Ask HN: What's the most expensive mistake you've ever made - <AUTHOR> I'm reading comments [1] and wondering what's the most expensive mistake you've ever made?<p>[1] - https://www.reddit.com/r/programming/comments/64idzl/digitalocean_accidentally_deleted_production/ <comment><USER2> Back when bitcoin was a mere curiosity, pre crypto currency excitement, well even before that first bitcoin pizza. I happened to have just found this neat piece of software while searching for things related to MPI, parallelism, and that sort of thing. It was called bitcoin, and I had a 32 node OpenMOSIX cluster all to myself for about 12 hours.

I kicked off the bitcoin processes let it all fan out to every node, and went to class. Coming back to check on it before I left University that day. I made a mental note to myself about how many "coins" it had ground out of the clusters CPU time and placed in my "wallet", with all the importance one might place on remembering the exact number a computer got on a geek Bench score. If memory serves, it was something around 25,000 bitcoins.

At their peak value, that works out to in excess of 30 million US dollars worth of mistake due to lack of desire to back up the results of my idle experiment. To be fair at the time, they were worth less than nothing, I vaguely recall some mention of them 'possibly in future being used as a medium of value exchange' and that sort of abstract thing, and I was running the software out of curiosity. So I'm not bitter.

</comment><comment><USER3> I once added a backdoor to gain full Admin rights (without corporate sign-off) to a site I was building for a relatively large corporation. Though this was only intended for QA and Dev, I forgot to get rid of this backdoor when I deployed to production, and it was shortly found. A lot of the data that had been input was mangled and broken (or just outright deleted) and not backed up, which forced a lot of the creative people to redo several days of work.

I was fortunate enough to have a boss was pretty understanding, and I was not fired, though I genuinely felt he would have been justified in doing so.

<comment><USER4> Yikes! This is why sign-offs for things like that exist. You had an incredibly kind and understanding boss!

</comment></comment><comment><USER5> The most expensive mistake I've made is not focusing on a single goal, task, technology, or stack. I keep changing my goals. Because of that I have learnt nothing today. Any idea to get rid off this habit?

<comment><USER6> IDK, if it's your nature than try to embrace it rather than loathe it. IT generalist can be useful in consulting business.

</comment></comment><comment><AUTHOR> [http://www.b3ta.com/questions/expensivemistakes/](http://www.b3ta.com/questions/expensivemistakes/)</comment>


OpenSSL Security Policy - <AUTHOR> https://www.openssl.org/policies/secpolicy.html <comment><AUTHOR> _Threat Model_

 _Certain threats are currently considered outside of the scope of the OpenSSL threat model. Accordingly, we do not consider OpenSSL secure against the following classes of attacks:_

 _same physical system side channel_

 _CPU /hardware flaws_

 _physical fault injection_

 _physical observation side channels (e.g. power consumption, EM emissions, etc)_

 _Mitigations for security issues outside of our threat scope may still be addressed, however we do not class these as OpenSSL vulnerabilities and will therefore not issue CVEs for any mitigations to address these issues._

We are working towards making the same physical system side channel attacks very hard.*

 _Prior to the threat model being included in this policy, CVEs were sometimes issued for these classes of attacks. The existence of a previous CVE does not override this policy going forward._</comment>


Ask HN: PHP Directory structure and code organization - <AUTHOR> I work for a company (PHP shop) where we are looking at cleaning/separating our code as we move toward PSR-0 (http://www.php-fig.org/psr/psr-0/).
We have lots of different `features` that we would like to split up and organize in a way that makes the most sense.
We want: - Highly modular. - Easily extend/implement abstract code between features. - Outside the core framework.
Any suggested reading material, advice, or feedback would be fantastic!
Thanks HN! :)
Edit: We use CodeIgniter (earlier version) <comment><USER2> I moved just about everything below web root cept icons and images, and other browser side necesities. All directs go through index.php, nothing is referenced by directory publically.

/core/apps/[name of app]

/core/config/ (config files, PDF templates, etc.)

/core/inc/ [libraries/extensions]

/public_html/index.php

/public_html/info/ [icons, images, and other public accessible data]

mainly index.php has

$home = $_SERVER['SCRIPT_FILENAME'];

$loc = explode('/',$home);

define('CORE_BASE', implode('/',array_slice($loc,0,-2)).'/');

require_once core_BASE.'core/inc/main.php';

which defines the core path (below web root), then includes the main base code. From there all code is below web root.

note: css and javascript can be included directly (saves having browser request them anyway)

</comment><comment><USER3> There are several solutions that work well in conjunction: 1\. Start moving code into code libraries. These can be reused in multiple projects, are framework-agnostic, and can be managed via composer. 2\. Once you've reached a certain codebase size, switch to using modules. This will help create logical separations of code, and will limit devs stepping on each other's code 3\. Start putting common utility code into helpers, and base controllers/models. 4\. If you have common view components, consider breaking them out into partials

</comment><comment><USER4> Just a tip, load as much as you can get away with (configuration, ESPECIALLY) outside of your webroot.

BAD:

* /var/www/config/mysql.json

* /var/www/static/site.css

* /var/www/index.php

* $_SERVER['DOCUMENT_ROOT'] = '/var/www';

GOOD:

* /var/www/config/mysql.json

* /var/www/public/static/site.css

* /var/www/public/index.php

* $_SERVER['DOCUMENT_ROOT'] = '/var/www/public';

</comment><comment><USER5> Organizing around Composer[0] may be what you want. It's extremely flexible in terms of the kinds of packages it can load, implements PSR-0 and PSR-4 and allows custom autoloading, and binding scripts to pre and post installs.

[0][https://getcomposer.org](https://getcomposer.org)

</comment><comment><USER6> Are you already using a framework? If so which one? If not, I would check out the book Modernizing Legacy Applications In PHP by Paul M. Jones [http://bit.ly/1FQjpby](http://bit.ly/1FQjpby)

</comment><comment><USER7> How much of a lift would it be to transition away from CodeIgniter to something like Symfony or Laravel?</comment>


Ask HN: Is a $100B MOOC startup in the making? - <AUTHOR>

It seems plausible for billions of people to pay a two digit yearly sum for continuous online education. That means a MOOC empire bigger than Google. what do you think? <comment><USER2> I'm going to stick to a firm no on this one. For starters, this is very expensive to some. Second, not everyone owns or has internet access. So to say "billionS of people" is already incorrect. The second problem with this is competition, you're assuming that people will just line up in droves to come learn and this super company will have no competition. When you put a pricetag on something it becomes a harder competition to fight. The example of google being used as an 'empire' is comparable to that of Facebook. They're both free services, so the idea of using them is a no brainer. People will easily sign up for something that is free.

The final problem is most people don't care. I can say myself that I get nothing out of most education programs and learn more from experiences and communication. Of the people who are willing and able to sit down and educate themselves further on a regular basis with a paid program is a fraction of the population.</comment>


Phrack Magazine issue #67 announced - <AUTHOR> http://phrack.com/index.html

<comment><USER2> _Exploiting Memory Corruptions in Fortran Programs Under Unix/VMS_

that is some serious bleeding edge shit right there

<comment><USER3> Maybe you wanted to contribute something instead of mocking other people's _shit_ , then?

<comment><USER4> Same to you, buddy. At least the grandparent contributed a joke.

<comment><USER3> I'd be mocking if I said: " _that is some serious bleeding edge comment right there_ ". I applaud your sense of humour, though.

<comment><USER5> Actually it doesn't have to involve imitation to be mocking.

True, that is one sense (like in "mocking bird")...but it can also be just general derision or taunting, like in " The jelly donut sat there, mocking me."

/language nerd

</comment></comment></comment></comment></comment><comment><USER6> I... cannot see any download link. Or any other kinds of links to #67.

<comment><USER7> Seems the submission to HN should be titled "announced" rather than "released".

<comment><USER8> The website earlier said "phrack will be at ruxcon", which is this weekend (starts the 20th). I imagine it will be released then.

<comment><USER5> They posted a couple days ago saying #67 would be released today.

I'm not sure what the deal is; seems like they're having trouble with their website as what would normally be the front page news is a non-functional TOC for #67.

Based on the title, it could also be them yanking people's chains...who knows.</comment></comment></comment></comment>


Airships could return to our crowded skies - <AUTHOR> https://www.bbc.com/future/article/20191107-how-airships-could-return-to-our-crowded-skies <comment><USER2> CargoLifter[1] tried to bring airships back in the late nineties. They started building a gigantic manufacturing building but ran out of money before they even started to build an airship. The hangar was later turned into an aqua park but ran into troubles because the heating expenses were too high. Not surprising given the hangar was designed to be open at both ends. Another commenter in a previous thread wrote that the aqua park does well nowadays[2].

[1] [https://en.m.wikipedia.org/wiki/CargoLifter](https://en.m.wikipedia.org/wiki/CargoLifter)

[2] [https://news.ycombinator.com/item?id=20766309](https://news.ycombinator.com/item?id=20766309)

<comment><USER3> Well, Zeppelin NT [1] _did_ bring back the airship. At least insofar as they have produced a number of actual airships, as opposed to Cargolifer. Also Zeppelin NT existed before Cargolifter, and after - it is still an operating company.

[1] [https://en.wikipedia.org/wiki/Zeppelin_NT](https://en.wikipedia.org/wiki/Zeppelin_NT)

</comment></comment><comment><USER4> Could an airship make sense as a loading dock for drones making deliveries?

Laden drones which can drop down to their delivery point from above, and then return empty back to the air dock seem like they could operate much more quietly and efficiently than drones which need enough power to maintain altitude as they travel horizontally to their target.

Of course the drone would need the capability to throttle up and climb fully laden, possibly even minus one rotor, and the energy reserves to spare.

But the theory would be launching off the airship, and traveling horizontally (at altitude) above the target, then a controlled descent straight down to the drop point.

Presumably you would have two or three ships so one would be in position, while another was moving to/from the ground warehouse, while the 3rd was being loaded for the next batch.

The whole thing only makes sense if the energy density of the drone batteries doesn't allow them to simply launch from a remote warehouse and proceed directly to their destination at altitude and return all on their own power.

<comment><USER5> > Could an airship make sense as a loading dock for drones making deliveries?

Carrier has arrived: [https://www.youtube.com/watch?v=7B5DPovWY7o](https://www.youtube.com/watch?v=7B5DPovWY7o)

<comment><USER6> Imagine how quickly those things would become the modern day Wells Fargo stagecoach to be plundered for our masses of under-employed and well-armed poor! Not to mention the conspiracy theories that would quickly pop up around anything like that; it's spying/vaccinating/etc.

<comment><USER7> This doesn't seem like an easier target than a delivery truck or a warehouse. Why and how would people attack airships?

<comment><USER8> It seems like a _much_ easier target to me, if the ship passes over a secluded area. I suspect a cargo airship is also more likely to be unmanned.

How: drone with a harpoon, or a particularly pointy model rocket. Perhaps you'd attach a tether, so you can bring the ship to a specific spot (and reel it in gently without having to compromize its buoyancy so much it crashes hard).

<comment><USER7> Does that really sound easier to you than hopping into a running UPS truck while the driver is delivering a package and driving away?

How far do you think you could drag a drone-filled zeppelin before you were detected? How long would it take you to gently reel in a floating warehouse while Amazon alerted authorities and private security about your multimillion- dollar heist?

</comment></comment></comment></comment></comment></comment><comment><USER9> Everyone keeps talking about these being slower than planes, but I'm wondering if it is more interesting to compare these to cargo ships and trucks instead for some routes. While the cargo capacity is a lot less, these can be point to point over land or sea (no switch to trucks at a port) and these move through the air and not water, so the energy requirements should be a lot lower since air is less dense than water.

The autonomous problem is far simpler than autonomous trucking. It's probably somewhat comparable for autonomous shipping.

That all said 4 TEUs is far from the ~20,000 TEUs that the largest cargo ships can carry. Even if you can build something that can move 20 TEUs, that's still three orders of magnitude difference in terms of volume.

For certain goods however, like moving wind farm blades and pillars, airships would be ideal.

<comment><USER10> The key limitation is weather. Airships are definitely not "all weather" capable, they must avoid wind shear. So reliability will be lower than ships or trucks.

<comment><USER11> That raises an interesting question for me -- how do ships deal with inclement weather on the open sea anyways?

<comment><USER12> Depending on the course and the actual weather event they'll either try to go around or - if they can't - weather the storm. Large ocean going ships can pass through most weather you'd usually encounter.

</comment></comment></comment></comment><comment><USER13> Well that's cool.

I'd be interested to know more about the technical details. The article mentions something about "cells" to reduce risk of buoyancy loss from a tear, and something about ultracapacitors. While some of the details may be proprietary, I'm sure there are some interesting things to say about the technology that this article somehow manages to almost completely avoid.

Also aren't we running out of helium (because it's a mostly non-renewable resource on Earth)? I know it's not actually consumed by the airship, but that's a lot of helium, right? Edit: According to my calculations, filling up a Hindenburg with helium (0.2 million cubic meters) uses about 1/900 of the annual global helium production (about 180 million cubic meters).

<comment><USER14> You can use hydrogen instead of helium. It's flammable sure, but so are gasoline and jet fuel. Plus it is hard to make it explode unless you inject oxygen.

<comment><USER15> Hydrogen fell out of favor for airships after the Hindenburg disaster. It's much more dangerous than gasoline or jet fuel.

<comment><USER16> I wonder if safe hydrogen designs are conceivable today.

<comment><USER17> Even if they were, which seems unlikely, the question of economic viability would come into play.

</comment></comment></comment></comment></comment><comment><USER18> These are great, but I think the way forward is cellular design. Do an image search for Alexander Bell's cellular kites. Build (relatively) small units that combine to scale, rather than trying to build huge machines right off. (Also makes your craft more resilient: say it breaks in half, both halves are also viable vehicles.)

Also, take advantage of Magnus effect.

</comment><comment><USER19> I remember reading (a very long time ago) that one of the primary use cases for using airships for carrying cargo was in regions that don't have an existing highway system to support fleets of big trucks. Africa in particular doesn't have superhighways crisscrossing the continent.

A quick search suggests that one Airlander costs about as much as 10 miles of two lane highway.

<comment><USER20> Yeah, there was a push a little while ago to start an airship delivery service to remote communities in northern canada. The economics of an airship look pretty good when you compare it to Boeing 737s.

</comment></comment><comment><USER21> >Last year, a blimp demeaned itself by setting two world records, including one for the fastest text on a touch screen mobile phone while water skiing behind a blimp.

That's misleading. The record was for "Fastest text message (SMS) on a touch screen mobile phone while water skiing." It happened to be set behind a blimp, but that's not a requirement for the record.

</comment><comment><USER22> for context, 60 tonnes is two fully loaded 40 foot shipping containers.

if you could make it battery-electric and autonomous, then you've solved for global shipping emissions (cuz we don't need the ships anymore).

<comment><USER10> The economics are bad. Imagine the unit cost is $10 million. This seems realistic, the prototype cost ~$30 million and this airship is made of 40,000 pounds of light weight materials with very manual assembly processes. The cost of capital and depreciation might be $1 million/year. If the cruise speed is maybe 70 MPH, even if electricity and maintenance were free, this will $1.60 per mile. A container ship will be about $.01 per mile in similar cost.

Then looking at energy consumption, a container ship might need 8 HP of power per 40 foot container sailing at 18 mph. This airship has 700 HP per container at 70 mph.

<comment><USER23> With automated ships, and automated airships, you could do away with most loading/unloading - have the airships load/unload in coastal waters, use ships for the long haul across oceans?

Ideally you'd use windpower (sails) and solar (electricity) for the ships.

</comment></comment></comment><comment><USER24> VICE had did a show called 'Africa's cowboy capitalists' which highlighted how hard it is to move things (vehicles for the UN in this case) across Africa due to poor roads and corruption. An airship would have saved them a lot of trouble.

<comment><USER25> Or get shot down in one of many local wars. Friend of mine flew a homebrew plane across Africa and got shot at multiple times but a plane is quite a bit quicker than an airship. He also got 'arrested' several times after landing because they suspected he was a spy. Typically after they found out he was just a crazy Dutch person on a cross-Africa trip in a device of questionable airworthiness he was let go again.

[https://www.youtube.com/watch?v=tWdpgGryELA](https://www.youtube.com/watch?v=tWdpgGryELA)

<comment><USER26> Your friend is awesome. I can't help but be reminded of Antoine de Saint- Exupery

<comment><USER25> Check out 'Auto op dak' if you like this, it is hilarious.

<comment><USER26> haha, a thing of beauty. He's a madman.

This is what you were referring to right?: [https://www.youtube.com/watch?v=Gc4HbvjE5OQ](https://www.youtube.com/watch?v=Gc4HbvjE5OQ)

Would be some serious road rash if things went wrong on that thing!

<comment><USER25> Yes, that's it. I didn't want to give anything away about what it is about in the text. You really have to see it. And yes, he's a bit mad but not in a bad way.

He gave this talk in front of a bunch of VCs and LPs, it was really funny. Worlds colliding. So he's up there at the start of the talk, looks over the people there and says 'we probably won't get along well'.

</comment></comment></comment></comment></comment></comment><comment><USER27> The opening preamble of this article is clearly a shill for the BBCs adaptation of His Dark Materials.

That said, the reason we don't have a return to airships, is that they cannot carry the sheer numbers that planes can, need a much larger 'docking' area compared to planes, and take 100 times as long to get anywhere compare to modern air travel.

<comment><USER28> I agree that airships will never directly replace with airplanes. However, historically airships reached 100 - 160 km per hour which is gets you to about 2 days for a transatlantic flight. Thats about a day more than a flight today but given the reduced effect of jetlag, I would assume quite a few people would go for it (not the buisness travellers, obviously). However, for that airships would need to have as much space as a cruise ship and therefore become really big again. You would start on in a small plane, land on the airship, travel long distance with it and exit again why another plane.

<comment><USER29> I disagree. They could replace planes for me.

Give me a real bed in a room that can be locked (even if shared with a few other people), and a restaurant to socialize like in a train. For comfortable travel I would pay extra, business or not. I must not be the only consumer wanting that.

And no, regardless of "class", airplane travel is miserable. I do not want to seat in a open space with people walking around, eating on my lap or from a folding table food served on a tray.

<comment><USER30> You're basically describing a sleeper train but those are increasingly rare because they are that much more expensive than flying that people don't consider them worth it.

Not enough people will pay the extra for regular point to point travel. I could see something like that taking off in terms of an experience, like an air version of the orient express.

<comment><USER31> I took the Caledonian Sleeper from London to Edinburgh recently. For two people, the pricing wasn't bad and I don't regret doing it. But it was a very small room and the common cafe space was very cramped as well. We're definitely not talking Agatha Christie Orient Express experience.

But, yeah, in general sleeper trains don't work other than for the experience. Just for kicks, I looked at traveling to Chicago from Boston by sleeper a couple years back instead of flying. Made absolutely no sense for me in terms of time and I couldn't have justified the expense to my company.

The concept of airship travel as presented in fiction looks really appealing. But it would probably cost $10K for a trans-Atlantic ticket. And if you have that kind of money to spend, and especially aren't really in a hurry, there are other attractive options.

<comment><USER32> > But, yeah, in general sleeper trains don't work other than for the > experience. Just for kicks, I looked at traveling to Chicago from Boston by > sleeper a couple years back instead of flying. Made absolutely no sense for > me in terms of time and I couldn't have justified the expense to my company.

I regularly travel Munich-Hamburg via sleeper train. It has many advantages:

\- at short term booking it's way cheaper than a flight

\- I arrive well rested, showered and fed in Hamburg, compared to being essentially a wreck the whole day after having to get up at 0330 (this alone is well worth the extra cost compared to a flight)

\- I don't waste time travelling to and from the airports, or security crap, or have to expense taxis

\- I don't have any contact with police

<comment><USER31> Fair enough. I'm just not aware of any overnight routes in the US that are a good alternative to a morning (or even an evening) flight. I do take trains when they're a good option, especially Boston to NYC, but that's rarely the case either with respect to money or convenience.

</comment></comment></comment></comment></comment></comment></comment><comment><USER33> This comes up every 5 years.

</comment><comment><USER34> We "could" also all receive ponies.

</comment><comment><USER35> It is still flying way. Too. HIGH.

Can't we just go everywhere by train and boat, by land and sea? Humans were not meant to soar up in the sky, thousands of meters high. We're not birds.

I hate flying.</comment>


About backdoors in crypto messengers - <AUTHOR> http://blogs.fsfe.org/larma/2017/signal-backdoors/ <comment><USER2> Conversations [https://conversations.im/](https://conversations.im/) is an awesome XMPP client for Android, just use good software only.</comment>


Twitter Users Most Followed by Readers of Hacker News: Updated & Expanded - <AUTHOR> http://jeffmiller.github.com/2010/07/28/twitter-users-most-followed-by-readers-of-hacker-news I originally posted this list 3 months ago (July 2010). I've since improved upon it.
Now the list has been expanded to 200 people (previously 100).
Hacker News usernames are shown wherever possible.
I've also posted a link to a CSV file which contains the full list up to 1,000 people.
And a cron job will automatically regenerate the list once a week. <comment><USER2> This would be more interesting if you added one more column, dividing the number of HN followers by the total number of followers. @Shitmydadsays has 1.8 million followers, but the people ahead and behind that account on this list each have <30K followers. Clearly, those accounts (@al3x and @dhh) are more Hacker Newsy.

<comment><USER3> Agreed, that would be interesting to see.

If nobody else does it, I'll try to crank something out this weekend.

</comment></comment><comment><USER4> I don't consider myself a hacker, so am not best placed to pass judgement, but... it seems like the true hacker ethos is not to swim with the stream, and yet here is pretty clear proof that hnews has formed its own stream. How many hackers here check the list and de-follow anything not in the long tail, fearing getting caught-up in groupthink?

I apologise in advance if this causes offence; stream or not, I still have tremendous respect for this very high calibre community.

<comment><USER5> >it seems like the true hacker ethos is not to swim with the stream

I don't think so. The hacker ethos is about being clever and hacking stuff.

Hackers don't do things differently just to be different. They do things differently because they see the world differently. The reason there is a "hacker community" is because hackers meet each other and say "No shit! You do that too! I thought I was the only one!"

Like any good community, it's about commonalities.

<comment><USER4> absolutely. but groupthink is a well-known phenomenon. hackers are very original people, and originality tends to get lost in large groups, no?

<comment><USER5> Groupthink is a well known pitfall of any group.

But not all groups engage in groupthink. Organizational psychologists talk about ways to reduce and/or avoid groupthink in an organization or community.

If you believe that Hacker News is suffering from groupthink, you should present evidence of that, and then the community could take action to try and reduce it.

Personally I don't see it. I strongly doubt anyone is deleting people off their twitter based on this submission.

</comment></comment></comment></comment><comment><USER6> Would LOVE to see this weighted by the each user's HN Karma score. For example, a user with 1000 Karma who follows Harj should be worth more than a user with 10 Karma who follows Lessig.

</comment><comment><USER7> Very nice. Would be cool to see how people moved up/down since July :)

</comment><comment><USER8> I remember when @PaulG joined Twitter he quickly gained several thousand followers in a few hours via a link from Hacker News. This data is based on only 400-500 users. I would say the majority of the Hacker News community is left out.

</comment><comment><USER9> Nice, I'm on the List. I guess my one year experiment worked.

<comment><USER10> Me too. I'm pretty sure mostly because of the list of Hacker News members on Twitter I maintain: <http://twitter.com/tlrobinson/hackernews>

Also, I noticed the first time this was posted I got a bunch of new followers. It's kind of a self-reinforcing list.

</comment></comment><comment><USER11> This reflects what the HN community represent, and we are certainly not all hackers. Entrepreneurs? Perhaps. Notice a lot of VCs got pretty high up on the list.

</comment><comment><USER12> The unofficial ycombinator tweet didn't have a link embedded for this submission.

EDIT: changed official to unofficial, thanks riklomas

<comment><USER13> Ah, that's my fault actually, it occasionally chokes on punctuation (especially ampersands), I plan to fix that this weekend. It's not an official Y Combinator twitter feed by the way, it's just something I knocked up in my spare time.

</comment></comment><comment><USER14> Nice hack. Very good idea. I keep wanting to give Twitter a whirl but I never know who to follow, thanks.

</comment><comment><USER15> i'm a little surprised steve blank is so low. his blog entries are usually a great read

</comment><comment><USER16> nice, added to <http://hnresources.com/hackernewsers/></comment>


Catching pointer overflow bugs - <AUTHOR> https://wdtz.org/catching-pointer-overflow-bugs.html <comment><AUTHOR> Pointer overflow UB checks recently got merged into clang.

[https://reviews.llvm.org/D33305](https://reviews.llvm.org/D33305)</comment>


Show HN: KwickBox – The Digital CV Revolution - <AUTHOR> https://kwickbox.intuitive-web.co.za/ <comment><AUTHOR> KwickBox is a software platform where you can easily create your online CV website, restrict and track who can view it and more.</comment>


Hacker Bribed 'Roblox' Insider to Access User Data - <AUTHOR> https://www.vice.com/en_us/article/qj4ddw/hacker-bribed-roblox-insider-accessed-user-data-reset-passwords <comment><USER2> The real takeaway from this:

Do your threat models include your staff? Of course, nobody has admin access.

Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job?

IME this is a great interview question to ask potential employers. The rabbit hole that you are required to go down will open eyes.

The answer is: you can't. But how you mitigate damage (with data silos) and engage in disaster recovery after the fact puts you in excellent condition to weather any storm.

<comment><USER3> This is why security is an onerous black hole.

Security folks always condescendingly lambaste companies not using best practices, but security is literally the worst. It's an infinitely deep hole of money, time, and CPU cycles.

If you create a startup with security best practices you'll never get anything done because you have to build everything in a way such that you don't trust anyone, including your own staff. So now your staff have ball and chains shackled to their ankles to prevent them from misbehaving (but also preventing them from having agility).

It's 100x cheaper and easier to do the cheapest 80% of security, and then hope that you don't get exploited by the other 20%.

<comment><USER4> You say black hole, us security people call it a "hard problem".

I mean lots of IT things are or end up being black holes.

I will say though, usually, attitudes like yours end up causing more problems than they solve (casual dismissal of security in general, more of a bother, doesn't stop everyone, waste of time, etc. etc.)

I like to think of security like this: My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. Yes, black hole, but my (infinite) glass is half-full.

<comment><USER3> The problem with security is that there is never "enough." It's a game of cat and mouse that will consume ever increasing amounts of time, money, and electricity until the end of time. Time, money, and electricity that could be spent on other things. Pretty soon I expect 50% of my electricity to be uselessly devoted to spectre mitigation and other security concerns instead of, you know, computing useful stuff.

Yes, I get we live in a world where bad people take advantage of others, making security necessary.

But if security people had their way, hobbyists wouldn't be allowed to hack together a side project without first hiring a $100k/year security specialist.

> My goal is to make it as hard and annoying as possible for bad guys to do > bad things to the systems I'm responsible for.

By making it hard and annoying for the good guys to do their job as well. I know it's all necessary, but you can't deny that. Having to beg and plead with the IT security gatekeepers every time I want to [open a port for a webserver/install some package/etc] is more onerous than me having sudo privileges, especially when IT tickets take 2-3 days to resolve. And that's just one example. Anything security related is usually a pain. HTTPS is much more painful than HTTP, for example.

<comment><USER5> Security is a trade off. Everyone knows that the most secure computer is one that you never turn on; the job of your security team is to strike a balance that is better than that.

<comment><USER6> > _the job of your security team is to strike a balance that is better than > that._

There are two ways to strike a balance. A cooperative way, and a competitive way. A cooperative way is when all sides get together and hammer out an optimal solution, and then implement it in agreement. A competitive way is when everyone pushes to maximize their interest, and through the fighting, an equilibrium establishes itself[0].

I think GP is complaining about security teams that approach their job in a competitive manner, instead of a cooperative one.

\--

[0] - You'll note that this is how competitive markets work; this both makes them a robust decision-making mechanism, and an incredibly wasteful one.

<comment><USER7> Firms in competitive markets don't fight, fighting would be if one firm's products somehow un-manufactured another firm's products. So, the defense industry, and nothing else. They hurt _each other_ 's bottom lines, but help society as a whole by collaborating to produce more of whatever it is they're selling.

<comment><USER6> > _fighting would be if one firm 's products somehow un-manufactured another > firm's products_

They absolutely do, and would do it much more if most ways of doing that weren't strictly illegal. A particularly notorious, legal way of unmanufacturing your competitor's product is when both yours and theirs rely on a common component - so you can buy out the entire supply of that component to prevent your competitor from releasing a similar product after you. Off the top of my head, Apple did that with these mini hard drives for iPods.

A more common example of fighting is advertising, which becomes a zero-sum game when the market for a product category saturates.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8>
      This is Mr. Eddie Vedder, from
      Accounting. I just had a power surge here at
      home that wiped out a file I was working on.
      Listen, I'm in big trouble, do you know
      anything about computers?

      Right, well my BLT drive on my computer just
      went AWOL, and I've got this big project due
      tomorrow for Mr. Kawasaki, and if I don't get
      it in, he's gonna ask me to commit Hari Kari...

      Yeah, well, you know these Japanese management
      techniques.
      Could you, uh, read me the number on the
      modem?

_\--Dade social engineers a security guy over the phone in Hackers_

<comment><USER9> For those on mobile:

> This is Mr. Eddie Vedder, from Accounting. I just had a power surge here at > home that wiped out a file I was working on. Listen, I'm in big trouble, do > you know anything about computers?

> Right, well my BLT drive on my computer just went AWOL, and I've got this > big project due tomorrow for Mr. Kawasaki, and if I don't get it in, he's > gonna ask me to commit Hari Kari...

> Yeah, well, you know these Japanese management techniques. Could you, uh, > read me the number on the modem?

</comment></comment><comment><USER10> I'll be using this example for years to come with clients who push back on why certain logging and alerting functionality has to be part of customer service related user stories as an acceptance criteria! There is always the insider threat!

<comment><USER10> Seriously. This fits directly one of my go to examples of a user story that needs security constraints:

"As customer service, I need to be able to help my customer regain access to their account easily so that they can continue to do business with us."

I'm teaching a group of developers about Risk Assessment and threat modeling on Wednesday. This is perfect timing to enhance the lesson slides with this story and have them think about "Fraud Against People Assets".

As customer service, I need to be able to help my customer regain access to their account easily so that they can continue to do business with us.

Security Threat: Customer service agents may use their trusted access for fraudulent, purposes.

Compensating Controls / Acceptance Criteria

1\. Software should log all customer service actions and write to a file that is kept for 1 year for review

2\. Users should be informed that their actions are logged in clear, bold language when accessing customer portal

3\. Notify customers at already known contact when anything about their account is changed by customer service portal

</comment></comment><comment><USER11> Step 1, audit everything.

Step 2, have a Red Team that's trying to do sneaky things. Make sure you can catch them.

Is this not obvious?

I mean, it's as obvious to me as "if it's important, back it up," and "if you don't test backups, they're not backups."

Roblox Corporation raised $150M at a $2.5B valuation, in 2018. [1]

That's big enough that they should understand these rules and follow them.

[1] [https://variety.com/2018/gaming/news/roblox-investor- funding...](https://variety.com/2018/gaming/news/roblox-investor- funding-1202926691/)

<comment><USER12> How is this data not covered under COPPA? Most people I know that play Roblox are under 13 years old.

</comment></comment><comment><USER13> Does it really count as a 'hacker' if it was just a straight up bribe? Where is the hacking here?

<comment><USER14> I'd categorize this under social engineering, so... probably counts.

But the terminology issue seems like a surface detail. The attack vector (bribing an insider with front door access to customer data) is a pretty big and actively exploited class of organizational vulnerabilities, so it's a security problem anyway.

<comment><USER15> It is a security problem but it's not hacking. Default passwords are security problems but they're also not hacking. Overhearing conversations in an airport or bar or whatever where sensitive information is disclosed is a security risk but also isn't hacking.

<comment><USER16> These are all examples of hacking. Finding a way in is the goal it can be a clever way but sometimes doing the obvious is more clever.

<comment><USER3> So is torturing a password out of someone hacking? I suppose if the torture method involves a hacksaw.

<comment><AUTHOR> Hacking imho implies a workaround or circumvention that has a certain degree of cost-effectiveness and an indirect angle of attack (e.g. many types of remote exploits). For example, I don't know if I'd consider a brute force calculation of a password to be "hacking", if the cost and time of computing resources outweighed the potential gain. And while hacking a user's arm off might be more "cost-effective" (to put it coldly) than brute forcing their password, it essentially requires the resources and opportunity to have very direct physical access – in the same way that blowing off a bank vault door with explosives doesn't feel like "hacking".

But in any case, I don't think bribery as an effective attack vector for a service as big as Roblox is so self-evident that it lacks cleverness or insight. It's not just the work of finding someone with access privileges (could be as "easy" as searching LinkedIn for people listing Roblox as an employer), but also knowing what to bargain for (e.g. account credentials versus "give me the password of the richest Roblox player"), _and_ having the confidence that the system would allow me essentially unfettered access (i.e. weak access-control policies and threat detection).

Logically, if bribery is such a straightforward and cost-effective attack, then people would be going hard all the time bribing insider employees at a bank. Yet if I had the money and time and willingness for illegal behavior, I'm not at all certain what unauthorized access I could get from any bank employee, nevermind how far I'd get undetected.

To put it another way, "legitimate" hacks usually reveal major substantive ways that a system can/should be hardened. I think it's pretty obvious how Roblox's access-control and auditing should be hardened after this kind of intrusion. How would a company realistically improve its security after learning a user's own account was compromised after the user was tortured into giving away their credentials?

</comment></comment></comment></comment></comment></comment><comment><USER17> And this is why you should not make backend services accessible from the wide Internet, only from a 2-factor secured VPN or corporate internal network.

It's utterly amazing how many companies got hacked by this oversight.

<comment><USER18> Why not just make the back office require 2fa? No need for a VPN

<comment><USER17> Simple: because an Internet-accessible backend will always be a prime target for hackers. RCE exploits, API endpoints where the developer forgot or misconfigured the authorization checks, credential spoofing/phishing... keep that stuff on the real intranet and a whole class of attacks simply vanishes.

<comment><USER18> And a VPN isn't subject to exploits or misconfiguration either?

I'd much rather put my back office behind a 2fa in the browser than use a VPN, it's a far better user experience. Using an off the shelf reverse proxy or commercial solution mitigates to some extent the risk of developers messing up the auth, but both a VPN and proxy can be misconfigured.

[https://cloud.google.com/beyondcorp](https://cloud.google.com/beyondcorp)

<comment><USER19> I would argue that making sure a VPN is correctly configured is easier than making sure every single backend service is configured correctly and patched against all known vulnerabilities. Overall I think its best to keep those things on the company intranet and only accessible remotely via VPN, while further limiting the employee to have access only to the services they need on the network

Even better though, why not use both 2fa and locking such improtant services to the intranet or behind a VPN

</comment></comment></comment></comment></comment><comment><USER20> Does Roblox pay the folks with access to this system a living wage? Why was it so easy to sway someone in this group?

<comment><USER21> This is the main problem and it isn't specific to Roblox; mobile carriers have the same attack vector when it comes to fraudulent SIM swaps.

</comment></comment><comment><USER22> The boundary between cyber criminal and smooth criminal has always been blurred. Consider the social engineering prerequisite for LOVE-LETTER-FOR- YOU.txt.vbs. No one remembers his other worms because nobody opens malware.sh.

</comment><comment><USER23> Back in the days of AOL, before phishing became mainstream, it was all about getting the leetest screen names or wielding power over inferior "hacking" rivals. One of the easiest ways was to befriend college kids who worked as CSRs and eventually extract enough info to call in and reset the password. That eventually stopped working so well when AOL added auditing to their customer support activities. History repeats itself!

</comment><comment><USER24> Online criminal = hacker That is probably the use of the word for most people

</comment><comment><USER25> To prove a point that these people use Microsoft framework for their back back end development.

</comment><comment><USER26> Does that mean Jeff Bezos is potentially the strongest hacker?

<comment><USER25> doing illegal stuff for money and bribes existed since antiquity it's just human nature</comment></comment>


What Earth Tells Us About Life, Intelligence and the Universe - <AUTHOR> http://nautil.us/blog/what-earth-tells-us-about-life-intelligence--the-universe

<comment><USER2> > Earth is about 4.5 billion years old, and early forms of life were > definitely on the planet by 3.7 billion years ago. That bare fact seems to > imply that it wasn't hard to get life going on Earth; if initiating life was > really improbable, then we should have had to wait a long time before its > appearance.

I think that's a big leap to make in drawing conclusions exactly because of the N=1 problem. If we had managed to reproduce a process by which a bunch of organic compounds turn into a the simplest cell type then we could start talking about probabilities of this process happening elsewhere in the universe. It might very well be true that life would start just as easily elsewhere but that conclusion can't be based on the amount of time it took life to appear on earth. The fact that someone wins the lottery the first time they buy a ticket does not mean its easy to win the lottery...

<comment><USER3> _" Earth is about 4.5 billion years old, and early forms of life were definitely on the planet by 3.7 billion years ago. That bare fact seems to imply that it wasn't hard to get life going on Earth; if initiating life was really improbable, then we should have had to wait a long time before its appearance."_

I think it's a significant observation that there's just a single origin of life -- that after a 4.5 Gy sample time, we only observe one type of biochemistry. If you predict abiogenesis happens easily, you should expect it to have happened again independently, many times, and expect to find distinct classes of radically different, "alien" life on earth.

<comment><USER4> Not necessarily. It might have happened that different types of chemistry appeared, but as life evolved, one type pushed out the other. So we can't really tell if life happens easily or not from the fact that there's one type of biochemistry here.

</comment></comment></comment><comment><USER5> Isn't the discussion about extraterrestrial life pretty much entirely speculation?

<comment><USER6> I guess in the same way the Higgs Boson was speculation, or string theory is speculation. It is a valuable hypothesis that is not proven yet.

<comment><USER7> IANAP, but I think the hypothesis is more that it's incredibly likely that life exists.

We have no evidence that it does, only that Earth-like conditions are not unique.

<comment><USER8> A serious question: why are earth-like conditions suggestive of extraterrestrial life and not, say, extraterrestrial McDonalds? The observed frequency is identical so far.

I think the answer must be a bias towards believing in some essential specialness or uniqueness of life, which isn't supported scientifically.

</comment></comment></comment></comment><comment><USER9> It tells us very little, there are more stars in the universe than sand grains on earth [http://www.npr.org/blogs/krulwich/2012/09/17/161096233/which...](http://www.npr.org/blogs/krulwich/2012/09/17/161096233/which- is-greater-the-number-of-sand-grains-on-earth-or-stars-in-the-sky) and we don't even have the technology to properly search our solar system, our sand grain.

<comment><USER4> Considering prospects of living, stars in other galaxies are irrelevant, because they are unreachable. We should, at least now, look at the closest stars around us, which are very few. There's reason to believe even these might be unreachable for us. [https://en.wikipedia.org/wiki/Great_Filter](https://en.wikipedia.org/wiki/Great_Filter)

<comment><USER10> There could be other filters not listed. I sometimes wonder why on the Earth the observed sizes of the Sun and the Moon are the same, and recently wondered if the effect is far better eyesight in some land animals, including humans, than would otherwise be the case. If the Moon looked larger than the Sun, the Sun would disappear more frequently and for a longer time in the daytime, and there'd be no corona; if vice versa, the eclipse would only ever be partial. Because the corona lasts 5 minutes only, once a lifetime, animals will stare at it in surprise. Only animals with eyes which won't be damaged by sustained bursts of daylight will pass on their genes. Perhaps it also gives rise to animals which can see both in the dark and in the bright light. Is such type of eyesight essential for higher intelligence? If so, it's part of the Great Filter, reducing the odds of intelligent life by orders of magnitude.

</comment></comment></comment><comment><USER11> But all the intermediate steps suffer from the same n=1 problem. In fact, those difficult hoops themselves cannot be identified when there's just one experiment.

How are we to know that our experiment is not just an outlier in some way?

I guess there will be more data when we have a closer look at some of these exoplanets.</comment>


The creator of Monkey Island plays and narrates his game, 20 years later. - <AUTHOR> http://grumpygamer.com/8280380

<comment><USER2> Am I just looking at the past through rose-coloured glasses or have they stopped making games like these?

Spent hours on games like Monkey Island, Day of the Tentacle, Space Quest etc. as a kid. Any good modern ones, or should I just replay the old?

EDIT: And preferably with OS X support, as it seems the TellTale games only run on windows! What a bummer, was actually at the point of buying a game for the first time in years.

<comment><USER3> DOSBox works well on the Mac, is free and plays those game that ran on DOS very well. I'm pretty sure at least some of these games only require DOS, not Windows

[Edit: Monkey Island 1 and 2 run under DOS, but 3 requires Win95]

<comment><USER4> Instead of dos, to play lucas art games you're better off using scummvm

</comment></comment></comment><comment><USER5> Who else thinks this would make for a great iPhone port? I really hope Lucasarts jump on that. It did great things to revive Myst.

<comment><USER6> If you've jailbroken your phone, you can: <http://wiki.scummvm.org/index.php/IPhone>

<comment><USER7> Thanks! I can't wait to load Day of the Tentacle onto my iPod Touch!

</comment></comment></comment><comment><USER8> I feel monkey island was the most captivating out of all those type of games (except maybe leisure suit larry?)

<comment><USER9> LSL definitely wasn't the best of the Sierra characters.

I broke out the Space Quest series again recently. Roger Wilco is hands down my favourite character in those adventure games.

<comment><USER10> Tis hard to beat Roger Wilco. Quest for Glory was pretty fun also.

</comment></comment></comment><comment><USER11> In the same vein, I remember seeing online the storyboard of the game, where each puzzles were detailed, but I can't find it anymore. It's very instructive for would-be game designers.

<comment><USER12> Are you sure that was Monkey Island and not Grim Fandango?

<comment><USER11> That's possible, my memories are somewhat foggy.

</comment></comment></comment><comment><USER13> I know it's not the same game but I have fond memories of whiling away hours lost in Space Quest and Roger Wilco.. Thanks

<comment><USER14> The Space Quest games were always wonderful for me- In particular, I loved the multitudes of ways you could die in the most horrific possible way.. I'd often try things I knew would kill Roger just to see what the writers dreamed up as a Death.

Space Quest 1 in particular was special to me, since my father and I played through it together- It was a great learning experience and a fun way to interact with a story together.

In the early 2001-era, I actually started up a project to create a new Space Quest game.. (Sq7.org). We got Josh Mandel, one of the original SQ authors to write us a script, and dozens of animators around the net to donate time.

It went pretty well, but fell apart over a disagreement with Vivendi- They offered to let us release it, but only if we turned over the Copyright.. We had promised Josh and others we wouldn't ever do that, so we were a bit stuck. That lead to disappointment all around, which was acerbated by the now dated look of the project, due to the long dev time of a Fan game. I'd still love to release a SQ game some day, though- It's such a wonderful premise- The not-so- heroic everyman who bumbles and bungles his way to saving the world.

As an aside, we had also tried pitching Vivendi to do commercial remakes of the Space Quest games, on the (Then band new) Nintendo DS. We had a nice discussion with them about it, and worked our arses off on the proposals, but ultimately, they didn't think it was worth it.

To my mind, TellTale games is really carrying forward the spirit of Sierra adventure games. The new Wallace and Gromit is wonderful, not to mention Sam & Max, etc.

I'm excited by their engines, their storytelling, and their sense of fun, and can't WAIT to see what they do for the Monkey Island continuation.

<comment><USER4> I'm actually impressed with Lucas arts open mindedness compared to Vivendi. By the way, I wonder why Vivendi allowed AGD Interactive (<http://www.agdinteractive.com/games/games.html>) to release their King Quest 1 & 2 remake and didn't allow the development of Space Quest 7, seems a bit incoherent...

Hope you can use the work you did on Space Quest 7 and release it one day, I'll be happy to play it :-)</comment></comment></comment>


Ask HN: What is your best book or tutorial recommendation to learn typography? - <AUTHOR>

<comment><USER2> I learned a lot from here [http://practicaltypography.com/](http://practicaltypography.com/)

</comment><comment><USER3> The Elements of Typographic Style is what I'd recommend.

Also, A Type Primer is quite good. :)

</comment><comment><USER4> Back before there was a graphical "web" and all the rest, and when typography was generally relegated to a small subset of professionals, I learned quite a bit from Don Knuth's (yes, that Knuth) TeXBook. He's an entertaining writer, as well, and it was an enjoyable read.</comment>


Rate my nodeknockout project: tweetirc - <AUTHOR> http://tweetirc.com/

<comment><USER2> Nice idea, i thought about something like this myself. I'll check it out.

You should keep the notices window on top/in focus when someone opens the page, though, so they know what they're looking at.

<comment><AUTHOR> Implemented. thanks

</comment></comment><comment><USER3> As I understand it, this is no real IRC-twitter gateway (as is BitlBee, for example), just an IRC-like web interface?

<comment><AUTHOR> thats what the project descriptio nsays

</comment></comment><comment><USER4> Nice idea, but I keep having that all over the tabs : [00:41] Error!: You have been rate limited. Enhance your calm.

<comment><AUTHOR> im being rate limited by twitter. rushing to implement memcached.

</comment></comment><comment><USER2> Windows should automatically scroll with the content (just like a real irc client would).

<comment><AUTHOR> i know, tryed to implement it but it wasnt working "node.scrollTop = node.clientHeight" or something

</comment></comment><comment><AUTHOR> you can vote on <http://nodeknockout.com/teams/celestial-being> if you liked it

</comment><comment><AUTHOR> had 1.896 unique visitors since the 28th, not bad for my standards

</comment><comment><AUTHOR> tweetirc made the preliminay 10th place <http://nodeknockout.com/>

<comment><AUTHOR> ... for 40m ;P

<comment><AUTHOR> back to 9th

<comment><AUTHOR> back to 10th

</comment></comment></comment></comment><comment><USER5> I have been waiting years for someone to make something like this. I still believe Twitter has a lot more room to grow, and a lot more experimental spaces to explore, on the way to becoming more like IRC in many ways.

Thanks for making this, it's awesome!

<comment><AUTHOR> thanks, its very rough but i think i got the general idea working</comment></comment>


$100 to anyone who tricks me into inserting "BackdoorPoCTwitter" in my software - <AUTHOR> https://twitter.com/DefuseSec/status/730897149727137794 <comment><USER2> "You should put this on your website" "Good idea!"

This didn't turn out into the amazing social engineering trick that I hoped it would! Funny nonetheless.</comment>


It is possible to detect and block Chrome headless - <AUTHOR> http://antoinevastel.github.io/bot%20detection/2018/01/17/detect-chrome-headless-v2.html <comment><USER3> The listed techniques not only detect Chrome headless, but all custom browsers built on CEF (Chromium Embedded Framework) [https://bitbucket.org/chromiumembedded/cef](https://bitbucket.org/chromiumembedded/cef), such as Kantu from [https://a9t9.com](https://a9t9.com)

If your goal is to only allow the original Google Chrome browser, that is fine. Otherwise this might cause false alarms.

<comment><USER4> Not only that, but it would be simple enough to just create an iframe based scraping script or browser extension for use in a normal browser, no?

</comment></comment><comment><USER5> And it's possible to pretend not to be Chrome headless too.

[https://intoli.com/blog/making-chrome-headless- undetectable/](https://intoli.com/blog/making-chrome-headless-undetectable/)

<comment><USER6> Hah, this didn't cover window.webdriver, and I was about to post that you can still use that (since I assumed window properties weren't deletable) but... window properties _are_ deletable. Cool.

<comment><USER7> How do you ensure that your deletion code runs in the context of the hosted page but before that page can run any of its own code?

<comment><USER8> From the original article, you put a proxy in front of Chrome headless and inject the deletion code into the HTML of each page before any JS loaded by the page.

<comment><USER9> So now the page needs to checksum itself once loaded to detect tampering.

<comment><USER7> You'd get false positives from e.g. extensions modifying the page.

<comment><USER10> Which, for 99% of extension-equipped users, will be just an ad blocker, i.e. something the websites don't want to deal with either.

The arms race goes on.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I read these things and I think "So much wasted energy and effort"

In the beginning was the web, and it was good. Content came along. Some was good, some was cats. Then paid sites with sign-up. Then search engines. Then ads.

Pretty soon folks thought "I not only own this content, I own how it will be presented to the end user. If I choose to add in cats, or Flash ads, or whatnot? They're stuck consuming it. I own everything about the content from the server to the mind of the person consuming it, the entire pipe."

Many people did not like this idea. Ads were malicious, they installed malware. The practice of using ads on content caused sites to track users like lab rats. Armies of people majoring in psychology were hired to try to make the rats do more of what we wanted them to do.

Ad blockers were born. Then anti-ad-blockers. Then headless browsers. Now anti-headeless browsers.

It's just a huge waste of time and energy. The model is broken, and no amount of secret hacker ninja shit is going to make it work. You want to know where we'll end up? We'll end up with multiple VMs, each with a statistically common setup, each consuming content on the web looking just like a human doing it. (We'll be able to do that by tracking actual humans as they consume content). But nobody will be looking at those VMs. Instead, those invisible screens will be read by image recognition software which will then condense what's on there and send the results back to whoever wants it.

Content providers will never win at this. Nor should they. Instead, we're just going to sink billions into a busted-ass business model over the next couple of decades throwing good money after bad.

</rant>

<comment><USER12> It's more complicated than that, almost all spidering that I do lately for clients is not about scraping the content in a classical sense, but some form of "spying" of one's competition, mainly in e-commerce. Tracking inventories, fine-tuning prices, tracking how they promote certain products online, etc. Not to mention really blackhat stuff that many people do like attacking competition with fraudulent ad clicks and similar. Many times "the content providers" have every right to wish to protect themselves.

<comment> jon-wood I'll add my piece of anecdata to this. I've done a few projects that involved scraping over my career.

1\. Scraping results from a property listing website, specifically to pull the properties an agent had listed and put them on their website. The agent didn't want to pay the fee for API access (they probably ended up paying my employer more to scrape it, and keep that updated, but hey).

2\. Scraping an e-commerce website of a company my employer were working with to keep our product catalogues in sync - the partner had their own platform, but no API for it.

3\. Automating requests to a price comparison website to find out what prices competitors are offering for particular types of customer.

<comment><USER13> API keys can be revoked at any time or the API service can be suddenly terminated. You can't trust them. Scraping is more maintenance, but it is more reliable.

<comment><USER14> But whoever you're scraping can suddenly break your scraping tool too.

<comment><USER13> Temporarily until you work around what they're doing. API key revocation leaves you dead in the water until you rewrite your app to do scraping.

<comment><USER14> Yeah, but imagine they totally redesign their Web site. The "workaround" is a complete rewrite.

<comment><USER15> > The "workaround" is a complete rewrite.

No it's not, it's just swapping out a few selectors or regular expressions...

<comment><USER14> I think that depends on how thorough the redesign is, but surely it's not any less work than if the API breaks overnight.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> You probably want the web equivalent of malicious compliance - <USER2> algorithmically generated web-hole or similar. That way the bot author isn't entirely sure you're on to them; it could be a bot or server error. Like send the right headers but garbage data that looks like it's compressed but isn't, or doubly compressed garbage, or trim pages at a different place (before anything interesting), or slow data transfers, or ...

<comment><USER17> Just randomize the content they're trying the scrape imho

<comment><USER18> I saw that with a page and it works extremely well. Inserting wrong data based on rules (there it was on rate limiting rather than user agent) is extremely hard to detect. The scraper never knows if they see real or wrong data.

On the other hand, this will also get wrong data in search engines.

<comment><USER19> I think you could get pretty far just by simply scrambling the CSS classes and ids.

</comment></comment></comment></comment><comment><USER20> All web automation and automation prevention is a cat and mouse game where you never stop the scrapers, you just create more effort for them. It's like traditional and digital security in that regard, except that security often has an element of difficulty in overcoming it (cryptography, thickness of physical barriers), whereas stopping web scraping is about adding more trivial things to make the process more complicated.

Eventually, human browsing and headless browsing converge. Nobody wants to make the human browsing experience bad, so the headless browsing continues.

In my opinion, if you're running a site that is existentially threatened by someone else having your content, you need something else for your moat.

<comment><USER21> Don't worry. Thanks to the W3C and their EME standards, scraping will reach the level of other sorts of security. I'm surprised I haven't yet seen a simple framework for serving your page not as a page but as an EME-protected blob that bears a rendering of the content. We will see just that.

<comment><USER10> So scrappers will start OCRing screenshots.

This race won't end, and the only result beyond wasted effort is the creation of ever more ridiculous and user-hostile practices.

<comment><USER19> I've seen some DRM that can detect if you're running within a virtual machine and prevent screenshots.

The future will be raspberry pi clusters connected to HDMI capture cards.

</comment></comment></comment></comment><comment><USER22> This feels a bit like the "VMs aren't quite like real machines" problem --- as in, it's a cat-and-mouse game that will probably continue indefinitely.

Personally, as someone who regularly uses several different browsers and experiments with others, I wish the Web was far more browser-neutral.

<comment><USER23> Everything that can't be handled with curl or beautifulsoup is probably not worth the effort.

<comment><USER14> Lots of pages have the content you'd want to scrape injected with JS; headless Chrome would seem to solve that problem.

<comment><USER19> Don't most SPAs have some kind of internal API that is easier to work with than the HTML?

</comment></comment></comment></comment><comment><USER24> The whole point of using an headless browser is to work around web sites that attempt to block simple "curl" style scraping (or where you need to execute JavaScript to scrape).

So making it detectable (intentionally, even, right there in the user agent!) is really absurd.

Or actually, it makes one wonder about Google's motives.

<comment><USER25> That's definitely not the whole point of headless browsers, that's more of a side-effect. The whole point of headless browsers is rather automation and testing.

<comment><USER18> Same as torrents are for the distribution of legal content. That was the original thought and it's still used for that but I'd bet the majority of headless browser requests crawl websites not owned by the scraper.

</comment></comment></comment><comment><USER26> so, now I can run a script to fix all of these things so that headless can't be detected by any of these methods? thanks.

</comment><comment><USER27> Is there a way to enable Chrome PDF Viewer/Widevine Content Decryption Module etc in headless chromium? Is there some switch in chromium code base that would enable that?

</comment><comment><USER28> To every action there is always opposed an equal reaction... [https://intoli.com/blog/making-chrome-headless- undetectable/](https://intoli.com/blog/making-chrome-headless-undetectable/)

</comment><comment><USER29> Re. blocking scrapers: Some of us are neither vast corporate espionage practicioners nor zombie-botnet users: we're on our own, scraping for data science & other academic research purposes.

Is there some way to declare, "I am a legitimate academic user", something akin to 'TSA Pre' status?

"Sure, register for & use the site's API," you'll say. What if they don't have one?

"Sure, just don't slam the server with too many requests in a short time," you'll say. But if they're rejecting you just because they detect you're headless, etc...?

<comment><USER30> > _But if they 're rejecting you just because they detect you're headless, > etc_

Isn't that their right?

If I pay for my outgoing bandwidth (even if I don't) I am under no obligation to give my content/data/whatever to any third party source, even academic.

<comment><USER10> > _If I pay for my outgoing bandwidth (even if I don 't) I am under no > obligation to give my content/data/whatever to any third party source, even > academic._

Aren't you? You put a server on the _publicly routable Internet_. And made it _talk over HTTP_. At this point I believe you've already chosen to waive your rights not to serve content.

</comment></comment></comment><comment><USER31> What's the reason for blocking a headless browser?

<comment><USER32> Headless browsers are used to create robots in order to automate the gaming of web-based value systems - thus diluting the value for legitimate participants. Examples:

* create fake profiles in order to boost someone's "followers" in a social network where you can monetize your "influencer" status

* click ads from a competitor in a way that would trigger fraud prevention from the ad network effectively preventing the competitor to advertise there

<comment><USER33> Yeah I think you covered all the bases here. /s

</comment></comment></comment><comment><USER34> For what it's worth, Dullahan, my headless SDK on top of Chromium Embedded Framework appears exactly the same as desktop Chrome:

Overview: [https://bitbucket.org/lindenlab/dullahan/overview](https://bitbucket.org/lindenlab/dullahan/overview)

Examples: [https://bitbucket.org/lindenlab/dullahan/src/default/example...](https://bitbucket.org/lindenlab/dullahan/src/default/examples/?at=default)

Not suggesting it's better or worse - just an alternative if you need something that appears to be like a desktop browser.

</comment><comment><USER35> Id be careful using this as google crawls (well specifically it indexes) using headless chrome you could block googlebot when you don't want to.

</comment><comment><USER36> This discussion is also happening on a counterpoint posted about 9 hours later, also currently on the front page:

It is not possible to detect and block Chrome headless | [https://news.ycombinator.com/item?id=16179181](https://news.ycombinator.com/item?id=16179181)

</comment><comment> yoz-y The original article does not mention blocking it, just the detection.

<comment><USER37> Good point - for a lot of what unwanted headless scraping would be used for I imagine returning subtly changing patterns of semi-useful data is probably more useful than blocking.

A fully blocked bot will error and get replaced with a working bot. A bot that subtly errors again, and again, and again will look almost-right and create a maintenance nightmare...

<comment><USER18> Yep, just feeding wrong data to a headless browser will trick most. If you keep data realistic (add small random error terms), it could take very long until someone finds out.

<comment><USER38> What if some legitimate user will be fed erroneous data by the algorithm misfire on his system?

<comment><USER37> If someone is setting specialized properties in their browser to impersonate automated browsing, or using automated browsing themselves, the question is only if you (as a content provider), accept that their use is legitimate...

This wouldn't impact day-to-day users baring gross incompetence.

<comment><USER38> The code posted on the site fails simply on incongruity of the JS behaviour (window.chrome) and userAgent. I can see how this can fail with common user setting userAgent to Chrome on Edge or Firefox for some compatibility reason or just forgetting to turn off old referrer override. There can be other valid reasons it will fail if user is not bot that I miss. And BLAM they'll get all wrong data for no reason... You may call it gross incompetence or whatever but this method will get you one angry lost user at the time.

<comment><USER37> UserAgent detection is in the "old" groups, is specific to having your userAgent be "HeadlessChrome", and is no longer recommended. The new triggers are 'navigator.webdriver', or a chrome extension specific object, or specific permissions being set, none of which are relevant to or impacted by any the scenarios you are highlighting...

Of course the JS itself can fail due to incongruent browser behaviour... but why would you trigger a bot obfuscation routine based on a failed JS call?

 _That_ is the gross incompetence I was referring to, and it's hard to call basic errors a lack of basic testing anything but.

Downvotes aside, the kinds of f-ups you're speculating about here are at the level of knowing how true/false works in JS.

And, no, there really are _not_ valid reasons for users to be adding specific properties on their navigation objects to flag for headless, or use specific extension objects that report the use of headless automation, if they aren't. There is no valid reason you should set your Edge userAgent to "HeadlessChrome", either.

That's not an angry lost user, friend, that is an upset unauthorized third- party content scraper. I work with Open Data, so I don't care, but some sites for-realsies do.

<comment><USER38> Providing users with fake data is never a good idea because it can be, and probably will be, used against you in the long run. Plus no sane evil scrapper uses default referrer and no masking so misfires are realistically possible within a thin line needed to detect them.

In any case, users can do whatever they want with their client and expect the service to work properly. If you detect abuse you should block or captcha them but the fact of them being a possible bot doesn't really call for such drastic measure. It's the second worst approach after serving hindering scripts to them.

Disclaimer: I haven't downvoted you as I don't downvote things prompting a discussion.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER39> Worth noting, I believe: the word "block" doesn't appear in the article, and seems to have been editorialized in the poster's title.

</comment><comment><USER40> So headless now knows it is headless. Then what?

<comment><USER41> I believe the usefulness of this is that now the _server_ knows the client is headless. Then blocks it.

<comment><USER42> The techniques explained in the article seem like they'd be JS running on the browser itself, so… the "browser itself knows it's headless" pretty much sums it up.

<comment><USER43> Isn't it more like, "the browser can be coerced into revealing to the server that it is headless"?

<comment><USER18> But for that you need to send content first? That doesn't work before you send the result (unless you want to redirect each request)</comment></comment></comment></comment></comment>


Fastest Growing Startups Who Are Hiring Now - <AUTHOR> http://mattermark.com/15-fastest-growing-startups-who-are-hiring-now/

<comment><USER2> The post was pretty vague on the criteria used for inclusion on this list. From how many possible startups was this list whittled down? What specifically about each company got them put on the list? Are there any conflicts of interest to disclose? Are any of these 15 companies founded by people who are friends of the author? etc.

<comment><USER3> All of the Mattermark rankings are done by Mattermark's "propitiatory algorithm."

Additionally, Mattermark is technically YC S12 and has received funding from VCs, so there are potential conflicts of interest for any of their rankings, especially taken together with the first point.

</comment></comment><comment><USER4> Congrats on Mattermark making it into the list!

<comment><USER5> The list is by mattermark...

I don't know what to say. Certainly I wouldn't have included my self in such a list if I'd have made it.

<comment><AUTHOR> We listed ourselves in the order we are by score. I thought putting together a list of several companies would be more valuable than just posting our position stand alone.

<comment><USER5> which then just shows how silly your system is so far. You included an ecommerce store - I just did a quick DB query and we have over 1k stores that are growing faster relatively and absolutely. Every company that grows this quickly is hiring.

</comment></comment></comment></comment><comment><USER6> Founding engineer from Upworthy here. My email is my username @upworthy.com -- Happy to talk.

</comment><comment><USER7> This list doesn't give me much confidence in mattermark's "proprietary algorithm."</comment>


A simple heap memory allocator in about 230 lines of C - <AUTHOR> https://github.com/CCareaga/heap_allocator#shmall---simple-heap-memory-allocator <comment><USER2> I remember years ago my friend was gong to college for CSCI and had to write a malloc for a course. He procrastinated till the last... night... and wrote it. In the free() routine, he simply wrote "return true;". The TA's unit-tested code because there were over a hundred classmates to test. Well, the unit- tests must not have been very good because he said he scored a 100.

<comment><USER3> Ha.

Ages ago, I was told to add copy protection to one of the products I managed.

I didn't want to. Hackers posted cracked versions of our apps within a few days any way. And our legit customers hated it.

Our company's QA/Test in charge of these things signed off on my implemention. Surprising. I knew it didn't work (as expected). But what the hell. I embraced her acceptance (buyoff), and burned those gold master CDs, meeting our deadline, pleasing our dealers, and had a new release to show-off at the trade show. Woot.

About a year later, this QA/test person figured out that implementation (for that release) never worked. She wasn't very happy with me.

<comment><USER4> "I embraced her acceptance (buyoff)".

What does that mean? My understanding is that a buyoff is a bribe, but your last paragraph implies it wasn't a bribe.

<comment><USER3> I meant the tester acknowledging the acceptance tests passed, so we had her approval for release.

<comment><USER4> Ah ok, signoff then.

</comment></comment></comment></comment></comment><comment><USER5> Coincidentally, the libc malloc/free implementation in 7th Edition Unix is also about 200 lines of C: [http://www.tuhs.org/cgi- bin/utree.pl?file=V7/usr/src/libc/ge...](http://www.tuhs.org/cgi- bin/utree.pl?file=V7/usr/src/libc/gen/malloc.c)

<comment><USER6> Is it my unfamiliarity with C or the code is really terrible? It seems that coding practices that we have started to think of as common sense are anything but.

<comment><USER5> It's certainly not the style I would expect C to be written these days, but I don't think it's terrible code. It was, 40 years ago, genuine shipping real- world code. There's a related quote about this in the foreword that Dennis Ritchie wrote for the reprint of the Lions commentary: "You will find linear searches, primitive data structures, C code that wouldn't compile in 1979 let alone today, and an orientation towards a machine that's little more than a memory. But you will also see in the code an underlying structure that has lasted for a long time and has managed to accommodate vast changes in the computing environment." We're still calling malloc() and free() and realloc() today with the semantics that the Unix designers assigned them in the 1970s, even if the underlying implementations are significantly different. The bones of the design are strong; the initial implementations may have been naive but they were good enough to ship (and remember there were only a fairly small group of people writing the whole OS and userland).

<comment><USER7> It seems that it's not entirely the same semantics: [https://www.spinellis.gr/blog/20170914/](https://www.spinellis.gr/blog/20170914/) ( [https://news.ycombinator.com/item?id=15246690](https://news.ycombinator.com/item?id=15246690) )

<comment><USER5> That blog post is talking about the kernel's internal allocator, not the libc one.

</comment></comment></comment></comment></comment><comment><USER8> It's not a "simple" allocator. It's an overly simplistic and largely unoptimized one.

E.g. try and make it work well with 2 threads. Now try and make it work well with 2 threads, one - allocating, another - freeing, etc.

Writing a memory allocator is a _fantastic_ exercise in data structures and optimization. It's also an easy one, so making a reasonably fast allocator from scratch is not that hard, but in the end it's much more fun to write one than to look at someone else's results. This is also what makes these toy allocators to be a dime a dozen.

<comment><USER9> Is there an allocator that uses lockless programming?

<comment><USER10> IIRC jemalloc has per-thread pools & caches which I assume can be accessed locklessly. I don't think the entire thing is lossless, and neither is tcmalloc. And as far as I know these are the only significantly thread-aware allocators (or at least production-ready ones).

<comment><USER11> glibc has also grown a good thread-aware allocator, though that is more recent than tcmalloc or jemalloc.

</comment></comment></comment></comment><comment><USER12> _" Each chunk of memory has a node struct at the begining and a footer struct at the end._"

As a public service announcement, if you are building a heap manager for C code, don't do this (put your heap control structures next to the allocated memory). Sure it looks elegant, however a _VERY_ common C bug is the 'off by one' error, and when an off-by-one can corrupt the structures that define the heap, well it gets out of hand quickly.

Have your heap structures "far" away from the allocated memory. Yes you burn another N bits (where N is log2(max_address)) in your heap control structures, and yes you may have heap control structures you "don't need" pre-allocated, but your future self will thank you for doing it this way.

</comment><comment><USER10> > In order to initialize this heap, a section of memory must be provided. In > this repository, that memory is supplied by malloc (yes, allocating a heap > via heap). In an OS setting some pages would need to be mapped and supplied > to the heap (one scenario).

brk/sbrk is a bit of a pain but would it really be more complicated to use mmap?

<comment><USER13> mmap isn't available on Windows. On those platforms it is available on, there could be subtle differences. If you don't care about memory protection, there is no reason not to use malloc.

<comment><USER14> It's there in spirit. VirtualAlloc is extremely flexible. brk is really intended for a segmented environment but it makes it almost impossible to return commit back to the OS.

A lot of unicies allow over commit because of this where windows will fail the alloc. The windows design is much better if you care about handling OOM.

</comment></comment></comment><comment><USER9> What's the state of the art in memory allocation?

<comment><USER15> The application acknowledges that a general purpose allocator can't be tuned to it's specific needs and therefore implements it's own very restrictive, specialised, simple and fast allocators.

The most simple and therefore fastest possible memory allocator usually is just a continguous byte array and an offset. On allocation you check if there is enough memory left and if not you request another very large block of memory from the general purpose allocator. Otherwise you merely return the current offset and increment the offset by the size of the allocation. Of course the restriction here is that you can only delete all allocations at once or none at all.

Generational garbage collectors go one step further. They are capable of detecting whether the object is alive or dead and thus make it possible to keep them and move them into an different memory area. Unfortunately the garbage collector has to stop all mutator threads otherwise the mark and sweep phase, copying phase and compation phase would not work. There do exist some concurrent garbage collectors but they are not widely used.

</comment></comment><comment><USER16> ..sometime ago had come across [ jemalloc, tcmalloc ] memory allocators whilst solving a performance limitation of platform (in a multithreaded environment) - I think it was jemalloc which gave real boost in performance. Worth trying them too.

</comment><comment><USER17> Could you use this as a malloc/free replacement or is it missing something?

<comment><USER10> Aside from not being a good allocator, it's implemented on top of an existing malloc so it doesn't actually work.

<comment><USER18> Removing the calls to existing malloc on an embedded system would be trivial. Just point it at a predefined RAM area instead. It uses malloc only so you can play with it on a full featured OS, not because they left something out.

</comment></comment></comment><comment><USER13> I suspect that some of the functions for iterating the linked lists are a big drag on performance. Such as: [https://github.com/CCareaga/heap_allocator/blob/master/llist...](https://github.com/CCareaga/heap_allocator/blob/master/llist.c#L68) An optimization that most memory allocators use are to instead store the nodes in a balanced tree, such as a red-black one. Or even better, a B-tree. That turns those functions from O(n) to O(log n).

<comment><USER19> > _An optimization that most memory allocators use..._

Got any evidence to support this claim? I call b/s, especially on the "most" part.

Balanced trees introduce an _extra_ per-node overhead, they tend to thrash the cache and are generally inferior to a simple array of double-linked lists indexed by the block size range.

* An AVL tree doesn't have the per-node overhead, but it is very cache-unfriendly.

<comment><USER13> How about the memory allocators used by Linux, Windows, BSD and Solaris? :)

It doesn't matter if the allocator uses buckets (indexed by the block size range) or not, it still has to find blocks of suitable size, for some definition of "suitable." So look at his get_best_fit and add_node functions. These ensure that his alloc and free functions are O(n) at best. Clearly, we can do better.

<comment><USER19> What about them?

Are you making an educated guess that there should be a blanced tree somewhere in there? If yes, then it's a wrong guess, because there are better options that aren't based on a boatload of conditional branching and that _are_ routinely used in a lot of allocators. If no, there shouldn't be hard to produce relevant code segments. Especially since these trees are virtually everywhere as per your opening remark.

<comment><USER13> See f.e:

Address spaces in modern operating systems. Address spaces can consist of a large number of virtual address regions. As one example, on a typical Linux desktop, GNOME applications and web browsers such as Firefox and Chrome use nearly 1,000 distinct memory regions in each process. To manage this large number of regions, most modern operating systems use structures like the ones in Figure 1 to represent an address space. Linux uses a red-black tree for the regions, FreeBSD uses a splay tree, and Solaris and Windows (prior to Windows 7) use AVL trees [18, 24].

[https://people.csail.mit.edu/nickolai/papers/clements- bonsai...](https://people.csail.mit.edu/nickolai/papers/clements-bonsai.pdf)

If you know of any better search structures, then I'd love to hear about them. I wrote my own memory allocator for a vm project and found that storing the free list in a red-black tree was absolutely required for decent performance.

<comment><USER19> This is unrelated, you are switching the subject. The context is an application-level memory allocators, not the underpinnings of the virtual memory systems.

You said -

> _An optimization that most memory allocators use are to instead store the > nodes in a balanced tree, such as a red-black one_

Yet, you still haven't shown a single memory allocator that actually does that. Except for your own.

<comment><USER13> Now I'm beginning to think that you are trolling me. Memory allocators within the kernel works exactly the same as those outside of it. But for one stand- alone library using balanced trees, look at jemalloc.

<comment><USER19> Okay. "Exactly the same as outside of it."

jemalloc uses trees (off the fastpath nonetheless), but hoard doesn't, dlmalloc doesn't, etc.

Common sense derived from CS101 on data structures doesn't directly translate to what's happening in the real world. Your opening comment was pure armchair athelitics.

<comment><USER13> Most memory managers worth their salt tend to cache commonly used sizes, that's why tree accesses aren't on the fast path.

I have now looked at Hoard. It does use std::map which is indeed a red-black tree.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> I was extremely happy to see this as I have been trying to find a single- threaded memory allocator (one which doesn't have any reliance on any form of threading primitives that I simply don't have on the platform I am dealing with, which I point out to make clear that I am not looking for this due to any delusion about performance), but since this doesn't have a license on the code it is essentially useless :(.

<comment><USER21> Did you consider opening an issue about it?

</comment></comment><comment><USER22> Neat! See also TLSF [https://github.com/mattconte/tlsf](https://github.com/mattconte/tlsf)

</comment><comment><USER23> A silly allocator i wrote for fun one night is also under 200 lines of code.

[https://github.com/mbrumlow/toyos/blob/master/kernel/heap.c](https://github.com/mbrumlow/toyos/blob/master/kernel/heap.c)

Admittedly mine has no test or does any fancy stuff -- just needed a simple allocator so I could move forward with a toy kernel.

</comment><comment><USER24> Reminds me of an old project of mine for an embedded platform that needed a memory allocator. Also around 200 lines if you leave out the stdlib functions. [https://github.com/jinie/memmgr/blob/master/memmgr.c](https://github.com/jinie/memmgr/blob/master/memmgr.c)

</comment><comment><USER25> The implementation of malloc in K&R is about 20 lines...

<comment><USER10> It's closer to 50 lines if you don't exclude the morecore helper, and that's using the pretty opaque, outdated and golfy style of K&R itself.</comment></comment>


Why exit strategy is a bad idea? - <AUTHOR> http://print3dc.com/exit-strategy-cleverly-masked-pitfall/

<comment><USER2> That's the difference between venture capital and bootstrapping.

When you have outside investors, they will eventually want to cash out or sell their investment.

If you bootstrap, you can have a business that generates a consistent $200k-$500k/year in profit, even if you can't find some larger corporation willing to buy.

They VC needs an "exit" so they can return the money to their shareholders and then raise their next fund.</comment>


Radiohead Releases New Album with Name-Your-Own-Price - <AUTHOR> http://bygonebureau.com/2007/10/01/rainbows-reveals-a-brighter-tomorrow/

<comment><USER2> Can't wait.

For fans -- email me and I'll send you a link to download a bootleg compilation of live songs appearing on this album.</comment>


Software with the most vulnerabilities in 2015: Mac OS X, iOS, and Flash - <AUTHOR> http://venturebeat.com/2015/12/31/software-with-the-most-vulnerabilities-in-2015-mac-os-x-ios-and-flash/ <comment><USER2> Worth noting: "You'll notice that Windows versions are split separately, unlike OS X. Many of the vulnerabilities across various Windows versions are the same, so there is undoubtedly a lot of overlap. The argument for separating them is probably one of market share, though that's a hard one to agree to, given that Android and iOS are not split into separate versions. This is the nature of CVEs."</comment>


The psychology of the reticle and the feeling of control - <AUTHOR> http://notch.tumblr.com/post/8208212863/the-psychology-of-the-reticle-and-the-feeling-of

<comment><USER2> Some how while I respected his attention to detail I never really respected Notch's attention to game design before this. Endermen feel Hitchcockian in nature. I'm genuinely scared of them already o_o</comment>


New AI Algorithm Can Fix Grainy Images Without Looking at Clean Photos - <AUTHOR> https://www.bleepingcomputer.com/news/technology/new-ai-algorithm-can-fix-grainy-images-without-looking-at-clean-photos/ <comment><USER2> This is really cool, but I think this has less to do with AI and more with sorting algorithms. If the actual scientists say otherwise than I'm wrong, but I can only see AI as merely a buzzword.</comment>


Electron's API Docs as Structured Data - <AUTHOR> http://electron.atom.io/blog/2016/09/27/api-docs-json-schema <comment><USER2> So, what interesting things could be done with this data?

<comment><AUTHOR> From the last section of the article, some are

\- Improvements to electron.atom.io/docs/

\- A TypeScript definition file for more streamlined Electron development in projects using TypeScript.

\- Searchable offline documentation for tools like Dash.app and devdocs.io</comment></comment>


U.S. Senate Report: Over 400 Prominent Scientists Disputed Man-Made Global Warming Claims in 2007   - <AUTHOR> http://epw.senate.gov/public/index.cfm?FuseAction=Minority.SenateReport <comment><USER2> This just in: global warming debated.

<comment><USER3> Yeah, could we save that for some other site? Any time these get voted up, they're all about beliefs and have no real exchange of information.

</comment></comment><comment><USER4> When the creationists tried this same kind of foolishness, 856 scientists named "Steve" signed a petition supporting evolution.

Are the anti-global-warming people really so history-blind as to make the same political miscalculation?</comment>


Ask YC:  How do you embed an image or video based on a keyword search? Are there copyright issues? - <AUTHOR>

I'm looking for something like Google's "I'm feeling lucky" but for image and video embedding. <comment><USER2> Google's "I'm feeling lucky" feature just takes the first result. If there's an image search API you could just use that, taking the first result.

<comment><AUTHOR> I found this:

<http://code.google.com/apis/ajaxsearch/multimedia.html>

So I guess there are no copyright issues? This is for a facebook app. Doesn't Facebook have strict requirements on image copyright?</comment></comment>


New: Custom Details Page (CDP) on Google Play - <AUTHOR> https://geeklab.app/posts/8 <comment><USER2> [https://satheeshkchinnappan.com/custom-details-page-cdp-a- co...](https://satheeshkchinnappan.com/custom-details-page-cdp-a-complete- guide/) Check the detailed post here

</comment><comment><USER3> [https://satheeshkchinnappan.com/custom-details-page-cdp-a- co...](https://satheeshkchinnappan.com/custom-details-page-cdp-a-complete- guide/)</comment>


What's your favorite CSS framework, and why not not? - <AUTHOR>

Why should I make sure to not not use this framework you propose? <comment><USER2> In my eyes the two biggest CSS frameworks would be Bootstrap (obviously) and to a much lesser degree Foundation. Fortunately these two are almost exactly the same in terms of what they achieve and how you integrate them into your app. The decision you have to make is whether you prefer LESS or SASS for a CSS pre-processing language, whether you like the saturated gradients and rounded shapes of Bootstrap or the boxy but shinier theme of Foundation, and other quality of life (for the developer) and aesthetic preferences.

I prefer Foundation due to my preference of SASS over LESS (I was also personally convinced of the benefits of SASS and Compass over LESS by Brandon Mathis and Chris Eppstein) and because it also looks unique in an online world plastered in Bootstrap and other similar-looking frameworks.

<comment><AUTHOR> Both of them fail to center elements. They are also unable to keep the proportions set for them when resizing a window.

Here's code that demonstrates that:

<http://news.ycombinator.com/item?id=4652191>

<comment><USER3> Yeah...emmm...nobody uses the center tag anymore.

<comment><AUTHOR> Why not?

The center tag is the only tag that still centers correctly.

<comment><USER4> It's deprecated in HTML5, you should be using CSS to center elements. You can do this pretty easily:

        width: 500px;
        margin:0px auto;

<comment><USER5> Or text-align:center</comment></comment></comment></comment></comment></comment>