Unfortunately, we have renewed our ICANN accreditation - <AUTHOR> http://iem.easydns.com/link.php?M=1080600&N=201&L=181&F=H <comment><USER3> You know what would make whois data more accurate? Requiring that registrars provide basic anonymization without any extra fee and build a meaningful process for situations where breaking that anonymization is actually the right thing to do (ie. not an opportunity for collection of bulk mailing address and phone number lists for spammers and phishers).

It would cost the registrars something to do so, obviously, but so does this. And a basic level of privacy should never have been allowed to become a premium service to begin with.

<comment><USER4> For what it's worth Google Domains provides free privacy and a few other things (including up to 100 DNS entries per domain). They cost a little more though.

<comment><USER5> Yea, transferred one domain and it was $10. I haven't heard from them, so I'm assuming it went smooth. After being stalked by Godaddy over the years, I think I developed Stockholm Syndrome? Hay GoDaddy--I will date you again if you bring back coupons for renewals? We were together a lot of years, let's not breakup over money?

(If any Registrar reads this, could you explain the extra cost of providing free whois privacy? It seems like the cost associated would be minimal, and the payback would be huge? I heard the true cost to a company for a .com domain is around $7.00? Go ahead and add one or two dollars to the domain for profit. Just be consistent, honest, and no shenanigans. Oh, I looked into Gandi--and they are just to much money.)

<comment><USER6> Funny enough, Laurent Chemla (Gandi's founder) did publish an essay in 2002 called "I am a thief", denouncing registrars' artificial prices (Gandi did cut prices at that time).

An extract [FR] : [http://www.chemla.org/textes/voleur.html](http://www.chemla.org/textes/voleur.html)

</comment></comment></comment></comment><comment><USER7> I have a small number of domains (about 15 at last check) - and most of them have a mailing address from 16 years ago. If all they verify is email, why does this process have any value? It's not like you can't (A) Spin up a random mail server in 30 minutes, or (B) save yourself the trouble and just use mailinator.

This, finally, is the most pure form of security theater I have ever seen. There is no possible argument that this would deter any bad actor from doing bad things with their DNS domain - totally useless policy.

<comment><USER8> It has value to _you_. What are you going to do when you get a default judgement against you and get your domain(s) transferred away from you because you decided to be cute and put 123 Elm St. for your address, preventing service of process?

<comment><USER7> The comment I was referring to was that sentence about working with LEAs to ensure accuracy.

If I really have concerns about losing a domain in a legal process, (I'm a corporation, or ongoing business) - I would use the services of a domain name portfolio management company, like MarkMonitor. [https://www.markmonitor.com/services/domain- management.php](https://www.markmonitor.com/services/domain-management.php)

<comment><USER8> MM doesn't appear to protect you against attempted trademark-infringement claims.

<comment><USER7> Trademark/Intellectual property claims, in both directions, are one area of MM speciality.

 _Domain Services

As a full-service, corporate registrar, MarkMonitor offers a complete range of domain services:

.Brand Registrar Services Trademark Clearinghouse Services Registrations, renewals and transfers Domain recovery, snapping and masking Enterprise DNS UDRP administrative services Local presence Domain locking Mission-critical domain security, including Two Factor Authentication SSL certificates_

Check out [https://www.markmonitor.com/solutions/role_based_solutions-l...](https://www.markmonitor.com/solutions/role_based_solutions- legal.php) for some of the services they offer.

<comment><USER8> As far as I can tell, they only deal with trademark assertion, not defense.

</comment></comment></comment></comment></comment></comment><comment><USER9> Coincidentally, the service some registrars use to do the verification (wdrp.name-services.com) is down right now. How much fun must it be to watch your business taken off the 'net because you _can 't_ click a "this information is accurate" button.

<comment><USER10> When it is up, navigate to name-services.com and see the most dodgy shady looking site. It does nothing to instil confidence in this process.

I had to spend a good 30 minutes trawl through Dreamhost's forums to get an official "OK" that this was a legit email.

<comment><USER11> eNom are owned by Demand Media, so that's pretty much what you can expect!

<comment><USER12> Actually, they are no longer owned by Demand Media, rather they are a brand under Rightside.

<comment><USER11> It's barely worth differentiating between Demand Media and Rightside Group (and Donuts, for that matter).

</comment></comment></comment></comment></comment><comment><USER13> Somebody needs to create a service which does the following:

\- gives you an email address for the whois as a proxy

\- automatically follows the link given in the email and clicks the stupid button

\- waits for the confirmation email

\- if after 48 hours you haven't received confirmation then the system escalates it to a human proxy to click the stupid button (Turk maybe)

Reminds me of Lost

<comment><USER14> Let me upgrade that service:

\- Generates real-looking names

\- Generates a "social live" across the internet, with pictures, Linkedin profiles, and "friends"

\- Generates "obviously valid" email addresses

\- Provides an email forwarding service to your real address as above

\- Provides a "Post office box" pseudo-service so that you can add that as your "real address"

\- Generates extensions for a (800) we all can use to as to protect our real phone numbers

\- Signs up to your registrar's information and updates it

You just got yourself a "valid" info set in the eyes of ICAAN (without having to pay anon services).

<comment><USER15> "\- Provides an email forwarding service to your real address as above"

Another suggestion - the service keeps a public gpg key you supply, and posts the email, after encrypting it to you, to usenet/pastebin/wherever searchable (perhaps by the key fingerprint?), and maybe publishes notifications of that somewhere distributed (maybe a has tagged Tweet where that hashtag is the key fingerprint?)

Sign up over TOR, and you could have a pretty good "air gap" between you and any messages it receives for you. Wouldn't matter if they get subpoenaed or NSLed - they'd never be able to see who's _reading_ those messages.

</comment></comment></comment><comment><USER16> I've already started seeing spam and phishing attempts for official-looking- but-fake whois verification emails. It was obvious that this was going to happen when ICANN first announced this new requirement, and I'm only surprised that spammers haven't been even more on the ball about it.

We haven't yet begun to see how ugly this stupid new program is going to get.

<comment><USER17> It goes without saying but I think we're rapidly getting to the point where Law Enforcement Agencies are the bad guys.

<comment><USER11> If you think the current WAP is bad, you should've seen what the LEAs were originally demanding registrars implement! _shudders_

</comment></comment></comment><comment><USER18> Can we just agree that either now or in the near future the idea of thought or expression without attribution is a thing of the past. Something that our grandparents internet had but not for us.

This slow crawl of both policy and protocol toward greater bureaucracy will have a much more permanent effect than say the NSA/GCHQ spying.

<comment><USER19> not really. Although generic internet users keep making the internet a "safer space" , there will be a critical point when a fork will occur for those who still think the internet can be interesting.

<comment><USER20> Reddit can be seen almost as an anonymous fork to some degree. Obviously it doesn't share the same network concepts, but the spirit of anonymous information sharing is there.

<comment><USER21> Reddit has already started closing its most controversial subreddits. Expect it to continue to "clean up" as it grows. It's a business after all.

</comment></comment></comment></comment><comment><USER11> The whois accuracy program is such an enormous pain in the arse. It's worthless junk law-enforcement agencies demanded be included in the 2013 RAA that will have _no_ useful impact on anything. It's just a massive resource drain on registrars.

<comment><USER22> > It's just a massive resource drain on registrars.

And on their customers.

<comment><USER11> Yup, but for customers, it's just a periodic annoyance. For registrar, it's a constant support overhead. I expect domain pricing to increase as more registrars have to move over to the 2013 RAA.

Nobody's happy with this crap.

</comment></comment></comment><comment><USER23> I still have a really hard time with the idea that a domain needs to have "valid" or "meaningful" whois data at all... ...and now there's this? Sounds like a fishing windfall.

<comment><USER24> I _wouldn 't_ have a problem with it if the data weren't so easily to crawl and parse by spam-bots and robo-callers. Ever since switching away from an whois-anonymization service for one of my domains, the amount of spam letters, emails, and robocalls from telemarketers I get has increased more than ten- fold.

For some reason people assume that these whois-anonymization tools are just used by squatters and spam websites, but I use it to someone overloading my physical/digital/voice mailbox.

</comment></comment><comment><USER25> I also got such eMails lately and was wondering, because I could find no connection between the web-address linked to and the company I was ordering from in the first place, nor any registering authority!

I also asked the company and they said that it was legit, but came from some kind of service provider.

Finally, the web site, I was directed to also looked very suspicious and less than professional (something, a hacker could have made up in a weekend -- and again no names, logos or information that could make up a connection to my business contacts).

I really would appreciate, when they could make the process more transparent and less phishing-prone -- so anybody could make up a nice sounding domain and fire eMails to people with domains ...

Somebody could think, that domain registration authorities have at least basic knowledge of internet threats ...

</comment><comment><USER26> I have a domain registered under my real name and personal email address. Coming away from the article, my understanding is that my domain is liable to sniping if I step away from the Internet for more than two weeks (e.g., I go on a trek into the jungle somewhere) and don't take steps to have a friend or colleague keep tabs on the issue. This seems like a straightforward and obviously undesirable scenario; I wonder what came up in the ICANN consultation when it was discussed.

<comment><USER27> I believe the two week timer only starts if you initiate a domain transfer, modify your domain's WHOIS info, or have a renewal notice bounce. 2/3 of this are forces that are within your control, so you can at least plan around that.

<comment><USER28> Further, I beleive that if it does happen, your domain is just suspended, i.e. set to not resolve, and isn't available for anyone else to register/snipe.

</comment></comment></comment><comment><USER29> This is a big opportunity for registrars to make their customers feel safer: "We will go to extra lengths to make sure you don't lose your domain this way. We will pick up the phone and call you."

<comment><USER30> Yeah, like I need my registrar calling me all the time. What if you have several hundred domains? Are you really going to call and harass me about each one?

<comment><USER29> Sure, but you always have a few Truly Important domains, that you DO NOT want to lose. This is about those. An easy solution would be to charge you a few bucks more for domains you designate as Important.

</comment></comment></comment><comment><USER11> Oh, and one other thing: while other registrars tried to resist stuff like this being added to the 2013 RAA, EasyDNS were one of the registrars that sat on the sideline and did nothing.

Let's just say I don't have too much time for their moaning and griping now. They should've engaged with the registrar constituency back when the negotiations were happening.

<comment><USER31> We're in the RRSG now, we joined last year (better late than never) - <USER2> said - speaking as somebody who has been on the CIRA board and involved in early ICANN Whois TF, there isn't a lot that can be done about it. Registrars are pretty much a captive audience with zero power wrt ICANN and governance in general.

<comment><USER11> As individuals, yeah, but I know plenty of what goes on behind the scenes, and what goes on in the mailing lists is only a fraction of the story. A savvy registrar can have plenty of soft power if they know what they're doing.

BTW, you should get involved in the IETF provreg and eppext WGs: we need a stronger registrar voice there, and the more registrars involved, the better.

<comment><USER31> Time constrained lately but happy to look at it, shoot me an email ( pretty easy to find it )

</comment></comment></comment></comment><comment><USER32> I wonder if it would be worth having a way to expressly request that easyDNS (and any other domain provider following this policy) send a test email for your accounts? This would be an email that looks like the one they'd send for this program (as close as possible to ensure spam filters treat it the same) but is labelled somehow as a test. This way you can make sure that a) the email address on file works, and b) the email will make it past your spam filters.

<comment><USER33> Why need it be a test? If verification just needs a click on a link it doesn't seem very onerous to require that click. If the mail doesn't arrive, you know you have a problem with a deadline NOW, instead of a randomly appearing problem in the future. The former certainly seems better.

<comment><USER32> The problem is you don't want to start the 15 day countdown if you have a problem receiving the email. Yes obviously you'd still have a problem because the countdown could be triggered at any time in the future, but it's still better to not trigger it immediately if you can avoid it.

That said, if the test email bounces, that might be required to start the countdown anyway?

<comment><USER34> The test e-mail is an e-mail from the registrar to the contact address, so if it bounces, the register is then required to send a real e-mail to that address, which will presumably also bounce. _Then_ the countdown starts.

I have very little expectation that the boneheads who came up with this scheme considered this possibility, and therefore exempted test e-mails from the bounce-trigger requirement.

The imaginary black-hat that hangs out on my left shoulder has already suggested that spoofing a bounce message for a correctly delivered registered e-mail could be used for mischief. Phishing the domain customers is entirely too obvious for him, though the imaginary white-hat that hangs out on my right shoulder seems quite concerned about it. They both agree that black-hat wins this round.

</comment></comment></comment></comment><comment><USER35> On the bright side, this will really breath new life into the domain sniping/blackmail economy!

<comment><USER33> How? By finding bugs in the interface that allows hostile users to set new values for the email address at the registrar and using this for triggering the 15 days period?

<comment><USER36> Why bother with looking for interface bugs? Domain owners have been told they risk losing their website if they don't respond to requests for confirmation of the details of their domain name. So how about I send some emails asking them to urgently pop by my website, which looks very much like the registrar's website, and log in to update their details?

Or if I didn't want to do anything actually illegal, I'd probably have an enhanced chance of success in pulling off the Domain Registry of America scam and convince people they must update their details [by transferring to my registrar] in the next 15 days.

Seems almost certain to become the most frequent uses of the contact details ICANN has kindly ensured will be up to date and accurate.

</comment></comment></comment><comment><USER37> What a completely worthless process.

<comment><USER38> The post sure does a lot to paint it that way; makes you wonder what, if anything, is the counterargument?

<comment><USER33> To me, one issue seems to be that ICANN dares to demand of the registrar that they must verify the contact information that is REQUIRED to be present in a registration... that's not really a sane stance to have when you sell a subscription to what is basically an identity, so lets put that aside.

One other complains is that this verification procedure is really weak: "just send a mail with a link to the address provided"

Imagine if ICANN changed their rules so that a more substantial verification process of the MANDATORY fields was required? Like if they didn't make it optional to verify the telephone number, what would easyDNS do then? From their post, I presume they would go insane, declare Holy war on the ICANN, and then start assaulting ICANN officers with the sharp edges of their ibook 12"

They also complain that its a huge phishing opportunity because they must send mails with a link for people to click, but according to the ICANN spec they link to the actual requirement is[1]: """ [...] sending an email requiring an affirmative response through a tool-based authentication method such as providing a unique code that must be returned in a manner designated by the Registrar """ So the mails looking very phish-y is entirely their their own choice, the spec does not mandate that the title is "Look at these funny pictures, friend" or anything.

Finally, they complain this will lead to a lot of big sites going down because they are forced to suspend domains if people don't take certain action within a certain time (although they don't clearly argue that the time is too short or something like that). But big sites already go down because the dns owner has been negligent with their interactions with their registrar, like failing to pay their fees for instance.

So this is not a new type of problem really, you actually already have good reason to read the mail from your registrar, who knew? (Not Sony online: [http://www.pcworld.com/article/2454820/sony-gaming- websites-...](http://www.pcworld.com/article/2454820/sony-gaming-websites- down-over-unpaid-bills.html))

[1]: [https://www.icann.org/resources/pages/approved-with- specs-20...](https://www.icann.org/resources/pages/approved-with- specs-2013-09-17-en#whois-accuracy)

<comment><USER11> I don't blame ICANN for this: this demand came from the law-enforcement agencies. I know that internally, ICANN would've been happy sticking with the existing WDRP process.

<comment><USER39> What is ICANN's motivation for complying with law-enforcement agency demands? Quite a number of them have proven themselves to be bad actors in the past, and there are provisions in civilized society that restrict them from actually demanding things, absent a specific court order. Which shouldn't really apply to an international regulatory body in a prescriptive manner by most standards - and if it gets such orders it needs to leave for another flag of convenience that doesn't cripple a global infrastructural standard.

"The Net interprets censorship as damage and routes around it" should be the ideal we aspire to. LEA and intelligence-agency intervention in the Internet system is typically damage to our liberty-printing machine, one way or another. Their incentive structure offers no benefits and poses a lot of difficulties in dealing with a free Internet. Pressure from them should be expected as an open adversary to the free Internet, and defended against.

<comment><USER11> They might've proven themselves to be bad actors, but they're backed by national governments, and that gives them a lot of sway when it comes to these things. LEAs do have a legitimate interest in this kind of thing because domain names can be used for fraudulent and otherwise illegal purposes, which is why they're involved in the process. However, it's up to the other parties to moderate this influence where possible, which is what the registrar constituency fought for in the negotiations.

Believe it or not, what the LEAs were looking for in the first place was significantly more extensive then what ended up in the RAA. Here are their recommendations: [https://www.icann.org/en/system/files/files/raa-law- enforcem...](https://www.icann.org/en/system/files/files/raa-law-enforcement- recommendations-01mar12-en.pdf)

</comment></comment></comment></comment></comment></comment><comment><USER40> I get tons of these WHOIS emails as I build websites for small businesses. The last ICANN email I see regarding WHOIS data accuracy said the following (GoDaddy)

"If you find that your domain contact data is current and accurate, there's no need to take action. If, however, your domain contact information is inaccurate, you must correct it."

This was sent on May 5th - when does this new policy take effect or does it only effect when you renew/transfer/register?

Edit: I RTFA again and see that the date is June 23rd(?)

<comment><USER41> The email you received was a "friendly reminder" to make sure your registrant contact information is accurate. It is officially called a Whois Data Reminder Policy email.

If it was accurate, GoDaddy is correct - there is nothing further for you to do.

If, on the other hand, the email they sent you would've bounced back as undelivered then you would've ended up into the next phase. "Click this within 15 days or else."

<comment><USER42> In fact, GoDaddy in particular (used to?) charge you $25 as a penalty if they determine that your whois information is incorrect. That's the reason I took my domains elsewhere.

<comment><USER43> Let's not forget about SOPA/PIPA/OTHER_PA which godaddy famously support.

</comment></comment></comment></comment><comment><USER44> Rather than be harassed by ICANN emails it would be preferable for EasyDNS to handle any admin issues on a case by case basis. That should, after all, be included in the cost of buying a domain. I always made sure my registrars were handling this on my behalf, and for domains where I was required to submit personally identifiable information; I let the domain expire and die. It's not worth the hassle. I don't work for free.

<comment><USER11> They can't. They're contractually required to contact you about this stuff.

</comment></comment><comment><USER45> Interesting:

[http://www.theregister.co.uk/2015/05/21/icann_ceo_quits/](http://www.theregister.co.uk/2015/05/21/icann_ceo_quits/)

<comment><USER11> Fadi quitting has nothing to do with this. The 2013 RAA was done and dusted before he even started.

</comment></comment><comment><USER46> Are there any avenues open for avoiding being part of the WAP? i.e. are there any registrars the WAP will not apply to?

<comment><USER47> ccTLD registrars do not need to be ICANN accredited (e.g. .io, .ly, .me, .to, etc...)

<comment><USER11> Though some, such as Nominet (*.uk) are bringing in not dissimilar procedures: [http://www.nominet.org.uk/how-participate/policy- development...](http://www.nominet.org.uk/how-participate/policy- development/current-policy-discussions-and-consultations/data-quality-policy)

Many ccTLD registries have stricter policies when it comes to WHOIS data, and actively audit their contact databases for dubious data, place restrictions on contact updates, or actively review registrations and contact updates to ensure that the contact data provided is valid.

.me, .co, .io, .ac, .sh, and a few others, are relatively easy-going. .us is straightforward enough too, and though there are technically restrictions on who can register .us domains, they're not really enforced all that actively by Neustar. I really like the .me registry: they're good people.

</comment></comment></comment><comment><USER48> Phishing attempts using "Click this link to verify your Whois data" in 3... 2... 1...

</comment><comment><USER49> Agreed 'click here to confirm your details on domainadmin.com' looks suspicious. Maybe EasyDNS can send their customers a 'heads up' email to let them know to expect the whois accuracy email?

<comment><USER50> Phishing training companies will actually use this tactic (they call it 'double barrel'), which makes me think that real phishers are already doing this, too. What I think would be better is an email that said to go log into your account to complete the confirmation, instead of following any link in the email itself. It's less convenient, but it's not something that phishers would tell you to do.

<comment><USER49> Sure but domainadmin.com may not have an API to make that possible (they should have one though, and if they don't it's a reasonable criticism).

</comment></comment></comment><comment><USER45> Can we kill the DNS system already and move to something more decentralized?

<comment><USER51> It is decentralized, you can spin up an alternate root right now. The problem has been, and always will be namespace coordination.

You can argue that ICANN could have done better. And part of me still cares, but of course ICANN fucked up the existing root. In the current business and legal climate, it's basically a foregone conclusion.

<comment><USER52> That's not decentralization; that's just moving the single-point-of-failure.

A better system would be something based on a cryptographic blockchain/ledger, like Namecoin. Thus, no reliance on a central authority to decide which domains are or aren't valid; you instead just look at the ledger (which is maintained decentrally by network participants).

<comment><USER53> We can't even deploy IPv6. What's your plan for getting your system deployed in every Internet connected device, including ancient routers without cryptography chops and refrigerators, then transferring the multiple billions spent on the current namespace into your system without conflict?

<comment><USER54> > We can't even deploy IPv6

Actually, all my traffic is v6 by default using Telenet (Belgium) and XS4ALL (the Netherlands). And yes, those are mainstream ISPs. Lots of services, most noticeably Google and thus Youtube, use it by default as well.

We're nowhere near 100% yet, but as the need increases we _are_ getting there.

<comment><USER53> As anyone who knows what you just condescendingly explained knows, anything short of 100% doesn't alleviate the problem that motivated IPv6 in the first place. Until absolutely everything is accessible via v6, we must continue to allocate v4 (or, worse, NAT it all), so we aren't really anywhere.

It was a side point. I'm on dual stack Comcast, so I already knew what you're telling me, and I made the point nonetheless.

<comment><USER54> First of all, sorry, I did not mean to be condescending. People keep repeating we can't do X because we can't even deploy IPv6 and X is an equally large or bigger change. Since I've got v6 for years and am getting it in more and more places, we're getting there alright.

So I do not understand how you can say we cannot deploy v6. You are running dual stack as well, clearly we are on the way there? And yes of course we first need widespread deployment before we can turn off v4 entirely, but the fact that we both have it means that people are getting it and that we can turn off v4 at some point in the future.

And as an aside, we don't actually need 100% exactly: at 99% (or something) it's not going to be cost effective to get v4 addresses for everything anymore and more stuff will become v6-only.

</comment></comment></comment></comment></comment></comment></comment><comment><USER55> What really sucks is that the email some hosting providers are sending out looks really super spammy. If I hadn't paid very close attention and Googled the issue, I would have trashed it. At least in DreamHost's case, they look like phishing emails and the links go to a non-DreamHost domain. But if you dig into the DreamHost support forums enough, you'll find confirmation from a developer there that it is legit.

And that's all you'll find. So who knows. It's a pain in the ass.

</comment><comment><USER19> I dont even understand how ICANN can make that decision which has very dubious benefits. The equivalent would be to require all newspapers to disclose the real name, telephone email and address of everyone who writes an article or puts an advertisement in their pages. I might even get it if ICANN required a private registry with these data; But the useless whois database only serves as a goldmine for spammers that want me to renew my domains for $1000. this is illogical and i m at a loss

</comment><comment><USER56> I haven't used easydns yet (mostly been using namecheap) but this convinces me to give them a try.

<comment><USER57> This pretty much what this posts exists for in the first place.

</comment></comment><comment><USER58> They try and appear to be very open about the whole thing, but no mention as to why they need to be accredited in the first place? Can they just choose not to get the accreditation and still give out .com domains?

<comment><USER59> ICANN accreditation is a prerequisite to be a registrar for certain TLDs, including .com and all new TLDs.

</comment></comment><comment><USER60> I have no problem with the Whois Accuracy Program. Make sure you have up to date whois contact info, or use a whois privacy service if you don't want your contact info public.

Should web surfers have to right to see who owns a domain (via whois) even if the domain owner doesn't publish that info on the site? Should they have the right to (try to) contact the domain owner via the whois and have a reasonable expectation that that email is going to get to the domain owner (even if they choose to ignore it)?

<comment><USER36> If ICANN believed "web surfers have a right to see who owns the domain" it would ban DNS privacy services rather than enacting this bullshit.

I actually think the rights of web surfers are far more infringed upon by being unable to access a website because the contact at the organisation that built and paid for it was on holiday or ignored an email (or possibly didn't even see it because the spam filter thought it looked like a phishing attempt)

I cannot believe you are defending this.

And for the record, as a domain owner I actually _don 't_ think you necessarily have a right to email me or the non-technical administrative contacts to try to sell us similar domains or persuade me to switch to your dodgy registrar. Even if I don't provide an email address there's always the option of taking it up with the registrar if there's a genuine legal issue with the domain or what it points to.

<comment><USER24> As someone who owns a personal website/domain -- not a business one -- I have never been legitimately contacted by visitors via the whois info; but now that I switched away from whois-privacy service I get several letters a week, 2-3 robocalls a day, and hundreds of spam emails a week from bots that spam legitimate whois contacts.

<comment><USER61> I never understood why the .com (.net, .org etc.) domains provide the registrant information via port 43. Denic for example only provides information about Tech-C und Zone-C. The other information are behind a Captcha.

</comment></comment></comment></comment><comment><USER4> I had to do this back when I used GoDaddy just a few months back. I was able to verify all of my domains but one. For whatever reason I'd click on the link in the email, go to the page, verify it then get another email a few days later since I didn't verify it.

Fortunately it was a domain I was going to let lapse so I didn't bother trying to deal with their support but I swear I verified it 3 different times and never once did it say it successfully went through. Very frustrating experience.

</comment><comment><USER62> I literally got hit with this the other day and set it to my registrar as an obvious example of cheap bullshit fishery.

Imagine my surprise when they wrote back, telling me it was legit.

What an awful, awful program.

</comment><comment><USER63> Is there a reason registrars aren't cryptographically signing these messages? That would give everyone a relatively simple way to verify that they aren't forged. I get that not everyone who will receive these messages are technical enough to figure out PGP or S/MIME, but it would be trivial for Gmail, Outlook.com, Yahoo Mail, etc. to put a pretty seal on these signed messages.

</comment><comment><USER64> I think when I get one of these from my domain registered through Dreamhost, it says something to the affect of "Log in and check, if it's OK do nothing", which is much nicer than having to log in and take action (like I have to do with Godaddy). I'm basically not required to do anything.

Is that an option? Seems to sidestep these rules, but these rules seem silly.

<comment><USER31> You're probably referring to what are known as "Whois Data Reminder Program" emails (WDRP), which is a few years old. Also mandatory to send those out, but can be safely ignored (which is what makes this program so much worse).

Even the guy who invented WDRP later admitted it as a useless program which should die. [http://www.circleid.com/posts/20120719_a_confession_about_ic...](http://www.circleid.com/posts/20120719_a_confession_about_icann_whois_data_reminder_policy/)

This is much much worse.

</comment></comment><comment><USER65> So if one wanted to knock over a competitor's business, it would only take to arrange for the owner to be unavailable for a couple of weeks, send this email, wait for the deadline, grab the domain. Profit.

What happens if you become sick or get in an accident and must go to a hospital? Game over?

</comment><comment><USER66> When I registered a domain with Amazon Gandi sent me the verification email and it went to my spam folder. Luckily, Amazon sent me a follow up email saying my domain would be suspended unless I followed the instructions in the Gandi email.

<comment><USER67> > Amazon Gandi

For a moment there, you had me thinking that Amazon had purchased Gandi! But no, I see they are just partnering with them. Phew.

</comment></comment><comment><USER68> disclaimer: I work on a wal-related project for a TLD

Let's not throw the baby out with the bathwater.

Projects like the WAL actually do help prevent the spread of malicious sites. Some TLD registries go into great length to ensure that the identity of their registrants is valid (address, phone, email).

Valid whois data is a necessity when processing some of these cases (from a legal point of view). I see this in practice every day.

The potential burden for the majority of domain owners (those who don't plan to do anything illegal with their little piece of internet real estate) is undeniably an issue, but projects like WAL have very real merit for the internet as a whole.

<comment><USER69> But if all it takes is an email confirmation, how on earth does this prevent bad actors from faking their data? Or use a straw-man?

This looks exactly like security theater to me.

Disclaimer: I may or may not have a domain registered in the name of my cat.

<comment><USER30> It's true. There's honestly no way for these companies to know that "Walter P. Fluffington" isn't a real person.

<comment><USER70> Sure there is. Outsource that verification to someone who already needs to do it, like the local government. South Korea has a pretty poor implementation of this already, but things will only get better over time.

<comment><USER30> Do you honestly think it's feasible to maintain a database of contacts for every country and quasi-political entity in the world?

Secondly, I'm not even sure how you'd reasonably do this in a country like the United States where there's a functioning government if only because there's 50 states plus other territories to deal with. How would you go about verifying that "Walter P. Fluffington" exists and lives at some arbitrary address in Puerto Rico? It seems extremely time-consuming unless you are going to exclude people who have driver's licenses or some kind of government ID issued to them, or are foreign citizens living and working there under a visa of some sort.

This also doesn't even come close to addressing what happens when you register a domain with someone _else 's_ name.

The whole thing is completely pointless. If South Korea can't do it, nobody can.

<comment><USER70> The whole point is you don't verify it. You accept their government-issued identification and verify the validity of that. Currently this is done stupidly by comparing their face to a photograph, but if the demand is there, the process will improve.

Compare to how we verify certificates. Trusted CAs issue certs and we verify the chain of trust.

<comment><USER30> If you're depending on "government-issued identification" you've already failed.

A) What does that even mean? What's considered valid? There's got to be at last 100 different forms of this in the United States alone. How can anyone be familiar enough with all of these forms to verify them? Then consider there's several hundred countries around the world, each with equally quirky identification systems.

B) So the "face to photograph" method of identification depends on someone supplying a photograph of themselves? Since when is this part of the process for applying for a domain name? Secondly, it's impossible to verify that the photograph is of the applicant. Are we applying for domains at the DMV now? What about people who have identification where their face is concealed, or is a woman no longer allowed to register a domain in places like Saudi Arabia?

C) Why should having government-issued identification be a pre-requisite for owning a domain name? What if you're 10 and want "billyslemonadestand.com", paid by Bitcoin?

This isn't a trust issue. Owning a domain name shouldn't be terribly difficult. This isn't like an EV SSL certificate where a notary is going to be involved. Their entire process is complete _bullshit_ and does nothing to improve the security of anything.

<comment><USER70> Uh, yeah. We're not talking about their process. We're talking about how to improve it. AKA by making it not bullshit and by requiring real verification.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER71> Clearly you need to provide a working email address to receive the confirmation. Does anyone know the consequences of providing wrong information anywhere else?

<comment><USER11> Potentially, you can have your registration revoked, but usually the address information isn't checked. If you don't want your information appearing in WHOIS, go with your registrar's WHOIS service, if they provide one. Don't use a third-party 'service', as you'll effectively be in breach of their TOCs (because you've provided inaccurate information to the registrar).

</comment></comment><comment><USER72> Can't we just get Namecoin or another blockchain based service supported in major browsers, so ICANN is no longer a sole monopolist?

</comment><comment><USER73> Invalid link?

</comment><comment><USER74> GoDaddy already follows this!

</comment><comment><USER75> The tl;dr: Respond to an email and confirm your ownership of the domain within 15 days, or your site dies.

I would discourse further on the silliness of this policy, but they stated it best: "You can thank ICANN...because if it were up to us, and you tasked us with coming up with the most idiotic, damaging, phish-friendy, disaster prone policy that accomplishes less than nothing and is utterly pointless, I question whether we would have been able to pull it off at this level. We're simply out of our league here."

<comment><USER31> The clarify - you will need to do this at key events:

* New domain registration

* Domain transfer

* Upon receipt of an NDN (bounce) in some other mailing

We'll be putting together a mini-FAQ based on questions and feedback of this.

<comment><USER11> Also, if you update any contacts associated with the domain.

</comment></comment></comment><comment><USER76> Please don't overlook that ICANN is regulatory capture. The idea you need to pay more than 2c/year for an entry in a goddamnn database and you have to pay a designated intermediary to make that request is, well, lucrative for the intermediaries because there's this massive barrier to entry to setting up in competition with the intermediaries.

Does it look the same as "a seat on the exchange" in the financial world - trade on an exchange, you and your counterparty both get skimmed by a "broker" as well as by the exchange.

Anything to make something as simple as putting a tiny entry into a database more of a pain and hassle justifies the ridiculous fees. The worse they do it the better it works for them. Incentive, yeah, let's make sure this screws up and looks like phishing, then they'll _really_ _need_ us and we can claim to be the _good_ guys with utterly ignorant law enforcement who don't understand what they're asking for being the bad guys.

If this cost the intermediaries money rather than being something that will turn out to be lucrative for the industry as a whole, you'd have a very different result.

Now watch the downvotes and screams from the intermediaries and their apologists. Hi, enjoy your money!

<comment><USER77> _> Now watch the downvotes and screams from the intermediaries and their apologists. Hi, enjoy your money!_

I downvoted you for this grandstanding, not for the rest of your post (which I agree with, for the most part, I think it's a crock). The "conspiracy behind every hedge" rhetoric stinks, and I wish we wouldn't do it here.

<comment><USER76> Oh come the hell on. Not a conspiracy or anything like it. Just pure market forces in the presence of a market failure. Regulatory capture is normal and happens all the time. We should just point it out.

Watch the responses, see whether flagging what I think they will be in advance is a useful thing or not.

Grandstanding from an anonymous account? Really?

</comment></comment></comment><comment><USER78> There's a crackdown on scumbags running businesses without disclosing their identity. Great! That's illegal in many jurisdictions, including the entire EU and California. Finally, ICANN is doing its job.

If you put your real name, address, phone number, and email in your domain registration, and keep it updated, there's no problem. I've had real contact info on all my domains for two decades. I get maybe one phone call a year, two or three email spams, and a letter or two.

Quit whining.

<comment><USER79> What person in their right mind would want their real name, and contact information on a public facing database open to be queried by the entire world? The fact that I have to pay extra money to have a company "Hide" my data is ridiculous to start, I'm just shifting my trust from the entire world to a company who will sell my data or use it for their own purposes.

<comment><USER16> Having your personal information publicly associated with your domain registration is dangerous even if you're not running a controversial domain. There's a scumbag company out there called the "Domain Registry of America" that sends out fraudulent renewal notices to domain holders who have public information in their domain registration.

If you happen to be a not-savvy domain holder, you get a letter that looks like it's for a domain renewal, you fill it out and return it with a check, and that gives DRA the authority to transfer your domain registration.

And getting it back away from them is an unpleasant process at best.</comment></comment></comment>


Forget Electric Cars Says U.K. Parliamentary Report, Get Brits on Bikes Instead - <AUTHOR> https://www.forbes.com/sites/carltonreid/2019/08/22/forget-electric-cars-says-u-k-parliamentary-report-get-brits-on-bikes-instead/#6bfe80e55e7c <comment><AUTHOR> Maybe it's a bit gauche to comment first on your own link, but these quotes from the report seem most salient:

"In the long-term, widespread personal vehicle ownership does not appear to be compatible with significant decarbonization."

and

"The government should 'aim to reduce the number of vehicles required, for example by promoting and improving public transport; reducing its cost relative to private transport and encouraging vehicle usership in place of ownership,' add the MPs, stressing that the government ought to be 'encouraging and supporting increased levels of walking and cycling.'"

<comment><USER2> Well, can you imagine a future where a billion battery powered cars is a possibility on this planet? A billion electric bikes though is not that crazy.

<comment><AUTHOR> That would certainly be much better, and I actually came to the Forbes piece from an article that pointed how little of these rare earth metals e-bikes use compared to electric cars:

[https://www.treehugger.com/bikes/electric-cars-wont-save- us-...](https://www.treehugger.com/bikes/electric-cars-wont-save-us-says-new- uk-parliamentary-report-get-bike-instead.html)</comment></comment></comment>


Yet another pre-installed spyware app discovered on Lenovo computers - <AUTHOR> http://boingboing.net/2015/09/22/yet-another-pre-installed-spyw.html <comment><USER2> See also this discussion: [https://news.ycombinator.com/item?id=10263766](https://news.ycombinator.com/item?id=10263766), which concerns the linked article at Computerworld.

<comment><USER3> Aha! Here I thought this was an anomaly - normally stuff from BoingBoing is stuff I read on HN the day before. I thought maybe this time it was the other way around - we're discussing a BB article. But no, just a more extended circle.

<comment><USER2> On an unrelated note (perhaps mere cathartic complaining): i have the really strong impression that "these days" BB is really just another Buzzfeed-like blog-spam platform. I find that a pity, because about 3 years ago i still considered it one of my favourite places to go for a slightly less technical but nevertheless savvy place, that had political leanings i could get behind. I have the impression that there's really a dearth of solid commentary these days, and that it's mostly videos of cats. Videos of cats _without further comment_ at that, which is worse, if possible.

I am particularly disappointed because in my perception the decline has been relatively steep and abrupt (whereas i would never mourn Buzzfeed or others in the same way, simply because i never had the impression they had quality 'content' in the first place).

Anyway, time to move on i guess. Where else do you HN people get news that isn't necessarily focused on startups or programming? I quite like the New Statesman, personally, but i follow it less closely than i used to because of time pressure.

</comment></comment></comment><comment><USER4> These guys have absolutely zero awareness of sensitive privacy issues. The trample on their customers rights, secretly and obviously maliciously, and they do it over and over again!

I can think of no reasonable response but to abandon Lenovo products entirely.

<comment><USER5> And go where?

<comment><USER6> UPDATE: I've made a huge mistake. seduced by the matte black dark side. Avoid all modern Intel CPU/chipsets (post 2006) if you value your privacy and security:

 _In summary, the Intel Management Engine and its applications are a backdoor with total access to and control over the rest of the PC. The ME is a threat to freedom, security, and privacy, and the libreboot project strongly recommends avoiding it entirely. Since recent versions of it can 't be removed, this means avoiding all recent generations of Intel hardware._

[http://libreboot.org/faq/#intel](http://libreboot.org/faq/#intel)

Original comment follows:

Former Thinkpad fan. I love my new Dell Rugged Extreme. I got the 12. This thing is built the way Thinkpads used to be (complete with the price tag of a used car).

The only thing(s) I don't like about it is the missing trackpoint. I really miss that. And the fact that black-box UEFI is built in (but what do we know about modern microcode anyway, might as well get some ostensible security measures for 'free'). Oh, one more: the "QD" connectors do not accept standard straps/slings -- only insanely expensive (and hard to find) Dell brand straps/handles.

Everything else about it is outstanding. This thing is a brick with rounded, rubber edges.

Drive over it with your truck. (watch the video)

Use it as body armor. (no, don't really)

Go scuba diving in the arctic. (Check out the frozen-in-an-ice-block video on Youtube.. while running on battery.)

The screen is incredibly bright, but it also has a slick quick-kill for all the lights. Just the thing for when a warlord is on your tail. The multi-color LED backlit keyboard looks awesome.

It runs Kali Linux (built on Debian Jessie) perfectly. Everything works, including the touch screen and stylus, out of the box.

<comment><USER7> > And the fact that black-box UEFI is built in

UEFI isn't any more black-box than BIOS in general. Sure, I'd rather run entirely FOSS firmware, but in the absence of that, UEFI doesn't make things any _worse_. If anything, it allows quite a bit more introspection and extensibility. And its core _is_ FOSS ([https://github.com/tianocore/edk2](https://github.com/tianocore/edk2)), just not the versions shipped by board/system vendors.

<comment><USER6> UEFI starts with encrypted code and wraps additional layers of encrypted, signed code around it. It's impenetrable, and purposefully so. That's the practical definition of "black box". It's huge, too, with a much larger attack surface.

[https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_In...](https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Criticism)

<comment><USER7> You say "encrypted" and "signed" as though that's a bad thing. When they're used against the owner of the system, sure; however, they can also be used _by_ the owner of the system to protect themselves. "Only runs authorized code" can be a good thing as long as you're the one doing the authorizing.

<comment><USER6> > "Only runs authorized code" can be a good thing as long as you're the one > doing the authorizing.

<comment><USER6> _as you 're the one doing the authorizing [signing]._

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> The "Lenovo.TVT.CustomerFeedback.Agent.exe" that this article labels as spyware is explained on lenovo's website below. Did the author bother using google? The program reports if you are using lenovo's apps for usage statistics.

[https://support.lenovo.com/us/en/documents/ht102023?tabName=...](https://support.lenovo.com/us/en/documents/ht102023?tabName=Solutions)

"Some applications in the preload collect usage data that is transmitted to Lenovo. This includes statistics about which features/settings are being used and how often they are being used. The data does not include any personally identifiable information (PII). Lenovo uses this information to improve our applications and focus on the features that are being used the most."

Seems reasonable to me.

<comment><USER9> No, burying notification of telemetry systems with unknown privacy impact (and most likely sloppy coding/encryption practices (if any!), as is standard for oems) in a eula that is probably 10+ pages of dense text is the opposite of reasonable.

Yet another reason to just buy macs. Apple doesn't do this shit.

<comment><USER10> I agreed with you until your last line - apple has been doing stuff like this at least sense 2011[1]

[1] [http://arstechnica.com/apple/2011/04/how-apple-tracks- your-l...](http://arstechnica.com/apple/2011/04/how-apple-tracks-your- location-without-your-consent-and-why-it-matters/)

<comment><USER11> Apple wasn't uploading that data to their servers. It was only used locally for location accuracy.

</comment></comment></comment></comment><comment><USER12> rebuttal from reddit [https://www.reddit.com/r/thinkpad/comments/3lz78g/thinkpads_...](https://www.reddit.com/r/thinkpad/comments/3lz78g/thinkpads_send_usage_data_to_lenovo_using_lenovo/cvav8ie)

tl;dr: uploaded data is lenovo program usage only

<comment><USER13> " The behavior is documented in the End User License Agreement that all users must read and accept prior to using their Lenovo system for the first time. The EULA can also be found in the "c:\windows\system32\oobe\info" folder."

Do current machines actually ship with the EULA on paper or require the user to confirm it on first boot? (Not that that makes it a positive thing)

<comment><USER14> > accept prior to using their Lenovo system for the first time

Paper or first boot doesn't matter. While there are other necessary features[1], the _post purchase_ ("shrinkwrap") EULA doesn't have a "meeting of the minds"[2] and thus is not a contract.

A contract isn't a "gotcha" game - the entire point is that there is to establish a _mutual agreement_ between parties. At the time of sale (when consideration[3] is exchanged), there is no EULA. Nothing has been negotiated and there is no mutual understanding of what is required of each party.

In an ongoing attempt to circumvent the first-sale doctrine[4], the software industry has a bad habit of thinking they can throw an offer[5] at someone afterwords and have it count as a contract. They can make all the offers they want, but without another agreement and exchange of consideration[3] it's not a contract.

[1] [https://www.law.cornell.edu/wex/contract](https://www.law.cornell.edu/wex/contract)

[2] [https://en.wikipedia.org/wiki/Meeting_of_the_minds](https://en.wikipedia.org/wiki/Meeting_of_the_minds)

[3] [https://en.wikipedia.org/wiki/Consideration](https://en.wikipedia.org/wiki/Consideration)

[4] [https://en.wikipedia.org/wiki/First- sale_doctrine](https://en.wikipedia.org/wiki/First-sale_doctrine)

[5] [https://www.law.cornell.edu/wex/adhesion_contract_contract_o...](https://www.law.cornell.edu/wex/adhesion_contract_contract_of_adhesion)

disclaimer: see a real lawyer for proper legal advice

</comment></comment></comment><comment><USER15> In some ways, this is why I'm glad the year of 'Linux on the desktop' never came. The last thing Linux (as an OS or community) needs are a tonne of OEM tweaked 'editions' of various distributions shipping with all kinds of garbage.

<comment><USER16> IMHO - this is basically what happened to Android.

</comment></comment><comment><USER17> Rootkits and spyware are an egregious violation of user trust.

One other company with a glaring example was the Sony root kit debacle.

Is there a list of companies who have done things like this? Kind of like storing passwords in free text (for which there is a site to name and shame) it doesn't get the press that it probably deserves to.

<comment><USER18> I could give you my list of companies I know of that won't do things like that with their hardware.

My list contains one name.

For some reason, this company on my list remains a hated company for some geeks. Something about overly restrictive control of the platform, but for me it means having control over my own data, because the platform tries its damnedest to keep bad players from getting inappropriate access.

I won't give the list because doing so seems like a cheap shot. But I think everyone knows what company is on it.

I'm not saying this is the only such company. It's just the one I know of. Others may have longer lists.

<comment><USER19> Yeah, Apple is like that. They charge you a pretty penny, but then they don't feel the urge to nickel-and-dime you through backdoors like this.

The problem with crapware on Wintel is that Microsoft and Intel consumed all the profit from the industry, commoditizing their compliments - OEMs. OEMs then found themselves in a race to the bottom, which has entirely shaped the field and brought about the behavior we've seen. Android is now facing the same problem on mobile - a race to the bottom among the OEMs is bound to produce all kinds of shady behavior.

Apple stayed out of this game entirely, they have thick margins which gives them means to pursue their religion of design, UX, and whatever else they think helps them keep their high-ground spot.

<comment><USER13> If it really is only usage reports for Lenovo software, I wouldn't bet on Apple not collecting data like this, but it is hard to compare since they also make the OS and don't add another component on someone else's.

</comment></comment></comment></comment><comment><USER20> I love Lenovos, owned countless awesome thinkpads and I was teetering between a thinkpad and a System 76 for my next upgrade. This just seals it for me.

[https://system76.com/](https://system76.com/)

Great hardware for the price, comes with Ubuntu but you could easily put a good Linux system on there (ducks flying objects)

<comment><USER21> I'm afraid touchpads are a deal-killer for me. Are there any manufacturers other than Lenovo that do the nub-mouse or something similar?

<comment><USER22> There are some critical patents that Thinkpads use in their trackpoints that ought to be expiring soon:

[http://worldwide.espacenet.com/publicationDetails/biblio?CC=...](http://worldwide.espacenet.com/publicationDetails/biblio?CC=US&NR=5570111&KC=&FT=E&locale=en_EP)

[http://worldwide.espacenet.com/publicationDetails/biblio?CC=...](http://worldwide.espacenet.com/publicationDetails/biblio?CC=US&NR=5521596&KC=&FT=E&locale=en_EP)

[http://worldwide.espacenet.com/publicationDetails/biblio?CC=...](http://worldwide.espacenet.com/publicationDetails/biblio?CC=US&NR=5489900&KC=&FT=E&locale=en_EP)

<comment><USER21> Fuck patents.

Edit: But, thank you for the information.

<comment><USER22> I prefer to think that this means we'll be getting good pointers on not- Thinkpads in 2016 or 2017.

</comment></comment></comment></comment></comment><comment><USER23> This only sucks if you run Windows, sure...

But the fact that the company thinks this is perfectly acceptable behavior because EULA, EULA, EULA...

...means they're just as likely to target BIOS, UEFI and other firmware that do the same thing, no matter your OS.

A breach of trust foments a breach of loyalty, no?

</comment><comment><USER24> [https://support.lenovo.com/us/en/documents/ht102023?tabName=...](https://support.lenovo.com/us/en/documents/ht102023?tabName=Solutions)

</comment><comment><USER25> It sounds like it's sending a list of what applications you have installed and which ones you use. I'm not really in favor of this, but don't iOS, Android, and Windows 10 all do this as a core part of their design?

Obviously it enables all sorts of malicious behavior by the companies and governments they are subject to, but Lenovo seems like they're pretty tame by comparison to the OS vendors.

</comment><comment><USER26> This revelation is minor, but nonetheless unsettling. Previous Lenovo snafus up to this point had specifically excluded the Thinkpad line. Apparently they're not immune from Lenovo's meddling after all.

</comment><comment> at-fates-hands This is why I always build my stuff from the ground up. I feel like people have gotten incredibly lazy with their hardware. As pointed out in the article. the author tosses the hard drive and installs his own software when he buys any Lenovo laptop.

As long as people don't think about their hardware, this will continue to happen. Either build your own, or don't use vendors like this.

<comment><USER27> I wish building laptops was easy.

<comment><USER28> Reinstalling windows on them sure is.

<comment><USER29> That's not enough if your Lenovo laptop uses LSE.

Here's their tool to remove it. [http://support.lenovo.com/us/en/downloads/ds104370](http://support.lenovo.com/us/en/downloads/ds104370)

<comment><USER28> By reinstall I mean fdisk, dd if=/dev/zero

</comment></comment></comment></comment></comment><comment><USER30> Oh even paying customers have long been the product. Just look at printed magazines etc, where the number of subscribers is used as part of the advertisement sales pitch.

Hell, buy/rent a DVD/BR these days and you will likely find yourself with a face full of (unskippable) ads.

Edit:

Welcome to the modern metric laden day. Every waking moment will be measured and assessed by algos and "experts" alike.

</comment><comment><USER31> It makes me wonder if this is the only way to make a profit in the laptop business then perhaps we have bigger problems.

</comment><comment><USER32> I have issue with HP PC in my parent's home. Some customer feedback program will run in background non-stop and can't be disable/uninstall.

But Standard Windows/Ubuntu linux/Mac OS install all phone home and "check for security upgrade" everyday too.

<comment><USER33> Ubuntu? Only if you choose to. And there is a difference between calling home / checking for upgrades and calling home / sending user activity data.

</comment></comment><comment><USER34> Is there any difference when Google/Apple/MS do it?

</comment><comment><USER35> Lenovo is sure trying hard to drive their customers away...

If they insist, all right then, I will buy a Latitude next time.

</comment><comment><USER36> Well, i own a Lenovo Y40-80 and i found it installed on my laptop, what's going on Lenovo?

</comment><comment><USER37> Fudge, I have a lenovo just like the one they are talking about. When superfish came out, I had it and managed to get rid of it with the help of the internet. My question; how do I determine if I have this and how do I then get rid of it?

<comment><USER38> They give the path to the app in the article so you could check for that.

<comment><USER39> its finally happening here. people are just reading the headlines :(</comment></comment></comment>


GNU bc ends 11-year beta test, releases 1.7 - <AUTHOR> https://ftp.gnu.org/gnu/bc/ <comment><USER2> To commemorate this momentous achievement, they're changing the name to `ad`

</comment><comment><USER3> For those unfamiliar with bc, here's the man page: [https://www.gnu.org/software/bc/manual/html_mono/bc.html](https://www.gnu.org/software/bc/manual/html_mono/bc.html)

<comment><USER4> > an arbitrary precision calculator language

Everybody use GNU Guile already :)

</comment></comment><comment><USER5> Here's a handy bc wrapper I picked up somewhere.

        cat /usr/local/bin/solve
        #!/bin/sh
        bc << EOF
        scale=4
        $@
        quit
        EOF

$ solve "4*49+732"

</comment><comment><USER6> Come on guys. Everyone knows real h4ck3rs are using apcalc: [http://www.isthe.com/chongo/tech/comp/calc/calc- mirror.html](http://www.isthe.com/chongo/tech/comp/calc/calc-mirror.html)

<comment><USER7> What reference am I missing here?

<comment><USER8> My high school had Calc AB, Calc BC and AP Calc.

</comment></comment></comment><comment><USER9> What changed from 1.06 to 1.07?

<comment><USER10> Unsure, but it broke compilation of the Linux kernel for me. (linux-mainline on Arch)

<comment><USER11> Why is bc even needed for a kernel compile?!?

<comment><USER12> It replaced a Perl script used to create time constants at compile time: [http://www.spinics.net/lists/linux- kbuild/msg07241.html](http://www.spinics.net/lists/linux-kbuild/msg07241.html)

</comment></comment></comment></comment><comment><USER13> There are very few console programs which thinks they know better than me what I want when I press Ctrl+C and bc is one of them.

</comment><comment><USER14> As someone that has done most my maths using perl during the 90s and lately scheme, I have managed to miss BC completely.

Since some people here seem to use it daily, are there any other reasons to use it than "i am used to it" or that you actually need arbitrary precision?

</comment><comment><USER7> Does anyone know why the default scale is 0 (meaning division rounds down by default)?

<comment><USER15> No idea but initial system setup on every system I touch is to alias bc to 'bc -l'.

I use bc tens of times per day ...

<comment><USER16> I use bc all the time, yet I still managed to miss that option. Thanks!

</comment></comment></comment><comment><USER17> 1.07, actually. Title is wrong.

<comment><AUTHOR> Gah, sorry. Touch-typing failed me again.

<comment><USER18> I believe it should also be a 17-year beta test, since 1.06 was released in 2000.

<comment><AUTHOR> The last beta "release" (which AFAIK everybody has been using) was 1.06.95, in 2006

<comment><USER19> macOS hasn't been. Which isn't surprising, since 1.06.95 switched to GPLv3 (like most GNU projects).

</comment></comment></comment></comment></comment><comment><USER20> In bc 10 / 3 => 3

It yields integer values unless started with -l option. What's up with that?

<comment><USER21> bc has a scale variable, which determines the precision of calculations. By default it is 0, but running with -l sets it to 20 (among other things).

</comment></comment><comment><USER22> Finally! I have been waiting for them forever

<comment><AUTHOR> No announcement on info-gnu or on the bc web page; I only noticed because I was about to download the ancient version to check something.</comment></comment>


Elon Musk reacquires x.com domain from PayPal - <AUTHOR> http://www.domaininvesting.com/elon-musk-acquires-x-com-domain/ <comment><USER2> This is a great move. The marketing alone he is getting is in the 7-8 figures. Everybody already knows the brand. Crazy.

</comment><comment><USER3> Any idea how much he paid for that domain?</comment>


If Your a Grammar Nazi, Scientists Have Bad News for You - <AUTHOR> https://sparkonit.com/2016/04/03/grammar-nazi-scientists-bad-news/ <comment><USER2> Is the typo in the title supposed to be ironic?

</comment><comment><USER3> > "In addition, less agreeable people are more sensitive to grammatical > errors, while more conscientious and less open people are sensitive to > typos," the researchers said. The findings have been published in the > journal PLOS One

This sounds like it could be weaponized to annoy only certain people.</comment>


ARM & Embedded Linux Craigslist - <AUTHOR> http://dev.emcelettronica.com/arm-embedded-linux-craigslist <comment><AUTHOR> This article is full of sources that can help you to design an ARM for your embedded application. You'll find all the software and hardware tools you need.</comment>


Data Portability and Lies, Damned Lies - <AUTHOR> http://siliconangle.net/ver2/2009/10/19/data-portability-and-lies-damned-lies/

<comment><USER2> > Contrary to what Sachin claims, there is no export function, and the read > API has a limitation of 50

bah, that's based on the 'num_posts' param. But there is also an optional 'page' param right underneath the bit he is complaining about. You just have to make multiple calls to get them all out. Not such a big deal if you're used to using search based API's.

Doesn't look like author read the doc very closely.

<comment><AUTHOR> That's not the point. Not the point at all.

Sachin defends his service Posterous because non-geeks can do _everything_ with it without knowing how to walk and chew bubblegum.

I can't name five members of my immediate or extended family that has a lot of experience using a search based API. Hell, I'm a coder, and I don't have that much experience using a search based API.

I code when I hafta, and I don't want to write a whole set of libraries just to export my data. Creating artificial barriers to the exit door is the exact opposite of the spirit of Data Portability.

Edit: Incidentally, it isn't that I didn't read the API that thoroughly, it's that the API isn't that well documented. Pretty much what is screenshotted is what exists. It's not very well explained.

<comment><USER3> tjpick thanks for pointing out how you can get more than 50 posts out by using the page parameter. Yes, the documentation is not very clear at all and we need to fix that.

rizzn, it's true that most of our users wouldn't be able to use the export API since they are not programmers.

But we're relying on programmers to write the shims needed to go from Posterous to Wordpress, Posterous to Tumblr, Posterous to Blogger. We simply don't have the resources to do this, so we wrote export to be as generic as possible.

Other sites do export by letting you pull down an XML file with all posts. We could do this, but then what about the media? Where should we put that?

The point is, we always want to let you get your info out. We have assured our users (including Scoble and Rubel personally) that they will always be able to get their data out, including the original files they have sent us, if they ever need to.

</comment></comment></comment><comment><AUTHOR> I've been around since the whole Data Portability thing was conceptualized. Everyone nodded and stroked their beards pensively, but it's been what? Two years? Three years? Data is still effectively locked up under the guise of portability.

<comment><USER4> Maybe what people really want is not portability but something else. Data ownership perhaps.

<comment><USER5> Google already says you "own" your data. But you don't really own it if you can't take it with you to other places.

<comment><USER6> They now have a data liberation front: <http://www.dataliberation.org/></comment></comment></comment></comment>


Google Open Source Blog: Introducing Android Scripting Environment - <AUTHOR> http://google-opensource.blogspot.com/2009/06/introducing-android-scripting.html <comment><USER2> This is great. I remember writing games as a kid on a pocket computer during long car rides. Imagine being a kid today, with all these great toys.

</comment><comment><USER3> Time to finally get a new phone, methinks.

<comment><USER4> I'm waiting for some more Android phones to become available, so I'll have more choice:

[http://en.wikipedia.org/wiki/Android_%28operating_system%29#...](http://en.wikipedia.org/wiki/Android_%28operating_system%29#Hardware_products_running_Android)

<comment><USER5> I picked up a Dev Phone 1 (G1 / HTC Dream) last week, knowing full well that more refined devices are in the pipeline. I'll probably replace it for day to day usage in the not so distant future, but it'll stay relevant as a lowest common denominator for app development and testing.

</comment></comment></comment><comment><USER6> Well, that sort of blows the raison d'etre for Hecl's Android port out of the water, but it's really cool to see nonetheless, and one of the reasons why Android is a great platform for those who want to hack on stuff.

Actually, I think Hecl will still be useful for some things: it compiles directly to dalvik bytecode, whereas these are native processes which are launched/managed/interacted with via jsonrpc.

</comment><comment><USER7> Does anything like this exist on the iPhone/Pre?

<comment><USER8> The iPhone EULA (or maybe app store agreements) prohibit scripting and interpreting, but if you have a jailbroken one you can install Python (search for Python in Cydia).

Coding using the iPhone keyboard isn't much fun, and as it's unsupported there are limited APIs - but there is a Python/Objective-C package, and a sample GUI app which loads a long list from a data provider (with full scrolling), and with a jailbroken phone and SSH, you can upload and edit remotely and so on.

<comment><USER9> I wish the iPhone supported Bluetooth keyboards (or some form of external keyboard). It would make using SSH and such much more pleasant. Maybe someone will use the external peripheral framework in OS 3.0 to add an external keyboard. I've seen one hack that did add a keyboard.

Does either of the Android phones support Bluetooth keyboards?

<comment><USER10> Android doesn't yet support the bluetooth profile you'd need to pair with a keyboard. I hope that full bluetooth support will be in an Android update later this year, but I don't think anything definite has been announced.

</comment></comment></comment></comment><comment><USER11> I kind of really want an android phone now.

</comment><comment><USER12> I really thought that they'd make versions of these languages that would compile to Dalvik bytecode, so that people weren't restricted to writing Java Android apps. Makes sense given it's a custom VM, right? Guess we're halfway there now.

<comment><USER6> I think you could definitely do that with Lua (I know someone has ported it to J2ME), and Javascript. Python and Ruby are harder, because they are bigger, and their Java implementations use lots of more 'advanced' stuff like reflection and bytecode generation that are not going to fly on Dalvik.

</comment></comment><comment><USER13> Hmm. Python has been available for Symbian/S60 for at least five years. Surely there are interactive scripting environments on Windows Mobile as well. What makes ASE special?

<comment><USER14> Can you write Python/S60 programs on the phone's keyboard? (Honestly, I don't know)

<comment><USER13> I haven't tried it, but I don't see why not... The project's feature list mentions that there's a console for interactive development.

Of course Symbian is one of those old-fashioned operating systems with a user- accessible file system, so one can also just open a text editor, write a script, save it as a file and run it the PyS60 script shell.

</comment></comment></comment><comment><USER15> Anyone having trouble installing this on a G1? I am getting "not enough space" messages upon download, even though I have >50MB free on the phone.

<comment><USER16> Worked for me. I'm on Cupcake. Not sure how much space I had before the install, but after it I have 7MB left.

<comment><USER15> Yes, I got it to work by rebooting the phone (eek!)

Whole thing takes about 12MB after install, much bigger than any other app.

<comment><USER6> Wow, that's huge. Ok, now I'm not feeling quite so bad about Hecl.

</comment></comment></comment></comment><comment><USER17> Well if they give an easy way to deploy it this could be fun.

<comment><USER18> I get the impression that this is for prototyping as opposed to a new way to create applications.

 _ASE lets you develop on the device itself using high-level scripting languages to try out your idea now, in the situation where you need it, quickly._

<comment><USER15> It would be possibly to make them deployable, but use of an application would require pre-installation of the rather hefty SDK install.

Kind of like a ".NET" scenario.

<comment><USER17> The easier it is to deploy applications, and the more options available the better. :)</comment></comment></comment></comment>


Properly Dreaming About Success - <AUTHOR> http://blackhole12.blogspot.com/2012/05/properly-dreaming-about-success.html

<comment><USER2> How many creators actually become rich? I thought the marketers of innovations are the ones who become rich. To but people back on earth you could show how many great creators end up with nothing after years and provide practical solutions to combat this.

Charles Goodyear, Eli Whitney, and Robert Kearns come to mind as people who never profited off their creations or suffered greatly trying to receive just compensation.</comment>