LAPD hacked into iPhone 5S belonging to slain wife of 'Shield' actor - <AUTHOR> http://www.latimes.com/local/lanow/la-me-ln-lapd-locked-iphone-actor-wife-michael-jace-20160504-story.html <comment><USER2> Every time I hear about a husband -> wife murder case that doesn't involve a prior violent crime history or some large amount of physical and circumstantial evidence the two words that go through my mind are "tunnel vision," Without leads the cops just latch on to the only thing they have which is "well... ugh... divorce law gives him a monetary incentive to bust a cap in her ass now don't it?"

I'd like to hear what the defense has to say. I think it's really fishy for a journalist to write an article that basically parrots the prosecution. Maybe the defense couldn't be reached for comment...well then say that if it's the case.

<comment><USER3> This doesn't seem like a case of tunnel vision. The evidence and circumstances of the theory do seem to point towards the husband. Of course, the trial may reveal Jace's innocence, but there seems to be enough evidence that I don't think "lazy police work" applies in this case.

Also: "Jace's attorney and the prosecutor assigned to his case could not be reached for comment."

<comment><USER4> "the trial may reveal Jace's innocence"

That's unfortunate. The system is suppose to prove his guilt, and assume innocence by default.

</comment></comment></comment><comment><USER5> It's no wonder that Apple is becoming increasingly pushy about updates on iOS. I've noticed in the last few months that the new pop-up options are to either "remind me later" (and it absolutely will) or "update now."

I think a huge part of it is trying to stay ahead of this security curve.

Exploits are going to continue to be found in older versions of iOS (and every other piece of software, for that matter). It's kind of disheartening to think that if the authorities just hold your phone long enough, they'll eventually have an exploit to unlock it with.

<comment><USER6> It is interesting when Microsoft did the same with Windows most my peers were pretty outraged. Imagine clicking remind me later in the morning, start a long running process when you are just about to go to have lunch and coming back to Windows installing updates after a restart.

I don't think Apple gains anything substantial from pushing security fixes, however eroding user control could be in their interest.

<comment><USER7> There's one key difference: iOS doesn't automatically reboot itself at seemingly random times. If you choose "install later," it will make sure you aren't on the phone when it starts the process.

That Windows loves to do it with no warning _while you are actively using the computer_ is what makes it annoying.

<comment><USER8> Actually I think Windows has always had a little popup in the bottom right which lets you cancel within about five minutes. But sure, you might happen to step away momentarily during that time.

Thankfully browsers and editors now save and restore their last state, so an automatic reboot doesn't enrage me like it did in the WinXP days.

<comment><USER7> While that modal does exist, Windows for some reason does _not_ give it always-on-top status, so if you have anything fullscreen running you'll never see it. There also seems to be a limit to the number of times you're allowed to delay a reboot, though I'm not entirely sure on that.

</comment></comment></comment></comment></comment><comment><USER9> The killing was 19/05/2014\. iOS8 came out on 17/09/2014, and the iPhone 5S launched with iOS7. It'll have been iOS7, and hence unencrypted by default in a way Apple (and presumably attackers) can access.

<comment><USER10> That sounds right. There are a few unanswered questions.

"[I]n 2015, an Apple technician was ordered by an L.A. judge to help police extract data from the phone's hard drive, according to the search warrant."

So, did Apply comply? If they did, or if they didn't, I don't think this has been reported anywhere.

Perhaps Apple complied and imaged the disk, and afterwards, LA needed a consultant to actually make something of it.

<comment><USER11> There are various statements issued by Apple stating that they do cooperate with law enforcement when they can, and that pre-full-disk-encryption, they generally did.

That said, they sometimes go out of their way to make it inconvenient - if you want data provided on physical media, you have to supply a firewire disk

<comment><USER12> Yes. There is a huge difference between:

1\. "Here's how to break the phone's encryption using available tools today", and;

2\. "Here's a less-secure version of the OS, we'll use our digital signature to convince the phone to accept it."

If they ever do the latter, they can be sure it won't be long before they start getting warrants to push insecure OS updates to everyone named as a "person of interest," which seems to be everyone these days.

And the next time a Snowden leaks that Apple is sending insecure OS updates to more-or-less all iPhones, they have lost an enormous amount of goodwill and brand recognition.

A lot of people believe (rightly or wrongly) that run-of-the-mill Android phones are insecure because the carriers won't push updates, but that you can trust top-tier manufacturers like Apple to keep your phone secure.

The last thing they need is for people to say "Cheap Android, Expensive iPhone, there's no difference."

</comment></comment></comment></comment><comment><USER13> _...had no arrest history, according to public records, but divorce papers from a previous marriage include allegations of threats and domestic violence._

Has there been a divorce in California in the last several decades in which child custody was an issue, which has _not_ included such allegations? Are reporters really that ignorant, or do they just assume their readers are?

<comment><USER14> Well, in Logan, Walker, Jordan, and Horvath (2002) 40% of cases in Kentucky over a two year period did not mention violence (and the court ruling was largely insensitive to the presence or not of violence allegations).

Using the number "Domestic Violence-Related Calls for Assistance" as reference on how to scale from Kentucky to California, ~60 % of divorce cases will have no mention of violence.

(In 2004 Kentucky had 800 calls per 100 000 inhabitants and California had 500; the assumption is that number of allegations in hearings scale with the calls of assistance).

[https://aifs.gov.au/publications/allegations-family- violence...](https://aifs.gov.au/publications/allegations-family-violence-and- child-abuse-family-l/2-international-research)

[https://oag.ca.gov/crime/cjsc/stats/domestic- violence](https://oag.ca.gov/crime/cjsc/stats/domestic-violence)

[http://www.ncdsv.org/fortcampbell/I-12_Kentucky%20DV%20Facts...](http://www.ncdsv.org/fortcampbell/I-12_Kentucky%20DV%20Facts.pdf)

[http://www.census.gov/popest/data/state/totals/2004/tables/N...](http://www.census.gov/popest/data/state/totals/2004/tables/NST- EST2004-01.pdf)

<comment><USER13> Thank you for confirming my point that the domestic violence rate as reported in divorce proceedings far exceeds that as reported to police, by two orders of magnitude. (Presumably some of the reports to police are false, which lowers the actual rate even further. Many such reports are filed on the advice of divorce attorneys, after all.) Doesn't that seem like a fact that a serious journalist would include?

<comment><USER14> What are you talking about? First off, your point was that reports of domestic violence was almost always involved in child dispute cases, which I remarked was not true.

Secondly, the calls for assistance is basically reports to the police, and they (8 per 1000 in Kentucky and 5 per 1000 in California [ACS 2008 estimate]) are close to the divorce rate in the respective states (13 per 1000 in Kentucky and 8 per 1000 in California). Overestimating by saying that all divorces are settled in court (some numbers say that ~ 4 % are), the 60% of cases involving domestic violence means that there would be 7.8 per 1000 domestic violence divorce cases. As this is the same amount as the number of calls for police assistance (8 per 1000), your claim that the rate of domestic violence reported is orders of magnitude greater in court is pure falsehood. The case in California is even worse, with estimated 3.2 per 1000 domestic violence cases versus 5 per 1000 calls about domestic violence.

[https://www.census.gov/hhes/socdemo/marriage/data/acs/Evalua...](https://www.census.gov/hhes/socdemo/marriage/data/acs/Evaluation_tables.pdf)

</comment></comment></comment></comment><comment><USER15> Whoa....slightly off-topic. I mis-understood "Shield" as being a reference to "Agents of S.H.I.E.L.D", in which Patton Oswalt has starred...whose wife recently passed.

Went too far down the rabbit hole there.</comment>


Linux.conf.au 2011 going ahead in Brisbane, Australia - <AUTHOR> http://lists.followtheflow.org/pipermail/chat/2011-January/000274.html

<comment><AUTHOR> Brisbane has been in the news recently because of flooding.

It was announced tonight "the lca2011 team and Linux Australia have made a joint decision that lca2011 will go ahead".

Further information see the main conference site: <http://lca2011.linux.org.au/></comment>


Bespin Embedded 0.6.1: Syntax Highlighting Rebooted - <AUTHOR> http://mozillalabs.com/bespin/2010/02/20/bespin-embedded-0-6-1-syntax-highlighting-rebooted/ <comment><USER2> Hopefully WordPress and other software with online code editing incorporate this into their next release. I was wary of Bespin when I first used it years ago, but since then it's become a pretty nice editor. Makes writing code online a ton easier.

The online collaboration tools on the main bespin site are also great for editing code with other people (job interviews, online tutoring, etc).

</comment><comment><USER3> doesn't work right in chrome</comment>


Fbuild: A Python based build system, unlike Make - <AUTHOR> http://email@example.com/msg01976.html

<comment><USER2> Worth mentioning that the "single phase" concept seems to be the same as djb redo <http://cr.yp.to/redo/atomic.html> which djb described (but never released) some 10 years ago.

apenwarr implemented the redo spec in python "to the letter", and also a shell script called "do" which is very short, and can be shipped with a project so one does not have to worry about having it installed.

That said, a quick look at fbuild shows that it is interesting, and despite a similar concept, very different from redo.

</comment><comment><AUTHOR> Here is the meaty part:

        As I mentioned previously, every build system I've
        found is based off of a multi-phase declarative tree
        evaluation.  Here's the list of the system I looked at:

        * [Ant] (http://ant.apache.org/)
        * [Automake] (http://www.gnu.org/software/automake/)
        * [Boost Build] (http://www.boost.org/doc/tools/build/index.html)
        * [Cmake] (http://www.cmake.org/)
        * [Make] (http://www.gnu.org/software/make/)
        * [Ocamlbuild] (http://gallium.inria.fr/~pouillar/)
        * [Omake] (http://omake.metaprl.org/index.html)
        * [Qmake] (http://doc.trolltech.com/4.2/qmake-manual.html)
        * [Rake] (http://rake.rubyforge.org/)
        * [SCons] (http://www.scons.org/)
        * [Waf] (http://code.google.com/p/waf/)

       By "declarative tree evaluation", I mean that the order
       of evaluation is explicitly encoded in a dependency
       tree.  Each node has a function that takes one or more
       inputs and returns one or more outputs. By
       "multi phased", I consider building the tree as one
        phase, walking the dependencies as another, and
       evaluating the nodes as yet another.  This contrasts
       with `Fbuild`, which I consider to be a single-phase
       procedural build system.  As python evaluates each
       cached function, the dependency implicitly gets
       evaluated.  This means that it's possible to dynamically
       modify the build on demand:</comment>


Aaron Swartz documentary under development - <AUTHOR> http://www.aaronswartzthedocumentary.com

<comment><USER2> Do documentaries like this bother anyone else? I'm only surmising from the trailer, but it seems to take this very serious event and over dramatize it into something like the bogus Gasland documentary. I already know about this tragedy, so maybe this movie's not for me.

<comment><USER3> No because I believe Aaron would be upset if there weren't people fighting to right the wrongs of his death or murder.

This wasn't a clear cut case of suicide. He was practically murdered by the state. What would you do if you were facing those charges, and anyone that tried to help you being bullied to march forward with their agenda.

An agenda that the corrupt politicians in Washington are pushing. An agenda to close and wall the internet so more free people can be brought to "justice" for their crimes against corporations.

<comment><USER4> > What would you do if you were facing those charges?

Are you asserting that suicide is the most reasonable option in a situation like this?

I've noticed this sentiment a lot lately (you hear it all the time in discussions about youths who commit suicide after having been bullied excessively); as if outside forces are overwhelmingly responsible for when a person takes their own life, and any personal culpability that that person might have had is thrown out the window.

I'm not saying that the events that contribute towards a suicide should be ignored, but it's important to remember that suicide, by definition, is always a personal choice. We should be doing more to assist, or even empower, those who feel as if they have to make that choice.

Instead of doing the easy thing and blaming a scapegoat (to say that "[Aaron] was practically murdered by the state" is ludicrous, and not at all productive), why don't we look at the root of the problem - what _really_ caused Swartz to do what he did (i.e., a poor state of mental health, something that currently affects millions of Americans) - and work towards preventing it from happening to others?

<comment><USER5> Suicide is a symptom of acute mental illness. Framing it in terms of personal responsibility is often cruelly ignorant because it ignores much about the actual experiences of the person involved.

Would you blame a diabetic who loses his foot because he was unaware that he'd contracted an infection? Would you give a lecture on personal responsibility to the mother of a child whose first asthma attack ever was fatal? If someone dies of an infection contracted because someone else threw them in a septic tank; is it their fault for swimming in sewage?

In Aaron's case, we don't know exactly what was going through his head when he killed himself; but we do know he was being put under extreme pressure by prosecutors who were less interested in justice than in punishing him for imagined slights, especially the PACER affair.

<comment><USER6> Thank you for pointing this out. People shouldn't be 'blamed' for taking their lives. However, I always feel this uneasiness around people when, like you said, the fact that suicide is a symptom of mental illness is brought up. It's as if people associate having mental illness with being some sort of 'good person club' outcast, or having some character flaw.

<comment><USER4> Technically, mental illness _is_ a character flaw ("a limitation, imperfection, problem, phobia, or deficiency present in a character who may be otherwise very functional"[0]).

[0]: [https://en.wikipedia.org/wiki/Character_flaw](https://en.wikipedia.org/wiki/Character_flaw)

<comment><USER6> No, it's not. it's an illness. Your quote is about 'character flaw' as a literary critique concept. I was going to say in my post (the grandparent) that it could be argued, though not technically. Technically, it's _not_ a character flaw.

<comment><USER4> Fair enough; I wasn't aware that there was a difference. I've always thought that a person's "character" is "the aggregate of features and traits that form the individual nature of some person or thing"[0], but it looks like the most common usage only refers to concern moral/ethical characteristics.

To be clear, I'm not singling out people with _mental_ illnesses; as a person with a physical illness, I would have considered it to be one of my "character flaws".

[0]: [http://dictionary.reference.com/browse/character](http://dictionary.reference.com/browse/character)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Kickstarter: [http://www.kickstarter.com/projects/26788492/aaron-swartz- do...](http://www.kickstarter.com/projects/26788492/aaron-swartz-documentary- the-internets-own-boy-0)

</comment><comment><USER7> Kickstarter ended month's ago, the movie is now in production. I haven't heard much in the way of updates though.

</comment><comment><USER8> It's great to see things like this about Aaron continue to spring up. He truly was a great guy and his contributions and efforts seem as if they won't ever be forgotten. Regardless of your opinion on what he did with JSTOR, the guy truly, truly cared and believed in what he was doing and I feel anyone can respect that. It's hard to believe it has been almost a year now. RIP.

</comment><comment><USER9> I've very excited to see this, hopefully it will help Aaron's Law to pass too.

</comment><comment><USER10> Cool they are doing a creative commons open license on the footage. I'll have to do a re-edit and change the cringeworthy title.

<comment><USER11> Fix your link too.

</comment></comment><comment><USER12> In this situation, is there a notion of a "rightholder?" Someone (e.g. his family) who can sell the right to make the film?

<comment><USER13> You don't need permission to make documentaries about people.</comment></comment>


Using Git bisect - <AUTHOR> https://dev.to/gonedark/using-git-bisect <comment><USER2> I think git bisect is one of the most useful tools that git gives you, and one that not many people use when they should. It's not every day one needs to bisect, but when you need to, it's very good to know about it.

One of my worries with git bisect and other tools, is that it's very easy to use them when the application is very quick to test the correctness of it, but veeery slow if for each commit you checkout you need to restart some process, clear some cache, deploy something, repopulate some other thing, and then you can check for correctness. I guess the way to deal with that would be tests, but tests are not always the solution or even a possibility.

<comment><USER3> Tests generally _are_ the answer for the complex stuff in my experience.

If it takes you more than a minute or so to check for the failure, then write a script to automate it. Once that's done, you can just run the script at each iteration of bisect, and you'll save time in the long run. The bonus is that the script you've written to determine a failure case will also serve as a regression test so that the same bug won't be reintroduced in the future.

Adding the script as a regression test isn't always a possibility (you may not have a set of tests to add it to), but that's just a "value add" anyhow.

Oh, and if you don't have tests at all, that's a _huge_ red flag. That should be remedied as quickly as possible.

<comment><USER2> I agree, but what if this script takes itself 10 min to run because it has to do lots of work? That's the slow cases I mean.

As for tests, of course it's great to have tests, but how do you test if a streaming video from a phone app is dropping more frames after a specific commit? there are things that are hard to test with a script. And usually these are the cases where bisect is very useful, because it reduces two weeks of debugging to two days. Which is still a long time.

</comment></comment></comment><comment><USER4> I've used git bisect five or six times in the last three months. Only five or six times in this person's career? Wow.

<comment><AUTHOR> I've needed it once in the past 30 years ;-)

Actually, I needed it a couple times before Git was invented, but that doesn't count.</comment></comment>


Certificate Revocation Issue - <AUTHOR> https://downloads.globalsign.com/acton/fs/blocks/showLandingPage/a/2674/p/p-008f/t/page/fm/0 <comment><USER2> The handling of this has been quite terrible. The article is the first "good" communication about an event that started 7 hours prior. And according to the communication will take another 4 days to solve completely.

Before this, the Technical Solutions Director tweeted solutions that did not work for end users, but highlighted a typical IT centric approach to problem resolution ("Works, What's the problem?") [1]

For anyone not already aware, check out Let's Encrypt. I am evaluating it for about 200 domains now in earnest after having it on my horizon for some time. At least to have it ready as a fallback. [2]

Getting 200 EV certificates in a hurry from a different CA has been costly this morning.

[1] - [https://twitter.com/vanbroup/status/786548172864626690](https://twitter.com/vanbroup/status/786548172864626690) [2] - [https://letsencrypt.org/](https://letsencrypt.org/)

<comment><USER3> Let's Encrypt doesn't offer EV, and AFAIK, they don't plan to.

<comment><USER4> CertSimple only does EV (and we happily recommend Lets Encrypt, CloudFlare, Heroku and other free sources if you only need a DV cert).

We're 18 months old and the main reason we exist is to make the identity verification EV adds not a pain in the arse.

Here's a list of ways we do EV differently from other providers: [https://certsimple.com/about](https://certsimple.com/about)

I've been on HN for nearly as long as pg has so feel free to give me a shout here if you have any questions. It's past midnight in the UK right now so I'll answer them tomorrow morning. If you prefer email: mike@certsimple.

<comment><USER5> Tried it out for the heck of it. Unfortunately Dun & Bradstreet has old address information for my company and their account creation system is broken (error 'CEPDEV101' when creating an account). So the "3 hour" validation will take a lot longer, through no fault of CertSimple's.

<comment><USER4> Hi Steven! Check the 'Next steps' email which has specific instructions for your company - we don't rely on Dun & Bradstreet to update.

</comment></comment></comment></comment></comment><comment><USER6> In case you can't access their website

Dear Valued GlobalSign Customer,

As most of you are aware, we are experiencing an internal process issue (details below) that is impacting your business. While we have identified the root-cause, we deeply apologize for the problems this is causing you and wanted to ensure you that we are actively resolving the issue.

GlobalSign manages several root certificates and for compatibility and browser ubiquity reasons provides several cross-certificates between those roots to maximize the effectiveness across a variety of platforms. As part of a planned exercise to remove some of those links, a cross-certificate linking two roots together was revoked. CRL responses had been operational for 1 week, however an unexpected consequence of providing OCSP responses became apparent this morning, in that some browsers incorrectly inferred that the cross-signed root had revoked intermediates, which was not the case.

GlobalSign has since removed the cross-certificate from the OCSP database and cleared all caches. However, the global nature of CDNs and effectiveness of caching continued to push some of those responses out as far as end users. End users cannot always easily clear their caches, either through lack of knowledge or lack of permission. New users (visitors) are not affected as they will now receive good responses.

The problem will correct itself in 4 days as the cached responses expire, which we know is not ideal. However, in the meantime, GlobalSign will be providing an alternative issuing CA for customers to use instead, issued by a different root which was not affected by the cross that was revoked, but offering the same ubiquity and does not require to reissue the certificate itself.

We are currently working on the detailed instructions to help you resolve the issue and will communicate those instruction to you shortly.

Thank you for your patience.

Lila Kee Chief Product Officer GMO GlobalSign

US +1 603-570-7060 | UK +44 1622 766 766 | EU +32 16 89 1900 www.globalsign.com/en

<comment><USER7> One thing that shocks me about this is the browser responses. Opera would not allow me to visit the sites affected, citing a revoked cert and possible attack. While I appreciate the warning, it was odd to see the site fully disabled.

Safari on the other hand silently failed the https auth and served the page regardless. Concerning behavior for a revoked cert.

<comment><USER8> That might depend on the specific Safari version. I am using Safari 10 on macOS Sierra, and it would not allow me to access any site using one of the affected certs: instead it would just serve an error page.

<comment><USER9> I think that was more because of the site, not the certificate - the grey failure page would appear for sites that use HSTS[0]. If the site didn't use HSTS or if you visited it for the first time, you'd get an ordinary certificate error alert.

[0] [https://en.wikipedia.org/wiki/HSTS](https://en.wikipedia.org/wiki/HSTS)

</comment></comment></comment></comment><comment><USER10> This worked for me on OS X:

      sqlite3 ~/Library/Keychains/*/ocspcache.sqlite3 'DELETE FROM ocsp WHERE hex(serialNum) IN ("040000000001444EF03E20", "040000000001444EF04247");'

What a pain in the behind :/

<comment><USER11> That didn't work for me, but this did:

      sudo rm /var/db/crls/*cache.db

From: [https://support.globalsign.com/customer/portal/articles/1353...](https://support.globalsign.com/customer/portal/articles/1353318-view- and-or-delete-crl-ocsp-cache)

<comment><USER10> That removes all caches for OCSP. That seems a little heavy handed IMHO.

but if it works.

</comment></comment></comment><comment><USER12> How does their SSL warranty play into this? Will they have to pay $1.250.000 for each OrganizationSSL certificate? [https://www.globalsign.com/repository/globalsign-warranty- po...](https://www.globalsign.com/repository/globalsign-warranty-policy.pdf)

<comment><USER2> Interesting - 3.3 seems to be applicable here:

"3.3 Intentional or accidental errors This Warranty Policy warrants against intentional or accidental errors introduced into a Certificate by any personnel of a GlobalSign RA or a GlobalSign LRA due to failure to use reasonable care as required under the CPS."

Not a lawyer, but will push this with our legal team for sure.

This could destroy GlobalSign, so there must be a clause to exempt them from liability ... ah, here it is:

"8.1 Total amount for warranty exhausted When the maximum limit allocated for warranty payments is exhausted, GlobalSign shall have no further obligation to refund any Beneficiary, unless required otherwise by applicable law."

<comment><USER13> "introduced into a Certificate"

They didn't introduce any errors _into_ a certificate. They affected the certificate chain, but not the certificate directly. I'm certain this is how their own lawyers view this.

<comment><USER12> If _THIS_ isn't covered by warranty, what would it take to invoke this warranty?

Btw I've always thought these SSL insurance warranties sounded like a scam.

<comment><USER14> It seems likely we'll find out if they are, at least for GlobalSign's.

</comment></comment></comment></comment></comment><comment><USER15> I bought new certificates, for a new set of domains, through AlphaSSL today. One hour later customers starts calling, complaining about revoked certificates. Initially I assumed they had screwed up somehow and revoked our old certs, but after reports saying that it worked with some browsers and failed on others I started googling for recent related issues, and found out about GlobalSign.

Man, do they suck at communication. We're now 14 hours into the incident. 6-7 hours ago they posted a trouble shooting guid, promising new intermediate certificates for AlphaSSL and I've just been informed by their support that it'll be another hour before they're ready.

It's now 02:00 in dk, so I can expect the new certs at 3 and be done by 4.

Fun night.

Thanks GlobalSign.

P.S. Also thanks to the guy who made their marketing department stop tweeting iot crap while this is going on. That pissed me off.

</comment><comment><USER11> This broke bootstrapcdn.com, bootstrap's official CDN. So the effects are extremely widespread even for non-globalsign clients.

</comment><comment><USER16> Since this may take days to resolve completely, here's a temporary workaround for Chrome users -- launch your browser with this flag:

        chrome --ignore-certificate-errors

You'll still know when sites have bad certificates due to the red line drawn through the [https://](https://) portion of the URL. But you will be able to access these sites. But be sure to stop using this flag as soon as you can. It could leak secure cookies to a MitM with a fake cert. _Very_ slim odds of that, but still undesirable. Yet Chrome left us with no other option here.

I must say though, I'm increasingly frustrated by software vendors trying to strip away control over our own machines. There is no option at all from the standard error message, even under advanced, to indicate that you know about this problem and wish to proceed. And I'm sure it's only a matter of time before they remove this command-line option as well.

I get that novices probably need some protection, but I really wish there were a way to say that, "yes, I _really_ do know what I'm doing, please stop treating me like a toddler." So instead, I'm forced to use a much less safe, hidden command-line option or be locked out of various sites for four whole days.

<comment><USER17> > I must say though, I'm increasingly frustrated by software vendors trying to > strip away control over our own machines.

I get the sentiment, but if you look at how common malware is on Windows versus (walled-garden) platforms like iOS, it becomes pretty clear that it's the most effective way to keep users safe. Inconveniencing tech-savvy folk is a small price to pay for that, IMO.

> I get that novices probably need some protection, but I really wish there > were a way to say that, "yes, I really do know what I'm doing, please stop > treating me like a toddler."

Typing "badidea" when faced with the interstitial should do the trick.

<comment><USER16> But that's just it, I'd have to download the source to Chromium, find where this error is thrown, and add a UI element to allow me to bypass the error. That's ... a whole lot more than just inconveniencing me. Flipping a switch in chrome://flags would be an acceptable inconvenience.

This command-line switch works, but it requires accepting a larger risk with respect to secure cookies and MitM attacks.

<comment><USER17> That's why "badidea" exists.

<comment><USER16> ... wow, I thought you were saying that would be a good way of implementing it. Didn't realize that _actually_ worked o_O

Thanks, that's certainly superior to the command-line flag! A touch patronizing, but I guess it could be worse :P

</comment></comment></comment></comment></comment><comment><USER18> What reuptable certificate authorities are left besides LetsEncrypt?

<comment><USER19> Symantec is expensive but they seem to have their act together.

<comment><USER20> Not particularly.

[https://security.googleblog.com/2015/09/improved-digital- cer...](https://security.googleblog.com/2015/09/improved-digital-certificate- security.html)

[https://security.googleblog.com/2015/10/sustaining- digital-c...](https://security.googleblog.com/2015/10/sustaining-digital- certificate-security.html)

<comment><USER21> Also:

[https://groups.google.com/forum/#!topic/mozilla.dev.security...](https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/VjRDU_VAOf8)

[https://cabforum.org/pipermail/public/2016-January/006519.ht...](https://cabforum.org/pipermail/public/2016-January/006519.html)

[https://groups.google.com/d/msg/mozilla.dev.security.policy/...](https://groups.google.com/d/msg/mozilla.dev.security.policy/siHOXppxE9k/OOBlANs4BAAJ)

[https://security.googleblog.com/2015/12/proactive- measures-i...](https://security.googleblog.com/2015/12/proactive-measures-in- digital.html)

[https://sslmate.com/blog/post/ct_redaction_in_chrome_53](https://sslmate.com/blog/post/ct_redaction_in_chrome_53)

[https://www.agwa.name/blog/post/domain_validation_vulnerabil...](https://www.agwa.name/blog/post/domain_validation_vulnerability_in_symantec_ca)

And all of this is just from the last year.

Symantec is one of the worst CAs there is. Avoid them like the plague.

<comment><USER20> Now i have ten tabs open catching up on tweets from you and @sleevi_

[https://bugzilla.mozilla.org/show_bug.cgi?id=1261919](https://bugzilla.mozilla.org/show_bug.cgi?id=1261919) is fun

</comment></comment></comment></comment></comment><comment><AUTHOR> Updates [https://news.ycombinator.com/item?id=12712279](https://news.ycombinator.com/item?id=12712279) [https://downloads.globalsign.com/acton/attachment/2674/f-06d...](https://downloads.globalsign.com/acton/attachment/2674/f-06d2/1/-/-/-/-/globalsign- incident-report-13-oct-2016.pdf)

</comment><comment><USER22> >some browsers incorrectly inferred that the cross-signed root had revoked intermediates, which was not the case.

So it's not their failure but browsers'? Which ones then and what versions?

<comment><USER23> At least Safari and IE, it seems.

<comment><USER24> Beta chrome as well. Stable chrome shows revocation if you click into details; beta marks the cert as revoked.

<comment><USER25> Stable Chrome for me was definitely broken. And in fact, trying to view the details on the revoked certificate caused Chrome to beachball.

<comment><USER24> Weird! Completely different than my experience.

</comment></comment></comment></comment></comment><comment><USER26> I didn't even know that this was what was going on until I saw this on HN and I've been experiencing it all day today.

<comment><USER27> I thought it was Opera's fault: sites would load fine on Firefox or Chrome, but not on my primary browser.

</comment></comment><comment><USER28> This killed one of our main webapps, but since the site was hosted on AWS, I provisioned an ACM certificate (free) in about 5 minutes and manually applied it to the ELB listener. Couldn't have been easier.

Today's weirdness and communication around it has made me trust Globalsign a lot less now.

</comment><comment><USER29> Affecting SoundCloud, though I'm not seeing any ssl issues on my end.

[http://status.soundcloud.com/day/2016/10/13](http://status.soundcloud.com/day/2016/10/13)

</comment><comment><USER30> Revoking keys (and the necessary checking that it requires) will never work IMHO. The only way to solve this problem is short key signature lifetimes, automated signatures and, if compromised, just no re-signature.

Let's Encrypt is one way, although the lifetime with 3 months is a bit too long. One month or even less would be better. Additional verification and checks via DANE/DNSSEC help to shorten the impact of a compromised key. Constant checking for revocations do not. Again: IMHO.

<comment><USER31> If you're going to do that properly, why not more like 1 hour?

<comment><USER32> That'd be pretty rough if Let's Encrypt had an outage.

<comment><USER33> It'd also be incredibly hard on Certificate Transparency servers.

</comment></comment></comment></comment><comment><USER34> This issue affected me as soon as I upgraded my chrome to V54 yesterday. It broke all my CDN hosted files which were using the AlphaSSL Wildcard certificate. We were experiencing low traffic and realized this may have been the issue. Got into Chat support with ssl2buy who provided me with a Comodo Wildcard certificate. It was a pain to recreate and install the certs everywhere. But we didn't want to lose any more traffic.

</comment><comment><USER35> [https://support.globalsign.com/customer/portal/articles/2599...](https://support.globalsign.com/customer/portal/articles/2599710-ocsp- revocation-errors---troubleshooting-guide)

They are in the process of fixing certificates. I know of many that are now ok. Too bad I already bought new ones, won't be going back,.

</comment><comment><USER36> Once we understood that this was caused by the Chrome update we contacted them and we got a free Komodo certificate from AlphaSSL.

</comment><comment><USER37> it looks like this is impacting sites hosted on google cloud using the load- balancer (you upload your cert, and I'm using a globalsign cert). I am getting 502 errors via mobile but via desktop it's fine.

anyone else use globalsign via google load balancer who can confirm?

<comment><USER37> downvoted eh? tough crowd.

FYI the google load balancer issue seems to be real, but not related.

[https://status.cloud.google.com/incident/compute/16020](https://status.cloud.google.com/incident/compute/16020)

</comment></comment><comment><USER38> I've been wanting to switch all our certificates to Let's Encrypt for almost one year. But, there was always something else which needed my attention more urgently.

So, I guess, thank you Global Sign for forcing me to finally make the switch!

</comment><comment><USER39> Luckily I don't have many tenants yet: I replaced my wildcard AlphaSSL with a couple of Lets Encrypt certs to fill the 4 day gap. Four days of inaccessibility is just not acceptable.

This is a real mess.

<comment><USER16> Did the issue directly affect your AlphaSSL site? So far mine's continued to work. May have dodged a bullet by using OCSP stapling, though.

<comment><USER39> Yes it did. I have had multiple emails from clients who could not access the platform.

</comment></comment></comment><comment><USER40> My company uses Google Firebase and Fastly CDN, and we're affected by this issue through both hosts.

</comment><comment><USER41> I assume this explains why so many people are experiencing random SSL issues today.

</comment><comment><USER42> Easy, they just need to revoke the revocation.

What do you mean, X.509 doesn't support that? :P</comment>


Ask HN: At what point does someone become a "developer" - <AUTHOR>

At what point does someone become or consider themselves an iOS developer or Android developer or web developer?<p>Is it when you start learning or when you know enough to make something or when you actually release something you've made on whichever platform you choose? <comment><USER2> You are over thinking this. When is someone an artist? Just do you and call yourself whatever helps you get where you want to be the fastest.

</comment><comment><USER3> It's much easier to define who is not a developer than who is a developer. These are necessary but not sufficient conditions to being an X developer or an X engineer:

In the software world, you can call yourself an X developer when you're competent enough in X that an employer would hire someone with your level of expertise as an X developer with no additional training in X.

For something measurable, I would say 90% of the code you write, assuming you write all of the code in your application, does not require the use of Google. I'm sure there are exceptions to this - this number is based on the language you pick. I need to use Google much more often for Java than C# for instance, because Java relies more heavily on methods instead of language constructs, even though I'm much more experienced in Java.

Both of these fail to capture the true scope of the problem. It's very, very easy to fall into becoming an "expert beginner" and never learn advanced language/framework features: [http://www.daedtech.com/how-developers-stop- learning-rise-of...](http://www.daedtech.com/how-developers-stop-learning- rise-of-the-expert-beginner)</comment>


Code Smells: Iteration - <AUTHOR> https://blog.jetbrains.com/idea/2017/08/code-smells-iteration/ <comment><USER2> At the risk of sounding arrogant, isn't this a bit obvious?

To me, code smells are more about spotting when someone's been forced to do something a bit weird and convoluted. It's possibly the cleanest solution available given the immediate context, but this is actually a symptom (or "smell") that something is wrong with the wider design of the system.

This article seems more about detecting choices around data structures which are bad in any context and have no real link to the overall system design.

<comment><USER3> It's worse than that. We have met the Enemy and the Enemy is us.

Java, as introduced, claimed that nearly everything was an Object. What we got instead was nearly everything is a String.

The Real WTF in this code is that all of the important information is passed around as Strings. The iterator and its source hint at this but she fixes the wrong problem. Ever has this been the way with Java. Despite having a statically typed language nobody turns the data into information and instead your modules just vomit strings at each other. Sometimes in groups of four or more.

<comment><USER4> Agree. I think we're all Stringly-typed developers. We use strings everywhere. We throw strings across system boundaries at will.

<comment><USER5> If you're just using objects to represent groupings of strings and encapsulate behavior around converting them back to strings for output at some point, why not just operate on the strings instead of all the serialization / deserialization? Maybe enough of the quick stuff I do isn't enough to warrant more complex data structures, but I get pretty far into a problem with just dicts (in Python) and generally get annoyed when something returns back objects that have no easy str representation without finagling the object into giving me what I need. I think that this is generally a bigger issue with libraries and treating object metadata (stuff like time stamps, extra attributes, etc) as of equal importance as the data it represents; if an object has one obvious attribute for what the thing is, make that the default thing you get when you just refer to the thing, instead of making everyone call some weird method to turn the instance into the representation that you likely want to get out of it.

<comment><USER6> cat your_comment.txt | fold -w 80 -s | grep that | head -n 1 | sed "s/ have/'d be/" | sed 's/n/to/' | cut -d's' -f1-2

<comment><USER7> If you're going to be snarky, fix the useless use of cat.

</comment></comment></comment></comment></comment></comment><comment><USER8> The author proposes using data structures that use hashing without even mentioning the necessity of having a hash function and immutable data for the hashed objects, because in their case they were basically just using strings.

It isn't always that easy.

</comment><comment><USER9>
      boolean hasName(String
        storedName) {

        return getLoadNames().\
           contains(storedName);
        }

> That's it. No more looping, just a simple check.

And how is set.contains implemented?

[https://github.com/openjdk- mirror/jdk7u-jdk/blob/master/src/...](https://github.com/openjdk- mirror/jdk7u-jdk/blob/master/src/share/classes/java/util/HashSet.java)

wraps

[https://github.com/openjdk- mirror/jdk7u-jdk/blob/master/src/...](https://github.com/openjdk- mirror/jdk7u-jdk/blob/master/src/share/classes/java/util/HashMap.java)

public boolean contains(Object o) { return map.containsKey(o); // map is HashMap }

public boolean containsKey(Object key) { return getEntry(key) != null; }

And finally:

      final Entry<K,V> getEntry(Object key) {
            int hash = (key == null) ? 0: \
              hash(key.hashCode());
            for (Entry<K,V> e = \
               table[indexFor(hash, \
                         table.length)];
                 e != null;
                 e = e.next) {
                Object k;
                if (e.hash == hash &&
                    ((k = e.key) == key \
                       || (key != null \
                     && key.equals(k))))
                    return e;
            }
            return null;
        }

TL;DR how did they imagine a general setContains would be implemented without a loop?

[ed: obviously it makes sense to use a datastructure that more closely match your intent, but the wording here struck me as a bit odd...]

<comment><USER10> But the loop your pointing out is only over the hash bucket, not the entire set. Ideally it will only have a single element.

<comment><USER9> Good point :)

</comment></comment></comment><comment><USER11> Something I see often and is a huge code smell to me is not using the most restrictive form of iteration.

If you see collection.map(...) you know that each iteration is simply a pure function from original element to transformed element, which is an immense help when reading the code.

If you can use only map / filter / takeWhile / join etc to express what you are doing, use those! If not, try and just use reduce / foreach. If not, try and just use for. Only use while if nothing else works!

<comment><USER12> > If you see collection.map(...) you know that each iteration is simply a pure > function from original element to transformed element, which is an immense > help when reading the code.

You'd think so, but I've had colleagues who managed to fuck that up and use map or list comprehension solely for side-effects.

<comment><USER13> Even Excalibur can be used to mince garlic, and even a supercomputer can be used to play Zork.

<comment><USER12> Yeah I mean my point is "trust but verify", I love restricted iteration construct, but just because they're being used does not mean they're being used "properly" unless the language ensures it.

</comment></comment></comment></comment><comment><USER14> I like this kind of article not necessarily because it's revolutionary or groundbreaking (because it's not), but because it serves as a helpful reminder sometimes, and can help stick an "observation bias" bug in my brain to notice more often the sorts of examples it calls out.

<comment> Ar-Curunir Yup, I already know where sets and maps are better than lists, but this article now primes my brain to look carefully the next time I write more code.

</comment></comment><comment><USER15> Reading this article, I got a bit bothered.

I agree with the sentiment: people repeat entirely too much code. There are very few cases where a for-loop is the right thing to write. Using generic methods which can be tested and shipped in isolation is basically always better.

But the article seems to imply there are performance concerns in some cases with its talk of using "a data structure". This irked me, because it's not like Set will beat linear time in balanced read-writes and without care the hash tables end up being non-constant as well.

<comment><USER16> > There are very few cases where a for-loop is the right thing to write.

I'm trying to get my head around that, do you mean any for loop is bad or many nested loops?

<comment><USER15> Indexed loops are just a bad problem waiting to happen. They introduce arithmetic bugs, are the least efficient way to traverse most any data structure but a sequential memory segment, maximize the opportunity for error, and are often harder for compile-time optimizers to work through (since it's harder to prove what they do in situ).

Abstracting away your iteration is important.

<comment><USER16> Like, for(int i=0; i<10; i++) { // todo } OK well yes there can be bugs using the index and even C++ back when I was doing it had the Boost library which had for_each. In Java we got something similar back in Java 5 or 6. Also we have fancy stream operations now in Java 8 which took me the longest time to come to appreciate. The only down side is removed compatibility with other languages like C and C++ and C#, locking in the app to a specific language more.

There is on rare occasion, however, sometimes a problem that is solved more clearly or handily using indexing, similar to step indexing in BASIC.

One use case where I've seen stepped indexing useful is in the field of robotics, which uses step characteristics for synchros and servos.

<comment><USER17> > The only down side is removed compatibility with other languages like C and > C++ and C#, locking in the app to a specific language more.

Using a Stream instead of a for loop does very little to make your code incompatible with C. It is already pretty much incompatible (modulo JNI).

What I mean is: if you want something that looks like C just use that, there is no gain in not learning new constructs just because older languages did not have them.

</comment></comment></comment></comment></comment><comment><USER18> I really don't like the term Code Smells. Its just seems like it heralds finicky criticism that ignores wider context and real-world pressures. Outside of academia, _you can 't release a build without creating a few smells_

</comment><comment><USER19> Hashing is indexing and there is no faster and memory efficient index than an array (not vector) of sorted items. Iteration is the best if you can organize your data for it

<comment><USER20> Not sure what you're trying to get at. Indexing by surrogate index, yes. Indexing by value? That doesn't help. The best you can do is binary search -- O(log n). Hash-based structures are average amortized constant time -- O(1). This works because the key is a function of the value, rather than a surrogate key which is unrelated to the value.

Straight from Wikipedia:

"In many situations, hash tables turn out to be more efficient than search trees or any other table lookup structure. For this reason, they are widely used in many kinds of computer software, particularly for associative arrays, database indexing, caches, and sets."

[https://en.wikipedia.org/wiki/Hash_table](https://en.wikipedia.org/wiki/Hash_table)

</comment></comment><comment><USER21> To say that iteration should be "considered a code smell" is not a good thing to do for the programming community.

Present-day CPUs operate on structures by iterating. On a typical high-level programming language, they are at some point done by either (a) iteration or (b) recursion. If the compiler does not do automatic tail call optimization; then (b) recursion can't be made as optimal (in terms of speed and resources) than (a). The latest Java compiler does not perform tail call optimization and probably never will be able to do it. I mention Java because the article is targeted to the Java crowd.

Thus, iteration IS a very important tool for enhancing performance, and real- world (production) systems might have very important performance requirements.

Iteration, in a code, should just be considered... iteration. No kind of smells.

In the past, there was a very important computer scientist called Edsger Dijkstra wrote a paper called _" Goto Statement Considered Harmful"_, GOTO being considered a "code smell": Dijkstra is a very important guy; an unit of measure, the nanoDijkstra, was named in his honor.

However, even afterwards, new programming languages did include a GOTO statement (or some form), because there are special cases when they are needed for higher performance or (believe it or not!) producing more readable code.

</comment><comment><USER22> The autoplaying code editing animations are really annoying. By the time I've read the preceding text, it is somewhere in the middle and I don't know what it's doing.

Please, can we just agree that animations and videos (and audio) should only play when the reader initiates it? Also, a progress bar would be handy, although it may not always be necessary (for short animal videos and similar).

</comment><comment><USER23> These examples seem to discuss data structure choice what I thought it might be about. I have encountered two major bugs at two separate companies all involving iteration and maps.

Both of the examples were written in Go and although language shouldn't matter, iterating over a map is non-deterministic. But each time the author intended for them to construct the returned data structure in a pre-defined order.

We had been suffering from poor caching performance and saw our Cassandra reads spiking as a result. Once we spotted the incorrect cache key construction, our reads to Cassandra dropped significantly allowing for better performance all around.

Perhaps others would have spotted this but it seems innocuous in code review. I know I will be more diligent in the future.

</comment><comment><USER24> Clickbait title, article doesn't seem to back up this hyperbolous claim either</comment>


Ask HN: Negotiation help, HR dance - <AUTHOR>

Accepted first job out of college w/o negotiation.  Stupid.  Even though it's a job and living somewhat comfortably, I feel burned. New opportunity in lap. Will require detox from current job. Innovation, hard work, stimulation. Sweet.
A few questions...
1) Remain lips sealed until they make an offer, then negotiate upwards?  or, be first to state a number that is higher (current salary + raise, market research, etc.), then prevent downwards negotiation?
One part of me wants to walk in w/ straight face and state current salary + 40%. Sick of jr. compensation and jr. responsibilities. Need some real work...
2) What to pay attention to for RSUs, stock, vesting...?
3) How common is it to negotiate raises and bonuses?
4) How to milk a sign-on bonus? <comment><USER2> What I've seen is that usually, if a company is negotiating in good faith with you, they'll give you an offer that is close to as good as they can make it. Normally you can't get very much more in terms of more vacation, a higher signing bonus, or a higher % for bonus, unless you're a superstar and then the rules are different.

Of course, negotiating for a higher position than what they were considering, and with that the commensurate salary, etc, is totally valid.

If they don't give you the best offer they can, it would make me question whether or not they're a good company to start with. Someone who is trying to squeeze out as much from their new employee as possible doesn't seem to be a company that values keeping their employees happy.

</comment><comment><USER3> The more energy the other party expends on you before salary is brought up, the better. Then get them to mention the first number and then explain that your counter-offer is the real number.

It was a different scenario, but I had a funny manifestation of the energy expended thing. I was doing contracting at a company whose senior guy was leaving imminently. He trained me up to do the work he was doing then left. There I was having been handed a lot of critical knowledge before the company even offered to hire me as staff and negotiate salary.

</comment><comment><USER4> For a "normal" straight salary job I like to state a range as soon as they ask. The "never make the first offer" rule is taken as gosple but IMO, wrong. Stating your numbers (with wiggle room, hence the range) has an "anchoring" effect. To pull the number lower, the other party will have to expend negotiating capital.

As for a stock options go, I would value them as zero but use them as a negotiation "chip" to be traded for real compensation/benefits. Before you trade this (statistically) worthless chip for something, get them to "sell" you on how valuable it is. ;-)

</comment><comment><USER5> Let them make the offer first. Tell them that you're very keen on the job, but are prepared to wait for the best rate offer. Really play up the "I _really_ want to work for you" bit.

The principle is that you put the pressure on them to not lose you. If they really want you generally they'll make a better offer especially if they think that it's a take it or leave it choice for you.</comment>


Why Is It So Hard for Democracy to Deal with Inequality? - <AUTHOR> https://www.nytimes.com/2018/02/15/opinion/democracy-inequality-thomas-piketty.html?action=click&pgtype=Homepage&clickSource=story-heading&module=opinion-c-col-right-region&region=opinion-c-col-right-region&WT.nav=opinion-c-col-right-region <comment><USER2> Stop calling it Democracy— it isn't after all— and the question stops being so compelling. What we call democracy has little bearing on the real thing.</comment>


European Parliament Recommends End-To-End Encryption for All Communications - <AUTHOR> http://www.tomshardware.com/news/european-parliament-end-to-end-encryption-communications,34809.html <comment><USER2> Good to see there's at least 1 government in the world that does what is best for the needs and privacy of the many.

Europe truly is the home of the free.

</comment><comment><USER3> I would be curious to see what effects such a bill would have on other countries' approaches to surveillance and privacy. Taking the UK's push for all forms of communication to be backdoored - would this result in all communication to the EU being blocked? Or would perhaps all communications be encrypted only within the EU?

<comment><USER4> There should be no communications that the government can't read. Said the PM.

So, the EU gets extra security while the UK can get hacked by literally anyone unless they Great Firewall the whole island. Which should be easy to achieve.

I wish them good luck, it would be interesting to see their plan in action. I'd have to move elsewhere, but that's no big deal compared to this awesome free entertainment.

</comment></comment><comment><USER5> Previous discussion: [https://news.ycombinator.com/item?id=14577828](https://news.ycombinator.com/item?id=14577828)

</comment><comment><USER6> Good one;</comment>


Ajit Pai says you're going to love the death of net neutrality - <AUTHOR> https://arstechnica.com/tech-policy/2018/06/ajit-pai-says-youre-going-to-love-the-death-of-net-neutrality/ <comment><USER2> > _ISPs ' required disclosures "will allow consumers to make an informed > decision about which Internet service provider is best for them_

The one that's best for me is literally the only one that's available in my area, so my informed decision is whether to have the internet or not.

<comment><USER3> The FCC actually changed the definition of an ISP so that cellular and satellite providers are included. Meaning according to official FCC statistics your area is swarming with competition, in spite of having just a single wired ISP.

In fact according to official statistics, even rural areas with zero wired internet options have a great competitive landscape. Let that sink in...

<comment><USER4> > The FCC actually changed the definition of an ISP so that cellular and > satellite providers are included.

Wireless providers are competition for home internet service the same way the gas station down the street selling water bottles for $3/each is an alternative to running water.

You aren't going to get a $300 water bill just because some company in another _state_ spent several days secretly filling your in-ground pool with the garden hose without permission, nor would anyone tolerate having that happen repeatedly while being told they can only brush their teeth but not flush the toilet for the rest of the month.

A while back, the DSL here was not working for a few days, so I connected my iPhone to my Macbook. Normally that's not an issue while away from home or in a car for an hour or two, as there are limits to how much data anything could use in that amount of time.

Apple's Photos app proactively downloaded something like _25GB_ of old stuff from iCloud Photo Library that I didn't ask to download, didn't browse through, or even remember having, simply because the local drive had free space and Apple decided that both the space and the bandwidth were freely available for it to waste.

If wireless providers were forbidden from imposing ridiculous data caps I would be fine with calling them competition, because we _do_ have multiple high speed providers here, they're just not _usable_ because they'd rather be selling water bottles.

</comment></comment></comment><comment><USER5> Sure, and Mulvaney is really going to "streamline" the CFPB...

Why is it always "removing regulations" == "removing things that protect the average person from predation"

The small government/less regulations argument is just a dog whistle for unfettered corporatism.

</comment><comment><USER6> He _removed_ the consumer protection. I now know with full confidence he will lie to my face just like certain other politicians. All of his words are now and in the future are automatically hollow.

<comment><USER7> Cite your claim. He strengthened it. Obama admin didn't actually implement any consumer protection.

<comment><USER6> Title II was a consumer protection. It is removed. We have less. The only thing now is a lack of competition unless you count a convenient redefinition of competition to include wireless.

To quote another FCC commissioner: > Internet service providers now have the power to block websites, throttle services, and censor online content. They will have the right to discriminate and favor the Internet traffic of those companies with whom they have pay-for-play arrangements and the right to consign all others to a slow and bumpy road. Plain and simple, thanks to the FCC's rollback of net neutrality, Internet providers have the legal green light, the technical ability, and business incentive to discriminate and manipulate what we see, read, and learn online.

What do we have left? Well truth in advertising. But that just requires lies by omission and half truths to bypass. "Speeds up to 1 Gbit" is truthful. 0.01 mbit is within the advertised "truth", except when browisng websites that not paid Comcast's now legal extortion fee. Then they'll get less.

We have a protection that was removed! Full stop. The existing protection of truth in advertising did not change. So we went _down_.

</comment></comment></comment><comment><USER8> There is a city here with a six lane freeway running right through the middle of many previous residential areas.. It might seem obvious that a six lane freeway produces constant noise, heavy particulate matter in the air all year, and a constant blanket of heavy matter downwind on every surface, the soil, your clothes, etc..

The benefit of this heavy motorway is that areas far from the city became the new (wealthy) suburbs and shopping malls.

It is a matter of record that some local politicians made speeches about how the new freeway would benefit the original city it runs through. I think they use the phrase "tortured truth" to express how these statements reflect what actually happened. I expect somewhat similar rise in fortunes, and drop in privileges, associated with the new "un-Net".

<comment><USER9> > It is a matter of record that some local politicians made speeches about how > the new freeway would benefit the original city it runs through. I think > they use the phrase "tortured truth" to express how these statements reflect > what actually happened.

Does anyone have any more info on the meaning and usage of the term "tortured truth."

I've been looking for new, concise ways to refer to a dishonest use of selectively chosen truth to mislead.

</comment></comment><comment><USER10> Anyone willing to consider that maybe he's right about this issue?

<comment><USER11> As a European: he's right. You'll love zero-rating. I do. :-)

<comment><USER3> You love this[0]? Ick.

[0] [https://en.wikipedia.org/wiki/Zero- rating#/media/File:Screen...](https://en.wikipedia.org/wiki/Zero- rating#/media/File:Screenshot-2017-10-28_MEO_- _Televisão,_Internet,_Telefone_e_Telemóvel.png)

<comment><USER11> Yes, paying extra to get unlimited traffic to certain services is good. It's good there's choice.

<comment><USER3> You, as the consumer, aren't making the choice. The ISP is picking which companies get the privileged position. It is in effect king-making certain services.

<comment><USER11> No because European law does not allow them to do that. If you zero rate YouTube you have to zero rate all video streaming sites, for example.

<comment><USER3> So in effect you're arguing it works due to Net Neutrality?

</comment></comment></comment></comment></comment></comment></comment><comment> polski-g Its important for everyone to know that the existence of non-existence of the Obama-era NN rules had no bearing on what most people think net neutrality did. (read: Those rules did nothing for consumer protection). ISPs were free to opt-out of those rules if they so chose to do so.

[https://techliberation.com/2017/07/12/heres-why-the-obama- fc...](https://techliberation.com/2017/07/12/heres-why-the-obama-fcc-internet- regulations-dont-protect-net-neutrality/)

<comment><USER3> That's a legal theory that was never challenged (i.e. that ISPs could fall outside of Common Carrier status and bypass Title II). It was likely never challenged because not being a Common Carrier might make them liable for the content traveling over the wire.

This article is ruminating on what might occur, not what actually occurred.

<comment> polski-g The DC Court of appeals said just the same:

[https://www.cadc.uscourts.gov/internet/opinions.nsf/06F8BFD0...](https://www.cadc.uscourts.gov/internet/opinions.nsf/06F8BFD079A89E13852581130053C3F8/$file/15-1063-1673357.pdf)

an ISP making sufficiently clear to potential customers that it provides a filtered service involving the ISP's exercise of "editorial intervention." Id. ¶ 549. For instance, Alamo Broadband, the lone broadband provider that raises a First Amendment challenge to the rule, posits the example of an ISP wishing to provide access solely to "family friendly websites." Alamo Pet. Reh'g 5. Such an ISP, as long as it represents itself as engaging in editorial interventi on of that kind, would fall outside the rule. See U.S. Telecom Ass'n , 825 F.3d at 743; FCC Opp'n Pets. Reh'g 28 -29; FCC Br. 146 n.53 . The Order thus specifies that an ISP remains "free to offer 'edited' services" without becoming subject to the rule 's requirements . Order ¶ 556.

</comment></comment></comment><comment><USER7> Can I be the antagonist here?

I simply want a free market for the internet. Stop with government intervention on both sides. Simply protect the consumer and let the free market take over.

Who cares if companies like netflix get charged more? It will allow another competitor to bubble up since Netflix will start adjusting their prices. This works. Its called capitalism.

In theory, simply look at Lasik. Lasik 5 years ago, used to be 5k an eye. Now I can get it from a Pandora commercial for just $200.00. Thats capitalism. It drove prices down. I expect the same thing to happen with this. Competition will drive prices down quickly. It also allows the providers like Cox or Verizon to invest in their infrastructure. EVERYONE knows we are way behind Japan and other countries with our infrastructure.

Let people decide with their dollars, rather than the government deciding.

<comment><USER12> That would be fine if there were _any competition to begin with_.

Allowing incumbents to abuse their customers does devalue them, making their competitors _relatively_ more valuable. The problem is that there are _no competitors_!

What we are left with are incumbents who can devalue themselves via customer abuse without consequence, which simply boils down to customer abuse.

<comment><USER13> By your logic, no competitive market can ever arise because somebody is always the first, and incumbents can't possibly be competed with. Why isn't everything a monopoly?

If lack of regulation allows for an incumbent to engage in anti-consumer behavior, it opens a huge door for a more consumer-friendly competitor to sweep the market.

<comment><USER12> No, my logic is that no one can compete with an already present oligopoly.

Opening that door is fruitless, because it is still impossible for a small business to compete with the oligopoly.

ISPs are already very difficult ventures. There is a _huge_ upfront cost, including infrastructure and land rights, that incumbents have already either paid or had paid for by government aid. There has also been huge support from government for incumbents. New ventures are risky, so incumbents are almost always chosen for tax spending.

And let's not blow this out of proportion: That door is not _huge_. It is barely significant in ideal circumstances. Infrastructure quality and price matter more than net neutrality to most consumers.

</comment></comment></comment></comment><comment><USER14> Part of me really hopes the internet heads into the crapper within the next couple years. It's time for a reboot anyway, to clear the cruft.

<comment><USER15> Reboot the internet with IPv6 and now all your internal devices will be openly addressable to the internet. I see nothing good coming from that.

<comment><USER16> NAT is not a firewall. There's no reason you can't hide your LAN from a WAN connection with IPv6.

<comment><USER17> Exactly right. When I enabled IPv6 on my home LAN, I made very sure that only those hosts (and ports!) I wanted open were available to the outside world. Otherwise, incoming IPv6 is DROP by default.</comment></comment></comment></comment>


Satellite photos of possible crash site of MH370 - <AUTHOR> https://photos-4.dropbox.com/t/0/AAAFoSL9yTdmE2e4_DanfiQ5uk_dIxS6rH4LdM3m2NlzKg/12/278996766/jpeg/32x32/3/1395306000/0/2/DIGO_00718_01_14.jpg/i8-tgdryiKA-RGrF0bqZp6kq1abmJlDkQ-02XKzQQ2E?size=1280x960 <comment><USER3> Mirror for when Dropbox goes over bandwidth limit [http://i.imgur.com/UYDAYfz.jpg](http://i.imgur.com/UYDAYfz.jpg)

<comment><USER4> Thank you. It's 1200 UTC and dropbox is hosed.

</comment></comment><comment><USER5> Here is google maps of the lat and lng's:

[https://maps.google.ca/maps?q=-43.5834,90.5737](https://maps.google.ca/maps?q=-43.5834,90.5737) [from 1]

[https://maps.google.ca/maps?q=-44.0302,91.1327](https://maps.google.ca/maps?q=-44.0302,91.1327) [from 2]

Based off these images:

[1] [https://photos-4.dropbox.com/t/0/AAAFoSL9yTdmE2e4_DanfiQ5uk_...](https://photos-4.dropbox.com/t/0/AAAFoSL9yTdmE2e4_DanfiQ5uk_dIxS6rH4LdM3m2NlzKg/12/278996766/jpeg/32x32/3/1395306000/0/2/DIGO_00718_01_14.jpg/i8-tgdryiKA- RGrF0bqZp6kq1abmJlDkQ-02XKzQQ2E?size=1280x960)

[2] [https://pbs.twimg.com/media/BjJuy3QCUAAHS7s.jpg:large](https://pbs.twimg.com/media/BjJuy3QCUAAHS7s.jpg:large)

<comment><USER6> Ok, so unless they were trying to rendezvous with the secret undersea Nazi base on the underwater volcano, it looks like the "steal the airplane" thing either was wrong entirely or went completely awry.

So I wonder how it got out there.

<comment><USER7> Flying is my bet.

As for scenarios, based on what CNN had on their screens I would say of the media, they have pretty much jumped the shark.

I am more and more interested in what steps international authorities will take with regards to requirements for commercial aircraft. We have the technology to prevent disappearances like this from occurring again, so will they step up and require them? The costs of the search must be pretty high by now

<comment><USER8> One of the scenarios, which has been credited as reasonable, is a big fire in the aircraft [1].

In the scenario depicted, "all the busses are pulled", in which case the airplane goes silent, then restored one by one, except that because of the fire, restoration hasn't been possible.

If that will prove to be the case, I think prevention measures would be quite hard - circuits were silenced.

[1]=[https://plus.google.com/app/basic/stream/z13cv1gohsmbv5jmy22...](https://plus.google.com/app/basic/stream/z13cv1gohsmbv5jmy221vrfyiz3vdhbop04)

<comment><USER9> >which has been credited as reasonable

No it hasn't: [https://news.ycombinator.com/item?id=7431715](https://news.ycombinator.com/item?id=7431715)

</comment></comment></comment></comment></comment><comment><USER10> I am obviously no expert, but I expected something more clearer than this. This doesn't look too different from the smudges and discoloration all over the image (are those ocean waves?)

<comment><USER11> RAAF has gotten radar reflections off the objects in this area.

<comment><USER10> Yeah, I read that bit of news after posting my comment. I guess they do account for something when you add radar reflections of solid objects.

</comment></comment></comment><comment><USER12> "P-8 has arrived in Indian Ocean area; US 7th Fleet spokesperson confirms they have located the debris identified by Australia"

Awaiting confirm on just what it is...

<comment><USER13> "RAAF P3 crew unable to locate debris. Cloud & rain limited visbility. Further aircraft to continue search for #MH370"

[https://twitter.com/AMSA_News/status/446583054002171904](https://twitter.com/AMSA_News/status/446583054002171904)

</comment></comment><comment><USER14> It looks like just waves, or noise.

But I think they think it's real because it looks the same on both types of imaging, while the noise looks different between the two images.

<comment><USER15> Right, the two images are off of two different sensors. Probably off the same satellite, one is a panchromatic image and one is probably one channel off of a multispectral sensor. The DTGs are the same (March 16th 2014, 4:16Zulu/12:16 Local).

For reference, DIGO is the Australian version of the U.S. NGA.

They probably have a bunch of analysts pulling long shifts staring at endless images of ocean along the suspected track.

</comment></comment><comment><USER16> Doubtful on this one. I've seen several objects in satellite images of 'significant size' on Tomnod

</comment><comment><USER17> That is fucking incredible they could find that in the Indian Ocean

<comment><USER18> Funny that the US Military and Intelligence technology was never put to use here. Gives you a sense of the ethics in play.

<comment><USER19> I´m just wild guessing here, but if the US had had the MH370 located with a classified radar or satellite, and they know it had crashed, It would be stupid to disclose that technology. They would better use available resources to point the actual position to the search teams (like: "look at this interesting satellite ping arc"), without showing that they knew the position all the time.

I´m not telling this is the actual case, but I would do it if I were the one in charge of such technology.

</comment></comment></comment><comment><USER20> Watched a mind-blowing TED talk by former NASA researcher Dan Berkenstock on the state of Satellite imagery and what we're going to be able to do in the next couple of years:

[http://www.ted.com/talks/dan_berkenstock_the_world_is_one_bi...](http://www.ted.com/talks/dan_berkenstock_the_world_is_one_big_dataset_now_how_to_photograph_it)

One fascinating use-case is "gleaning a country's consumption from images showing the number of cars in every one of its Walmart parking lots"

We live in such interesting times!

<comment><USER21> There was a story on NPR a few weeks back stating that Lowe's (or Home Depot, I can't remember) is already doing this.

<comment><USER22> [http://www.businessweek.com/articles/2014-02-26/lowes- most-p...](http://www.businessweek.com/articles/2014-02-26/lowes-most- powerful-sales-tool-satellites)

M: [https://operationsroom.wordpress.com/2014/03/04/forecasting-...](https://operationsroom.wordpress.com/2014/03/04/forecasting- store-traffic-from-the-sky/)

[http://mjperry.blogspot.com/2010/08/markets-in-everything- pa...](http://mjperry.blogspot.com/2010/08/markets-in-everything-parking- lot.html)

</comment></comment></comment><comment><USER23> Looks more like sea water reflection.

</comment><comment><USER24> I just watched "All Is Lost" with Robert Redford, and I can't help but think that if you are going to have your boat sink in the Indian Ocean, now would be a REALLY good time to do it.

</comment><comment><USER25> As I mentioned in a previous thread:

Distance between: 43:58:34S 090:57:37E 44:03:02S 091:13:27E is 22.72km according to WolframAlpha

Images are from DigitalGlobe. A commercial satellite imagery / spatial data provider who provide a lot of imagery that powers Google Earth / Map. Also providing the imagery for the crowd-sourced effort for the search.

More info on their satellites on their wiki [http://en.wikipedia.org/wiki/DigitalGlobe](http://en.wikipedia.org/wiki/DigitalGlobe)

</comment><comment><USER26> The MH370 has the following dimensions

 _Wing span 60.9 metres; Overall length 63.7 metres; Tail Height 18.5 metres_

Just thinking out loud... but a piece that's 24m long, seems a bit small. To me it makes me think of a boat or something similar. I guess the news agencies are happy with this news today, at least they don't have to keep on repeating the fluff from the last few days.

<comment><USER27> 60.9 meter wingspan, minus 5.8 meter cabin width, divided by two = 27.5 meters length of each wing. I'd say that computes.

</comment></comment><comment><USER28> Question: why are they timestamped March 16, 2014 ?

<comment><USER29> I'd have thought that was the date of the image capture - surely it takes an immense amount of time to process that volume of imagery in order to pick out such a thing?

<comment><USER30> So there is a chance that from the time the image is taken till today it has drifted and the search area would again has to be widen around that location?

</comment></comment></comment><comment><USER31> 404.

</comment><comment><USER32> Is this really hacker news worthy?

<comment><USER33> A plane full of people vanished with no sign of wreckage nor anything to go on with tens of thousands of kilometres of possible search area. I'd say this is definitely "Hacker News worthy".

<comment><USER34> Actually, it's not even newsworthy. This is very similar to the live coverage of car chases that have no real news value - it is sensationalist journalism at it's worst. There are much bigger problems in the world. Heck, car accidents killed far more people in the US alone since this story began than were on that plane (30k/year means 82/day). And this is ignoring new revelations about technology companies being complicit in NSA spying - <USER2> is _very_ Hacker News worthy.

The Crimean crisis is a good example of a news-worthy story that is absolutely not Hacker News-worthy.

<comment><USER35> It's _interesting_. 99% of the things on hacker news are insignificant and have little impact on the world. No one is saying that this plane is significant.</comment></comment></comment></comment>


GoDaddy now owns nodaddy.com, what happened? - <AUTHOR>

I just noticed that nodaddy.com, Fydoor's site collecting GoDaddy horror stories is gone. It is now owned by GoDaddy and has an IP of 0.0.0.0
Does anyone know what happened?
This has been my favorite place to point people to over the years when they start having problems with GoDaddy. <comment><USER2> Only news article I could find on it: <http://domainincite.com/go-daddy-gripe- site-shuts-down/></comment>


Comodo fails to check CAA records - <AUTHOR> https://email@example.com/msg08027.html <comment><USER3> Comodo is communicating actively in the bug, in the email discussion, and proactively CC'd the original reporter on the bug that was filed about this without being asked to do so.

The general rule in Operations work is tolerance. You don't fire someone for making a mistake, you fire them for lying about the mistake, for refusing to avoid mistake-prone behaviors, and other problem of that sort.

Applying that same principle to CA operations, why on earth should Comodo be "fired" as a CA for this? They're actively working to solve it, they're responsive, and the agreements they operate under will compel a post-mortem into existence if only to meet the terms of their next CA audit.

If, after investigation, they are found to be willfully violating policy, knowingly lying about CAA support, fail to produce an acceptable post-mortem, and/or fail their next CA audit, then _of course_ they should be at risk of direct sanctions - not just a verbal reprimand.

So if your initial response to this issue is "Comodo should be fired", remember that in Operations culture that specific response "X should be fired" is a _harmful_ response to a zero-day report of an incident, and many Operations teams would fire anyone who called for a firing in response to a fresh incident, in order to protect others from that harmful posture.

<comment><USER4> I would bet money (maybe not a lot of money, but money) that the only outcome of this is that Comodo ends up within a month being the CA that most reliably checks CAA records. It would be shocking if Google penalized them for this.

As you say, that's based in part on how they handle it.

<comment><USER3> The thing I'm sad to see is that there's no third-party information stated on _when_ Comodo's CAA verification started and stopped. When they first announced CAA support, who tested it? When did it stop working? So I'm hoping this will come out of the post-mortem and be shared with us all.

<comment><USER5> Comodo is required by Mozilla to publish a public incident report: [https://wiki.mozilla.org/CA/Responding_To_A_Misissuance](https://wiki.mozilla.org/CA/Responding_To_A_Misissuance)

</comment></comment></comment></comment><comment><USER6> Worth noting that the rule they broke has only been in effect for three days ([https://cabforum.org/2017/03/08/ballot-187-make-caa- checking...](https://cabforum.org/2017/03/08/ballot-187-make-caa-checking- mandatory/)). This might cause the CAB to go a bit easier on them.

<comment><USER7> They also voted "yes" to the proposal and had 6 months to implement it.

<comment><USER8> Exactly. For some contrast: I use tinydns, which doesn't natively support CAA records. But I wanted them so I read the CAA spec and wrote a little tool to add support for these records using the generic record format. And I'm not even a programmer! (I can write a little code, nothing serious, and nobody would hire me for it.)

And yet with all of Comodo's resources, they couldn't get this done? I can't take them seriously.

<comment><USER9> I'd assume that Comodo wrote the code, tested the code, deployed the code, and forgot to flip the switch to actually enable it in production.

</comment></comment></comment></comment><comment><USER4> If you're not already familiar with his work, you should know that Hanno Böck is a machine, and someone worth following. If there's some mistake you can make with the web PKI that is so stupid nobody would ever bother to check for it, rest assured that Hanno will eventually check.

<comment><USER10> Couldn't agree more, this (among others) was brilliant: [https://blog.hboeck.de/archives/888-How-I-tricked- Symantec-w...](https://blog.hboeck.de/archives/888-How-I-tricked-Symantec- with-a-Fake-Private-Key.html)

<comment><USER11> Oh that's amazing. Imagine if he'd got, say, Google or Facebook's key revoked and the havoc it would wreak.

</comment></comment></comment><comment><USER12> If this is the first time you've heard of CAA records, note that the "dig" command isn't yet aware of these records types, so you need to tell it to use "type257" as the record type:

        $ dig empty.basic.caatestsuite.com type257

More resources here:

[https://support.dnsimple.com/articles/caa- record/](https://support.dnsimple.com/articles/caa-record/)

[https://caatestsuite.com/](https://caatestsuite.com/)

<comment><AUTHOR> The dig command is totally aware of it if you have updated bind within the past couple of years.

</comment></comment><comment><USER13> Wikipedia has a nice list of previous Comodo malfeasance: [https://en.wikipedia.org/wiki/Comodo_Group#Controversies](https://en.wikipedia.org/wiki/Comodo_Group#Controversies)

Highlights include allowing fraudulent certs to be issued for Google, Yahoo, and Mozilla; working with a malware company; and trademark shenanigans with Let's Encrypt.

<comment><USER14> >working with a malware company

Why is this a bad thing? A cert says "Yes, person x REALLY IS person x, and I can prove it mathematically." It doesn't say "Person x is trustworthy enough for me to vouch for them."

<comment><USER13> Who do you imagine they verified was Person X? More on the malware cert issuance: [https://blogs.msmvps.com/donna/2009/05/18/microsoft-mvp- mike...](https://blogs.msmvps.com/donna/2009/05/18/microsoft-mvp-mike-burgess- respond-to-comodo-s-ceo-on-comodo-certificates-issued-to-malware- distributors/)

For malware concerns there's also Comodo's relationship with PrivDog. I'm not clear on whether PrivDog is deliberate malware or just incompetent insecure software.

<comment><USER15> That is ridiculous, to expect a CA to google every cert request domain and check what they are doing? That is a ridiculous requirement - cert issuance is automatic.

Do you think we should stop allowing Let's Encrypt to issue certs? You know they don't google each domain to see what they are doing.

<comment><USER16> In my opinion, it would be worse if they denied certs to certain people.

</comment></comment></comment></comment></comment><comment><USER17> Curious to see how the CAB will handle this or if they're going to be "soft" as it's the first days of the CAA enforcement. Historically, they've been very accurate in enforcing their rules, which could mean a serious reprimand of Comodo.

If anyone is interested in testing their own CAA records, we built an online CAA validator specifically for this; [https://dnsspy.io/labs/caa- validator](https://dnsspy.io/labs/caa-validator)

<comment><USER18> Between their decision to release a rebranded "more secure" version of Chrome where their changes had introduced security holes, and their decision to try and trademark "Let's Encrypt", I can't imagine they have many friends in the CAB.

On the other hand, they issue a lot of certs - if you've used Cloudflare's free SSL stuff, you've got a Comodo certificate - so they're unlikely to be shut down or anything that extreme.

<comment><USER19> > On the other hand, they issue a lot of certs - if you've used Cloudflare's > free SSL stuff, you've got a Comodo certificate - so they're unlikely to be > shut down or anything that extreme.

They're still smaller than Symantec, for whom the nuclear option was considered (and ultimately decided against, in favour of a phased distrusting).

</comment></comment></comment><comment><USER20> CAA is fresh like IPv10. Done some tracking the last couple of months on the alexa top 1 million domains. In April 400(!) had CAA records. In August 800. 10% have errors (the issuer-critical flag's value is set to 128, 4 6 or 9) where it should be either 0 or 1. iodef set to totally unusable web addressed, you name it. As a matter of fact there are MANY large DNS service providers that do not even bother providing CAA options. If you want to name and shame, there is ample opportunity for the years to come. Getting it up and running is harder but more rewarding in the end.

<comment><USER21> > 10% have errors (the issuer-critical flag's value is set to 128, 4 6 or 9) > where it should be either 0 or 1.

Are you certain?

[https://datatracker.ietf.org/doc/rfc6844/?include_text=1](https://datatracker.ietf.org/doc/rfc6844/?include_text=1)

> The data fields are defined as follows:

>

> Flags: One octet containing the following fields:

>

> Bit 0, Issuer Critical Flag: If the value is set to '1', the

> critical flag is asserted and the property MUST be understood

> if the CAA record is to be correctly processed by a certificate

> issuer.

>

> A Certification Authority MUST NOT issue certificates for any

> Domain that contains a CAA critical property for an unknown or

> unsupported property tag that for which the issuer critical

> flag is set.

>

> Note that according to the conventions set out in [RFC1035], bit 0

> is the Most Significant Bit and bit 7 is the Least Significant

> Bit. Thus, the Flags value 1 means that bit 7 is set while a value

> of 128 means that bit 0 is set according to this convention.

EDIT: Fixed formatting? I hope.

</comment></comment><comment><USER22> That's quite incredible... It'd be interesting to see how up to date the CRL is as well.

</comment><comment><USER23> This inspired me to add a CAA record for my domain - <USER2> [https://www.namecheap.com](https://www.namecheap.com) doesn't support that record type. Has anyone had better luck other places?

<comment><USER5> You may find my CAA website helpful: [https://sslmate.com/caa/support](https://sslmate.com/caa/support)

<comment><USER23> I used your site - it was quick and easy. It soon went downhill from there. I don't run my own DNS or I'd be done pasting the line into my config. Instead I ran into a UI that doesn't support CAA as a type.

<comment><USER5> Unfortunately, if you want to use CAA your provider must support it. I recommend you use one of the DNS providers on the page I linked - there are quite a few to choose from.

</comment></comment></comment></comment><comment><USER24> maybe time to revoke Comodo's CA authority. Similar to what has happened before with Symantec (?).

<comment><USER25> Revocation for being three days late in implementing a new standard would be a massive overreaction. It would harm thousands of businesses in the process and would be extremely petty. Symantecs misdeeds are _far_ worse than this.

<comment><USER26> Revocation can be done only for new certs. It's time to throw a CA to the dogs once in a while pour encourage les autres.

<comment><USER27> Not at all. Revoke trust in the signing authority and all it's certificates turn invalid the second that change hits. Update your OS's trust store to not trust Comodo anymore and you'll see the effects immediately in IE/Edge on Windows or Safari and Chrome on macOS (Firefox still ships its own CA bundle).

It's just that when trust has been revoked in CAs recently, it's been done in a more gradual fashion to not hurt customers too much and give them time to migrate. After all, it's not the customer's fault the CA went rogue. This usually starts with not accepting certificates past a certain date but still validating previously issued ones, until sometime 6 months to a year later they're completely distrusted.

<comment><USER26> Which is exactly what I said above could be done.

<comment><USER27> That's not at all what you said. What I replied to is where you literally said:

> Revocation can be done only for new certs.

That's not true. The "newness" of a cert or a CA has absolutely nothing to do with how, if and when it can be revoked.

</comment></comment></comment></comment></comment></comment><comment><USER28> Is it expected from all CAs that they obey CAA records, or is it something just made up by the community to crush the big CAs? I see an RFC from just a few years ago, and I'm not sure how these things are standardised.

<comment><USER29> Standardization goes through the CA/B forum. There was a ballot voted to make CAA checking mandatory for CAs[1], and COMODO voted yes for it.

Any CA that issues certificates publicly need to check CAA from the 8th of September onward.

[1] [https://cabforum.org/2017/03/08/ballot-187-make-caa- checking...](https://cabforum.org/2017/03/08/ballot-187-make-caa-checking- mandatory/)

<comment><USER28> Ah, so they are three days late. That doesn't sound too serious.

<comment><USER30> On a requirement they voted for half a year ago for a standard specified 5 years ago. It's sloppy and sloppy is not a property you want in a certificate authority.

<comment><USER31> From experience working with them, sloppy is an excellent way to describe Comodo.</comment></comment></comment></comment></comment>


Ask HN: How to find duplicated directory subtrees - <AUTHOR>

Due to sloppy backups and synchronization (with crashplan, dropbox, and manual copies going back some years), I have a large collection of files that has been duplicated, partially merged, and updated locally. It's quite a mess. Do you know if there's any tool that would help to identify subtrees of the whole set that are identical, similar-and-strictly-newer, or similar? How would you approach the task of trimming it down to one clean version? <comment> geoff-codes Identical is pretty easy. Maybe something like this.

        #!/bin/sh
        here=$PWD
        dir=.
        depth=
        rm -f /tmp/list

        [ $# -eq 1 ] &&
          [ -e "$1" ] && dir=$1 || depth=$1

        [ $# -eq 2 ] && for i in "$@"; do
          [ -e "$i" ] && dir=$i || depth=$i
        done

        for each in $(find -L $dir -type d -depth $depth 2>/dev/null); do
          [ -x "$each" ] && cd "$each" &&
          sha=$(tar c . 2>/dev/null | tar xmvO 2>&1 | xz | shasum | sed 's| .*||')
          [ $(find . 2>/dev/null | wc -l) -gt 1 ] && echo $sha $each >> /tmp/list
          cd "$here"
        done

        for sha in $(cat /tmp/list | sed 's| .*||' | sort | uniq); do
          [ $(grep $sha /tmp/list | wc -l) -gt 1 ]  &&
            echo Identical directories: && grep $sha /tmp/list | sed 's|.* ||' && echo
        done

Similar and "similar-and-strictly-newer" both are much trickier as you have to invent a rubric for what "similar" mean, and `diff -qr` isn't going to tell you if, say, the files are mostly the same, but have been moved into a subdirector. So I'd probably use git, traversing the file tree by moving the .git dir around and adding each candidate directory as a different branch, and doing a `git gc` each time to try to keep the size of the index manageable. Then doing a `git diff [--word-diff] [--stat] --find-copies-harder` between branches will pick up files that have been moved around, etc. You could literally do this for every directory and subdirectory, but if you can narrow it down to, say, directories with the same baseman, it would be substantially easier.

On the other hand, I would say I suffer from this same ailment, I just mostly don't bother sorting it out. I just use something like [http://cpansearch.perl.org/src/ANDK/Perl-Repository- APC-2.00...](http://cpansearch.perl.org/src/ANDK/Perl-Repository- APC-2.002001/eg/trimtrees.pl) to make hard links between identical files, keeping the size of the monstrosity in check.

</comment><comment><USER2> I have exactly the same issue. Tons of backup archives nested inside each other. I have been reducing the mess manually, as I have not found a tool that would help. My approach is to use "diff -qr" between directories I know contain the same project and manually merge them / pick the best one. Merging is definitely the worst part of the process, as it cannot be automatically done. I thought about building a tool that builds some sort of sha tree through the directories but on the first try it generated many matches due to empty folders and stuff like that.

</comment><comment><USER3> When I sorted my photos, which are also copies of copies, especially after moving laptops several times I ended up with creating a list of md5sums, sorting by count to find duplicate folders.

I'd be interested in something more reusable as well.</comment>


Ask HN: I'm addicted to HN, what should I do? - <AUTHOR> How do other people deal with addiction to hacker news? I check it every morning and every night. I often find myself distracting myself with Hacker News during work too.
Hacker News seems to have been designed to optimize for new good content and I can't  help but feeling like I'm missing out if I don't read it.
How do you all deal with this? <comment><USER2> The noprocrast feature was designed to help with this. It's described in the FAQ: [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html).

</comment><comment><USER3> > feeling like I'm missing out

On what?

Have you tried blocking HN during certain hours, but allowing it during lunch break and late evening?</comment>


Ben Aung talking about GDPR affected businesses - <AUTHOR> https://www.linkedin.com/feed/update/urn:li:activity:6536198132907245568 <comment><USER2> Well, not sure about this link (its some shitty ad?) - but I have been testing GDPR data obtains on a few banks and one large credit score company and most of them are failing huge.

I will release report soon.</comment>