Making the case for fewer assertions in tests - <AUTHOR> https://assertless.org/ <comment><USER3> A whole domain for a rather minor point like this, which is not even all that correct in the first place?

All the arguments in this article promise very minor benefits.

> When your test breaks, by fail or error, further assertions are never > executed, and test coverage is reduced.

Oh wow. I wish I had your problems. :D

Sure, a failing assertion can hide a bigger problem being there. But most of the time if one assertion fails, rest of the code is useless anyway, and will just generate noise. You could design assertions in a very sophisticated way to minimize that problem, and optimize amount of information... but that's complex and brittle and time consuming.

The whole idea seems like marginal return optimization that takes way too much effort to be worth it. If you have a decent test coverage with well written tests ... you're golden and you probably have more important things to do than trying to tweak your tests to optimize your assertions just in case something sometimes fails during development work.

<comment><USER4> > most of the time if one assertion fails, rest of the code is useless anyway

You either don't write tests or you're already writing them in the right way (sounds like the later). I've seen my fair share of what I would consider compound tests that have multiple asserts in tests that would crash execution of that test even though 3 lines down in that same test is a completely different bit of state being tested. This is hopefully less of an issue in unit tests but my gosh I've seen it way too much in integration tests.

It can get worse still when one of these initial assertions starts failing, a lazy dev goes in to address the problem, finds that one assertion isn't an issue worth addressing for now, labels the whole test as a KnownIssue and moves on leaving us at risk for the other issues covered in the later asserts to break without warning at a later point in time! (only seen this twice luckily)

</comment></comment><comment><USER5> Maybe I'm misunderstanding this, but assuming you require all tests to pass there should be no more code coverage by using "soft assertions", because no assertions have thrown in your tests. The code re-use benefits don't seem that substantial.

I can see this being useful in the development cycle to see more failures that are happening, but there's an overhead to structuring a test that can fail at multiple points – early exits are easy to write.

Maybe I'm missing the point, but I'm not sure I agree that this is something we should be striving for. It doesn't seem to solve problems I have, and seems to introduce additional complexity.

<comment><USER6> I'd say when you run a big suite in CI and it takes an hour and your first assertion of many in a test fails, you don't know if the others also fail or not. You fix it only to wait another hour for the tests to fail again.

<comment><USER7> I mean you have to run the tests again anyway. If the test is in a invalid state then you can't trust soft asserts that pass. It might be meaningfull but fast aborts is easier to reason about.

Even CUnit has specific test invocations via eg. an interactive ncurses session, so any fancy pancy Jenkins monster surely can retest failing tests seperately?

<comment><AUTHOR> > If the test is in a invalid state then you can't trust soft asserts that > pass.

Agreed, which is why I suggest designing each test for a single target state.

That target may then legitimately benefit from multiple assertions, and you have the same problem.

<comment><USER7> Ye at-least for projects with many developers involved. My experience is that tests that tests too much makes QA collapse when the original authors of the tests are gone and no-one know what tests are actually testing implementation or spec.

I use #ifdef:s to enable "intermediate state" and implementation asserts usually to mark them as development tests.

</comment></comment></comment></comment></comment><comment><USER8> Thought about it, and I don't agree that this is a good idea, outside of a few special cases.

Test coverage from failing tests - I can't see being concerned about the coverage of a suite that isn't completely passing. If you have failing tests, you have bigger problems than your test coverage figures.

As for the test continuing, if an early assertion failed, then your state is unknown and can't be trusted. To do this, you'd need to spend a lot of time for every non-terminating assertion reasoning about all of the possible states your system could have that would have caused that assertion to fail, and come up with reasonable things to do in the rest of the test for all of them. I can't see much value in this effort specifically. Better to let it blow up and try to fix whatever caused the first bad assertion to fail.

I think it might be useful to strive for one assertion per test though. Then, you can get a better idea of what's failing and where by how many tests fail. Sounds a lot like the benefit the author cited. Key difference though - <USER2> aren't reasoning about the state of your application after a test failure. The other assertions set up their own state from scratch after the other test's state setup is torn down, so it's either as they expect, or they can blow up too.

</comment><comment><USER9> We have a test environment with this taken to the extreme at work, i.e. integration tests where the whole codebase softly fails and continues whatever happens. IMO the drawbacks are worse than the upside of seeing more errors. Now one errors ends up giving you a lot of failing soft assertions after the first failure which are not useful at all. There is certainly benefit to being able to go through a failure, but it seems better handled at the framework level rather than writing the tests with this in mind. There's already enough unknown in the tests to add possible earlier failing assertions.

<comment><AUTHOR> Interesting, it sounds like you would benefit from breaking each test out into one that focuses on a single target state.

Another layer would be conditional test execution hierarchy where one early failure would skip a set of tests that depend on that state.

<comment><USER9> I agree, but the tests are in the order of minutes (sometimes hours), not your typical unit tests. That's basically why it uses soft assertions, it's costly to run. Ideally you'd still want tests with a single assertion/target state, but it's hard to write it that way.

We also do have this conditional test hierarchy, but again it's hard to properly define when the system under test behaves unexpectedly...

<comment><AUTHOR> > it's hard to properly define when the system under test behaves > unexpectedly...

I feel your pain. I think at that point it's good to look deeper and ask if exceptions are being properly thrown, as I try to call for in the final section on Exceptions.

You can't plan for everything.

</comment></comment></comment></comment><comment><USER10> This has been encouraged by test frameworks for more than a decade; see e.g. [https://testing.googleblog.com/2008/07/tott-expect-vs- assert...](https://testing.googleblog.com/2008/07/tott-expect-vs-assert.html) .

<comment><USER11> I'm not sure how that would work. After an expect fails, why would I trust the results of any other that is passing of failing?

It is true that the tests should be independent, so that one of them failing wouldn't imply on the other being useless. But that requires much more than simply continuing after an error.

<comment><USER10> That's why both assert and expect are in that framework. You still use assert when that particular test failure may prevent other tests from working as designed, but you try to use expect for all independent "leaf" tests.

</comment></comment></comment><comment><AUTHOR> Hey Hacker News, I'm Ross Radford from Austin Texas.

I've been a Senior Engineer in Test for long enough to care about this subject, and I think we'd all be better off using soft assertions, and less assertion in tests generally.

</comment><comment><USER12> The JUnit reference should probably be to ErrorCollector rather than Verifier, since that's what you'd actually use.

ErrorCollector isn't in JUnit 5, and i believe the maintainers think that Assertions::assertAll is a sufficient replacement, which it isn't. I wrote an ErrorCollector for JUnit 5:

[https://gist.github.com/tomwhoiscontrary/4fbf20350700d7e1c35...](https://gist.github.com/tomwhoiscontrary/4fbf20350700d7e1c354b67d62b2895e)

But i'm sure someone could do a better job of it.

<comment><AUTHOR> Thanks, I'll check it out.

</comment></comment><comment><USER13> What's the value in code coverage from failing tests?

<comment><AUTHOR> If one assertion fails early in a test, you lose any subsequent coverage from further assertions.

Maybe you can build your tests such that there's only one assert for each, and if that meets your needs, fine.

If not, or if you're in the process of refactoring your tests into single assertions, this way we can reclaim that coverage.

<comment><USER13> I can appreciate that an automated test that runs to completion will cover more code that a unit test which aborts early. And that using 'soft' asserts lets the test run further than a hard assert.

My question is more basic than that, though.

Perhaps to clarify my understanding: code coverage indicates what code was 'covered' by executed tests. This can be useful to show: what parts work as expected in at-least one case, and what parts of code haven't been covered by tests at all. -- But with code coverage from failing tests, you can't get either of "covered code will work as expected in at-least one case" or "this code isn't covered by tests" (since the code that fails the tests is shown as 'covered'). -- What value do you get from code coverage from failed tests?

<comment><AUTHOR> Short answer: Not all failed test coverage is invalid.

Granted, unit tests benefit less from soft assertions, but I'll take a shot at an example anyway:

Consider a complex object returned from a unit test result (this would be a single target state). That structure could have a missing field that should be reported, but the rest of the fields are evaluated fine, and so that information would be lost if the first assert halted the test.

For functional tests, the value is usually easier to discern, so for another contrived example:

A login form has a failed assert on it's UI structure, say a button is the wrong color, but the login is successful, and the following assertion post- login is also successful.

Ideally, you would assert post-login tests in separate target state, perhaps mocking the login as a pre-condition to another test. For functional tests that could dramatically increase the testing time and complexity, and so this makes a non-halting assertion valuable.

<comment><USER13> Ah, I misread "test coverage" as "code coverage". Whoops.

> Consider a complex object returned from a unit test result (this would be a > single target state). That structure could have a missing field that should > be reported, but the rest of the fields are evaluated fine, and so that > information would be lost if the first assert halted the test.

Right, I'd understand this as 'soft' assertions provide an easier way of making a composite assertion. e.g. I think with RSpec, its matches can be composed; its matchers can nicely return whether a field is missing, or a custom matcher can be written. -- Either way, the point is that a test failure results in the signal that's wholly useful.

> [...say, for cases where an early part of the test fails in an unimportant > way...]

Hmm. I think I'd take this suggestion as: test for 'insignificant' things as low as possible; it's expensive to halt a slow functional test over something that doesn't matter. -- Once something that matters fails, that's the information which is useful for the test to signal.

And maybe it can be useful to warn about insignificant things that do get picked up during the functional test.

<comment><AUTHOR> I appreciate the conversation! That's interesting about RSpec, I'll read more about it, thanks.</comment></comment></comment></comment></comment></comment>


Anonymous Ousted from Twitter and Facebook - <AUTHOR> http://www.readwriteweb.com/archives/anonymous_ousted_from_twitter_and_facebook.php

<comment><USER2> You can call Anon a bunch of script kiddies, but they hit the front page of nearly every major news source today. What have you done for free speech lately?

edit: If you want to help <http://pastehtml.com/view/1c8i33u.html>

<comment><USER3> What has Anon done for free speech? Internet vandalism? I don't think that counts.

<comment><USER4> People who disrupt business operations are bad people and shouldn't be propped up on shoulders. Preventing processing of high risk 3DS transactions and preventing busses from getting people home are both good examples of this.

People give Anon and Parks too much credit in my book.

<comment><USER5> You cannot seriously argue that Rosa Parks "shouldn't be propped up on shoulders" because she instigated the first event in a series of coordinated events that stopped the buses in Montgomery County. She was not a bad person. She made a stand against racial segregation, something we now all acknowledge as unjust.

<comment><USER4> > You cannot seriously argue

No, I cannot. =) Knowing that, reread my post.

</comment></comment></comment></comment></comment><comment><USER6> Just wanted to point out - I don't support what Anonymous is doing. These businesses have been given two shitty choices - piss off the online community or piss off Governments that can roll them over 1000x worse.

And remember, businesses are just people - Anonymous is going to hurt mostly innocent people who work for these companies or work with them, not people who did anything to Assange.

<comment><USER7> Anon isn't doing anything to hurt the people who work for those companies. Those people are paid to handle exactly these kinds of attacks, so if anything Anon is just making sure they're actually earning their paycheck.

The fact that there are only two choices and both are shitty is just a symptom of the fact that we are at a transition point in the relationship between government/business/everyone else.

<comment><USER8> _...we are at a transition point in the relationship between government/business/everyone else._

This transition point is called "history." Plus ça change, plus c'est la même chose.

<comment><USER7> Of course it's just history, but you can't deny that there are points of inflection with regards to certain aspects, rather than interminable gradual change.

<comment><USER8> Yes, but inflection points like the one we're witnessing now are sprinkled all through the past.

<comment><USER7> Then I think we're in agreement -- I wasn't trying to say that there was anything particularly special about this one, just that we're in one.

</comment></comment></comment></comment></comment></comment><comment><USER9> What gets me is that what Anonymous is doing isn't terribly sophisticated. Imagine if they had an overarching military-like strategy and intelligence system to back them up, rather than a stand alone complex like "LET'S DDOS STUFF" and obtaining "docs" on people.

Shit. It makes me want to join in.

Also been thinking for awhile, what's needed is an intelligence clearinghouse.

An open revolution wiki that goes beyond dropping docs to one that mimics the world's intelligence systems. Collating information on organizations, people, things. Linking them together. What makes them culturally tick. Their logistical backbone. Their economic makeup. Their command and information gathering apparatus. Their political connections. Their geo and temporal locations.

A target-centric database that people can extract useable tactical information from, so when the times comes ...

<comment><USER10> You can't do what you suggest in an open, collaborative model. It's too susceptible to malicious actors.

What Anon needs is hackers, not spies. They need people who know what the fuck they're talking about to build tools and strategies. LOIC may be slightly improved, but it's still terrible. Having a bunch of angry skiddies is a great resource, if used properly to shield the activities of more capable members.

Also, it's dox, not docs. /pedantic

<comment><USER9> >You can't do what you suggest in an open, collaborative model. It's too susceptible to malicious actors.

Sure you can. All you need is a suitable counterintelligence and counter- deception wing to crosscheck sources. There's plenty of good open source literature out there on how to set up such a structure (the intelligence scholar Roy Godson's books being one).

>What Anon needs is hackers, not spies.

That's like saying what the military needs is more engineers and less intelligence. Obviously you haven't read your Sun Tzu. To win, you need both. You also need some overarching strategy as well, so far, it looks like Anon is lacking in that department.

</comment></comment></comment><comment><USER11> They aren't stupid, there is an agreement that Twitter and Facebook would only attract haters and stop the recruiting process. Been checking their IRC for some time, the OPs aren't stupid.

For those interested, connect to their IRC through the IP, not the hostname as it isn't resolving aparently: 184.108.40.206

Also, the official Twitter accounts are: @Op_Payback and @AnonOpsNet

</comment><comment><USER12> What Anon is doing today makes me thoroughly proud of The Internet. It's not just Anon's attack on some way-out-there reactions to what WikiLeaks is doing, it's the whole internet's attack.

Days like today restore my hope in humanity and our ability to resist our oppressors.

Sure, it might be illegal. Yes, it will probably cause inconvenience to many innocents. It is very likely somewhat foolish. But there sometimes "The Mob" simply has to retaliate.

Who was it that said People should not be afraid of governments, governments should be afraid of people?

<comment><USER13> So it is OK to harm anyone with no more reasons than a) you don't like him b) you can? And that makes you proud? Mastercard, Visa, Twitter and Facebook are our oppressors? Seriously? Government you elected should be _afraid_ of you? Not accountable, but afraid?

<comment><USER12> Visa et al just got caught in the crossfire, Government made them do something stupid, government gets attacked through the proxy that they did something stupid through. You know the whole, attack their industry shebang.

This is how Governments are held accountable ;) You have to hurt their economy, nothing else sticks.

</comment></comment></comment><comment><USER14> I suppose the DDOS cannon will be aimed at twitter and facebook next then.

<comment><USER15> How will they report their attacks then?

<comment><USER6> IRC and 4Chan

<comment><USER16> Reddit and hn, too!

</comment></comment></comment></comment><comment><USER17> While I am proud of Anon's resolve, I am ashamed of its foolishness.</comment>


A Cloud Guru Has Acquired Linux Academy - <AUTHOR> https://acloud.guru/linux-academy <comment><USER2> Interesting, never heard of A Cloud Guru. LA's content is fantastic, but I feel like, ironically, that they were in a little over their head in the cloud/devops management of their own lab VM infrastructure in AWS. Not sure if they have fixed all that, but they would never stay up, and DNS names to the instances would either never work or fail after a bit, leading one to be forced to remove the lab instances and start all over from scratch, with all your lab work to that point gone with it...

Perhaps A Cloud Guru can improve some of these processes.

<comment><USER3> A Cloud has excellent courses especially for AWS but (at the time) they lacked any lab environments. This deal seems like it will help plug that gap.</comment></comment>


Swift Toolbox – community-supported catalog  of iOS and OS X libraries - <AUTHOR> http://www.swifttoolbox.io <comment><AUTHOR> We would love to hear your feedback. This project is very MVP and definitely has some issues that we will be iterating on over the next week.

Any features you would like to see, let us know. We plan on adding a much nicer view for all the libraries with more information. The ability to the community to add tags to existing libraries, and more.

Hope you guys enjoy!

<comment><USER2> What about some kind of integration with CocoaPods? Seems like there's going to be some duplicated effort here.

<comment><AUTHOR> Yep, going to look in to this in the near future. Going to talk to someone at CocoaPods on Friday.

<comment><USER3> Awesome!

</comment></comment></comment></comment><comment><USER4> As a non-Mac person, it's fascinating to see the difference in interest between Swift and Dart. Sounds like you can do "incremental progress" and succeed (Typescript), "radical progress" (Swift) and succeed, but something between the two doesn't work, at least as far as community uptake is concerned.

<comment><USER5> One possible difference is that Apple has signaled that Swift will be _the_ language at some point. As far as I know Google didn't do that with Dart and, in fact, couldn't without getting buy-in from all the other browser vendors.

<comment><USER6> > One possible difference is that Apple has signaled that Swift will be the > language at some point

Have they? Then I really hope they add some easy form of C++ interop to swift in a future release.

There's so much C++ code out there in the Mac/iOS world that rewriting it to swift (or even just wrapping it in C) would make no economic sense.

<comment><USER7> Since you can use Objective-C (and therefore also Objective-C++) libraries directly in Swift, it actually has quite a nice integration. Objective-C++ is a far better interface layer than something like FFI or having to write C wrappers for everything (as you see in most other languages).

<comment><USER8> Nitpick: Objective-C and C are terrific for interoperation. FFI works pretty well with Obj-C and C too because it is all based on C binary compatibility and predictable symbol mangling. This is how previous Apple language bridges like PyObjC and RubyCocoa worked.

C++ and thus Objective-C++ has always been a disaster for FFI or anything that depends on binary compatibility or predictable symbol name mangling. Obj-C++ has a lot of ugly areas partly because of this. Kudos to Apple to making it work as well as it does.

Swift is terrific that it also seems to interoperate with C/Obj-C nearly seamlessly (bridging headers), but it is no surprise that the Swift documentation immediately says it doesn't support C++ and you must build C interface wrappers.

* Edit: reclarified comment

</comment></comment></comment></comment></comment><comment><USER9> Awesome project I know I'll use several of this packages. It would be awesome to list the packages CocoaPods name if it has one. So it's easy to install.

<comment><USER10> CocoaPods does not support pure Swift libraries yet. This Github issue lists some ways you can help: [https://github.com/CocoaPods/CocoaPods/pull/2222](https://github.com/CocoaPods/CocoaPods/pull/2222)

</comment></comment><comment><USER11> Would it be acceptable for me to submit someone else's package? Can they edit tags/etc?

Oh, and nice idea. I've been waiting for something like this. Ideally, I'd like to see something a package manager like brew or apt.

<comment><AUTHOR> It would be acceptable. We will be adding the ability for the repo owner to manage the entire project, but also the community will be able to add extra tags, etc. These are in the upcoming weeks as we iterate on it.

</comment></comment><comment><USER12> This is a great help for someone like myself who is just learning Swift. Pretty excited for some of the JavaScript style libraries being ported over to Swift.

<comment><USER13> If you are just starting out, checkout [http://www.sososwift.com](http://www.sososwift.com) It has tons and tons of resources.

</comment></comment><comment><USER14> Good idea.</comment>


Public Transit Unions - <AUTHOR> https://pedestrianobservations.wordpress.com/2016/07/16/public-transit-unions/ <comment><USER2> I'm curious how the imminent roboticization of public transit will play out. I'm sure management everywhere is waiting eagerly for this tech to roll in.

<comment><USER3> And to be honest, so are any commuters on lines where drivers strike

<comment><USER4> The UK then.

<comment><USER5> There've been a bunch in the Greater Toronto Area in recent years, as well.</comment></comment></comment></comment>


A Message to Our Users - <AUTHOR> https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-users/ <comment><USER2> I think thats fair. All of us who have written and deployed software know that a change in the onboarding/new users rate like this would be a punch in the face that would knock any SW team on its ass. And it would take anyone a few days to get back up.

The important part is the leaderships reaction to the situation. Compare to something like Boeing. Zoom acknowledges facts, takes responsibilty and starts fixing things. Boeings reaction to its product killing hundreds of people was "Lol user error. RTFM". That is (apparently) what acceptable leadership can look like..

Any sw product has issues. The question is what the company does about it

<comment><USER3> Err, no. It would be understandable if their servers buckled under the load or something. Zoom's blatant disregard for their users' security and privacy is unacceptable regardless of whether they have 5 or 5 million users.

> Any sw product has issues. The question is what the company does about it

See [https://news.ycombinator.com/item?id=20389812](https://news.ycombinator.com/item?id=20389812), [https://news.ycombinator.com/item?id=20390755](https://news.ycombinator.com/item?id=20390755)

<comment><USER4> And more recently, Zoom Is Leaking Peoples' Email Addresses and Photos to Strangers

[https://news.ycombinator.com/item?id=22753675](https://news.ycombinator.com/item?id=22753675)

<comment><USER5> I let out an audible "wow" upon reading this. This is absolutely bone-headed and I have no idea how they thought automatically grouping members by their email domain name was a good idea.

You gotta figure, as soon as you starting writing a blacklist of "common" domains like gmail.com, hotmail.com, etc, your immediate thought should probably be "wait, maybe we're doing this wrong."

<comment><USER6> You're right but I absolutely see why they are doing this. When I saw all my colleagues in the company list I immediately figured they only have the email domain and I found it extremely useful to see whom I can contact without explaining how zoom works. Privacy isn't our most important concern right now, it's keeping the world running, and this "feature" helped me/us (if only just a little bit) communicate more effectively.

<comment><USER7> I don't mean to be overly snarky, but removing authentication from all computers and servers would also help everyone (if only just a little bit) be more effective. It's still a bad idea, crisis or not.

<comment><USER8> Yep. And at the other end of the spectrum, never having users is the easiest way to maintain user privacy and security.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Key section:

> _Over the next 90 days, we are committed to... Enacting a feature freeze, > effectively immediately, and shifting all our engineering resources to focus > on our biggest trust, safety, and privacy issues._

I see a lot of comments here claiming that this blog post is bland corporate apologia, doesn't take responsibility, doesn't change anything.

But this seems like a pretty legit turnaround. Overall, they seem to be addressing pretty much everything that's been brought up. They removed the Facebook SDK, they removed attention tracking, they've clarified their encryption policies in detail.

One commenter here is asking for more, for _punishment_ , another demands their security team be fired. And I mean, if someone wants to try to sue Zoom for misusing the term E2EE then go for it, but obviously Zoom can't "punish itself" in a blog post, and pinning it on a few bad engineers feels like a scapegoat.

This seems to be positive steps, folks. Genuinely not sure what more you could be asking for from a regular for-profit business.

<comment><USER10> > One commenter here is asking for more, for punishment, another demands their > security team be fired. And I mean, if someone wants to try to sue Zoom for > misusing the term E2EE then go for it, but obviously Zoom can't "punish > itself" in a blog post, and pinning it on a few bad engineers feels like a > scapegoat.

A portion of the development community loves to talk about blameless post- mortems and a blame-free culture until a tech company like Zoom does something they don't like.

<comment><USER11> I think it's generally a poor assumption to assume that any two internet "crowds" are the same people. Some commenters care about X and some about Y and we can almost never tell what the overlap between those groups is. The hivemind is not as uniform as that.

<comment><USER12> Well said, and it applies beyond just "internet" crowds. Some people think whole nationalities work as uniform hiveminds.

</comment></comment></comment></comment><comment><USER13> I am tired of reading such statements. They are like a playbook when things get wrong.

Zoom had privacy and user invading issues years back. They didn't learn their lesson back then with the MacOS installers, and continued to assure us they are taking the "right steps".

My company have stopped using Zoom and we'll never go back.

<comment><USER14> They admitted problems and deployed fixes. All while massively scaling during pandemic.

I'm honestly curious, what could CEO say differently?

<comment><USER3> None of the actual issues are related to scaling at all.

<comment><USER15> Bingo, they straight up lied about E2E, bypassed security features, sold user info and hacked their way into self installing.

Plus blaming all the issues on consumer use cases is hilarious. That might work for like a company that makes fiber lines for commercial deployments or something However, it's like they forgot that their core video might be B2B, but the client is almost always B2C and always has been. The fact that you are forced to use the Zoom client/plugins to attend a Zoom meeting may make the business case enterprise, but they have always been taking these horrible stances on the client and harming normal people who can't choose to use something else.

</comment></comment></comment></comment><comment><USER16> Zoom has had major security issues for years, and they've always brushed them off as not a big deal. This isn't an isolated incident.

If their position is now that the Zoom software was designed for corporate users, e.g., that you're expected to only run it on your own VPN where you can guarantee there's no malicious network traffic, then it should have "NOT FOR CONSUMER USE" plastered all over it.

To me, this reads _exactly_ like "Lol user error", except there's no "M" to "RTF" that ever said, for example, that its local web server stayed running after uninstallation and could take control of your camera, or that "E2E" in the Zoom docs doesn't mean the same thing as it means to the rest of the industry.

There's no responsibility being taken here. Taking responsibility would be "We fired all our 'security' people who told us we had best-of-breed security, and hired some actual security experts to re-architect our system to provide actual security for our users." What they did here is indistinguishable from "We're sorry we got caught!" except in verbosity.

<comment><USER8> > Zoom has had major security issues for years, and they've always brushed > them off as not a big deal. This isn't an isolated incident.

But here's the operative question: were they wrong to set their priorities the way they did? In this crisis, they're wildly popular, and part of that popularity comes from optimizing for usability and advertising to close the deals that got their product in front of enough people to be a "household name" when everyone suddenly needed videoconferencing.

If people want security, GChat is built on top of Google's infrastructure, has almost no outstanding security issues, and years of engineering behind making it a quality product. And users don't care enough about security for that to be the tool people are reaching for right now.

Business is an art, and that art is the art of making tradeoffs to meet users halfway. And time and again, the product that thinks users need to be met halfway at "it's secure" gets trounced by the ones who meet users halfway at "It's usable."

> We fired all our 'security' people who told us we had best-of-breed security

Why, in a crisis, would you _start_ by firing the people who already know the inside of your application, warts and all?

<comment><USER17> > _here 's the operative question: were they wrong to set their priorities the > way they did?_

Yes. Let me ask this the other way, in a different context.

Say your company builds rapid-assembly prefab building components. You have built the business on being supposedly greener than the competition, by using natural materials where possible. All of a sudden there is a massive surge in demand, and you find out that certain cost-cutting optimisations that used to be merely mildly beneficial, actually provide a marketing edge.

Does it matter that your fire-proofing is a naturally occurring material? Namely, asbestos?

<comment><USER8> 1) Is there a better fire-proofing alternative available, one that will work as well and be as cost-effective to deploy?

2) Are we talking about 1990 (when the public actually cared, legal torts were likely, and it was a huge hassle to sell a property that was known to have asbestos) or 1890 (when in spite of evidence that asbestos may pose a health risk, industry was full-speed-ahead on it because, hey, everything poses a health risk, and lung cancer was of lower concern to the public than dying in a fire)?

</comment></comment></comment></comment><comment><USER18> I struggle to understand why the sudden influx of new users would affect these security problems in any way. OK, more people are affected, but the problems are surely the same regardless of how many users they have.

To me it just comes across as an attempt to deliberately confuse the issue.

<comment><USER19> They address this specifically in the article:

> Dedicated journalists and security researchers have also helped to identify > pre-existing ones.

Sure, you could translate that as "more eyeballs have uncovered our sloppy security" if you'd like, but it doesn't strike me as dishonest.

<comment><USER20> This is cunning PR diversionary bullshit.

<comment><USER21> Not cunning; it's a low effort hand wave. The rest is true.

<comment><USER22> If a team of career PR folks meticulously iterating on the precise wording of this message to frame the narrative in their favour doesn't count as "cunning" to you, I don't know what would.

<comment><USER23> I believe "cunning" is not about intent, but the action's effectiveness.

As an attempt to mislead or imply that there are no problems here, this is pretty much a failure, and thus not at all cunning.

<comment><USER22> That feels backwards. One can certainly intend to be cunning!

<comment><USER23> If you can intend and fail to be cunning, then the word's meaning must not be defined by the subject's intent.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> > "On March 29th, we updated our privacy policy to be more clear and > transparent around what data we collect and how it is used – explicitly > clarifying that we do not sell our users' data, we have never sold user data > in the past, and have no intention of selling users' data going forward."

That is such a dishonest way of framing it. No one was really concerned whether they would "sell" data. The issue was with the exorbitant amount of data they collect and its analysis for commercial purposes, be it ads (which doesn't involve selling data), targeted pricing or providing access to corporate admins.

<comment><USER25> Surely as this comes from the FB lib zoom are not an outlier here? Why the sudden pearl clutching at zoom when everyone is using facebook, google and any other site that has facebook tracking built in?

<comment><USER26> I work very hard to keep Facebook out of my life. I run an ad-blocker and I don't log into my (inert) Facebook account outside of privacy mode (or a VM). Unfortunately, I don't have a choice about using Zoom. So it sucks that I'm effectively getting backdoored with this nonsense. Why is it OK to expose my information to an advertising company like Facebook without asking for permission first? Because everyone else does it?

<comment><USER25> agreed, I'm the same except i have no FB account.

I can't help but feel this sudden Zoom "panic" is coming from large (and incompetent) tech companies who are not happy with an upstart.

</comment></comment></comment></comment><comment><USER27> "We didn't design for for scaling overnight" is different from "we did care for security until we got caught"

However small or big, a company shouldn't be selling data without user consent, shouldn't use terms end-to-end encryption while make otherwise claims.

This behaviour should be punishable

<comment><USER28> Facebook did that (e.g. [https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana...](https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal), funny stuff they did to circumvent GDPR). And Who cared? There was some noise in the media and that's all. Was Mark Zuckerberg punished? For me all this Zoom bashing looks a bit as if those guys stepped on someone's toe, who does not like the idea of having another competitor in the social media/online advertising area.

</comment></comment><comment><USER29> This is "we are sorry for getting caught" changes-nothing nonpology.

The use of "end to end encryption" designation was no confusion, it was deception - it is implausible that this could have been done accidentally or as a result of a misunderstanding without engineers warning managers that this is not how zoom works and being overridden in their objections to communicate it as such.

They also double down on data collection. Disclosure does not establish consent and "we do not sell data" is a red herring because data can still be shared with third parties for business purposes against the interests of the users without being overtly sold (not to mention with governments under various "compelled cooperation" arrangements) and the entire policy can be subject to retroactive change without recourse.

The fact that they were targeting organizations with IT support is irrelevant except maybe to discredit the people within those organizations who greenlighted Zoom.

The saddest part is that it is unlikely any of the competing corporate offers are any better in any of those respect, but then they are not being actively pumped these days.

<comment><USER30> > This is "we are sorry for getting caught" changes-nothing nonpology.

True, but I am still happy to see it. It shows that they got burned and that they noticed and felt the burn. It remains to be seen how they follow up — I will be watching closely.

<comment><USER29> People who care and have the time to spare might, but this is standard PR crisis mitigation technique and the goal is to have a large mass of the users thinking "ah, this was just a mistake made under pressure in crazy times, zoom is ok now, still convenient".

</comment></comment></comment><comment><USER8> Zoom seems to be another example of the repeating pattern we seem to see from web service software: if the product has good UX, people don't care about the technical issues that aren't in their faces. At least, they don't care in any tangible way like "They stop using the product."

Remember when Twitter was incredibly unstable? That was fine when it had only ten thousand users. They had to fix it fast when it had a million. But the thing is: that seems to be viable software practice (rush on features, forget about the robustness and the corner cases) because it keeps working.

</comment><comment><USER3> "Oh no, it used to be alright that we are shady as hell, because, you see, we never thought anyone would actually use our service!"

Give me a break..

</comment><comment><USER31> _" Removed the attendee attention tracker feature."_

Oh, I missed that one. [https://support.zoom.us/hc/en- us/articles/115000538083-Atten...](https://support.zoom.us/hc/en- us/articles/115000538083-Attendee-attention-tracking)

</comment><comment><USER32> I want to share my solution for remote collaboration and teaching: [https://github.com/amkhlv/mathpump3](https://github.com/amkhlv/mathpump3)

Professor uses Wacom and Inkscape to draw a picture, which is incrementally transmitted to students' computers. Students, those who have Wacom, may interact. Or just watch. Transmission happens every time the svg file is saved. Transmission requires a RabbitMQ server, which can be easily set up. Basically, a class needs one person who knows Linux, to set up the server.

It is intended for scientific collaboration or teaching in small groups of people. I am now using it for teaching my QFT class, although it only has 5 students. In principle, it should scale, but I have not tried it for large groups...

Drawing with Wacom in Inkscape is a pleasure, once you get used to it. In some sense, it is more convenient than using a physical blackboard. Although, some training is needed...

<comment><USER33> Awesome idea! Is there much overlap in the area where a professor has a wacom and also has a student that knows linux?

</comment></comment><comment><USER34> The moral of the story is once again that focusing on user acquisition at all costs is an effective strategy. MongoDB disregarded reliability, Youtube disregarded copyright, Reddit faked comments, Facebook disregarded privacy. Yet they were all ultimately successful. Could it have happened differently ? Not so sure.

<comment><USER35> "Move fast and break things." I'm afraid getting there first is pretty much imperative.

<comment><USER36> Honestly, I don't understand why this site seems to hate Zoom so much. They're doing what all of the large players have done in the past. Why aren't they being congratulated for their success?

This is not meant to be snarky. They are literally living by the move fast and break things motto. Growth at the expense of everything else to win the market first, fix it second.

How are they not the golden child of SV right now?

<comment><USER37> It's just 2020 speaking, people outraged on the behalf of users who honestly don't care and just want easy to use videochatting.

This is just a symptom of ycombinator becoming a more widely known social network. All the malaises of social networks like pointless discussions about morality without any concrete solutions are coming along with that.

<comment><USER38> > _pointless discussions about morality without any concrete solutions_

The correct response to many moral issues is not to create concrete solutions, but simply to stop people from doing bad things.

</comment></comment></comment></comment></comment><comment><USER39> For anyone excusing any of this, Zoom is currently a 34bn dollar company. There really are no "whoops, didn't expect to get this popular" excuses that are legitimate for all of these issues; especially when none of these things have to do with scaling and are instead just boneheaded design decisions.

<comment><USER40> "34 billion" is the fake Silicon Valley price tag. And they get there by rushing like a bunch of idiots to a hollow Hoover Dam of a product that looks great to everyone from the outside.

<comment><USER39> Zoom is a public company. The CEO owns 4% of it.

</comment></comment></comment><comment><USER41> > "We want to start by apologizing for the confusion we have caused by > incorrectly suggesting that Zoom meetings were capable of using end-to-end > encryption. Zoom has always strived to use encryption to protect content in > as many scenarios as possible, and in that spirit, we used the term end-to- > end encryption."

Excerpt from their previous release above, only a few hours earlier.

Glad to hear they are starting to make improvements but waiting for public backlash to fix issues is a bad sign.

</comment><comment><USER42> While I think Zoom has a lot of work to do from a security perspective, overall I think we should be supportive: facilitating -- mostly for free! -- very low friction video calls between an enormous number of isolated people is an incredible service.

</comment><comment><USER43> What is a security focussed open source / self-hosted alternative to Zoom with comparable UX?

<comment><USER44> [https://jitsi.org/](https://jitsi.org/)

<comment><USER45> [https://meet.jit.si](https://meet.jit.si)

</comment></comment></comment><comment><USER46> December 2019: 10M daily participants. March 2020: 200M daily participants. A sustained 20x spike in usage. And it's still working! I think that's amazing.

Think through this situation — 90,000 schools suddenly using Zoom, children doing their classes. What is most important: option 1) it just works option 2) it's 100% secure

Imagine you were a member of Zoom's team, would you not be justified in feeling proud right now?

<comment><USER47> > Imagine you were a member of Zoom's team, would you not be justified in > feeling proud right now?

It has nothing to do with scaling. The problem is the numerous anti-privacy and anti-safety measures that they actively partook in. Those were no "features missed out" due to rapid development. Those were anti-user features purposefully developed in. This is what people are complaining about; and this is what the zoom manifesto is shamefully trying to brush off as if they were related to rapid development or to rapid scaling. If I was a member of the zoom team (who hadn't actively participated in these features), I would be extremely ashamed of my company for spoiling our success with these damaging practices.

<comment><USER46> I have to believe the aim of these features was to make it easier for Zoom to be installed and to "just work." I'm inclined to give them the benefit of a doubt right now.

</comment></comment></comment><comment><USER48> I don't know exactly what is the main security issue right now, but as I understand it, it's mostly related to this: [https://www.bleepingcomputer.com/news/security/zoom-lets- att...](https://www.bleepingcomputer.com/news/security/zoom-lets-attackers- steal-windows-credentials-run-programs-via-unc-links/) (on Windows).

The windows changelog[1] doesn't talk about a version released on April 1st, like the press release says[2].

So is the only way to mitigate that issue for non-techie users is to deactivate the chat feature for all conversations?

[1] [https://support.zoom.us/hc/en-us/articles/201361953-New- Upda...](https://support.zoom.us/hc/en-us/articles/201361953-New-Updates-for- Windows)

[2] [https://blog.zoom.us/wordpress/2020/04/01/a-message-to- our-u...](https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-users/)

</comment><comment> Nevada-Smith "Thousands of enterprises around the world have done exhaustive security reviews of our user, network, and data center layers and confidently selected Zoom for complete deployment."

Interesting that he would point out the failure of thousands of IT departments around the world.

<comment><USER49> that jumped out to me as well. I'm in a large org that uses Zoom, not company- wide, but certainly in several departments. We have a SaaS questionnaire that vendors need to submit for review as part of the procurement process.

With everything that's come out since (not just the iOS client issue), I'm wondering how deep that questionnaire goes with regards to security concerns.

</comment></comment><comment><USER50> Zoom added the Facebook SDK. When they got caught they removed it. Great! But what about a statement that they will provide a user-focused third-party security assessment on a regular basis so that users know there are no other issues?

People need transparency.

</comment><comment><USER51> "It takes 20 years to build a reputation and five minutes to ruin it" -Warren Buffet

They didn't even bother to build up a reputation; hard to see how they're going to build respect for people's privacy and security into their culture now.

</comment><comment><USER52> I find the whole ganging up against Zoom disgusting. Mac-fanbois-cum-security- experts blaming Zoom for the deficiencies of a) their platform not having a working native teleconferencing solution and b) their platforms arbitrary installer policies.

Then there's the issue that Zoom is now suddenly responsible for the complete lack of security awareness of teachers and middle managers who have never before held online classes, and are publicly posting meeting credentials so that everyone can join.

All, of course, while the while world is free loading (yes, "you are the product, hurr durr"; great contribution).

</comment><comment><USER53> I think we need to acknowledge the fact that Zoom, and its use of cloud infra, took on 20x peak volume of 2019 within just a few months.

</comment><comment><USER54> I think this is a necessary move on their part.

And they obviously have the business and engineering talent to make a good product (it's better than their competition, I'll grant).

But how much of their market share came because of some nefarious business and technical practices?

Forgive and forget, 'cause "correction"?

</comment><comment><USER55> Off topic, but it would be nice to mention Zoom in the title, it's pretty ambiguous otherwise

</comment><comment><USER56> > On March 27th, we took action to remove the Facebook SDK in our iOS client > and have reconfigured it to prevent it from collecting unnecessary device > information from our users.

Sounds like folks at Zoom take privacy and security related feedback pretty seriously.

</comment><comment><USER57> I'm pretty new to Zoom. It always seems to take me a while to get to the option of using the web browser instead of the executable. Is there an easy way (e.g. URL structure) to force the web-browser-meeting and skip the download dialog?

<comment><USER57> Answering my own question: the URL to use to force using the web browser instead of the download is: [http://zoom.us/wc/join/{your-meeting- id}](http://zoom.us/wc/join/{your-meeting-id})

</comment></comment><comment><USER58> Through this I learnt, for the first time, that they also send data to Linkedin.

<comment><USER59> That's a enterprise integration, you can view participants' LinkedIn profile which is very helpful if implemented right.

[https://marketplace.zoom.us/apps/ex1KIG08R3-ctKCi65YePA](https://marketplace.zoom.us/apps/ex1KIG08R3-ctKCi65YePA)

<comment><USER60> >With Zoom's LinkedIn Sales Navigator integration, you'll build connections and instantly gain insights about your meeting participants.

Sounds pretty creepy. I assume participants have to opt into this?

</comment></comment></comment><comment><USER61> BS

</comment><comment><USER62> What a load of crap...

First, some background: our platform was built primarily for enterprise customers – large institutions with full IT support

These new, mostly consumer use cases have helped us uncover unforeseen issues with our platform

Never ever gonna use zoom.. I got rid of it a long time ago when I found out about the malware...

</comment><comment><USER63> Maaaan, the /wordpress/ in the URL really knocks home how slapdash this whole operation is.

And this wasn't anything but an acknowledgement that they're not qualified to produce the software they're distributing. They still don't even know what they don't know.

<comment><USER64> Do you really think they're not "qualified" to produce video conferencing software? Does that seem like a reasonable statement? I am genuinely curious if you think a public company with millions of users and fairly reliable quality is not "qualified" to deliver its own product.

<comment><USER63> I'm genuinely curious if you think that company status, bank balance or number of users translates into software quality.

I posit that Zoom has been right place, right price. Simple as that. The software is demonstrably hot trash. Not just at client endpoints but structurally.

<comment><USER65> Right place, right price, pretty-much flawlessly working video chats. The latter point is just as important (there's a bunch of free video chat products), and suggests it's not completely trash.

</comment></comment></comment></comment><comment><USER66> I know this is banal but f __k these guys.

<comment><USER67> Please don't. You may not owe "these guys" better, but you owe this community better if you're posting to it.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment><comment><USER68> A message in the right direction, but they need to solve the recent macOS security issues. Let's give them the time to (transparently) correct all the recently reported issues.

<comment><USER69> It's a template PR / sales pitch talking about how great they are and how they've had to adapt during the COVID-19 crisis (all of which aren't relevant to the security and privacy complaints being made) and there's only a boilerplate message about how they care about their users....and it's such a generic message it could have been ripped out of any other correspondence sent from any other company.

Nothing about that message came across as sincere.

Also one of the biggest core issues (their installer) was widely reported and condemned last year (or was it the year before?) so these aren't all new issues coming to light. In fact blaming the visibility of these problems to an influx of new users (re COVID-19) is just dishonest.

<comment><USER70> Because we're technical and can smell the BS miles away. But a lot of the people deciding whether to keep using zoom at their corporation aren't technical and it might be reassuring enough for them to keep using it. Not saying that's ok but here we are.

<comment><USER71> "We're technical" is no excuse for a pitchfork mob. I'm technical and HN's reply feels more like echo-chamber than a reasoned consideration of what they said. Almost every comment as of now is people reacting to the tone and dialect. It's like there's nothing to object to technically and so the mob has turned their rage onto speech patterns.

<comment><USER69> > _It's like there's nothing to object to technically and so the mob has > turned their rage onto speech patterns._

I'm usually the first to roll my eyes at such mobs but this case is different. When you have a company that has a documented past of privacy and security violations and then releases a letter saying "sorry about the new reported problems but you wouldn't have known about it if we weren't so popular lately," you can hardly blame us for getting ranty. It just demonstrates that fixing those problems was never a priority and thus that press release is really just meaningless platitudes.

<comment><USER71> I absolutely blame us for pitchfork mob behavior in the initial reply, even if there's a risk that Zoom is misbehaving intentionally. Theories about their motivations are no excuse for this. There is _never_ an excuse for this. This behavior is unprofessional of us, disrespectful of us, and makes HN look no better than 4chan or Reddit to anyone who sees us doing so.

<comment><USER69> Which initial replies are we talking about? The one I wrote was literally just calling out their statement as being generic, templated and "hogwash". I don't see what's disrespectful nor unprofessional about that.

As for other people's comments, if others took it too far (I haven't read the majority other other comments since I came to this early and haven't ventured outside of my thread since, so you'll have to excuse my if ignorance here) then perhaps you should be taking that up with them rather than me?

In any case, I don't appreciate being lumped as part of a "mob mentality"! My own opinions are my own and not the product others.

</comment></comment></comment></comment></comment></comment></comment><comment><USER72> Translation: "We are _SO_ sorry that we got caught and that you _feel this way_ about us. Let's see if we can react to this situation fast enough before everyone will start replacing us with alternatives that at least have a better reputation." ... yeah, give me a break!</comment>


We're Baking 'Have I Been Pwned' into Firefox and 1Password - <AUTHOR> https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/ <comment><USER2> I have such great respect for Troy and all the work he's done/is continuing to do to promote good security practices. I just went on HIPB though and noticed the advise for better security is "use 1Password" (after checking your email for compromises).

This just seems a little too commercial to me and I'm not sure I like the phrasing. I fully understand the need for Troy to be sponsored and it's great that 1Password works well with his tooling, but it's _not the only solution_. I'd feel a little less uneasy if it was phrased in such a way as "Use a password manager, like 1Password".

<comment><USER3> This. I am using LastPass for example, because it is probably only password manager, where you can completely disable auto-fill (you need to click on an input field and then pick a profile - so it is "on demand" fill) which makes automatic harvesting attacks much harder. I have switched from 1Password exactly for that reason - 1Password is very aggressive in filling input fields for you.

<comment><USER4> LastPass have a horrible security track record.

I've even caught them editing their wiki page, trying to erase their past, which was reverted thanks to HN.

<comment><USER5> Not-so-happy LastPass user here: I evaluated alternatives, but LastPass is the only one which somehow works on Linux/Firefox. I have even tried to make pressure to 1password about that, without much success: [https://discussions.agilebits.com/discussion/comment/410603/...](https://discussions.agilebits.com/discussion/comment/410603/#Comment_410603)

<comment><USER6> BitWarden works fine. I'm using Linux/Firefox as well, the rest of the time is on Windows/Chrome. It's 100% open source: [https://bitwarden.com/](https://bitwarden.com/)

<comment><USER7> I stopped using browser based password managers and switched to KeePass. It's a bit more work to pull passwords and back them up, but for me it beats trusting cloud services with security critical data.

<comment><USER8> This! I love my setup. I use KeePassXC and sync my password db with NextCloud. I love having an open source password manager that is useful across all of my devices, be it Android, Linux, Mac or Windows.

<comment><USER9> KeepassXC, syncthing, and keepass2android here.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> As many have commented, this isn't a new tool for technologists.

The goal of Firefox Monitor is to bring this functionality to non-technical users, which requires a lot of user experience research to inform without scaring people away from using the internet.

<comment><USER11> I'm confident that this is a first step towards integrating it into Firefox itself.

1\. Test Firefox Monitor on the web

2\. Integrate it for all Firefox users

</comment></comment><comment><USER12> One feature I wish HIBP had was support for sub-domain addressing [1] and plus addressing [2].

My main email address has the format 'firstname.lastname@example.com' and receives alerts from HIBP if found in a data breach, but all of the related subdomain-based email addresses do not (e.g. firstname.lastname@example.com, firstname.lastname@example.com etc.)

Based on the 1Password screenshots in the linked article it would appear that specific support for sub-domain/plus addressing may not be required?

However, Firefox Monitor looks like it has the same limitations as the HIBP website/API and makes the alerts somewhat less useful when using sub- domain/plus addressing.

[1] [https://www.fastmail.com/help/receive/addressing.html](https://www.fastmail.com/help/receive/addressing.html)

[2] [https://haveibeenpwned.uservoice.com/forums/275398-general/s...](https://haveibeenpwned.uservoice.com/forums/275398-general/suggestions/6774229-enable- search-and-notifications-for-email-addresse)

<comment><USER13> You can sign up to get notifications for an entire domain, meaning that you can get notifications for any email with the "example.fastmail.fm" domain.

See here: [https://haveibeenpwned.com/DomainSearch](https://haveibeenpwned.com/DomainSearch)

<comment><USER12> Thanks! I will give that a try.

</comment></comment></comment><comment><USER14> I recently wrote a small tool to download the whole password database from HIBP and turn it into a Bloom filter that can be used from Golang or Python.

The tool also includes a webserver that lets you check for plaintext password matches (only recommended over a secure network) and SHA1 values:

[https://github.com/adewes/have-i-been- bloomed](https://github.com/adewes/have-i-been-bloomed)

The filter is about 1.7 GB in size with a 10e-6 false positive rate, so it can be used even on moderate hardware to check user passwords against the database (the entire filter must be loaded into memory currently, though it would be possible to use a memmapped file).

<comment><USER15> You don't need to download them from HIBP. You can freely download all major breach databases from databases.today. There really aren't many passwords not represented in those databases which are present in others, but for everything else you can just automatically download grab dumpmon like Hunt does.

Also, try google dorking site:vk.com/doc and "@gmail.com"...there are many large password and email databases you can find that way which have not been publicized. This includes many which are not in HIBP. I've tried to call attention to this before but there isn't an active effort to crawl these.

Once you download, normalize and deduplicate the entire corpus of password databases, you can find matches in real time for e.g. signup requests.

</comment></comment><comment><USER16> Congratulations @troyhunt Your project's making a bigger difference around the world.

</comment><comment><USER17> I'm worried that this will just train people to start blindly clicking through "pwned password" modal dialogs for CVVs and OTP/SMS 2FA codes, just like they did for the "Do you want to view only the webpage content that was delivered securely?" dialog in MSIE.

<comment><USER3> The wide public is not so interested in secured content really imo, but they will rarely ignore warnings about their passwords. The password is like a pin for your debit card. You don't mind people seeing your card (unsecured content), but you will not share your pin code (password).

<comment><USER18> Next time you are in a checkout line, pay attention to how few people make any attempt to prevent shoulder surfing their PIN. POS devices have gotten better with shielded keypads, but there are still many machines that make it somewhat difficult to obscure your PIN. The average person gives very little thought to security, or at the very least gives little thought to possible threat models.

</comment></comment></comment><comment><USER19> Make sure to not do it automatically, but on user interaction (like new Safari password fills). Otherwise you leak usernames and tie them to browser sessions which can be fingerprinted.

<comment><USER20> I think this is addressed by the use of k-anonymity which is described in the section of the article titled "Enabling Anonymous Searches with k-Anonymity".

</comment></comment><comment><USER21> This uses HIBP for the underlying dataset. I'm not sure what's added though. Convenient UX? They claim to only send anonymized data out, but HIBP already supports the underlying hash range queries -- that doesn't appear to be new here.

<comment><USER22> I suspect it'll warn you if any of the accounts you've saved in Firefox (username/password) have been compromised. 1Password already does this¹ but this is likely the Firefox implementation of it.

¹ - [https://blog.agilebits.com/2018/02/22/finding-pwned- password...](https://blog.agilebits.com/2018/02/22/finding-pwned-passwords- with-1password/)

</comment></comment><comment><USER23> It's interesting how HIBP considers mainstream dating sites sensitive on par with adult sites, while shady hacking related forums are fair game.

<comment><USER18> Have you considered the amount of PII the dating site is likely to have on their average customer? Access to a dating profile is almost as good as Facebook access to perpetrate identity theft.

<comment><USER24> That's not what makes a breach "sensitive" for HIBP, it's about breaches that only can be checked if you authenticated your e-mail address or domain, so that not everyone can check if you've used the site.

</comment></comment></comment><comment><USER25> "Have I been Pawned" should require email verification.

The way it's now, you can do searches for people's emails and get info of the sites people have been using.

<comment><USER26> You realize they are only using data that is already publicly available right?

</comment></comment><comment><USER27> Troy has done great security work for the community at large. If you haven't seen it check out one of his other projects [https://report- uri.com](https://report-uri.com) that aggregates your Content Security Policy reports for your site; a base security measure almost everyone should be utilizing for their sites these days.

</comment><comment><USER28> What will happen when Have I Been Pwned gets Pwned?

Must be storing a lot of email addresses at this point.

<comment><USER29> It is storing leaks so the data on the site is allready public one way or another.

<comment><USER30> It also has emails of people who sign up to its 'alert me if this address is found in future leaks' service.

</comment></comment></comment><comment><USER31> "Have I been pwned" is just a more friendly than "Was my password easy?". But the truth should be known!

<comment><USER24> Not only, since bad passwords aren't the only way passwords can leak, bad password storage practices on a hacked site do it too.

HIBP also includes leaks that didn't include recoverable passwords, but other personal data.

<comment><USER31> Well, truth. If the password were ejected from let's say "the random" website and you use the same one for all other ones you are kinda "pwned".

</comment></comment></comment><comment><USER32> So will this feature only be available in the web-version of 1password and not in the stand-alone version? :(

<comment><USER33> The latest versions of 1Password (I'm on 7) have great HIBP integration. Really pleased with it so far.

</comment></comment><comment><USER34> It would also be cool to implement native email reader inside firefox and some kind of messenger.

</comment><comment><USER35> > Have I Been Pwned

You are. HN sits behind Cloudflare. Your SSL connection terminates at Cloudflare to plaintext, and new SSL connection to HN is created.

Your login and password, IP and User-Agent and who knows what else, is in clear view to Cloudflare - you've been pwned :))

<comment><USER36> That's such an amazing thing about them.

I know a few places that... would pretty much die for such a global "MITM" service, so I wonder if it's five corners financing it.

<comment><USER35> I need a browser extension (for Safari) to warn me if the site is behind Cloudflare. I'll pay money :) I'm kinda protected by using VPN, IP is not my ISP IP. But the rest, plus browser fingerprinting is busted.

Use this: www.cloudflare.com/ips/ and HTTP headers like CF-RAY

<comment><USER37> You could also just use the ASN of the network which is always cloudflare for CF ips.

<comment><USER38> That's not easy to retrieve from a browser extension without using an external service, right?

</comment></comment></comment></comment></comment><comment><USER35> Leave the Firefox alone, please. Pocket, HIBP, 1Password, Cloudflare ... Not cool. 1Password has flawed sec rep [0], Cloudflare is pure MITM, stripping TLS between you and webserver, the rest just network and data leaks I haven't asked for.

For passwords best is KeepassXC, sync encrypted db via any file sharing.

[0] [https://www.theregister.co.uk/2017/02/28/flaws_in_password_m...](https://www.theregister.co.uk/2017/02/28/flaws_in_password_management_apps/)

</comment><comment><USER35> To Mozilla devs, if I may. Try OpenBSD approach to security, like in [https://www.openbsd.org/security.html](https://www.openbsd.org/security.html)

</comment><comment><USER39> My problem with haveibeenpwned is that when you haven't been pwned, you've just handed them your mail address.

Is there anything to alleviate those concerns other than "trust us, we're not saving emails from queries"?

<comment><USER40> k-Anonymity. In other words, "I have hashed my e-mail address, here's the beginning part _of the hash_ : 0deadbeef0, tell me if you have anything matching that." "Yup, I have something that hashes to 0deadbeef0123456789abcd, associated with these breaches, and something else that hashes to 0deadbeef0abc1056886516, associated with those breaches." Plaintext is not exposed, and you're not even exposing the whole hash, so GL to anyone trying to find out which if the hashes (if any) is yours, let alone what the plaintext was.

[https://blog.mozilla.org/security/2018/06/25/scanning- breach...](https://blog.mozilla.org/security/2018/06/25/scanning-breached- accounts-k-anonymity/)

<comment><USER39> Seems like a good solution. I was looking for this on the official HIBP website, but it's not mentioned there.

Going public with this would probably be a good time to update the website.

<comment><USER41> Read [https://www.troyhunt.com/were-baking-have-i-been-pwned- into-...](https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox- and-1password/) as well.

</comment></comment></comment></comment><comment><USER35> It reads like a press release. Praises for Troy, Troy praises 1Password and Cloudflare, great sell to naive Mozilla. Shareholders pat themselves on the backs. Champagne, sir?

<comment><USER42> And that's bad because? And Mozilla is "naive" because?

What's the angle? "Stick it to the Man", and stuff?

<comment><USER35> Security is hard. Adding 3rd party systems you don't control is not the way.

<comment><USER43> I use Firefox. Are you saying I'm now less safe? If I'm more safe but some other people don't like the solution then I guess they can configure or fork Firefox then we're all happy, right?

<comment><USER44> Arguably, if Firefox is devoting resources to this then it's not got resources to spend on other issues. That could in theory make it less secure.

HIBP and 1Password aren't making FF more secure, chances are they're increasing attack surface in both directions (ie making compromise of 1Password more likely too).

<comment><USER45> This is FUD.

<comment><USER44> Can you explain what's incorrect in my post?

(FWIW it's not a position I hold, I've not looked at the situation properly yet.)

<comment><USER45> Sure, I'll take it point by point.

> Arguably, if Firefox is devoting resources to this then it's not got > resources to spend on other issues.

This is a logical fallacy. It's like saying - if we wouldn't spend money on the space program, we could feed Africa with that money. The problem here is that this is not a zero-sum game: the people that worked on this (e.g. Troy Hunt) wouldn't had the skills or inclination to bring other enhancements to Firefox. Thus this is a net addition, and not to the detriment of other work

> That could in theory make it less secure

So adding a feature that helps people be more secure against a specific threat (using bad passwords that have been broken) makes the product less secure? This makes no sense, but it's just put in there to spread Fear (FF is less secure because of added security features) and Doubt ("could in theory" ... meaning we don't know, but lets put this out there)

> HIBP and 1Password aren't making FF more secure,

I tend to evaluate a security in context of a threat model. HIBP and 1Password have very good track records of mitigating attacks on user passwords (by notifying people about password breaches and thus decreasing the value of a password breach, and by making easy for the average user to manage complex passwords). As a result, the Firefox users have better tools to manage password-based authentication, increasing their security.

> chances are they're increasing attack surface in both directions (ie making > compromise of 1Password more likely too).

The evaluation of the "attack surface" here refers to the horizontal scale (how many actors of the same type see the interface) whereas the concept of reducing the "attack surface" refers to the vertical scale (how many types of communication the actors see). Reducing the horizontal scale is known as "security by obscurity" and it's a very bad idea to use it. A larger horizontal scale has no impact on the security, see ciphered communication: an encrypted message doesn't get less secure if more eyes see it, its security only depends on how well the encryption works.

Assuming that 1Password doesn't use "security by obscurity", increasing its footprint on the web will not decrease its security.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER46> Mozilla has wasted a bunch of resources creating a pointless tool. Let me explain why!

Last year, they promised to create an add-on that triggered when you visited sites known to have been breached in the past, and let the user check if his password was included in the leaked data, via HIBP: [https://www.bleepingcomputer.com/news/security/firefox- will-...](https://www.bleepingcomputer.com/news/security/firefox-will-warn- users-when-visiting-sites-that-suffered-a-data-breach/)

Now, they announced Firefox Monitor, which is nothing but a standalone website where you can check your email and see if it's been included in public breaches. This is the same functionality of the main HIBP website. If people want to check if their email was included in a breach, they'd just visit HIBP, not Firefox Monitor.

Why does this website exist in the first place? They took a good idea that used a proactive approach to alerting users of potentially leaked passwords and they've created a Firefox-branded HIBP clone website that very few people are gonna know about or even use.

Pointless use of resources, when they could have used them for something actually useless.

<comment><USER47> You're ignoring how most users need things in front of their face. Most users are not privacy or security "aware" in any manner. Putting it in the UI or actively promoting these services is beneficial to the common web user.

And if it fails, it's at least worth it to learn why it failed. Was the UI bad? Did it not promote the service in the right way? Did users not understand the purpose of the tool?

I think the juice is worth the squeeze.

<comment><USER48> 1\. Put it on the web first.

2\. Get it working well with UI, UX, etc....

3\. Then integrate it into the browser.

Seems like a totally logical flow to me.

<comment><USER49> But the browser is part of the UI/UX.

When Firefox warns you that you're (possibly) pwned when you browse to a website or try to log in, then you can't get around combining step 2 and 3.

Or when Firefox compares your password database with HIBP, you can't get around combining step 2 and 3.

</comment></comment></comment></comment><comment><USER50> A much more honorable way to do this would have been to allow the search of a hash of your email rather than your actual email.

<comment><USER51> That's... exactly what they're doing?

<comment><USER50> Double-checking source code @ haveibeenpwned.com. I see no javascript that hashes your email address before submission.

<comment><USER51> Sure, but that's not what the linked article is discussing as the basis for integration with Firefox.

</comment></comment></comment></comment><comment><USER52> What could possible go wrong?

<comment><USER40> Shooting the messenger, that's what. People tend to confuse "X might have your password" and "Y tells me 'something X something password', therefore Y hacked me".

</comment></comment><comment><USER53> You had been pwned anyway.

<comment><USER53> Everything said that isn't politically correct is systematically downvoted here on «hacker» news. I am enjoying your very low knowledge and your smartphone attitude. LOL

<comment><USER24> You sure it's not you posting trite, basically irrelevant one-liners that's presenting a "smartphone attitude"?

Nothing is politically incorrect about your post, but it doesn't add to the discussion.

<comment><USER53> There is no discussion here, just marketing stuffs.

<comment><USER35> Wow. How did you guess?

<comment><USER53> By answers not politically correct systematically downvoted...!

<comment><USER35> Was joking, man :))

</comment></comment></comment></comment></comment></comment></comment><comment><USER54> Excellent need, more than enough reason to switch. Now bake 1Password into Firefox.

<comment><USER55> Not quite 1Password, but Mozilla is developing a cross-platform password manager, tentatively called "Lockbox", that will support Firefox, Android, iOS, and possibly a Chrome extension.

[https://mozilla-lockbox.github.io/](https://mozilla-lockbox.github.io/)

<comment><USER56> I hope they add support for self-hosted backends. It'd be great to have a self-hosted password manager developed by a company with an amazing security team.

<comment><USER57> This would be really amazing.

</comment></comment></comment></comment><comment><USER58> Instead of actually fixing authentication they are baking "have this password been exposed in plaintext" into the browsers.

What's the deal with WebAuthN? Such a basic functionality still not completed.

<comment><USER59> > _Instead of actually fixing authentication they are baking "have this > password been exposed in plaintext" into the browsers_

"Perfect is the enemy of good" [1].

[1] [https://en.m.wikipedia.org/wiki/Perfect_is_the_enemy_of_good](https://en.m.wikipedia.org/wiki/Perfect_is_the_enemy_of_good)

<comment><USER58> I'd argue there is no "good" auth at the moment, only "poor". And upgrade to authenticator-based "good enough" is much needed.

<comment><USER60> [https://en.wiktionary.org/wiki/no_good_deed_goes_unpunished](https://en.wiktionary.org/wiki/no_good_deed_goes_unpunished)</comment></comment></comment></comment>


Time.is - <AUTHOR> http://time.is/

<comment><USER2> Here is a sensationalist article about the upcoming leap second: [http://time.com/3666522/leap-second/](http://time.com/3666522/leap-second/)

<comment><USER3> > For computers, a day is 86,400 seconds, no matter what

As far as I'm aware, daylight savings still has an effect on the number of seconds in a day.

</comment></comment><comment><USER4> One of my most often used Google queries is "time in [city]"

</comment><comment><USER5> This video seems appropriate [https://youtube.com/watch?v=-5wpm- gesOY](https://youtube.com/watch?v=-5wpm-gesOY)

</comment><comment><USER6> It is impossible to press any of the sharing buttons while the time is highlighted. Everything else seems pretty neat!</comment>


Ultimate Guide to Drupal 8: Episode 2 – Mobile Improvements - <AUTHOR> https://www.acquia.com/blog/ultimate-guide-drupal-8-episode-2-mobile-improvements

<comment><USER2> Will it get a totally admin based method to upgrade Drupal 6 & 7 sites, ie something that doesn't require migrate scripts?</comment>


Kati – An experimental GNU make clone - <AUTHOR> https://github.com/google/kati

<comment><USER2> The Ninja it converts to appears to be here:

[https://martine.github.io/ninja/](https://martine.github.io/ninja/)

<comment><USER3> I'm a big fan of Ninja: it applies the philosophy of "do one thing and do it well" to build systems. It takes in a dependency graph and a list of build rules, and it builds stuff in parallel.

Like Make, you can use it to build a lot of different kinds of things, and it doesn't care what programming language you're using.

Unlike Make, it doesn't give you its own idiosyncratic, messy, easily-misused programming language for defining your dependency graph. The dependency graph is just an input that comes from somewhere else. You can make it in a reasonable programming language, or apparently now you can make it out of a Makefile using Kati.

Because it's not trying to support decades of Makefile hacks, Ninja can do things that would be dangerous to do in Make, such as a single build step that reads M files and writes N files without any extra locking or bookkeeping.

</comment></comment><comment><USER4> How does it compare to mk[0]?

mk was make done better for Plan 9.

[0] [http://plan9.bell-labs.com/sys/doc/mk.html](http://plan9.bell- labs.com/sys/doc/mk.html)

<comment><USER5> mk and Ninja (the target to which Kati compiles) appear to be almost equivalent to each other, except that mk has patterns ("here is how to compile any .c file into a .o file") and Ninja requires that each target be written explicitly ("here is how to compile foo.c into foo.o", once per file).

This is okay, because mk is meant to be written by humans and Ninja is meant to be a target for compilers like Kati and cmake.

<comment><USER6> Make uses patterns as well, especially if you're "Doing It Right"(tm) [0][1][2].

[0] [http://git.suckless.org/st/tree/Makefile#n6](http://git.suckless.org/st/tree/Makefile#n6)

[1] [http://git.suckless.org/st/tree/Makefile#n7](http://git.suckless.org/st/tree/Makefile#n7)

[2] [http://git.suckless.org/st/tree/Makefile#n20](http://git.suckless.org/st/tree/Makefile#n20)

</comment></comment></comment><comment><USER7> Why two versions of the code in Go and C++?

</comment><comment><USER8> Why? A wheel with less corners...

<comment><USER9> Some people on bigger projects are tired of waiting for their builds and test results, so they wrote something better and faster. => ninja

On bigger projects waiting 60min or 10min or 2min makes a difference.

kati so far converts traditional makefile recipes into ninja builds.</comment></comment>


Soviet shuttle "Buran" found in the trash - <AUTHOR> http://translate.google.com/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=ru&tl=en&u=http://www.mk.ru/photo/social/1090-buran-prinesennyiy-v-zhertvu.html <comment><USER2> I doubt this is actually the Buran itself--there were a few Buran-class shuttles built to varying points of completion, as well as multiple mockups for aerodynamic tests and the like. _The_ Buran was left in Kazakhstan, and it's unclear why they would haul an abandoned spacecraft all the way to the outskirts of Moscow.

This is most likely the fourth, unnamed Buran-class shuttle "2.02" which Wikipedia reports as "Partially dismantled, remains outside Tushino Machine Building Plant, near Moscow." Here's a picture of it in winter, apparently in a worse state of disrepair: [http://www.aerospaceweb.org/question/spacecraft/buran/2.02-2...](http://www.aerospaceweb.org/question/spacecraft/buran/2.02-2.jpg)

More information: <http://en.wikipedia.org/wiki/Shuttle_2.02>

<comment><AUTHOR> Its good information to know there were extra ships being built. I don't think its 2.02 though. These photos appear to be new, and the ship is in much better condition than the one that appears in the photo you shared, also as you noted. Unless for some reason these photos are actually much older than the one you found on aerospaceweb.

<comment><USER2> The condition of the shuttle is odd between the two photographs. Perhaps the windows were boarded up? Still, the location is most consistent with 2.02-- there would be no reason to move any of the other shuttles from Kazakhstan to Moscow.

</comment></comment></comment><comment><USER3> Only tangentially related but the title reminded me of [http://www.magnumphotos.com/Archive/C.aspx?VP3=ViewBox_VPage...](http://www.magnumphotos.com/Archive/C.aspx?VP3=ViewBox_VPage&VBID=2K1HZOWTPE90K&CT=Search&DT=Image) from a few years back. Photos taken of crashed rockets in Kazakstan,

I think [http://www.magnumphotos.com/Archive/C.aspx?VP3=ViewBox_VPage...](http://www.magnumphotos.com/Archive/C.aspx?VP3=ViewBox_VPage&VBID=2K1HZOWTPE90K&IT=ZoomImage01_VForm&IID=2K7O3RJHMMHH&PN=1&CT=Search) is particularly stunning

</comment><comment><USER4> FWIW, the only flight that Buran performed was 100% automatic from launch to landing, with no crew on board, in 1988. It could have been an awesome machine.

<comment><USER5> The Buran was an imitation of the US Shuttle system, but the US Shuttle was not something worth imitating. Reusable launch vehicles have some advantages, but the Shuttles were not reusable in any reasonable sense. Had the Soviets dumped the development budget from Buran into building and launching stations with Energia while continuing to use Soyuz for crew ferrying and return they could have done some truly amazing things. Instead they made fundamentally the same mistake as the US, throwing away money on a horribly flawed system.

<comment><USER6> As we all know by now, the launch system has its flaws (segmented solids and loosely insulated liquid tanks). The economics of Shuttle was grotesquely oversold, and satellites were limited to LEO because that was the service ceiling for the platform. NASA never should have relied on Shuttle to do _all_ its lifting; the back-breaker for the US Air Force was the launch delay during the Challenger investigation. Shouldn't have been using a man-rated vehicle to tow satellites into orbit to begin with.

But the orbiter itself is a work of art, a dazzlingly complex system, finely tuned to operate on the hairy edge of materials science and meticulously maintained. For all its expense, it was done _right_ , and I rather wish there was the money to do it again with 21st century tech.

<comment><USER5> The Shuttle system was a triumph of technological marvel on top of technological marvel that even today deserves respect. Nevertheless, it was the wrong design for its mission, overcomplicated, expensive, and impractical. That it did fly is a testament to engineering savvy and determination. But it flew on the back of a standing army of aerospace engineers costing billions of dollars a year and upwards of half a billion dollars a flight. That aspect is not something to be proud of. The opportunity cost due to the Shuttle system in terms of things we could have done with the same money and resources is nothing short of breathtaking, and must be counted as a significant tragedy in the annals of manned spaceflight.

Consider that every single Shuttle flight (all 100 or so of them) ranks up there with a Saturn V launch in terms of expense, engineering, complexity, and hardware. Imagine where we would be today if instead of 100 Shuttle flights we had had 100 Saturn V launches.

The Shuttle design turned out to be deeply flawed in ways that prevented it from ever achieving a high flight rate (the only way to dramatically lower costs with a reusable vehicle) and was at best only quasi-reusable. Worse yet, it was burdened with requirements from the military which ended up not being used and took a heavy toll on the system's capabilities, robustness, and efficiency.

It's telling that of the many new clean-sheet designs for manned space vehicles the particular characteristics of the Shuttle are absent.

The Shuttle performed its primary mission of keeping the prestige of the US through the maintenance of an impressive looking manned spaceflight program. But in terms of advancing manned space exploration the Shuttle was a failure. And all of this is independent of the safety problems of the Shuttle system.

My heart still stirs when I see a Shuttle launch, but my head cannot help but see the terrible flaws of the program.

</comment></comment></comment></comment><comment><USER7> This is the kind of thing that Jacques Littlefield (RIP) could have rescued. <http://en.wikipedia.org/wiki/Jacques_Littlefield> I once visited his place. Believe me, 200 tanks, vehicles, and a SCUD missile on its launcher is a sight to behold. (Scud missiles were apparently hammered into shape with ball-peen hammers.)

</comment><comment><USER8> If you look at the photos the craft looks like a solid piece of steal. The amazing effort, energy and engineering effort it took to get that into space. It's simply astonishing. Same applause to the Space Shuttle of course.

</comment><comment><AUTHOR> I also find it interesting that its listed as destroyed on the wikipedia article, <http://en.wikipedia.org/wiki/Buran_(spacecraft)>

<comment><USER9> As many commenters on Slashdot have noted, this is most likely Shuttle 2.02 of the Buran program (<http://en.wikipedia.org/wiki/Buran_program>) and was never actually fully assembled.

</comment></comment><comment><USER10> What a waste...

</comment><comment><USER11> Um... I don't really think that's the "trash" ... there aren't any garbage trucks large enough to cart that away.</comment>