moonshinefe

"The U.S., by comparison, taxes citizens’ income no matter where it’s earned."

This is a common statement I see pretty often on the internet, often in the context of bashing the US. However, there's a big asterisk there if you look the rules up. If you're not making over 6 figures, you still have to file I believe, but you don't pay taxes. So the vast majority of Americans abroad are not paying taxes back to the US ($100800 / year is the cut off by the looks of it)[1].

I'm not saying it isn't annoying still to file with the IRS or there aren't people who are over the threshold getting burned, I just feel it's often a glossed over detail that puts the US in an unnecessarily harsh light, considering, again, most people won't be penalized financially here.

[1] https://time.com/money/4298634/expat-expatriate-taxes-us-myt...

even as a single male I'd find being told to go to strip clubs by my CEO highly unprofessional and not want to work like that. That sounds ridiculous.

Yeah, I think my memory may be inaccurate / hazy since at this point, it's been almost 13 (!!) years. Boy, I feel old now.

I think I was referring to: http://www.eqemulator.org/forums/archive/index.php/t-11175.h... and similar. So not even an emulator, just a leaked, crippled version of the game earlier on. Thanks for the correction.

I feel any game is possible to pirate given enough resources. However, point taken, there's definitely a certain drop off point where the resources required to do it aren't very likely to be marshaled when it becomes sufficiently prohibitive.

It's preferable to a company trying to squeeze all the profits possible out of their games, but certainly not for preserving gaming history many years later when profits aren't much of a factor.

Yes. And if they can patch out the connecting to steam requirement for TF2, it can be preserved even if Steam dies eventually.

Unfortunately for Overwatch, a battle.net account / connection and their centralized servers makes it a far harder task. They've moved toward a model where the reverse engineering and ingenuity involved to get it to work outside of their control is increasingly prohibitive.

These things often take volunteers hundreds of hours to figure out and are illegal according to terms of service agreements (followed by lawsuits no less--if you look into "bnetd" and "fsgs" starcraft alt servers, and WoW bots, Blizzard is not afraid to go this route). If it's just too much work for said hackers, it likely will not get done, especially if legal action against the volunteers is a probability.

Exactly right, we're looking at a hole in modern video game archival history with the way the industry models their games these days. The older games aren't nearly as hard to preserve.

They're doing good work and I work in the preservation industry. Unfortunately, many games in the last 5-10 years and maybe even a bit earlier than that have been moving to "if the company isn't running the centralized black box server, this game simply can't work" model. I think the main reason being anti-piracy and DRM, but the side effect is those games are much harder to preserve.

It's a good point / thought. I feel like the same question could be asked of any preserved art form or valuable cultural item.

I think it's ultimately just up to people and their feelings / how significant they feel a game is/was to put the resources in to preserve it. I also feel like some games are clearly more notable than others that a consensus would agree with.

Mario Bros 3, Zelda, WoW, Skyrim... I could go on for hours I'm sure, but certainly some games have a much larger impact and are more historically notable than others. Maybe it's partially subjective, and I'm not sure what the solution is. Do we legislate these things must be preserved?

That seems pretty extreme. Do we ask nicely? It seems most companies won't listen if there's no profit there. I'd be interested in hearing other people's ideas on that and how to make it happen. I think it'd be a real shame if in 20 years, given all our technology, these things were lost to history somehow still.

A lot of it is due to companies centralizing games and putting up huge barriers to even make games functional without their black box servers. After many of these games die off population wise, the companies just drop them instead of giving back to the community to preserve it.

Look at TF2--it could foreseeably be modified and anyone can run a server for it. It may be possible to preserve it. Blizzard's Overwatch on the other hand, which is somewhat of a successor to it, they won't let the game to work at all without their servers since it's a gigantic, centralized black box. Those servers might go away.

The only reason WoW is preserved for the future at all with third party vanilla servers is because during the beta they made a mistake and leaked a ton of debugging info and world data early on. Ideally (from the company's perspective), we wouldn't even had that and one of the biggest blockbuster MMOs in history would simply be lost.

Not picking on Blizzard in particular, but they've gone from a decentralized model in the Diablo 1, War 2 BNE, and Starcraft 1 days to massively centralized. If there isn't a profit to be had, I think they'll be very happy to let the history die there, which is very unfortunate and seems to be a model many AAA game companies are taking at this point, not just Blizz.

I believe what he was getting at is as an adult, you should be able to realize that a website on the internet is just that--and have the ability to take it with a grain of salt without being highly offended / outraged.

I don't think the intention was to say everyone on Twitter are adults--in fact it's the complete opposite of that. It's a platform where you can get both the best and the worst from all walks of life across the world. Sometimes there will be jerks and people who are the polar opposite ideologically to what you agree with.

I appreciate that info, +1. My main point was just if you're dealing with a repository where actors that have those 6 figures to spare to attack you (and that's a minority):

1) you've got to rely on a lot better security than the minimal if at all security provided by git (it assumes a web of trust). If people are signing off with PGP sigs but not watching diffs, you've got big problems.

2) You're probably far more likely to be exploited by far cheaper methods at this point. If they have access to a trusted contributor's keys, it's far more cost effective to slip in other tricks than sha-1 collisions right now. I'd say this is the main point so far, but admittedly maybe not in the future.

3) It sounds like Linus and the git devs have admitted they need to migrate from sha-1, but also I haven't seen any cheap, exploitable PoC for git yet based on this due to how they actually mix in other info instead of raw sha-1 hashes of the files.

4) As far as I know, and I'm sure I'm subject to correction, but there hasn't been a WebKit svn repo-esque calamity yet like what they've experienced dropping 2 sha-1 collision PDFs into the repo in a Git context yet.

Again, I'm totally open to new info, but the sky-is-falling attitude right now is what I'm mainly arguing against.

Yes, if you sign off on commits you haven't reviewed to confirm the diffs at all, and they're carefully crafted files to make the collision, you may commit a duplicate sha-1, which still doesn't even break Git.

I'll also mention literally the first setup step to Git for most people: https://help.github.com/articles/set-up-git/ or similar.

That might be a hint that Git isn't something which you should allow it to handle the security. Literally the first step to the entire thing: pick any email or name...

Please provide reasonable security policies in your repos--and if someone is exploited, you've probably got far bigger problems than someone duplicating a sha-1. Not necessarily, but highly likely your system is owned.

If you're working on such a massively important git repo with very poor security measures and trust levels at $200k break in status that are practical... yeah, maybe bigger problems.

Well holy smokes. I don't know which repository you contribute to, but if you're getting undermined by such James Bond-esque deception by super villains, in addition to someone spending 6 figures into breaking your stuff, I'd hope you'd at least review the commits you sign with your key after glancing at it.

In addition, you'd have to have everyone else not notice it, all the insanely cheaper exploits not been tried on your current setup, and all the other stars aligning...

So wait, when is SHA-1 ever used for signing tags and commits in git? that's new to me..

My understanding was you're using a public key type of encryption such as PGP at that point. I feel I may be missing the point here. (apologies if so)

Please PoC a Git exploit then?

This reads like a giant "I told you so." circa 2005

"In the next few years, nasty people will teach him the threat model"

I'd like to see those very forceful claims substantiated. Git hasn't said moving forward it will never change from sha-1 and 2005 was a far different era than 2017 for crypto. Let's keep that in perspective.

Yeah, I don't get it either. It reads like someone who smoked a bunch of pot and is spouting off various, insanely vaguely related points but with no clear thesis whatsoever.

I would love to get down there too, but unless I guess the reality is it's profitable to cut it all down and the political will is there, not sure what else we can do...

I think their absolute dominance in email, browsing and internet search insulates them from a lot of this stuff.

I can't say I'd be confident in their newest project-of-the-week going forward though (if not in those realms), if I needed it to go beyond the next 5 years.

Agreed. It seems they'll hype up and push a service then shut it down at the drop of a pin at this point. It's not great for their brand if you're a company that wants a reliable, long term solution.

I think the original comment was getting at the fact Google often starts, massively trumpets services, and then abandons them in the night. I never recall them saying a single time in the several if not dozens of services they've started / ditched in the last several years where they've explicitly said "yeah, this might go away at a moments' notice."

It tends to chip away at your confidence if you're looking at investing in their services.

Correct me if I'm wrong, but if you're letting untrusted people push to your git repositories, you're pretty much screwed anyway.

Given a case where someone with permission to push gets compromised and a malicious actor can pull this sha-1 attack off, aren't there bigger problems at hand? The history will be there and detectable or if they're rewriting history, usually that's pretty noticeable too.

I may be totally missing a situation where this could totally screw someone, but it just seems highly unlikely to me that people will get burned by this unless the stars align and they're totally oblivious to their repo history. So I guess I agree with the "the sky isn't falling" assessment.

I'd absolutely love to hear what language you're using that's superior and not a "90s language" then. Pretty sure most of the popular languages date back to then if not a decade or two earlier.

I find it especially amusing you cite typescript and the node ecosystem as superior. I've never seen such an unreliable and constantly changing ecosystem with dozens of frameworks and libraries ever in recent history.

Yeah, I don't think you know python very well at all given your criticisms. The very first thing you criticize is "its reliance on mutable data structures"--uhh no, most data structures and types in python are immutable.

I'll at least agree I've met a lot of python snobs who say don't use the built in map/filter functions and things like that in favour of comprehensions, but that's hardly representative of the language.

And please. List comprehensions can be nested, just like every other language can be abused if you really want to try.

I agree with this sentiment. I hate the 'tip culture' too, but it's not going to change overnight and the reality is, if you aren't tipping people in the US (and Canada, btw), the worker is getting far less compensation.

It should change, but this particular Uber situation isn't going to be the straw that broke the camel's back I'm afraid.

That does sound fun! I think figuring out bugs is a good way to find out if someone knows what they're doing at all. My main objection was "implement a LL from scratch in X language!" -> googled in 5 seconds and slightly modified, done as a work-from-home and hand in assignment.

I'd enjoy a good debugging question for sure.

Sure. If it's say a web application, I'd invite them to install the framework(s) / libs used and to implement a basic feature that could actually be used in an application they'd be working on. Nothing super complicated, but something that wasn't "reinvent the wheel that's googled easily". I'm not aware of many major programming languages these days that are missing linked lists or similar data structs.

I'd also pay them for their time, regardless if they got the job.

OK since I'm being down voted for this post, let me clarify: if you read the context which the OP mentions in the blog post, he/she was given a take-home assignment.

I agree, rooting out people who can't do basic things like linked lists is desirable, however, if you're going to send a take home assignment, my point was, you're not going to get a very honest measurement of their capabilities on one that they can google in a few seconds. That's all I meant.