Is it safe to give my email address to a service like haveibeenpwned in light of the publication of "Collection #1"?

Question: There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g.
Have I Been Pwned.
Is it safe to enter my email address there to find out whether I need to change my passwords?
Comment: Note that @Xander's comment only applies to that specific site - there are others which are also fine, but by no means all. Any site which asks you to provide the email address and password to check is best avoided (note that while HIBP does offer a password checker, it doesn't require any other data for that function)
Comment: Yes, it is safe.  haveibeenpwned.com is a well respected website run by a well respected individual. (Troy Hunt.)
Comment: To be honest - can it be - has it been - independantly verified that `haveibeenpwned.com` is safe? I don't doubt it is, but really what I'm going on is little more than *trust*. Has there been any 3rd party penetration testing analysis? (open question)
Comment: Well to be honest, the worst what could happen @Martin is that Troy Hunt (which is a well known respected security author) has your email address. I actually have an email address to give to people so they can contact me, if that is the only PII I am giving out I'm not so worried ;)
Comment: @Martin Not that I know of, but even if there was a pentest or code audit a year ago, how would we know that the same code is used today? Even if the code was open source, how would we know if that was the version that was deployed? Then *in theory* a single request could be altered in such a way, that the data of specific users was handled differently.
Comment: @Martin Yes already leaked passwords which are also not linked to an account when you type in a password, but I agree this would be more of an issue (although I still don't believe there is an issue)
Comment: @KevinVoorn to be fair, you (probably) enter your email, then go to the password page and enter your password. If HIBP wasn't safe, the password could then be stored into one of the best dictionary attack dictionaries ever. because you actually provided a password that had been save previously all by your own.
Comment: A screenshot that all data in the `haveibeenpwned.com` database is encrypted at rest is a good start. But yes, trust only goes so far as the here and now, we can't trust `haveibeenpwned.com` tomorrow, based on this morning's assessment. *Oh dear, the paranoia is back.....*
Comment: @KevinVoorn people contact each other by email? wow! What is this, the Dark Ages?! `;-)` p.s.> `haveibeenpwned.com` also deals with passwords ....
Comment: @TroyHunt - would you be interested in weighing in? TomK's answer below covers it, I think, but always happy to see posts directly from the horse's mouth.
Comment: Please note that some other people could find a way to take over the server. TroyHunt is just human after all and won't achieve a perfect protection in all directions. The best intentions don't change that.
Comment: @Martin The site does deal with passwords. But it actually provides an API to securely look up passwords in the database of leaked passwords. In those lookups the server doesn't learn the password, it only learns a few bits of a hash of the password. The number of bits the server learns is chosen to be small enough that the database will contain at least a handful of different leaked passwords which all match.
Comment: What thread model are you considering, where disclosing an e-mail address, and only an e-mail address, is potentially dangerous?
Answer: This question was explained by Troy Hunt several times on his blog, on Twitter and in the FAQ of haveibeenpwned.com
See here:

When you search for an email address
Searching for an email address only ever retrieves the address from storage then returns it in the response, the searched address is never explicitly stored anywhere. See the Logging section below for situations in which it may be implicitly stored.
Data breaches flagged as sensitive are not returned in public searches, they can only be viewed by using the notification service and verifying ownership of the email address first. Sensitive breaches are also searchable by domain owners who prove they control the domain using the domain search feature. Read about why non-sensitive breaches are publicly searchable.

See also the Logging paragraph
And from the FAQ:

How do I know the site isn't just harvesting searched email addresses?
You don't, but it's not. The site is simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach. As with any website, if you're concerned about the intent or security, don't use it.

Of course we have to trust Troy Hunt on his claims, as we have no way of proving that he is not doing something else, when handling your specific request.
But I think it is more than fair to say, that haveibeenpwned is a valuable service and Troy Hunt himself is a respected member of the infosec community.
But let's suppose we don't trust Troy: what do you have to lose? You might disclose your email address to him. How big of a risk is that to you, when you can just enter any email address you want?
At the end of the day, HIBP is a free service for you(!) that costs Troy Hunt money. You can choose to search through all the password databases of the world yourself if you don't want to take the risk that maybe a lot of people are wrong about Troy Hunt, just because then you would disclose your email address.
Comment: As mentioned before: this **only applies to haveibeenpwned.com**. Other services might be sketchy and sell your data off to spam providers.
Comment: Besides only applying to haveibeenpwned.com, this answer **only  applies to haveibeenpwned.com as of the time this answer was posted**. A necessary caveat to any endorsement is that a service isn't guaranteed to be trustworthy for the remainder of its lifetime. A server can be hacked, a policy can be changed, a buyout can happen, a domain name can be seized, or a trustworthy guy could stumble into his supervillain origin story.
Comment: `HIBP is a free service for you(!) that costs Troy Hunt money` I find this detracts from your answer as such services usually find a way to make money from the data you send them (e.g. targeted advertising). It doesn't answer the "is it safe" question anyway.
Comment: @Aaron The way Troy Hunt makes is money is by sponsorships on his blog and he is actually a keynote speaker on a lot of notable events. Besides that, he also creates Pluralsight courses which he obviously also makes money of.
Comment: @Aaron FYI Troy Hunt **is** doing targeted advertising... the site is clerly sponsored by 1password and considering whoever goes to that site is or might be interested in password security those ads are a form of targeted advertising
Comment: @Daniel That is true, which is why all websites which could be damaging to someone (such as dating, porn etc.) are not disclosed on the website itself, rather to the email address you put in to keep it from being used in some sort of account enumeration.
Comment: Well, a lot of times there are pros and cons to a side. ;) I won't delete it, because *other* sites offer free services to then sell off your personal data. To infer that HIBP does the same without any proof seems very odd to me.
Comment: @SSight3 It's worth noting, that this has already been noted in my answer. ;)
Comment: @TomK. I was cautiously giving an anecdote on experience to reinforce, but appears I worded it poorly. I should have worded my comment as 'you *can* enter someone else's email address'. Alternatively, anyone else can enter your email address. My only mild beef is it gives a 'pwned' response to any email to begin with, even if it's without which service (which infers you were on at least one of the pwned services), when it should simply just send the data in an email and give nothing to the casual browser.
Comment: He also does not store email addresses next to passwords in his own database: you can search each independently, *but you can't search pairs.* As he, himself, acknowledged, [doing so would be incredibly dangerous](https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make-passwords-available-via-have-i-been-pwned/).
Comment: @GiacomoAlzetta I think he was not refering to targeted advertising, merely to use PII for advertisement. A misunderstand of what 'targeted advertising' is, as it is one of the least intrusive forms of advertisement.
Comment: I'd like to point out – the minor privacy issue, not saying it is good or bad – that we can enter any email address at the website. This means I can enter a colleague's address and the service could tell me that my colleague's email address was pwned at websites A, B, and C, thus informing me that said colleague has an account at those websites with this email.
Comment: Personal anecdote: It just so happened that someone recently tried to login to my wife's email account with her actual password (the email provider decided it wasn't us and automatically blocked the attempt).  Did the usual "change password" stuff and turned on 2FA on her account.  Then I checked her old email and password on `haveibeenpwned`.  Neither were marked as leaked.  She still got pwned (well, at least they didn't get in).  It's worth saying therefore that just because `haveibeenpwned` comes back clean doesn't mean that you're safe
Comment: @Aaron 1. As I said we cannot be sure that it is indeed "safe". 2. I wanted to show in my conclusion that the likelihood of this particular risk is - afaict - relatively low and the consequence of this risk is more or less negligible.
Comment: I agree we can't prove it is safe, but the rest of your answer still provides good arguments toward why we can reasonably trust the website. This part though in my opinion isn't an argument for but rather against whether we can reasonably trust it.
Comment: It's worth noting that you can hypothetically enter anybody's email address (it will say if it's been pwned, but not what on - which gets sent to your email account if you so choose to use the service), so even if you give the email address, it isn't associated to anything but your IP address and that's a tenuous association at best. No more or less risky than handing out your email address to any other service.
Comment: @FutureSecurity : I know a lot of times people don't check their comments.  I thought I'd just point out that this one, which you made, has been getting some up-votes.  I, for one, appreciate the light-heartedness of your last few words (and appreciate the serious truth of the message as a whole).  Thank you for such positive input.
Answer: Troy Hunt is a very respected Information Security professional and this service is being used by millions of people worldwide, even by some password managers to verify if the passwords selected by the users have been involved in a data breach.
See for example, https://1password.com/haveibeenpwned/
As per the website, 1Password integrates with the popular site Have I Been Pwned to keep an eye on your logins for any potential security breaches or vulnerabilities.
Entering your email address on this site will tell you which data breaches involve this email address, so that you can go back to the affected website and change your password. This is esp. important if you have used the same password for multiple websites, where credentials stolen from one site can be used to attack other sites in a technique also called Credential Stuffing attack.

The following StackExchange post has a response from Troy himself with
  further clarification on this service:
  Is "Have I Been Pwned's" Pwned Passwords List really that useful?
Comment: The linked question and answer by Hunt specifically deals with the "Pwned Password" feature.
Comment: @TomK. yes that is correct and I have provided the link above as a reference and an extension to this question, to put things in context further.
Answer: You didn't explicitly ask about this, but it is very related to your question (and mentioned in the comments), so I thought I'd bring it up.  In particular, some more details can give some clues on evaluating stuff like this.
The argument
haveibeenpwned also has a service that let's you look up to see if a given password has been leaked before.  I could see this service being even more "questionable".  After all, who wants to go around stuffing their password in a random website?  You could even imagine a conversation with a skeptic:

Self: If I type my password in here it will tell me if it has showed up in a hack before!  This will help me know if it is safe!
Skeptic: Yeah, but you have to give them your password
Self: Maybe, but even if I don't trust them, if they don't also know my email then it isn't a big deal, and they don't ask for me email address
Skeptic: Except that they also have a form that asks for your email.  They probably use a cookie to associate your two requests and get your email and password together.  If they are really sneaky they use non-cookie based methods of tracking so it's even harder to tell they are doing it!
Self: Wait!  It says here that they don't send off my password, just the first few characters of my password's hash.  They definitely can't get my password from that!
Skeptic Just because they say it doesn't mean its true.  They probably do send off your password, associate it with your email (because you probably check your email in the same session), and then hack all your accounts.

Independent Verification
Of course, we can't verify what happens after we send them our data.  Your email address definitely gets sent over, and there are no promises that they aren't secretly turning that into a gigantic email list that gets used for the next wave of Nigerian Prince emails.
What about the password though, or the fact that the two requests might be connected?  With modern browsers, it is very easy to verify that your password isn't actually sent to their server.  This service is designed so that only the first 5 characters of the hash of the password are sent off.  The service then returns the hashes of all known passwords that start with that prefix.  Then, the client simply compares the full hash against the returned ones to see if there is a match.  Neither the password nor even the hash of the password are even sent.
You can verify this by going to the password search page, opening up your developer tools, and looking at the network tab (chrome, firefox).  Put in a password (not yours if you're still worried) and hit submit.  If you do this for password you'll see an HTTP request that hits https://api.pwnedpasswords.com/range/5BAA6 (5BAA6 being the first 5 characters of the hash of password).  There are no cookies attached, and the actual submitted password never shows up in the request.  It responds with a list of ~500 entries, including 1E4C9B93F3F0682250B6CF8331B7EE68FD8 which (at the moment) lists 3645804 matches - aka the password password has showed up about 3.5 million times in separate password leaks.  (the SHA1 hash of password is 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8).
With only that information the service has no way to know what your password is, or even if it shows up in their database.  There are a near limitless variety of hashes that might come after those first 5 digits, so they can't even guess whether or not your password is in their database.
Again, we can't know for sure what happens to the data after it leaves our browser, but they have certainly put a lot of effort into making sure that you can check to see if your password has leaked without actually sending them your password.
In summary, Troy is definitely a respected member of the community, and there are aspects of this that we can verify.  Certainly, there have never been any cases where trusted members of a community later break that trust :)  I definitely use these services, although I don't know if you want to trust some random person on the internet.  Then again, if you weren't willing to trust some random person on the internet, then why are you here?
Comment: The site might send you different JS if you use an old vs. modern browser. It could detect whether the developer console is open. It could sample passwords 1:1000 to reduce chance of detection. It could submit the cleartext password on unload. Etc. And if you send a weak password it can be mostly identified from the first five characters (that's the entire point of the service). If you want to be paranoid about it, be thorough :)
Comment: @Tgr :) I thought about adding some comments like that, but the point wasn't actually to make people paranoid, but rather to point out that the internet doesn't have to be a black box. There are helpful tools in almost every browser these days.
Comment: @Tgr Actually identifying a password from the first 5 characters of your hash is tricky.  The only way to actually do that would be to take your password and your email and spam against a service where you are known to have an account.  There are 300-500 passwords per hash "bin", so it would be plausible to brute force that few passwords against a weakly secured online service.  If your password was in the list it could *potentially* be cracked that way.  However, it could be tricky in practice.  If you weren't using a leaked password, sending around your first 5 hash characters has no risk.
Comment: It's plausible to try that many passwords against pretty much any online service. Other than maybe banks, very few websites lock you out after a fixed number of failed login attempts (the harassment angle would be more problematic than the security one). Reasonable websites throttle logins so it might take 1-2 days to get through the list but that's all. Of course if your password cannot be leaked this is not a risk, but then if your password cannot be leaked why bother checking it?
Comment: @Tgr Indeed.  The "trickiness" is because you might not know what service to check.  If you know for sure that someone has an account on a given service and they don't do throttling, you can pretty quickly brute force the passwords (as you say).  If you get in then great (but not for them!).  However, a lack of a match is trickier to diagnose.  Do they not use that service?  Did they use a different password than the one they checked?  Did they use a different email on that service?  It's definitely a plausible attack, but it won't have a 100% success rate.
Comment: Sure. It's the same kind of attack HIBP is intended to prevent: the attacker gets a bunch of username + password combinations from some weakly protected website, and tries them until they find one that matches; except in this case it would be username + 500 possible passwords. These kinds of attacks always go  for quantity over likelihood - given lots of target accounts, it will probably work for some.
Comment: Anyway if you are paranoid (and I don't think a normal user should be) you can download the full password (hash) dump from HIBP and search it locally. That won't tell you *where* the password was used but you usually don't care about that anyway. (Of course the original question was about email, not password; in that case I don't see any possible harm from using the online service, unless it's a super secret email address and you have put your phone number in it or whatever. But others have said that already.)
Answer: Many answers here talk about the particular service "Have I Been Pwned". I agree with them that this service is trust worthy. I would like to say some points that applies in general to all these services.

Don't use a service that asks for both email and password for checking.
Use a service that allows you to check anonymously without requiring a sign in.

These services check data breaches that already happened. If your email address is in a breach these services and many others already know about it. Searching your email is not going to trigger anything new.
The maximum you get to loose in this case is that your email address is disclosed. But that is true for any website or newsletter.
Comment: Straight to the point and actually gives a rational explanation of why there is no actual risk involved in sharing your email. Voted up.
Answer: It really comes down to a few subjective questions about trust.
How much trust is too much to ask? and... How much reliance on trust can we mitigate? Are the first two that come to my mind. Then I ask, who could get the data I'm afraid to give (ie my email address)? How little data can I give? How much do I trust the actors that could potentially get access to my data?
Now I'll attempt to answer these questions for myself and hopefully that will shed some light on how other's can answer it for themselves.
How much trust is too much to ask?
Honestly, I don't know what it would take for me, I just know when I'm comfortable with it.
How much reliance on trust can we mitigate?
I feel like the comments and replies above do a good job of illustrating what can be done so I won't rehash that here.
Who could get the data I'm afraid to give?
Obviously Mr. Hunt could get it. It has been suggested that Cloudfire and possibly the NSA might be able to access it in part at least. Any bad actor could get a hashed partial of it with little to no context.
Some of these seem far fetched enough that I'm personally willing to wager my privacy that it's likely only going to be Troy and to a limited extent, Cloudfire.
How little data can I give?
Just my email, which I openly share to the public anyways, and if I return as compromised, than my passwords attached to that email but if that's the case, I'm already compromised so they could've gotten that anyways.
And finally; how much do I trust the actors that could potentially get access to my data?
Well there's Troy Hunt... it has been said that he's a well known and respected member of the security community. It has also been pointed out that it's not like no respected member of the security community has ever violated earned trust. To that I would counter that he's too well known and documented to getaway with anything if he gets caught doing anything sketch like what's implied, I personally feel that's sufficient for me to trust him given all the other factors but that's just a judgment call so...
As far as Cloudfire goes, I don't trust them as far as I can throw them, so I only trust the email check and not the password check. I do sometimes check passwords that have expired 3 or more iterations ago, as I know Google for example will give an alternate login option to reset your password (in the event of a forgotten password) and one of the alternate options is using the last password you remember using (as in old passwords) so I only test really old passwords of mine.
Hopefully that helps someone decided weather or not to trust it and if so to what extent.
Comment: I don't think this answers the question with anything that hasn't already been posted in other answers.
Answer: If you don't trust HIBP enough to give it your email but trust Mozilla (e.g. because you already gave them your email address for some other reason), you can use Firefox Monitor, a service Mozilla built in collaboration with HIBP. They query HIBP database without ever sending your email to HIBP. (I'm not sure if Mozilla receives your email address or if it's being hashed on the client side.)
Comment: This does not answer the question since Firefox Monitor qualifies as "a service *like* haveibeenpwned", I think. You're just saying "don't trust service A, trust service B instead" while not explaining why anyone should trust a service like that in the first place.
Comment: @Norrius Many people have already given Mozilla their email and it doesn't take any more trust to use their service. I'll add that to my answer.
Answer: Depends on what you mean by "secure," and how paranoid you are.
Just because the creator of the website is a security expert doesn't mean that the website has no security vulnerabilities.
The Website supports TLSv1.2 and TLSv1.3 which is great of course.
https://haveibeenpwned.com is using Cloudflare. As we all know Cloudflare is a Man in the middle. The encryption from the website is broken on the way to the actual server by Cloudflare.
Now, for example, the NSA could knock on Cloudflares door and let the data move over. But you don't have to be afraid of other attackers, because only Cloudflare and the actual target server can decrypt the data.
If you don't care if the NSA or other intelligence agencies get your data, which you sent to https://haveibeenpwned.com, then there should be no problem.  Unless you don't trust the security expert.
Personally, I'd rather have my account credentials exposed than the Cloudflare (NSA) getting my data.
Note: This is only an answer for paranoid people. For those who aren't paranoid, other answers should work better.
Comment: I'm having a hard time even understanding your answer, in my opinion it is full of nonsense which is why I downvoted this answer.
Comment: I don't think you know how the website works. When data (your email, password, etc.) is exposed in a data leak, that is when the websites stores the data and notifies owners if they want when they are part of a data leak. The database only keeps data from data leaks so there is no reason to fear your credentials becoming public because ``haveibeenpwnd.com`` leaks it, the data already is public.
Comment: @KevinVoorn, Ok, I've revised my answer so that even those who don't understand so much about encryption can benefit.
Comment: Thank you for your clarification, although I am having trouble with ``Personally, I'd rather have my account credentials exposed than the Cloudflare (NSA) getting my data.``. I myself would not want to connect Cloudflare to the NSA (which is a personal view), but I don't see why there is a choice between either sharing your data with the NSA and having account credentials exposed. Maybe you could elaborate on that.
Comment: Right, of course it is best if the credentials do not even reach the public in the first place. But in the worst case, if it does happen. What I mean by that is that if my credentials becomes public, I have a small time advantage to change my password before they find my email. This small time advantage does not exist with direct connections to the spy server. In the worst case, your email will be tapped directly and stored in a database. Now they have your e-mail address.  Maybe this is really only for paranoid people. Assuming the owner doesn't work for any intelligence agency.
Comment: That's right. But my IP address remains even in the leaks unknown unless admin is retarded and stores the ip next to the user credentials. But if you send an email via the insecure espionage connection, the Central Intelligence can directly say: "Aha! The email address belongs to the IP address xy". Now they know where you live, because the majority don't use VPN or proxy. Then they got you. Mission failed. I assume the leaks only contain credentials and not IP Addresses. So they don't reveal IP addresses unless the service who leaked the data stores the log files in the same location.
Comment: I'm not really sure if you're trolling or not. If you are really worried about the CIA/NSA or something, I don't think your biggest problem is that your IP address is matched to an email address using the mentioned service. If the CIA/NSA or any other intelligence party wants to find you or information related to you, they will because they can ask your ISP for data, they can monitor and track you, they can follow you, they can tap the wires etc. So I don't see any more risk involved then mentioned earlier.
Comment: [I moved the discussion to chat](https://chat.stackexchange.com/rooms/88648/discussion-between-kevin-voorn-and-skiddie-hunter).


Voice typing new line

Question: I have a Samsung S9 running Android version 10 (q).
I frequently use the Google speech to text facility on the keyboard. I can make it do punctuation like commas and periods however I cannot make it do a new line or carriage return.
There seems to be posts about very old Android versions showing that this may have been possible. is this still possible please?
Comment: Ah good point. Yes I have tried them and it doesn't seem to work as it once did. Seems such an obvious functionality to have. I can't understand why it doesn't work now.
Comment: Ok. Have you tried those old posts you encountered? Old does not mean obsolete. :-)
Answer: On Android 12 with a Google Pixel 6 and Gboard voice typing, the voice command is "New line".
Answer: I have the same phone, Samsung Galaxy S9, with Android 10, with the same problem. When I said, "new line" or "new paragraph," these phrases are not typed. If I say them after a period, a space is generated. If I say "period new paragraph," just the period is generated. Changing the language settings to single language or disabling, "Block Offensive Words" does not affect it.
In Google Play Store, I updated "Speech Services by Google" and rebooted.  After that I got, "new paragraph" to work.   I'm not sure if I didn't just get the pause to be an appropriate length. It works even without a comma or period.  It seems that it needs to be said as if it were written in italics.It doesn't always work.

Voice typing new line


Measuring memory consumption programmatically in PhantomJS

Question: Is there a way to have a JavaScript code that would run as an automated test and measure a web-app memory consumption?
What I am looking for is a way to prevent memory leaks in an angular app by having automated tests as a part of CI build process informing me about memory issues as soon as they arise. I already have many JavaScript tests running in PhantomJS via Jasmine.
Comment: No, basically a duplicate here: http://stackoverflow.com/q/15958395/1816580
Answer: I would get that information from the operating system by grepping ps aux for the phantom process.


Is a auto body shop required to send me a copy of documents that they said I signed?

Question: I requested through text message that they send me a copy of every document that I signed. They have not responded yet. In this situation, they have added $1300 of additional repair costs onto my original estimate. They never notified or called be before going on with these additional repairs. Nevada law states that any additional repairs over $100 need to be authorized. Do they legally have to provide me with the paperwork I signed? I'm intending on filing a complaint against their business for deceptive practices since they charged well above the written estimate and didn't notify me.
Answer:
Is a auto body shop required to send me a copy of documents that they said I signed?

During court proceedings there is a phase known as discovery. That is where parties obtain evidence, such as the paperwork you mention, that previously was unavailable due to an adversary or non-party being uncooperative.
Alternatively, the defendant would have the burden of proof that you authorized the additional charges. This is likelier the path to follow if you file the complaint in Small Claims Court, since there the proceedings are simplified or shorter than in trial court.


How practical would a staff with knobs on the end be?

Question: So I've had an idea for a special quarterstaff with a solid knob on each end and I was wondering if and how practical it would be in a real fight. I did some research, and the closest I could find was the African knobkerrie, which looks to be maybe four-ish feet long, but what I really want to know is how a much longer and knobbed on each end staff would balance, and if the resulting weapon would be able to be wielded to a good effect.
Comment: The wizard's staff has a knob on the end... SCNR
Comment: If it's symmetrical, why would balance be any particular problem just because it has "knobs" at each end? Balance is about some manner of symmetry, which may be a design goal, but balance is not really affected by the design itself.
Comment: Why don't you make one and find out? Just take a long stick and add some layers of cloth to the ends, tying down the cloth with rope or something and now you have a staff that's weighted on both ends slightly more than in the middle. But seriously, why would this change the effectiveness of the quarterstaff from before? It's still a bludgeoning weapon, it's still a long stick, and can still be used the exact same way.
Comment: Define practical.
Comment: By practical I want to know how easily the weapon would be in an actual fight, especially against more than one opponent.
Comment: My resources are a little limited at the moment, and I wanted the opinion of someone who had a little more experience with martial arts than I do. :-)
Comment: @DecemberKat artemissunshine mentions it in their answer, but this may also be a good question for the martial arts stack exchange group.
Comment: Would help if we knew the intended purpose of the staff.  Is the person using it going into battle, or is it something to be carried around just in case of attack?  In the latter case, you probably want it to have other uses as well, like a cane or hiking staff so two knobs would seem impractical.  See for instance the Irish  shillelagh.
Comment: One of the big questions I would have for developing such a weapon is how heavy are the knobs?  A knobbed staff has more rotational inertia.  This means it can put more kinetic energy on target, but its slower to react to changes in the opponent's movements once rotating.
Comment: Have you considered a tube with something like mercury (heavy and thick liquid) inside, to emphasis the strength of the blow ?
Comment: @DecemberKat, may be a question for martial arts stack exchange as well. Frankly I have only a few years experience on a chinese straight sword, broad sword, spear point pole and short staff. There may be masters out there who can answer this.
Comment: @Layna I've been waiting for someone to make that joke XD.
Answer: Hehe, martial art question in worldbuilding! Let's take historical short staffs and long staffs separately before treating the double knob staff.
The longest staff/staff-like weapons that have been used historically are the pike poles, halberds, the Chinese spear poles and the Japanese naginata. These were mostly not targeted at people but at horses during warfare. These are invariably weighted at one end and are not expected to be balanced at all. The knife or spear point is heavy, bearing these at one of the two ends of a 7-10 feet long pole: the metal blade (for slicing and 'poking' power), the tying rope and the extra tassels etc (to cause maximum internal damage as well as slip out of flesh quickly while ripping it out, brr, boy, am I super glad we don't live in those ages!). This is intentional since the unbalanced end makes it easier to wield - your strength and gravity work together to keep the long staff in constant motion and give it its thrusting power. These poles are usually flexible to prevent breakage. Check out the special martial arts practice routines devised around these weapons to see what I mean. YouTube has several (apols, can't seem to link anything in the post on a mobile device)
There exist double balanced blades on both ends of a long pole but these are not as popular as single ended ones. I suspect the double ended ones would look flashier since it would be easy to do rotational motions and slices with them. But these would need greater strength to thrust and change direction while wielding. (added later:) Also, with a 7.5-foot chinese spear pole, about 3/4ths of the moves hold the pole not at the balance point halfway, but with one hand a bit above one end and the second 1/3rd of the length up, the intention being that there should be 'a good length to poke and slice with'. Any sharp object on the shorter end would be a major irritation and require extra care not to cut yourself with. It can be done, like with a double naginata, just more trouble than it's worth. Since this is a knob, not a knife, doesn't have a cutting problem but might have a manoeuvering problem if the weight is too heavy.
Short staffs usually do not have any spear points and knives at the end. At short range, the points are difficult to wield and attack with while protecting yourself at the same time. So usually the staffs at 4-6 feet length are unweighted at the ends except to take advantage of 'gravity assist', you could have a knob at one end acting as a bludgeon. Staffs at this length are more of blocking and bludgeoning weapons than slicing or thrusting weapons. Also they can be 'fatter' or more inflexible than long poles for the weight of it as a weapon that can break bones and hurt. As an added advantage you can use them for walking sticks, to chase away dogs and hang up washing (haha, but this is exactly what ancient travelers and wandering monks did, staffs are delightfully multipurpose).
So double knobbed staff okay, bludgeons well and rotates well due to the balanced nature. No gravity assist but sheer human strength can compensate for it at 4-5 feet length, as a thrusting weapon as well. No obvious disadvantages. Just keep the knobs not too big or heavy.
Curiously, a double knobbed staff looks a bit like a long bone...
(added after some more thought): The joint where the knob meets the staff pole would be prone to breakage on impact if the knobs are exactly spherical meeting a thin pole. Perhaps the knobs could meld in like the ends of a bone.
Comment: Thanks, I appreciate it! The wielder I have in mind for the story/universe _is_ a lot stronger than an average human (sort of in the Jessica Jones range, if you've seen the show), so really sheer strength really isn't much of a problem...
Comment: (Some edits). It doesn't really matter if your character is just average strong too - poles and staffs were the weapon of choice for monks, women, pilgrims and the so-called 'weak', relying on speed and the through knowledge of psychology and human kinesics. I keep thinking of the delightful antics of Monkey King and Ruyi Jingu Bang staff ;)
Comment: @artemissunshine staves were also the weapon of choice for the multitude of civilians in Europe who were not permitted by law to carry bladed weapons. They would often be fitted with iron bands with protruding nailheads and rivets. Knobs are entirely reasonable, so long as they don't make the staff too heavy and unwieldy.
Comment: @Mike yup, that's right, likewise in Asian cultures. Staffs, sticks and pike poles ended up with common folk who weren't permitted to carry blades and peasant-drawn foot soldiers who couldn't afford horses and swords. A single knob is entirely reasonable, a double knob is a bit out of experience, but why not?
Answer: In general you need to pick the right we weapon for the right enemy. I don't know if you'd benefit from two knobs against any kind of enemy. A regular quarterstaff can easily break an unarmored skull, for example. Someone with a helmet would at least get a concussion.
I would like to point out the physics as well. Kinetic energy equals mass times velocity squared, so added mass actually does little compared to just swinging the thing a bit faster. The knob would also spread the force of the impact over a larger area of the enemy, which is not desirable when you really want to hurt them.
A knob on each end would also limit the available moves for the one wielding that thing. You couldn't hold one arm closer much closer to one end of the staff. An asymmetrical grab is essential when you want to put good force behind your strike.
All in all, I think there are good reasons why such staffs are not common.
Comment: The main problem would be rotational moment of inertia.  Putting heavy knobs on the ends of the staff means you'll have a very slow swing making it a less effective weapon.  Adding mass might be practical, but you'll want that in the center of the staff and not the ends.
Comment: @Jim2B Yes, that too. You could swing it once, but if you missed, you'd be in trouble trying to quickly change the direction of the swing for a defensive position.
Answer: A single ended version of the weapon already exists, it is called a mace. The purpose of placing a weight at one end of the mace is to add extra mass to deliver a crushing blow to the enemy, and add a lever arm to deliver the force to cause critical injuries to an armoured target.
As noted, increases in velocity considerably increase the force of the blow, so we need to essentially strip the weapon down to the minimum needed to function for a fast blow, consistent with the other needs (ability to withstand the shock of impact, ability to bock or parry enemy strikes and so on).
A double ended mace, which is essentially what you are describing, might offer some advantages, but the symmetrical placement of the weights would probably create more problems for the wielder than it is worth.
The weapon would be heavy compared to a conventional staff or one sided mace, so it would be harder to get into action, more difficult to get up to speed for a killing blow, and probably the most critical factor is the moment of inertia would make it difficult to quickly change the trajectory to strike a moving target or rapidly parry a blow. Moment of inertia can be quickly visualized by imagining a figure skater. When she is spinning with her arms extended, she spins relatively slowly, but when she brings her arms in her rotational speed increases even though she has not otherwise changed the amount of torque used to cause the spin. Your double ended mace is the figure slater with her arms extended.
So while there is nothing in principle to stop you from making and using a double ended mace, the weapon doesn't offer enough of an advantage over a conventional staff or mace to really make it worth the trouble.
Answer: I've heard of a staff with iron caps on the end for extra weight and striking power(as well as making the main striking points more durable.) Having knobs on the end would serve the same purpose. As far as balance, that could improve the speed and power of each strike when used with the right style of martial art for the weapon.
In a street fight that doesn't include pole arms, firearms or any edged weapon capable of cutting through the staff your weapon would be a very good choice. The main downside are that it may take some extra practice to get familiar with the differences in balance, and shaping a staff like that would be more time consuming and labor intensive than an ordinary staff, or an iron capped staff.


Google sign out in

Question: I've implemented the Google SignIn code with authentication to access Google Drive and have a sign out button with the following recommended code from Google:
GIDSignIn.sharedInstance().signOut()

However, every time after the first time I run the app, the signIn process no longer asks me for my password.
If I sign in and then press the my sign out button, the next time I press the sign in button I am prompted for a google account and then prompted to allow access to Google drive.
If I sign in and then quit the app without pressing the sign out button, the next time I press the sign in button I receive no prompts and am logged in completely.
This behavior appears to be consistent with Google's statement regarding their quick start code (https://developers.google.com/drive/v3/web/quickstart/ios?ver=swift):
"Authorization information is stored in your Keychain, so subsequent executions will not prompt for authorization."
That is the GIDSignIn.sharedInstance().signOut() sign out command appears to work on Google's end (have to pick a Google account and allow Google drive access on the next login), but not on the iOS end as it appears that iOS has saved the password (presumably in the keychain) and always gives it to Google when I sign in after the first time.
I saw the post for Google Sign Out iOS where Birendra had recommended trying
[GTMOAuth2ViewControllerTouch removeAuthFromKeychainForName:kKeychainItemName];

to remove the password from the iOS Device's keychain.
I have not had any luck finding out how to use that suggestion. Can someone explain how to remove the password information that the user entered using Google SignIn? (Assuming this is what needs to be done to completely log out the user). I'm using Swift.
Normally having the keychain remember the password for Google wouldn't be a problem, but this is an app to collect research data. The subjects will be using their own iOS device (iPhone) and log into the lab's Google account, so we don't want that password to stay in their keychain.
Help is appreciated.
Answer: As of the time of this post, you can use the following:
Swift 5
GIDSignIn.sharedInstance()?.disconnect()

Disconnects the current user from the app and revokes previous
  authentication. If the operation succeeds, the OAuth 2.0 token is also
  removed from keychain.

Google sign out in


I want to redirect the index.php from a Wordpress site to another URL, and all the other URLs in the WP site separatley

Question: So, here is the problem:
I need to have a redirect from website.ro/ to website.com/
Website.ro is on wordpress.
At the same time, all the sub-links like website.ro/title will be redirected individually to website.com/different_title_same_content
If i do this:
Redirect 301 /index.php http://website.com/
Redirect 301 /title http://website.com/different_title_same_content
What happens is that website.ro is on wordpress, that means that all the sublinks are called through index.php (i think, but not sure) and if i do a redirect on index.php than all the other links will be redirected to the homepage and not to their corresponding innerpage.
Its like setting a master rule when i'm redirecting the index.php.
What i would like to do is redirect index.php to a homepage, and any other variation on its corresponding subpage on the new website.
Can it be done?
EDIT: I have added a little of the code that i have to write:
Redirect 301 /Zuzu newsite/portfolio/cases/doc/47860743/
Redirect 301 /Antena1 newsite/portfolio/cases/doc/47860862/
...and so on for allmost 100 urls. (i had to post here without http and www since i am not allowed here more than 2 urls)
The reason i have to do this is that in the past, many of the links on the oldsite appeared in articles, press, blogs and so on, and i do not want to loose traffic that the old links generated on each page.
At the same time, i want to redirect the homepage to the newsite homepage, but if i do this with:
Redirect 301 / newsite/
it will redirect all the other links to the main page of the newsite and not to its corresponding article.
Its the same if i do Redirect 301 /index.php newsite/
since the old website is on wordpress and i think that all the pages are called through index.php(and some variables)
Also, the urls on the newsite.com are not rewritable as to rename them as the old ones so i can create an automated redirect generally valid.
WHAT IS THERE TO DO?
Answer: Look into this it may solve your issue
http://enarion.net/web/htaccess/migrate-domains/
Best of luck!
Comment: No. It doesn't actually, but thanks for trying. What i wanted to say is that the newdomain links cannot be rewritten since they load content from other parties and display them.


Why I cannot see object from certain location? (Glass in Eevee)

Question: If you see in the image below, then that particular glass jar has liquid visible from front but not from the back. I am using eevee.
Options under screen space reflection, refraction all are turned on.
The file link is here. Couldn't add on stack exchange as it exceeds 30mb https://drive.google.com/file/d/1wwzQwqlR2s7uLsIywxNqTIBqOfGMkPOq/view?usp=sharing
Comment: pls provide blend file - else - as TheLabCat tried to do - we can only guess around - so your information you gave us isn't sufficient
Comment: Oh boy, transparency and EEVEE again. Well, let's go through the pre check. Are any materials set to Alpha Blend? Are your normals properly calculated? Do you have any faces in the same position as eachother (causing Z fighting which looks like an animated scratchpad in Solid view)?
Comment: @Jehan Alpha Blend typically has failed with situations like this, where one has multiple faces lined up, some in the same object. Use Alpha Hash instead.
Comment: @TheLabCat I am going to download the file again and see what I get after your and moonboot's solution because after I applied the solution, I can't go back to the state when it disappeared LOL
Comment: Hi. So yes I have set that jar glass and liquid to Alpha Blend. Normals are all good. No faces in same position too. I scaled down the liquid too and checked by rotating around
Comment: @Chris the file is added now..
Comment: Alpha Hashed didn't help though :/
Answer: From what I know, for the moment in Eevee, through an object that has its BSDF Transmission activated (or that uses a Glass node), you can't see another object that has Alpha Blend or Screen Space Refraction activated. So you need to either turn off these options for the liquid, or, for the glass, you can use a mix between glass (your current setup) and Transparent, with an Input > Layer Weight (Facing output) as a factor. It's not perfect but all this is due to Eevee's limitations:

Before:

After:

Edit: As you mention, another solution, in your case, would be to join the objects, as it's not a problem here that the liquid appears in front of the glass:

That said, in some cases, as this last solution makes the liquid appear in front of the glass, it won't work:

See what switching the liquid to opaque, as I recommend, will give (as a side note, the liquid is now opaque but the reflection of the HDRI gives the false impression of transparency):
Comment: @Jehan It's really mysterious. When I tried to reproduce your result with joining and separating the objects I selected the liquid first and then the bottle, hence joining the liquid to the bottle. Now I tried it the other way around, joining the bottle to the liquid. It still works as long as it's one object - but if I now separate them again, it goes back to the way it was before with the liquid disappearing. I would really really like to know what makes the difference.
Comment: oh yes, that's a nice idea! Wow that's weird that it's still working after separation.
Comment: @Jehan What I would have guessed is that when combining objects some settings like modifiers, auto smooth etc. that were different in the separate objects before are now all the same as soon as you merge them, and they stay the same once you separate them again. However I couldn't find those settings that might make the difference. It's not the modifiers or otherwise coyping them should do the trick as well... auto smooth settings was the same on both objects before, the individual materials stay individual after joining, visibility settings were the same before as well... I have no idea.
Comment: Thanks as always man :) This worked. However, I found a very weird solution. I selected all 3 meshes, joined them and then separated them. LOL. it worked!
Comment: Yeah. Dont understand the reason though but it worked :/
Comment: Hey Moonboots thank you for elaborating more :) @GordonBrinkmann did you look at it if the material slots are not copied in all objects??
Comment: @Jehan I did. It works like this in Blender, if you have 10 different objects with 10 different materials, join them into one object it's now one object with 10 materials. If you now separate them by loose parts for example, you have 10 objects again, but now they all have the 10 materials. They are just not assigned to any faces except for their original material.
Comment: Ok!!! Yes you are right. What we select first matters here. I checked on online manual also to see if I am missing anything..I am also clueless as how it worked!
Comment: Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/133529/discussion-between-jehan-and-gordon-brinkmann).


What angles should I be honing to for what type of chisels/planes/uses?

Question: I'm new to honing/sharpening and am a little confused about which angles I should be trying to hone my chisels/plane blades to (given the type and their usage). Any general rules of thumb that I can start with and progress towards?
Answer: As long as a bevel-down plane iron's sharpening angle is more acute than the bedding angle, that face of the iron doesn't see any action, so it doesn't really matter. It's normal to sharpen a plane iron to around 25°.
Chisels will vary depending on their purpose: for mortising, you want a stouter, wider angle; for paring, a finer, narrower angle. Start with 12° and see what you like.


How to set an drag and drop element in my case

Question: I want to drag an element in my app and would like to create a restricted area so the element can only be dragged within a certain area.
I have something like this.
http://jsfiddle.net/L73T5/10/
html

css
#background{
    background: url('http://www.iiacanadanationalconference.com/wp-content/uploads/2013/01/test.jpg') no-repeat center center fixed;
    width: 100%;
    height: 100%;
    position:fixed;
    -webkit-background-size: contain;
    -moz-background-size: contain;
    -o-background-size: contain;
    background-size: contain;
    z-index: -1;
}

#wrapper{
    width: 80%;
    height: 80%;
}

#viewer{
    cursor: pointer;
}

js
$( "#viewer" ).draggable({containment: "#wrapper", opacity: 0.65 });

I want to restrain the highlights image being dragged inside the test image area (can't drag it to the white background) and I need it to be responsive.
Is this possible? Thanks a lot!
Answer: Here is one solution that may work for you.
Fiddle Demo
You need to give your #wrapper a height and then position the #background down an equal amount. That should keep the two from overlapping. Also I found removing the fixed off the background style let it re-size correctly.
CSS:
#background{
   // existing styles

   background: url('http://...') no-repeat top center;
   top: 50px;
}

#wrapper{
 width: 100%;
 height: 45px;
}


What is the best way to switch between different ranges when designing a multimeter using microcontroller?

Question: We are developing a multimeter using a PIC18 microcontroller and we are searching for the best method to switch between different ranges in multimeter with the smallest possible amount of switching delay.
Comment: Are you using a manual switch to select ranges or is this done automatically i.e. is it intended to be an auto-ranging multimeter? What sort of accuracy are you looking for?
Answer: You don't give a number for the maximum delay you require, or much description of the design, but I'm assuming it's to be an autoranging/switching type of meter.
There are plenty of cheap analogue multplexers available, the best known being the 74xx4051, 4052 and 4053 series.
These are dual polarity 8:1 (4051), 2 x 4:1 (4052), and 4 x 2:1 (4053) muxes, available for under 50 cents and made by various manufacturers (e.g. TI, AD, Maxim, etc) I would have a look at these and similar offerings. Here is an example 4051 part from Farnell (many more here). Also see analogue switches.
For slower switching only one or two ways, but better isolation and lower resistance there are mechanical relays (or solid state relays, such as the PhotoMOS type from Clare) These can be used where appropriate, together with IC switches, e.g. to isolate one channel from the next when active.
Answer: For a lot of applications nowadays, you can use a single high resolution delta-sigma A/D and not bother with ranging at all.  The tradeoff to get the high resolution is long conversion times, but in a multimeter time is measured on a human scale so a few 10s of ms is still instantaneous.
Another trick is to present the input signal with different gains to the different A/D inputs of the micro.  The micro then uses the one with the highest reading that isn't saturated.  Usually you do a little blending with the next lower reading down so that there isn't a sudden jump when different ranges are used.  It also helps to do some calibration during manufacturing to store offsets and gains separately for each of the A/D inputs.
Comment: "to the different A/D inputs of the micro"  This is usually just a multiplexer to a single ADC anyway.  Might as well use the internal one instead of building one externally.


Being considered volunteer for answering questions?

Question: My company gives us $10 per hour for working for any nonprofit organization and I can use that money to donate to whichever charity I want from Benevity. The requirement is someone from the nonprofit needs to tell them (when asked) how much time I spent working for the nonprofit organization. I know SO is not a nonprofit. Is there any possibility/program for us to reply to questions here and get that reported as volunteer work? Are there any organizations that SO partners with? I think my best use of time would be to use my skills first to help people rather than another type of help.
Comment: Stack Overflow is a for profit company!
Comment: I don't understand why the question is poorly received. Notwithstanding that the for-profit nature of the site won't meet OP's apparent requirements, it seems perfectly reasonable to ask whether and how it is possible to get certification of having spent time improving Stack Overflow; and doing so clearly is volunteer work.
Comment: Related/similar request over on MSE [Community service hours on SE](https://meta.stackexchange.com/q/378054/1099857) (perhaps this is the one @cocomac was referring to)
Comment: Very, VERY, for profit. One of the regulars around here has a dig about just how profitable in their name.
Comment: @greg-449
   I know Stack Overflow is for profit -- but authors are not paid and help other people. Anyways that is a different discussion. do you have any other nonprofit places where software engineers can help?
Comment: It is conceivable that you could volunteer for a registered non-profit software developer answering Stack Overflow questions related to their software.  However, you'd need to coordinate that with the non-profit rather than Stack Overflow itself (as Stack Overflow/Stack Exchange is a for-profit company).  I'm not aware of any non-profit currently doing this.
Comment: @KarlKnechtel the fact SO is *not* non-profit company is well known and absolutely public. mcvkr could have easily clarified that they know that in the question. Without that question seem to be based on an obviously false premise - whether such questions deserve downvotes is everyone's personal call, but I can see why some would downvote (apparently, I did not.... which is surprising for me :) )
Comment: Please feel free to help anyway, though.
Comment: Maybe https://www.fsf.org/
Comment: I don't have a link right now, but someone asked something similar (SE verifying someone spent X amount of time helping for the purpose of volunteer hours) over on MSE. This was a bunch of months ago, and it may have been severed (not sure), but it may be helpful if you can find it
Comment: @HenryEcker Yep, that is what I was thinking of
Comment: Okay updated the question. I am surprised that most people assumed I did not know SO is a for-profit organization when I asked the question. Some companies partner with nonprofits for things like helping job search, learning programming, or feeding people. I was curious if SO has anything similar to that in an event or something we could do it.
Answer: To answer the direct question:  Stack Overflow is a for-profit company.  The work done around here is largely facilitated by volunteers, but the company itself does intend to pull a profit.  You need to clarify with your employer if that is enough of a distinction.


Expired vs. All Sales Final

Question: Supposing a man buys a box of food at a clearance event where signs are posted that say "All Sales Final." When he gets home, he discovers that it is a week past its expiration date. Is he just out of luck?
Comment: In the US, under the Uniform Commercial Code, there is an implied warranty of merchantability and fitness for purpose.  In this case it would presumably mean the manufacturer implicitly guarantees the food is fit for human consumption, so we'd have to consider whether that is the case.  Also, it is possible for the seller to disclaim this warranty; the question would be whether the "All Sales Final" sign effectively does so.
Comment: What jurisdiction?  Also, is this actually an expiration date (such that the local law considers the food unfit for human consumption after that date), or just a "best before" date (meaning that the manufacturer considers the food may not be of optimal quality, but the law still considers it edible)?
Answer: Best-before dates are optional consumer advice and are not legally enforceable or required, at the federal level. An exception is infant formula, where a date is required by law. There do not appear to be any states that require food to be removed at or after any of the various "pull" dates, but there is some variation in whether items have to have a date on them (NJ requires that fluid milk products and bottled water yes that is right bottled water have an expiration date). It is still legal to sell expired water. California law does restrict post-date sales on OTC drugs and baby food, but not generally. California's legal return policy Civil Code sect 1723 which requires stores to take back goods also restricts returns of food and "all sales final" goods:

This section does not apply to food, plants, flowers, perishable
  goods, goods marked "as is," "no returns accepted," "all sales final,"
  or with similar language, goods used or damaged after purchase,
  customized goods received as ordered, goods not returned with their
  original package, and goods which cannot be resold due to health
  considerations.

Expired vs. All Sales Final


Error 5 (Access Denied) copying files - Script that once worked stopped mysteriously

Question: I am baffled.
I've been running a robocopy script on my Windows XP box for several years without trouble. Recently, it has been failing occasionally with error 5 - access denied.
My script is a batch file with several instances of robocopy pointing at various folders. Here's an example of the one line that I know is failing (I think it's the only one, but it's first on the list so I'm not 100% sure) - all are identical except for the paths
robocopy "P:\Program Files" "z:\robobackup\Program Drive\Program Files" /purge /e /it /ts /fp /tee /w:1 /log:Z:\robolog_ProgramFiles.txt

(I install all my programs to the P drive instead of Windows default. I'd suspect a problem due to that, except that one of the files that fails is my own backup script, so I know it wasn't installed or have any weird permissions.)
I recently installed a new backup drive, but nothing else has changed. Here's what I did:

Installed new drive, formatted it in XP's admin tool. Set drive letter to my old backup drive's letter (Z)
Ran my script. It ran for over a day with no trouble at all, but I got tired of waiting for robocopy. Interrupted backup.
I cloned my old backup drive to the new drive with SeaTools for DOS.

At this point, everything still seemed to work OK. Robocopy found all the same files on the old path and only copied changed files as it's always done. I was happy.
Here's the command I'm using:
robocopy "P:\Program Files" "z:\robobackup\Program Drive\Program Files" /purge /e /it /ts /fp /tee /w:1 /log:Z:\robolog_ProgramFiles.txt

THEN...
I decided to add a line to the batch file to copy my network shared data folder (old win2K box) to my new backup drive.
I added the following as the first line to my script:
robocopy "\\calypso\shared folder" "z:\robobackup\calypso" /purge /e /it /ts /fp /tee /w:1 /log:Z:\robolog_Calypso.txt

This simply failed. I don't remember the error, but since I had never used robocopy to copy from a network, I figured I got the syntax wrong. I then mapped the folder to Y and tried again:
robocopy "Y:\shared folder" "z:\robobackup\calypso" /purge /e /it /ts /fp /tee /w:1 /log:Z:\robolog_Calypso.txt

I ran my script again and it copied the Y folder perfectly, but when it tried the P drive it started giving me the access denied errors. Now it will give errors seemingly at random, except that once a file errors out it will error out on that file every time**. As a test I changed the backup path ("Program Drive2" instead of "Program Drive") and even the drive to back up to to eliminate trouble with the new drive as a possibility. **When I changed the backup path the file that may have failed before no longer failed, but then it would fail on a different file.
If I remove the reference to the P drive it seems to work OK, but I can't be sure because I haven't edited any files on my data drives since starting this process.
I've read through every Robocopy Error 5 post I could find on Google and non have helped. I'm running it under an administrator-level account (same account as always) and I am the owner of all the files (it's possible that some of the files on the old Y2K network folder are owned by someone else with a Win7 box.)
Anybody have any brilliant ideas? I've been going crazy with this for three days.
Thanks!
* Updated Info *
I downloaded a program called "Fastcopy" to see if that would work - it did not. So this is not limited to robocopy. I was able to copy the folder with XCOPY without any troubles.
All I can think of is that accessing that network drive changed some permission setting somehow, either of my admin user or of some of the files. I tried claiming the P:\Program Files folder (even through it already said I was the owner) - still having the problem.
Answer: You can use the /B (backup) switch to copy also those files that give access denied.


Is Lightspeed Flash faster than light?

Question: I'm wondering if Lightspeed Flash has the power to travel at the speed of light, or is faster than it, or is it just some kind of hero name?
Answer: Flashy Flash hasn't shown any of his abilities or powers in the manga or at the tv show. But in the webcomic series of ONE (the original manga), which it has a lot more chapters, we know some of his abilities and his powers.
SPOILERS
So according to the webcomic:

 One of his moves, was to fly to the enemy within milliseconds and attack him from any distance. Flashy Fist (閃光挙, Senkōken): In only a matter of milliseconds, Flash traverses the distance between himself and the opponent and unleashes a barrage of punches.

So you have to wait until to the point where the manga, will show more about this character.
Answer: In short, it's just a hero name which is flashier than reality.  Pun intended.  Some more recent translations have switched to using "Flashy Flash" instead of "Lightspeed Flash" specifically in order to avoid the light speed comparisons, and to better reflect the silliness in his Japanese name (Flashy Flash is a fairly literal translation).
In a couple pages of the webcomic we're actually given a timer on one of his actions, which allows some rough estimates of travel and attack speeds.  This forum post (which is itself a summary of a post somewhere else but which I don't have a link for) contains the calculations on said pages, and estimates both his movement and attack speeds (arm speed during a punch) at around 2.3% of the speed of light, which isn't even fast enough to warrant relativistic corrections.  It's hard to say what the error margin is on those, for a variety of reasons, though it should be well within an order of magnitude—20% of the speed of light would warrant the use of special relativity, at least.  However, the calculations also assume that ONE's depiction of the scene is reasonably close to scale (and his drawing skills make that questionable), and that he actually drew it to that scale after deciding how fast he really wanted Flashy Flash, aka Lightspeed Flash, to go.  The scene in question also occurs during a very serious sequence where Flash knows that many of the best combatants in S class have been defeated, so it is reasonable to assume this is near or at his maximum speed.
There hasn't been an official description of how fast he truly is, so this is the best we've currently got on his capabilities.
Here are the webcomic pages in question:

Is Lightspeed Flash faster than light?


$B(t)$ is brownian motion. I want Find $d(M(t))^2$,where $M(t)=e^{B(t)-\frac{t}{2}}$,

Question: let $B(t)$ is brownian motion.
Find $d(M(t))^2$,where $M(t)=e^{B(t)-\frac{t}{2}}$,
Comment: @peter, this is likely a homework question, can you show us what you have done? You'll need Ito's Lemma for this (hints: $\mu_t = 0$ and $\sigma_t=1$ since the underlying process is Brownian motion). Can you compute $d(M(t))$? What happens when you square that term?
Comment: @Stat, you cannot take the derivative of a functional of Brownian Motion, not without care at least.
Comment: OP: Why not mentioning the accepted full answer here http://math.stackexchange.com/q/613823/?
Answer: The accepted answer at Math.se is wrong. The question is asking for $dM(t)^2 = dM(t)dM(t)$, the (differential of) quadratic variation of $M(t)$, whereas the answer at Math.se explains how to calculate $d(M(t)^2)$. To find $dM(t)dM(t)$, first you find $dM(t)$ using Ito's formula:
$$dM(t) = \left(\frac{\partial f}{\partial x} + \frac{1}{2} \frac{\partial^2 f}{\partial y^2}\right)\rvert_{t, B(t)} dt + \frac{\partial f}{\partial y}\rvert_{t, B(t)} dB(t)$$
where $f(x,y) = e^{y-x/2}$. This gives $dM(t) = M(t) dB(t)$. Now use the "box calculus" formula for the quadratic variation of an Ito process: if
$$dX(t) = \mu(t) dt + \sigma(t) dB(t)$$
then
$$dX(t)dX(t) = \sigma(t)^2 dt$$
to get the answer. For more details and derivations of these formulas, see these Columbia notes or these UPenn notes.


Why aluminum is added in Multi Layer Insulation?

Question: Aluminum is a highly conductive material. Instead of insulating the system from heat, it conducts. Multi-Layer Insulation aims to protect spacecraft from extreme heat by acting as a thermal barrier. Gold plating is used to reflect solar radiation but what about aluminum? Isn't using aluminum coated on MLI decreases the thermal insulating property?
Comment: Aluminum is a better reflector for solar radiation than gold. That is why we see aluminum like silver or white and gold like yellow.
Comment: Gold is a better thermal conductor than aluminum, 314 to 236 W/(m K). But such ultra thin coatings of a metal on a plastic film do not conduct very good anyway.
Answer:
Gold is used to reflect solar radiation but what about aluminum?

Some multilayer insulation (MLI) definitely has a gold-like color, but no gold is used in MLI. The gold-like color color is a result of the combination of the plastic-like material used to separate rather thin sheets of aluminum foil. Gold would be an extremely lousy choice due to its high density and high cost. Despite the gold-like color of many satellites covered with MLI, there is no gold in that MLE>

Aluminum is a highly conductive material. Instead of insulating the system from heat, it conducts.

Conducts heat where? Not to space; there is essentially no conduction to space. The only means of transferring heat from a spacecraft to space is radiation, and the only means of transferring heat from sunlight to a spacecraft is also radiation.
The mathematics that underlie multilayer insulation say that it's best if the layers have low emissivity. Reflectivity, emissivity, and transmissivity are positive numbers between zero and one, and sum to one.  This means that a good reflector is a lousy emitter, and vice versa. This in turn means that multilayer insulation that uses a highly reflective material will do an even better job of thermally insulating a spacecraft that would a multilayer insulation that uses a pitch black material.
Comment: @Uwe There is no gold in a multilayer insulation.
Comment: I don't know why aluminum specifically, but I also don't know why not. Aluminum is an established technology, cheap, low melting point, stays shiny, used on mirrors, thermoses, aluminized mylar for cryogenic insulation and for balloons, aluminized Doritos bags... It's the standard reflective coating, it's what any engineer is going to use unless there's a reason to use something else.
Comment: I mean conduction occurs if the outer frame of the satellite touches the Multi layer insulation.
Comment: @Auberron The outer frame of a satellite touches a mesh insulative layer rather than an aluminum coated mylar layer. But even if it did touch a metallic layer, so what?
Comment: @Auberron The ultra thin metal coating is a bad thermal conductor
Comment: @Greg Aluminum is a rather low density metal. A few low atomic mass alkali metals and alkali earth metals are less dense than aluminum, but those elements have very undesirable chemical behaviors.
Answer: Just to join the last comments together on David Hammen's already good answer, this was gong to be a comment but became too long.

It is worth clarifying for the uninitiated that MLI comprises layers of Kapton (thermal insulator, yellow colour) each with a vacuum deposited aluminium (VDA) layer on one or both sides of each layer, and then a spacer (something resmbling like old fashioned net curtains or a sparse tissue) to separate the Kapton layers.

There is no through path comprising alumimium and so the VDA layer can only conduct laterally through the blanket and even that will be insignificant because the VDA is microscopically thin.

The final outer layer kapton is usually either left natural, without VDA, which gives the "yellow mirror ~ looks like gold" appearance or it is "carbon loaded" meaning that it is black in colour. The choices between these seem to be down to the practices of different manufacturers, the natural finish has a lower sunlight heat load than black but is (or used to be at least) not so good at aging under UV and was less stable over 10 - 15 years.


Multiplayer Minecraft on Xbox 360

Question: So I am trying to play multiplayer split screen offline (local play). I have the TV set up with the HDMI cable and everything, and my TV is 1080 and up, so everything resolution wise is supported. Then i open a world and start. But when I go to press start on the other controller, the normal "Press Start" thing doesnt come up, instead nothing comes up. Help?
Answer: Is your second controller synced to your Xbox 360? If this controller is not synced the console will not take inputs from it and the "Start" button cannot be used to load a second player into the game.
Refer to this guide on how to Sync your Xbox 360 controller
Alternatively, you may have reached the maximum amount of players on your Minecraft world. On Xbox 360 there is an 8 player limit on a Minecraft multiplayer world. If you attempt to exceed this by adding a 9th player via split-screen you may be prevented from having them join.
If that doesn't work try restarting your game or console.
Answer:
Make sure all controllers are on and logged in.
If this is not the problem, try pressing start a few times anyway, it doesn't always show up.

Multiplayer Minecraft on Xbox 360


Manipulate Filters in Javascript

Question: Is there any code in JavaScript which allow to manipulate filter to a library webpart?
Answer: There is no documented API that would help to filter ListViewWebPart using JavaScript. The best way to achieve this would be to use query string parameter filtering, like described here http://www.sharemuch.com/2013/11/18/sharepoint-silly-questions-filtering-list-view-with-query-string-parameters/
You could redirect from JavaScript with window.navigate() to a page with appropriate query string parameters.

Manipulate Filters in Javascript


When I Plug In the HDMI Cable From My TV To Watch Content From My Laptop To The TV I get Two Different Screens

Question: OK guys heres the dilemma. I want to watch NCIS from my laptop on my big screen tv but when I plug the HDMI cable from the TV to the laptop, the screen thats on my laptop is different from the one that is displayed on the TV. Its the same wallpaper but without anything thats on the desktop and I don't know how to switch them or put on the right screen.
Answer: That's a feature, not a bug. Some people use more than one monitor. You should be able to drag a window from your laptop to your TV just like you drag a window from place to place on one screen. Alternatively, you could set the TV to mirror the laptop, but you'd then get the lowest resolution of the two on both. You could also turn off the laptop monitor and have the TV be the only active monitor.
Go to "system settings" via the Dash menu and select "Monitors". You can plat with the settings until you find what you want for your particular viewing needs.


Algorithm and Design for developing a exact text system

Question: We have millions of documents consisting of many paragraphs. The requirement is to develop a exact search system on top of this corpus. The search string will typically start from the beginning of a paragraph and may extend to two or more paragraphs.
What data structure and algorithm will be used to store persist the data in this system
It is to be noted that the pace of addition of documents in much slower as compared to the pace of search query across the pages.
Answer: If you manually Parse Millions of Records by yourself it will be a tedious and time consuming task.
You can Use APACHE Lucene Engine to parse the document for you.
If you dont know about Lucene, it is a full-featured text search engine library that enables  full-text search, especially cross-platform.
Check out : http://lucene.apache.org


Tenants right with a no waiver lease agreement

Question: I signed a lease to rent the lower level of a home which has an upstairs unit as well. My lease lists me as the only tenant on my lease, for my unit. It states tenant agrees to be responsible and pay for the cost of electricity, gas, yard maintenance, snow removal and snow walks. I had to put utilities in my name. I've paid in full for years, but questioned a few months after moving in why my electric and gas run at least $200 a month each. Apparently I pay and provide the utilities for the other unit. That's not what my lease states. Also, it states that no subleasing, sharing of premises, or assignment of the lease agreement is permitted. Tenant shall not sell or give accommodations in the premises to any boarders, lodgers, or roomers. The upstairs unit is leased to a middle aged single woman. Her utilities are "included in her rent", in truth I pay for her utilities and I get no type of reimbursement from the landlord for her "included utilities". In October of 2021, she left and didn't return until after the first of the year. The end of October to the beginning of November, I noticed that her adult son, his girlfriend, and their child were always there. I noticed in increase in my already high utilities. There is only one mailbox for both units, so we all see each other's mail as we have to shuffle through the one box. By the end of November (2021), there was mail for both the son and girlfriend regarding their recent change of address, unemployment to them both addressed to the address, Friend of the Court correspondence, and so forth. When the tenant on the lease returned, she stayed a couple of weeks, and the son and girlfriend and child have never left. This is their residence. I advised the landlord in November of what was going on, so they sent a notice to all occupants demanding possession of the property. March 24 of this year, I received a voicemail from the landlord stating the owner of the property management company had passed away. Her daughter has ran the business with her mom for many years, and when her mom became ill a few years ago, she has ran it on her own. The voicemail stated they're not going to go through with the demand of property because she didn't feel like dealing with anything. I called and expressed my concern regarding the extra tenants and the fact that them not going through with it affects me and me only, because I am responsible for their utilities. They told me to get over it and to basically accept the increase due to 3 additional people who have moved in against the leases terms. There is a no waiver section in the lease. If I'm understanding it right, do I not have any rights at all?  In addition, I get rental assistance from the housing voucher program, and I just came across a request for tenancy that must be filled out, including a blank copy of the lease for approval by the housing commission prior to being able to actually sign the lease, and an inspection of the rental unit before any lease can be approved. In a section titled "Some of the items that we look for at the inspection are"….the 2nd item listed states that all utilities must be turned on. If the unit is not a single family unit, there must be separate meters for utility services (gas, electric, water, etc.) for each unit. As I mentioned earlier, there is only one utility meter for 2 units. The housing commission approved the lease, and I now wonder if the fact that both units use the same house number and street in the address, which explains why there has always been only one mailbox for both units. There is nothing in the lease stating the units address ends with unit A or B, nor up or down. In a search of the property on the county's website I inquired the property address. It lists the house as a single family home, when it's a house that was made into 2 units. The upstairs uses the gate on the side of the garage leading to the backyard to gain access to the stairs leading to the unit. There is no indication by looking at the front of the house that there's an upper apartment. I had contacted the post office regarding the house only having one mailbox as I've been missing some important, time sensitive mail. They advised me that there was nothing I could do because the house is registered as single family and the units aren't specified through the county. How might this affect the fact that I am legally responsible for the utilities as that is what my lease states? Could I possibly be reimbursed for her portion of the utilities based on square footage of my unit vs hers, amount of people, and by taking such things into consideration as the fact that she leaves a crank type window open all winter long? Or that she uses a window air conditioner?
Comment: Can you break down that wall of text in to paragraphs please.
Comment: In addition to Rick's suggestion, make sure your post reflects which paragraphs are excerpts of the lease and which ones are not.
Answer: As far as I can figure out, your question is whether you are required to pay the utilities for the whole house, when you have no control over utility usage in half of the house. The answer comes from two sources: local law, and the lease. Your state or country may have laws that directly address rights and responsibilities for shared utilities. The law usually allows landlord and tenant to work out a suitable arrangement, appropriate to the physical realities of the residence, but it is commonly required that the landlord give an accounting to tenant for utility charges paid by the landlord. You'd have to look up the law of your jurisdiction. Since you mention "housing voucher", this could include separate legal provisions for landlords receiving such vouchers, if this is a government-run program.
The other source of obligations is the lease: if you're required under the lease to pay the entire amount of the utilities, then you have to pay all of the utilities even if you don't like the outcome, because that is what you agreed to. This can interact with the previous "what does the law say?" consideration, because the lease might be "all of the stuff that you agreed to", paper of not, or it might be limited to that which is written on the signed lease agreement.
Typically, a utility company gives a bill to a specific account-holder, who then has to pay that bill. The account-holder could be the landlord, or one or more tenants. If there is only one electric meter or water meter for the entire house, there will be one account-holder (if there are two meters, one for upstairs and one for downstairs) there can be two account holders. If you don't have two meters, then either the landlord has to guestimate utility charges and distribute the charges accordingly – as specified in the lease – or the landlord offloads the problem to one of the tenants, you.
You'd be best off consulting with an attorney to see if you have any legal recourse.


Is this grammatically correct? I am not sure of the sentence structure. "She saw two boys in white dresses standing by the road?"

Question: I am kinda confused of the participial phrase in that sentence. Is that grammatically correct? Do I need to put a comma? Does the sentence make sense?
Comment: It implies that "she", while in some unspecified location, observed two boys, and these boys were standing adjacent to the road. The boys were (oddly) wearing white dresses.  If this is what you intended then sentence is grammatical and makes sense.
Comment: @HotLicks I agree that the "boys in white dresses" phrase is odd, not linguistically but culturally. I wonder if Edward means "boys in white robes". If it was a Friday and the boys were Muslims then this would not be odd at all.
Answer: The sentence is correct and grammatical.
It is also ambiguous, because it is unclear whether the structure "standing by the road" is qualifying "she" or "the boys" (although its position suggests the latter).
But there is nothing wrong about the sentence's grammar per se.
Comment: It may be _technically_ ambiguous, but few native speakers would understand the phrase as referring to _her)_.


how to change "username" text located in registration form

Question: how i can change "username" text, located in registration form.. i need to change it to "Organization Name" and everywhere of my website "username" text should replace with "Organization Name". How to do it?
Thanks
Answer: The way to modify the user registration form is to add a hook_form_alter() function to your theme to change the form variables and add a theme hook to use a custom use-register.tpl.php file. There are numerous tutorials and responses here on stackexchange (for example) that can guide you on this process, but if all you're trying to change is one string, you should try the string overrides module, which allows you to easily replace anything passed through the t() function (ex. "username" --> "organization").


Can we Uninstall Java on Production Server?

Question: A vulnerability scan on a web server told me that my version of Java needs to be updated.  We run .NET web applications on this server, and to my knowledge there is nothing that uses Java.  How can I determine if I can safely uninstall Java?  I don't want to just uninstall it and then have something break.  Is there an easy way to check if anything is dependent on it?
Answer: One solution, would be to update Java to remove the vulnerability.  Next, write a small application that wraps the java executable (ie: rename java.exe to java-real.exe and make an app called java.exe that just passes all the arguments to java.exe and logs the calls to a file.  After a month (or however long until you feel comfortable), if the log's empty, uninstall Java.
Comment: You gotta be really careful just upgrading versions. Alot of java apps are really sensitive to what version is installed. So upgrading can break things just as badly as removing java.
Comment: Mighty fine point sir.
Comment: @Zypher Exactly, thank you.  I guess when I said "an easy way" I really meant "a non-malicious way".
Comment: I ended up just updating.
Answer: You could use Systernal's Process Monitor.
It will by default list all registry, file, process, etc activity on the system.
You could set a filter for Java, leave it running for however long you wish and see what kind of activity you get.
Such as add a filter for "When Path contains Java then Include".
You may also want "When Result is SUCCESS then Include" so that you don't get a bunch of attempts at things that aren't there.  For example, if java is being called from within the PATH variable, before it finds java where it actually is, there will be attempts for it at C:\Windows, C:\Windows\System32, etc.
Comment: I gave two separate answers as the other is specific to Java and this one could be used for checking access to any application on windows.
Answer: On such occasions I often try these:
<code>find /some/path/ -type f -atime -50    # has any file been accessed (read) in last 50 days?
find /some/path/ -type f -ctime -50    # has any file had attributes changed in last 50 days?
find /some/path/ -type f -mtime -50    # has any file had been modified in last 50 days?
</code>
EDIT: missed the Windows 2003 tag... You can still use these commands on cygwin. Or run File Explorer -> F3 -> search all -> sort them by access time -> check manually -> sort them by modify time -> check manually). If the file was not accessed/modified, it probably means it is not required by anything.
Of course you can test uninstall to see if the removal of package requires removing something else, but it's a trivial case. (EDIT W2k3... not-so-trivial)
Comment: It's a Windows server...
Answer: What kind of Java is installed?
Is it just the plain Java Runtime Environment or some server-side thing like Tomcat/JBoss/AnotherApplicationServer?
Chances are it simply go tinstalled when someone was browsing a website; but it could also be actually used by something else; but there's no easy way to tell.
Answer: Java has some internal tracing/logging options you could turn on and monitor the log to see what kind of activity occurs.
See Tracing and Logging on Sun's site.
Comment: I gave two separate answers as this one is specific to Java and the other could be used for checking access to any application on windows.


Wordpress: redirecting to my old public ip

Question: I started to develop my own wordpress site, that I hosted locally. I am using Apache for hosting and mariaDB for DB. I accessed the site through my public ip, that in my case was was xxx.xxx.1.163. I could also access my site thorugh 127.0.0.1. I set the wordpress site up and everything worked fine.
PROBLEM
Until I moved from one place to another with my computer. Now I can not access my site anymore. I have been struggling with the problem for 2 days now. Now my public ip is xxx.xxx.1.110. Problems that occur, when I try to access site:
Accsessing through browser

When i try to access through 127.0.0.1, then it automatically redirects me to xxx.xxx.1.163, although I have erased all the Firefox
cache, history and cookies.

When i try to access through xxx.xxx.1.110, then it also redirects me to xxx.xxx.1.163

I have tried the same in Chrome also. Results are the same.
What I have tried and outlined:
Apache working fine -
When I have only apache's index.html file in /var/www/html directory, then I am able to access the default Apache page through 127.0.0.1 and through my current public ip xxx.xxx.1.110. Like this everything seems fine.
Original wordpress - When I move original wordpress files to /var/www/html directory, then then from 127.0.0.1 and xxx.xxx.1.110 the wordpress first setup page appears. Like this everything seems also to be fine.
When I try to set up the wordpress, with the same database connection that i had the last one, then it thorws error and says "Wordpress already installed". And now, when I try to connect to 127.0.0.1 or xxx.xxx.1.110 then it automatically redirects me to my old public ip xxx.xxx.1.163
When I move my own wordpress project(the project that I had before and was working) to the /var/www/html folder, then the same thing happens. I keep getting redirected to xxx.xxx.1.163
MY IDEA OF SOLUTION
My idea is that i would probably have to make some changes in my wordpress database and maybe in my wordpress conf files. But I have no idea where I should change and what I should change. I have looked it up also but I have found very different answers.
If somebody could tell me, if I am moving in correct direction or what exactly should I change, then I would be very thankful.
Comment: Start by taking a read through the relevant sections of [Moving WordPress](https://wordpress.org/support/article/moving-wordpress/) and [Changing the Site URL](https://wordpress.org/support/article/changing-the-site-url/). If you're still having issues after deploying the procedures listed there, file an [edit](https://wordpress.stackexchange.com/posts/406331/edit) to update your question with what you've done.
Answer: UPDATE
Found and Fixed the problem. The thing was that yes all the sources in wordpress database pointed to old public ip xxx.xxx.1.163. Which had to be changed.
The things that had to be changed was:

In wp_options

Change siteurl

Change home url

In wp_posts

replace all the old public ip with new public ip

For me as newbie the easiest way to do this was using GUI, for example phpmyAdmin
Comment: This helped me a lot. Thanks.


One chat for 2 number

Question: I've got a Wiko Iggy on 4.2.2 Android and try unsuccessfully to bind both numbers of a workmate on one sms chat.. what should I do?
Answer: As far as I know there are no chat/SMS applications which will support two numbers of the same user/contact at the same time.
If there are two numbers, there will be two threads/conversations.
Answer: Contacts+ will do that for you.
It will also let you have one fixed primary "to send" number.

It's great if you only want to send to one of his numbers and he only wants to send from the other. Your workmate texts you from number X and you just have to write and send and the sms will be sent to number Y automatically.

One chat for 2 number


Is there a second play through in Majora's Mask 3DS like there was in Ocarina of Time 3DS?

Question: In the OoT remake you could play the master quest version after the first play through. Is there anything similar to this in the recent Majora's Mask remake? Basically the reason I am asking is because this kind of incentivizes you to wait to do a lot of the completionist type stuff until the second play through. If there is no post game then I will just do all the completionist stuff on this first play through. Is there any reason to wait?
Comment: I don't think so, but I also haven't completed the game to find out.  Bear in mind that the "second quest" stuff in Ocarina in Time 3DS was the GC Master Quest dungeons, which were originally produced for the Zelda N64DD (Disk Drive) game that got scrapped... its other assets ended up being used in Majora's Mask.
Answer: No, they haven't included any sort of harder mode in Majora's Mask 3D.
Ocarina of Time Master Quest already existed prior to the 3DS remake, so they choose to include it as a bonus. Majora's Mask 3DS includes a slew of changes to the main game, but sadly no "hard mode" of any kind.
Comment: I think though that adding a simple "Hero mode" where you take double damage would have been easy. Pity they didn't.
Answer: No, sadly, I have 100% Majora's Mask 3d, with all the bomber note quests, heart pieces, and all 24 masks, and I had not gotten any acknowledgement of getting a master quest option, because I started a file for a 3-Heart run.
Comment: Thanks. I can also attest to not unlocking it after beating the game but if you have 100%ed it then that should be definitive.