What are the security implications of storing password blacklist?

Question: I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this blacklist in the database?
Comment: I'm the author of the similar question linked to above--which was marked [duplicate] and didn't receive much attention. Then this question comes along and gets crazy upvoted. I will never understand how these SE sites work.
Comment: I think security implication is out of context for your question more relevant question would be what benefit we can get and how to maintain such a list. Your can also review previous post on same topic http://security.stackexchange.com/questions/39051/would-a-massive-blacklist-of-guessable-passwords-be-useful
Comment: See also: [Banning specific passwords?](http://security.stackexchange.com/q/30122/12139)
Answer: In that order of magnitude (1000 passwords), I don't see any down sides from a security point of view. If anything, I'd say it's a good idea. Granted, you'll be shrinking the pool of possible passwords which, theoretically, decreases the security. In practice, however, those most commonly used passwords will be one of the first wordlists an attacker would try.
In fact, I've seen a few web services disclosing this in their registration forms. Some even block whole dictionaries in addition to common passwords.
Comment: I wouldn't be surprised if people choosing `xyz` for a password just change it to `xyz1` after getting a message that their password is blacklisted. Now as an attacker you could try some simple variations of words in the blacklist first, before brute-forcing.
Comment: I agree with @Aerus, you should consider making a powerful statement to users at the point of refusing their password on the grounds you detected it was too weak, to ensure they don't simply append a single character to get around the blacklist. User education is paramount. Also, consider preventing enumeration of the blacklisted passwords.
Comment: @Aerus, what about using a Levenshtein compare to also prevent xyz1?
Answer: Not only is this not a bad idea, it's actually quite advisable. In fact, there's a whole library already included on most Linux/Unix systems called cracklib which helps you prevent users from picking horrible passwords.
There are bindings for this library in most languages, which makes checking for bad passwords pretty trivial. You just say "cracklib, is this password bad" and it will say something like: "this password is based on a reversed dictionary word".
Answer: From a security perspective, there should be no negative implications. The only thing I can think of will be the attacker knowing not to try those 1000 passwords if he manages to get hold of that list but that's really doesn't count.
Comment: 60^8-1000 isn't that bad really...
Comment: That's what I was thinking. Just sharing it with the community before implementing.
Comment: Even 60^8- ...
Answer: I can see one problem in this situation, it will make brute force easier for the attacker. They will have fewer passwords to try in order to break into the account. I think you should not limit password choice to users at all.
Comment: Removing 1000 passwords from the potential passwords to try will have a negligible impact on the attacker's workload. The point here is to prevent people picking `123456`, `password`, `guest`, etc.. think of it as those pesky password rules, but more controlled and sane.
Answer: If you make the blacklist public and it has your boss's favorite password CarlosDanger77 in it; chances are you are getting canned when his Twitter account gets hacked with it.


Numeric keypad keys in vi insert letters instead of numbers

Question: I'm new to vi. Actually I'm using it just to modify small text files. I've a serious and unusual, I think, problem with the numeric keypad, as follow:
I write vi IN and press enter. This make me access to the file named IN. Then I use arrow keys (or hjkl) to move the cursor through the file. Then I press i to activate the insert mode and write. Here comes the problem: numeric keypad doesn't work properly, since I get pqrstuvwxyl when I press 0123456789+ (,.-*/= still work).
Comment: Why was my question migrated here? The problem was not about the Mac but about Vi. In fact, as I said, the numeric keypad was not working just **in Vi**. On the contrary it has always worked in the terminal or in other applications.
Answer: I solved the problem on my own, but I'd like to know WHY my solution works.
I deselected the option the red arrow indicates in the following picture

This is italian, but the english version of the same window is here
But I don't recall enabling this but there it is.
Comment: The reference is that I always used numeric keypad to insert numbers in Vi. Anyway, maybe the the option could have been activated by the upgrade from Yosemite to El Capitan (still I'm sure I used the numeric keypad to insert the numbers _after_ the upgrade).
Comment: It used to be on by default. Starting in OS X 10.11 El Capitan it is off by default. Vim is enabling Application Keypad Mode (DECKPAM) without providing any default mappings. I have not been able to discover why Vim does this. I think it should either supply default mappings or not enable DECKPAM by default.
Comment: The edit is misleading. It's false that "_I don't recall enabling this_"; on the contrary I am sure **I never enabled it in this window**!
Comment: Furthermore, there was a part in which I asked for someone to tell me why this option had that consequence, if there are other consequences, and if it is possible that I enabled it by a typo's side effect.
Comment: AFAIK the option is enabled by default (at least it's enabled on my Mac as well and I'm quite sure I didn't deliberately enable it myself). As for your second comment: see the remark in the edit history regarding follow-up questions hidden in answers.
Comment: The option is not enabled by default.
Comment: Do you have a reference for that? I've just created a new user on El Capitan, started Terminal and the option was enabled by default.
Answer: As far as I understand, there are two possible modes for number keypads of VT100 terminals: the normal Numeric keypad mode and the Application keypad mode. The latter has the keypad keys send not numbers, but escape sequences. E.g., the '1' key sends <ESC>[Oq,  the '2' key sends <ESC>[Or, of which only the letters q and r are visible on the screen. These are control sequences that the program (host) may interpret as commands for some features. So, in this mode, the keypad keys are practically used as additional function keys.
In accordance with the VT100 terminal standard, a program (host) may 'ask' the terminal to switch the keypad to application mode. (It can do this by sending a specific control sequence to the terminal.) Vi and Vim are known to do this. The mode switch is not universal, but on a program to program base: it's only active in the program that requested it. In other programs,  including the shell, the keypad remains in Number mode. The default setting in OS X's Terminal.app is to allow programs to switch to Application mode, which is what you now disabled by un-checking the option "Allow VT100 application keypad mode". (BTW: In OS X 10.7 this option is labelled "Strict VT100 keypad behaviour".)
See also:
http://www.vt100.net/docs/vt100-ug/chapter3.html
https://ttssh2.osdn.jp/manual/en/usage/tips/appkeypad.html
Comment: The mode switch is only active in the program that requested it (in this case: vi). So the keypad works normal in other programs including the shell. I've added this clarification to the answer.
Comment: Maybe I didn't get the point in what you wrote. When I'm in the terminal, the keypad works well (inserts numbers). The "strange" behavior was happening only in the insert mode of Vi.


Does everyone prosper through development projects?

Question: Why don't all investors focus their intentions on development projects in less developed countries? Wouldn't this benefit all parties since the recipient country would be more developed and the investor would make a profit? In other words can it be said that development projects are the type of investments where no one is placed at a disadvantage and everybody prospers? ( p.s. please don't criticize if you find this is a stupid question or I sound redundant, I'm a 17 year old economics student excited to learn as much as I can)
Comment: Since you're new to economics, one thing to keep in mind as a rule of thumb is that there are always winners and losers.

One subject that might be interesting for you is the so-called "resource curse".  There's a lot of good literature on it, especially re: the coal boom-bust period in the USA.
Answer: A lot of this comes down to risk. A developing country usually don't have very strong "institution" and are much more prone to various kinds of crisis (think military coup, hyperinflation, terrorist attack, nationalization*). An investor might also not be as familiar with the developing country in question* (and hence the risk).
As a result, investors require higher return (the "premium") to invest in these countries. You can see the risk premium by country here.
This is why developing credibility could be very helpful in terms of drawing foreign investment into a country.
* Added from comments below.
Comment: I would also add familiarity with the country: for example, you're less likely to know about real estate in a foreign country.
Comment: You might also mention the ability to prove and maintain property rights is a problem. Even if ownership can be proven there is still the trouble to keep the property. Sometimes nationalizations happen. An example... https://www.reuters.com/article/us-venezuela-crystallex-idUSKCN1B527D


How to add domain access to custom entity?

Question: Trying to do this for a custom entity, but it seems like Domain Access doesn't have its own entity to reference, and I'm not quite sure what method to use.  I'm still looking into it, but since I couldn't find a question on it yet, I thought I'd post this ahead of time in case anyone else has done this.
Answer: You can override the access handler.
You have to add the handler path in the entity anotation and create an access class extending EntityAccessControlHandler. Inside you can manage the entity access using the rules that you want.
You can copy for learning the Node access Handler:
https://api.drupal.org/api/drupal/core%21modules%21node%21src%21NodeAccessControlHandler.php/class/NodeAccessControlHandler/8.2.x
Answer: The module https://www.drupal.org/project/domain_entity can be used, the only requirement is that your custom entity is fieldable.


Isekai manga where the main character gets summoned and brings the goddess with him

Question: This is a manga where the main character has S luck and is summoned to a different world, but instead brings the goddess with him. With his luck, he spins a raffle drum and wins things such as a legendary sword to a lake house. With that, eventually the goddess somewhat falls for the main character.
Comment: Which goddess is "_the_ goddess?"
Comment: Hi, welcome to SF&F.  What is "S luck"?  When and where did you read this?
Comment: Hi, welcome to the site. Was this manga mostly in black & white or full colour?
Answer: This is I Rose Suddenly in The Alternate World By Overwhelming Gacha With Luck!

It was a gacha experience in a world of swords and magic that the late Jinta Kazama reincarnated in after an accident. But after the reincarnation, a status abnormality was found. His [Luck] stat had a numerical value of [999,999], when its normal maximum was [99], he has become—– The Strongest weapon of mythlogical grade was won in the first gacha! "I won this house with gacha!"

The synopsis is a solid match for the question. After dying, he reincarnates in another world and brings the goddess in charge of his reincarnation along with him.
Answer: The wording of your question is a little confusing, but it sounds like it could match KonoSuba: God's Blessing on this Wonderful World. In particular (taken from the linked WP article and some related articles, plus the fan wiki):

Following an untimely and embarrassing death, Kazuma Satō, a Japanese teenage shut-in NEET, meets a goddess named Aqua, who offers to reincarnate him in a parallel world with MMORPG elements, where he can go on adventures and battle monsters. Despite being offered a superpowered item or ability to use in this new world, Kazuma, following some provocation, chooses Aqua herself to accompany him to the town of Axel, quickly finding her absent-mindedness to be less than beneficial.
He has average stats in crucial categories, but above average intelligence and extremely high luck, neither of which are important for adventurers.

(About their mansion)

The mansion used to have a ghost problem because Aqua created a barrier around a nearby graveyard, causing the spirits of the graveyard to move to the mansion. Kazuma and his party were allowed to stay in the mansion for the winter after exorcising it, but the owner told them they could live there after there were no more rumors about it being haunted

I admit that winning a sword and a lake house in a lottery don't seem to have a match, and while Aqua does occasionally admit to liking Kazuma it doesn't extend to love in the anime (or the manga, I think).


Length of dispersal flight of European spruce bark beetle?

Question: I'm interested in length of dispersal flight of Ips typographus. I can barely find some information about dispersal distances, height of dispersal flight, but not at all information about how many days does it takes for one beetle to find suitable host in average? The only information I found is that it is highly variable (Forsse, E., & Solbreck, C. 1985. Migration in the bark beetle ips-typographus duration timing and height of flight. Z. Angew. Entomol. 100 (1). 47-57). I also know that it is weather dependent but this won't help me... thank you !!
Comment: You should check out this recent dissertation, which might contain useful information: [Kärvemo. 2015. *Outbreak dynamics of the spruce bark beetle Ips typographus in time and space*](http://pub.epsilon.slu.se/12015/).
Comment: thanks @fileunderwater! I didn't know about this one !
Answer: The number of days may still be unknown, and it is probably a large variation when they find a suitable host tree. The "pioneer males" might use "random-walks", when they try several trees before they chose the right one. Its also a large difference between endemic and epidemic periods regarding dispersals.
Anyhow, the flight distance of I.t. has been shown to be more than 8 km (see Botterweg, 1982), but during outbreaks when it can be pheromone sources everywhere most of them may disperse less than 500 m and maybe even less than 100 m. See:
Kautz. 2011. Quantifying spatio-temporal dispersion of bark beetle infestations in epidemic and non-epidemic conditions.
Whichmann and Ravn. 2001. The spread of Ips typographus (L.) (Coleoptera, Scolytidae) attacks following heavy windthrow in Denmark, analysed using GIS
and as mentioned above, the dissertation by Kärvemo and articles within.
I hope this helps.
cheers
Simon
Comment: Hi @SimonKärvemo, thank you very much for the answer and for the proposition of different papers. I hoped to obtain a type of answer as "10 days" or similar but I was sure that it will not be so simple... I am working with Kautz's paper but they simply establish that the flight  takes "several days". I also wanted to relate it to IT life cycle but this is highly variable too ( from 7 - 11 weeks - it is almost the double ! - to establish the threshold value). So, it still remains unknown... but I feel much more sure about this information now ! :)


Learning rule for recurrent neural network with flexible time steps

Question: Summary: I want to train a recurrent network to output some answers, but the recurrent network is allowed to re-iterate through itself a flexible number of times for each input-output pair.
Why this is important:
In traditional neural network learning, we are given pairs of input-outputs, the network is trained to recognize or approximate such a map (with extrapolation or generalization, so to speak).
In this new setting, the input can be mapped to the output via:

1 iteration of the network, OR
2 iterations of the network, OR
3 iterations... etc etc

So there is potentially many more input-output relations that can be recognized by a network of the same size.
For example, the new type of network can recognize the digits of $22 / 7=3.\dot{1}\dot{4}\dot{2}\dot{8}\dot{5}\dot{7}....$ via periodic iterations, but a traditional network can  only memorize a limited part of the sequence.  In short, this is a much more powerful kind of learning machine.
Details:
Define $F$ as the standard multi-layer feed-forward perceptron:
\begin{equation}
F(\mathbf{x}) = \Theta( W_1 \circ \Theta( W_2 \circ .... W_L(\mathbf{x})))
\end{equation}
where $\Theta$ is the sigmoid function and $W_i$ is the weight matrix for layer $i$, with a total of $L$ layers.
The weights $W_i$ can be learned by standard back-propagation if a set of inputs and expected outputs are given.
Now connect the (last-stage) output of $F$ back to its input layer (assuming they are of the same dimension).   Then we have a special recurrent network, call it $R$.
In other words, if we let the network $R$ iterate $n$ times, its output would be:
$$ R^n(x) = F \circ F \circ ... (x) \quad n \mbox{ times}$$
One iteration means the input passing through the $L$ layers of $F$ once.
The RTRL (real-time recurrent learning) algorithm proposed by Williams and Zipser in 1989 can be used to train $R$ to approximate a sequence of output values (the output of $R$ is just the vector at the last layer, and is the same vector fed back to the input layer;  the first element of the sequence is the initial input).
So far so good.
But now I relax the requirement that the sequence has to respect the time index strictly:  it is OK for the network to output some values that are not the expected answer, until $n$ iterations later, and $n$ can be variable from 1 to $N$.
When the network outputs something that is not the answer, it can set a component of the output vector to 1.0 to distinguish it from an attempted answer.
Put it another way, the expected output sequence can be interlaced with "dummy" values for arbitrary numbers of times, as long as the order is respected.
In other words, the goal of learning is to learn the weights of $R$ to satisfy the set of equations:
\begin{equation}
R^n (d_j) = \hat{d_j} \quad , \quad j \in \mbox{data set}
\end{equation}
where $\{d_j, \hat{d_j}\}$ are pairs of input and expected output.  The catch is that each $n$ in the above equations are unknown variables.
The standard practice is to apply gradient descent by differentiating the error:
$$ \epsilon = \frac{1}{2} \sum_j  (\hat{d_j} - R^n(d_j))^2 $$
as partial derivative w.r.t. the $W$'s.  But since $n$ is variable (and possibly dependent on $W$), I don't know how to calculate the gradient.
A theorem by Lo (1993) states that under mild regularity conditions, a dynamical system can be approximated to any accuracy with respect to an $L_p$ criterion by a recurrent neural network.  So, it is reasonable to believe that given enough neurons in the network, the desired operator $R$ should exist.  But I cannot formulate a learning algorithm to find it.
Any suggestions on how to tackle this problem?  Just some general ideas would be greatly appreciated.
PS:  I am thinking about using Hebbian learning which is unsupervised, but this is just a hunch without any specific details.
Comment: Why are there two votes to close?  The question might get more and better attention on cstheory.se, but I don't see why it is off topic for MO.
Comment: Yes, I feel the problem is very mathematical in nature.  In fact, the back-propagation algorithm and the RTRL algorithm were both discovered in optimization research first, and then later popularized in the computer science community :)
Answer: Perhaps you could start with the "easiest" approach, so called Echo State Networks, in which one is really just using the recurrence for feature generation and then using least squares (or Lasso et cetera) to fit to data.
Another idea would be to treat time as just another observation.


Powering nanobot with neurotransmitters

Question: We are thinking of creating nanobots in the brain that control emotions and to power these nanobots we are trying to decompose neurotransmitters to release the energy in the bond. What would be the best way to do this?
Comment: None. Use glucose. Why would you use much less energetic source when you have dedicated fuel available?
Comment: To explain a bit better: please give us a reason not to go with glucose and we may try to help you with inventing excuse for neurotransmitters (from other ill fitting choices). But without such reason already in place we are helpless. Glucose is just to good and to many readers will know that.
Comment: We were thinking of using glucose, but one of our process required uptake of neurotransmitters and we weren't sure how to get rid of them, so we thought just turn these transmitters to energy. And to have glucose battery and neurotransmitter storage would require too much space that we can't provide in nanobit.
Comment: You'll need a chemist to verify this, but given that the chemical structure of glucose (C6H12O6) is fairly similar to a neurotransmitter like epinephrine (C8H11NO3), it seems like you _should_ be able to use a similar process to the Krebs Cycle to decompose it (just less efficiently, and you'll need a way to bleed off excess C, H, and N, and/or uptake more O).
Comment: The amount of available neurotransmitters is _tiny_, because they are made for a highly special purpose. The molecule used as "fuel" is glucose. Use glucose like any other component of the animal body.
Answer: Here are a list of neurotrasmitters maybe one of them could be broken down in the body:
https://en.wikipedia.org/wiki/Neurotransmitter
What if someone took cocaine and the nanobots interfered with the usual reaction us humans with the cocaine and some how take the energy derived from it? I am not a chemist but if our body reacts to other neurotransmitters then perhaps if energy is released then it could be captured by the nanobots?
I have some alternative suggestions below though:
Just like the navigation systems, nanotechnologists are considering both external and internal power sources. Some designs rely on the nanorobot using the patient's own body as a way of generating power. Other designs include a small power source on board the robot itself. Finally, some designs use forces outside the patient's body to power the robot.
Nanorobots could get power directly from the bloodstream. A nanorobot with mounted electrodes could form a battery using the electrolytes found in blood. Another option is to create chemical reactions with blood to burn it for energy. The nanorobot would hold a small supply of chemicals that would become a fuel source when combined with blood.
A nanorobot could use the patient's body heat to create power, but there would need to be a gradient of temperatures to manage it. Power generation would be a result of the Seebeck effect. The Seebeck effect occurs when two conductors made of different metals are joined at two points that are kept at two different temperatures. The metal conductors become a thermocouple, meaning that they generate voltage when the junctures are at different temperatures. Since it's difficult to rely on temperature gradients within the body, it's unlikely we'll see many nanorobots use body heat for power.
While it might be possible to create batteries small enough to fit inside a nanorobot, they aren't generally seen as a viable power source. The problem is that batteries supply a relatively small amount of power related to their size and weight, so a very small battery would only provide a fraction of the power a nanorobot would need. A more likely candidate is a capacitor, which has a slightly better power-to-weight ratio.
Another possibility for nanorobot power is to use a nuclear power source. The thought of a tiny robot powered by nuclear energy gives some people the willies, but keep in mind the amount of material is small and, according to some experts, easy to shield [source: Rubinstein]. Still, public opinions regarding nuclear power make this possibility unlikely at best.
External power sources include systems where the nanorobot is either tethered to the outside world or is controlled without a physical tether. Tethered systems would need a wire between the nanorobot and the power source. The wire would need to be strong, but it would also need to move effortlessly through the human body without causing damage. A physical tether could supply power either by electricity or optically. Optical systems use light through fiber optics, which would then need to be converted into electricity on board the robot.
The Piezoelectric Effect
Some crystals gain an electrical charge if you apply force to them. Conversely, if you apply an electric charge to one of these crystals, it will vibrate as a result, giving off ultrasonic signals. Quartz is probably the most familiar crystal with piezoelectric effects.
External systems that don't use tethers could rely on microwaves, ultrasonic signals or magnetic fields. Microwaves are the least likely, since beaming them into a patient would result in damaged tissue, since the patient's body would absorb most of the microwaves and heat up as a result. A nanorobot with a piezoelectric membrane could pick up ultrasonic signals and convert them into electricity. Systems using magnetic fields, like the one doctors are experimenting with in Montreal, can either manipulate the nanorobot directly or induce an electrical current in a closed conducting loop in the robot.

Powering nanobot with neurotransmitters


How far should the two propellers on a twin engine plane be apart?

Question: I was wondering if there are any specific ways to calculate the appropriate distance between two propellers for a twin engine twin fuselage planes like a Twin Mustang plane?
Comment: Welcome to the site. Your question is a bit brief and it is not clear to me what you are asking.
Comment: If you want to determine the distance between two propellers, you could take out a tape measure and *measure it*.   If you want to **calculate** appropriate distance, it will be more complex.
Comment: I was wondering about if there are any specific ways to determine the distance between two propellers for a twin engine twin fuselage planes.
Comment: Oh sorry for the unclear manner of presenting the question.Yes,i do mean if if there is an approximated way to determine the appropriate distance.
Answer: I'm assuming that you want to minimize efficiency losses due to propellers competing for clean air. I do no know what the optimal distance is but looking at a few practical examples it seems that as long as the propeller disks aren't overlapping you should be alright.

Here is a B 29 superfortress front view you can see the propeller disks are tangential to each other. The B 17 has a similar set up.

Here is a Tupolov bear as a more modern example there is more space between the propeller disks here than on the b 29. I would say this is probably because of the significant difference in horse power between the bears engines and a b 29's.
I hope this helps shed some light on what you were looking for. If you need more information your best bet is to look for a NACA paper on the topic. If there is research on this (and published in english) they are likely to be the ones who have done some.
Comment: Thank you very much for the information! It did answer my question.
Answer: For twin fuselage aircraft, the propeller distance is not the only parameter to look out for.
Safety-wise, the distance of propellers affect the size of the vertical tail and rudder. Because, the aircraft must still be trimmable / flyable in the loss of one of the engines.
The fuselage separation affects the weight breakdown of the aircraft as a whole. It is actually a relief for the wing loads.
From the viewpoint of Propellers, there's almost no problem in bringing them in close proximity. They can even intermesh, as in the case of some helicopters.
They will generate unwanted pressures to each other and extra noise, if they approach too much. However, if not overlapping, propellers do a good job of streamlining a flow (and adding a twist to it).
Comment: Thank you very much for the extra information regarding the effect of it.


Why is the line from the camera to vanishing point parallel to the other parallel lines?

Question: When trying to find the vanishing point of an image, why is it that the vector from the center of the camera to the vanishing point is parallel to the parallel lines of the image?
What's the mathematical reasoning behind this?
Comment: This diagram simply shows how in perspective projection the parallel lines are not parallel in the resulting image (image plane). They would only be parallel in orthogonal projection. The author of the diagram could project any lines he wanted to on the image plane. They don't have to be parallel with the line going through the vanishing point.
Comment: @AndrewWilson, absolutely. And the OP phrase `to the parallel lines of the image` is invalid, because there is no such thing that "THE" parallel lines. It's only meant to mean that some cubic looking, well aligned geometry, like architecture and streets, will tend to display lots of parallel lines that "engenders" the presence of a virtual vanishing point. Do anybody speaks of vanishing points in image of trees and ponds ?
Comment: What are "original lines"?
Comment: Sorry for not being clear, I fixed that now. I hope its clear now
Comment: This question seems nonsensical as it currently stands. Perhaps a photo showing which parallel lines you mean would clarify?
Answer: FYI every set of parallel lines will have their own vanishing point. The reason why there is usually only a single vanishing point (the most obvious one) talked about in an image is due to aesthetic choice.
A perspective projection can be seen as a point projection of a 3D scene onto a 2D plane. The way to determine where a point in the 3D scene ends up on the 2D plane is to draw a line between the point and the camera (the sight line) and see where it intersects the projection target plane.
To find the vanishing point of a set of parallel lines you can take a the limit of traveling on that line infinitely far. At the limit the sight line will be parallel to the line.


What are alternative agile applications?

Question: Agile is getting more popular by the minute and as i understand it is all due to expanding the practice into new areas and business fields. I am interested in knowing what other fields, outside of software development, is agile being used in and how does it benefit them?
Comment: I believe that you can find an answer to your question here: http://pm.stackexchange.com/questions/1470/agile-methodologies-such-as-scrum-in-non-software-development-projects
Answer: There is a real appetite from the Scrum Alliance and various stakeholders to push Scrum into new industries including Construction (Scrum-C).
You can find one such example here https://www.scrumalliance.org/community/articles/2015/may/scrum-in-construction-(1)
The Agile Coffee podcast touches upon this issue every few episodes and is a worthy listen.
Answer: From my experience, I have found that agile can be easily adapted to most of the traditional business fields, such as finance and marketing.
An example I came about most recently is a kanban application within an accounting firm:
Prior to kanban being introduced, the firm was doing okay, but it lacked structure and capabilities to distribute the work and track resources effectively.
Applying the practice solved that by visualizing the work on the kanban board. All the team members immediately saw the full scope and structure of work to be completed.
It also allowed the team to move away from the traditional model where one accountant is responsible for certain clients and to distribute their resources more evenly to be the most productive.
Lastly, by tracking the work in such way they were able to say exactly how much time was needed for each client and make more accurate future estimations.


Electrolysis of copper without any copper initially in solution

Question: Let's say we have two copper electrodes as shown in the image, and there is a solution with copper nitrate. In this case, I know that copper will deposit onto the cathode and copper from the anode will be oxidized and enter solution when a voltage is applied across the two electrodes. However, what if instead of copper nitrate, there was just NaCl (or any other electrolyte that wouldn't cause any problems like precipitation) in solution instead? Would current still be able to flow, and if so, would the electrodes still lose and gain mass as they did before? I am fairly certain that current does flow, but I am not really sure if copper will still deposit onto the cathode and vice versa.
Answer: It is a complex problem. Yes, NaCl solution is a conductor, so electricity will pass through the solution. Now in your situation both electrode are made of copper. Since electricity is passing through the solution, electrolysis must occur at both electrodes. You cannot have electrolysis only at one electrode.
Assuming there is sufficient salt in the solution, what will happen at the anode?
Chlorine gas will evolve. I will let you find relevant equations. Chlorine gas attacks copper very quickly and the anode starts to "degrade" quite fast, but will it pass into solution? Nope.
Let us see what is happening at the cathode?
Sodium ions cannot be reduced in water esp. on copper electrodes (on mercury they do), instead water will be reduced. What happens when water is reduced? It turns into hydrogen gas, which escapes, and leaves hydroxide ions behind. This process makes the solution basic.
Now coming back to the anode, since you have hydroxyl ions around, they precipitate copper ions. All you get is yellow orange junk in such a system. Cu(II) is blue so why an orange yellow mess? It is most likely due to Cu(I) compounds. Anode dissolves pretty fast but nothing happens to the cathode.
Comment: Thanks for the answer! I see that you stated that at the anode, chlorine will be oxidized. Do you have an explanation for why chloride will be oxidized but the copper on the electrode will not be?
Comment: Good point, look at the electrode potential tables for Cu(2+)/Cu and Cl (-)/Cl2 half cells. Which species will have a higher tendency to oxidize at the $anode$?
Comment: @M. Farooq Hm, I would suppose the copper oxidation would occur sooner than chloride oxidation, comparing the standard potentials being almost 1 V apart. Like Cu -> Cu2+ + 2 e-, or Cu + 4 Cl- -> [CuCl4]2- + 2e-

Unless current density is too high to be saturated by copper oxidation and with high enough voltage, chloride oxidation would start as well. I suppose oxidation to Cu(I) can happen as well.
Comment: @Poutnik, the oxidation potential of Cu to Cu(II) would be -0.34 V and that of chlorine would be -1.36 V with respect to SHE. Since there is no Cu(II) to begin with, it is hard to say. Under standard conditions, copper oxidation should occur.


How can i change color to some tiles?

Question: I read that it's not possibile to change the background color of the tiles. So i downloaded an app to change the icons. My problem is that that app doesn't change all my icons (so i have My App Of The Day, games and a pair of icons that aren't changed). I triend to download different apps, but i can't still change these icons. Is there a way to replace the icon with a new one that has the color of my theme? My phone is a Lumia 520 with WP8
Comment: Can you elaborate on which 'apps' you used?
Answer: It is only possible to change the colour if the tile is transparent. Some applications primary and secondary tiles have specific colours and cannot be changed, for example an application may wish to keep their brand colours on the tile.
Comment: So, can't i change the complete icon in some way?
Comment: @AsAs No, the app either allows it or not.

How can i change color to some tiles?


UX vs IA core competencies

Question: What core competencies differentiate a User Experience Designer from an Information Architect?
Answer: Jesse James Garret, author of "The Elements of User Experience", made an infamous visualization on User Experience elements before writing his book. It has two different scales: Abstract to Concrete- scale and Conception to Completion-scale. It's divided into five layers which should be read from the bottom and upward (from Conception to Completion and from Abstract to Concrete over time).

Download the original PDF from March 30, 2000.
It reflects the process of designing any artifact from a User Experience perspective. Garret highlights what is important at each layer and each stage of the project. Beware though, this image should not be seen as a project roadmap where you complete one layer before moving on to the next. Garret states though that you can't finish one layer before preceding layers are finished. You need to be agile and move between layers as you move along.
It is possible to transfer these layers into different competencies. The User Experience Designer cover all of these aspects of the visualization:

Site Objectives and User Needs
Functional Specification and Content Requirements
Interaction Design and Information Architecture
Information Design, Interface Design and Navigation Design
Visual Design

The Information Architect (IA) is a more specialized area of User Experience. In short an Information Architect "connects people to the content they're looking for". To do this the IA have four different tools:

Classification and Hierarchy
Labels and Tagging
Navigation and Wayfinding
Search

Image by murdocke23 on Flickr
That's the difference between a User Experience Designer and an Information Architect.
Answer: UX covers more than just IA. As I learned from Matt, UX = IA + Accessibility + Usability + IxD.
Comment: Accessibility is a subtopic of Usability. In order to make a page usable, it has to be accessible (for everyone). Its covered in the seven dialog principles of ISO 9241-110.
Answer: While - as others have pointed out - there are certainly theoretical differences in how people perceive the two job titles.
However, in practice, you'll find that many of the people with an IA title are in fact doing a great deal of more general UX work.
So the real answer is "it depends" :-)
Answer: Information Architecture (IA) is one aspect of User Experience (UX).
5 Core Compentencies of User Experience (UX):

Information Architecture (IA)
Interaction Design
Usability Engineering
Visual Design
Prototype Engineering
Comment: +1 as your answer matches with real world job descriptions
Answer: Information Architecture relates to the problems of structuring large amounts of information:
So the key text on this is 'The Polar Bear Book'
Co authored by Louise Rosenfeld.
Whose professional background was library science.
As a graduate student in library and information studies in the late 1980s, Lou became convinced that the skills of librarians were grossly undervalued — in the coming information explosion, who else would supply the skills of organizing, classifying and labeling information?
As the Web sped that explosion along, Lou realized that additional skills and perspectives were required to develop coherent, intuitive structures — information architectures — that made web content accessible to users.
So IA is the application of library science to the overall UX mix.
IA is particularly relevant in situations where there is a lot of information, such as corporate intranets.

UX vs IA core competencies


A bad guitar... CAN it sound good?

Question: is it possible to have a beautiful agreeable good sound to dance or to rhythm the night while using a cheap $70 guitar (the classical guitar). Is the instruments responsible for it or it depends just of the musician ? Any minds ? thanks a lot in advance
Answer: There is a reason that instruments including cheap ones are showcased by expert players.  Famously, Paganini, getting tired of having his prowess attributed to his "magic" violin, one evening after a concert earning thunderous applause broke his instrument in pieces to a flabbergasted audience.  It had been a cheap instrument he got for that occasion.
A cheap instrument will make its player work a lot more for getting an agreeable sound out, but it's not beyond possibility.
Now $70 is really asking for it.  For a used instrument, you might have a chance.  For something costing $70 when new, this will be tricky.  Your best bet is when it is brand new and has not yet have had opportunity to warp its machine-milled neck: once that has happened, the instrument is no longer playable sensibly even by professionals.
Also it helps if you don't have to fill a concert hall with your sound and put on reasonable strings.
Answer: Generally speaking, the only limiting factors for a magic performance on a dirt cheap instrument are the skills of the guitarist and whether the guitar's intonation is correct (whether it can be played in tune).

A bad guitar... CAN it sound good?


How to secure ubuntu server from bruteforce ssh attacks?

Question: I have my passwords secure, but I heard people complaining about perfomance of a server going down drastically when a bruteforce attack is taking place. How can I secure my ubuntu 10.10 server from such attacks? Is there an apparmor profile for this? Or some other way to address it?
Answer: There are different solutions. The best one is using RSA authentication that uses public/private keys to authenticate users.
Check this great manual for different approaches (RSA authentication included): http://www.la-samhna.de/library/brutessh.html
I'm using the 3rd solution on my server because I don't want to make it complicated for my non-technical users: using iptables to limit the number of connections per minute that makes bruteforce attacks inefficient and ineffective.
Here is the solution I'm using:
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j LOG --log-prefix "SSH_brute_force "
iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP

As mentioned here: this will allow three port 22 connections from any given IP address within a 60 second period, and require 60 seconds of no subsequent connection attempts before it will resume allowing connections again. The --rttl option also takes into account the TTL of the datagram when matching packets, so as to endeavour to mitigate against spoofed source addresses.
As stated in the mentioned guide, it's better to use a white list to separate trusted users from these rules:
iptables -N SSH_WHITELIST

then add trusted hosts:
iptables -A SSH_WHITELIST -s $TRUSTED_HOST -m recent --remove --name SSH -j ACCEPT

and after that make the rules:
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSH_WHITELIST
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP

Comment: Using ssh, I don't think so.if you have a web server installed such as apache you can share the key using web.
Comment: Regarding turnign off password authentication, how do I login to a server if I loose its public key then? (I don't have a phisical access to a server, it is a VPS)
Comment: Public key can be published everywhere you want.So don't worry about that.You can put it somewhere that you're sure you won't forget it even public places.
Comment: Read more here: http://en.wikipedia.org/wiki/Public-key_cryptography
Comment: Is there a way to set up server to reveal its public key when asked?
Comment: Good idea, thank you. Are there any brute-force attacks against RSA?
Comment: No problem :) / No.Since server won't ask for password, attacker can't use brute force attack.But don't forget every security feature can have a problem which can be used to launch attacks. :D Anyway, it's always reasonable to use the most secure way.
Comment: As far as I understood from the manual, you generate and store your private key on your machine and upload your public key to a server's authorized_keys file. Is this correct? Or the other way around?
Comment: Yeah, that's correct.
Comment: But, in this case there is no such thing as a server's public key, hence nothing to publish. So, loosing my private key = loosing access to server. Correct?
Comment: Private key is like your password.If you forget your password you will lose access.Private key is the same.
Comment: Fair enough. To be on the safe side, I've setup my 2 servers to have access via RSA to one another. So if I loose my private key I will be able to ssh from another server.
Comment: I have browsed the net for about 50 hours reading blogs and forum-logs every where and give this answer/solution +1. It could be improved by listing the brute-force protection to all connection attempts using iptables EXCEPT permitted sources, such as the port address of a webserver, which is locked down tightly anyway.
Answer: I get brute-force ssh attacks on my servers with a rate of 1 to 2 per day. I have installed denyhosts (ubuntu package: denyhosts). It's a very simple but effective tool for that purpose: essentially it periodically scans your logs to detect brute-force attacks and puts IPs from where these attacks originate into your /etc/hosts.deny file. You won't hear from them again and your load should be reduced considerably. It is very configurable via its config file /etc/denyhosts.conf to tweak issues like how many wrong attempts consitute an attack etc.
Due to its transparent workings you can easily see what's going on (email notification: 'aha, another dastardly attack thwarted!') and undo mistakes due to your users mistyping their passwords repeatedly .
Of course, everything previously said about switching to other authentication methods holds but sometimes your requirements disagree with those of your users.
Also, new-connection rate limiting in iptables might be a better choice then denying access via hosts.deny. So, have a look at fail2ban as well. But if you know that ssh brute-force is your main concern (manually look through /var/log/auth.log to determine this), go with this very easy and low impact tool.
Comment: Well, this means someone at IP 188.8.131.52 tried to login as root. Could have been you, but likely not because using http://tools.whois.net/whoisbyip/ , I can see that this IP is registered in China which is quite a ways from Minsk ;-) So, yes, this looks like a guess of your password. Moral: Disable root login via ssh (PermitRootLogin no in /etc/ssh/sshd_config) because there is no good reason to leave this on. And then consider denyhosts or fail2ban. Also, make sure you have a firewall to let only essential access through port 22 and whatever else you need (but not more)
Comment: My /var/log/auth.log has been growing considerably lately. Does an entry like this `Mar 27 10:28:43 smartfood sshd[17017]: Failed password for root from 220.127.116.11 port 33119 ssh2
Mar 27 10:28:47 smartfood sshd[17019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.108.40.206  user=root` indicate of an attack?
Answer:
Change the sshd port to something nonstandard
Use knockd to implement a port-knocking system
Use iptables' recent and hashlimit matches to limit consecutive SSH attempts
Do not use passwords, but use SSH keys instead
Comment: @steabert it helps against script kiddies that just try to bruteforce their way through port 22. that's my experience: someone keeps bruteforcing an Internet-facing server when I was setting it up, making the system send me warnings after warnings. I moved the port, and the warnings subsided.
Comment: -1 for the first advice, complicates things for actually no real security increase
Comment: @Dziamid No, not correct. Other authentication methods (RSAAuthentication, PubkeyAuthentication, #KerberosAuthentication etc) all still make contact via port 22.
Comment: If you use ssh keys and turn off password authentication via ssh, do I really need 1,2,3 ?
Comment: @Dziamid ssh keys prevent someone breaking into your system. but it doesn't stop them from trying to connect to port 22.
Comment: @pepoluan, I thought that if you turn 'PasswordAuthentication to 'no', server won't even listen to port 22. Is this correct?
Answer: First of all you should consider not using passwords and use keys instead. There is no need to use a password. If this works for you, you can configure the OpenSSH-server not to react on password logins.
https://help.ubuntu.com/10.04/serverguide/C/openssh-server.html
Using fail2ban, could be an option as well.
https://help.ubuntu.com/community/Fail2ban
Comment: Only via console or direct access. I am quite sure that you will not lose your key if you are able to administer a server.
Comment: How do I connect to a server if I loose its public key?
Answer: How widely is the server exposed on the network?
Perhaps you can have a talk with the network admin and check if it's possible to monitor and restrict network access to the server.
Even if the account logins are safe, it seems that the server could suffer from simple DoS / DDoS attack.
Answer: An alternative to fail2ban is CSF: ConfigServer Security & Firewall.
It comes with LFD: a Login Failure Daemon that can detect multiple failed login attempts on various services, and will block the offending IP address (temporarily or permanently).
It has some other options that can help against flood attacks, and possibly detect intrusions.
Disadvantages:

You must use CSF as your firewall in order for LFD to do its job.  So if you have an existing firewall, you will need to replace it with CSF, and port your configuration over.
It is not packaged for Ubuntu.  You will have to trust the auto-updates from configserver.com, or disable automatic updates.
I have heard it is quite popular, so smart intruders will probably know how to disable intrusion detection before they are detected!
Answer: Do you intend to allow SSH service to the world?  Or just to team members at particular places?  My answer depends a bit on the severity of your challenge.
In either case, one thing you should do is make sure that the SSH server does not allow password logins for the root user.

In /etc/ssh/sshd_config make sure you never allow a root login except with an SSH key.

In my systems, I've got this setting
PermitRootLogin without-password

but I notice in newer Ubuntu they have
PermitRootLogin prohibit-password

If you read "man sshd_config" I think it means this newer "prohibit-password" means same thing and is certainly more obvious in meaning.  That is NOT default on some Linux systems, but probably should be.
Now, about your problem.  Does your system server only some users in particular places? Do this!

edit /etc/hosts.deny and insert
ALL: ALL

Then edit /etc/hosts.allow and list IP numbers or a range that want to allow to use SSH. The notation there is a little confusing because if you want to allow all systems with IP numbers like 188.8.131.52 through 184.108.40.206, you put in an entry like this in hosts.allow
ALL: 127.0.0.1
sshd: 111.222.65.
sshdfwd-X11: 111.222.65.

That is a bruteforce, powerful solution. If your users can be enumerated by IP range, do it!
This solution existed before IP tables was created, it is (I think) a lot easier to administer, but it is not as good as an IP tables solution because IP tables routines will spot enemies sooner than the programs driven by hosts.allow and hosts.deny.  But this is a sure fire, simple way to close out a lot of problems, not just from SSH.
Note the problem you create for yourself. If you want to open up an FTP server, web server, or whatnot, you will have to make entries in hosts allow.
You can achieve same basic purpose by fiddling with iptables and the firewall.  In a sense, this is a preferred solution because you are blocking enemies at the outer boundary. Ubuntu has "ufw" (uncomplicated firewall) and "man ufw" has plenty of examples.
I'd rather have a nice GUI to wade through this, I don't have to do this all the time. Maybe others can tell us if there is one now.

Other posts here suggested using SSH public key only for your users.  That will certainly help, at the price of complexity and frustration for your users.  In our lab, there are 15 computers. Users go among computers. Requiring SSH key authentication would cause a big hassle because people go from one computer to the next.

Another source of frustration will happen when some users accumulate different ssh keys for various servers.  Because I have SSH keys for about 12 different projects, now ssh fails because I have too many public keys (Requiring either "ssh -o PubkeyAuthentication=false" or creation of an entry in the .ssh/config file. It is a PITA)

If you must leave the server open to SSH from the big wide world, then definitely you should use a rejection routine to block locations that frequently try to log in. There are 2 nice programs for this,  the ones we have used are denyhosts and fail2ban. These programs have settings that allow you to ban offenders, for a duration you like.

In our Centos Linux systems, I noticed they dropped the denyhosts package and only offer fail2ban. I liked denyhosts because it built up a list of troublesome users/ip ranges and then in hosts.deny, that list was noted.  We installed fail2ban instead and it is OK. My understanding is that you'd rather block these bad users at the outer edge of the server, so the ip tables based blockers, like fail2ban, are actually better.  Denyhosts works on the secondary level, after enemies have gotten past iptables they are then rejected by the sshd daemon.
In both of these programs, it is a bit tedious to get users out of jail if they forget their password and try a few times to log in.  It is a bit difficult to get people back in when they make login mistakes. You'd have guessed there would be a point-and-click GUI where you could just point and let people back in, but it is not that way.  I only have to do this every few months and forget how between times, so I wrote instructions for myself on my web page  http://pj.freefaculty.org/blog/?p=301


Temperature of the earth

Question: What are the main factors that contribute to the temperature fluctuations/cycles of a location? Is the earth's temperature cycle dictated mainly by the temperature cycle of the ocean? How does the ocean's heat storage affect the temperature of the atmosphere and thus the seasonality that we human's feel?
Answer: The oceans have a huge effect on the climate and temperature of the various regions of the world. Climates fall into two categories: marine and continental. In Britain we have a marine climate, which protects us from the extremes of the European continental climate. Our winters are milder, our summers cooler, because of the proximity of the Atlantic and the warm Gulf Stream coming up from the Gulf of Mexico. It also gives us a damper climate, with more mist and rain. This moderating effect and increased dampness and humidity is characteristic of marine climates. In the S.Pacific they have El Nino, a strange subtropical current which reverses every ten years or so, causing droughts and other adverse effects for the countries of the region.
The Galapagos archipelago is another example of a marine climate, in this case cooled by the Humboldt Current coming up the coast of Chile from the Southern Ocean. The Galapagos Islands are on the equator, yet the climate is only subtropical and the waters are cool enough for penguins to thrive. These cold currents, like the Benguela current coming up the west coast of S.Africa, are rich in nutrients and in fish. The Benguela Current has strange effects on the climate of Namibia.

Temperature of the earth


Rails 2.3 action mailer Net::SMTPFatalError

Question: I am sending out a confirmation email on save. When an email address in the 'CC' list is invalid I get the following error
Net::SMTPFatalError (550 5.1.1 ... User unknown
):
and the transaction is not saved even though it is called from the after_save method in the model observer. Should'nt the transaction be saved before the error.
Also, when I set the raise_delivery_errors to false in my config file, the error is not raised and the transaction is saved but the email is not sent to the members of the 'To' list and the 'CC' list even if one of the email addresses in the 'CC' list is invalid.
The system should atleast send emails to people with valid email addresses. Any suggessions to fix this issue.
thanks,
ash
Answer: Sorry, your callbacks run in the context of the transaction, and returning false or throwing an exception causes the transaction to rollback: http://api.rubyonrails.org/classes/ActiveRecord/Callbacks.html
Can you catch that exception in your code, log it, and not re-raise it?
You could use your after_save to fire a worker queue or delayed job.


Effects processor in FX loop always?

Question: I recently got a Boss GT-1 Guitar effects processor and my question is should I use it in the FX loop or is in the front of an amp fine. My other question is if my effects processor also has an amp modeling function, is getting an amp with a good preamp even worth it, if the FX loop would bypass it? (P.S sorry if I have said any thing dumb or wrong I'm new at this)  side note what affordable amps work well with a Boss GT-1?
Comment: Not sure about GT1, but my GT3 and GT6 need to be told where they are in the circuit, from memory - haven't used each in a while.
Answer: No, definitely not as a rule, but it's something to try. The best thing is to try both and use what sounds best to you.
It depends on the type of effects that you are using and to some degree personal taste whether it will sound better in the FX loop. Most people tend to want volume based effects like distortion/overdrive in front of the preamp because often the very point is to boost the signal enough to overdrive the amp's preamp naturally. Some people prefer time based effects like delay/chorus/reverb in the FX loop, but definitely try both and see what you like.
Of course, some amps don't even have FX loops so it's not unheard of or unworkable to put everything in front. And given that with a multi-effects unit you can't really put some effects in front and some in the FX loop, I'd probably default to the front.
As for amp modeling, that again depends on if you like the sounds you're getting and if you're sure you that never want to use a natural amp tone. I have a Boss GT-6 and while the amp modeling is ok I guess, I greatly prefer a real amp. But again there's no correct answer.
Answer: The GT-1 would normally be used between guitar and amp, i.e. not in an effects loop.   Feel free to try other configurations if you wish!
Answer: I think a couple specific parts of your question haven't been addressed yet.

if my effects processor also has an amp modeling function, is getting an amp with a good preamp even worth it, if the FX loop would bypass it?

Whether or not another preamp is "worth it" depends entirely on the sound you're going for. It is possible to use the GT-1 preamp (or others) to go directly into the FX loop return, bypassing the preamp. If you like the sound of whatever external preamp you're using and don't want anything else, then no, the amp's preamp won't matter because you'll never be using it. But at that point, you may as well not buy one either. You can get standalone guitar power amps to drive your cab instead of paying for parts you'll never use.
If you go this route, make sure you update the GT-1 settings to tell it that you're going direct into the FX loop.

what affordable amps work well with a Boss GT-1?

This will be entirely up to personal choice as well. The pedal will work just as well with any amp, though the way the amp alters the sound of the pedal (and vice versa) will be slightly different for each amp. This will be especially true if you're using drive, distortion, or the preamp. You'll just have to head into a guitar shop with your GT-1 to try things out and see what combination you like best that also fits your budget. Consider taking your guitar in with you as well to test out your whole chain.

For what it's worth, I run my GT-1 in the FX loop. I use my amp's preamp and don't use any of the GT-1 modeling or distortion effects. I mainly use it for different EQ and noise gate presets for different guitars, and sometimes a bit of delay and reverb.

Effects processor in FX loop always?


How to properly estimate gas costs of function calls with go-ethereum and golang?

Question: I'm attempting to build out a program in golang to model ethereum gas costs of function calls for the smart contracts I write. I've successfully been able to estimate them using ethclient.EstimateGas however the reported gas costs seem incredibly underpriced, anywhere from 22K->24K gas to send tokens, and alter some boolean variables in storage? There is no way that's the correct gas cost. I'm unable to find out how websites like ethgasstation can reliably estimate gas costs, if the costs reported back by go-ethereum library barely even match real world costs?
Answer: I can't tell you why the ethclient.EstimateGas underreports the consumed gas. I remember facing the same problem once and my lazy solution was to multiply whatever it reported by 3.
In order to calculate the correct gas price for a method call, you need the binary EVM code of the contract. Once you have that, you can look up the price of each instruction in the Yellow Paper in Appendix G and H. The hard part of this calculation is, however, that the precise gas cost will depend upon the state of the virtual machine executing the code (the EVM). In order to calculate that correctly, you probably need to simulate the whole virtual machine. And in the general case, the whole Ethereum blockchain, i.e., you need an Ethereum blockchain node.
If you for example call the ERC20 function transfer, you will end up paying at least 21,000 gas just to make the function call and between 10,000 and 40,000 to update the balances and 400 to read the balances plus additional gas to pay for the jump table logic at the beginning of the contract. The amount paid to update each balance (sender and receiver) will depend on whether the address has a balance or not (5,000 gas vs. 20,000 gas for each update) so you need to know the whole state of the virtual machine. In other cases, you would need to know the state of other Ethereum accounts such as balances or deployed smart contracts.
Comment: Is there any way around that? It looks like `ethclient.EstimateGas`  estimates the gas just to make the function call. This seems very poorly designed no? Is the only way to estimate the cost to literally to spin or emulate the virtual machine? There has to be a better way to go about doing this.
Comment: I don't think there is a way around this; you need to simulate the entire blockchain (not just the virtual machine) in order to calculate the consumed gas for an arbitrary transaction.
Comment: You are correct, now I've run into issues with simulating the blockchain. Thanks!
Comment: I believe this problem is related to the halting problem.
Comment: Ok thank you i'll poke around. Appreciate the help :)


How easy to take the car in Schengen Area

Question: With a valid visa, is it possible to carry a car for the travel trip in Shengen region? How easy or difficult it is apart of the cost involved? Should owner have the European driving license to drive his car?
Comment: Where will you be entering from, and what country is the car registered to? If it helps, 10s of thousands of people cross every day by car between the non-Schengen and Schengen parts of the EU every day without issue, but they're normally EU citizens with EU registered vehicles
Answer: Schengen applies to persons, not to objects. For your car the rules for temporary importation in the customs territory of the European Union apply. The customs territory of the EU is not the same as the Schengen area. Norway and Switzerland for example are part of the Schengen area, but not of the customs union. The UK is part of the customs union, but is not in Schengen.
You can import a car and use it for up to six months. After that import duties will apply and you will might to re-register the vehicle.
More info here:
http://customs.hmrc.gov.uk/channelsPortalWebApp/channelsPortalWebApp.portal?_nfpb=true&_pageLabel=pageImport_ShowContent&propertyType=document&id=HMCE_CL_000237
This is a UK page, but the temporary importation rules are the same for the whole of the EU. What might be different in some countries is the time after which you need to reregister a car.
Comment: Customs regulations are just one of many issues when bringing a vehicle from one country to another. Even if there are uniform custom regulations in the EU, I am pretty sure that insurance requirements (e.g. proof of liability insurance) differs between the EU countries. At least the German law on liability insurance for foreign vehicles is a national law and is not based on any EU regulation.
Answer: Is it about bringing your own car? Only yesterday I was driving behind a car with Russian license plates not to speak of the many trucks with the most diverse types of license plates. I even have seen a truck with licenseplates from Kuwait, don't ask me how it got here.
If it is about renting or buying a car, different options are available Peugeot even has a formula that caters this situation.
Whether or not you drivers license is accepted does not so much depends on the car you are driving, but more on the regulations between your country and the Schengen area. It is always advisable to cary an IDP.


When you change ships does your old one disappear?

Question: I found a ship from a distress signal and misunderstood the inventory prompts when switching to it so all of my old ships inventory is still on the old ship. I have no idea where I left it but I just want to know if it is worth searching for it at all? Will it still be in the same place and will it have everything it had in it before the switch?
Answer: If you set your ship down right next to a crashed one (so you can easily find your ship again), then you can claim ownership of the crashed ship, scrap all of its parts for valuable elements, and walk over and reclaim ownership of your original ship.  You won't lose anything.
The game seems to do a good job of remembering the state of things (e.g. which boxes have been opened, which houseplants have been farmed, etc.) even very far away from one's current position, but I don't know what its limits are, and I would be very surprised if it remembers that info after the game has been shut off.
Terrifying Update
I recently made my first multi-million unit ship purchase inside a space station.  My old ship was still sitting where it had been when the purchase was complete, and as I'd not been able to fit all of my inventory into the new ship, I decided to use the above tactic to go grab the rest.  When I reclaimed my old ship, grabbed the remaining items, and turned around ... my new ship was gone.  My heart stopped for several beats until I realized that the game had moved it to a different landing pad.  (It had been parked behind my old ship and now it was to the right of my old ship.)
So, I don't know how safe it is in general to immediately reclaim your old ship after you buy a new one.  (But I still regularly use this approach on crashed ships.)
Comment: Actually, I've been visiting the same space station a couple of times, and it would only let me farm the houseplants in there on my first visit - even after shutting the game down in between. I haven't left the star system yet though, not sure if that would make the game forget. Even then, that is pretty impressive.
Comment: The game seems to keep a memory file for each planet. I've seen many pictures of people who dig a tunnel through rock using the Plasma Grenade, turn off the game, then when they log back on the game has spawned flora/fauna into that new hole.
Comment: @Andii Neat! I've had both of these experiencies: (a) I return to an outpost after leaving the planet and shutting down the game, and it remembers that I opened the Pu boxes by the landing pad. (b) I return to a space station after visiting two planets (no shutdown) and I can do the meet/greet dialog with the station manager again (i.e. not the one you have to pay 20C for, but the initial one where you have to guess what he's talking about).  Also, on most space stations I've been able to farm the suit upgrade station at least twice (I haven't tried for more than twice).
Comment: I just got shocked as well. Crash site. Claiming new ship to dismantle components. Claiming back old ship. GAME CRASHES. Re-Starting and I got the old ship. The new one is gone! What a luck the game has also the previous savegame available, which was saved when I exited my actual ship.
Comment: The entire game is online-based, including discoveries and harvested materials, so everything is saved on the game's servers. Therefore, if you leave a ship on a planet, it will remain there until a player claims it. However, a ship left in a space station will disappear if you go too far away or if you are away from the station at all for a long period of time. It will also usually disappear as soon as you log off.
Answer: Similar to upgrading a multi-tool you lose the old one but can pull whatever attachments over at the compare screen.
Made the mistake of not transferring the first time and lost some good stuff.
Comment: Best bet is to trade for a new ship with more slots either by buying one from someone in a space station or at a ship dock on a planet.
Answer: I don't think the accepted answer is correct.
When I was tearing apart the upgrades on my old ship I accidentally discarded a stack of much needed Zinc.
No problem, I thought, I'll just reload my last save.
After I reloaded my last save, my old ship was no where to be found.
So if you have reloaded since you transferred ships, I don't think you are going to find your old one anywhere.
Answer: There's currently a glitch with claiming ships (2.06C) where you can lose access to your current starship if it has any movable items left in its inventory when you swap.  Just make sure you empty it to your exosuit and freighter before hand.


How to write a character who is falling in love, but doesn't know?

Question: So I have been trying to write a character that is oblivious to romantic advances because they mistake them for normal, platonic reactions. I know how they act in my mind, but I can't convey it enough to readers.
  A little background; The love interest is a stubborn nihilist. They don't not like romance, but they are just disinterested in it because they are focused more on their career. The reason behind their focus on their job is because they are about to be let go unless they can come up with a way to save it. The main character doesn't solve the love interest's problem, but helps them relax every now and then, making them more able to focus on their task.
Comment: Your question is about the character falling in love, but your text talks about the character not realizing that romantic advances are romantic.  Is it that the character is falling in love, or that this character does not realize that another character is falling in love?
Comment: https://writing.stackexchange.com/questions/49692/under-the-radar-feelings

This is a link to a question that I asked a while ago. None of the characters involved are stubborn nihilists or anything, but I was also wondering how to show that a person is falling for another person without realizing it themselves. There are some cool answers, so maybe it could be of some help.
Answer: One of the best examples I know for this is in both the book and movie of Remains of the Day. The emotionally repressed main character is in love with his coworker, but never admits it, either to himself or to her. There's a wonderful scene where he drops and shatters a prized, vintage bottle of wine --completely out of character for him --on the day he learns she is leaving, yet never connects the two events.
This is a good strategy. Have the character show many of the characteristic signs of romance, yet refuse to admit to them. If you want to make it explicit, you could even have a conversation like "it's so great we can be so close and intimate and still be just friends." That may seem crude and hamfisted, but conversations like that do happen all the time in real life.
It's not clear to me which character is oblivious, the viewpoint character or the love interest (or both). It's easier to show this with the viewpoint character, because you can color their perceptions and reactions. If it's the other character, you might just need to focus in on the viewpoint character's frustrations with being stuck in the "friend zone."
Comment: "The Remains of the Day" is the perfect example.  There was such context in the scene of the dropped wine bottle, and so much sadness, and so much possibility, so much fire slowly extinguishing from denial of the oxygen it needs to bloom.
Answer: One thing you can try would be to write out a possible argument or scene with a bit of tension surrounding the disinterest in romance.
For example, say it's valentines day and the love interest brushes off your MCs attempt to have a romantic dinner. Being able to show (don't tell) the hurt that character is feeling and the other not seeing anything wrong with the situation will highlight the imbalance with their perspectives.
Even if you don't use this in your finalized piece, it may be enough background for you to sprinkle in details of tension (doesn't necessarily need to be a full on argument) that arise from the situation.
Hope this helps.
Answer: The best way is to show the character falling in love and not realizing it.  This is done by the character acting like he's in love
Particularly common ways:

The character pays attention to the Love Interest for (in his eyes) no good reason.
The character continually notices attractive things the LI does.
The character thinks about LI and how attractive she is at other times.
The character does nice things for LI spontaneously.
The character defends LI from others -- verbal more than physical, generally.
The character grows jealous if others show interest in the LI, or vice versa.


Changing geometry in linked duplicates

Question: I have a parent object with numerous child objects and made also a bunch of linked copies (via alt+D) of said parent object inside my scene.
As it turns out, I need to merge the child objects into the mesh of the parent object now and was wondering if there is a way to accomplish that without breaking the link to all the linked copies and basically propagate the same change to all of these linked copies.
The problem is, that memory usage of the scene would just explode if I loose the linked duplicates.
Answer: Let say the object A has a lot of linked duplications, and object A has a mesh called A'. Let say you have a B object with a mesh called B'. You want B' to be part of A. If you select B object, then select A, then ctrlJ, the A object is now made of the A' + B'. All the A linked copies are now made of A' + B'. It won't explode any memory as a linked duplication doesn't weigh on the file.
Now, if B was also linked duplicated and you need to delete all the now useless copies of B (considering B' is now part of A), you can select one of the B objects and press shift L Select Linked > Object Data and it will select all the Bs. Then X to delete.
Does it answer?
Comment: Hmm... First of all thank you very much for your answer! Unfortunately that is exactly NOT the behavior I've observed when doing exact that (except A in my case is the parent of B and I tried to merge all children into A). None of the linked duplicates changed in any way when I performed the merge :(. But I went the long way in the meantime, made the merge and created all new linked duplicates of the merged mesh. Thanks again for trying to help though, I appreciate this!
Comment: it is the behavior of a linked duplication, you must have duplicated with no link! Linked duplication is alt D, simple duplication is shift D

Changing geometry in linked duplicates


Is my Verizon iPhone 5c unlocked?

Question: I have a Verizon iPhone 5c. Is it unlocked so that I can just go to T-Mobile or AT&T prepaid, by just popping in the SIM card?
Answer: If you bought the iPhone at full price ($549 or $649) then yes it is unlocked.
If you and bought it subsidised (where the price is $99 or $199), no it is not.
This restriction is required by the carrier, because they paid the remainder of the price, and will claim it back from you (with a tasty profit!) over the duration of your contract with them.
Comment: This is not accurate. Verizon sells all 4G LTE devices with the SIM slot unlocked per the terms of their acquisition of 700 MHz spectrum a couple years back.
Answer: First things first: if you have inserted a Verizon SIM card (or any other carrier's SIM card) within 20 minutes of turning on your iPhone, you are out of luck as it will ONLY work on that carrier. This is a very weird thing that happens with the iPhone, but I believe Apple added this on purpose to sidestep something within the carriers.
As for whether or not a prepaid plan will work, apparently it can. There is a webpage on WikiHow that explains how to do it (look at the iPhone 5 method in your case).
I'm not too sure if it will work on a Verizon iPhone, but it never hurts to try.

Is my Verizon iPhone 5c unlocked?


Sound Cloud SSD Group

Question: Hi Everyone. I have taken the liberty of starting up a Sound Cloud group for Social Sound Design users. I thought it would be good to have an easy place to listen to each others tracks as we have many of the same sonic interests. It will be interesting to hear how others on this site produce music. The page can be found at link text Please feel free to post your tracks up now.
Comment: No worries, I think it might be best to keep this group for music or soundscape/concrete compositions rather than single sound effects or wild tracks. There is nothing stopping people putting sound effects on their own page and sharing sound effects easily with others if they are using sound cloud.
Comment: Great stuff @lenny. Thanks for that :-)
Comment: My bad. Is this solely for Music? What about sound effects we want to share?
Comment: Nice one Lenny!
Comment: agreed Lenny, just joined...
Comment: Awesome! Will be cool to share some stuff.
Comment: Very nice idea :) joined!
Comment: Nice! Joined, with user name Efraim.
Answer: I've just added a sidebar widget for our SSD group on SoundCloud :-) Look to the right -->
This way we can listen to each other's Music/SFX/Inspirations... I got a feeling there's a little bit of spam from producers trying to sell their music, but no big deal.
I also added a DropBox, so you can quickly just upload something.
Awesome!
Answer: This was such a lovely idea, but it seems to have become flooded with people trying to sell samples.
Seems like a bit of a shame really, as it could be a great place for SSD users to share interesting recordings.
Cheers
Comment: I agree, I wouldn't mind if it were just a few. But the ratio is just wrong. I wonder if I should delete all the ones for sale...
Comment: I agree, thanks for pointing this out, I have deleted them all as the first page I came across were all for sale and I didn't intend this to be a commercial platform.
Answer: Please do not upload commercial tracks on the Sound Cloud SSD group. I didn't mention it when I created the group as I did not expect it would be a problem. Myself and others on the site have had concerns about people using the SSD Sound Cloud page as a commercial platform to sell their tracks or sounds. I hope it doesn't offend anybody but I have deleted all tracks that are for sale. I started up this SC group for members of the SSD community to share sounds and music they have obtained or made and didn't want it being filled up with commercial stuff or people will loose interest in it.
Thanks
Answer: Great idea. Shared a track I have been working on lately, and checking the other tracks.
Answer: I actually added all mine to make a point - I'll remove them - it seems wrong for there to be any sounds with for sale links.... its like advertising....
Comment: Its ok, I have removed all of them Tim so no worries. In hindsight though filling a whole page with samples for sale may not have been the most logical way to make a point about people selling samples on the group page :-)
Comment: Really? I think it made the point perfectly clear.

Sound Cloud SSD Group


Russian "Turist" bike look alike

Question: guys! I was wondeing if any of you beautiful people can help me out. My dad's bike just broke :( He lives in Ukraine and has had this "Turist" bike for probably over 20 years. They don't make this model anymore and I was looking around on the internets trying to find a similar looking bike to buy for him. He's 60 and uses it to commute to work and when going on fishing trips. I have attached a picture. If you know where I could find a bike that look like it, or even better, where I could buy one and have it delivered to Kiev, Ukraine, I would greatly appreciate it :)
Please post a model number and I can look into it and where to buy it.
Thanks so much]1
Comment: HVZ bikes are dime and dozen all across ex-USSR, you can get another Tourist for cheap or spare parts for even cheaper, especially in Ukraine. What exactly has broken? Also, I'd advise to visit [HT HVZ subforum](http://xt.ht/phpbb/viewforum.php?f=31).
Comment: Here in Russia you can find Tourist for 1500-5000 RUB.
Comment: Note that the tricky part is finding a bike to fit him, without him having an opportunity to test-ride it.  He might be able to help in this regard by sending you measurements from the current bike, particularly "standover" height,  seat tube length and the distance from the center of the crank to ground.
Comment: That looks like a fairly conventional 1980s US road bike, aside from the fact that the US bike would have a front derailer.  It's virtually identical to my old Nishiki.  I wouldn't expect you'd have a hard time replacing it unless you insisted on something from the same era vs a more modern model.
Comment: @Klaster_1,  whoa! Thanks so much! That's awesome :) I made a thread in the forum, but it asked me to put down price that I'm willing to pay and I have no idea what they go for %\ .... But thanks, that's really helpful :)
Comment: @Klaster_1, wow, that's really cheap. Thanks for the info!
Answer: This is Bicycles.SE, we're more aimed at helping you overcome practical problems.  Since its a nice looking bike, why not fix it?
Please tell us more about the problem/damage, with photos of the broken parts.
Comment: oh! I'm sorry! I just thought this would be the best place to ask because I don't know if there is a specific way to search for bicycles, like if what it looks like tells you something about where to find similar models. I just knew that it was a road bike, that's it, i'm quite uninformed in this area XD I will ask him to take some pictures and will post them here :)
Comment: Good stuff - I'm looking forward to more info (a.k.a. bike porn!)

Russian "Turist" bike look alike


Vampires in Middle-earth

Question: I think I read somewhere there were vampires in Middle-earth. Does anyone have any knowledge of these vampires and any noteworthy events in history they were a part of?
Answer: Not much is known about them, but Vampires in Tolkien's mythology seem to be bat-like creatures under the service of Morgoth and Sauron.  They don't play a major role in any of the stories, and seem to be quite distinct from the tuxedo-wearing Dracula archetype.  It's generally assumed that Tolkien used the name simply because it evoked the idea of a "bat-monster," rather than bringing along all the common tropes of vampires, like crosses and wooden stakes.
One vampire is named in Tokien's world (Thuringwethil), and Sauron took the form of a vampire at least once.  While they are normally described as bat-like, they were at least somewhat humanoid, as Thuringwethil is described as a "woman of shadow" (emphasis mine).
However, there is no mention of Vampires after the First Age ended, and they presumably became extinct after the destruction of Morgoth.
It's possible that these are the "bats bred for war" shown briefly in the Battle of Five Armies film, although a quote from The Hobbit book implies that the war-bats are merely similar to vampires, not vampires themselves:

"There a host of Wargs came ravening and with them came the bodyguard of Bolg, goblins of huge size with scimitars of steel. Soon actual darkness was coming into a stormy sky; while still the great bats swirled about the heads and ears of elves and men, or fastened vampire-like on the stricken."
Comment: Sauron was probably dripping blood from his throat because Huan had wounded him there, not because he was a vampire. "But no wizardry nor spell, neither fang nor venom, nor devil's art nor beast-strength, could overthrow Huan of Valinor; and he took his foe by throat and pinned him down. Then Sauron shifted shape, from wolf to serpent, and from monster to his own accustomed form; but he could not elude the grip of Huan without forsaking his body utterly."
Comment: "*There a host of Wargs came ravening and with them came the bodyguard of Bolg, goblins of huge size with scimitars of steel. Soon actual darkness was coming into a stormy sky; while still the great bats swirled about the heads and ears of elves and men, or fastened vampire-like on the stricken*" - The Hobbit
Comment: @Richard Interesting.  So that quote would seem to imply that they *aren't* vampires, just similar to them.  I'll add that to the answer.
Comment: @Shamshiel Fair enough.
Comment: The Middle-earth themed MMO The Lord of the Rings Online features beings that are likely based on Thuringwethil, resembling a literal cross between women and bats, and are called Merrevail (singular Morreval) in-game. Fittingly, they are first encountered in Angmar.
Answer: "Vampire" appears to be a blanket term for messengers of Sauron in the First Age, who took the form of monstrous bats. Two characters are identified as having used this shape:

Thuringwethil, Sauron's messenger. She never actually appears in the narrative, but Lúthien borrows her form first to reach Beren in the forest of Taur-nu-Fuin, and then again in an attempt to infiltrate Morgoth's fortress of Angband (emphasis mine):

And [Beren] sang aloud, caring not what ear should overhear him, for he was desperate and looked for no escape.
But Lúthien heard his song, and she sang in answer, as she came through the woods unlooked for. For Huan, consenting once more to be her steed, had borne her swiftly hard upon Beren's trail. Long he had pondered in his heart what counsel he could devise for the lightning of the peril of these two whom he loved. He turned aside therefore at Sauron's isle, as they ran northward again, and he took thence the ghastly wolf-hame of Draugluin, and the bat-fell of Thuringwethil. She was the messenger of Sauron, and was wont to fly in vampire's form to Angband; and her great fingered wings were barbed at each joint's end with and iron claw. Clad in these dreadful garments Huan and Lúthien ran through Taur-nu-Fuin, and all things fled before them.
The Silmarillion III Quenta Silmarillion Chapter 19: Of Beren and Lúthien

Sauron himself takes a vampire's form at least once, to escape from Lúthien and Huan (emphasis mine):

Then Sauron yielded himself, and Lúthien took the mastery of the isle and all that was there; and Huan released him. And immediately he took the form of a vampire, great as a dark cloud across the moon, and he fled, dripping blood from his throat upon the trees, and came to Tar-nu-Fuin, and dwelt there, filling it with horror.
The Silmarillion III Quenta Silmarillion Chapter 19: Of Beren and Lúthien

The Lay of Leithian suggests that there are more of these creatures:

Then up that doorward slowly stood
  eyes shining grim with evil mood,
  uneasy growling: 'Drauglin,
  if such thou be, now enter in!
  But what is this that crawls beside,
  slinking as if 'twould neath thee hide?
  Though winged creatures to and fro
  unnumbered pass here, all I know.
  I know not this. Stay, vampire, stay!
  I like not thy kin nor thee.
History of Middle-earth III The Lays of Beleriand Chapter III "The Lay of Leithian" Canto XII

And an earlier section of the Lay indicates that this shape is characteristic of Sauron's (still named Thu at this early stage) messengers:

the other was a batlike garb
  with mighty fingered wings, a barb
  like iron nail at each joint's end -
  such wings as their dark cloud extend
  against the moon, when in sky
  from Deadly Nightshade screeching fly
  Thu's messengers.
History of Middle-earth III The Lays of Beleriand Chapter III "The Lay of Leithian" Canto XI
Comment: "*By the counsel of Huan and the arts of Lúthien he was arrayed now in the hame of Draugluin, and she in the winged fell of ThurIngwëthil. Beren became in all things like a werewolf to look upon, save that in his eyes there shone a spirit grim indeed but clean; and horror was in his glance as he saw upon his flank **a bat-like creature clinging with creased wings.** Then howling under the moon he leaped down the hill, and the bat wheeled and flittered above him.*" - Silmarillion

Vampires in Middle-earth


Oil cap has come off and oil has spilled after adding oil

Question: I've opened the bonnet to discover that the oil cap is off, and oil is all over everything. How can I get it cleaned up, and what damage will it have caused, if any?
Answer: This was a situation of some surface oil getting on everything but it's an excuse to share my under-hood cleaning procedure.

Warm up the engine just a tad.  Nothing should be painful to touch but should be noticeably warm.
Take your bottle of Simple Green and spray it around the surfaces of the engine bay.  Nothing should be dripping but try to get a bit everywhere.
Get out the hose and wash the rest of the car (with car soap, not Simple Green, don't be silly).
When you're ready to dry the car off, set the sprayer on your hose to "mist."  You want a very little bit of clear water to come out so that nothing drowns in the next step.
Mist down the engine bay.  Note how easily all the grease and dirt washes out from nooks and crannies of the engine.
Marvel at the nice looking engine!
Answer: It shouldn't have caused any damage, as long as there is still plenty of oil left in the engine.
To remove it you will need to use some kind of degreaser - you can buy proper engine degreaser at many automotive suppliers. It is probably worth getting the engine bay properly steam cleaned however, as you'll never be able to get into all the little holes and corners yourself!
Comment: Phew thanks nick the oil has pooled in a few little places and there is luckily only a light covering over the drivers half under the bonnet. Luckily it's a new antara and the engine had a cover over it. Thanks again


What do the Tau battlesuit numbers mean?

Question: Tau battle suits are often dubbed XV88 or XV81, is there a pattern to the number? What does it mean?
Answer: The common consensus is that the Battlesuit number is XV (indicating Battlesuit), followed by two digits, constructed based on size/mass (1-9, light to heavy) and function (1=long-range?, 2=experimental, 4=high-precision(?), 5=stealth, 6=space-faring(?), 8=heavy support), although the functional categories are less clear.
Lexicanum references Codex:Tau Empire, 4th Edition, p.35, and says:

Standard nomenclature has these battlesuits categorized by two numbers
  - the first number denoting which mass class it belongs to, the second its role. For example, in the XV22 Stealth Battlesuit, the first '2'
  denotes it as a lighter-weight suit, while the second '2' means it is
  still undergoing field-testing.

The Warhammer 40K Wiki has more detail:

All Tau Battlesuits are essentially the same pieces of Tau technology
  but can be customized and then given an alphabetical classification
  code of XV, which is followed by two digits. The first digit indicates
  the size of the suit: "1" being a complete exoskeletal version of
  standard Tau body armour, while "8" represents the largest available
  Battlesuits, the Crisis Battlesuits. The second digit indicates the
  role or status of the particular suit design. For example: "2"
  indicates an experimental design, "5" represents a Battlesuit with
  stealth capability, and "8" denotes a Battlesuit outfitted to provide
  heavy fire support. Other variations of a Battlesuit may be given
  different numbers to indicate their functions.

There is also the XV9 close combat suit, which has a slightly different naming scheme, and comes in two weapon flavours, the XV9-01 and XV9-04.
Additionally, the 5th edition codex mentions the XV16 and XV26. There is some speculation that the "6" may refer to a new functional designation, possibly space-faring.
Other letters represent different troop types. A detailed (exhaustive?) attempt to summarise them all can be found here.
Answer: It's a tip of the hat to real life military vehicle numbering which uses letters followed by a model number(F18, M1, ext.).  The letter usually represents a type of item: T for tank, F for Fighter, X for experimental, and so on. The number is the sequence of the model.  F-18 is the the 18th fighter model designation used by the US military.*
It may also be a possible reference to a few popular mecha animes.  XV-88 is pretty close to RX-78 the designation of the mecha in the original Gundam series.  This could be a coincidence, but the Tau do borrow some of their visual ascetic from Japanese manga and anime.
I don't think there's a literal meaning for XV other than it sounds cool and follows the pattern.
*This is after the US military reset their designations.  They where getting up into the f-100s.


Are there any decent UI components for touch screen web applications?

Question: For various reasons a web application would be best suite a project that I am working on but I am worried about the user interface.  There will be a lot of pick and choose options that could be handled by check lists, combo boxes, etc… and to a lesser extent their will be some free text fields.  However, I am concerned about the usability of standard components because users will have to access the application from touchscreen computers that will be wall mounted in a manufacturing environment (i.e. they will be very dirty and poorly maintained).
Answer: We are currently in the process of rolling out an application that is exactly as you describe.  There are a number of issues that you will run into.
You will probably need a "Soft keyboard" at some point. We have not found a decent third party one, but they are not too difiicult to write yourself.
If you want to implement any kind of keypress button that writes text into another control, you need to be able to call the SetStyle() method to ensure that focus does not change.  We found that the Janus button controls did not allow us to make this change so we reverted back to the standard winforms button.
I have not seen any existing component libraries that are designed specifically for touch screens. We have used a combination of the standard winforms controls and the Janus UI components.
If I were starting again now though, I would start with WPF.  It is such a huge improvement over Winforms that it would be an easy choice for me.
If you are really stuck with doing it in a web browser, then I would consider Silverlight as a viable option.  Personally, I would never touch HTML for an application where quick data entry is important.
Don't forget about bar-code input, sooner or later someone is going to tell you they want to do input with a scanner.
Answer: As a touch is translated to a click, you can probably use mostly standard components, maybe supplemented by javascript. I. e., it should be easily possible to implement an onClick event for every label that toggles the associated checkbox.
I'd worry more about the text input. Touchscreen typing (especially when wall-mounted) sounds tedious.
Answer: I'm currently working on a touch screen web application myself and keep wondering when I would "have" to put in a soft keyboard. The modules currently being developed deal only with order entry and retrieval/dispatch functionality and the client wants to limit any input by the call center attendant whereever possible. So no data input yet.
However, I've been searching for a keyboard for a touch screen myself. Darryl, where would you suggest I should begin if I had to write one?
Good luck to both of you!
Answer: You might want to take a look at Baobab Health's open source touchscreen tookit.  It does a nice job converting an html form into a touchscreen interaction using only javascript.  Documentation is a little light, but it might at least be a good starting point.