Whether the email is considered private or not is completely orthogonal to whether you are allowed / should tie an action to your email. And then again completely orthogonal whether you can/should make that connection public.

Even if your email is public information and even if what is uploaded is public information that doesn't imply that the email address behind the account that uploaded that information should be public.

There is software which is intended to e.g. locate the GitHub profiles of people working at companies, then scrape all public repositories they've contributed to for their email address and the emails of their coworkers - to enable targeted advertising to those individuals. Very common in enterprise sales.

With ChatGPT, this can be extended to create emails that look very personal - as if someone has followed all of your work and is genuinely interested in what you are up to - with extremely low effort. And people are already doing this, I already get emails like this today.

Should emails be private? I don't know - I personally consider them to be public because I know for a fact mine will eventually be public whether I like it or not. But I am aware AI is out their slurping up every public communication I've ever had, and is likely trying to manipulate me in various ways already today.

> This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts.

There are several ways to look at that.

The organization that I work for considers anything that ties two pieces of information about a person together as private information. That is to say that a person's name is not private and a phone number is not private, but connecting a phone number to a name is private. In one form or another, an email is frequently tied to a name (e.g. the email address is based on their name, or an account record includes both a name and an email address).

Another way is to consider how accessible the information is. There was a lot of information that was not considered as private prior to the widespread adoption of the internet. One issue that I remember popping up in the early 1990's involved property (i.e. land) records. Historically, people had to go to a government office to access them but they were publicly available. Since they were publicly available, some governments made them available online. Once they were available online, the barriers to access were removed (e.g. having to physically visit an office) and the ability to abuse that information was vastly increased. All of a sudden, people started considering something that used to be considered as public information as private information.

An issue is for most sites/services an email has just become a standard authentication method, rather than something that can easily be more unique per account. So any usernames across sites/services that share it identify that user as being the same person (for data broker profiling, doxxing, etc), which is the privacy issue (not the email address per se, unless it perhaps contained one's real name).

For contrast truly unique email aliases for example aren't possible on common services like free Gmail*, only things like self-hosting/certain paid email hosts, which makes less feasible for many. So from a privacy perspective while in an ideal world everyone would be able to freely create entirely unique per-account creds we're mostly stuck with the email implementation.

* One could create entirely separate accounts but it's high friction and IIRC the same phone number (now a requirement) can only be used for 2-3 accounts.

> This raises an interesting question: should email addresses be private?

I sadly don't think that's viable.

What might be, in our current world, would be having a mail server/client setup where you can generate random addresses for yourself like Wf1JJUBHLu@domain.com and never re-use an e-mail address, much like with passwords, while being able to see all of the incoming mail in the same place and respond with the corresponding accounts.

Then, when your address gets traded around, it'd be fairly obvious (with some basic bookkeeping, e.g. a text field with purpose/URL for why a certain address was created) who is to blame for it and blocking incoming traffic from somewhere would be trivial as well.

I do have a self-hosted mail server and there are commands to create new accounts pretty easily, I'd just need to figure out the configuration for collecting everything in one place, as well as maybe make a web UI for automating some of the bits. I wonder if there are any off the shelf solutions for this out there.

> This raises an interesting question: should email addresses be private?

Yes and no. Both of them. As any powerful tool, email is going to be abused, like any other alternative would be when it will come one day. Those services allowing creation of dynamic email addresses do their job (until they're banned, that's why I'm not mentioning them), however using them isn't automatic and most people don't even know about their existence. What if we then did upgrade email protocols to reflect current needs wrt privacy and modified existing mail servers so that they could create dynamic addresses when asked by a simple flag? Example: I want to subscribe to a service from company XYZ, however I'm not sure how much I can trust them, therefore, when writing an email or filling a web form I can activate the option to create a new address that is tied to the recipient I'll be writing to, and will work as a dedicated proxy for my real address, that is, every mail I send to the recipient using my real address will be actually sent from the new dynamic address, then all replies to the dynamic address will be routed to my real one, but a field in its headers will always contain either a memo by me (example: "signup with XYZ") or the original recipient (example: "info@xyz_trustuswerenotspammers_yeahsure.com"). This way one can immediately spot whoever sold their address to others and blacklist them. As said, those services work well but not being built in into mail servers and clients their adoption is quite restricted. I don't see why that function shouldn't be embedded in a new upgraded email protocol as the modification would neither be that hard nor consume any serious resource. I would however expect heavy resistance against the adoption, of course.

In a world where email costs ten cents to send (per receiver) email addresses need not be private. In our world? They kinda need to for sanity.

I think it just needs to be communicated. Some websites allow login only by login name and not by email, some people have identifying last name, others hardly identifying full name and whatnot. There's no universal or universally agreed answer to that, so it needs to be said whether your service _consider_ it public information or not.

Pr definition the email address is considered as private information and should be protected accordingly.

It should, mainly because an email is not just an email, it's a channel to reach otu to you, your internet address. And we know how that is going in your inbox.

This raises an interesting question: should email addresses be private?

GDPR is clear on this and there have been significant fines for revealing email addresses against the will of their owners (e.g. using cc instead of bcc). Not saying this is the ultimate wisdom, just a data point to consider.

>Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts.

Buildings are analogous to domains, not email addresses.

> should email addresses be private?

I dunno. Should your personal phone number be private? Or your home address? Would you be okay if I knew it and shared it with a stranger? Or would you rather be asked permission to share it first?

Seems pretty cut and dry to me. Yeah, there's going to be someone out there (there always is) who doesn't care, but I'd wager the majority would be pretty ticked off if you gave those pieces of information out to a rando on the street.

This question could not be more academic

> Theoretically, someone could scrape the pages and compile a list of exposed email addresses.

I laughed. Oh no! Anyways…

The people interested in identity theft are probably too busy figuring out what to do with all the SSNs they stole (not from this breach, but from the annual catastrophic breach of a credit bureau or government repository).

And the people who want your email probably already got it from one of the hundreds of other services you have to create an account for now.

I’m not really sure if there are circumstances where donating to the internet archive could be held against you and lead to persecution. Maybe in certain Luddite communities? The Amish? But then, how would they know…

IIRC there were a few storage based projects that popped up using alt coins to encourage people to offer excess storage space for other randos on there internet. The possibility you might be storing illegal content might have been what killed it/them.

https://en.wikipedia.org/wiki/Cooperative_storage_cloud gives a few examples, like Filecoin.

Are you, by any chance, named Richard Hendricks?

The main issue that such hosting faces is that it's less efficient and more expensive than just regular centralized servers.

Does https://ipfs.tech/ fit the bill?

This was a plot line in Silicon Valley.

I believe that it would be possible to cost effectively build and implement an architecture for a distributed IA backup—this comment entails some notes.

The system that asks volunteers about their age, sex, location, and storage format details (the model, past use etc. can be used to predict the durability of a single storage) without sharing most of this data anywhere.

The downloaders are then algorithmically allocated pieces of the archive. Exampli gratia such that there is at least limited amount of overlap between the pieces, and two people same country won't provide redunancy for each other.

When a downloader verifies that they have completed the download by giving (unique, to prevent fake-download sabotage) SHA hashes of the data, the information that these pieces have been downloaded in this or that country, plus an estimate of the reliability of the storage, is added to a public database, for the algorithm to use in the future.

Every downloader is then generated a public and private key so that they can give the hash of their download again once in a while or just verify that the piece is still there. The reliability estimates (based on storage / hardware details) would be empirically calibrated based on the data about the actual storage failures.

A public counter, estimating how well the archive is currently backed up via this scheme, could be displayed.

For copyright issues, it would be possible to encrypt some of the data, e.g. such that normally borrowable items become readable files only when X% of downloads are pieced together.

The scheme would be primarily based on existing designs and algorithms but work roughly as depicted above. I am not an expert of what compression, hashing and other algorithms should be used, and it needs lots of good work, to determine how to avoid errors in the scientific part of estimating the reliability of the downloads—and generally a situation where it would turn out that lots of data was lost when attempting to put the pieces back together again.

Remark (engineering): To empirically validate the correctness of the software of the backup architecure by testing it on grids of real hard drives in single places will probably give safety against catastrophic failure. Even better would be to obtain large amount of old hard drives and SSDs kept in a single place for a long time, to validate that the software works over time.

Remark (integrity): That a downloader actually has the downloads can be verified efficiently by IA server adding small part to the piece the downloader has, hashing it again, and requesting the new hash.

Remark (redunancy): It may be possible to develop a social program that analyzes whether a volunteer in certain place can provide more redunancy by buying themselves a hard drive or by supporting the acquisition of hard drives for volunteers who have proved themselves realiable elsewhere. This is speculative and the benefit may be lower than the risks.

Finally, instead of "public database" it may be much more optimal to decide to use a blockchain of some sort. Not a cryptocurrency, but a blockchain. This is because if the idea is to distribute copies over the world to ensure continguency in case of IA main architecture collapse, then the more parts of the distributed backup architecture (which must actually not be "the backup architecture" but "a scheme", that no everyday IA decisions rely upon, and that just exists out there) are on a blockchain network run by a "decentralized" system, the more reliable it will be.

My heuristic plausibility analysis: 0. IA backup would not need to be constantly accessed or changed (this makes storage easier, cheaper and prolongs the maximun age of the storage) 1. Not all IA has to be backed up: a distrobuted backup that successfully recovers 10% of IA in a catastrophe is by all means a great success (consequently priorization of what might / should be stored should probably be part of the algorithm that decides what volunteers download; and what existing "big" archives already store that overlaps with IA should be taken into account in this analysis) 2. I recall you estimated 30-40 M USD ballparks for a single copy: a properly led open source project may be able to develop this for free, and fairly compensated one could be ~ 0.1% to 1% of the cost. 3. The Sia network https://siascan.com/ has space for 7PB; and it's for storage where one can download their own files at any time; and they have had very little publicity. 4. 2TB hard drive costs 50-100 USD and 20PB would be 10 000 humans buying one 2TB hard drive which by itself is possible. Hobbyists and organizations may be able to provide even larger capacities. 5. Most IT projects fail, but since lots of technology already exists and in this we know what we are doing and IA might be able to recruit above talent we can conservatively, give conservatively 50% chance the groundwork development to succeed, or 45% without funding. 6. If the develoment succeeds, then there may already be around ~ 100 potential volunteers. I estimated that 0.1% IA visitors may volunteer, plus 1% from Hacker News traffick were to project to be mentioned there, plus growth over first few years and traffick from elsewhere. Perhaps 75% chance to get 10% of IA backed up by volunteers, given development succeeds. 7. If that much is backed up, there is perhaps 5% of attaining 200 TB in next few decades.

Conservatively, given that open-source development starts, one gets apprx. 33% - 38% chance that 10% backup is achieved & apprx. 1-2% that 100% of what is now in the IA, could be backed up. These are of course rather meaningless numbers, but the fact seems that in the lack of funding to build a complete backup IA can best guarantee continguency by starting to build a distributed one. Perhaps this was needlessly lots of words for a simple proposal.

- X

---

Note: It's probable that at least the NSA has a private full IA backup.

Part of the reason people don't/didn't like seeding is that many residential lines are so terribly asymmetric. If you had 100down/5up, seeding your torrent at a useful speed was often enough to degrade your connection into unusability.

Not much money and bandwidth if you aren't on a metered connection. You can share tens of gigabytes or more on a cheap read only flash plugged into into a $25 single board computer that draws way less than a full PC and can be left sitting there near the router. Just limit its bandwidth on the torrent client and you won't even notice it during online gaming. The client can be as small as the Transmission daemon running headless on one of the many Debian based embedded distros: all control through either the web interface or from its client: no monitor, mouse, keyboard etc. just a small cheap box.

https://www.friendlyelec.com/index.php?route=product/product...

(just an example, as it's way overkill for the task)

https://transmissionbt.com/

https://github.com/transmission-remote-gui/transgui

I see 24 seeders for the entire 72-episode run of the 1991 sitcom "Herman's Head" which was so poorly rated that it's never seen a home media or streaming release, your premise doesn't hold any water at all.

It does work, when you don't notice it. We need sane limits and permanent seeders. This is why so many regular people get hit with ISP notices, they don't know they've seeded Captain America for the last six months every time they started their PC.

If the whole world has bandwidth available for TikTok, it can make the same available for sharing torrent files.

I've been seeding some unpopular torrents for ten years (would have done for even longer if I did not change the torrent client a decade ago). "No one" is too strong a word, as usual with these absolutist things.

In addition to the costs, I'd say it's also that no one wants to risk getting sued like the IA is getting.

This is one of the very few real use-cases I can think of for the blockchain

torrents maybe

Proves they really did hack something. There's other sites where hackers register defacements etc.

If Troy authenticates the data, they can use that as an 'endorsement' when trying to sell it.

Anyone who buys it or finds it in the wild can also upload it.

I just checked and my unique-to-archive.org email is showing up in the breach as of 2024-08-09.

Many hackers will remove addresses that are obviously unique, including tags, to keep silent which database has been hacked, but it seems inconsistent.

I have checked and known my address was in a hack and it isn't there, while other times it is there. I also wonder if they start filtering out by domain, as they see a domain across multiple databases with unique addresses in each database exactly one time.

Out of curiosity, do you use a unique email address for every single service?

How do they get a hold of all these leaks so fast?

He didn't. If you break down that field you see:

    $2a$
    10$
    Bho2e2ptPnFRJyJKIn5Bie
    hIDiEwhjfMZFVRM9fRCarKXkemA3Pxu
    ScottHelme

https://xkcd.com/2176/

MFA

I use login with google, idk if it is safe

It's all good, as long as you're not in that recent AI Girlfriend breach which exposed a ton of users who were trying to coax it into generating CSAM images.

https://x.com/troyhunt/status/1843788319785939422

I'm also on HIBP over 10x. What are we supposed to do? Create a new email address for every service we sign up for?

I don't know what the best practice is for keeping our personal data safe anymore.

And my SSN's probably available for purchase with 9 types of crypto, too.

I feel like it's safe to assume the official Internet Archive would not write a "friendly"/attempt-at-humurous/unprofessional/confusing/delivered-by-popup message advertising a devastating security breach. Oh also while announcing that nowhere else.

Obv an attackers ability to insert a message does imply a breach beyond a DoS. But I am pretty confident that message was not from the IA.

It's a literal window.alert()

Yup.

https://news.ycombinator.com/item?id=41792651

yes, "https://polyfill.archive.org/v3/polyfill.min.js?features=fet..." is the URL with the malicious code

Correct. The source subdomain of the popup seems to be hxxps[:]//polyfill[.]archive[.]org

Yeah, but the leak has been confirmed by HIBP, I found my address in there.

yes

[flagged]

now internet archive is offline. uh-oh?

How long does an average hard drive last? You'd have to spend that 700k every that many years (plus the extra bits you mentioned). Quite an operation actually

IA stores lots of redundant stuff in 5 file formats and none of them are particularly well-compressed, I think. There are (big) savings to be had, but maybe figuring that out (software dev and compute time) isn't worth it?

Interesting to compare their stated drive $/GB to their B2 offering: $6/TB/mo for "pay-as-you-go",

hard-drive price: $0.014/GB

B2 price (12*6/1024): $0.070/GB/year

Oh no! I didn't know their IPFS initiative didn't pan out. What happened to it? I am surprised how hard it is to google. I remember interviewing for a role on that team at the archive to help move it to filecoin. Was so happy to hear that the effort was underway to decentralize their datastore. We need this more than ever.

Perhaps you can persuade Elon that it owns the libs?

See also the considerations mentioned in the sibling thread btw: https://news.ycombinator.com/item?id=41793846

> even if they got your password, if they don't have access to your password manager they can't login.

Wouldn't the same argument go for a non-2fa password? What's the difference between a randomly generated 2fa secret and a randomly generated password here?

> I was going to disagree with you (and I sort of do about password managers and storing 2FA in them

Note I'm quoting HIBP's advice from the email they've sent me! I'm absolutely not recommending to store one's 2FA secrets in the same place as the password!

Even if one uses 2FA for the password manager, it stops proving "something you have" in addition to something you know and you're one unlock away from malware vacuuming it all up. The point of 2FA is to be on a separate device you need to have on hand

Of course, the same logic goes for a password manager in the first place, but password reuse is a big enough problem that (for most people's threat model) it seems to be a net positive. 2FA tokens don't have that reuse issue

The difficulty is configurable. You can play around with it at https://bcrypt-generator.com/

I found this, not sure if it's still up-to-date:

◉ PHP's default implementation of bcrypt uses 10 rounds.

◉ Python's bcrypt library uses 12 rounds by default.

◉ Node.js's bcrypt library uses 10 rounds by default.

See also: https://gist.github.com/Chick3nman/32e662a5bb63bc4f51b847bb4...

Besides being slow, there's also an implicit salt, so rainbow tables to quickly check every account for "password" don't exist. Still, if you just used a simple dictionary word present in e.g. /usr/share/dict/words (my system has 234,937 entries), you don't have as much time. I have a Ryzen 9 5900X, 12 cores; using a random Go implementation of bcrypt I found with default work factor of 10 and going through that dictionary with 24 threads, it takes my machine about 18 minutes to get through every entry. A thousand years if I wanted to go through 31 million accounts and each one was a worst-case at-the-end value. But there are quite a few more than a thousand of my CPU or better out there, some surely part of botnets which routinely number in the thousands of devices, and probably faster bcrypt implementations. Earlier this year, the FBI dismantled a botnet with 19 million infected devices globally and over 600,000 US IP addresses. Surely some of those were weak IoT devices, but still, there's a lot of compute available to bad actors such that you shouldn't necessarily rely on bcrypt et al. to protect a very weak password. (They are rather good at protecting normally weak and mid passwords, though, and there's opportunity cost for all that compute.)

If you don't reuse that password anymore, does it matter tho. Some services might use older hashing for older passwords without updating the hash algorithm. But I don't know what is the case here.

brypt passwords are very slow to crack.

Thanks. I e-mailed my students to let them know.

Thank you.. was worried at first as I didn't understand the true scope of the breach. For such a vital website, the info gleaned seems relatively harmless (for those of us who don't reuse passwords that is)

That's what Troy got sent. It's not necessarily all the attacker took.

they use Stripe

> The timing on the last point seems to be entirely coincidental. It may also be multiple parties involved and when we're talking breach + defacement + DDoS, it's clearly not just one attack.

It could also be that the attacker has compromised IA communication channels and timed it for maximum dramatic effect and confusion.

Just a reminder that AI tried pivoting to much more clear-cut legitimate piracy, presumably because they got bored or something, and certainly put ‘donations’ toward that effort.

IA is an incredibly valuable resource, but let’s not put them on a pedestal.

[flagged]

Probably want it wants to purge incriminating documents against a nation state?

Verge article as possible replacement: https://www.theverge.com/2024/10/9/24266419/internet-archive...

What weird conspiracy is this? US interests dont involve taking down archive.org

It's a non profit. You're probably not choosing to work for the IA for high compensation.

Not even in the 10th % for the area per https://www.levels.fyi/heatmap/

[dead]

Which is pretty common. While the org is running around dealing with the DDoS, they're not doing anything to fix their systems. In this case, I can't even get to my account page on IA to change my password.

Actually figure out what is happening, or at least say how confident they are in what they know.

They aren't predicting the future, they are reporting on an ongoing event.

To be even easier, you can just have Apple or Google hold your domain and provide mail.

yea, but now i rely on cloudflare which is no-go for me.

I recently ran into an issue where Toyota’s app/site was detecting and refusing Apple iCloud hide-my-email addresses when trying to sign up.

The error message was very clear: hide-my-email was not permitted.

I was just trying to check for available service appointments near me and didn’t want the spam. But I guess sending spam is very very important to Toyota.

https://c-command.com/spamsieve/

Worth every penny.

it “works”, but handing over this control to Google is a no-go for me.

Memes are fun and all but this one is both untrue and just serves to entrench the big bastards, who don't need any more help.

I often use custom domains for email and haven't encountered this. From what I know, the best practice is to use a domain that you have had for a while and to use nameservers or MX records from an established service (basically). I don't run my own server but I am sure there are tricks to getting it to work that way too.

Use a commercial service then, they're cheap and provide every benefit mentioned by GP. The thing that you really need is not your own server, but your own domain.

I've never had this issue, been running my own email server for almost 10 years.

I do this. I just say "this will sound strange but my email is ..." and then spell it.

I think if you are at the level of catch-alls and your own domain(s) then you tell the cashier "no thanks!"

i have a similar setup for the past 20 years or so. I rarely get a raised eyebrow at giving X.yourcompany@mydomain.com, and if i do i state it upfront “this is for categorization” and never had to explain it again.

Zero problem. I have used this exact setup with my domain for over 23 years. First, it's rare that I had to give my email over the phone or something. And in the couple of times someone raised an eyebrow, it was an opportunity to educate the person that yes, "donotspamYOURCOMPANY@" is indeed a valid address (not exactly what I use, but similar).

The advantages are numerous: tracking who leaked my data (many times before the company even noticed it), easier to spot spam (20 years ago spam filters were a lot less sophisticated), minimize credential stuffing (before Pwd Managers became the norm), etc.

I have this same setup and this conversation happens often, you get used to it happening and navigating it.

ON only one occasion in ~20 years, someone refused to do business with me because they thought I was impersonating them and told me I was being disrespectful by using their brand as my email, and even after explaining how it works they weren't happy.

almartway@somedomain.com

Meh, it’s not that bad. I have a short domain and usually use an abbreviated version for user part. If it’s a big corp, just the stock ticker will suffice and nobody bats an eye. Some boomers raise an eye if it’s not @gmail.com or one of the big providers, but otherwise nobody cares.

But better than giving them an iCloud “hide my email” generated addy ;)

The metaphor takes precedence over the fact.

Here is a great video on the subject in case folks want to learn more: https://m.youtube.com/watch?v=M4WU8gqrgsQ

I had to look it up, but I guess HIBP refers to https://haveibeenpwned.com/

What are you "borrowing" from the Archive?

Check my edited comment for more info on that account. In short, typical russian shenanigans.

>Also at some point the account of a malicious hacker has to be banned right?

You can try ask musk about it.

There is/was plenty of anti-Zionist material available in the IA.

Because in the main, people are vicious, blind, narcissistic brutes.

I use several, but I dream about a world with no passwords. Managers or not, passwords are always at risk and it is only a matter of time before one of the 300 sites leaks your data.

That's why I'm told ezboard as a whole was removed from the index (sadly).

You probably can do this, OP.

It's an uncommon opinion for someone to be in favor of IA to retain all information, and it's also not their stated purpose.

It's a perfectly reasonable opinion to wish for retention of old sources of knowledge without retaining pages containing personal information of non-public people, or sensitive non-newsworthy information about anyone at all.

Bear in mind that is the doxxing and doxxers that have happened now. There are plenty of future opportunities to be doxxed and plenty of other potential victims.

Not that I'd cheer for the loss of IA, but it'd probably be nice if they took down PII on request.

Still worth deleting future instances. What's your point?

Attacks like that tend to have little to do with bluntness. They occur when you've touched something they consider to be theirs, and you are not entitled to. Usually that's some matter of group identity, where they feel the need to show off for each other just how angry they are at you.

It has less to do with what you say or how you say it, but with who you are.

Or, equally valid, pro-zionist activists who want something that is normally easily accessible in the IA to be censored.

>They are under attack because the archive belongs to the USA, and as we all know, this horrendous and hypocritical government supports the genocide that is being carried out by the terrorist state of “Israel”.

Ah yes, known arm of the US military-industrial complex, The Internet Archive

...or someone attempting to blame palestinian activists. This smells a lot more like someone trying to ape activist language.

Both tweets have received a community note disproving this.

I don't think they'd post cringe messages on Twitter though.

[flagged]

He or she is still a clown. What difference does it make who hired him or her? At an individual level one can always disagree to do things that only destroy value.

There is a big difference between doing something for pure curiosity, love, or exploration and doing something directly harmful to other people for the same reasons. One is art; the other is sadism.

It isn't "breaking into things" hackers.

It's "whipping something together" hackers.

Breaking into the Internet Archive's servers is like breaking into your public library. There's no honor to be had.

https://www.ccc.de/en/hackerethik

> Make public data available, protect private data.

True hackers probably have a special place in hell, but, in a good sense.

Accessing the data is one (hackery) thing, haphazardly publishing it and not responsibly disclosing it is another (criminal) thing.

This isn't Cracker News.

Did you miss the part about the DDOS attack?

nah. its politically motivated hacktivists that are pro Palestinian.

See their Twitter https://x.com/Sn_darkmeta

could also just be RU larping under another flag.

Yes? For society in general, for professionals in criminal justice system and also to some extent even victim as well, it is lot harder when there is no motive.

Perpetrators without motive can not be negotiated with, punishment may not a strong deterrent, rehabilitation is lot harder. Economic crimes or crimes of passion or ones as a result of addiction can have a path to rehabilitation and recidivism can be solved by tackling the underlying issue like poverty, addition etc. Even solving crimes without motive can be harder as there is less assumptions we can make about the perpetrator.

"Say what you will about the tenets of National Socialism, but at last it's an ethos."

A demonstration of what collateral damage actually means.

The bracker was a terrorist so we killed the candle stick makers family.

Is there any reason to think this? (Honestly asking). It seems like quite a stretch to me unless there is some reason to connect the two.

100%. https://x.com/Sn_darkmeta/status/1844080692772401399?t=j3xDz...

This Twitter account is suspicious and odd. I don't think anyone doing this is stupid enough to actually believe that they're doing it to "help Palestine." Seems like a job by Israel or supporting countries pretending to be supporters of Palestine.