Allow roles below admin to add subscribers only

Question: I want to give a group of user types (Editor + a custom role) the add_users /create_users capability. The only catch is that I wanted to limit that capability to adding 'subscriber' type users only, and nothing above that. Is there a way to do this?
Answer: This first step to making this happen is add the capability to create_users to a given role.  You do this be calling get_role, then using the add_cap method.  This only needs to be done once.  Here's an example that does it on plugin activation.
<?php
register_activation_hook( __FILE__, 'wpse42003_activation' );
function wpse42003_activation()
{
    foreach( array( 'editor', 'your_custome_role' ) as $r )
    {
        $role = get_role( $r );
        if( $role )
            $role->add_cap( 'create_users' );
    }
}

If you do that, you probably want to make sure to undo it on plugin deactivation with remove_cap.
<?php
register_deactivation_hook( __FILE__, 'wpse42003_deactivation' );
function wpse42003_deactivation()
{
    foreach( array( 'editor', 'your_custome_role' ) as $r )
    {
        $role = get_role( $r );
        if( $role )
            $role->remove_cap( 'create_users' );
    }
}

Now the problem of making sure those users can only register subscribers.  On the user-new.php page, the roles drop down get generated by a function called wp_dropdown_roles, which in turn calls the function get_editable_roles to fetch the roles the current user can edit/create.
Fortunately for you, there's a filter in there that will allow us to modify this bit.  First we'll copy all the $roles array keys, then loop through and unset any role other than subscriber from $roles -- only if the current user has the role editor or your custom role.
<?php
add_filter( 'editable_roles', 'wpse42003_filter_roles' );
function wpse42003_filter_roles( $roles )
{
    $user = wp_get_current_user();
    if( in_array( 'editor', $user->roles ) || in_array( 'your_custom_role', $user->roles ) )
    {
        $tmp = array_keys( $roles );
        foreach( $tmp as $r )
        {
            if( 'subscriber' == $r ) continue;
            unset( $roles[$r] );
        }
    }
    return $roles;
}

The bonus part of this is that get_editable_roles is called before a user is added or updated -- your editors won't be able to add users by insert extra options in the form with JS or something similar.
note: change your_custom_role in the examples above to your role's name.
All that as a plugin.
Comment: I kept looking for a way to filter the user insertion event, hoping to reject the attempt to add users above the desired level, but hadn't thought of simply filtering the dropdown. Thanks so much!
Comment: With making a few small adjustments to the code to suit my own needs, it still holds up in WP3.9.1 :)
Comment: FYI, I found that you have to have the following capabilities for this solution to work: `create_users`, `edit_users` and `list_users`. See a full explanation in my other comments. I hope that helps.
Answer: The answer of @chrisguitarguy is good. I've made a small modification to the code to have it work from a development bureau serving customers on a multi-site install. We were in need to create a 'customer' user role, but of course a customer should not be allowed to add another customer to its domain. Modified from the accepted answer I've come to this:
/**
 * Add filter to ensure a Customer type can NOT create another Customer user
 */
add_filter( 'editable_roles', 'limit_create_user' );
function limit_create_user( $roles ){
    $user = wp_get_current_user();
    if( in_array( 'customer', $user->roles )){
        unset( $roles[ 'customer' ]);
    }
    return $roles;
}

Hoping someone might find some use for this in the future. This was tested and applied in WP3.9.1.
Comment: I've got similar situation. I've added the following capabilities `create_users` and `list_users`. I've also added `editable_roles` filter, which displays a specific role correctly. However, when I create a new user it's always a 'subscriber' and not a custom role. Has anyone came across this issue?
Comment: I personally haven't and would like the answer to that ;) Even when going into the database and manually changing `default_role` from `subscriber` to `anything`, after the next refresh of the site, or a specific blog in multi-site, the value has been reset to `subscriber`.
Comment: Ok, I've dug into the WP code for creating a user and figured out why it doesn't work. A user have to have `edit_users` capability to create a user with a role that's been selected from the drop-down menu. Otherwise, without `edit_users` capability a selected role from the drop-down is ignored and a default role is assigned to the new user (which is usually 'Subscriber' role, unless it was changed to something else). This is for standard non-multisite setup, multisite might need more capabilities for it to work.
Comment: So, to recap, for this solution to work, a user have to have the following capabilities `create_users`, `edit_users` and `list_users`, to be able to create only users of other specific roles - where a role is selected from a drop-down menu on 'Add New User' admin screen. I hope that helps! :)


Put some $1$ into an $n\times n$ grid (every check has at most one $1$) such that the number of $1$ in each row and each column is $k \ (<n)$

Question: I want to ask if I can find a $1$ from each row such that for every two of $1$ they are not in the same column.
Comment: Sure, put them all down the main diagonal. Or do you want the number of different ways to do it?
Comment: http://en.wikipedia.org/wiki/Permutation_matrix
Answer: There are $n!$ ways to put $n \ 1$'s into an $n \times n$ grid so that no two are in the same row or column.  Start with the first row and put a $1$ in any cell-this gives $n$ choices.  Now put a $1$ in the second row in some other column-$n-1$ choices.  As you go down the rows, you have fewer and fewer choices until at the bottom you have only one choice, so you have $n(n-1)(n-2)\cdots1=n!$ ways to do it.
Answer: Let us count the ways.  For the first row, choose any of the $n$ places. For everyone of these choices, the $1$ can be put in the second row in any one of $n-1$ places.  For all the $(n)(n-1)$ ways of putting the $1$'s in the first two rows, there are $n-2$ places to put the $1$ in the third row. And so on. So the number of different configurations with the desired property is $n!$.


Should people explain their motivation for downvoting other people's posts and questions?

Question: I am just concerned because people downvote and for no reason, I don't understand this rule, should people downvote and take off running or should they give a reason for doing so? I'm confused.
Comment: Related - https://movies.meta.stackexchange.com/questions/1969/is-it-fair-to-downvote-a-poorly-constructed-question-by-a-new-user/1983#1983
Comment: As a note, voting is different on Meta. Downvotes show disagreement, not necessarily lack of research or quality... so a downvote here would be (probably) because they disagree with your question title.
Answer: Every downvote does have a reason even if it's not stated explicitly by the voter.
It's right there when you hover over the down arrow

This question does not show any research effort, is unclear or not useful.

If the voter feels it meets one of these conditions then no explanation is necessary.
I will grant that commment would be a nice addition but it's not, never has been and, based on many previous responses from moderators and SE employees, never will be mandatory.
Answer: The second the site requires comments for downvotes, is the second the site gets filled with comments that read:

stgouihj nwet gpojaygh-90i1248y 28iujtgoiwjrg0913 2glkjngopw
  Because I have to
  Blah blah blah blah

Forcing them to comment doesn't guarantee that you'll get a useful comment. It also invalidates the SE belief in private voting. If you're forced to comment when you downvote, everyone now knows that you've voted on the question.
Answer: Stack exchange does not force people to explain their down votes. It's just how things are on this website. It helps prevent antagonistic confrontations between users.
Comment: Good answer.  This explains exactly how the voting system works. Thank you for stating your concern regarding confrontations between users.  Another good thing to remind the community about is to not constantly complain about receiving down votes.
Answer: Yea - people being accountable on the internet for their actions and opinions, like in real life. Imagine it!


How fast can hackers change their IP address?

Question: What is the speed and frequency that hackers can bypass rate limiting continuously in a website using login with an SMS OTP? The rate-limiting activates if the same IP address triggers SMS OTP more than x times.
Comment: tl;dr Depends what you mean by "their"!
Comment: Using something like Tor you could easily get a new IP address for every request in a lot less than a second. On top of that you can parallelize the process, in case you need around (for example) two dozen new IP addresses every second ... Been there, done that.
Answer: Botnet
If someone has access to a botnet, even a small one, they could change the IP that their actions are coming from several times per minute or flood their actions from a million IPs in any given moment.
Non-botnet
For individuals without a botnet, there are several methods, including resetting their ISP modem, which, in some cases, resets the IP. Turning a phone's airplane mode on/off can also trigger a change in IP (MechMK1 reports this might take as little as 3 seconds to complete).
They could also change between public WiFi networks.
Using a series of VPNs and proxies or VPNs that permit the user to choose the exit node will also work, and services that have different exit nodes can make this switch in seconds. There are also proxy/Tor utilities that can randomise your IP according to a schedule you set. The Janus tool has a default change time of 1 minute, but that can be changed.
Therefore, for any practical case, if the attacker is waiting for the SMS code to come back from your server, then they are only limited by the time it takes to receive the SMS code.
Comment: To add some real data, on my mobile phone connection, it takes about 2.5 seconds to get a new IP address.
Comment: Activating and then de-activating airplane mode. It gives me a new IP address every time.
Comment: @AndrewMorton aside from running a botnet that they, themselves, own and proxies? Not really.
Comment: @schroeder presumably a state level actor could own a block of IPs to themselves (or co-opt any IP within their jurisdiction) and could have a single server using millions (?) of IPs, no botnet required. I don't think it really makes a difference though.
Comment: Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/106149/discussion-between-kevin-lee-and-schroeder).
Comment: Are there any additional considerations for state-level someones?
Comment: I think it would be good to highlight that, while an attacker may have access to a million IPs in an instant through a botnet (sounds really bad!), an already-large botnet will typically never suddenly grow a lot or change IPs all at once, so while it is "millions in an instant", it is not as if they have *another* million ready in the next instant. The current phrasing sounds like there is a near-infinite supply of v4 addresses and one would need high-entropy tokens to resist brute-force, while in reality an attacker would never be able to go beyond a few percent of the 2^32 address space.
Comment: @SteveByrne yes, that is covered in the tangential discussion in the chat above
Comment: IPv6 could change that dramatically, however another fair point is to address the security requirement. If a one time code is being sent the delay should be server side per account and the password should be required to be new each attempt.
Answer: No one seems to have addressed this yet, but I'd like to introduce the biggest problem to IP based rate limiting: IPv6.
If you (naively) applied the same logic as you do to IPv4 addresses to IPv6 addresses (i.e. block the address after a certain number of attempts), your rate limiting will be thwarted in about zero seconds.
Why? Well, the simple version is that IPv6 addressing scheme is substantially different than IPv4. IPv4 is rationed to the highest degree, so much so that even multiple homes and physical city blocks may have the same external address. This greatly contrasts with IPv6 where each machine, by convention, will have a /64 block addresses assigned to it. If you aren't familiar with the /x notation, this means that the first 64 bits of the address are fixed while the rest are left free. Since IPv6 addresses are 128 bits long, this means that each machine, by convention, has 2^64 unique addresses which it can use as it pleases! If you used the same approach as with IPv4 and simply blocked one address, the attacker could simply pick a brand new one from their essentially infinite pool of addresses! Your rate limit is then absolutely destroyed and they can submit an unlimited number of OTP codes as quickly as they want. This arguably makes your 2FA implementation useless since if your OTP code is six digits long, the attacker just needs to keep flooding you until they get lucky. In my real world testing, I found I could break a six digit OTP using this method in under six hours using a single thread so it's very practical and a very real threat.
What can we do to stop this? The natural choice would be to ban the entire /64 block of the requester when they hit the limit instead of just their specific address. On the surface, this seems suitable as it means that the attacker can no longer use any of the addresses in their pool.
This, however, also doesn't work even though far too many companies think it does. The problem is that while a host is generally assigned a /64 by convention, networks are designed to have more than one device on them! This means that even home networks will have oodles of /64 blocks (because why not? we're not going to run out!) given to them so that they can handle a bunch of devices. In my case, I was given a /56 block by my ISP to break up among my devices as desired. This means I actually have 2^8 (or 256) /64 blocks to hand out and break up among the devices on my network as I please.
Since there's nothing stopping me from handing the entire /56 block to one host, that means I have 256 /64 blocks at my disposal to cycle through and circumvent your rate limiting. If you let your users try five OTP codes per /64 block before banning them for some period of time, the attacker (using a residential connection!) would be able to hit you with 1,280 codes before they had to wait for the cooldown period. Compared to a classic IPv4 circumvention attempt (using a botnet, proxies, etc) this is an enormous gain for essentially just using what they already are given for free. If you combine this with a botnet (or even just by paying a small amount for a larger "enterprise size" IPv6 pool), IP based rate limiting is thwarted again for very very cheap.
So what now? Do we start blocking /56s for the purposes of rate limiting? You could, but this would have pretty unfortunate effects since although some people are given /56 blocks, others aren't and so you may very well end up accidentally blocking random people for no reason while not solving the problem of easily buying /52 and /50 blocks. The next reasonable choice would be to try and deduce what range assignment a request is originating from. While this would work, it isn't exactly possible as ISPs do not publish or release this sort of information. With this off the table, we (as far as I know!) are out of options. IP based rate limiting fundamentally does not work on IPv6 against an attacker who actually understands how IPv6 works.
But all is not lost! While IP based rate limiting is useless, rate limiting as a concept is not yet dead. You simply need to pick a different resource to limit access to. Instead of limiting the number of times an IP address (or range, or block, etc) can attempt to attempt OTP verification, you should limit the number of times an account may have OTP performed against it. By locking out the account after a certain number of failed OTP attempts and requiring the user click a link in their email to reactivate OTP, the attacker will not be able to bruteforce the OTP for the account no matter how many addresses they can wield. By setting this limit fairly high (say around 25), a normal user should never be inconvenienced by the policy unless something is very wrong with their authenticator (and so would probably need to initiate recovery anyways).
Such a technique has been used effectively by Instagram, Facebook, LastPass, and likely many more for both SMS reset codes and OTP. It is very effective and, in my opinion, the only safe way to block brute force attempts in a world where IPv6 is no longer simply ubiquitous but often mandatory as quite a few networks (mainly mobile!) are slowly transitioning to IPv6 only and using proxies to access 'legacy' IPv4 resources.
Comment: Account-based ratelimit lets someone DoS your ability to log in to your account.  IP-based rate limiting does not.  So there is a potential downside.
Comment: I've had an ISP that assigned /48 to my home. That's possible too! It's indeed useless to try IP ratel imiting.
Comment: It's not correct that each Machine has a /64 block, each Network has one.
Comment: @Josef: The opposite is not always correct either. I agree that machines are not usually assigned /64s "by convention" (that's just a common misunderstanding of `ifconfig` output) – but for example, in hosted VPS environments, often customers are indeed given a /64 _per VM_. In LTE, at least from what I've heard, each device gets its own /64. In some LAN networks, a machine could easily get a /64 using PD from the local router (e.g. for hotspot mode or virtual machines).
Comment: There are standards about the allocation size; this "answer" is more fearmongering for the big evil IPv6 where you can no longer ban evil hackers, than helpfully telling us what a typical allocation size is and that you should indeed just consider the subscriber's allocation size to be a single subscriber.
Comment: @Gizmo my ISP assigns a /60 to my home. Still all devices are in the same /64 and the rest is unused. To change that, a more advanced configuration and at least one additional router would be needed.
Comment: @user1686 ah! My mistake. I do use PD at home and use enterprise network equipment for my lab and so I made the assumption that ISP gear would do the same when handling IPv6. Good correction!
Comment: @Luc please share the standard allocation size and a source saying that it's standardized, if you can! As shown by the discussion in the comments and in my answer, I feel I have demonstrated very well that the block sizes given to a subscriber are variable are entirely up to the ISP. In just the five people here, we've seen blocks ranging from /48-56 on *residential* connections
Comment: @Sirens /48 is historically the standardized size that ISPs should allocate to subscribers; some cheapskate by giving people less. A router will typically just use the first /64 of your allocated range, and malware on someone's computer or IoT device will not be able to change that to make use of more of the space, so as far as I can tell, a /64 in IPv6 can be considered roughly equivalent to a IPv4 /32 address where one address is one subscriber (unless you have a crap ISP that does CGNAT on v4 and gives /128 to customers in IPv6, so v6' /64 and v4's /32 is equivalent in that way, too).
Comment: Also, it's not as if you have to do one-size-fits-all. If you blocked some percentage of the 256 /56s at some point, you might as well block the whole /56 range because it seems to be under the control of bad actors. It's not impossible to make systems work with IPv6 if you actually want to, but of course, therein lies the issue, especially when people post elaborate answers built on the premise that IPv6 is the problem.
Answer: If a hacker is in posession of a botnet, they can have control over thousands of IP addresses and can switch between them at will. So there is not really a practical limit to the frequency and speed with which they can change IP addresses.
Comment: Thousands probably being a relatively small botnet...
Comment: The [Srizbi botnet](https://en.wikipedia.org/wiki/Srizbi_botnet) was the biggest at around half a million machines
Comment: @MooingDuck Srizbi was taken down in 2008. Since then ... there have been much, much bigger botnets .... https://en.wikipedia.org/wiki/Bredolab_botnet and https://en.wikipedia.org/wiki/Conficker to name just a couple. [Mirai](https://blog.cloudflare.com/inside-mirai-the-infamous-iot-botnet-a-retrospective-analysis/) was 600,000. In 2016, [you could rent](https://www.bleepingcomputer.com/news/security/you-can-now-rent-a-mirai-botnet-of-400-000-bots/) a 400,000 node botnet.
Comment: Important thing to note is that they're probably already attacking with other IP addresses before you've had a chance to block anything.
Answer: Using cloud providers you can "rent" a great number of IPs for a short amount of time. This is much easier than botnets/tor/switching off our phone/etc. (edit: although potentially more risky in terms of covering your traces, see comments).
The whole thing can be fully automated, for instance with Amazon API Gateway.
Bibliography

https://thezerohack.com/hack-any-instagram
https://rhinosecuritylabs.com/aws/bypassing-ip-based-blocking-aws/
Comment: "Easier" is relative. You need to set up accounts, set up payment to AWS, and configure from scratch. Renting a botnet is far more streamlined. And by using cloud services this way, you expose yourself. Renting a botnet provides separation between you and the attacking traffic. AWS/Google cloud is perfect for research, but limiting and exposing for attacks. I would use AWS for exactly what the authors did: to simulate a botnet, but not to actually be one.
Answer: This depends on the network between the attacker machine and your server. If it is across the world, the attacker may be limited to single IP address or small number of them. Some cloud providers allow to change IP address of the virtual machine in the cloud the attacker may own, or the attacker may just start another virtual machine. Scripting support may be limited and the action may require multiple seconds at least.
If both computers are inside the same local network, it may be possible to change IP address of the attacker with a single command. That command can be launched from something like Python script that does the rest of attack and take only milliseconds to execute. It must be run as root but this is unlikely to be a big problem.
Comment: You don't think that the use of botnets to brute-force credentials and stay under rate-limiting thresholds and IP-blocking measures is relevant? That's a very strange opinion to have since that is a core use case for botnets ...
Comment: This answer assumes the remote attacker only has one machine and one network and uses one cloud provider. It also seems to ignore all the rest of the factors presented in all of the other answers.
Comment: The question is how fast it is possible to change the IP address of a machine, I assume, a single one. How it is relevant how many machines or networks the attacker is actually using?
Comment: The OP does not specify "IP of a machine". You've added that assumption.
Comment: Also, VPNs/Proxies allows a single machine to have virtually unlimited IPs.
Comment: Yet the OP wrote **to change**. I do not see answers like "the attacker can use multiple machines with fixed IPs from botnet" as very relevant.


Transfering merits

Question: This is a tradition I have heard in Thailand: Many men become monk for a few months in order to transfer merits to his parents and so they can go to heaven. If I'm not mistaken the Buddha said you could only transfer merits for ghosts (according to teacher Dhammavvuddho Thero), it is not possible to transfer merits from man to man. Is it? Any text to help? I may be wrong so I appreciate the explanations.
Comment: The old sense of transferring merit had to do with mudita, you tell other people about your success so that other people can be happy about that. Being happy about other people success is meritable, so it works like transfer. Later on esp in Mahayana, merit transfer works more like magic-- any meritous activity is done for the goal of transferring the merit to others, which to me also sounds like disclaiming it with the goal of staying humble.
Comment: Not sure about humans, but definitely beings other than peta.  See http://www.basicbuddhism.org/index.cfm?GPID=65&Print=1 for example.
Answer: According to What Buddhists Believe by Venerable K. Sri Dhammananda Maha Thera, it is possible to transfer merit to living persons as well as deceased persons.

According to Buddhism, good deeds or 'acts of merit' bring happiness to the doer both in this world and in the hereafter. Acts of merit are also believed to lead towards the final goal of everlasting happiness. The acts of merit can be performed through body, speech or mind. Every good deed produces 'merit' which accumulates to the 'credit' of the doer. Buddhism also teaches that the acquired merit can be transferred to others' it can be shared vicariously with others. In other words, the merit is 'reversible' and so can be shared with other persons. The persons who receive the merit can be either living or departed ones.
The method for transferring merits is quite simple. First some good deeds are performed. The doer of the good deeds has merely to wish that the merit he has gained accrues to someone in particular, or to 'all beings'. This wish can be purely mental or it can accompanied by an expression of words.
This wish could be made with the beneficiary being aware of it. When the beneficiary is aware of the act or wish, then a mutual 'rejoicing in' merit takes place. Here the beneficiary becomes a participant of the original deed by associating himself with the deed done. If the beneficiary identifies himself with both the deed and the doer, he can sometimes acquire even greater merit than the original doer, either because his elation is greater or because his appreciation of the value of the deed is based on his understanding of Dhamma and, hence, more meritorious, Buddhist texts contain several stories of such instances.
The 'joy of transference of merits' can also take place with or without the knowledge of the doer of the meritorious act. All that is necessary is for the beneficiary to feel gladness in his heart when he becomes aware of the good deed. If he wishes, he can express his joy by saying 'sadhu' which means 'well done'. What he is doing is creating a kind of mental or verbal applause. In order to share the good deed done by another, what is important is that there must be actual approval of the deed and joy arising in the beneficiary's heart.

I encourage you to read the whole page devoted to this (linked above). It has some interesting supplemental information that is related to, but a little outside of, what you had asked about.
The author refers to the Tirokudda Kanda sutta which you may find interesting.
Answer: You can dedicate merit for anyone.
Check out some articles that can help on understanding it more intuitively.
http://blog.vajrapani.org/featured/featured-authors-articles/item/407-gettin-our-merit-on.html
Comment: Hi vaso vookohteach and welcome to Buddhism.SE. We've put together some useful information to help you get started [here](http://meta.buddhism.stackexchange.com/questions/1502/i-am-a-new-user-here-at-buddhism-se-what-should-i-know-before-i-post?).
Answer: You cannot transfer merit from man to man but others can have appreciative joy at some good deed you have done and also make merit.
You can transfer merit to certain type of beings on sensing this develops appreciative joy for the deeds you have done and gain the merit.
Tiro,kudda Sutta: The Outside-the-Wall Discourse covers some interesting point on merit transfer. (In section 4)
Comment: Updated the link.
Comment: Any other link for this? The link's not working now
Answer: There is disagreement on this between schools, in the Tibetan tradition merit cannot be transferred to others, but can be offered / dedicated to achieving virtuous goals : IE dedicating all my merit to the goal of freeing all beings from suffering.
This however is borderline transferring... so it is unclear where the line is drawn.
Answer: the 165th verse of the Dhammapada, the 9th verse of its Attavagga, says

Attanā hi kataṃ pāpaṃ,
  attanā saṅkilissati;
  Attanā akataṃ pāpaṃ,
attanāva visujjhati;
  Suddhī asuddhi paccattaṃ,
  nāñño aññaṃ visodhaye.
By oneself is evil done;
  by oneself is one defiled.
  By oneself is evil left undone;
by oneself is one made pure.
  Purity and impurity depend on oneself;
  no one can purify another.

the Kaladana sutta (AN 5.36) says

At the proper time, those wise,
  charitable, and generous folk
  give a timely gift to the noble ones,
  who are stable and upright;
  given with a clear mind,
  one's offering is vast.
Those who rejoice in such deeds
  or who provide other service
  do not miss out on the offering;
  they too partake of the merit.
Therefore, with a non-regressing mind,
  one should give a gift where it yields great fruit.
  Merits are the support of living beings
  when they arise in the other world.

these passages indicate impossibility of merit transfer or sharing, but recognize the possibility of taking part in other's merit making by rejoicing of their wholesome deeds or providing assistance in them.
but neither of the passages is attributed directly to the Buddha
here's what the Buddha says according to the suttas
in the Culakammavibhanga sutta (MN 135)

beings are owners of their actions, heirs of their actions; they originate from their actions, are bound to their actions, have their actions as their refuge. It is action that distinguishes beings as inferior and superior.

in the recount of a parable in the Devaduta sutta (MN 130, AN 3.36)

that evil kamma of yours was neither done by your mother, nor done by your father, nor done by your brother, nor done by your sister, nor done by your friends & companions, nor done by your kinsmen & relatives, nor done by the devas. That evil kamma was done by you yourself, and you yourself will experience its result.

these seem to indicate that kamma is only personal which in turn implies that one cannot acquire a wholesome kamma without ever performing a wholesome act and making conscious effort at spiritual development as in case of unbeknownst reception of merit from somebody. otherwise it would mean undermining the concept of the Noble Eightfold Path as a way to awakening by dint of purely personal effort.
Answer:
Even some Buddhists are skeptical that merits can be "transferred" to other beings: It does not appear to be "scientific". However, Buddha Dhamma is far ahead of science, and this is another example. Even though the vocabulary is different, mechanisms of "energy transfer" (mental energy) has been described in Dhamma.

Not only the merits of a good deed, but also many other versions of "mental energy" can be transferred, as we discuss below.
The basic idea can be thought of as follows: If one has an oil lamp that is lit, and if others have oil lamps that are not lit and they do not have a way to light them, wouldn't it be better for everyone to let others use one's lamp's flame to light their lamps?
Thus while it is not possible to "create" many oil lamps starting with one, it is possible to make thousand other lamps to become useful by sharing the light. In the same way, the receiving person needs to have a basic ingredients to reap the benefits, as explained below. But since all those lamps will be useless without a way to light them, the person providing the light is doing a great service.
2. First of all transfer of merits is the correct phrase, but "punna anumodana" is not. Anumodana means the receiving mind becoming joyful with the merits it received ("anu" + "mödanä"). The giver is giving ("däna") the "paccayä" or the auxiliary causes. (The common word is "pratyaya" but that is the incorrect Sanskrit word; the correct Pali word is paccaya). It is paccaya that represents "patti" in "pattidana" (pronounced, "paththidäna").
Other than in direct giving (see below) the giver cannot make the receiving party "receive what is intended" unless the person receiving has a mindset that is attuned to receiving.
It is the receiving person that is doing the "punna anumödanä", i.e., gladly receiving the pattidana of the giver and becoming joyful with the merits received. This is also called "pattanumodana".
3. Giving and receiving can be done in many ways:
The direct way of giving/receiving is when one gives money or something material. It is deducted from the giver's ledger and is added to the receiver's: it is fully transferred.
When a teacher teaches a classroom full of kids, he/she is teaching the same way to all the kids. But how much a particular kid "receives" or comprehends depends on that particular kid's ability to receive.
A radio/television station is broadcasting a program. But the reception of the program by a radio/TV depends on the quality of that device and also whether it has been "tuned" to the correct station.
This transfer can happen instantaneously or with a time lag, because that mental energy is in the "nama loka" and is accessible at any time; see, "Memory, Brain, Mind, Nama Loka, Kamma Bhava, Kamma Vipaka" , "What are Dhamma? – A Deeper Analysis", and "Our Two Worlds : Material and Mental".
4. Therefore, only in "direct giving", the amount received is the same as given. The amount received in the other other two "indirect giving" methods depends on the receiver. A similar mechanism is at work when one does a good deed and "transfers merits" to another person who may be far away.
All intentions have kammic energy. You may remember that the Buddha said, "Cetana ham bhikkave kamman vadami", or "Bhikkhus, I say intention is kamma". And kamma is the fundamental potential energy for everything in this world.
People very much underestimate the power of the human mind. Those who have experienced at least anariya jhanas can sense at least a little bit about the power of the mind; see, "Power of the Human Mind – Introduction" and the two follow-up posts.
Direct giving is "däna"; indirect giving is "pattidäna". These are two of the ten meritorious deeds (punna kamma); see, "Ten Moral Actions (Dasa Kusala) and Ten Meritorious Actions (Punna Kriya)".
5. One such mechanism is the annantara-samanantara paccaya; see "Annantara and Samanantara Paccaya". This is a universal law governing the kamma niyama. Many people pronounce "niyama" as "niyaama", but "niyama" is the Pali or Sinhala word for "principle". Thus kamma niyama is the universal principle of kamma (like the law of gravitation).

When one is "transferring merits" by sincerely saying that "May so and so receive merits from this good deed that I have done", or doing metta bhavana by saying, "May all beings be free from the suffering in the apayas" or some version of it, one is BROADCASTING one's intention.

However, just because one is doing such a "giving", the intended recipient may not receive the benefits UNLESS the receiver has a matching mindset; it is just like the case of a radio/TV, where the receiving device need to be set to the "right frequency" to receive the signal.
This is explained in the post, "Annantara and Samanantara Paccaya". Don't be discouraged by those Pali words; sometimes, as in the case of paticca samuppada, it is best to use the Pali words, because it is not possible to find an English word that can convey the same meaning.
From Puredhamma.net

Transfering merits


Question about principal prime ideals

Question: Let $R$ be a commutative ring, and $I$ be a principal prime ideal. Is it true that $I$ does not contain any non-zero prime ideal? (You may assume that $R$ is Noetherian)
Answer: If $R$ is Noetherian, Krull's principal ideal theorem implies that $\operatorname{ht} I \le 1$, i.e., any chain of prime ideals $P_1 \subsetneq P_2 \subsetneq \ldots \subsetneq P_n = I$ has $n \le 1$. Taking a maximal chain of prime ideals, we know that $P_0$ is made up from zero-divisors, since the minimal prime ideals of a ring contain only 0 and a (possibly empty) subset of the zero-divisors. So, either $I$ is made up from zero-divisors, or it strictly contains only prime ideals made from zero-divisors.

Question about principal prime ideals


File system performance: cylinder vs. track

Question: Why is it better for blocks belonging to the same file to be on the same cylinder as opposed to being on the same track?
Answer: It doesn't matter that much. Especially as the cylinder and track concepts, although still used by some utilities, is quite obsolete and has no real relationship with how the data is stored on modern disks. The number of sectors per physical track vary depending on the disk area used nowadays.
Answer: For older hard disks the best performance are obtained by putting the file on different plates (heads) that can be read simultaneously and on alternate sectors since near sectors can not be read consecutively.
As jilliagre pointed out there are no more correspondence between the old sector coordinate and the physical disposition on disk.


What to wear in Switzerland in July?

Question: I am aware that the weather changes often and that I should wear layers, but I also read that locals tend to dress quite modestly (dark, plain clothing). Is that so? I will note that I am going to a few metal concerts and festivals - should I still dress classy?
Comment: Depends on where in Switzerland. Big cities like Zurich or Basel are fairly cosmopolitan and with lots of culturally variety. As you go more rural and/or up into the mountains, things get more conservative and the higher you are, the colder it gets.
Comment: It depends on where you want to go. No, no need to wear classy, but it could rain, and if you are in some metal open airs in mountains (and valleys), bring also something warm (just in case).
Answer: The clothing locals wear will change with fashion, so what was noticed last year will likely not be the same this year and will be different again next year. And what you describe sounds like office workers on their way to work.
You will be a foreign visitor and as such you will stand out whatever you do, it is almost impossible to blend in and it is useless as it will not help you with anything.
If you go as a tourist, I would dress in the style you would when going to a different part of your own country, when going into town you would wear a milder version of your style than you would when going to a concert. That will do for Switzerland as well.
Being dressed in 'metal' styles will likely help you get in with people who also like that music, while when being dressed as an office worker will not get you anything.
On the other hand, if you plan to combine business with metal concerts in one trip, you best bring business style clothing. You do not need to adjust to what you assume is Swiss style, what you would wear at home going to work or business casual if your contacts allow it.
Comment: Being dressed in a suit or in business casual will make it easier to meet fellow office workers or businessmen :)
Comment: @JonathanReez, I included an option of business meetings.
Comment: @JonathanReez But does wearing loafers make it easier to meet bakers?
Comment: Yes, and if they're penny loafers, you can meet bankers too.

What to wear in Switzerland in July?


What are good placement strategies for Stratego?

Question: How would I set up a good placement in Stratego, especially with bombs and the flag?  What is a good strategy for varying the placement?
Comment: I'm voting to close this as too broad, as it's essentially a [what are some good tips?](http://meta.boardgames.stackexchange.com/q/86/5573) question - albeit tips about a particular thing. The answers are many and varied, as evidenced below.
Answer: I find that the key to Stratego lies in-

Cover your flag with bombs
Kill all enemy miners.
DO NOT MOVE a new piece when moving an old one will suffice.

Of those, I find that #3 is the most crucial.  Most players have a very hard time attacking pieces about which they have no information;  every time you touch a piece, or even visibly consider moving it, you inform your opponent that that piece is NOT a bomb.
Comment: This can work the other way 'round, though, if you can convincingly appear to consider moving a piece that is, in fact, a bomb.
Comment: @mafutrct As long as you don't actually touch a piece that can't move, I don't see how it can be considered cheating....  I'm just looking at my pieces and thinking.  Whatever you choose to read into it is clearly entirely up to you.
Comment: fwiw - I find that surrounding *other* pieces with bombs more effective
Comment: @AndrewVandever: On a sidenote, some may consider this close to cheating. So make sure the people you play with do not mind being "tricked" like this.
Comment: @GWLlosa That's how I see it too. I like applying little mind tricks like these. Just some of the people I played with seemed to be unused to it, and slightly annoyed ;\
Answer: There is no hard and fast answer for a good placement in Stratego, in part because as soon as someone learns your regular setup they can easily counter.  Many good strategies can work once but not regularly.
In general, common logic is to keep the flag in the back of your field surrounded by bombs.  Corners are also great because they only require two bombs instead of three to cover.  Both are excellent strategies with the weakness being predictability.  It is still a good idea to protect a flag on as many sides as possible with mines.  Setting up dummy flags with a Sergeant in wait for a miner is also common.
One of my favorite ploys is to leave the flag behind one of the lakes unprotected, or protected only on one side or both as not to be conspicuous.  Many players will assume that the flag is in the back row and go charging past that ignored Lieutenant or Sergeant.
I also commonly pick one of my three entrances and double bomb it off.  If the other player is set to attack all three fronts evenly it can throw a kink in their plans as they need to move a miner in to clear the way.  Also the miner is sure to be gobbled up as soon as it defuses one of the mines to clear a path.
Comment: Blocking your own entrances (any) is self-defeating in my opinion. It is something which can easily be overcome by the enemy (although probably at the cost of a miner) and you lose all control over what happens behind the barrier until your opponent clears a path. Loss of maneuverability, loss of control. It's not worth it.
Comment: double bombing off an entrance is great if you can find a way around the loss in maneuverability. Really gives you a solid defense.
Comment: This is a good answer and check out mine!
Answer: If you play the same person more than once, the most important setup strategy is to avoid being predictable. If I play someone who always surrounds their flags with bombs, I'll beat them almost every time because discovering the location of a bomb (or better yet several bombs) means there's a good chance the flag is nearby.
In order to avoid being predicable, I tend to rotate between the following types of setups:

2-3 bomb clusters located far from each other (flag behind only 1 of
them)
2-3 bomb clusters located far from each other but flag NOT behind
them, so opponent wastes a lot of time and effort cleaning up bombs
that protect 7s.
semi-random bomb placement where no 2 bombs are placed adjacent or
diagonally.
a single bomb cluster protecting the flag with the rest placed
semi-randomly
One bomb protected side of the board that has lots of poor ranking
pieces, leaving me free to concentrate my attack on the other side of
the board.
I also occasionally do something truly wacky like place the flag in
the front row NOT behind a lake. I've won most times I've done this
because it is unexpected and is assumed to be a bomb, which is then
usually ignored/avoided, though I'm usually also protecting it with a
strong piece or two.

I've found that more important than flags/bombs is the placement of your best pieces (1, 2, 3, 3, and Spy in the old, original version). If your best pieces are too far back and separate from each other, you'll be at a big disadvantage to the player who comes barreling through your front ranks with a concentration of good pieces.
If you're playing someone for the first time, it's important to get a sense of how much they've played and what bomb strategies they employ, if they're willing to tell you. For example, if you're able to determine they've never used or played against the semi-random bomb setup, you're very likely to win if you use that set up.
Answer: <code>[B][5][6][3][1][7][6][6][6]
[7][B][6][S][2]
[B][7][B][F][3][4][5]
[7][B][7][B][9][9][9][9]
</code>
Above you have a classic 6 bomb matrix - your opponent will have no choice but to position 8's and 6's to get through it.  This should give you plenty of moves to attack.  Use the top row 7's and 6's to test enemy units. then use the row nearby 1,2,3... to kill enemy units once you know what they are.  Leave the spy near the flag as a failsafe.  Keep the nines close to each other to make a little 9 highway, they can get out of the way of each other very quickly.
Comment: I'm confused by the diagram. Is it just that a bunch of pieces are cut off from the right side?
Comment: @Alex P, I was doing it from memory, so I don't remember all the other pieces.  The left hand side is what's important.
Comment: What happened to the right hand side?
Answer:
Use a diagonal of bombs backed by sevens to protect your flag. I go
back and forth between a pyramid toward the middle or a diagonal on
each corner, with a six or above instead of a bomb on one side.
Use your one for one aisle, your two and spy for another, and at
least one three for the last. Try to keep enough space clear that
you can maneuver these pieces around. Once you've really pinched
all three aisles, it's hard to lose.
Save some spies for later.
Comment: The diagonals+6s has always been one of my favorite strategies. If you can wipe out their 8's, it's not a definite win but sure helps.
Answer: This will work with all versions:

Put bombs as decoys, so 2-3 bombs can protect your flag, as for the decoy, put the next strongest guy, so that you can kill the miner
Try placing most of the bombs in the front row and leave 1 or 2 spaces with movable pieces (I recommend the scout) so the opponent will have to get all his miners up front who can then be destroyed so the opponent could never reach the flag
This is pretty obvious but remember never to put the flag up front
Thanks for the reading!
Comment: This strategy makes me think of the Marginot Line. Putting most of the bombs in the front row seems like a formidable fortification defense, but your opponent will simply ignore your bombs and walk past them.
Answer: NOTE: This is an old school set so bear with my strategy if you have the new ones.
All of y'all's strategy is good, but I have a good one too :)

Guard your flag with an X of bombs
(make an X out of bombs, have the flag below the middle bomb, your marshal to the right of the middle bomb, your 3 left of the middle bomb, and your 4 on top of the middle bomb. Place further 4s to the right and left of the bottom X corners).
ALWAYS ALWAYS ALWAYS have your spy with your general, this way when your general is taken out by a marshal (obviously) take your spy (next to your general which is now next to the marshal) and kill him.
A lot of people actually have their 9s in the front which is not a bad idea, but it's also not a bad idea to have a number like 4-7 as infantry.
Never attack a non-moving piece. Even though it could be a bluff (like the non-moving piece could be a bomb or 1-S ) just don't attack them. Instead, have your scout see what the piece is then determine whether to take your miner or 4-7 to attack that piece.

This may not be good for you but it's how I roll and how I win xD
Btw it's an old school set so bear with my strategy :D
All I can say now is enjoy the strategy and the game ;)
Comment: "this way when your general is taken out by a marshal".  unfortunately, this seems to be the first rule drilled into everybody's head, and as a result I have never had anybody's marshall attempt to take my general when the spy is waiting next to it.
Answer: Great setups are nice, but are secondary to TACTICS. All placements have advantages and disadvantages. Generally, I don't like grouping bombs much in the first 2 rows because it impedes movement of your troops, likely will only kill lower ranked pieces, and gives away the location of your bombs too soon. Obviously you shouldn't NOT ever put bombs in the first 2 rows, just keep it to a minimum IMHO. Also, I save my Scouts for the end of the game by keeping them in the back rows. You will want them when you are at the end of the game and you have NO IDEA where to attack.
Answer: Here are a few key principles. It's important to play "systematically".

Flag should always go in the back row and be protected by bombs.
6, 5, 4, 2s should go in the front row, however limit to just 1 six in the front row. Don't waste twos early on save them for mid-game. Opponents rarely put pieces worth knowing in their front row.
You will lose the game if you go down a 6, 7, 8, 9 or 10. Play carefully with these pieces. 9 and ten should be on opposite sides and be on the second or row and be able to reach the middle easily.
You want to clear the front row out quickly and use it as a path to organize your pieces.

Make sure you evenly distribute your major pieces (e.g. 5, 6, 7, 8, 9, 10). That means 1 six on the left, 2 in the center and 1 on the right and the same with your other pieces (7, 8, 9, 10). Once you reach end game you want to be able to quickly bring these pieces to the flanks between the lakes.
We outline more of how to play "systematically" in our e-book and also offer a lot of free content.
Check out Strategy for Stratego
Comment: Hi Paul. Thanks for disclosing your affiliation with your product and providing an otherwise useful answer - or at least, I think so; I don't play stratego! If you haven't read them already, please bear in mind our [advertising policy](http://boardgames.stackexchange.com/help/behavior) when you post here - though it seems like you might have already done so. See the 'Avoid overt self-promotion' heading at the bottom.
Comment: I agree that the front row should be cleared out quickly. Maneuverability is your best defence.
Answer: Bomb Decoys. I play an updated version with and 8x10 board and only 30 pcs per side. I always stack 4 bombs on one side and put the flag in the corner with the other two bombs. put your spy near the decoys so when your opponent thinks he has discovered your flag he sends in his ten. your opponent will put several 3s and 1s to uncover ur bomb.
Answer: hide flag with bombs, make decoy bombs so they think your flag is hidden somewhere else, hide 4/5/6's near the decoys to kill any 3's they use to defuse the bombs, don't waste all your 2's at the start of the game, you will need them later on, 2's are great for finding out which piece is the spy - AND TWOS KILL THE SPY- so then your 10 is safe so you can go rampaging around killing anything that they move
Finally they will be out if moving pieces and forced to surrender- you win!!
Answer: You Should place your flag in the corner and make a grid of bombs and fill that grid of bombs with 7s. 7s are the least useful.


UI : Is it fine to have MessageBox without a caption?

Question: A trivial UI guideline question - Is it ok to have MessageBox without caption ? I have a Winforms GUI with 3 confirmation boxes at different scenarios. Can anybody provide me some formal UI guidelines information on whether it is mandatory to have Captions on MessageBoxes ?
Comment: Why are you wanting to remove the caption?
Answer: There's certainly no rule against it, but you aren't helping the user out without a title.  Even a simple title such as "Warning" or "Confirm" is helpful to the user.
The title should describe what the message is about, where as a message icon helps distinguish the type of message.
But you should try to keep MessageBoxes to a minimum.  They are usually disruptive to the end user.
Comment: Ok. I have a warning icon (exclamation) on the message box. But, today I checked in the code without caption and so I am wondering is it really necessary to put caption. I am just wondering...
Comment: @SeeSharp But if it's a slightly long message, then the title gives a good "heads up" about the contents of the message.  Even with a real short message, it's probably best to stay consistent.
Comment: @SeeSharp The message icons help categorize the type of message, but it doesn't necessarily convey what the message is about.
Comment: I am really liking the discussion. I thought this was trivial. But, again, the Message description conveys the information. So, warning icon + description makes it 'a warning message'. So, still should I put a caption based on each context ?
Comment: cool. nice discussion. I think I should give. Subtle, but matters a lot for a nice UeXp !
Answer: A window without a title does no favours for your accessibility users. Windows should always have a title.
You mentioned a warning icon, but unfortunately that's not helpful for people who use a screen reader. Screen readers typically look for a title in dialogs to give context.
Answer: Firstly the point of the title is to provide a context within which the message box is appearing. It helps relate the cause, the action, and the response to it.
Secondly, user are so used to titles, that a blank title makes you think there's an error or missing text that was meant to be there. It's why pages in printed media say 'this page intentionally left blank' instead of leaving the reader wondering if it was actually supposed to be blank.
So whilst there's not exactly a written rule for every ui toolkit that says thou shalt always title a message box, it kind of doesn't make sense not to - when you can perfectly easily. It just feels a bit lazy...?
Answer: From MSDN:

lpCaption [in, optional]
Type: LPCTSTR
  The dialog box title. If this parameter is NULL, the default title is Error.

It will show a default caption, and if the caption is not correct (when it is not about an error), it will confuse the user. I wouldn't do that.
Comment: I have put string.empty in my code & checked in like that.
Answer: There is much to do with the message boxes, and its often used for providing some kind of information(an error, or information, warning etc.)
.NEt itself provides a number of overloaded methods when you use MessageBox, which simply added that you are not bound to specific detail, If your message(than caption) can only capable of what you actually wants to tell, that's enough, else there is Caption, MessageBoxIcon, MessageBoxButton, which further can be added to your functionality, helps user to get it the way you want.


How can a child with one Chinese parent, but a non-Chinese passport travel to China?

Question: My daughter has one Chinese parent, and one parent from an other country (A). She was born outside of China. At birth she acquired citizenship of country A, and she has an A passport. How can she travel with us to China (P.R.C)?
Comment: Thanks for this great Q&A, +1 from me for both. Feel invited to be around on this site and in [chat](http://chat.stackexchange.com/rooms/591/you-are-here), there is plenty of interesting [questions related to china](http://travel.stackexchange.com/questions/tagged/china), plenty of which without answers, e.g. [Can a spouse of a Chinese citizen somehow visit China visa-free?](http://travel.stackexchange.com/q/77029/32134) and [What determines the requirement for a guide when a foreigner wants to drive a vehicle he brought from abroad in China?](http://travel.stackexchange.com/q/74780/32134)
Comment: Just dropping in to let you know that there is an option box when asking a question to immediately add a self-answer to it; so you don't need to ask first, answer later. In any case, assuming this is not noted anywhere else, it is a good thing to know!
Comment: I think that box doesn't show up for a newly registered account, maybe to keep the interface simple?
Comment: Thanks. I am not actually an expert on China, I can only share what I have learnt.
Comment: @napu: I believe it's there for all accounts. Be sure to tick the checkbox to reveal the answering window.
Comment: Welcome to the site. As you probably know by now, since you have a decent amount of reputation on other Stack Exchange sites, Stack Exchange isn't a discussion forum. I  don't see how your post answers the question; it just seems to be an "I'm having this problem too" post. But I do hope you find a good solution to the problems you're having.
Answer: China will not issue a visa to a child with a Chinese national parent, as the child is considered to be a Chinese national. China does not allow dual citizenship, and will not issue a full Chinese passport either.
You should apply for a Chinese Travel Document, which looks similar to a passport and will allow the child to enter and exit China. It is valid for two years. After that you may be able to renew it, or China may demand that one of the nationalities is renounced. You can apply for it in the same places where Chinese nationals abroad apply to renew their passports. She will still need her other passport to enter countries other than China.
Comment: That sounds rather draconian. Are we saying then that, possibly, a non-Chinese individual with one Chinese parent may only ever be able to visit China for a single two-year period and then will never again be allowed to visit China, unless they renounce their actual nationality?!
Comment: @LightnessRacesinOrbit Or they renounce their Chinese nationality (according to this answer).
Comment: The situation in the UK is that we have to go to two different places to get documents to travel to China: my wife and I to the Visa Centre as UK citizens, and my daughter (with us) to the Consulate. In addition, we had difficulty typing in information for our daughter, where the site kept changing her English name to the Chinese version of it. We did not know how to make an appointment to the Consulate. We travelled to London twice, wasting time and money with no result. Sadly, we cancelled out trip. The concept of Travel Document is not working well for our daughter.
Comment: @immibis: Oh, right, yes. That's a little less draconian then :)
Comment: What you describe seems only to be the case when the parents do not have permanent residence in the country. The answer below seem to be more correct.
Comment: There is no basis to "demand that one of the nationalities is renounced" under Chinese law. China does not recognize the person's other nationalities.
Answer: If the parents (one Chinese, one not) settle permanently outside China then the child does not acquire Chinese nationality via 'jus sanguinis', so long as they acquire country A's nationality at birth (see this page). So, in this case the child can obtain a visa in the usual way. (However, the situation may be different if the parents have not settled permanently outside China.)
My personal experience: my wife is Chinese, I'm British and we live in the  U.K. Our son was born in the U.K., acquired British nationality, and was able to apply for a Chinese visa prior to his first trip to China.
Comment: Interesting. Does you wife still have a Chinese passport? It may have complicated our case that we live in a third country.
Comment: @napu36 At the time that we first applied for my son's visa, my wife had already become a British citizen, though she was required to submit her Chinese passport with the visa application. I guess your case must be a bit different. I think that, to fully answer this question, we would need input from a lawyer with knowledge in this area of law.
Answer: The first issue is whether the child has Chinese (PRC) citizenship. According to Article 5 of the PRC Nationality Law, a child born abroad to at least one Chinese-citizen parent will automatically have Chinese nationality at birth, unless at least one parent was a Chinese citizen who has "settled abroad", and the child has a foreign nationality at birth. In this case, we know that one parent was a Chinese citizen at the time of the child's birth, and the child has a foreign nationality at birth. So it hinges on whether the Chinese-citizen parent has "settled abroad" at the time of the child's birth. The Chinese government interprets "settled abroad" to mean having permanent residency abroad (e.g. a green card). If the Chinese-citizen parent had foreign permanent residency at the time of the child's birth, then the child does not have Chinese citizenship, and would need to get a Chinese visa to visit China.
If the Chinese-citizen parent did not have foreign permanent residency at the time of the child's birth, then the child is a Chinese citizen, and needs to use a Chinese-issued travel document, not a foreign passport, to enter and leave China, as China does not recognize the foreign nationalities of its nationals. The current practice is for Chinese consulates to issue "PRC Travel Documents" to dual-national Chinese children outside China. This is a travel document in booklet form just like a passport, and says on its Notes page "The bearer of this travel document is a citizen of the People's Republic of China." It is valid for 2 years, and can be used to enter and exit China during its period of validity. A new PRC Travel Document can be applied for at any PRC consulate outside China when the old one expires, as many times as needed (until the child is 18, according to reports). If the PRC Travel Document expires or is lost while in China and the person needs to exit China, they would apply for an Entry/Exit Permit to use to exit China, and then get a PRC Travel Document (if desired) at a PRC consulate abroad after they get abroad.
(It is unclear why PRC consulates do not just issue regular PRC passports to these dual-national children; they do issue regular PRC passports to single-national children. Both PRC Travel Documents and PRC passports identify the bearer as a PRC citizen, so there is no difference in that sense. I can see nothing in the PRC passport law that says issuance is affected by the possession of other nationalities. It seems to be just an unofficial unexplained policy. In practice though, there is a difference in usage between the two, as Chinese exit controls will let someone with a PRC Travel Document and a foreign passport leave China with no problems, but they will not let someone with PRC and foreign passports leave (and you would usually need to show the foreign passport as they want to see evidence you can enter the destination). Maybe this is a way of distinguishing "real" dual nationals, who would have a PRC Travel Document, from people who have already lost PRC citizenship by naturalizing abroad and are pretending to be PRC citizens, who would have a PRC passport.)
Complicating the situation a bit is that starting in 2015, there have been anecdotal reports that a few (but not all) Chinese consulates in the US have been refusing Chinese Travel Documents to dual-national children who have lived abroad for over a certain amount of time (like 18 months). There have been conflicting reports of this, sometimes describing the situation shifting back and forth by month at the same consulate. Because the situation is somewhat unclear, if your child is a dual national, you might want to fill out both a visa application and a Chinese Travel Document application just in case.
Comment: I am an Indian, have a Chinese wife, but we live in Norway. Now, Norway does not give citizenship on the basis of birth, so we are quite confused what would happen to our child. Norway will not give its citizenship; and China, will it also not give it, because my wife is "settled abroad"? (She is still a Chinese citizen.) I don't want the child to keep applying for a Chinese visa every time we visit China, so I hope we can get a Chinese passport for our child.

Thanks in advance for replies!
Comment: @greatbears: Well, Article 5 says a child born abroad to at least one Chinese citizen parent is a Chinese citizen at birth unless at least one parent is a Chinese citizen who has "settled abroad", and the child has a foreign nationality at birth. In this case the child has a parent who is a Chinese citizen who has "settled abroad", so the question is does the child have a foreign nationality at birth. (If yes, then no Chinese nationality; if no, the the child automatically has Chinese nationality at birth.)
Comment: @greatbears: The child does not have Norwegian nationality. But according to Indian nationality law, a child born abroad to an Indian citizen will be an Indian citizen at birth if registered at an Indian consulate within 1 year of birth, with the parent declaring that the child does not hold the passport of another country. So it's somewhat complicated, because it seems like whether the child has Chinese nationality depends on whether you register the child at the Indian consulate or not.
Comment: @greatbears: I am not sure the Chinese consulate goes that deep though; they may just see that the child does not have Norwegian nationality and automatically assume that the child does not have a foreign nationality. You will have to try and see.
Comment: Thanks everyone; I do not plan for Indian nationality, as with the OCI card,  the child will not have a problem visiting India. He cannot have Norwegian nationality anyway. I hope Chinese nationality is not a problem in such a case.
Answer: Me and wife are both Chinese with permanent residence in the UK but not UK citizen. Our daughter was born in Apr 2015 in the UK and she isn't allowed to be a Chinese national. So she is British and travels with Chinese visa on her UK passport.
However, this is a recent change. Before Apr 2015, children born in the UK to Chinese parents with permanent residence (but not naturalised) are allowed (by the Chinese government) to be Chinese (and if you so choose, they can't be British).
So the situation is not clear. It's best to call the embassy to find out.
Comment: There was no change. It doesn't make sense to say "they can't be British" because according to British nationality law (since 1983), a child born in the UK to a parent who was "settled" (has permanent residence) is automatically and involuntarily a British citizen at birth. And according to Chinese nationality law (since 1980), such a child would not be a Chinese citizen because they had a parent who was a Chinese citizen with foreign permanent residence, and the child had foreign nationality at birth.
Comment: A situation in which a child born in the UK would have both British and Chinese citizenship at birth would be if one parent was a British citizen and the other was a Chinese citizen without permanent residency. The child would be a British citizen because they were born in the UK to a British citizen parent. The child would also be a Chinese citizen because they were born to at least one Chinese citizen parent and there was no parent who was a Chinese citizen with foreign permanent residence.
Comment: @user102008 there was no change to the letter of law, but do you know how it is practiced? Before Apr 2015, babies with permanent residence Chinese parents are given the chance to apply for Chinese citizenship if parents fill in the form to revoke British citizenship. And I said they can't be British because if the parents had made the baby Chinese, then the Chinese law of single nationality is in force, so they can't be British.
Comment: But whether someone has British nationality is determined solely by British law. The UK does not allow unmarried children under 18 to renounce British citizenship.


install vmware tools in zeroshell 2.0

Question: Situation
I'm using the 2.0 RC2 iso from http://www.zeroshell.org in a VMware ESXi 5.1 virtual machine and am trying to adapt the instructions on HowTo: vmware-tools in ZeroShell for v2.0 as the file layout is a little different.
Initial Deviation from Instructions
The instructions work successfully up to the line to unlink /cdrom/modules and re-link to /Database/rootfs/modules.  If you try and work around that by doing the same to the entire /lib folder it won't run any more programs.
Among other things, I believe vmtools needs to modify the content of the /lib/modules directory but in zeroshell, by default, this is stored and run from the CD.  I can't change the link for /lib/modules yet because the entire /lib is a symbolic link to /cdrom/lib and is read only.  So I'm trying to move /lib to the hdd by running the following but it has errors when running the ln command after unlinking /lib. This breaks everything and I restore from a snapshot to try again.
mkdir /Database/rootfs/lib
cp -a /lib/* /Database/rootfs/lib
unlink /lib && ln -s /Database/rootfs/lib /lib

To get ln work to work on that last line I tried changing it to be "ln -sfn /Database/rootfs/lib /lib"
any ideas on how to install vmware-tools in this VM? I've tried the .img.gz file from their download page and it just has a /dev/sda1 = /boot and /dev/sda2 = an iso9660 CD image and /dev/sda3 has profile storage, which results in the same problem of having to move /lib.
Extra System Info
After extracting the vmtools tar.gz file and before running the rest of the procedure, the system looks like
cat /etc/fstab
tmpfs      /            tmpfs      defaults        1     1
/dev/cdrom              /cdrom              iso9660 ro,remount 0 0
proc          /proc        proc     defaults        0     0
none          /sys         sysfs     remount        0     0
devpts        /dev/pts     devpts   gid=4,mode=620  0     0
shm           /dev/shm     tmpfs    defaults        0     0
usbfs       /proc/bus/usb  usbfs    defaults    0     0

cat /etc/mtab
tmpfs / tmpfs rw 0 0
proc /proc proc rw 0 0
/dev/sr0 /cdrom iso9660 ro 0 0
none /sys sysfs rw 0 0
devpts /dev/pts devpts rw,gid=4,mode=620 0 0
shm /dev/shm tmpfs rw 0 0
usbfs /proc/bus/usb usbfs rw 0 0
/dev/sda1 /DB ext4 rw,noatime 0 0
/DB/_DB.001 /Database none rw,bind,noatime 0 0

ls -al / | grep ">"
lrwxrwxrwx    1 root     root           10 Nov 21  2012 bin -> /cdrom/bin
lrwxrwxrwx    1 root     root           10 Nov 21  2012 lib -> /cdrom/lib
lrwxrwxrwx    1 root     root           21 Jul  4 02:57 sbin -> /cdrom/sbin
lrwxrwxrwx    1 root     root           20 Jul  4 02:57 usr -> /cdrom/usr

ls -l /lib/modules
lr-xr-xr-x    1 root     root           14 Nov 21  2012 /lib/modules -> /cdrom/modules

Current Problems
When running "./vmware-install.pl" it complains that it cannot find gcc or the kernel headers, and hence cannot compile modules.  I'm particularly after the VMCI module and the memory module would be handy aswell.  The distro already comes with a vmxnet3 driver and paravirtual disk controller driver so I don't need to compile those.
With the below instructions it looks like it is running fine, but if I try and use the viClient to shutdown or restart the VM it gives me the error: "The request to Reset this virtual machine failed because the corresponding VMware Tools script did not run successfully. If you have configured a custom reset script in this virtual machine, make sure that it contains no errors."
when I go to the shell and try and run what I think is the command to shutdown it says
/etc/vmware-tools/poweroff-vm-default poweroff-vm /etc/vmware-tools
Thu Jul 4 09:29:44 CEST 2013 : Executing '/etc/vmware-tools/poweroff-vm-default'
Thu Jul 4 09:29:44 CEST 2013 : Executing '/etc/vmware-tools/scripts/vmware/network'

Jul 04 09:29:44 network: ifup not in search path.

Current Method to Install VMtools
Ensure that the linux.iso file is connected to cd2 and then paste the following code in to the console

mkdir /mnt/cd2
chmod 555 /mnt/cd2
mount -t auto /dev/sr1 /mnt/cd2
cp /mnt/cd2/VMwareTools*.tar.gz /Database
cd /Database
tar -xvzf VMwareTools*.tar.gz
rm -f VMwareTools*.tar.gz
umount /dev/sr1

cd /Database
mkdir rootfs
cd rootfs
mkdir sbin
mkdir usr
cp -a /sbin/* /Database/rootfs/sbin
cp -a /usr/* /Database/rootfs/usr

mount -o remount,rw /
unlink /sbin && ln -s /Database/rootfs/sbin /sbin
unlink /usr && /cdrom/usr/bin/ln -s /Database/rootfs/usr /usr

mkdir /Database/rootfs/lib
cp -a /lib/* /Database/rootfs/lib
rm -f /Database/rootfs/lib/modules
cp -a /cdrom/modules /Database/rootfs/lib/modules
cd /Database/rootfs/lib

ln -sfn /Database/rootfs/lib /lib

mkdir /Database/vmware-tools
cd /Database/vmware-tools
mkdir etc
cd etc
mkdir init.d
mkdir rc.d
cd rc.d
mkdir rc0.d
mkdir rc1.d
mkdir rc2.d
mkdir rc3.d
mkdir rc4.d
mkdir rc5.d
mkdir rc6.d

cd /Database/vmware-tools-distrib
./vmware-install.pl

ensure the paths all start with ''/Database/vmware-tools/'' and when manually typing ensure that they end with a trailing /
Then you're ready to configure.  Say no to everything, it complains about not being able to find gcc or kernel headers and hence cannot compile modules like the vmci module to allow communication with the host for commands like shutdown guest.  <---- This is a problem

cd /Database/vmware-tools/usr/bin
./vmware-config-tools.pl

VMtools will currently be running, but to ensure that it starts with the machine paste in the below
cd /Database/vmware-tools
mkdir startup
mkdir startup/etc
mkdir startup/etc/vmware-tools
cp -a /etc/vmware-tools/* /Database/vmware-tools/startup/etc/vmware-tools

cat <<EOF > /Database/vmware-tools/startup/run.sh
#!/bin/bash
mount -o remount,rw /

unlink /usr && /cdrom/usr/bin/ln -s /Database/rootfs/usr /usr
unlink /sbin && ln -s /Database/rootfs/sbin /sbin
ln -sfn /Database/rootfs/lib /lib

cp -a /Database/vmware-tools/startup/etc/* /etc

/Database/vmware-tools/etc/rc.d/vmware-tools start
EOF
chmod 766 /Database/vmware-tools/startup/run.sh

Now WebLogin into ZeroShell. Go to the panel "Startup/Cron", select "post boot", enable status, and add the following line:  ''/Database/vmware-tools/startup/run.sh''
Answer: I would suggest trying bind mounts (like /Database already is) rather than the unlink/relink games that page has you play.
Try something like /Database/rootfs/lib/modules   /lib/modules   none   rw,bind   0 0 in /etc/fstab for /lib/modules.
Alternatively, I assume your problem replacing the /lib symlink was that commands started to fail immediately after the /lib symlink was removed. That's likely because the replacement was not atomic. You might have better luck with ln -sfT /Database/rootfs/lib /lib as that should be more atomic if not, in fact, actually atomic (I don't know offhand).
Comment: except /etc is in RAM on a tmpfs and is lost on reboot and I don't know if I can change its contents before it has already mounted the file systems.  Zeroshell's ln doesn't support the T option so I tried the "ln -sfn /Database/rootfs/lib /lib" and that did the trick. Now to see if I can get through the rest...
Comment: You don't need to make the change before things get mounted normally. You can always remount them later by calling mount appropriately. Though not having those mounts available on boot is certainly going to make starting the vmware tools at boot a bit tougher. (Though that's the case for the unlink/relink stuff you were already doing too, no?)
Comment: yes, so it has to run an extra script when it boots.  I've updated my question with the current method of install that includes this script.

install vmware tools in zeroshell 2.0


Search results page not inheriting from parent site

Question: I am using variations and have 2 sites under main:
Main Site

English site
French site

I created a search results page in English site as below and inserted search web parts.
<code>http://myserver/en/Pages/Search.aspx
</code>
I have defined this search page in top level site which is Main Site under "Send queries to a custom results page URL"
When I search on Main Site then it shows my search result page which is fine.
Now in my English site and other sub sites Search settings, I have chosen option "Use the same results page settings as my parent" but in none of the sub sites it takes my to my custom search results page. And instead it always shows default search results page.
If I specifically define this search results URL under "Send queries to a custom results page URL" in all sub sites, only then it shows my search results page.
What am I doing wrong? I want to use this search results page for all sites or please give me another alternative to do this.
Answer: Ok I found out I needed to set search setting in "Site Collection" which solved the problem.


Is it useful to answer old questions?

Question: When I am looking at questions, I see the related questions over to the side. Recently I have been clicking on them and adding my own two cents. Then I realize that the questions is a few weeks or months old and the original person may never even see it. Is it considered valuable to answer these sort of question (for the sake of future visitors?) or is it simply vanity and I should pass on them after a certain period of time.
Comment: I am really tempted to answer this question "No" four years after it was asked.
Answer: I would definitely answer the old questions.
For one, a new answer "bumps" them to the top of the front page.   Frequently, a new answer to an old question will revive a question and give it a breath of fresh air including many new insights.
Stack Exchange also encourages this through the necromancer badge.
Answer: I think yes -- if it's a good answer, I will always upvote it, regardless of how old the question is.
However, this assumes the original question is interesting enough for me to click on in some way -- if it's a really bad question (title, etc) or an extremely obscure topic. However, this can sometimes be fixed with editing..
Thus, since anonymous and low rep now have the ability to submit edit suggestions, I would "punch up" the question through judicious editing when answering, to maximize the chances of people seeing both the question and your answer.
Answer: Yes, but only if the new answer adds real value. If the new answer looks good, but reading all the others shows that the new one added no new details at all, it really offered little more than a bump and clutter.
Comment: There's no harm in adding an answer even if its only improvement over others is that it "looks" better and in fact I much prefer reading answers that are well formatted and organized nicely.
Comment: Kenny, I respect your opinion, but disagree. If you answer, and content is good, another member should offer some kind editing/formatting, not an attempt to plagiarize your content. In fact, when I see a great answer that's just missing one important point, I'm likely to just add it. No OP has even rolled one back on me, as they never conflict with his intent.

Is it useful to answer old questions?


Should portfast be configured on the physical interfaces or on the logical port-channel, or both?

Question: I'm using a Cisco 3750 switch and have two physical ports configured in a port channel that connects to a router. Should I configure spanning-tree portfast on the physical interfaces or on the port-channel virtual interface, or both?
Comment: Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
Answer: Port-channeling is a way to bypass the topology limitation of spanning-tree allowed to only having a single path.  In spanning tree, the logical topology of the data-plane will arrange itself into a logical tree where you can only have 1 active link between the same two devices.
By implementing a LAG (link aggregation group: aka Port Channel) you fool spanning tree into thinking it is one single port instead of a multiple ports.  So from this perspective spanning tree does NOT see the underlying ports, only the LAG itself.
To answer your question you can put it on both without issue, but it will only take effect on the port channel as spanning tree does not see the member ports.

A better practice would be to actually enable spanning-tree portfast default globally.  This would allow any port that does NOT receive bpdu packets to behave as an edge port and accelerate the spanning tree process.  More importantly if you bounce a portfast "edge" port it will NOT trigger a spanning tree TCN (topology change notification).

This is all assuming you're using the LAG port as an access port.  If you're trunking vlans across the port, you need to specifically enable portfast for trunks.
I hope this helps to clear things up.
Answer: Port channels or aggregated links are used between switches - those links should not use portfast as that can cause a temporary bridge loop when a redundant link comes up.
Portfast skips the learning phase on an upcoming spanning tree interface and is for edge links only where it is not normal to have redundant links. Portfast decreases the delay between link up and actual forwarding/connectivity that may irritate some network clients.
As it modifies STP behavior, portfast needs to be applied to the logical port-channel interface in any case. Applying it to the physical interfaces will either have no effect or won't be possible at all.
Comment: @Zac67 port-channel is not only used between switches. If you team NICs on a host you may or may not also need to define a port-channel on the switch (es) they uplink to, depending on how you configured the team on the host side.  Hence the terms "switch dependent" and "switch independent".
Comment: @Zac67 I know. I was just adding to what you said about port-channel being used between switches, so everyone knows that is not the ONLY place you can use them.
Comment: Thanks. What do you think about portfast on an aggregated link to an end-host (like a router in this case)?
Comment: I wouldn't use it against a router that likely has no problem with a slightly longer delay between linkage and forwarding.
Comment: @JesseP. LAG is more common between switches and the OP asked about a switch-router link. With a host, I'd use *portfast* but only if there was no or little chance that any forwarding was configured - essentially only on a physical server but not on a virtual host (which has its own virtual switch anyway).


Any cameras move the sensor instead of lens elements for focus?

Question: All the cameras that I'm aware of move lens elements to obtain focus, although I'm not familiar with the workings of in-phone cameras. It occurred to me this morning that you could also focus by moving the sensor in or out. Just curious if a) it's really possible, b) it has any advantages, c) it's been done?
Comment: Do spider eyes count?
Comment: It doesn't make much economic advantage, at least with SLRs. The lens is the expensive part with lifetime measured in decades, while body with sensor is the cheap and disposable part meant to be replaced in 2-3 years. So packing expensive moving mechanism for focus with part that already has another expensive moving mechanism for zoom has bit more sense.
Comment: Wouldn't it allow for "macro mode" with any mounted lens if the sensor could be moved further apart from lens? I mean this as a hypothetical advantage, as the camera would need a deep well for the sensor to creep into.
Answer: Not a digital camera/sensor, but the Contax AX film SLR was able to move its film plane forward and back via a ceramic rail and ultrasonic motor in order to be able to autofocus the normally-manual-focus-only C/Y mount Zeiss lenses. Indeed, Hasselblad V system lenses could be mounted to the Contax AX via an adapter, and the moving film plane allowed for autofocus with these lenses too.
You can find a sales brochure for the AX with information on the feature here:
http://www.forums.camera-info.com/contaxinfo/broshures/AX/FrameSet.htm
Comment: +1 Also, that link says that moving the film plane is common for large format cameras.
Comment: Some old rangefinders work this way as well (though manually). I have an early Mamiya 6 that focuses by moving the film plane. http://camerapedia.wikia.com/wiki/Mamiya_Six
Comment: The AX was only semi-AF—it only had 10ish mm of movement—so for longer lenses you had to manually set focus to something ballpark and let the camera AF from there.
Comment: I'm surprized to hear this done for a Zeiss lens. I supposed that this method of focusing provided lower image quality than focusing through moving groups of lenses. In my mental model, lenses are designed to project the image to a particular precise distance, and changing this distance can introduce defects such as chromatic aberration.
Answer: AFAIK, it has not been done yet but it is possible. Canon recently patented the idea. There would be some latitude for determining focus but not as much as moving lens elements. Many modern lenses move multiple elements in middle groups to be able to focus throughout their entire zoom and focus ranges. The advantage though would be that you would not change the relative position of optical elements which could help preserve aberration corrections.
Answer: View cameras are, essentially, two flat panels (normally squarish) with a bag or bellows in between. One panel holds the sensor (or ground glass/film holder) and the other panel holds the lens (which normally doesn't itself have movable elements). The panels can be moved independently, so you could focus by moving the rear panel.
A potential advantage of rear focusing is that for close-in photography keeping the lens fixed also keeps the magnification fixed (otherwise you might end up wanting to move the whole camera to get in focus). [See comments]
See Wikipedia's page on this camera type for pictures: https://en.wikipedia.org/wiki/View_camera
Comment: Moving the film/sensor back away from the lens also increases magnification. That's how extension tubes work: they move the entire camera further back from the lens.
Comment: Keeping the lens fixed keeps the viewpoint fixed, not the magnification.  Keeping the viewpoint fixed is important.  In my experience, it is a huge advantage when taking pictures of relatively small objects with a 4x5.  In fact, if you move the camera and then move the lens to focus, it might be outright *impossible* to focus only by moving the lens.  For example, with a 150mm lens, it is impossible focus unless the film plane is at least 600mm away from the focal plane.
Comment: Right, doesn't really matter how you increase the distance between the lens and the sensor, not sure why I worded it that way (it has been a while since I've used a view camera). I guess from a workflow perspective (when using a view camera) with close-in shots you could put the lens where you wanted it and have it and the camera's position fixed and then adjust the focus using the rear standard. Not sure if that is a huge advantage.
Answer:
a) it's really possible

Sure. Whether you move the lens or the sensor, the important thing is that you're changing the distance between the two. I have a EF 50mm f/1.4, and when I turn the focus ring the entire internal barrel seems to move as one unit. If I were to clamp the front of the lens to something stationary and turn the focus ring, it'd be the camera body, including the sensor, that moves, right?

b) it has any advantages

Simplified lens construction (and associated cost reduction and improved reliability) would be one advantage. A disadvantage is that zoom lenses might be difficult or impossible to build. Also, some lenses move the optics a significant distance while focusing, so the camera might need to be fairly deep to cover the necessary range.

c) it's been done?

I don't know if it's been done at all with respect to focus, but some cameras move the sensor instead of optical elements to implement image stabilization. Two obvious advantages are that you get stabilization with every lens, and you don't have to pay for stabilization for every lens.
Comment: I'm also still waiting to see those non-stabilized lenses that are actually cheaper than their stabilized counterparts when the optical formula is the same. When comparing third party lenses in various mounts those made for systems with body based IS are rarely any cheaper than those made for systems with lens based IS. And I've yet to see a IS-less Sony lens with the same focal lengths, apertures, and image quality that is cheaper than its Canon/Nikon counterparts with IS.
Comment: And the not-so-obvious but oh-so-very-real disadvantage of body based image stabilization is that it provides the least amount of stabilization when one needs it the most: at longer focal lengths.
Answer: A standard camera for use with a telescope is focused this way.  In a typical optical telescope (I'm not sure if this is also true for the fancy new scientific research-oriented telescopes), you simply slide the the section that holds the camera (the same section that can hold an eyepiece) in or out to focus the image on the camera's CCD.  The camera (again, this is just in my personal telescope photography experience, but I imagine it would hold for any telescope camera) has nothing to do with the focusing.  It just records the photons that strike it.
Comment: This occurred to me as well; but I'm not sure if it's valid.  The focuser is part of the telescope (lens equivalent); and it's only the camera moving not the telescope because in most cases its the scope attached to the tripod with the camera hanging off the back. (IIRC similar weight/balance reasons cause a lot of telescope sized telephoto lenses to use similar mounting mechanisms.)  The position of the imaging sensor within the camera remains fixed.
Comment: I might be misunderstanding what you're saying, but let me address what I think you're saying.  I'm not an expert on telescope construction, but from what I have read, telescopes are more or less unadjustable (sure, you can change the shape of the mirrors in a reflector, but that doesn't seem to be what the OP was asking).  According to Wikipedia, both [refractors](https://en.wikipedia.org/wiki/Refracting_telescope) and [reflectors](https://en.wikipedia.org/wiki/Reflecting_telescope) manipulate light in a way that the user can't significantly alter....
Comment: What the user can do is insert an eyepiece, which helps determines magnify and focus the light for an eye, or a camera, which consists of a sensor, filters, and possibly (I don't know) some small focusing lens.  In this scenario (and the eyepiece one as well), focusing the image involves moving the camera (or eyepiece) in or out until the image is clear.

If there is indeed a small focusing lens in the camera, then I leave it up to you and others to decide whether that makes this relevant to the original question.  If there is not a lens, then this answers the OP satisfactorily, I believe.
Answer:
a) it's really possible

Sure.

b) it has any advantages

No specific requirements for lenses for AF to work. Every objective may be focused this way.

c) it's been done?

I recall that Contax G or AX had similar system but I cannot find confirmation of this ATM.
Other than that, all old enough objectives had focusing done only with single helicoid moving lens back and forth inevitably causing breathing - quite similar to what you are asking about.
There are certain disadvantages though:
1) focus breathing
2) macro not achievable without sensor being able to move few mm in and out
3) objectives will behave differently from when being used with internal focusing system.
4) variable speed (brightness drops at macro distances)
Comment: Contax G did not have this feature. Maybe you are thinking of the Contax AX? See my answer.
Answer: To follow up on all the other answers, it seems that is has only really been done with
1) Image stabilization on the image sensor.
I imagine this is done as it requires just minor, rapid focus (along with field-of-view) adjustments.  Perhaps they use piezo style actuators for this.
2) Push-pull style focusing (View) cameras
Here there is no rotation during focusing, so there does not need to be any rotational symmetry involved.
In a normal SLR, the lens can use a rotational motor to turn the lenses without worrying about the sensor turning. If you wanted to move the sensor, you would need a linear motor or a way to translate a spinning motor to a linear motion so as not to turn the sensor. Caleb's answer addresses this by noting what happens if you clamp the lens such that the camera body rotates (you focus, but your image may be upside down on a now rotated sensor)
Comment: "Perhaps they use piezo style actuators for this." - actually a good old spring suspension works wonders by itself.


Can I use cosine similarity as a distance metric in a KNN algorithm

Question: Most discussions of KNN mention Euclidean,Manhattan and Hamming distances, but they dont mention cosine similarity metric. Is there a reason for this?
Comment: This problem is called "maximum inner product search". There are efficient solutions.
Answer: Short answer: Cosine distance is not the overall best performing distance metric out there

Although similarity measures are often expressed using a distance metric, it is in fact a more flexible measure as it is not required to be symmetric or fulfill the triangle inequality. Nevertheless, it is very common to use a proper distance metric like the Euclidian or Manhattan distance when applying nearest neighbour methods due to their proven performance on real world datasets. They will therefore be often mentioned in discussions of KNN.
You might find this review from 2017 informative, it attempts to answer the question "which distance measures to be used for the KNN classifier among a large number of distance and similarity measures?" They also consider inner-product metrics like the cosine distance.
In short, they conclude that (no surprise) no optimal distance metric can be used for all types of datasets, as the results show that each dataset favors a specific distance metric, and this result complies with the no-free-lunch theorem. It is clear that, among the metrics tested, the cosine distance isn't the overall best performing metric and even performs among the worst (lowest precision) in most noise levels. It does however  outperform other tested distances in 3/28 datasets.
So can I use cosine similarity as a distance metric in a KNN algorithm? Yes, and for some datasets, like Iris, it should even yield better performance (p.30) compared as to Euclidian.
Comment: big +1 for posting link to highly relevant paper, thanks! I'm gonna have to compare L2 and cosine for my use case, I'll let you know what I find.
Answer: as Lejafar mentioned cosine violates triangle inequality however maybe this repo will help you
Answer: Although cosine similarity is not a proper distance metric as it fails the triangle inequality, it can be useful in KNN.
However, be wary that the cosine similarity is greatest when the angle is the same: cos(0º) = 1, cos(90º) = 0. Therefore, you may want to use sine or choose the neighbours with the greatest cosine similarity as the closest.
Comment: I'm minimizing L2, but I should maximize cosine distance -- dang this is a good callout thank you
Comment: use 1 - cosine similarity. it is the method of choice in many papers on clustering
Answer: If there does exist a reason it probably has to do with the fact the Cosine distance is not a proper distance metric.  Nevertheless, it's still a useful little thing.
Comment: It fails the triange inequality which is a requirement for a proper distance metric.
Comment: 'Cosine distance is not a proper distance metric' -- Why?
Comment: [Interesting](https://stats.stackexchange.com/q/198080/84191).  I understand that it fails the triangle inequality. But, that that it is a requirement for a proper distance metric, is a new info to me. Thanks :)
Comment: View definition of a metric here by https://en.wikipedia.org/wiki/Metric_(mathematics)


How to connect my mining pool to another mining pool

Question: What are some ways to connect my mining pool to another mining pool without altering any settings on the miners?
Comment: What effect are you trying to get?
Comment: I want to set up a pool that allows people to connect to it and then be able to outsource their mining power to another pool.
Comment: Your question and title are a bit unclear, we're gonna have a hard time getting you an answer.
Answer: Outsourcing to a larger pool is definitely possible and can help reduce variance. Conceptually, to them you're just a very large miner. On your side, instead of submitting a found block directly to the network, you submit it to the larger pool, and any shares you accept can be passed on the larger pool. (Regarding difficulty settings: Having different difficulty settings between your miners and the larger pool is find as long as the larger pool's difficulty does not exceed that of any of your miners. If that is the case, you must either bring down the difficulty of your miners or convince the larger pool operator to raise your difficulty (which they may very well agree to, since it reduces the load on their stratum).
For the actual implementation, I'd talk to someone who's done it before. TradeMyBit outsources its LTC and DOGE mining to MultiPool. I've talked to the owner merc before, and he seems like a nice guy. You could try contacting him here to see if he's willing to give you any tips.


remote multiple raspberry pi using ssh without password

Question: I using
 for i in <ip1> <ip2> ... <ipn>; do ssh pi@$ip sudo halt; done
to turn off multiple raspberry pi. But i don't want iput password one by one for a lot of raspberry pi. So what should I do that?
Answer: This question is not Raspberry-specific.
Read up ssh key-based authentication as put e.g. here
As soon you have the shared key created and copied it onto the target hosts (simplest method: use ssh-copy-id), you can start an ssh agent on the coordinating host (e.g. in its .profile or .xinitrc) and only need to type the key password once per session with ssh-add.
Or use passwordless keys.
Comment: ... and if I may add: check out Steve Robillard's series on the topic on our blog: [SSH Security and Usability – Part 1 (and follow-ups)](https://raspberrypise.tumblr.com/post/148032481829).