a grid-based design.

<comment><USER15> This is something I don't understand about these sorts of grid systems. Isn't using specific classes for the divs of the grid in the HTML just as difficult for maintenance purposes as using a table? You're defining specific rows and columns and because you're doing so with class names, that layout information is in the HTML and not the CSS.

The point of using CSS for layout is to have the markup be relevant to the content of the document, not for it to be relevant to the styling. Just as having class names like "blueText" or "thickBorder" is injecting style information into the HTML, so is having class names like 'g80' or 'g940' or whatever.</comment></comment></comment>


What Star Trek Predicts About The Future of Information Security - <AUTHOR> http://ha.ckers.org/blog/20090918/what-star-trek-predicts-about-the-future-of-information-security/

<comment><USER2> And people will start wearing skin tight jumpsuits.

<comment><USER3> Yay!</comment></comment>


Papa the Investor - <AUTHOR> https://www.theparisreview.org/blog/2017/03/24/papa-the-investor/ <comment><USER2> On the mobile phone since the content is very long and the popup for subscription comes up the whole page fades and makes it unreadable. If you are on the mobile don't forget to scroll till the middle of the page and close the popup box for proper reading</comment>


How Did That Chain Letter Get To My Inbox? - <AUTHOR> http://www.nsf.gov/news/news_summ.jsp?cntn_id=111580&org=NSF&from=news

<comment><USER2> The ones that require the recipient to forward the letter for one reason or another drive me nuts. Like this totally useless one I got recently (hint: there's nothing wrong).

        What's wrong here

        AAA
        BBB
        CCC
        DDD

_< snip>_

        XXX
        YYY
        ZZZ

        Did you know that 80% of UCSD students could not find
        the error above? Repost this with the title "what's
        wrong here", and when you click "Forward ", the answer
        will be really obvious.

The worst thing is we're seeing the EXACT SAME THING in disguise as social- viral-loop-Facebook-app nonsense. "Your friend rated you! To see the results, rate 10 friends first!"

And I wonder why I stopped using Facebook soon after they launched the app platform...

<comment><AUTHOR> This is a great simple example of social engineering.

</comment></comment><comment><USER3> In my experience, those chain letter emails almost always came from my mum. ;-) At least until I asked her to stop forwarding them to me.

Seriously though, I haven't had one of those for what must be years. Are they still going strong and I just happen to be spared? Or is all of this stuff happening on Facebook, etc. these days? (By the time Facebook was open for me to register, its appeal was gone, so I never did. There's a story there but I'll leave that for another day.)

<comment><AUTHOR> I experience the same thing as I haven't gotten many chain letters in a long time. This is due, I think, to two things:

1) I trained my family to either stop emailing this stuff or stop emailing me this stuff. I would do a quick search on the topic which usually ended up with sending everyone a quick sentence asking to read the snopes article I linked.

2) I am in a different social network that is insulated from the "main stream" social networks (I'm just saying different, no more no less). The people who are connected between networks are my filters. I assume that most of them are literate enough to stop forwarding this junk from one group to another. There was a technology magazine article I scanned a while back which explained visualizing social networks that better illustrated what I have feebly described.

<comment><USER4> Have to agree. I used to reply (basically) "You're an idiot, here's a snopes link explaining why".

When that didn't work, I used Reply All, which basically added "and now I've told all your friends that you're an idiot".

Haven't received a forward in a long, long time...also have a lot less email- only 'friends'.

</comment></comment></comment><comment><USER5> I used to get a lot of this crap then I did the following:

1\. I did a "reply all" (Everyone address is always in the To or Cc with these things) and asked very nicely that people stop sending me "chain mails and other jokes".

2\. I wrote a giant email about how chain mails are basically for idiots and sat and waited for the first person to ignore my nice email. When that happened in a day or two, I did another "reply all" and emailed my dissertation out 50 times.

3\. I did that once more to a different chainmail.

I've never received a chainmail or other retarded email since. :-)

</comment><comment><USER2> Jon Kleinberg... he's the guy who wrote my graduate algorithms course textbook. And reportedly did the research that eventually inspired PageRank.

</comment><comment><USER6> I'm not sure what's worse.

1\. That I get these emails

or

2\. That the gooberment spent probably $3million for this "research"</comment>


Show HN: The platform used for the TechCrunch interview with Sam Altman - <AUTHOR> Last week, I published a conversation on TechCrunch with Sam Altman using ReplyAll http://techcrunch.com/2015/08/09/ycombinate/
I've personally used ReplyAll to interview Mark Cuban http://abovethelaw.com/2015/05/a-conversation-with-mark-cuban/ discuss depression with Brad Feld https://blog.replyall.me/a-conversation-about-depression-with-brad-feld/and debate David Frum on marijuana legalization http://abovethelaw.com/2015/05/is-legalizing-pot-a-bad-idea-a-published-email-exchange-with-david-frum/
Our homepage is www.replyall.me
Why we built ReplyAll: my cofounder & I used to exchange lengthy emails every day about important topics, and we lamented the fact that we didn't have an easy way to publish these conversations. Then we saw some of our favorite writers like Sam Harris & Glenn Greendwald doing just that: publishing their email exchanges as content.
http://www.samharris.org/blog/item/dear-fellow-liberal2
So we built ReplyAll to make it easy to publish this content (no manual cutting and pasting out of emails) and allow readers to follow along like a fly-on-the-wall as the conversation unfolds. Participation is asynchronous, so no one has to coordinate schedules. It is an easier, better way to create interviews & debates, and ReplyAll conversations get great engagement in both time on page (10 minutes plus) and repeat visitors (2.3 page views per unique).
Happy to answer questions about the platform, business model or failing to close the deal at our YC interview in April. <comment><AUTHOR> PS here are the links other than the homepage that I mentioned in the post, now clickable

The conversation with Sam [http://techcrunch.com/2015/08/09/ycombinate/](http://techcrunch.com/2015/08/09/ycombinate/)

An interview Mark Cuban [http://abovethelaw.com/2015/05/a-conversation-with- mark-cuba...](http://abovethelaw.com/2015/05/a-conversation-with-mark-cuban/)

A discussion about depression with Brad Feld [https://blog.replyall.me/a-conversation-about-depression- wit...](https://blog.replyall.me/a-conversation-about-depression-with-brad- feld/and)

Debate with David Frum on marijuana legalization [http://abovethelaw.com/2015/05/is-legalizing-pot-a-bad- idea-...](http://abovethelaw.com/2015/05/is-legalizing-pot-a-bad-idea-a- published-email-exchange-with-david-frum/)

Sam Harris & Glenn Greenwald's debate (not done with ReplyAll)

[http://www.samharris.org/blog/item/dear-fellow- liberal2](http://www.samharris.org/blog/item/dear-fellow-liberal2)

</comment><comment><USER2> I did a conversation with Zach on ReplyAll some months ago: [http://abovethelaw.com/2015/06/should-you-leave-law-and- lear...](http://abovethelaw.com/2015/06/should-you-leave-law-and-learn-to- code-a-conversation-with-lawyer-turned-programmer-will-ha/)

The experience was pretty awesome. The sign up was easy, and I was up and running doing posts/replies to questions. Watching the reaction to the conversation was pretty cool.

The next interview/conversation I have on my personal blog, I'd like to use ReplyAll simply because it helps in creating the most insightful comments/responses. If you were to do a conversation real time (podcast/phone/live), a lot of thought is lost while thinking on your feet (you can be really good, but it's likely inchoate relative to the true potential while you're writing and thinking). On the other hand, if you're doing an "email interview" where you just have a long set of questions, there's no freedom to let the conversation go as it should without some heavy editing.

Cool product, well done Zach, et al!

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER3> Clickable: [https://www.replyall.me/](https://www.replyall.me/)

<comment><AUTHOR> thanks for that!

</comment></comment><comment><USER4> Really cool, and I thought Reply All was just a podcast. If I am understanding this platform correctly this allows each person involved in the conversation to send email responses, and replyall publishes the conversation in an embeddable widget. I haven't used it before so I could be way off.

<comment><AUTHOR> Actually, that's exactly how it works and in many ways ReplyAll is a much easier way to publish a conversation than a podcast.

Which is why btw, I told the guys from Reply All that they were infringing on our TM.

But that's another story...

</comment></comment><comment><USER5> Interested to see if you will have a featured conversations list where you showcase conversations between notable people in different verticals.

Would be particularly interesting for controversial debates. Would be a bit more thought out than tweetstorms, but lower friction than back-and-forth blog posts.

<comment><USER6> Absolutely. Love the way you think.

It's in early development now, but that's exactly where we're headed. A hub to read and follow the greatest conversations going on around the world.

</comment></comment><comment><USER7> This is a neat idea. Do you guys have any numbers that show that your interface is more engaging than say a blog post with quotes from a conversation? (I know it makes it easier for the publisher but do readers enjoy reading this format? I sure as hell do!). Great job!

<comment><USER6> And readers enjoy reading this format just as you do.

Some of our favorite comments from readers on various sites: "I love this format! Definitely like it over the regular Q and A style and even better than podcasts" "Love the format. Easy to read." "More fun than the usual five questions and way more interesting" "ReplyAll, you're my new favorite platform."

And one of my personal favorites: "This is voyeuristically fun. If that's a word. And I'll creep back where I came from."

</comment></comment><comment><USER8> What makes a convo unsuccessful on the platform? What makes a successful convo on the platform? Any strategies?

</comment><comment><AUTHOR> Btw if you want to see a version of a live conversation, here's one in doing right now [http://abovethelaw.com/?p=386196](http://abovethelaw.com/?p=386196)

</comment><comment><USER9> Do you have the capability to widen the conversation to include more than two people? Have it take on a feel of a conversation rather than an interview? What about live interactions?

<comment><USER6> Yeah, you can definitely include more than two people. Here are a couple of roundtable examples with multiple voices: \- [http://dannybrown.me/2015/03/16/the-future-of-content- part-4...](http://dannybrown.me/2015/03/16/the-future-of-content-part-4-the- return-to-pure-blogging/) \- [http://www.bloodyelbow.com/2015/5/7/8565733/be- roundtable-as...](http://www.bloodyelbow.com/2015/5/7/8565733/be-roundtable- assessing-the-ufcs-reebok-sponsorship-payout-system)

</comment></comment><comment><USER9> Can you explain a bit about why a conversation on Replyall is different or in your opinion better than an interview or guest blog post?

<comment><AUTHOR> Sure. Interviews in general are better than a guest post because it requires less work from your guest and you get to ask follow up questions and get answers that you think your audience will find interesting. Late night hosts interview their guests, they don't usually invite guests on and have them monologue.

ReplyAll is better than the standard way of doing interviews because the questions are not predetermined, there is active back and forth and the readers get to follow the conversation as it unfolds.

</comment></comment><comment><USER10> so why did your YC interview not work out?

<comment><AUTHOR> It's a good question, and I'm not sure we have a good answer. We did show that we had built a product that people want, use and even love, but I don't we think did a good job of showing that we were building a $10B business.

</comment></comment><comment><USER8> What have you found that makes a successful conversation on the platform? What makes a convo bomb?

<comment><AUTHOR> So far bombs include situations where people use ReplyAll as a replacement for live chat around an event or simply include too many people.

Our best conversations usually take place over an extended period of time and between a small group of people 2-4

</comment></comment><comment><USER11> Cool project, does it support RTL languages like Arabic or Hebrew?

<comment><AUTHOR> Yes. We actually added that because one of the campaigns in the last Israeli election asked us to add it in. They didn't use it then, but we actually just white labeled a version for the group running their campaign.

</comment></comment><comment><USER8> What makes a successful conversation on the platform? More importantly, what makes a conversation bomb on the platform?

</comment><comment><USER12> Hi, great platform!

What is the business model??

<comment><AUTHOR> Thanks. Right now, we have the basic free version plus we've white labeled the platform for a few sites. Debates.eu is an example, they are launching soon. We also consult for a few non-profits and help them get the most out of their use of ReplyAll. Ultimately, we'll build those services in, but it's been a good way to keep cash coming in at an early stage, plus we helped one non- profit use ReplyAll to secure two grants.

But what we're experimenting with now (with one big publisher) is the software for free, but they pay us for repeat visitors and/or we advertise inside the emails that go out to people who subscribe to the conversations and split that revenue with the publishers (this is the Outbrain model).

</comment></comment><comment><USER13> very cool, makes total sense. Great article with the shark himself, Mr. Cuban</comment>


Open Innovation Contests – Connect big companies with startups - <AUTHOR> http://newdartagnan.com <comment><USER2> Poorly-designed website. It won't let you see any details about the contests they list without handing over a _lot_ of detailed information, including some private stuff, like your phone number.

Feels spammy/suspicious to me.

</comment><comment><USER3> This is a lot of what we do at Work-Bench already in New York, where we work at the intersection of suits and hoodie's. [http://work- bench.com](http://work-bench.com)

</comment><comment><USER4> Except there don't seem to be any contests?

</comment><comment><USER5> Big Company + Startup = Pilot = End of Startup

That at least has been my experience. Slight as it is.

<comment><USER6> In France, where the posted initiative originates, there is a weird obsession among mainstream startups of getting partnerships with big companies ASAP. As if that can help with product-market fit or customer dev. It's as if startups are all about bizdev hounding corporate partnerships, for something akin to validation.

That's why, IMO, there are so few successful B2C/consumer products startups coming from France. Besides, of course, the usual reasons, the huge brain drain to SV, wrong mythology, lack of funding, stifling regulation.

The hounding for partnerships sometimes finishes in a pity acquihire with a tiny ROI.</comment></comment>


Choose Email for Remote Productivity - <AUTHOR> https://fastmail.blog/2020/05/22/email-for-remote-productivity/ <comment><USER2> I'm all for using email productively. As soon as I'm done sorting out the automated and mass mailed stuff and read through these emails that contain important information but has been forwarded 16 times before being sent to me.

<comment><USER3> give people one email address and computers another.</comment></comment>


The Web Can Do That? (video) - <AUTHOR> https://developers.google.com/events/io/sessions/gooio2012/204/ <comment><USER2> Excelent talk. I've been asking in various places how could I access the local file system with a web app and the response was always "You can't due to security reasons" (makes sense, I wouldn't want any website messing with my files).

When I saw the drag and drop + filesystem API + download, I was amazed, that is exactly what I've been looking for.

</comment><comment><USER3> Excellent talk. Here are the slides: <http://www.htmlfivecan.com/>

<comment><USER4> That site is extremely slow (with lots of CPU usage) on Firefox.

Seems fine on Chrome

</comment></comment><comment><USER5> I literally cheered during the flexbox portion. It will be so great in 2 years when it's safe to use ;)

<comment><USER6> At least it is supported in IE 10, which ships with Windows 8 so it will get quite a lot of marketshare. The main reason IE 8 kept so much marketshare because it initially shipped with Windows 7.

If it wasn't in IE 10, we would be waiting a whole lot longer for it to be safe to use.

</comment></comment><comment><USER7> wow can most people understand everything he is talking about? I have a long ways to go as a web designer/developer

<comment><USER8> not to worry... thanks to browser support delay you have something like 2-3 years at your disposal to get up to speed with all these :)

</comment></comment><comment><USER9> Very cool, but unfortunately things "the web can do" are limited by things "bad popular web-browsers can do"

</comment><comment><USER10> Great presentation, very informative, but on a slight tangent I watch things like this and often get frustrated with, probably unintentional, nonsense that comes out of HTML advocates mouths.

'I have to touch js and it's super icky' - when talking about boxes resizing themselves

It's only icky because we can't over-ride control behaviour at a fundamental inheritance level.

Truth is it wouldn't actually be a problem if controls were actually extensible and overridable. If we could actually inherit and program the controls in browsers this all would have been solved 5 years ago, instead we have to wait for the browsers to agree on the next badly written, half-assed death-by-committee spec they'll bring out.

I mean look at what happens at 7:30:

[http://www.youtube.com/watch?feature=player_embedded&v=X...](http://www.youtube.com/watch?feature=player_embedded&v=X_ek1wSe66o#t=444s)

Is that what I actually want happening? The content of B overflowing into C? No. But that's HTML's ethos, content is king, which is fundamentally wrong for apps where layout is king.

I have this constant nagging wish to 1. Use anything but JS in the browser and 2. To have actual control over the behaviour of controls and to be able to build composite controls.

Deep down I know it's never going to happen, but why do they have to pretend that it's brilliant when in fact it's just actually kinda sad that HTML is still stuck in the 90s. Why do they want us to coo over features that have been available in other layout engines for decades now?

It's like the speakers often wear a special kind of blinkers in presentations like this, like they've never used an application outside the browser and seen what computers and programmers can actually do when not hamstrung by HTML.

</comment><comment><USER11> It's more like "chrome can do what ?". unless you believe chrome is the web...</comment>


We All Have 24 Hours - <AUTHOR> http://bennesvig.com/we-all-have-24-hours/

<comment><USER2> The blog post is content-free, so instead of wasting thirty seconds reading it, I'd suggest HN members for whom the title is interesting instead grab a copy of Arnold Bennett's _How to Live on 24 Hours a Day_. Written in 1910, it is one of the first self-help books, it is firmly in the public domain, and is a lovely "meta" companion to Getting Things Done.

<comment><AUTHOR> Just picked up the Kindle version for free. Thanks for the recommendation.</comment></comment>


When You Need to Redesign Your Product? - <AUTHOR> http://usersknow.blogspot.com/2010/12/you-need-to-redesign-your-product.html <comment><USER2> RedesignMe may be helpful: <http://www.redesignme.com/></comment>


AMD EPYC Architecture and Technical Overview - <AUTHOR> https://www.techpowerup.com/reviews/AMD/Epyc_Server_Architecture/ <comment><AUTHOR> This is a far better and more detailed article than the other one posted. This includes information on the cache, prediction neutral network, memory subsystem, and others that the other article didn't touch.</comment>


End-to-End Encryption Plugin for Yahoo Mail - <AUTHOR> http://yahoo.tumblr.com/post/113708033335/user-focused-security-end-to-end-encryption <comment><USER2> Little known fact: Google's End-to-end encryption extension already works on _any_ site. It is not limited to Gmail. In fact it's not limited to webmail either. If a PGP blob is present in a web page, End-to-end can decrypt it. If a text input area is present in a web page, End-to-end can encrypt it.

<comment><USER3> Littler-known fact: if you are serious about protecting that message, then web based email can't really do it.

So long as the server has access to your plaintext as you compose it, the security is compromised and a third party has it. And then if the recipient views the plaintext from a browser...

If you want the email to be secret, it must be in it's encrypted form before the browser even knows about it ... but at that point, why not just use a different, well vetted client program for email?

<comment><USER4> > but at that point, why not just use a different, well vetted client program > for email?

Anyone have any names?

<comment><USER5> Mutt and Thunderbird come to mind.

<comment><USER6> GPG in Mutt is fantastically well integrated.

Now, of course, you have to get used to Mutt first :)

<comment><USER7> Thunderbird with Enigmial also works quite well. I use it everyday.

</comment></comment></comment></comment></comment></comment><comment><USER8> Rather to compare E2E with Mac GpgTools, I'd try to compare it with [https://www.mailvelope.com/](https://www.mailvelope.com/) which is a much better comparison since both are addons for browsers.

Mailvelope works both on Firefox and Chrome (ironically, the Yahoo plugin seems to only have Chrome support at the moment) and is actually even nicer to use (read: seamless) than E2E IMO.

<comment><USER9> Yeah, I use mailvelope with my close friends and family. It's not yet easy enough for my parents generation to "get it" but if it's set up for them they can muster through it.

The problem with plugins though is that very few people go out of their way to install browser plugins. Having an integrated option is way more useful. So some people have to encrypt/decrypt in-browser using Javascript (like, how tutanota and protonmail do it, or like whiteout.io does, or like anybody can do now using the keynote.io API). I know it's not ideal, but it is way better than nothing. It won't stop the NSA, but it will stop hackers, email leakers, doxxers, and big-data email-mining algorithms.

</comment></comment><comment><USER10> Can someone give an explanation of how this works?

In order to get this to be seamless, I would guess that this only works when you are sending from one yahoo account to another one correct? Unless they have found a clever way to share the public keys.

<comment><USER11> Yahoo Paranoids Engineering Director for end-to-end here.

Today our extension works as a developer only demo, and no Yahoo keyserver service is online yet. If our toy keyserver code didn't make it into this release, you will see it very soon and will be able to experiment.

We released the source so we can solicit security feedback early, and can keep all security and privacy critical parts of this product in the open. No "just trust us" now or in the future.

Along those lines, we will work with industry peers to build public key registry software that interoperates with other federated providers, is open source, and is transparent in the cryptographic sense. I.e. Yahoo and Google users should be able to send encrypted email to one another with ease, and if either company was forced to lie about the public keys of our respective users we would be caught because math.

There's a lot more in the works, and we have many challenges to overcome to make this generally usable. In addition to the key server, there's not unnecessarily breaking existing mail features, multi-device issues, search over encrypted content w/o providers being able to read it, and mobile support to start.

If you know anyone with the skills and motivation to make strong, usable encryption available at internet scale we'd love to listen, collaborate, or hire. :)

<comment><USER12> Except that we cannot verify that you actually deploy the "open" code. It's obviously commendable that you do development in the open, and have people review the work you do. But there is no way for us to know that you don't run /addNSAbackdoor.sh in your deploy script for key parts of your infrastructure.

There is already published docs that show Yahoo is/was part of Prism since 2008: [http://www.wired.com/2014/09/feds-yahoo-fine- prism/](http://www.wired.com/2014/09/feds-yahoo-fine-prism/)

<comment><USER13> All encryption runs clientside. The whole point of end-to-end is that you don't have to care about who the message passes through.

Your actual worries at this point are the key exchange (impersonation) and extension distribution.

The first is very hard to get right without alienating a large number of potential users, the second seems perfectly possible to have verified but seems like it's going to require some kind of changes in the Chrome extension system.

<comment> m-app It doesn't have to pass through anything but if the '/addNSAbackdoor.sh' script just adds a routine to the code that adds the Public Key of an NSA owned key-pair before the encryption process, then the NSA can pick it up from any Internet-tap they have and decrypt it.

<comment><USER14> Except that this runs locally, so if you're worried about that, you can build it yourself.

</comment></comment></comment></comment></comment></comment><comment><USER15> It is worth noting that the Yahoo! devs do not promise OpenPGP (RFC 4880) compatibility in the future.

</comment><comment><USER16> now take my public and private key Yahoo!</comment>


I'll Take 2 MasterCards and a Visa, Please - <AUTHOR> http://krebsonsecurity.com/2010/09/ill-take-2-mastercards-and-a-visa-please/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+KrebsOnSecurity+(Krebs+on+Security) When you're shopping for stolen credit and debit cards online, there are so many choices these days. <comment><USER2> Wait a minute... there's a website advertising stolen credit cards for $1.50, and the author is complaining that they tacked on an extra 0.60 fee?

I'm pretty sure this article was written with tongue firmly in cheek, but it's just so... out there.

I dare the author to make this $2.10 purchase using one of his own valid credit cards.

<comment><USER3> Hmm..I wonder if there is a way to charge the $2.10 to the card that you are purchasing.

</comment></comment><comment><USER4> If I were a bank, I would be buying as many of these as possible and canceling them before someone else buys them. $1.50? That's the fee on like one transaction!

<comment><USER5> Amusing response on the thread to this same proposal - "The cynic in me suspects that the net profit they make from allowing fraudulent transactions to go ahead exceeds the costs associated with preemptive cancellation, particularly since they try to make the merchants eat the costs of fraud as much as possible."

Obviously this is just cynicism. I assume the main reasons are 1) imagine justifying that to shareholders, 2) it creates a market.

Having said that, the banks could offer a "reward" system for anyone who manages to report a stolen credit card number.

<comment><USER6> How exactly will a bank make money on a fraudulent transaction? I had my accounts emptied and had the bank give me back everything that was stolen. I fail to see how thousands of dollars being reimbursed is a profitable model.

<comment><USER7> Your mistake is in assuming the bank is who reimburses their account holders for stolen funds. It's not. Every store your card/account was used at was forced to return those funds to your bank, even if they already provided the products or services that were purchased. They also each had to pay a chargeback fee (usually $15-20).

Say your credit card is stolen, and used to purchase 5 items from 5 stores. Each of those 5 stores will be forced to return all of the money they charged, no matter how impossible it might be for them to know the credit card was stolen. They will also collectively pay $100 in chargeback fees to your bank, which is likely more than it cost to move the couple pieces of paper it took to handle the situation and inform the customer.

The bank has now made a profit.

Each store that accepted the stolen credit card has lost:

\- The payment they accepted

\- The transaction fees paid on the payment they accepted

\- The product they shipped, potentially hundreds or thousands of dollars

\- The chargeback fee

And if chargebacks ever amount to more than about 1% of any of those store's transactions, their processing fees can go up, they can have their cash flow abruptly cut as a reserve fund is created to hold their future charges for some time, or they can lose their ability to accept credit cards entirely.

<comment><USER8> That's not true. This clearly depends on the country you are in, the payment processor you use, and the type of credit card you got. (eg with chip or no chip).

<comment><USER9> Which part isn't true?

Also chip or no chip doesn't matter for online/telephone/mail order purchases which I would guess would be the only place you can use this stolen credit card info.

<comment><USER8> That you don't get your money when somebody pays with a stolen card or does a chargeback.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> This is a direct consequence of the global near-real-time credit card payment authorization system being the Biggest Ball of Mud design you can imagine. Clearly, at each and every stage of getting to where we are now, people did the bare minimum of change to add new functions to the system.

The other aspect of the problem is the length of time the NSA sat on public key encryption. It's within the realm of possibility for credit card companies to have used public key encryption to at least validate that the human user of a card number knew something, a PIN or whatever, related to the card number. The payment authorization system grew up without that math, so it pretty much depends on everyone (like the call center reps or the programmers of shopping cart software) keeping the card number and the CID/CVC/CVV secret and off their disks.

<comment><USER11> What does public key encryption have to do with it? Password or pin + salt + hash function like MD5/SHA would be all it takes to securely verify that the CC holder knew a secret.

</comment></comment><comment><USER12> Am I the only one who finds it shocking that it's apparently so cheap and easy to buy stolen credit cards? Why are the law enforcers (or the banks, or other appropriate organizations) not going after these "re-sellers", atleast to find/track the original thieves?

Or am I missing something? Are these cards all (or mostly) deactivated? And so the buyers are not using them directly, and rather using them as leads/information to do some other nefarious activity?

<comment><USER13> > Why are the law enforcers (or the banks, or other appropriate organizations) > not goiging after these "re-sellers", atleast to find/track the original > thieves?

Um, who says they're not?

<comment><USER14> I know someone who works for an insurance company that covers credit card and identity fraud. They are actively monitoring these sites for their costumers information. Even though that's a private company, I wouldn't be surprised if government organisations do the same.

<comment><USER15> And following LeCarré, I could easily envision some entities searching for and holding certain of these acquired credit card numbers in reserve, should there be a need to charge p*rn or some financially questionable charges onto those account holders they care to call into question.</comment></comment></comment></comment>


Imperial Wars Always Come Home - <AUTHOR> https://patrickwyman.substack.com/p/imperial-wars-always-come-home <comment><USER4> I agree with the article's title but much less with its content, which seems to claim that returning imperial soldiers will always cause some sort of trouble for the (soon to be former) empire.

I think it's quite telling the author had to go back to the 15th century to find a historical precedent for his claim. Especially since the Hundred Years War could be described as many things (succession war, civil war...) but certainly not an imperial or colonial war. Why not take an example from the end of the British Empire, the French Empire or the Japanese Empire - <USER2> great colonial powers in the 20th century? Or Spain, Portugal and Netherlands before that? Because they are very few. I can only think of the loss of Algeria and the coup attempt by the French military in that context - but in the end that hardly destabilized the country.

<comment><USER5> >I think it's quite telling the author had to go back to the 15th century to find a historical precedent for his claim.

To me, it is just a period with an anecdote the author was familiar with. The War of the Roses, while an important event in British history, isn't the type of nation destabilising event you're looking for either. It is yet another succession crisis that happened in monarchies time-to-time that was militarised. The argument being that the militarisation is the result of failed foreign military campaigns.

>Why not take an example from the end of the British Empire, the French Empire or the Japanese Empire

All fell more or less as a protracted result of the Second World War followed by the Cold War. I don't think that is comparable. The Vietnam War and the cultural effect it had on the US probably more apt. That is probably where this first began, and then continued with Afghanistan and Iraq.

>Spain, Portugal and Netherlands

The history of both Portugal and the Netherlands are quite intertwined with Spain and its (ie. the Hasburgs') imperial ambitions. Take the War of Spanish Succession for example, the Spanish ceded what was left of the Spanish Netherlands (after the Dutch revolt) to Austria, and arguably had much more impact than the War of the Roses.

It's a widely accepted view that the imperial activities of these powers in foreign lands (both in Europe and beyond) aggravated the conflicts in Europe over several centuries, culminating in the World Wars.

<comment><USER6> How about the Weimar republic after the end of World War I? Even though that's not a very apt comparison either.

It feels like the author tries to draw historic parallels with current events, which is always a tenuous exercise at best.

<comment><USER7> The Blutmärz Era was quite different too, there a social democrat administation asked for, or at least tolerated, the aid of right wing forces (Freikorps) to stop significant strikes of Spartakist Communists, about 2000 of them were killed. That schism and distrust on the left also significantly helped the Nazis a decade later in not having a unified left to their opposition.

The conflict here was a fundamantal post war struggle about the course of action in the first ever German Republic. Germany was not an established Empire like the others either. It was not even 50 years since the German Unification 1871 under Prussian Dominance.

[https://en.wikipedia.org/wiki/Berlin_March_Battles](https://en.wikipedia.org/wiki/Berlin_March_Battles)

</comment></comment></comment></comment><comment><USER8> The phenomenon is best explained the other way.

An imperial ruler losing a war, let alone an underhanded one, is most clear signal to Brutuses in waiting that the empire is weakened, demoralised, and it is "now, or never."

The later is the most important. The moment the emperor start to reconsolidate power, the first ones whose heads, or wallets he will reap will be them — nobles of uncertain loyalty, who usually thrive under such circumstances.

Almost as a rule, empires do not fall when their oppression peaks, but, after it, when they run out of steam to maintain pressure, and they are crushed by all old adversaries springing up at the same time.

</comment><comment><USER9> It's odd to me, the need to over-complicate things like this. We've had escalating protests like this for 10+ years, plus recurring bursts over the last literal century. And the conclusion is... it's the Iraq war causing all this?

We had active, publicly-supported policies in place to militarize the police before Iraq and Afghanistan. The last civil rights movement included much more violent anti-protester crackdowns than Portland (Kent Stake & Selma come to mind, let alone the implicitly-supported KKK). Hell - who remembers the images from Ferguson 6 years ago?

Just because sh*t is going down doesn't mean it's the barbarian hordes marching on Rome. This has been going down for a WHILE. The president hasn't changed that.

</comment><comment><USER10> The fatalism around America's relative decline is so tiring to read about. Apparently the only thing that can occur is a sudden and disastrous collapse of Pax Americana, even though as shortly as 15-20 years ago America enjoyed total and complete hegemony over the rest of the world (militarily, economically, politically and culturally).

That period was a historical fluke, in my opinion. At no other time in human history has one nation been as powerful and influential as America was, and to a certain extent continues to be. To assume that its relative decline can only continue and exacerbate and end in complete and utter disaster in our lifetimes reads to me as simplistic binary thinking.

<comment><AUTHOR> The system can of course continue to grind & lurch for a very long period of time. However, here we have a global forcing function: climate change, and the likely mass refugee crisis. America is not set up politically to welcome those refugees. The plan is to let them die at the border. It's unlikely a sizable portion of the American population will accept this solution.

<comment><USER11> The United States welcomes more immigrants than any other country in the world with fewer restrictions on who can immigrate than any other country in the world. What more can America do?

<comment> grey-area That's not true any more.

The US is now actively hostile to immigrants - travel bans (prior to covid19), border walls, detention camps, separating young children from parents, denying visas for students with online courses (the government wanted this, the courts stopped it). That may change, but the current US administration is very hostile to immigration.

<comment><USER12> The US has always been hostile to low skill immigrants. Reading the civil laws in any "progressive" northeast state is basically a big game of "were they trying to screw the Irish or the Italians back when they wrote this."

<comment><USER13> The US is among the least hostile developed nations when it comes to low skill immigrants. Few other nations allow them in, much less in such massive numbers. Half of all US immigration is low skill chain migration. The US is one of the few developed nations not operating primarily on a merit-style immigration system.

See: Canada, Australia, New Zealand, Sweden, Denmark, Norway, Finland, Austria, Japan, South Korea, Germany, etc.

Just try immigrating into those countries and becoming a citizen if you can't support yourself and or are low skill. Good luck, you'll need it.

</comment></comment></comment></comment></comment></comment><comment><USER14> Maybe I'm imposing my own, um, _biases_ , onto the OC: methinks many of the replies here are wide of the mark.

It's pretty simple. The costs and consequences of war will be felt at home as well as abroad.

First, creating a weapon means it's more likely to be used. An underlying feared consequence of the military industrial complex is that the build up increases the _potential_ for violence at the expense of diplomacy.

Second, the wages of war are paid by the people. Returning veterans discarded by the war machine. Families ravaged. PTSD, addiction, domestic violence, broken homes. Etc.

Third, everyone's keying off the title, is the chaos in the aftermath of war, every where. The OC gives a historical example. This story is as old as humanity. I have nothing new to add here, but will note that some tried to mitigate these effects with stuff the League of Nations & United Nations, the Marshall Plan, and so forth. Stabilizing institutions which have been under continuous attack, from before they were even enacted.

Those who ignore history are fated to repeat it, cliche, blah blah blah.

</comment><comment><USER15> A related insightful take by Jacob Levy (an important political theorist) on the capacity of border lawlessness to undermine the rule of law at home: [https://www.niskanencenter.org/law-and- border/](https://www.niskanencenter.org/law-and-border/)

<comment><AUTHOR> Very clearly written, excellent read. Thanks for linking.

</comment></comment><comment><USER16> This completely off topic but the author has a long and detailed podcast series on the fall of the roman empire.

[https://wondery.com/shows/the-fall-of-rome- podcast/](https://wondery.com/shows/the-fall-of-rome-podcast/)

</comment><comment><USER17> I think there is a simpler explanation for the fall of empires: They are built on assumptions about the world in which they are founded, and they come with coping-mechanisms to deal with the kinds of problems that their founders expect them to face, based on their own experiences and their understanding about what went wrong in previous empires. In this way they are like a code base, built to be easy to extend in the ways where extension is expected, but rigid in the directions where it is not. But the world changes, and eventually it will change in ways the founders could not have predicted, and which the empire is incapable of fully adapting to. Not only that, but as the empire grows, power is concentrated in its midst, so it becomes more and more lucrative to game the system, to find ways of exploiting the rules and institutions of the empire to gain access to this accumulation of power. (In startups this is similar to when the MBAs start running the company and all the creative people leave). These adversarial attacks further break down the coping mechanisms that were supposed to help the empire adapt to a changing world. It leads to consolidation and inflexibility. And as the center of power increasingly attracts those with no interest in the sustainability and well- being of the empire, unrest increases as the common man loses faith in the empire, and its ability to deal with the issues of today. The empire is now in crisis, and it will either adapt through a massive change (a civil war that is swiftly resolved, a 'New Deal' or similar) that 'resets' its alignment, and makes it capable of change in new needed directions (not unlike a pivot in startup parlance), or it will fall apart (typically through a civil war that never really ends).

The US has managed to survive several such crises (e.g. the Civil War and the Depression) but there are many ways in which the coping mechanisms that its founders created have been hamstrung. The 2nd amendment made perfect sense when the biggest perceived risk to the wellbeing of your citizens was a foreign tyrant occupying their land - but today it is far, far more likely that you will be shot by your neighbor. Guaranteeing free speech makes perfect sense, but the founders never predicted a world of multimedia broadcast, where the person or company with the most money can drown out the speech of everyone else. Letting everyone be free to pursue happiness on their own is a great principle, but it never predicted a world where people and corporations could be rich enough to suppress social mobility as much as an aristocracy does. The three branches of government were supposed to provide checks and balances on each other, but this breaks down when massive partisan polarization puts the executive and legislative branch in bed with each other, and they join forces to appoint politically motivated judges. The electoral collage, a mechanism that was supposed to prevent the majority from ignoring the will of the minority instead became a tool for the minority to ignore the will of the majority. The list is long.

As an outside observer, I really hope the US can pull through its current crisis (the world could do with fewer empires, but I don't particulalarly want the stage to be left for China or Russia instead). But as far as I can tell, it requires not only that the US changes, but also that it changes the ways in which it can change. That's a tall order considering the current state of affairs.

</comment><comment><USER18> [https://twitter.com/LegendaryEnergy/status/12875467381069824...](https://twitter.com/LegendaryEnergy/status/1287546738106982400)

</comment><comment><AUTHOR> This phenomenon was also described by Foucault, and is now usually called Foucault's Boomerang[0]:

 _" It should never be forgotten", Foucault said, "that while colonization, with its techniques and its political and juridical weapons, obviously transported European models to other continents, it also had a considerable boomerang effect on the mechanisms of power in the West, and on the apparatuses, institutions, and techniques of power. A whole series of colonial models was brought back to the West, and the result was that the West could practice something resembling colonization, or an internal colonialism, on itself"_

On a practical note there isn't anything mystical or karmic about this. If you have a bunch of people with experience acting in a certain way in an overseas setting, and then those same people come back to positions of power in a domestic setting, they're going to act according to their past experience. If you have a surplus of weapons, armor, and vehicles developed for overseas engagements being given out to domestic police forces, they will be used according to their design.

Sometimes the link is even direct and explicit: Israel trains American police forces in tactics they've developed in Palestine[1].

[0] [https://www.opendemocracy.net/en/opensecurity/foucaults- boom...](https://www.opendemocracy.net/en/opensecurity/foucaults-boomerang- new-military-urbanism/)

[1] [https://progressive.org/dispatches/us-police-trained-by- isra...](https://progressive.org/dispatches/us-police-trained-by-israel- communities-of-color-paying-price-shahshahani-cohen-191007/)

<comment><USER4> _A whole series of colonial models was brought back to the West, and the result was that the West could practice something resembling colonization, or an internal colonialism, on itself_

I keep thinking a lot of today's identity politics are the direct result of colonialism and its racial hierarchies. A lot of post-Apartheid South Africa's affirmative policies transferred some of the priviledges of the former whites to the groups that Apartheid had marginalized, but the legitimacy of identities developed by a colonial system were never really questioned. (Saying this as a coloured man, who still can't see how such a category could ever be considered meaningful).

You could even say that affirmative action evolved as a kind of colonial science of imperial management. Following brutal colonial repression and subsequent rebellion in the late 19th century European empires adopted a softer type of rule that - on the surface - provided more advantage or more recognition to colonized people. Japan itself learned the technique from Europe and implemented a similar ruling style for its Empire until WWII, giving more visibility to Manchu, Koreans... and representing itself as a multicultural Empire. A historian called the USSR the "Affirmative Action Empire"[0] because this was their preferred way to maintain control over minorities while giving them the sense that they could "make it" in the Soviet Union.

I think affirmative action dates back to the 60's in the US, which follows its rise as a global empire with the Japanese occupation, Korean War, Vietnam War and influence over South America...

[0][https://books.google.com/books/about/The_Affirmative_Action_...](https://books.google.com/books/about/The_Affirmative_Action_Empire.html?id=rdlSX2hsb1kC)

</comment></comment><comment><USER19> Empires fall. Always. Good riddance. Either fall or transition into a normal state. Quit wasting time imperializing.

</comment><comment><USER20> First comment is good:

 _Always appreciate your insights Patrick, but you are completely off base here. USA has far fewer working age combat veterans now than it did in the 1950s through 1980s, and violence isn 't anywhere near the levels that pervaded American society from the late 1960s through early 1990s. Trump's harshly criticized immigration policy is quite tame - compare it to the mass deportations under Roosevelt and Eisenhower.

The scenes in Portland and elsewhere are completely understandable - <USER3> black clad rioters are attacking federal buildings. Is the government supposed to let them storm the buildings? No government would allow such a thing to happen, though perhaps the USA will.

America is a dying country, her people destined to be a small & hated minority surrounded by masses of her former subjects. Your own state legislature even recently voted to legalize discrimination against people like you (Assembly Constitutional Amendment No. 5)._

<comment><USER21> > surrounded by masses of her former subjects

You're not supposed to say that part out loud /s

</comment></comment><comment><USER22> >When we see Border Patrol agents wearing camouflage and helmets, carrying M4s with optics, rigged up like they're about to go on patrol in Ramadi or the Korengal Valley (or deal with a migrant caravan in the southwest), that's empire coming home.

The federal agents in Portland are using technology to reduce harm. Over 50 nights they have had mobs trying to come in and destroy a federal courthouse, but instead of reenacting the Boston Massacre, at worst there has been non- life threatening injuries.

Empires and countries grow weak when they divide against themselves. This is obvious, and the main way power structures fall apart. Articles like this are trying to further this division by suggesting that trying to keep a mob from destroying courthouses is authoritarian. Would Putin be so patient as to allow mobs to lay siege to a courthouse for 50 days?

It's unbelievable how hyperbolic the rhetoric has gotten on this issue. My guess is that people like the author are not actually seeing what's happening in Portland. He's seeing what the federal agents are doing, but not what the mob does to provoke these responses. I won't go so far as to say the city is burning down, but if the federal agents left the courthouse to the mob, it would be burned to the ground that very day.

</comment><comment><USER23> > Empire is a spectrum or a continuum, not an either/or proposition, and it's > a little bit like the old saying about pornography: You know it when you see > it. The United States is an empire, and nobody who works seriously on the > subject of empire would be likely to argue otherwise.

What does "empire" mean? I thought it meant "a group of nations or peoples ruled over by an emperor, empress, or other powerful sovereign or government" (from dictionary.com) but clearly he's not using it in this fashion. Is it now another word for hegemon?

If the concept of empire is a spectrum would that mean the US is a very large but relatively very weak empire, as it exerts a lot of influence but little direct control over a lot of its "territory" in the style of other past empires? Does that mean Luxembourg is an empire now, but only at a very very low level of empire?

I guess there's Puerto Rico (and maybe more like that?) – but I don't think this is the sense he means it.

He talks about global military bases making an empire: as both the US and UK have bases in Germany and Bahrain, does that mean that Germany and Bahrain are both part of overlapping US and UK empires? Empires can overlap? Or is the UK too weak and powerless to make an empire - and that means there's now no such thing as a small empire? Does empire just mean "Very powerful and influential country"?

Before I read this article I thought I knew what an empire was and would know it when I see it – now I feel have no idea what an empire is...

I don't mind changing the meanings of words when it makes them more useful - what specific concept beyond "Very powerful and influential" does "empire" now identify?

<comment><USER24> Undisputed hegemon over large portions of the world.

I think you're hung up on the PR fictions -- it used to be, empires would indulge in the fiction of an absolute authority vested in the emperor when of course it was more complicated than that with feudal and tributary relationships. Now, in this political era, we spin things the other direction.

<comment><USER23> That's interesting! So that would mean that as we've studied empires we've realized that they were never particularly about ruling countries directly as we thought (and so as the word originally meant), the important identifying concept behind them was hegemony, power and influence?

<comment><USER24> There's a continuum between direct central administration and tributary/vassal status. The Roman Empire, for example, often had big chunks of land that were entirely run by local people, but were 'part of the Roman Empire' as far as public perception. Look strong and all that. (this went back and forth in different places at different times, sometimes there was very strong central bureaucracy).

The US, by contrast, insists that we're merely allies with all of these countries that host more US military power than they even have domestically, only buy US weapons, trade using our currency, scrupulously respect US intellectual property law, vote with us in the UN nearly 100% of the time.. it's a different political posture for a different time.</comment></comment></comment></comment>


Compiling a List of App Development Frameworks - <AUTHOR> http://allframeworks.net <comment><AUTHOR> Hi all, just started this site today and want to make it better, and perhaps with time expand to other types of frameworks.

Where does it lack, what search filters are missing and what key data should be there that isn't there now?</comment>


280North/Cappuccino modules list comes to life - <AUTHOR> https://github.com/280north/cappuccino/wiki/Modules

<comment><USER2> Nice! Now, any chance of open-sourcing Atlas to speed up the development? =)

</comment><comment><USER3> They should really integrate (or at least link to) their GitHub wiki on their official website. Every time we look into using Cappuccino for a project, the lack of (new or updated) documentation on their website is a turn off (was hoping it would get better after they were acquired).

Compare this [1] to this [2]

[1]<http://cappuccino.org/learn/>

[2]<https://github.com/280north/cappuccino/wiki>

<comment><USER4> We have plans for a new website. Stay tuned. :)

<comment><USER3> Nice! Thanks for the info.

</comment></comment></comment><comment><USER5> Excellent. I've just added a link to an early preview of my library: Sparkles - SPARQL for Cappuccino.

<https://github.com/66laps/sparkles>

</comment><comment><USER6> Would be nice to see some dates on the list so we can see how long the modules have been around or when they were last updated. Otherwise pretty awesome to see Cappuccino is still alive. 280North's website seems dead.

<comment><USER4> The 280North website was never really updated, so it's silly to look there for development updates. The Cappuccino website still receives updates and the Mailing lists as well as the repository are very active.

</comment></comment><comment><USER7> Excited about fist stable release.. Can't wait!!!

</comment><comment><USER8> Really nice idea.</comment>