joepie91s Ramblings

Random posts about technology, activism, programming, people, and anything inbetween.

Bye WordPress!

I’ve decided to finally end my procrastination, and switch to a self-hosted blog. The details can be found here. One of the consequences is that I’ll likely be posting more frequently in the future.

If you’re following my WordPress blog, don’t forget to subscribe to my new blog – I’d hate to lose you as a reader! Here is the RSS feed, and you can subscribe via e-mail here. See you there!

I will be removing (and redirecting) my old posts on this WordPress blog soon.

– Sven

Anti-solutionism

I’ve been observing something frustrating lately. Quite a few people appear to have a habit of intentionally preventing others from finding good solutions to problems. And I don’t mean disagreeing with proposed solutions – I mean actually keeping others from even trying to find them. I’ll give some examples, starting out with a seemingly innocent remark.

“The only solution is X.”

This seems like a harmless statement. You could call this person narrow-minded, or perhaps tell him that he overlooked some things. In reality, this statement shows a very clear problem: this person has already discounted any possibility of other options. No matter how good your solution to the problem might be, he’s not interested in hearing it. It doesn’t even really matter why; that he rejects any other ideas straight-away, is enough to kill the entire process of finding a solution, stone dead.

“There is no perfect solution!”Image

Indeed, there probably isn’t. While this statement is technically correct, it doesn’t have anything to do with the process of solving a problem. It’s a neutral observation. But that’s not how people use it – usually, when somebody tells you this, they try to use it as an implicit argument, basically telling you “it’s not worth the effort to find a solution, it won’t be perfect anyway, why don’t you just give up?”

The problems with that attitude should be obvious. It makes it impossible to solve a problem, because one of the parties involved has already decided that it isn’t worth the effort. What they are overlooking, is that while a solution may not be perfect, it’s still likely to be a better solution than what is currently in place.

“Who cares?”

The most problematic statement of all. I’ve seen this one especially often around the LowEndTalk and VPSBoard forums lately. When somebody says this in a group setting, they’re not trying to tell you that they don’t care – they’re trying to tell you that you shouldn’t. It’s worth noting how this statement is often used by the same people repeatedly, in conversations (or, in the case of forums, threads) that they do not otherwise take part in, and could’ve easily avoided.

The consequences

A recurring theme in all of these statements, is that they’re not just keeping themselves from finding a solution, but also inhibiting the ability of others to do so. They are effectively trying to convince others that they shouldn’t bother finding a solution. The question is: why?

I would argue that, in many of these cases, there’s a combination of learned helplessness and cognitive dissonance going on. Especially in the example case of LowEndTalk, where ColoCrossing now runs the show (with all the bias and shady proceedings that result from that), this seems to apply; some people have realized that they can’t just work around ColoCrossing’s influence, and have ‘accepted’ the situation.

However, as they would still be disagreeing with the state of things, cognitive dissonance occurs; their actions (not doing anything about the situation) and their beliefs (disagreeing with the situation) conflict, and they attempt to cope with this situation by convincing themselves that “not doing anything” is the right course of action.

How they do that? By telling others that they shouldn’t be doing anything against it either, thus justifying their own behaviour. They’d not be trying to convince others, so much as they’d be trying to convince themselves. I’d call it “anti-solutionism”.

In fact, it is quite likely that somebody will exhibit the exact behaviour I described above, in the comments for this post.

Footnote: The issues I’ve described above, don’t just happen around LowEndTalk and VPSBoard; those are just an example. They occur virtually everywhere, and you’ll likely see it happen in your own environment.

How to write proper PHP

Note: This is a repost of a thread that I originally wrote on LowEndTalk. I can no longer support the operational and advertising policies of LowEndTalk, and have therefore decided to move the post here.

Okay, there have been quite a few threads here about questions regarding PHP, and every time I see people making the same mistakes in their code. Considering there are probably quite a few people here that use LEBs for development stuff, I’ll point out some good and bad coding habits, with solid reasoning as to why you should or should not do it, for each of them. Unless you can give a valid counterargument that proves the reasoning invalid, you do not have an excuse not to do shit.

As a first word, I’d like to point out something: Please stop letting your ego get in the way of writing proper code. Stop making up reasons as to why you wrote code a certain way (“that’s by design”, “but that isn’t necessary because …”, etc.) just to not have to admit that your code quality was bad. If there is an issue with your code, then get over it, fix it, and learn from it. I expect others to tell me when my code sucks, and the other way around, I expect other developers to genuinely consider suggestions for their own code. The reason I point out code sucks is not to boost my own ego, but because I care about proper and secure code being written. There is simply too much crap code going around, even in many popular and commercial software packages.

Note that this thread should not be considered a complete guide, nor will I touch on subjects like sanitation – there are plenty of other guides for this. This is more about safe code syle than anything else.

Things you should be doing

Understand your code.

Try to understand your code. When looking at your code, you should be able to pick any line in your code and know exactly what data is in what variable, accurate to the byte. If this isn’t clear, make your code clearer. Don’t be afraid to use more variables to make it more obvious what your code does, variables are cheap.

Why? By understanding your code, you will be able to spot bugs and vulnerabilities just from looking at it. It will take some time to get skilled at this, but eventually every single bug will be blatantly obvious to you, even if you’re looking at code you wrote a year ago.

Indent your code.

Always, always, always indent your code properly. That includes PHP, that includes HTML, that includes CSS, that includes every single language that allows you to indent code. “It’s not public code” is not a valid reason not to indent.

Why? Properly indented code allows you to see the structure of your code at a glance, and improves readability. Improved readability and understanding of code results in less bugs and less vulnerabilities. You should be able to understand what your code is doing at any point, just by looking at it, this makes it easier.

Use proper spaces.

While I can’t tell you what your coding style should be, I do have some suggestions that would be a good idea idea to follow, to improve readability of your code.

$variable_name = some_function($something_else, $another_thing);

Leave spaces around assignment and equality operators, this makes it clear what part of your code belongs together. Don’t add unnecessary spaces around braces, this will only make it less visible what belongs to what.

Why? This makes it obvious what part of your code belongs to what, and what the relationship between various elements is.

Use clear variable names.

Don’t abbreviate variable names. There is no valid reason to do so. Make it clear from the name of the variable what’s inside it. $unm is not a valid variable name. $username is a valid variable name, as it makes it obvious what is in it. $username_of_the_logged_in_user is far too long and makes your code hard to read; you could’ve used the much shorter $username.

Why? It allows you to see at a glance what a variable does. If you need to go to another line to see what a variable contains, you’re doing it wrong.

Use proper braces.

Never ever ever leave out the curly braces around a code block. I don’t care if it’s one line or not, do not ever leave them out. Always enclose code blocks that belong to control structures in braces. Preferably, give each brace its own line as it makes it obvious what opening brace belongs to what closing brace.

Imagine you have this code:

if($confirm_delete === true)
     delete_item($_GET['id']);

Oops! The delete_item() function expects an integer, not a string. Well, let’s just solve it like this, right?

if($confirm_delete === true)
     $id = (int) $_GET['id'];
     delete_item($id);

Whoops, you didn’t realize that you weren’t using braces, and now the item gets deleted regardless of whether $confirm_delete is true!

Why? People make mistakes, especially when in a rush. Don’t think that “you wouldn’t ever make the mistake above’, because you will, at some point. Don’t take the risk and just be safe and enclose it in braces; there is not a single reason not to do so.

Use curly braces for inline variables.

This trick isn’t very well-known, while it should be. Say that you’re using a variable inside a string, like so:

$whatever = "Hi, $something!";

Instead, do this:

$whatever = "Hi, {$something}!"

Why? There are many reasons to do this. 1. It will ensure that any characters that come after the variable name are not taken into account when parsing. 2. It makes it more obvious that a variable is a variable, which makes it easier to spot mistakes in things like queries. 3. Consistency. When using an array item in a code block, you enclose the key in apostrophes. To do the same in a string, you need to use curly braces. Logically, it makes sense to then enclose both array items and regular variables in apostrophes.

Stuff you really shouldn’t be doing

Obfuscating your code.

No, obfuscating will not secure your code against ‘hackers’. All it will do is make your code harder to read and understand – which actually makes it more likely that new vulnerabilities are introduced that you don’t notice.Security through obscurity is not security.

Using exec() to do anything other than launch processes.

It’s pretty likely that you can do whatever you want to do, with a PHP function. Don’t use exec.

Other tips

Use a code editor.

While you can technically use notepad or nano to edit your code, it’s not a very good idea – it doesn’t do auto-indentation, and doesn’t color-code your code, which makes it harder to spot mistakes.

A few suggestions for light-weight code editors: Windows: GeanyNotepad++Sublime Text Linux: GeanyVi,Sublime Text OS X: Sublime Text

Not sure if your code is good?

Post a code sample below, and I will read it, suggest improvements, give the reasoning behind those suggestions, and if applicable, update this initial post.

Something unclear?

If it’s not clear to you why I am recommending a certain practice, or you think the reasoning isn’t solid, then by all means point it out! I will attempt to clarify and take into account your concerns, and update this post accordingly.

Thank you for reading.

The security trainwreck that is ZPanel

Note: This is a repost of a thread that I originally wrote on LowEndTalk. I can no longer support the operational and advertising policies of LowEndTalk, and have therefore decided to move the post here.

Yup, another ZPanel thread. Why? To give a nice summary of the atrocious security history of ZPanel. The dates may be approximations, I do not keep specific track of these events. Additionally, quite a few things will be missing – I’ve only listed the events that I’ve run across.

  • August 12 2012, numerous vulnerabilities are fixed, one of which can be found here, after a supposed ‘security audit’ by ‘WebSec’.
  • August 12 2012, I have an argument with motters, one of the ZPanel developers, in the LowEndBox IRC channel. motters challenged me to find a vulnerability in ZPanel, after I claimed that their messy code style would produce vulnerabilities that they’d overlook.
  • August 12-13 2012, a few minutes later, I report a vulnerability that allows anyone to reset the administrator password on a ZPanel installation to an arbitrary value, without any authentication whatsoever. The vulnerability is fixed, with what seems like an attempt at insulting me. Note that their “professional security firm WebSec” completely overlooked this blatant and fatal vulnerability, while it took me literally 5 minutes to find.
  • August 15-16 2012, I inform the ZPanel developers of multiple remote code execution vulnerabilities in their ‘templater’, and submit a patch for a part of them. I warn the developers that the templater will still allow code execution that could potentially be disastrous when combined with zsudo due to the poor design of the templater (using eval(), and letting resellers set custom templates). The lead developer laughs off this warning, tells me that “that’s how a templater is supposed to work in PHP”, and says that a real templater may be written later, but that it is not a priority and not planned. Again, WebSec has overlooked the issue.

At this point, had I not reported any of these vulnerabilities, I would have been able to combine the administrator password reset vulnerability with the remote root vulnerability and a Google dork. I could have gained instant root on every single ZPanel server in the world, without issues, fully automated, in a matter of minutes.Just to put into perspective what their “professional security firm” missed.

  • November 10 2012, Bobby Allen, the lead developer, posts on the ZPanel forums, claiming that the ‘insufficient entropy’ vulnerability is “bollocks”, and that “CSFR [sic] protection is not necessary, because the backend code authenticates the session”. Seeing as insufficient entropy can significantly increase the chance of key guessing, and the whole point of a CSRF attack is to use an already authenticated session, it is clear that Bobby has no idea what he’s talking about on both counts, but refuses to admit as much. Furthermore, his attempts at justifying the vulnerabilities inspire a false confidence in users that the software is safe to use.
  • April 17 2013, I make a full-disclosure post on the ZPanel root escalation and command execution vulnerability, after having waited for it to be fixed for 8 months. There is no response from the ZPanel developers, at all, whatsoever.
  • May 10 2013 (today!), almost a month later, there is still no response from the ZPanel team. They have not responded to the full-disclosure post, there is no post on their forums, no announcement on their website, and most importantly, no patch. The codebase is still vulnerable, and it doesn’t seem like there will be any effort to fix it, any time soon.

I really don’t care that ZPanel is a free or even open-source project; that is not a valid excuse. The reality is that the ZPanel development team, in particular Bobby Allen, is acting highly irresponsible. He is putting hundreds, if not thousands of servers at risk, simply because he does not wish to admit that there are security problems and that they need fixing.

I have heard every excuse under the sun from the development team. “We do this in our free time!”, “It’s an open-source project…”, “Well, it’s free!”, “That’s not really a vulnerability, people won’t think to look there…”, and so on. I really don’t care. ZPanel developers, fix your shit. You have released ZPanel to the world and are promoting it as a professional panel, so give up your “hobby project” attitude. You can’t have both. Either include a big fat disclaimer that ZPanel is known to be insecure, and it’s a hobby project… or make it secure.

In the meantime, I would advise everyone to stay far far away from anything running ZPanel. The developers do not care about your security.

Announcing pythonwhois 2.0.0!

It took some work, but it’s finally done: pythonwhois 2.0.0!

pythonwhois is, simply put, a WTFPL-licensed library for retrieving and parsing WHOIS data for a domain. It’ll give you all the data in a nice, consistent, structured format – instead of the giant inconsistent mess that WHOIS responses normally are.

New in version 2.0.0:

  • pythonwhois can now parse registrant/contact data! All registrant and tech/admin/billing contact data is supported.
  • No more jwhois dependency! In fact, pythonwhois now has no dependencies at all aside from the Python standard library.
  • A commandline tool is now included. ‘pwhois’ will let you make WHOIS queries from a terminal, much like ‘whois’ and ‘jwhois’ – except pwhois will give you nicely formatted human-readable data! Here’s an example.
  • pythonwhois can now ‘normalize’ data. No more all-uppercase or all-lowercase WHOIS data! It will try to intelligently fix capitalization and some other stuff, so that you get consistent human-readable output. Of course this functionality is optional!
  • Retrieval and parsing have been separated. You can now just use half of the library, and let another application do the rest!
  • A testing harness has been added. This script will detect any unintended changes in WHOIS output, so that you can safely work on the parser without breaking things that worked before!
  • Documentation! There’s now full usage documentation (it’s also included in the repository, and uses ZippyDoc).
  • The parser has been improved to support many many more registries and registrar servers. Bug reports welcome!

To install it, just run `pip install pythonwhois`! Documentation can be found here.

If you want to upgrade from the previous version, you can run `pip install –upgrade pythonwhois` – however, the API has changed and your code will likely break. There’s more information about that here.

Update (17:13): Looks like I botched the get_whois() method in the 2.0.0 release. A 2.0.1 version has been released that rectifies this issue, and is available from PyPi. It should now work as documented.

A realistic analysis of the fallout of the Silk Road bust

After Silk Road and its alleged owner got busted, plenty of speculation arose in many places around the web on what the consequences of this bust would be – some realistic, some not at all, and some mostly ignored. I already joked about this a little on Twitter. This article is an attempt to provide a realistic analysis on what’s likely to happen.

One disclaimer beforehand; I was never a user of Silk Road (as I believe recreational drugs, including ‘legal drugs’ like alcohol, are an overall bad thing – although I do not believe prohibition helps the cause), so my description of aspects of Silk Road may be a little off at times. I’m well-versed in Bitcoin, but with regards to Silk Road I have somewhat of an “outsider view”.

Personal information

Back in July, the FBI already acquired images of the main Silk Road server, and judging from the criminal complaint against Ross Ulbricht – the alleged owner of Silk Road – they had access to the messages that were sent through the site’s internal messaging system.

What this means, is that the FBI likely has access to the personal (shipping) information of every Silk Road user that used the site before the server seizure in July. If your communication was encrypted (using GPG, for example) you are probably going to be fine – if it wasn’t, the FBI probably knows that you ordered stuff from Silk Road by now.

The Bitcoin exchange rate

A few media outlets immediately jumped on this opportunity to (implicitly) announce the end of Bitcoin by stating that it had experienced “a dramatic drop in exchange rate”. The reality turns out to be much less dramatic.

For the past few weeks, the Bitcoin-to-USD exchange rate outside Mt. Gox (which has been having withdrawal issues leading to rate inflation) has been fluctuating between some $110 and $130, depending on the exchange. When having a look at a chart for BitStamp, the exchange rate dropped to $104 after the news of Silk Road broke. It is already back at $112 at the time of writing this article.

Compared to past fluctuations for Bitcoin, and considering that Bitcoin really still is in its infancy as an unenforced currency, this is not a very significant drop – especially given the quick correction.

Regardless of what people believe caused the drop – decreased trading volume due to Silk Road closure, temporary loss of trust in the currency, opportunistic forex traders, drug lord capital sell-offs, or whatever else – it’s reasonable to assume, given the history of Bitcoin and the possible reasons for this drop, that the exchange rate will restore itself to (nearly) its old level very soon. The closure of Silk Road is unlikely to have a permanent impact.

The legitimacy of Bitcoin

This is really not even a serious concern. Other Bitcoin services are still running, the exchange rate has not taken much of a hit – there is currently no rational reason to consider the closure of Silk Road to be directly harming Bitcoin (or the ecosystem around it) as a whole. That won’t cause any concerns over legitimacy. The use of Bitcoin on Silk Road isn’t exactly breaking news either – it’s not going to be a reputation hit for Bitcoin.

In fact, if anything, this case has proven that Bitcoin is not magical fairy dust that makes it impossible for law enforcement to trace down people that they believe are breaking laws (regardless of whether that’s just or not). The FBI was perfectly capable of tracking down the owner of what is commonly known as the largest online drugs trading platform – despite that platform only using Bitcoin for its monetary flow.

Availability of drugs

This is a commonly mentioned one. Indeed there will likely be a temporary rise in the amount of street-dealing (and the associated violence and trouble) while Silk Road is gone. However, Silk Road has turned out to be a pretty solid business model, and it will have become obvious to any technically competent drug dealer that the owner got busted over a bunch of what are essentially rookie mistakes.

In short, it’s almost certain that some drug dealer is going to think “hey, I can do this too, but better”, regardless of whether they actually can.

Given the popularity and turnover of Silk Road, it probably won’t take very long before a nearly identical alternative surfaces – perhaps even with better security measures, lower trading fees, or whatever other features such a platform could use to distinguish themselves from all the other alternatives that will likely crop up. It most likely won’t take too long until you can order your drugs via Tor and Bitcoins (or cash-in-mail) again.

The War on Drugs really is an endless war.

The scams of Arturas Rosenbacher

Just when you think he vanished off the stage…

So, as most of you will most likely be aware, TouchID was broken. Very quickly. And there was a reward for it. For those not familiar with the reward thing, quite a few people had pledged a reward for the first person to successfully break TouchID. And one of those people was Arturas Rosenbacher, now apparently owning a company named I/O Capital Partners.

And he has refused to pay up.

Now, let’s get a bit of context here. To some within Anonymous and the Occupy movement, Arturas Rosenbacher is a familiar name. He has pulled off multiple deceptions and scams under many names, one of the most notable ones of which was probably the RefRef scam back in 2011. RefRef was supposedly a DDoS tool that was under development by a few Anons, and that would be massively more powerful than LOIC, HOIC, and other tools that had been used until then. The technical claims made were dubious from the start, and there were several indications that the supposed RefRef testing attack on Pastebin wasn’t actually RefRef.

Donations for RefRef were collected, but it never materialized.

What did materialize was a lot of media coverage and a Perl script named refref.pl – however, this was just a basic DoS script pulled off a random script kiddie forum, with the name changed. The real RefRef never appeared, and most likely never existed in the first place. The end result was that the supposed ‘creator’ of RefRef ran off with the donations, effectively turning this into a giant scam.

And guess who perpetrated it? Arturas Rosenbacher.

Aside from RefRef, there was, around roughly the same time, a spree of Twitter accounts – impersonating people and groups within Anon, and frequently claiming to be a “member of LulzSec”. Of course, all of these claims were false. One of the tactics used was registering lookalike usernames that were only slightly different from the real username of a particular individual or group, and gaining a significant follower base that way.

And again, it was Arturas Rosenbacher.

He has also been repeatedly accused of stealing donations for Occupy Chicago, has claimed to many people that he works for Wikileaks in order to gain trust, and has quite a bunch of other very questionable behaviour on his name, which is mostly described in the article that I’ve linked twice before.

It therefore comes as no surprise that once again, he has made promises – gaining some significant attention and media exposure for his “company” in the process, of course – and backs out at the last moment. And, of course, per his usual modus operandi… the Tweet with his pledge has been removed.

Update: Looks like ZDNet also wrote about this.

Another update: It also seems like Arturas tried to weasel his way out of it by defining his own ridiculous terms and conditions for pay-out.

Redesigning society: Introduction

It’s time for change.

But not just any kind of change, real change. As time goes on, more and more often it turns out that corruption is everywhere, no entity can be trusted, and – quite frankly – all of society is literally hanging by a thread.

Economic systems about to collapse or already in the process of doing so, governments spying on and attacking their citizens, people being unjustly imprisoned, the environment being utterly destroyed for commercial gain, people losing their homes, unemployment and therefore poverty rising, increasing ignorance amongst the population… it appears that pretty much every aspect of society is broken in some way or other, with no reliable fix in sight.

For the past few years, I have been fleshing out quite a few ideas, that together make up a proposal for redesigning society as a whole. I’ve been discussing these ideas with a lot of people, and made quite some changes and improvements to them as a result. In this series of blog posts, I will be describing these ideas, and how to implement them in reality. New posts will appear on an irregular schedule, as I find the time and inspiration to put these ideas into words.

There are, it appears, a few basic pillars of society:

  1. Government: Quite literally “governing people” to prevent conflict and harm.
  2. Economy: Means of trade, designed to mitigate the effects of scarcity.
  3. Education: The means for people to learn new skills and techniques.
  4. Work: Creativity, production, and other efforts that contribute to society or parts thereof.

These ‘pillars’ together are necessary – or at least, perceived to be necessary – to keep society running smoothly, and to keep people from harm. For each of these pillars, I will be writing one post that explains the problems with the current model, and my redesigned proposal for that pillar.

I do have to ask that you do not make a judgment until the entire series of posts has been completed. These pillars of society are all very strongly interwoven, and you need to see each pillar in the context of the other pillars. This also means that, if you try to take one of the posts and apply it to current society, it will appear to be a failure. In the current model of society, all pillars also depend on each other, and changing just one of them won’t work.

I’ll also warn that this series will contain quite a few unusual concepts and ideas. They work very differently from how most societies work today, and will take some time to take in. Additionally, it would be unreasonable to expect an overnight transition to the redesign I am proposing, even if it does work well – people tend to be set in their ways, and it would be very hard to instantly change how things work.

And that is what the fifth post in this series will be about; a model for introducing these ideas to the world in a gradual fashion, requiring little cooperation from current society. It will be a model that not only introduces the idea to ‘society’ at large, but also tests its feasibility in the process.

Finally, I’d like to say this: the redesign I am proposing is not centered around a certain culture. It is designed around human instincts and logical ‘defaults’, not around the history or bias of a certain population. If this proposed model does indeed work, there is no reason for it not to work in specific places in the world.

If you want to be notified of new posts, I recommend you subscribe to this blog.

About YourAnonNews, their IndieGoGo campaign, and the shady update

Category Page

Original title, eh?

Okay, the preface. For those that are not aware, earlier this year YourAnonNews started a crowdfunding project on IndieGoGo to finance the creation of a new site, as a ‘replacement’ of sorts for their current Twitter account. They raised $54,638, instead of the $2,000 they set as an initial goal. All this money comes from people that wanted to support this new project. The general impression that people seem to have gotten, was that YAN would be building a brand new website that was more open, more independent, and generally a better fitting platform.

I haven’t really talked or cast a judgment about this project before, for the simple reason that despite my historical disagreements with YourAnonNews, that doesn’t mean they don’t deserve another chance – and frankly, there was not enough information to make a judgment. I’ve shot off a critical tweet questioning their financial transparency (and was promised that all financial information such as expenses and income would be publicized), but that’s about it. Now, in the past 24 hours, a Pastebin appeared, posted by Emmi on her Twitter account. That Pastebin is raising quite some questions and concerns for me – enough to finally write a blog post about it and cast an initial judgment.

On to the actual topic of this post. This post will be in a bit of an unusual format; I will be quoting sections from the Pastebin, not necessarily in the order they appear, and respond to those quotes. There are several concerns, and I’d prefer to raise all of those separately and in-depth, rather than just jumbling together a giant blob of text.

Here is what we have done so far.
**Graphically, the website is fully designed, minus smaller pages such as “About” and “Contact”.
**The server is completely set-up, the software we need is fully installed

Here is what we have left
[….]
**Finish coding the site. (requires payment, which I will get to in a minute)

To me, this reads an awful lot like they are using a pre-made publishing platform (such as WordPress), with someone designing/developing a custom theme and some plug-ins for it. That’s certainly not the “brand new site requiring a lot of money for development” that I and quite a few others expected to see. In fact, it’s something that an arbitrary competent freelancer would probably do for perhaps $300 or $400 through any rent-a-programmer website.

Here is what we have done so far.
[…]
** We have aggregation proposals with multiple independent news companies about aggregating their content hassle-free. They’re all on board.

This certainly makes me wonder. What “multiple independent news companies”? If “they’re all on board”, why aren’t you just naming them? How does anyone know that they are independent? But alright, benefit of the doubt for this one.

Here is what we have left
**We have to populate the site with news. We need 8 stories for each category before launch. We have 8 categories:

human rights
activism
security
privacy
net freedom
environment
opinion
lulz

Also, undetermined number of videos needed… but all of these are really easy to find.

That sounds a bit like a content farm. And didn’t you have a bunch of independent news companies working with you? And a bunch of ‘contributors’? What’s the hold up?

**We have to train people on how to post to the site. We are in the process of writing up a manual for those who will have access to post.

Wait… so there’s just going to be the old model that was also used on Twitter, where there’s a very select group of (hand-picked) people, likely to all have a similar bias of some sort (because hey, it’s always the same people picking them), calling the shots with no ability for anyone else to post? Why don’t you just allow open submissions and moderate them? Is this just going to be yet another closed platform with an ‘agenda’, just like the current Twitter account is?

**We have a third party shop picked out and ready to go. We just have to weigh the benefits of the additional shipping options. We have created a store design, but we really have to find out how it plugs in to see how customizable the look can be.

Wait… what? A ‘third-party shop’? This is starting to sound quite commercial…

** We need to create an LLC and open a bank account in the LLC’s name. We are trying to find a community bank with business support if we can, but welcome to company life… we may get stuck with an international financial retard corporation.

WHAT?! Are you fucking kidding me? Why the fuck do you need to set up an LLC? What purpose would there be for an LLC (and not a registered non-profit organization!), other than… going commercial? Whatever happened to “oh, we’re doing it to inform people about important stuff because activism”? Is money more important now?

The reason that this website is taking so long to launch. We are dealing with an issue of a cashier’s check being lost/stolen from the United States Postal Service. We realize that this form of sending payment was extremely stupid on our parts, especially because we did not certify it. We are newbs. We are learning as we go. We have cancelled the check and are waiting on a report to come in so that we may figure out what is going on. Once this report is in, we will be back on track and we have figured out an alternate, more secure means of paying our programmer who has graciously spent their time putting our requests for this website into hard code. We all should appreciate their efforts, and they will be paid as soon as the report comes in.

Oh, right, the dog ate your homework. Would there have been any worse possible method to send your money across? Was this actually what happened?

We have been bottlenecked by USPS on packaging, getting 1000+ envelopes/boxes is NOT as easy as it sounds and we have been unable to this point to go the amount of USPS offices to collect these.

So why didn’t you just make a bulk order for packaging at any random office supply store in your area? Why do you need several months to collect a bunch of boxes and envelopes that any such office supply store would have been able to ship to you within a week?

We have spent over $10,000USD on incentives, more like 13, or 14,000 to be precise. Shit is expensive, and we decided to go with a shirt/sweatshirt printing company that is local and aligns with our causes. Because they were un-used to the volume that we asked of them, just getting these items took nearly a month.

This is probably the only paragraph in the entire Pastebin that sounds remotely reasonable.

We have spent several thousand dollars, the exact amount I am unsure of, getting the server space, software for it, and DDoS protection that will be required to handle a site where we expect nearly a MILLION hits a month. We want to make sure that we have the least amount of downtime probability as possible.

Uhm, what? A million hits per month? And you’re presenting that as if it’s a lot?

Okay, let’s get a bit of perspective here. When, in early 2011, the somewhat famous fake press release about the Westboro Baptist Church was released on AnonNews.org – a site that I run – it received roughly 400,000 hits from 300,000 unique visitors in one day. It slowed down a bit, but held up fine otherwise. At that point I wasn’t even using any form of cacheing, just a bunch of PHP with a MySQL database behind lighttpd.

Want to know what kind of server I used at the time? A basic OpenVZ VPS with 512MB RAM and a few hundred gigs of traffic a moment, that you could have gotten at any reliable low-cost VPS host for some $10 a month (at that time).

So for a site that receives roughly 3 times as many hits in a month as AnonNews received in a day (and coped with fine), you need to spend at the very least 100 times as much per month? I’d like to know who exactly you are hosting with, and what you are paying them for. This sounds very, very fishy.

I said, and I will say again, if you are patient I can gather a more precise run down, I personally have not been handling that side of things, but I will now be taking on the role of Support.

I would recommend that you post a full break-down of all income and expenses in the next few days, for everyone to see.

This ‘project’ is starting to smell more and more like a giant scam. Everything mysteriously goes wrong, exorbitant amounts of money are paid, and with questionable intentions behind the whole project to start with. And even if this isn’t a scam, there’s plenty wrong with it.

Because, let’s be honest – do you really think it’s a good idea to have a commercial and for-profit (!) corporation run and control the most-visited news platform for Anonymous (and increasingly, activism in general)? Do you really think that aligns with either the morals or the best interests of the activism community at large?

8-jarige moet het maar zonder begeleiding doen, aldus Chassé Theater Breda

For my English readers: this is one of my very few Dutch blog posts, because it’s unlikely to be relevant to visitors from other countries. After this post, I will resume posting articles in English.

Vrijdagavond naar een optreden geweest waar onder andere mijn 8-jarige broertje aan meedeed. Leuk optreden, gezellige sfeer. Althans, totdat hij een t-shirt vergeten was in de kleedkamers – toen begon de ellende. Snel naar de artiesteningang, de lift in, en onderweg naar het vergeten t-shirt.

En dan staat er ineens zo’n beveiligingsmedewerker in de liftopening. “En wat denken we te gaan doen?” Na uit te leggen dat hij onderdeel was van de show en een t-shirt vergeten was, dachten we dat het allemaal wel goed zou komen. Maar dat was verkeerd gedacht.

“Dan mogen jullie even naar buiten gaan, en mag hij in z’n eentje via de trap naar beneden lopen om zijn shirt te halen.”

Wacht even. Een 8-jarige die nogal snel de weg kwijt is, alleen naar beneden sturen terwijl de begeleider al weg is? Dat moet toch een misverstand zijn. Maar nee, de beslissing was al gemaakt. Zelfs één van de ouders meenemen zou teveel zijn.

“Ik heb hier driehonderd artiesten beneden zitten, ik wil geen chaos,” aldus de beveiligingsmedewerker van het Chassé.

Leuk argument, er is alleen een klein probleempje mee: er was die avond maar één voorstelling, en dat was toevallig de voorstelling waar mijn broertje onderdeel van was! En aangezien het overgrote deel van de kinderen inmiddels naar huis was, klonk dit mij in de oren als een nogal slappe leugen om de “regeltjes zijn regeltjes!”-mentaliteit te verbergen.

Maar goed, de beslissing was al gemaakt. 8-jarig broertje loopt de trap op – in de verkeerde richting uiteraard, en moet teruggehaald worden – en nog wordt het meneer beveiliger niet helemaal duidelijk dat deze jongen begeleiding van een volwassene nodig heeft.

Ruim een half uur later, de begeleider van de groep inmiddels gelukkig ook binnen omdat hij ook wat vergeten was, komt mijn broertje dan uitendelijk toch naar buiten. Zonder t-shirt.

Voor degenen die er interesse in hebben, hier zijn de eerste 20 minuten van de betreffende show “The Loads Goes Chassé” te vinden.