csydas

I'm from the US and left for Europe some time ago; seeing the difference in cultures and how countries and cities are run inspired me to reflect a lot on what we were taught growing up in the US, and as a result of that reflect I've gotten very skeptical of anything promoting American Exceptionalism; what we learned in schools was very much so a Disney version of American History, and at least in my experience, advocating for American exceptionalism especially when it comes to the members of the original early US government is usually an indicator to treat with suspicion.

I was also confused why this was on HN, as reading the article, it is very much so fanciful in nature, focusing purely on the sacrifice and struggles of the member of early congress. Nothing wrong with interest in this, certainly even if the original members of congress basically just copied from existing philosophies and such, in some ways it's still respectable that they soldiered on. But there is a lot more to the stories, and this article read to me more like just a love poem to the US' early government members. It was like being in 5th grade American History again)) cute but harmless I guess since I know better.

But I was curious, why on HN? Certainly it's not for the article content, as I'm not even convinced this isn't just AI written. So I wondered, "maybe it's the org itself? Are we supposed to recognize the author?", so I wanted to know who the author was.

As I get it, the author is a Christian musician and this is their self-promo site; nothing wrong so far, a little annoying to see all the plugs for their albums and actions, but hey, it's their site, so I shouldn't be surprised. But checking further, I can see that the author/musician is fairly active in both US and Christian politics, and is a fair supporter of the US right; anything involving a person active in US politics definitely makes me a little interested in what they're really doing, since it's nearly weekly if not daily that there is a new scandal in the US political sphere from all parties and even the most innocent. Combined with the article basically being US "Founding Father worship" in my opinion, I got quite wary of the person and wondered even more why this is on HN. (not even an interesting article frankly speaking) Seeing charities being pumped heavily on the site, combined with the fact that many popular charities in the US are not so great or used for scams by well off persons, I'm definitely curious who this person is and their history, since for some reason they're being spammed on a tech new aggregator site with an article that has nothing to do with tech.

In checking for controversies for this person, luckily looks like the worst controversy they have is purely in the Christian sphere about endorsing some specific translation of the Bible? Hard to tell, but at least it calms the alarms a little.

Granted this is a wall of text for what was about 30 seconds of reading and checking, but I hope you can understand the though process and why an article like this might trigger some alarms in people; the article is shared in a strange place, has little content except praising American Exceptionalism and hard work of the original government, it's not clear who this person is or why we should care about their article of praise, and at face value, and they're aligned with a political group that is rather contentious for their (now determined) illegal actions on last elections.

Same with security; quite a few of the S3 on-premises providers have backdoors that allow a person to bypass even the S3 immutable functions -- while I can understand that for specific customers who are using the S3 infra for Storage as a Service needing a way to clean up data from customers who left, such features are not advertised, and IMO, such S3 vendors should not be allowed to call their product "immutable", as it's anything but and most clients wouldn't even know about such backdoors.

The actual tech behind the providers might be pretty nice (this is arguable though...), but I would not say that this has any bearing on their trustworthiness as a provider.

the simple idea of implicit authority because of rank or position does not seem to work as soon as there is an incentive to misuse it; i don’t know what the answer is to this but i don’t really subscribe that the majority of the hierarchies matter so much.

the open source model of “just fork it if you don’t agree” isn’t great, but i would say it’s a start. maintainers define the goal and purpose of the project, but if you don’t like the rules, fork and go your separate ways. this is vastly simplified of course, but i think it better represents a model that would be reasonable for a hierarchy.

In the example I mentioned where the only footage of violence against me by persons is controlled by the persons themselves, what does it matter if it gets sent to S3 with immutability for 10 years? I still can't get that data if they don't want me to, in some countries the legal discovery process might _say_ all parties in a legal dispute must comply with the discovery process, but if one of the parties states they simply don't have the data, the courts can't do much of anything in such cases.

(The following statement is not to decry encryption, but more just to show that "deletion" is just an example there are many ways to "lose" such surveillance)

What if instead of deleting, we said "could not accesses, whoopsiekittens"? Let's say they do send the data to a centralized storage center, and naturally, they're encrypting all the data they send as per best practices? What exactly would I or anyone in my situation be able to do if the company "lost" the encryption key? Or they retrieve the data, muck a bit with the file to make it unreadable, and then just say "welp, guess just bad luck here"?

Unless it's _all open and all accessible_, it just means that those with the surveillance data have the power to use it however they want. Their excuses may be disprovable over time, but how long do you think most reasonable people would believe me if I tried to convince them that every excuse created was an intentional deception? How could I even prove it in most cases?

I am not advocating for non-stop surveillance and full open access to that surveillance to be clear; I have not thought what a system like that would look like and I am not able to say how it could work "for everyone", nor do I think it really could.

That's not the point, the point is instead that no matter how it's stored, unless everyone has equal access to it, it's still is surveillance that only those who control the surveillance data can use, regardless of what they decide to use it for. Body Cams for police in the US are a perfect example of this -- theoretically, they're for the public to use and for accountability with police, but since the police control the body cam footage and even get to decide that they don't _need_ the body cams at times, it's effectively surveillance that works for them when they want it to, and can be hidden when it works against them.

I would disagree to an extent -- for those in the brotherhood, yes it's about the relationships; for the rest, it's about the title(s). The hierarchy exists as an exclusionary barrier ensuring those outside it respect the hierarchy, while those inside play with the hierarchy of the brotherhood.

From my experiences across many businesses, this is an accurate representation of hierarchy and titles; they are a tool of force against those without the title, except for those who are close with someone else within the hierarchy who is willing to forgo the hierarchy and mission/purpose of the org. It's wildly inconsistent, prone to errors and really bad decision making, and it's quite hard to unravel for virtually anyone who wants another way of doing things.

Same with the idea of persistent surveillance -- it's only as good/useful as those who control the surveillance. In the case of authorities who are willing to abuse their power, surveillance does not make you more safe with these authorities, it just means that there is surveillance data they control, and it works for them, not not for you unless they decide to allow that.

Recordings get deleted "accidentally" all the time, and for most regulated businesses, at worst it's a small fine and some forms and mandatory training, none of which would make me feel particularly better if the "accidentally deleted" video was the only proof of the authority figures beating me to a pulp.

It's the same reason government backdoors can never be a tool "for the good guys"; once it's there, anyone able to pass a correct secret to the backdoor gets in, regardless of their intent or right to be.

Surveillance doesn't make us safer by default; it is a tool like any other, and it has it's legitimate uses and illegitimate uses. I don't feel safer if a stranger runs at me in an alley wielding a claw hammer just because I know that claw hammers are usually for construction work; I'm very much so aware that while a nail might survive the impact, my flesh and bone will not fare as well. Same with any surveillance -- I do not see how it's making _me_ safer, it's instead making someone else's job easier to monitor me, and I have no idea who that might be or why they're monitoring me.

This isn't to say it's always morally imperative wrong to have some sort of surveillance; I think a closed circuit recording system in a store is maybe frustrating, but I also don't have to go into that particular store I suppose. This does become a problem though once surveillance is everywhere, and even worse, when it's non-secured surveillance tech, so anyone might get at it.

Bumping into such personalities when it comes to their subject matter of expertise might be a challenge, sure. They are sure of themselves, direct to a fault, and it takes a lot to get them to reconsider their point of view or even explain it sometimes as they tend to get pretty dogmatic about it. It can be tempting to associate this with their skill level in the subject matter, but I see the same boisterous bravado from the C-levels and VPs when they decide there is something they _must_ opine on without having any knowledge in the domain.

In my experiences, those who just react "screw you guys I'm going home" when challenged aren't quite the superstars they present themselves as; the real superstars are far more open to their ideas being challenged because, in my experience again, they _like_ that sort of challenge. It's not earth shattering for their ego to be corrected, it's a moment of embarrassment, then a moment of appreciation as their mental model adjust and they begin to realize how many axioms they've held based of their previously incorrect logic begin to change/drop away, and they are unburdened by this correction, not harmed.

That is to say, I'm not sure that it's at all related to the skill level or special geniuses, it's just too easy to fall into a perception for oneself of "smart people are always right and when someone challenges them, the only correct path is to assert dominance above all else"; I don't think you need to tie such behavior to any particular industry or skillset, I can guarantee you that this happens in virtually all spheres.

With regards to the article, I think the author maybe has the start of a well developed idea that is marred by trying to associate it with success in the tech world; Steve Jobs may have bucked trends in the industry by going all-in on a nascent technology which ended up making Apple the household name for smartphones; I don't think it was out of any particular inspiration except that "this is coming anyways, and it's gonna make us a shitload of money"; Jobs might have known when he was wrong, but from the stories available, doesn't seem he was often humble about it.

But I would propose don't associate that kind of toxicity with the field; there are a lot of things that encourage such behavior, sure, but I think a lot of this is just the same outdated/ineffective ideas of leadership and decision making that have plagued the world for some time -- it's quite fast to see that this is in just about any community that gets big enough, and it's not exactly a game we _have_ to play, it's just one we continue to play for whatever reason...†

† Addendum: This is not to speak of workplace hierarchies and the ridiculousness that is the structure of a Corporation. From personal experience, such hierarchical power is absolutely a farce, the same in my mind as a pyramid scheme. My reasoning for this is that despite my very fancy title and rapid rise to this title, I know that the title is only useful so long as the person I'm talking with is willing to give it power. My colleagues will absolutely "go over my head" instead of discussing items with me if they don't get the answer they like right away, and our clients will do the same. I think the sooner we can do away with such stringent and pointless hierarchies the better, as it's hard for me to see them as anything but a show to allow the people with real power in such hierarchies to get their way.

No, I don't see how that's implied at all.

The arguments against back doors isn't that someone bad _might_ use it, it's that there is no need for the backdoor in the first place and there is no such thing as a secure back door that only intended people can use.

Authentication is not identification -- a client passing a secret to the server doesn't mean the person sending the secret should have this secret/be allowed to use this secret, it just means that they have the correct secret to get authorization from the server.

Thus, there is no such thing as a backdoor that only the "good guys" can use, this is an absurd statement (I am not implying you said this, but it seems to be the goal of governments and many tech companies for some reason...)

Technology is already chatty and insecure enough, we don't need yet another way for someone to get access to our personal devices.

The argument against back doors isn't misuse of the backdoors, it's that they shouldn't exist in the first place. There is no way to have a "safe" backdoor if any attackers with enough intent want to get access to whatever has the backdoor.

Perhaps some persons argue they'd be "okay" with the theoretical "good" backdoor, but I don't think that such arguments have been taken to their logical conclusions to explain how such a backdoor would ever ensure that only a person who really should be using it could be using it.

For example, dealing with a "legal threat" situation with the product I work on because a client got hit by ransomware and they blame our product because "we just got a security assessment saying everything was fine, and your product is the only other thing on the servers" -- checked the report, basically it just runs some extremely basic port checks/windows config checks that haven't been relevant for years and didn't even apply to the Windows versions they had, and in the end the actual attack came from someone in their company opening a malicious email and having a .txt file with passwords.

I don't doubt there are proper security firms out there, but I rarely encounter them.

This has been bugging me for awhile, but I don't think it's correct to associate identification with modern IT security, regardless of what it is. We don't have identity management, we have authorization management, and they're very different.

Identity management would mean that the system knows that the authorization request and secret it just received is coming from someone who is authorized to receive that authorization, which is obviously not the case. Even with MFA solutions (Yubikeys, geo-based fencing, etc), it's not really identity management unless someone actually sees you making the request, and even then, we can't know if the authorization request is done under duress or not or with malicious intent.

I'm not trying to suggest that this _must_ be a part of security, but I would say let's call it what it is; authorization management at scale. There is no identity, even with all the data that the companies vacuum up from users just trying to do their work, it's just deciding whether this user trying to access this resource has the correct secret to get access: or more succinctly, HTTPS and SSL Certs (and naturally any cert) doesn't validate identity, it just determines if the secret passed to the server should get authorized or not.

Similarly, Certs, as useful as they are, are still a mess; it's too easy to break the cert process with other common security practices, cert creation is too costly from the suppliers, unless you already understand how certs work, it's very easy to ask for a cert that doesn't meet your requirements which often means paying for another cert; SSL/HTTPS certainly are quite great and I don't want them to change or leave, but the cert process would be benefitted from a UX improvement. But it is important to understand that certs don't necessarily guarantee identity either, even with the names. All you can tell is that the chain is valid to the CA, so at some point, the cert was given specifically to a company. But breaches are so common, it's a bit too nervous to trust them blindly, and certs compromising stories also happen a bit too much. Unlike with Identity Management, I do think certs can solve this with some minor improvements to the process, and LetsEncrypt was a great step in this direction; just still, I have concerns about the idea that certs prove identity in a meaningful way.

Excuse the rant, but identity management has been on my mind a lot recently, and while the article was good, the 3rd panel mentions identification, which none of the items discussed in the comic truly addresses.

GDPR and the cookie banners are the perfect example. GDPR never says you need the gigantic banner, just that you cannot track without consent and it must be as easy to retract consent as it is to give it. somehow, this devolved into the cookie banners/walls, which are not required and in fact likely not compliant as very often there is no way to reject everything. i travel a lot in europe and asia and google is a clear example of a sort of malicious compliance. some countries in eu they show the reject all option easily. for others you have to log in and go through many settings pages. most other big companies are not much better or even worse.

that is the issue in my opinion. the goal of the privacy laws is very clear but the companies just do not care usually. i am very happy when a site truly respects my choice on their cookie/tracking consent banner, and even more so if they just don’t collect anything in the first place or ask for telemetry data instead of assuming it’s their right.

that is why i personally am not happy with the regulations from the US so far as they’re anaemic; the companies still treat your privacy and personal life’s details as if it’s their right to mine for data. until there is effectual law stopping all this and making such broad data collection something extremely rare and limited, nothing will change. and with how much of this data governments are buying, i’m not holding my breath that it’s going to get better.

until then i guess we need to continue to teach people that the technology they buy and use often is actively hostile towards the users in favor of giving the companies more personal data.

i have many of the same concerns about google, and at this point as long as there aren’t interruptions to their biggest contracts in a meaningful way, i would not put it past google to get more closed off.

But maybe it's worth challenging the question a little; what exactly is wrong with doing such a thing? What are the potential positives and negatives if one were to be more open with their failures? Are there any situations where a failure still yields positive results and an analysis of such a failure is useful?

The article itself is not very good and I think the article's author tries to hard to take an alleged social media story where an emotional outburst resulted in a performer getting better sales. Already the article is extremely light on details for this story, and the story itself doesn't seem as important as the author's segue into their point about "sob stories"; I read this as a trite example to vault to a larger point that I don't think the author ever makes, but their opening sentence is quite revealing:

> "There are few behaviours considered more unflattering than actively seeking pity."

This premise is too much for me to accept without further elaboration from the author, as it introduces a lot of questions on this view point that I don't think the article even tries to answer. The focus on how failure should be something we don't show is very unusual, since there are so many fields where failures are part of the expected process, and you're supposed to learn and discuss failures, not hide from them.

I can't really get what the article is meaning to express except a general rant about "sob stories", but the rest of the text just seems to go on regarding something about social media, and while I'm not quite sure what I'm supposed to understand from it, what I did understand was the author maybe just doesn't like the format of discussion on social media and common habits on social media.

That is fine, I am not big on the social media format as well, and I just choose not to use it a ton as a result. So there is something about 'sob stories' and social media we're supposed to understand, but I'm not really sure what it is. Tying it to an artist that "used their sob story to fill seats" and implying that this was a scam with extremely light details is not convincing to me.

My above post is not commenting on the validity of the regulations surrounding ITAR, SpaceX, etc, it was responding to the implication that this effort was politically motivated when it clearly was not.

I don't know how many other companies the governmental department was checking, and it's not really relevant, just like the naughty things other kids may or may not have done when you're explaining why it's not correct to punch another kid just because they didn't share their toys.

"It's hard" isn't really an excuse; other industries are held to pretty strict regulatory standards (the entire medical industry for example) and while there are violations and it's a lot of work to validate that a hospital and the doctors and nurses are meeting these requirements, they do it. There are times hospitals need to be corrected, but they still do it. Same with the legal field, same with engineering fields, etc.

So I'm not sure what exactly is meaning to be communicated here; especially with a company like SpaceX, I expect they should be able to follow the regulations and check their applicants appropriately, not just decide "it's too much work" and deny legitimate and legal candidates a chance for employment.

https://www.justice.gov/media/1311656/dl?inline

There are 17 specific examples of instances where Musk/SpaceX were publicly and repeatedly disseminating incorrect information about their hiring requirements (sections 34-51), the appropriate governmental department looked into it, found out that yes, Musk and SpaceX officials were repeatedly providing incorrect and false information, and that the complaints they received were legitimate complaints.

It's not a targeted attack; persons had legitimate grievances against SpaceX, went to the appropriate governmental departments to register their complaints, the department investigated and found out that indeed, Musk and SpaceX were violating the law. The emphasis on Musk is only because there are multiple instances cited in the filing where Musk himself was spreading the incorrect information on his social media sites consistently and repeatedly. Even if we give the most benign understanding that SpaceX just misunderstood the laws, it still was incorrect behavior that needs to be stopped.

I really cannot see this as political motivated; regardless of the reasons SpaceX did this, they were not compliant with the law and actively spreading incorrect information. If it was any other company not Musk-adjacent, probably we wouldn't be having this conversation :) Instead we have another example where Musk and Musk-adjacent companies are being held to tasks for the things they say and actions they've taken which have negatively affected others improperly.

Compression really is a game changer when you're over a certain amount of data you need to protect, and backup technology does some really clever space savings at basically all stages, making it hard to find a good and easy metric to help sell to management. It's a lot easier to tell management:

"These tapes hold 50 TB of production data, and we have about 45 TB in production. Backups and restores will be faster, we'll have fewer tapes to manage for backups"

than it is to explain the different types of data you need to move to tape, the expected compression ratio, etc.

That being said, I do agree they market it too much and it gets confusing, as it should only be a reference for implementation and quick calculations.

Similarly, I'm very disappointed that the discussions in the article focus so much on _replacement_ of these workers, but in terms of human replacement, it really seems like AI is better suited to displace management and executives, not the people who perform specialized and physical work.

AI should help people and extend their abilities, and right now it's very good at that. It can be used to make our lives easier _now_, not replace us, and I think this is the real reason the article is so heavily discussed. I think the article explains how the author released a lot of the conclusions they did, and I agree, the author is jumping around way too fast and in my interpretation, making some very wild assertion in the article without further fleshing out their points.

The AI space is ripe with a lot of new businesses appearing, and many of them want a lot of our personal information, neverminding API keys.

It's very hard to really know what the tool can do or compare it to other services if we cannot at least see some examples on why this implementation is worth interest over other services without some way to test it without giving up information I personally would rather not share until I understand why I should use this instead of just building my own project around available models.

I very much so love being tech literate, but it's extremely annoying even if you know technology to just deal with what formerly was an on-site transaction. While it's good many business have ensured that they can work with their usual customers, sometimes it's extremely frustrating to figure out the actual way to use some services, or there are extremely inconsistent handlings of payment for services that you simply can't know until you're trying to make the transaction.

It's not an unusual thought for me to imagine a summer market where some of the vendors take cash only, others only take direct transfers, and even more will only take cards. Online, it's pretty annoying as there is _so_ much spam/scam out there that the major search engines happily return that I would wager even most IT professionals would have an uneasy feeling trying to sort which one is the real site and which are just SEO spammed scams.

I don't think it's about the learning curve, it's about the businesses pushing a lot of their costs onto consumers and expecting them to figure it out, and more and more it's blocking people from doing business with these businesses.

I'm pretty sure there's a more healthy medium than just forcing your customers to deal with the lack of investment into the UX for their businesses. I always get a paper boarding pass along with my electronic one; it only took me one time almost missing a flight to reach this position, because the gate agent decided my electronic boarding pass was fake as they scanned it too fast across the scanner and it couldn't read it, despite me asking them to please try it again. While I was able to figure this one out, it's only because I got lucky enough that the employee working the desk finally got a break from their other duties during boarding to be able to check my situation. I'm pretty sure if there had been anything else that required this person's attention coming up, I would not have made my flight, despite having valid tickets.

Don't blame the individuals here; there are instances when caveat emptor applies, but a lot of ticketing/business is definitely pushing their poor UX problems onto the consumers and just blaming them for not knowing the workflows these businesses use for their operations.

It didn't stop attackers from using extremely common ways to punk the systems even under the best circumstances for the systems. A forgotten password gets leaked, using the backup applications/storage system's own encryption schemes against the victims, just deleting entire volumes or compromising the OS on the systems, the list goes on.

I wouldn't consider append-only an anti-ransomware technique, it just stops one of many common ways of compromising data. This is good, but I wouldn't rely on it to protect against even a run of the mill ransomware scheme.

The parent comment is intending to remind people that many things can happen to a backup after it's done. Backups cannot be "set and forget", as just making the backup isn't enough since so many things can happen after you've taken that backup.

- Bitrot/bitflips silently corrupt your backups and your filesystem doesn't catch it

- The storage your backups are on goes bad suddenly before you can recover

- Your storage provider closes up shop suddenly or the services go down completely, etc

- malicious actors intentionally infiltrate and now your data is held hostage

- Some sysadmin accidentally nukes the storage device holding the backups or some other mistake (to summon the classic, I'm betting there are a few persons who have stories where an admin trying to clean up some leftover .temp files accidentally hit SHIFT while typing

```rm -rf /somedirectory/.temp```

and instead writes:

```rm -rf /somedirectory/>temp```

- (for image level backups) The OS was actually in a bad state/was infected, so even if you do restore the machine, the machine is in an unusable state

- A fault in the backup system results in garbage data being written to the backup "successfully" (If you're a VMware administrator and you got hit by a CBT corruption bug, you know what I'm talking about. If you aren't look just search VMware CBT and imagine that this system screws up and starts returning garbage data instead of the correct and actual changed blocks that the backup application was expecting)

Basically, unless you're regularly testing your backups, there isn't really any assurance that the data that was successfully written at the time of backup is still the same. Most modern backup programs have in-flight CRC checks to ensure that at the time of the backup, the data read from source is the same going into the backup, but this only confirms that the data integrity is stable at the time of the backup.

Many backup suites have "backup health checks" which can ensure the backup file integrity, but again, a successful test only means "at the time you ran the test, it was "okay". Such tests _still_ don't tell you whether or not the data in the backup file is actually usable/not compromised, it only tells you that the backup application confirms the data in the backup right now is the same as when the backup was first created.

So the parent post is correct; until you have tested your backups properly, you can't really be sure if your backups are worth anything.

Combine this with the fact that many companies handle backups very badly (no redundant copies, storing the backups directly with production data, relying only on snapshots, etc), and you end up with situations like in the article where a single ransomware attack takes down entire businesses.

https://support.vanmoof.com/en/support/solutions/articles/44...

I think it's worth adding to this the official statement from Vanmoof, as overall I think it does have most of the information that owners would like.

Kind of a shame that the so many Dutch people are getting screwed here, but the repair shop owners/workers from the article describe a very locked-down bike seemingly designed to be a lock-in device, not a useful bike.†

I've been in Rotterdam for a good amount of time (and Amsterdam naturally) and even knowing that everyone in these cities bikes doesn't prepare you for how much the Dutch have integrated biking into their cities. It's very impressive and enviable, and plenty of options for persons who do need other transport options.

From my perspective, trying to do vendor lock-in on a bicycle is a bad idea; transport needs to be treated like a utility, and purposefully making a device that requires a company to exist to give you permission/parts to use this utility while there are dozens if not hundreds of non-locked-down options just seems like an awful business idea, especially when the model has been "open" for almost 200 years and bicycle engineering is already extremely efficient and user friendly without the vendor lock-in. Whether it's locked in by code or by non-open hardware, trying to capture what is basically a utility (transportation) is a dumb.

† I understand that many users liked the bike design, but in my opinion, if repair shops are having to crack open the bike frame or can't use normal bike parts to fix it, it's a bad bike.

Alternatively, consider just using a file system that does periodic integrity checks. I know ReFS has integrity streams, and I am pretty sure XFS has something almost exactly the same or better. It won't prevent corruption, but it will give you something you can monitor for when the filesystem reports an issue.

Some combination like this should work.

Similarly, you might be able to come up with a fast trick using stat; with some quick testing on a dummy file in MacOS' ZFS shell, you can do something like:

stat -f %m somedir/*

and compare the resulting value by passing it to sum or something. I am not super familiar with stat in general, so likely I am missing elements that make this unreliable, but I'd consider looking into it further unless someone tells me it's 100% the wrong direction and explains why.

Take it as a good impetus to catalog your data and find those extra replication options. Data protection does cost you a bit to do it "fully", but since I've worked on a backup solution before in a client facing way, trust me when I tell you that I've seen rather large businesses (a few you might even know as a household name) who have less consideration for their data than you've expressed in your 3 sentences :)

So just figure out which of your data _truly_ needs to survive at all costs, get a solid setup with personally owned storage for the backups in combination with cloud storage, and you're probably fine.

Early on that's how it was, but later on they figured out glitch rushes (grushes) to help you fly through a1-a3 and you'd usually just trade your forge on NM/Hell for it.

After awhile though, this got really scammy from my experience (too many players who needed to be rushed would just flake)

Around 2018 or so when I played again, there were a LOT of shop bots running around doing the runs, and even better you had ENCHANT games where some suped up sorc would cast a ridiculously leveled ENCHANT on you (and your merc!) and even get you waypoints. I think I even remember the bots could do the grush, but I'm not confident I remember right on this element.

Basically, yes, old team-ups were great, when the player base was significant enough that you could do this :) In the last years of D2/LOD original, it was a little less possible to go that route.

They're likely a sysadmin trying very hard to get around a lot of limitations Microsoft has on their out of box toolsets and to avoid home-rolling a lot of solutions in more challenging languages.

So a combination of C files, executables, and PS scripts is pretty normal for such an environment. The C/.exes are likely because there are usually pretty obvious walls in Powershell once you're reaching the limit of what PS is meant to do; if most of your code is just .NET, probably you should be writing a small .NET app instead of trying to do it through powershell; given that it's not always easy to just execute a PS script on end-user environments depending on the GPOs and other security items, probably the author has just written some very common workflows that were too annoying to do manually, not worth the effort for a fully functional program, but needed more than what Windows returns normally to Powershell.

I'd say the author is on the far end of the Powershell User spectrum, as the tooling is pretty good, and it's clear from the use-cases they list that they are really trying to administrate their Windows boxes very personally but without having to click around the UI a ton. Many of the scripts are just to get around windows' permissioning and access control

Powershell shines best when you're automating _Windows things_ or anything .NET adjacent. If you play inside the very specific rules Powershell allows, it works great and your Windows experience will likely be nicer.

So if you find yourself working on Windows and saying to yourself "wow, this works great but I wish I didn't have to babysit it like this", PS is your friend.

If you need to automate Active Directory, Exchange, MSSQL (I guess some general maintenance things or quick queries without SQL Management Studio), etc, PS is your friend.

Anything else, and you basically need to figure out how to get around the restrictions Microsoft put in to prevent you from doing this, usually using .NET code in your PS script.

That is, while you can call .NET methods on objects like:

$Object.SomeMethod('arguments')

You can also do:

[Namespace.ClassName]::SomeMethod('arguments')

And your Powershell scripts can even save you a lot of typing with the ```using``` function of Powershell to load namespaces: https://learn.microsoft.com/en-us/powershell/module/microsof...

Edit: As to why you would want to do this, usually it's because you want to do some scripting but you need to pull data out of some .NET application or out of Windows and there isn't a fully fleshed out cmdlet built for it. In a pinch, you can usually just use reflection to get it. For example, I needed to pull data from a Shared Outlook calendar that not everyone had access to and then do some date-math to share a time-sensitive schedule with a team living in quite a few timezones. Reflection to load the necessary Outlook and MSExchange elements, then the rest in Powershell. Now I have a script that is easy to pass around, can do this if I'm unavailable, and we can easily add/remove time zones/persons, and it just needed 5-ish lines of .NET inside of the Powershell script.

I would position part of what made Diablo 2 (not remake) last so long was bots on the ladder and the shops that provided the bots; no one "new" was playing the game at that time and everyone had "fair cheats" for rushing through the first two game modes [0] [1], and everyone had been using the "fair cheats" for years since they had been discovered. But the fair cheats needed other players to pull off, and this wasn't always reliable.

When the D2 shop farmers started botting, they realized it would be great advertisements to do specific types of common runs for leveling with the bots; the bots would grab any item worth value, but typically they just would repeatedly run common leveling/item farming areas on a predictable and guided schedule, dropping quick announcements about the shop in chat periodically (maybe several times per run which is usually around 5-15 minutes, and it was just a quick stylized message in the game chat.) There were enough bots that it wasn't flooding the available games to join, but you could almost always find a bot game to join and just follow until you were leveled.

Most players did this to get through Normal mode and often nightmare, as everyone just wanted to get a character ready for late Nightmare/Hell which is when the game is "fun" (better drops, more difficult monsters to fight, it was the point at which the game gets interesting in general for most players)

Without the bots and players "cheating" through the first 2 game modes, I'm not as confident people would have keep playing as long as they did. It wasn't "unfair" in my opinion as everyone had always wanted this, and it had automated what everyone was already doing; I'm not sure I see the difference between using AHK like the GP did and having a setup like what D2 had

0 - For the unfamiliar, Diablo 2 had three modes: Normal, Nightmare, and Hell; same game each time, but item drops are better and monster levels are changed to be more difficult, with monsters getting better attributes that made them more difficult. I am going to make a generalized statement that for most players, the game really begins at Nightmare if it's not one of your first few times playing the game

1 - By "fair cheats" I mean the game was exploited to ensure fast leveling without a lot of effort and also ways of bypassing the "boring" parts of the game that the game allowed, but likely not intentionally. Blizzard definitely couldn't solve this in game without substantial reworks, which they probably didn't want to do

Their "all viewports" page also isn't visible on my browser if the window is too small as the titles on each viewport aren't visible.