Refresh: concept for a new kind of web browser - <AUTHOR> https://refresh.study <comment><USER2> This looks really nice, kudos! Here are my few (hopefully constructive) comments:

\- The website looks great but quite heavy:

      29 requests, 17.66 MB transferred, Finish: 40.09 s

      Maybe see if you can re-encode `history-device.mp4` and `spaces-device.mp4` since they constitute the 78% of the traffic. =)

\- I liked all the features you've introduced, but _loved_ the way you've designed them!

\- Kudos for getting the tagging right! Many developers expect users to tag their content, and tags were the next-big-thing at some point where there were tag-based file systems[0], photo and video galleries that expected you to tag each of your photos, and so on; but what really worked was automating the process of tagging! Everyone can agree that Google or Apple Photos are miles ahead of digiKam or Picasa when it comes to finding what you are looking for. I am glad that you didn't delegate that responsibility to the user.

\- I think you should've put it on the AppStore first before sharing it; I would download it right away right now, as with many other people, but how many of us would remember Refresh a month later?

\- I'd love to have _branching_ history as well: so I have a tab and it has a _linear_ history through which I can either go "forward" or "backward". Now, if I move backward in history, and click on a different link in that page, the history should _branch_ at that point so that I won't loose the track of my previous "forward" pages when I click on a link in a previous page.

\- Maybe not as satisfying, but I'd also consider developing add-ons for Chrome and Mozilla; some people would be reluctant to change their browser, but they'd be more comfortable adding exciting add-ons on a reliable browser.

All the best!

[0]: [https://en.wikipedia.org/wiki/Tagsistant](https://en.wikipedia.org/wiki/Tagsistant)

<comment><USER3> > _I think you should 've put it on the AppStore first before sharing it_

It's not a browser. It's a _browser design_. (plus a bunch of not-really- functional prototypes).

I hope it becomes reality but so far this is basically the The William[0] of browsers. The William also never happened even though we all really wanted it to.

[0] [https://www.youtube.com/watch?v=2wBe3SDCcz8](https://www.youtube.com/watch?v=2wBe3SDCcz8)

<comment><USER4> Holy hell! Never seen that before, and I very much want it now. Do you know why it didn't happen?

<comment><USER5> It was never meant to become a real product.

The concept was made by Greg Beck, a dude from Ohio, as some sort of a "hey, wouldn't it be nice if..." thing. Or maybe as part of his showreel as a product designer.

Sadly, his website[0] is down, but you can find a version without images in the archive[1].

The domain name is still registered though. You could write him an email and ask what happened. ;)

[0] [http://becktothefuture.com/](http://becktothefuture.com/)

[1] [https://web.archive.org/web/20111208083212/http://www.beckto...](https://web.archive.org/web/20111208083212/http://www.becktothefuture.com/projects/The- William.html)

<comment><USER4> Thanks! I sent him an e-mail!

<comment><USER6> Iirc Electrolux was working on a fairly similar concept back in 2012-2013. Can't find the exact link for the touch screen one but these demos should be fairly similar:

[https://m.youtube.com/watch?v=dK1IVk_NiGY#](https://m.youtube.com/watch?v=dK1IVk_NiGY#)

[https://m.youtube.com/watch?v=qboMSdgxZ4s#](https://m.youtube.com/watch?v=qboMSdgxZ4s#)

[https://m.youtube.com/watch?v=QSJzq8rbR2c](https://m.youtube.com/watch?v=QSJzq8rbR2c)

</comment></comment></comment></comment></comment></comment><comment><USER7> Glad to see the concept of work spaces realized quite thoroughly - I wrote about the need for such an approach before: [https://rybakov.com/blog/open_tabs_are_cognitive_spaces/](https://rybakov.com/blog/open_tabs_are_cognitive_spaces/)

I am intrigued, though, how well the browsing history concept scales up to dozens of tabs. In my experience, I only use the newest tab on mobile, while the other open tabs become some kind of living bookmarks.

<comment><USER8> This is correct. Browsers need to become "spacers".

The spaces need to be publishable and moderateable and multiuser and all the other things we expect for web objects though.

Nice progress made on this project.

<comment><USER9> You should check out Workona's workspaces. We've built some of what you've mentioned as a Chrome extension backed by a web app.

Our workspaces (persistent windows with names) remember your tabs automatically, are multiuser/collaborative, and even have a URL (like any good web object). You can also access your workspaces on multiple computers, so you can start a project at work and finish it at home.

We're officially launching out of beta next month, but you can sign up now if you're interested:

[https://workona.com](https://workona.com)

<comment><USER10> Just tried it -- this is a great idea. Unfortunately, I can't use it because Workona spaces don't "containerize" accounts I'm logged into.

For example, I need multiple spaces where each space is "dedicated" to a single Google account -- it has multiple tabs open that are logged into that particular Google account.

I tried to create that setup, but the accounts "leak" between spaces: logging into a Google account in one space doesn't allow tabs in other spaces to be logged into a different Google account.

If you ever implement proper account isolation per space, please notify me: I'd like to be a beta tester.

<comment><USER9> Glad you like the concept. You're correct that we don't attempt to do account isolation as that isn't the purpose of our workspaces. Our workspaces are meant to be used at the project/meeting/workflow level, not at the Example Inc./Acme Inc./Home level.

As another person suggested, you can use Chrome profiles with Workona installed on each, but that likely isn't what you're after.

</comment></comment></comment></comment></comment><comment><USER11> I love the concept, but...

Ever since the early Internet; pre Firefox era, I have been a heavy Tab user. I am possibly on the higher end of spectrum, my Safari currently has 410 Tabs opened. It sort of expands and shrink during the weekend. In some days they could blow up to 500+ Tabs, more like a reading list.

Quite a few of them are youtube links that are acting like a mini playlist or file selection of music. So having a Video as group selection shown in this concept is a godsend. I have been wondering why Safari Multi Tab page doesn't have this. ( And Safari Tab Overview is kind of stupid, it reloads / reactive all the tab you have when you press overview, making huge memory and CPU spike as well as jack )

But over the years I have came to the conclusion, most of the consumers don't use Tab like us. That is why those mini Tabs in Chrome that shrinks to ridiculously small size don't annoy them. They don't check email on the web. Nor do they do much comparison. Their web browsing flow is very linear. While my web browsing flow is extremely jumpy. Reading on something could bring up dozens of other questions in my head.

So I am wondering if there is enough market for this browser? Don't get me wrong I love innovation in the browser UI space and I love the new History timeline. But I am slightly worry about its sustainability.

<comment><USER12> To support your point, data gathered from the Firefox user population a few years ago showed that, IIRC, the median number of tabs was somewhere around 2. And a _lot_ (I don't remember the proportion but it was unexpectedly large) of browser sessions lasted a couple minutes. As if lots of people opened links from outside the browser, read it, and closed the browser shortly after.

<comment><USER13> Comments like this remind me how out of touch I am with the average user.

</comment></comment></comment><comment><USER14> Here's an interesting question to turn over this lovely Sunday afternoon.

What stops you from implementing this yourself? Why?

Chrome is supposedly open source. So is Firefox.

It's an important question, because the answers lead to the reasons why we're subservient to megacorps. And it also shows merely being open source and free to use isn't enough to ensure freedom.

We tend to believe that (a) browsers are an open ecosystem, yet (b) we can't modify them. This is a contradiction.

<comment><USER15> Building Chrome requires a supercomputer and not everyone has one around.

Why is that so? Because there are enough crazy people who cannot stop writing new web standards. For example, things like Shadow DOM and web components, that are not really necessary and can be implemented using existing specs.

<comment><USER16> >Building Chrome requires a supercomputer and not everyone has one around.

What?

[http://www.linuxfromscratch.org/blfs/view/cvs/xsoft/chromium...](http://www.linuxfromscratch.org/blfs/view/cvs/xsoft/chromium.html)

Chromium comes in at 120 SBU, which while large isn't impossible. That comes to about 3-4 hours on my laptop.

Building software is not some esoteric pursuit only high priests can perform. It's good practice for software you're familiar with, require performance from and esoteric options most people don't care about.

<comment><USER17> _Warning_

 _Ninja, by default, sets the number of jobs to the number of available threads. If your machine is memory constrained, with regard to number of threads, you should reduce the number of jobs by passing the -j# switch to the ninja command below. Plan for roughly 1.25GB per thread while linking WebKit to avoid out of memory errors._

My laptop is memory constrained, I have yet to build Chromuium from source. How much RAM on your laptop? I've been looking for a laptop with 32GB RAM.

<comment><USER16> >My laptop is memory constrained

 _you should reduce the number of jobs by passing the -j# switch to the ninja command below._

I have had builds of linpack back in the day taking 24h+ on tiny systems. Again, building software isn't rocket science and you don't need super computers for it.

</comment></comment></comment></comment></comment><comment><USER18> I want to see something like [https://web.hypothes.is](https://web.hypothes.is) made native in browsers, so you can have community overlays on websites and commenting based on a group you subscribe to, automate common operations teams perform on web pages and leave notes for them etc. with out the websites itself being entirely in control of the entire ux and functionality.

<comment><USER19> We actually thought about adding a similar function in the beginning, but discarded it later since we wanted to focus on the existing key problems, rather than adding productivity features for power users. Nevertheless it is an interesting topic worth exploring.

<comment><USER7> In the same vein it would be interesting to explore mechanisms of automatic discovery - e.g. proposing tabs that have close horizontal proximity in other people's collections. Sure, it opens up the questions of privacy and data collection, but it could provide a much needed alternative to using search engines for discovery.

</comment></comment></comment><comment><USER20> Moving back in time was the most interesting new idea in the preso to me. Makes what you do in the browser quite accessible. Between this and web archival it might become possible to have easy, on-demand access to just about any personal web history. Imagine being able to travel back in time 10 years and see the websites you perused.

<comment><USER21> >Moving back in time was the most interesting new idea in the preso to me. Makes what you do in the browser quite accessible. Between this and web archival it might become possible to have easy, on-demand access to just about any personal web history. Imagine being able to travel back in time 10 years and see the websites you perused.

That was a killer feature as presented. In practice it might wind up a little iffy though. Web links aren't static, so the "history" you see might not actually be the pages you were reading. Especially for landing pages for news sites.

I can also imagine it becoming a memory hog for people with certain types of browsing habits. My wife, for example, basically never closes tabs. She just lets them purge on occasions when she needs to restart, which is basically just for OS updates.

</comment></comment><comment><USER22> Maybe it's the curmudgeon in me, but while I salute the ingenuity in this UI/UX idea, I think we need a new kind of browser _engine_ at least as much as a new kind of browser interface, perhaps more.

I used to worry that WebKit would eat the world, for awhile Trident _did_ eat the world, and now I worry about Blink.

<comment><USER23> Maybe you should take a look at Servo from Mozilla: [https://servo.org/](https://servo.org/)

A few things from Servo were integrated in Firefox 57. But the project is far from complete I think.

<comment><USER22> I'm aware of Servo. Servo is neat to play with, though it's pretty bad with older legacy HTML pages. Also, I'm not sure how likely Mozilla is to develop it into a product; it seems more like a testbed for later Gecko evolution (which, to be sure, is still a good thing).

<comment><USER24> Firefox already includes parts of Servo, so it's not a question of "how likely" it is to be used in production. [https://en.wikipedia.org/wiki/Quantum_(Mozilla)](https://en.wikipedia.org/wiki/Quantum_\(Mozilla\))

<comment><USER25> > so it's not a question of "how likely" it is to be used in production.

I believe you misunderstood the comment unless it was changed. The commenter questioned the likelihood of it being developed into a product and you responded as of they had questioned the likelihood of any of it being used in production.

Fwiw, I agree with the commenter and am unsure how likely Mozilla is to develop it into a product. They do seem to incorporate pieces though.

<comment><USER24> I think you and the commenter share some misunderstanding. Could you distinguish what you mean by developing Servo into a product vs. "incorporating pieces"?

Are you saying that Mozilla eventually replacing Gecko's style system, DOM, compositor, and networking system with Servo's (as the article I linked describes) is just incorporating "pieces" of Servo?

The product that Mozilla is developing Servo into is Firefox. I don't know what you expect—for Mozilla to replace Gecko with Servo all at once? For Mozilla to do the same thing they are doing now but just give it a new name?

<comment><USER25> > Could you distinguish what you mean by developing Servo into a product vs. > "incorporating pieces"?

Do you remember seeing screenshots of "servo"? Running a Servo executable (or browserhtml or whatever) is/was a thing. It was branded as being developed as an alternative browser to FF. It was even using cannibalizing FF pieces (e.g. Spider Monkey) not the other way around.

> The product that Mozilla is developing Servo into is Firefox. I don't know > what you expect—for Mozilla to replace Gecko with Servo all at once? For > Mozilla to do the same thing they are doing now but just give it a new name?

That is the case now, though they have names for the pieces, the name "Servo" still seems to be the name of the full browser (coopted by the VR group IIRC). It was what everyone expected to not necessarily replace FF all at once, but be developed alongside as an alternative. This history was clear, the name Servo as a whole browser was clear, and the misunderstanding is pretending that was not the case.

<comment><USER24> Not only is your understanding of history at odds with the facts, which anyone can look up for themselves, but I am _extremely_ confused at why the ill- defined concept of "Servo as a whole browser" is important at all.

Servo is a browser engine, not some VR project (where the heck did you get that? Go to [https://github.com/servo/servo](https://github.com/servo/servo) ); what's more, Firefox _is_ "Servo as a whole browser," whatever that is supposed to mean. Of _course_ you are able to run Servo "by itself," how the heck do you expect Servo developers to be able to test their browser engine?

I'm not sure what weird dramatization of history you are trying to create, but it's all the more bizarre in that (1) this all happened in the open, so you should easily be able to see what you are saying is and was simply not the case, and in that (2) far from Servo being killed, it is the future of Firefox, _so what on earth is there to be upset about?_ This has been surreal; good luck.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> Pretty nice. I use a Safari add-in called Sessions to create sets of browser tabs I can recall later. Super handy when you are researching something new or just want to persevere your current multi-tab browsing session for later.

[https://sessions-extension.github.io/Sessions/](https://sessions- extension.github.io/Sessions/)

<comment><USER27> Unfortunately:

>Sessions will not install on Safari 12 or later, as Apple has officially deprecated Safari Extensions.

<comment><USER28> Which is being replaced by Safari App Extension Platform. Did I read it correctly that App Extensions can only be downloaded from the Mac App Store?

<comment><USER29> Yes.

</comment></comment></comment></comment><comment><USER30> Looks like Tab Groups or Tab Trees, just 10 Years later.

<comment><USER31> That's exactly what I thought until I saw the proposed timeline mechanism for exploring session history. That feature looks very useful.

<comment><USER32> It looked entreating but i still can't come up with a use case; I'm very very rarely browse through my history. I only search for a specific item

<comment><USER33> Trip planning comes to mind. If you have a bunch of booking sites, along with hotel information open, then you switch contexts to something like airfare booking. It's conceivable you want to eventually come back to the hotels if you haven't finished booking, and getting all X tabs open again would be helpful in that case so you don't have to individually remember all the hotels you were looking at.

<comment><USER34> If only sessions on travel-related websites didn't expire already after half an hour.

<comment><USER33> That's a good point, although some will re-search once the session is expired. It still helps with reference sites (like the hotel's/airline's/cruise's/etc page).

</comment></comment></comment></comment></comment></comment><comment><USER35> I'd love to see this built out - I was disappointed there was no download link.

</comment><comment><USER36> Reminds me of Firefox Container Tabs and other advanced ffeatures

</comment><comment><USER37> I hope they build this!

Making web browser software can be very profitable if you get a large userbase. Mozilla had $520 million of revenue in 2016!

More browser innovation would be great, considering how many human hours are spent browsing the web. Small browser level increases in efficiency with better tools for web browsing could have massive impact.

And, building browser companies can be a path to making lots of money, so it's not a charity.

</comment><comment><USER38> On desktop chrome you can press ctrl+f find a link on a page using search then press escape and then press enter to follow the link without a mouse

I wish any browser on iOS could allow this, I use an iPad and I can shortcut myself to anything on safari with my hardware keyboard, except clicking links, it's really jarring to jab the screen for that part

<comment><USER39> Really need something like Vimari/Vimium for iOS Safari with hardware keyboard. I wonder if there are any custom browsers that support that.

</comment></comment><comment><USER40> Looks really cool. I wish there were more of these types of fully fleshed out design thesis. A couple years ago someone did one on Windows 8 and it had an outsized effect on the development of windows 10, someone had a similar idea for office, but I don't know how much of an effect it had. either way it was fun to read and look over.

</comment><comment><USER41> Some of those features can be done today with any browser, such as spaces.

Just create a virtual desktop for each space.

It really does save a lot of time in the long run. The added benefits of virtual desktops is you can also recall more than just browser tabs.

On Windows 10, all you have to do is hit CTRL + Win Key + Right arrow to launch a new desktop.

<comment><USER42> This is entirely different concept and has no implementation on mobile which looks like to be a target platform.

</comment></comment><comment><USER43> Interesting concept. Looks like a bunch of ideas from other extensions and apps that are already doing these things.

Tab management: Pin tabs seems to do this already.

Saving & recalling: Tons of "spaces" extensions already exist.

I'm not a big fan of the netflix layout.

Smart link previews: Nice to have an image preview but the auto categorization of links would probably not work so well. So this would be probably only be used for main well known sites.

Browsing History: That timeline actually looks really nice. Not sure how well it would work, but that's actually innovative for a browser.

Tagging: So... a bookmarking system?

Focus on whats important: Nope nope nope. I don't want my browser to become an app that strips out what makes a website unique. Most often this functionality just breaks the UI or strips away code that breaks the functionality.

<comment><USER44> > Focus on whats important

Firefox has such feature (reader's view) and it works surprisingly well. It really helps, especially when the text is difficult to read (contrast issues, small fonts, etc) or when a page contains lots of elements that try to distract you from main content.

</comment></comment><comment><USER45> Just wanted to point out that Chrome has Chrome Profiles which can be used for "work" "thailand" etc spaces.

Maybe we can extend this with a better UI + ability to move pages between profiles (this creates some serious security problems though)

<comment><USER46> Well, I think most of the concepts are design-centric.

We have history, tagging and bookmarks but I barely use them in modern browsers.

This UI makes it more orthogonal (it seems).

</comment></comment><comment><USER47> That's a browser I would love to use on my desktop. Two thumbs up!

</comment><comment><USER48> FWIW, you can get similar "Spaces" functionality with Toby extension: [https://www.gettoby.com/](https://www.gettoby.com/)

<comment><USER49> Panorama view for Firefox: [https://addons.mozilla.org/en- US/firefox/addon/panorama-view...](https://addons.mozilla.org/en- US/firefox/addon/panorama-view/)

</comment></comment><comment><USER50> Nice idea, I have definitely felt that the browser market space has become to stagnant and bland. I am surprised you are using cookies for what mostly seems to be a product outline.

</comment><comment><USER51> Wow, looks great, good job. I really wish this was available.

<comment><USER52> Yeah, I so want this. Funny how these features take so long to arrive then seems obvious afterwards.

</comment></comment><comment><USER53> I made it 3/4 of the way through the video, then clicked around the website in frustration looking for the download button.

</comment><comment><USER54> This reminds me a lot of Firefox tab groups/panorama which was removed a few years ago. I like the history idea, there are some really good ideas there. I tried finding something in my history on Firefox recently and it was an awful experience, so maybe someone will be inspired by this.

<comment><USER49> > This reminds me a lot of Firefox tab groups/panorama which was removed a few > years ago

It's back: [https://addons.mozilla.org/en-US/firefox/addon/panorama- view...](https://addons.mozilla.org/en-US/firefox/addon/panorama-view/)

<comment><USER54> I tried that addon, and it is not the same thing. Panorama was an overlay, but this opens a new tab to view your groups. This doesn't really work when you have hundreds of tabs. I'm pretty sure that the old Panorama view is not possible with webextensions, although I haven't really looked into it.

<comment><USER49> I don't get what the difference is, except that in the old version there was no tab bar in the overview, whereas in the new version the tab bar is still there with just a single tab that says "Panorama view"? I don't see how that interferes with the number of tabs you have? I have quite a few tabs as well, no problem there.

This is what it looks like if you press Ctrl+Shift+F: [https://addons.cdn.mozilla.net/user- media/previews/full/200/...](https://addons.cdn.mozilla.net/user- media/previews/full/200/200289.png?modified=1530209514)

If you then click one of the tabs, the tab bar gets populated by the tabs in that group.

(Perhaps you tried this extension before the tab hiding Web Extension API arrived? That only arrived in the latest version of Firefox, IIRC.)

<comment><USER54> >Perhaps you tried this before tab hiding

I might have done so. The problem I had is that I was in the middle of a few hundred tabs and opening panorama opened a new tab at the end of the list making me lose my place. If it hides all tabs when you open panorama it might work well enough.

I'll try it again, thanks for letting me know.

<comment><USER49> In that case I think you're going to like the extension now - I did :)

</comment></comment></comment></comment></comment></comment><comment><USER55> >> And while the web itself has undergone big changes in the last twenty years, browsers have remained largely the same.

Yeah, it's largely the same : we open app, enter the URL and it shows a web page..But cmon, stating that IE6 is largely the same as Chrome or Brave is kinda exagreggation.

</comment><comment><USER56> Containers is available in Firefox, however the usability and ease of usage should be something like shown in video. Its pretty awesome to shift between containers.

Timeline seems like barrowed from Windows. This will be another awesome feature I love to see

<comment><USER57> I used to use containers all the time (tab groups per activity/mind state is a thing I've always craved for) But they're buggy. Really buggy. Twice I've lost a trace of all the containers and tabs that were open (over 40).

</comment></comment><comment><USER58> Kinda confusing TBH. Browsing should be simple, why convolute it with the Productivity App ideas?

</comment><comment><USER59> Great design and media, got me interested!

</comment><comment><USER60> Interesting triplet of Chrome extensions.

</comment><comment><USER61> It's like Netflix for tabs

</comment><comment><USER62> Did this has tabs on the side?

</comment><comment><USER63> I'd use it.

</comment><comment><USER64> Disappointing that a website about making the web better still wants to track me with cookies for god knows what reason (also non-GDPR compliant despite them being based in Germany).

<comment><USER65> They clearly state that they use cookies for analytics. They are not collecting PII. Their Google Analytics implementation uses `anonymizeIp`.

<comment><USER64> I would not trust a company whose bottom line is proportional to how much personal data they collect to just honour an "anonymise" argument.

Not to mention, analytics still wouldn't require a cookie unless they want to know which other sites I visited, which is none of their business.

<comment><USER19> The cookies are also used to distinguish visitors. I'd recommend using private browsing or a GA blocker plugin if you're not comfortable with that.</comment></comment></comment></comment>


Winnti: Hackers attacking the heart of German industry - <AUTHOR> http://br24.de/winnti/english <comment><USER2> As of today we still use shared network drives for everything in major German company. We don't use slack/irc/Skype/zoom/whatever. Phone calls and conferences(!) from the middle of open office is normal. Asana/Trello/Jira are not known at all. GitHub is paid for, but never used. I am single weirdo in multi department project using github ticket system. The code with prefix is copied for colleagues to project's shared folder. PostIt tickets on the table works good enough for others. Talking about bugs is impossible since nobody knows what's fixed and what's not, the bugs have date in the best case. Everything else is done in Excel sheets using in house written scripts. They usually end in a mess since some people use German regional settings and other English ones. That's state-of-art situation in very rich and big company today. I don't see any possible changes in future. Old boy club fights all the time against proposed improvements. You can forgot topics like information security, phishing, being silent about work topics outside the office. Hackers are known from the American movies only.

On the other hand I also worked in opposite unhealthy paranoid environment. I was hired to design Ethernet camera, but Wireshark usage in their office was prohibited. Packet analysis was seen as the worst thing in the company. I quit after few months trying to explain, that I need to analyze the packets during design phase. I think, it's very normal, that other countries abuse illiteracy of German industry.

<comment><USER3> Germany's tech illiteracy is a self-inflicted consequence of its pitiful salaries in this field, treating IT like a cost center that has to be outsourced to wherever is cheaper and companies' tradition of rewarding management incompetence over technical competence.

Consequently, Germany's most brilliant tech minds leave for The Valley, Zurich or London.

You reap what you sow.

<comment><USER4> I don't think that's the case. I believe the problem is that large German companies tend to be hardware companies. They're used to development cycles that take years and extremely conservative in adopting new methods. Management and company culture is not used to dealing with fast changing development methods (where fast is anything that changes more often than once a decade). Rigid processes for compliance with external regulations over time where adopted for internal rules as well, making any change a bureaucratic nightmare.

Salary for developers really isn't that much of an issue. In Berlin for example a developer gets two or three times the median salary easily. That's enough for attracting people who are talented enough to choose, e.g. git and JIRA over whatever crusty system of shared folders and zip files or IBM crap you'd see for projects in many companies.

<comment><USER5> Pretty much agree with this sentiment regarding hardware/culture.

Also the salaries are acceptable (imo) compared to fairly high paying US jobs if you compare real working hours (vacation time, real 40h workweeks etc.). With a family there's even more benefits. Cost of living also tends to be fairly low (with a high quality of life) compared to higher paying places.

<comment><USER6> High paying American bigcorps _mostly_ have perfectly fine work life balance.

Getting double the vacation time (6 weeks instead of 3) when I moved from the US to Germany was very nice, but going back I'll have 5 weeks, which isn't too bad.

<comment><USER7> > Getting double the vacation time (6 weeks instead of 3) when I moved from > the US to Germany was very nice, but going back I'll have 5 weeks, which > isn't too bad.

I keep hearing this. Yes, _you_ will get 5 weeks. But what about your wife, your uncle, your friends? In Germany they're all guaranteed to have the same number of days off, access to healthcare, etc. When you have kids you have a bunch of weeks/months off before the child is born and more after.

In the US, as long as you're young, healthy, rich and selfish, life is grand :D

<comment><USER8> But that's the point of US, no? It's _the best_ country for _the best_ people. So, the best people go to the US... (well, many at least... I'm still holding out... for now, I value European way of life but I envy US political & legal systems, in particular their freedom of speech).

<comment><USER7> You can can't have 300 million _best_ people. You can't even have 100 million.

And once someone acquires citizenship, their descendants can't lose it, provided it's their only citizenship.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> This group of german companies founded their own security group [German Cyber Security Organization (DCSO)]. That speaks a lot about their trust in their public services.

The only time I've been involved in a hacking attempt (it was ransomware) the company I work for contacted the CCN-CERT. I wonder if US companies contact NSA/Other gov agencies or deal with it themselves with security companies.

Also, while I understand the care and concern they put into securing their networks, many german companies basically gift their tech to china, like Deutsche Bahn, or being bought and transfered there, like it happend with Kuka. So be it by hacking into your network or "partnering", they'll copy your tech and kick you out of their market sooner or later.

<comment><USER3> Probably because when it comes to anything cyber-related, the German government, like most big companies there, is a dinosaur, greatly inferior to it's British and Swiss counterparts.

<comment><USER10> Germany at least has the CCC, which it sometimes asks for advice and, occasionally, listens to.

<comment><USER11> When they aren't trying to put them in jail that is.

</comment></comment></comment></comment><comment><USER12> "Modern-day espionage operations have one big advantage: Instead of painstakingly planting agents in companies, digital spies are simply sending prepared emails."

We face this threat in my business - daily fishing attempts or schemes to get employees to open files. It never stops.

This is a primary reason when we started designing our new web app at bomquote.com a few years ago, we first focused on communication tools which reduce our use of email both internally and in our dealings with our customers.

Sure, there will be attempts to hack our app servers, but from my view we can deal with that easier than preventing our accounting admin from clicking on a well crafted email.

<comment><USER13> Using U2F security keys is one way to stop phishing if the app you're supposed to log into requires it.

[https://krebsonsecurity.com/2018/07/google-security-keys- neu...](https://krebsonsecurity.com/2018/07/google-security-keys-neutralized- employee-phishing/)

<comment><USER14> Unfortunately "phishing" nowadays is used to describe any kind of social engineering, including all variants of tricking the victim into executing malware on their machine.

U2F won't save you there, it will just make the attack a bit more annoying.

</comment></comment></comment><comment> ga-vu Is this a good way of tracking an APT? Just from bytecode? Isn't that easy to fake? What if they were tracking Russian hackers instead?

<comment><USER15> If I'm understanding the article correctly, the hackers are using a easily reversed cypher for storing configuration data for their malware, which was reversed by assuming the presence of the string "C:\Windows\System". In the following decrypted data the name of the respective company targeted was found.

Yes I suppose it would be easily faked if the faker had performed a similar analysis on the malware...

</comment></comment><comment><USER16> Good article. I am not so bothered by the effects, I think they complement the article well. I sure like that what may seem like decoration to some readers is actually real - I find it very interesting to find out that they find the malware using nmap.

Now where do I get that script? More detail would of course always be nice.

<comment><USER17> Git repo was linked by OP in this [dead] subthread: [https://news.ycombinator.com/item?id=20514267](https://news.ycombinator.com/item?id=20514267)

The nmap script was written by ThyssenKrupp's security division and can be found here: [https://github.com/TKCERT/winnti-nmap- script/blob/master/win...](https://github.com/TKCERT/winnti-nmap- script/blob/master/winnti-detect.nse)

</comment></comment><comment><USER18> pretty decent tech write-up from the German NPR

<comment><USER19> Finally, somebody said it. The English also very good, nay, excellent.

</comment></comment><comment><USER20> > Winnti is a highly complex structure that is difficult to penetrate. The > term denotes both a sophisticated malware and an actual group of hackers.

Hacking groups are corporations and spread risk away from indictable individuals just as efficiently, with a separation of liability and actions and knowledge

This needs to be understood</comment>


Office. Office never changes - <AUTHOR> http://codingfearlessly.com/2014/01/19/office-office-never-changes/

<comment><USER2> Not sure how this made the front page of HN. Maybe someone can explain to me how this is important/impactful/insightful?

<comment><AUTHOR> I can't know why people chose to upvote it, but I can say that reading this comment hurt just a little.

Also: it violates HN Guidelines ([http://ycombinator.com/newsguidelines.html](http://ycombinator.com/newsguidelines.html))</comment></comment>


An Illustrated History of objc_msgSend - <AUTHOR> http://sealiesoftware.com/msg/index.html <comment><USER2> It's cool to get a look at a piece of assembly code that seems oddly familiar from all those times when my app has crashed in objc_msgSend due to a prematurely released object... (I still write non-ARC code for compatibility reasons. Sigh.)

I find the following claim slightly misleading:

 _32-bit x86 was quickly overtaken by 64-bit, so this code received little attention after Tiger and many of those inefficiencies remain to this day._

There are still major 3rd party apps that run in 32-bit mode on the Mac. Google Chrome is probably the most popular.

<comment><USER3> It's perfectly correct from Apple's perspective (which is the perspective from which this article is written). Apple started shipping 64-bit Intel Macs less than a year after they started shipping Intel Macs at all. OS X 10.4 was the first version to support Intel, 10.5 was the first version to fully support 64-bit, and by 10.6 most of the system was running 64-bit. 10.7 dropped support for 32-bit Macs entirely.

Apple had little reason to improve 32-bit since apps can simply target 64-bit if they want the speed improvement. From Apple's perspective, Chrome makes a deliberate choice to run in that environment and they have no particular reason to help them out.

<comment><USER4> Anyway, since Chrome is mostly C++ code, especially in the inner loop, I doubt that a faster objc_msgSend would noticeably improve performance.

</comment></comment></comment><comment><USER5> Does anyone know if this function is actually written in asm? Case in point:

        The code was probably originally written for NeXT
        by an engineer who was familiar with load-store
        architectures like PowerPC but not so familiar with
        register-memory architectures like x86 ... Those of
        you who do know x86 better may be able to identify
        some of the inefficiencies in this code

Why wouldn't/couldn't this function be written in C (are there any instructions that would need some non-portable intrinsics?) and leave it to an optimizing compiler to get the instructions right. Sure, sending messages is low-level and needs to be high performance but that, to me, doesn't necessitate "we have to do this by hand" asm instead of C.

<comment><USER6> objc_msgSend would actually be impossible to implement in C.

Its role is to look up the function pointer that implements a method, then call that function pointer with the arguments passed to objc_msgSend, returning the result of the implementation.

Implementing objc_msgSend in asm guarantees that the argument & return registers aren't touched by the method lookup. Similarly to how ffi libraries and implementations of setjmp/longjmp need to be implemented in asm, it operates at a lower level than C's stack & function abstractions.

<comment><USER3> To elaborate on this, a C implementation of objc_msgSend would look something like this:

        id objc_msgSend(id self, SEL _cmd, args...) {
            IMP methodImplementation = ...; // look up the method however
            return methodImplementation(self, _cmd, args...);
        }

But there is no facility in C that lets you take arbitrary additional arguments and then pass them all to another function unchanged.

(In theory you could accomplish this using variadic functions. But then every method would have to take a va_list for its parameters instead of just taking a regular parameter list, breaking the idea that ObjC methods are just C functions with two implicit parameters. It would also be substantially slower.)

</comment></comment></comment><comment><USER7> Fascinating stuff. It's so weird to realize that such a critical piece of code is still changing significantly after 10 years at NeXT and 10 years at Apple.

<comment><USER8> I think it's weirder that so often such critical bits still are the makeshift unoptimized first version. But I know how it works in the real world, it's good enough and there are no reported bugs, so don't touch it until you have implemented all these features and fixed all these issues....

</comment></comment><comment><USER9> Related: If you want to see what messages are being passed around in your programs, you can use this: [https://github.com/nviennot/objc- tracer](https://github.com/nviennot/objc-tracer)

<comment><USER10> While this was probably an interesting exercise, I should remind everyone that one can get the same functionality by setting the environment variable NSObjCMessageLoggingEnabled to YES.

</comment></comment><comment><USER11> Where does he get that code from? The actual objc_msgSend function is much much longer and employs a bunch of other tricks.

<comment><USER3> Where do you get that idea? What's shown is it. There's a lot more to the message send system, but the rest is helpers that live outside of objc_msgSend and aren't on the fast path. There's no _room_ for "a bunch of other tricks", because objc_msgSend needs to be as fast as possible, and the more it does, the slower it'll run.

<comment><USER12> In the Mavericks version there are two jumps to labels that are not present in the code shown. One is for tagged pointers, the other is for a cache miss. The cache miss is probably interesting, tricky code.

Apropos nothing… the cache search algorithm is "enter at predictable point, linear search everything". When one thinks of all the PhD time spent developing and analyzing search data structures, this is a good reminder that at small N, other factors dominate.

Also, adding a one byte instruction prefix that you know will be ignored because your processor is happier if instructions aren't so bunched up is so close to witchcraft that the author should avoid campfires with stakes in the center.

<comment><USER3> The cache miss may or may not be interesting, depending on your interests, but it's all written in C and is much longer and more boring. As soon as you miss the cache, you're off the fast path, so the cache miss code in objc_msgSend just does the requisite register preservation and then calls into C.

</comment></comment></comment></comment><comment><USER13> As you can clearly see from the code it's perfectly acceptable in Objective-C to send a message to nil. This is a powerful feature that prevents the program from crashing but it is confusing for beginners.

<comment><USER2> It doesn't seem particularly confusing. It's pretty much the first thing you learn: square brackets send a message, and if there's no recipient, the return value will be zero. (Granted, it used to be more complicated in the PowerPC era, when e.g. a selector that returns a double was not guaranteed to return 0.0 with a nil receiver, but those cases were fixed in the runtime.)

I suspect the messaging-to-nil behavior is mostly confusing to intermediate programmers who only have experience with Java's passive-aggressive null references.

<comment><USER13> In my opinion the confusing part is not about SEGFAULT or NullPointerException. Let's make and example:

       NSArray *obj = nil;
       [obj count]; // return 0

In theory a nil object can hide in your code for a long time if you only use methods that can return 0.

<comment><USER14> It's a trade-off, because it's convenient to not have to check that objects are non-nil when you send messages to them. With experience, you learn to deal with code that requires non-nil objects via assertions:

        NSAssert(array, @"Array can't be nil.");

</comment></comment></comment></comment><comment><USER15> Would be great to see the changes made in the ARM variants too. I know there's no value in compiling libobjc for ARM, but at least for academic value.</comment>


Korean Cryptocurrency Exchange Bithumb Loses More Than $30M in Hack - <AUTHOR> https://www.wsj.com/articles/korean-cryptocurrency-exchange-bithumb-loses-more-than-30-million-in-hack-1529465655 <comment><USER2> Not sure why they can't secure their cold storage. That is what makes these hacks so suspicious any why investors need to be really weary of new exchanges.

Either way it killed the rally pretty nicely if that was the intent.[1]

[1] [https://blockmodo.com/quotes/BTC](https://blockmodo.com/quotes/BTC)</comment>


Sanoid – Replication and Backups with ZFS - <AUTHOR> https://github.com/jimsalterjrs/sanoid/ <comment><USER3> This is the piece I was looking for:

"Which would push-replicate the specified ZFS filesystem from the local host to remotehost over an SSH tunnel ..."

        syncoid root@remotehost:data/images/vm backup/images/vm

Now, if only there were a cloud storage provider that you could directly zfs- send to ...

If only ...

<comment><USER4> I have an Ubuntu server with a ZFS pool that I want to rebuild as a FreeNAS/TrueNAS server. Can I use something like rsync.net to push my datasets up as a backup, rebuild my server, and then pull them back down into a reorganised/renamed tree of datasets? Are there compatibility issues between ZFS on Linux and ZFS on FreeNAS that I need to be concerned about? (that come into play when pushing/pulling datasets)

<comment><USER5> > Can I use something like rsync.net to > push my datasets up as a backup

Yes, but depending on the size/value of the dataset, rsync might not be the best option.

Even after recent price reduction (Yay!), and with a hn discount (Yay!) - <USER2> still consider rsync.net as a _personal_ backup service a little overkill/expensive past 100 GB or so. And likely you could just handle anything on the order of 1 to 2 tb locally anyway (spare disks).

You technically could use it for 10+tb of data... But uploading and downloading is going to be slow unless you have a real uplink (ie at least 1gbps).

And if you did, unless you need filesystem level Metadata - rsync might be a better option than zfs send/receive (even though zfs is cool).

>, rebuild my server, and then pull them back down into a reorganised/renamed tree of datasets?

Again, if you just need the data back - you might be well served with rsync or restic (both choices should be orthogonal to using rsync).

> Are there compatibility issues between ZFS on Linux and ZFS on FreeNAS that > I need to be concerned about?

The world is divided in Oracle and not-Oracle - AFAIK there shouldn't be major differences between those two - that I believe now both follow upstream zfsonlinux.

However - I believe rsync.net still doesn't support zfsonlinux/openzfs encryption (zfsonlinux 0.8+). While locally it's possible to encrypt the disk "under" zfs... Native encryption is tempting.

And you would of course never send anyone data without encrypting it?

<comment><USER6> The switch of FreeBSD's ZFS master being ZoL is still work in progress, and is not the default ZFS in FreeBSD yet. (FreeNAS being FreeBSD + Configuration + Management Software).

A fair number of the ZoL 0.8 features (encryption, allocation classes being two prominent examples) are not available currently for FreeBSD

<comment><USER7> Allocation classes are available in FreeBSD CURRENT snapshots.

</comment></comment></comment></comment></comment><comment><USER8> Sanoid seems like a great tool. It was at the top of my list when I was looking for this kind of solution.

I ended up going with zfs_autobackup - [https://github.com/psy0rz/zfs_autobackup](https://github.com/psy0rz/zfs_autobackup) because it doesn't need anything set up on the computer to backup. Just a script on the backup server that does pull backups.

I'm not trying to hijack the thread but I've often appreciated links to similar software in threads like this.

<comment><USER9> The issue I have with that is that if everything is done by the backup server, it has the ability to both create and destroy (prune) datasets (snapshots), which means it has the ability to erase all of the data and all of the backups.

One thing I like about Sanoid/Syncoid is that if you set up Sanoid on both sides and use Syncoid to pull, the backup server only requires the ability to send snapshots (which you can configure with "zfs allow"). The backup server also doesn't require root in this case. This means neither server can delete the other's data.

And you still get all the automatic snapshot creation (done on the primary server) and pruning (done on both servers).

</comment></comment><comment><USER10> For FreeBSD users, it's available from ports:

[https://www.freshports.org/sysutils/sanoid/](https://www.freshports.org/sysutils/sanoid/)

(I'm the port maintainer, open to improvements)

</comment><comment><USER11> Only tangentially related, but seems like a good thread to ask:

Does ZFS (or any other FOSS file system) have a setup like Isilon or NetApp, where you could have any 2 disks in a box of 8 or any box out of say 6 die, and still not lose anything other than bandwidth?

<comment><USER12> I would say ZFS would be a lot closer to NetApp.

For Isilon, a better comparison would be Ceph. With Ceph you can have a cluster of 10s or 100s of servers, and you can lose 1 disk, or 1 server, or 1 rack or servers and it will recover very quickly.

As long as your minimum requirements for your type of replication or erasure coding profile are satisfied, your data stays safe and available.

</comment></comment><comment><USER13> This looks pretty solid. On one of my machines I'm using "zfs-auto-snapshot", which works great for something I can just install and not have to manage, for getting some history. For replication of snapshots, I haven't done that recently, but in the past I just used some scripts I had written to do one- time migrations. That was a decade ago. This looks much more capable than those scripts.

<comment><USER14> Yeah, there are base templates for configuration and they can be overridden on a single (or recursively on all children of a) dataset where needed.

</comment></comment><comment><USER5> Oh my. It's perl. Might be worth noting.

For those that actually use perl - I know perl has had (fairly sane?) package management for a while... Is it reasonable to use system perl version in anger?

I would typically reach for a version manager/virtual env with python or ruby - do you, with perl as well?

I'm fairly happy with asdf day to day.

[https://asdf-vm.com/](https://asdf-vm.com/)

</comment><comment><USER14> Great piece of software; the templating model for configuration is neat and works out well for my case.

</comment><comment><USER15> I love using Sanoid+Syncoid for keeping my laptop (with Xubuntu on ZFS) backed up to my NAS (running FreeNAS). In addition to the periodic snapshots Sanoid manages, I also have a small script (shameless plug [0]) that hooks into APT to take snapshots right before upgrades occur. It's already saved me decent chunk of time that would've been spent rebuilding from a botched upgrade.

0: [https://github.com/paxswill/zfs-apt- snapshot](https://github.com/paxswill/zfs-apt-snapshot)

</comment><comment><USER16> I wanted to use this tool for backing up my laptop to my NAS, however it only allows SSH to be used for data transfer, which is a real bottleneck for speed. It basically means you can only transfer as fast as one core can decrypt or encrypt data on either end of the pipe.

I ended up using [https://github.com/oetiker/znapzend](https://github.com/oetiker/znapzend) instead, because it can use mbuffer for the actual data transfer, which is much faster.

<comment><USER17> Is SSH speed a real limitation you've measured? I was able to easily saturate a 1 Gbps link for days using ZFS send over SSH with an Intel Atom when initializing my remote backups.

<comment><USER16> Yes. I have an Atom on one end of the pipe as well, but it's over 10Gbe and to a 6 drive mirrored and striped vdev. Using SSH as the transport it would only approach 100MB/s, using mbuffer it can max out the storage at about 250-275MB/s.

</comment></comment></comment><comment><USER18> I've used a few different ZFS snapshot management tools, the one feature I'm missing is something to assist with data retrieval. I'd like to be able to specify a dataset, path and date/time and the tool would mount the closest snapshot to the specified time and pull the appropriate data for me.

<comment><USER19> Not exactly what you're asking I think, but in Solaris-derived OSs the snapshots are exposed by default as previous versions in windows.

You can also use SAMBA to expose the snapshots as previous versions in windows.

SAMBA general documentation: [https://www.samba.org/samba/docs/current/man- html/vfs_shadow...](https://www.samba.org/samba/docs/current/man- html/vfs_shadow_copy2.8.html)

Randomly found ZFS specific: [https://blog.chaospixel.com/linux/2017/09/zfs- auto-snapshots...](https://blog.chaospixel.com/linux/2017/09/zfs-auto- snapshots-and-windows-shadow-copies-with-samba.html)

</comment></comment><comment><USER20> Another one, which creates backups on locally connected backup pool — [https://github.com/reconquest/zeus](https://github.com/reconquest/zeus)

</comment><comment><USER21> Is this a good fit for an on-prem small data center backup solution?

</comment><comment><USER22> I've been using it for my daily zfs snapshotting needs for a year. Rock solid software. Thanks.

</comment><comment><USER23> sanoid is great. I asked how to stop sanoid from snapshotting docker created datasets in rpool/var/lib/docker when rpool has the recursive flag, and they added a feature to do it the next day.

</comment><comment><USER24> What advantages does it have over zrep?

</comment><comment><USER25> yawn. hasn't this been done a million times over?

<comment><USER26> Please don't be a jerk on HN. Also, note this guideline:

" _Please don 't post shallow dismissals, especially of other people's work. A good critical comment teaches us something._"

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER25> in my defense, i wasn't dismissing his work. i was wondering why it merits HN attention. it's completely ordinary stuff. the world needs ordinary stuff but this isn't buzznews "the 3 surprising tricks about zfs snapshots".</comment></comment></comment>


848 ft/sq Home in Sunnyvale Sells for $2MM, setting new price ft/sq record - <AUTHOR> https://www.mercurynews.com/2018/03/02/sunnyvale-home-shatters-new-record-with-enormous-price-tag/ <comment><USER2> That house is a small single storey building with only a ratio 33% internal floor space vs plot size _.

Here is what $2m house looks like it good neighbourhood of Tokyo [https://www.homes.co.jp/kodate/b-75250036569/](https://www.homes.co.jp/kodate/b-75250036569/) 2100 sqft (195.75m²) of internal floor space squeezed on to a plot that is only 960 sqft (89.26m²). That is 218% ratio.

Is that the typical building density in Silicon Valley? If so, then not surprising it is so expensive. In Tokyo that plot might get divided into 3 and three good size family homes built on it.

_ From the satellite view on Google Maps it would appear this building uses only a third of the land of its plot. So maybe plot is about 2550 sq ft.

</comment><comment><USER3> I view this as a $1.8 million dollar tax for owning a home in Silicon Valley. The average house in Michigan sold in 2017 for $118 per square foot or a little over $100K for a house that size. Even in a nice affluent Michigan suburb with great schools I couldn't see paying over double that amount.

I was just out in the Valley a few weeks ago. Absolutely love it out there but that's just crazy. As usual I think DHH put it best in a tweet:

[https://twitter.com/dhh/status/969684080185950208](https://twitter.com/dhh/status/969684080185950208)

</comment><comment><USER4> The size of the house is irrelevant. It will almost certainly be torn down. The sad thing is that the buyer will be building their dream house in a vast sea of tract housing and ugly commercial strips. Oh, and one orchard.

</comment><comment><USER5> To be fair, it's freshly painted, and the water heater was just replaced last year.</comment>


Identifying HTTPS-Protected Netflix Videos in Real Time [pdf] - <AUTHOR> http://www.mjkranch.com/docs/CODASPY17_Kranch_Reed_IdentifyingHTTPSNetflix.pdf <comment><USER2> Before people panic and again try to claim that HTTPS does not help here, note that the leak here is not in HTTPS itself per-se: it's in DASH and VBR encodings. Segment sizes can be predictable and are unique for each video. Higher variation in bitrate leaks more unique fingerprint information, and Netflix happens to support high variation in bitrates. HTTPS still does guarantee integrity and confidentiality.

Stepping back a bit, although this paper is definitely valuable, it isn't that startling, because we already know that encrypted communications are vulnerable to passive attacks when the contents are predictable. It's a good reminder that "vanilla" encryption isn't necessarily the best way to protect privacy when the attacker can simply guess what we're transmitting because the search space is so small; in this case, it's easy to compare the length of what is being transmitted against a corpus -- and bam. There's only ~42k entries...

Entropy entropy entropy. It is your friend. Just so happens that VBR and DASH weren't designed to increase entropy when transmitting segments.

<comment><USER3> Re: Entropy: Note that just adding random padding to packets doesn't actually protect you from this kind of analysis. You'd want a constant bit-rate ("CBR") encoding instead. Even with CBR, the exact length of the video might give away the contents too.

From a bandwidth perspective, such CBR encodings are either wasteful or low quality for high motion scenes—or both. So it makes sense that Netflix has chosen a VBR system, but does have this privacy caveat.

<comment><USER4> > Even with CBR, the exact length of the video might give away the contents > too.

To avoid that issue you just artificially make multiple movies have the same length, meaning do some padding to round up to the next e.g. 10 minutes (so if the movie is 1:48:23 it becomes 1:50:00), to do so the movie keeps buffering in the background (some random audiovisual noise).

Maybe netflix should have a "Fully safe" mode where it uses CBR instead of VBR so the user knows the trade off (slower/heavier buffering)

<comment><USER5> It wouldn't work, that sounds like adding sleep calls to prevent timing attacks, which doesn't works...

Different bit rates on the random audiovisual noise (white noise would be uncompress-able, thus weight more, pure black would be too compress-able, etc).

<comment><USER6> Why wouldn't adding sleep calls help prevent timing attacks? Assuming you're padding all response times to the same total response time.

</comment></comment></comment></comment></comment><comment><USER7> The scraping and automated viewing in question pretty clearly violate Netflix's terms of use. As junior officers in the U.S. Army, the authors are more vulnerable than most to trivial but "correct" accusations of illegal activity, so I wonder if they were at all concerned about the government's sweeping interpretation of the Computer Fraud and Abuse Act.

> In order to generate these fingerprints, we first mapped every available > video on Netflix. We took advantage of Netflix's search feature to do this > mapping by conducting iterative search queries to enumerate all of Netflix's > videos. This enumeration was done by visiting > [https://www.netflix.com/search/<value>](https://www.netflix.com/search/<value>) > where <value> was 'a', then 'b', etc. and then parsing the returned HTML > into a list of videos with matching URLs.

This is not the same as but still in the same class of "unauthorized" use that Weev was charged with carrying out on AT&T endpoints. No privacy concern here, and in theory you are authorized to view this Netflix content but not to "use any robot, spider, scraper or other automated means to access the Netflix service; decompile, reverse engineer or disassemble any software or other products or processes accessible through the Netflix service; insert any code or product or manipulate the content of the Netflix service in any way; or use any data mining, data gathering or extraction method." Though Weev's conviction was vacated on appeal, that was only based on a venue problem so the prosecution's legal theory about violating terms of use still seems to be in play.

Not concern trolling here, I do this sort of scraping all the time and there's no reason to believe the authors are at any risk. It's just an interesting juxtaposition that illustrates how overly broad the DOJ's interpretation of CFAA is, and how selectively it can be pursued. As the EFF notes, one of the major impacts is that is puts security researchers in a legal gray area ([https://www.eff.org/issues/cfaa](https://www.eff.org/issues/cfaa)).

<comment><USER8> Alternatively, this research could have been done with Netflix's consent and cooperation, in which case there's no TOU violation.

</comment></comment><comment><USER9> Very interesting that they can get a video fingerprint without even downloading the video. So they can fingerprint 44k in 4 days (7 seconds each) instead of downloading each video which would be very demanding. I wonder if Netflix had any monitoring that noticed them initiating a stream of every single video. I wonder if they used multiple Netflix accounts.

They mention they used Silverlight. I wonder if this also works for videos when viewed with HTML5, and if the same fingerprints can be used.

<comment><USER10> > I wonder if Netflix had any monitoring that noticed them initiating a stream > of every single video. I wonder if they used multiple Netflix accounts.

I am very curious why this matters to you.

<comment><USER9> I'm curious why you're very curious why I'm curious.

I would think Netflix would be protective of their content and would likely have monitoring to detect mass downloading. The adversarial nature of one person trying to do something and other people trying to detect and stop them is interesting to me. I find JSOR's account of their monitoring, detection, and attempted blocking of Aaron Swartz's downloading of academic papers (not just metadata like this post), and the cat and mouse game that followed to be very interesting. [https://docs.jstor.org/summary.html](https://docs.jstor.org/summary.html)

And the perspective from the other side: the authors of this paper, whether they were concerned with being detected by Netflix and possibly blocked or even banned from Netflix for life, and maybe took action to avoid that such as using multiple accounts or VPNs.

<comment><USER11> How is Netflix going to ban someone for life? Get a new email address, a new IP, a new credit card, and you're a new person. You may have lost your ratings, but maybe a fresh start is nice from time to time.

<comment><USER12> Possible but not that simple since a new CC is also tied to your identity and billing address.

Paypal does do checks to ensure that blocked accounts are not easily resurrected.

Netflix has less incentive to perform such a costly operation but it's more than possible, this is what every credit and background check agency can do.

Sure if you want to get a completely new identity, credit history and address you can probably fool most of these but you are going to be violating a few laws in the process and it would be probably be cheaper to purchase the entire Netflix library on DVD/BR at that point.

<comment><USER11> > Possible but not that simple since a new CC is also tied to your identity > and billing address.

Billing address sort of, but address verification is usually only on the numbers, not the names of the street. Very few credit card systems pass the name on to the bank when requesting authorization. If you're only using streaming, it doesn't really matter if the street address isn't correct.

Credit and background checks usually request a lot more information than netflix does; nobody would give netflix their social security number, or recent addresses.

</comment></comment></comment></comment></comment></comment><comment><USER13> The result of this is generalizable. Looking at your encrypted HTTPS traffic, people can still tell what you are browsing and downloading especially when they have a good idea of what you could browse or download.

For the rest, I am not sure how many people should be afraid to let people know what they are watching on Netflix.

<comment><USER14> Yep, people can infer a lot. I did a demo of this a couple of years ago for my employer at the time by creating a tool which, in a slightly contrived scenario, is able to figure out what one is looking at on Google Maps over SSL.

Blogpost (includes demo vid): [http://blog.ioactive.com/2012/02/ssl-traffic- analysis-on-goo...](http://blog.ioactive.com/2012/02/ssl-traffic-analysis-on- google-maps.html)

</comment></comment><comment><USER15> Given that Netflix won't let anyone use a VPN to access their service, any security / privacy issue is 100% on them.

<comment><USER16> You sure about that? You sure it's not on the person who, knowing that, still __chooses __to use Netflix?

Note: not defending Netflix's position on VPNs, just pointing out that the user still has free will.</comment></comment>


Anybody willing to reverse engineer cheap DVRs? - <AUTHOR> A few years ago I installed two cheap+chinese+noname DVRs to a customer shops. They did their job and he was able to bust one of his employees stealing stuff. When I got to upgrade his XP PCs to Linux a problem arose: these boxes, as many other similar ones, require a Windows ActiveX to be installed client side. While it is possible to make the ActiveX work on newer (tested on W7) systems, it requires lowering all security options which on Windows is asking for troubles. I also tried installing them on Virtualbox XP machines on Linux hosts to no avail: they install but fail loading, so he's stuck with XP.
I was about to surrender when the news about DVRs being used as botnet slaves hit the presses; this is a huge problem as there are a huge load of those boxes out there. I wonder if someone could create a project aimed at reverse engineering those unnamed boxes in order to replace their internal OS with a fully open source and trustworthy one.
Note that all those boxes contain Linux, though they force the user to
install an ActiveX control, therefore requiring a Windows client. Most of those boxes point for downloading the ActiveX to a long dead address, but the installer can be found online by looking for "TSWebClient_EN_SetUp". I could install the same ActiveX to a PC and
connect to 4 different DVRs, so I believe they're just branded and dressed different but the guts are pretty much the same even if they had ports placed elsewhere.
By the way, once reverse engineered those boxes can become nice hacking platforms. They have SATA, HDMI, VGA, USB, some gpio or serial ports used for PTZ and 4/8 video inputs which means very fast ADCs. They cost new just like a RasPI 3 but the recent appearance of AHD/hybrid ones will inevitably bring the used price to a few bucks or less.
Should a reverse engineering project already exist, I'm willing to donate some quid plus a working box to the hackers. <comment><USER2> any examples (e.g. product names, shop links) of what set of devices you are talking about? Helps searching for existing projects.

<comment><AUTHOR> Hi, sorry for not posting links, I believed they were well known devices. Just do a search on ebay for "h264 dvr 4ch". Example: [http://www.ebay.com/itm/131590806530](http://www.ebay.com/itm/131590806530)</comment></comment>


I'm A Teapot – HTTP status code 418 - <AUTHOR> https://httpstatuses.com/418 <comment> non-nil People, please! If encountering a 418, consider adhering to ISO 3103: [https://en.wikipedia.org/wiki/ISO_3103](https://en.wikipedia.org/wiki/ISO_3103)

<comment><USER2> > The pot should be white porcelain or glazed earthenware and have a partly > serrated edge. It should have a lid that fits loosely inside the pot.

> If a large pot is used, it should hold a maximum of 310 ml (±8 ml) and must > weigh 200 g (±10 g).

 _looks at cast iron teapot_

what?

> Freshly boiling water is poured into the pot to within 4–6 mm of the brim. > Allow 20 seconds for water to cool.

 _looks at bag of loose-leaf green tea_

the?

> Brewing time is six minutes.

 _looks at green tea again_

fuck?

> 2 grams of tea (measured to ±2% accuracy) per 100 ml boiling water is placed > into the pot.

 _looks at gaiwan_

This is obviously a colonial document written by limey tea-monsters.

<comment><USER3> > This standard is not meant to define the proper method for brewing tea > intended for general consumption, but rather to document a tea brewing > procedure where meaningful sensory comparisons can be made. An example of > such a test would be a taste-test to establish which blend of teas to choose > for a particular brand or basic label in order to maintain a consistent > tasting brewed drink from harvest to harvest.

<comment><USER4> > _a tea brewing procedure where meaningful sensory comparisons can be made_

As noted elsewhere, there is no way to meaningfully compare teas that require lower temperatures or longer seeping time with this procedure.

<comment><USER2> > or longer seeping time with this procedure

Or more generally shorter seeping time, I've never seen a tea which wanted 6mn seep time, and most somewhat fragile tea want way less (with the possible exclusion of summing the consecutive infusions of an oolong, I guess you do get into the 6mn range total at the end of the session).

<comment><USER4> Err, yes, shorter, thank you. I mixed that up.

(I guess there is still the option of cold brewed tea though)

</comment></comment></comment></comment></comment></comment><comment><USER5> I had an issue a little while ago where I was trying to get iOS's Shortcuts app to post to WordPress. I noticed that doing this seemed to crash every one of my websites within seconds. It was like flicking a switch: I'd run the Shortcuts workflow and seconds later, all of my sites appeared to be offline. This lasted for precisely one hour, after which everything came back online.

Didn't take long to figure out that the sites had actually been online the whole time for everyone else; they were only inaccessible from my local network. At that point, I contacted my host, and they explained that the WordPress component of the Shortcuts app was, for some reason, bombarding the server with a whole lot of requests for files that didn't exist. The server thought it was under attack and blocked my whole network. Then it got interesting: the guy said that the server was throwing 418s.

I thought he might be mistaken at first. I actually recognized 418, since I've known about the teapot thing for a little while. I asked the guy if it was really the case that the server was blocking my network because it thought my phone was making too many demands for coffee it wasn't capable of producing, and he said that, well, other than the coffee bit, DreamHost really does use 418 for that situation: [https://help.dreamhost.com/hc/en- us/articles/215947927-How-d...](https://help.dreamhost.com/hc/en- us/articles/215947927-How-do-I-enable-Extra-Web-Security-for-my-website-)

That is the only time I've encountered 418 in the wild. That decision seems to be pretty consistent with DreamHost's sense of humor.

(They did, as usual, manage to fix my problem.)

<comment><USER6> This is kind of unfortunate because if they just returned a correct code (429 Too Many Requests), you could have immediately debugged the problem. (The standard suggests also including a Retry-After header, which would tell you when the rate limiting would be lifted so you could try again.)

Basically, there was a machine-readable way to tell you to go away. But instead they told your user agent that they were unable to brew coffee because they are a teapot. What a waste of everyone's time.

<comment><USER5> Agreed, although the iOS Shortcuts app did not even bother to tell me the server's response; it simply failed, so even if the server had returned a coherent error message, I think I still would have had to contact support to find out what it said.

I love Shortcuts—it's a great automation tool with some good ideas—but, as is the case with many Apple things, it prioritizes minimalism over functionality. Seems like an odd tradeoff to me, since I think the only people who even know Shortcuts is on their device are people like me who would vastly prefer full- featured complexity—and better documentation—to the smooth, almost toy-like UX.

</comment></comment></comment><comment><USER7> I added panic("I'm a teapot!"); to the FreeBSD kernel, many many years ago (sys/kern/kern_thread.c). It was for an impossible, cannot-happen scenario.

Much to my astonishment/amusement, it did.

<comment><USER8> > _I added panic( "I'm a teapot!"); to the FreeBSD kernel, many many years ago > (sys/kern/kern_thread.c). It was for an impossible, cannot-happen scenario._

I know it's in jest but I absolutely hate to encounter this kind of thing in the wild. It's a huge anti pattern and tax you put on other people who have to troubleshoot "impossible" scenarios.

<comment><USER9> I dunno, seems like a very quackable phrase to me. In fact soon it will probably lead right here!

<comment><USER10> Off topic, but first time I've seen "quackable". Hahaha, I like it! I've tried "duck it" earlier, but it just sounds like I'm stuck with auto correct on.

</comment></comment></comment></comment><comment><USER11> At Cloudflare's SF office, the conference rooms are all numbered after HTTP status codes. Our Board Room is 404. The coffee shop (Cafe Lambretta) in our building, at the corner of 2nd & Townsend, is bookable in our calendar system as Room 418.

<comment><USER12> There's a FAANG office which also uses 4xx status codes, but as you would expect, 404 is missing, and 403 is permanently locked (spoiler: it's a door mounted on a wall with nothing behind it). 418, on the other hand, is decorated with whimsical teapots.

<comment><USER13> and 401 has a bouncer outside that doesn't let anybody in?

<comment><USER14> Or it just requires a code to enter.

</comment></comment></comment></comment><comment><USER15> We return 418 on our site in case an admin tries to access the admin panel without a required VPN. It actually clicked pretty fast with everybody on the team, especially those less tech-savvy. They know the "teapot issue" means they forgot to turn on the VPN. It's less confusing than 401/403 :)

<comment><USER16> Why not return instead/in addition reply with an actionable message in the body?

<comment><USER15> The misinformation that 418 brings may be quite helpful if an unauthorized person temporarily gets in hold of your device and tries to access that admin panel.

<comment><USER16> How is that? Enabling VPN should require some knowledge still, so why would it help if an unauthorised person accessed your device?

<comment><USER15> Some setups are dead simple and require just 1 or 2 clicks to enable a VPN that was registered before, e.g. Tunnelblick on MacOS. The potential hacker who was explicitly told he has to enable a VPN may look for such an app on the compromised computer.

</comment></comment></comment></comment></comment><comment><USER17> 418 is actually unassigned.

[https://www.iana.org/assignments/http-status-codes/http- stat...](https://www.iana.org/assignments/http-status-codes/http-status- codes.xhtml)

This code has never been officially registered, especially not by that April Fools' RFC. A number of HTTP implementations added it to their lists of codes anyway; there was a concern that it might create a conflict with if an actual meaning is assigned by the HTTP specification. One of the authors of the specification went around asking libraries to remove the code for this reason. Web developers, like the mature people they are, bullied him into abandoning it.

By the way, if one actually wanted to control coffee pots over HTTP, 400 Bad Request would have been entirely sufficient for this situation. This code has been superfluous from the start. Ironically, it became the very thing it was meant to satirise.

<comment><USER18> > _400 Bad Request would have been entirely sufficient for this situation._

The whole idea of status codes is that if you encounter one you don't know about, you can treat it as a member of that family, so any unknown 4xx will be treated the same as a 400. Most of the 400 series is about clarifying what was wrong with the request. 400 just says _something_ 's wrong about the request, but not _what_. 405 says it's the method. 406 says it can't satisfy the provided Accept header. 411 says it wants a Content-Length header. 418 says it's that you tried to brew coffee in a teapot.

<comment><USER19> > 418 says it's that you tried to brew coffee in a teapot.

That you tried to do something so absurdly inappropriate that there isn't even a proper technical way to explain why it was wrong and why it could not work? Like, the server could not even begin to understand what you tried to accomplish with that request.

<comment><USER20> > That you tried to do something so absurdly inappropriate that there isn't > even a proper technical way to explain why it was wrong and why it could not > work? Like, the server could not even begin to understand what you tried to > accomplish with that request.

The "Blank Stare" response code. Or maybe the "Stunned Stare And Slowly Backing Away" response code.

Something at the other end:

[https://en.wikipedia.org/wiki/List_of_HTTP_status_codes](https://en.wikipedia.org/wiki/List_of_HTTP_status_codes)

> 420 Enhance Your Calm (Twitter)

>> Returned by version 1 of the Twitter Search and Trends API when the client is being rate limited; versions 1.1 and later use the 429 Too Many Requests response code instead.[74] The phrase "Enhance your calm" comes from the 1993 movie Demolition Man, and its association with this number is likely a reference to cannabis.

Visually:

[https://http.cat/420](https://http.cat/420)

<comment><USER21> Arguably that should be a 5xx response though; there's nothing wrong with the requests, the server just doesn't want to (doesn't have enough resources to) handle them as quickly as they're being issued.

<comment> another-dave I guess breaking the rate limit is a user error — e.g. sometimes if you continue with could get your access revoked.

I read 50x as "something not your fault" went wrong.

<comment><USER2> Yup. 500 errors are "the server is broken" (aka the server _fails_ to fulfil the request), 400 errors are "the client did something it should not", including every case of "the client did something the server took issue with for whatever reason".

In fact RFC 6585 added "429 Too Many Requests" specifically for rate-limiting scenarios.

413 (payload too large), 414 (URI too long) or 431 (header fields too large) are likewise things which may technically be valid according to the HTTP spec in general, but which the server _rejects_.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Also recommended: [https://http.cat/](https://http.cat/), particularly [https://http.cat/418](https://http.cat/418)

<comment><USER23> Or if you're more of a Dog person: [https://httpstatusdogs.com/](https://httpstatusdogs.com/)

<comment><USER24> And if you're more of a Rap person: [http://httpstatusrappers.com/](http://httpstatusrappers.com/)

with my favorite: [http://httpstatusrappers.com/200.html](http://httpstatusrappers.com/200.html)

</comment></comment></comment><comment><USER18> Some further relevant history:

There's an official registry of status codes: [https://www.iana.org/assignments/http-status-codes/http- stat...](https://www.iana.org/assignments/http-status-codes/http-status- codes.xhtml).

HTTP libraries normally use this as their canonical source of status codes that they should have constants (or whatever) defined for.

But _418 I 'm a teapot_ is not in that registry. It's not clear to me why it wasn't put in when the registry was established, but it seems most likely that someone made an executive judgement against pointless fun.

To my knowledge, it's the only status code from an RFC that has not made it into the registry. So many HTTP libraries, perhaps most, have this one exception, an extra status code not from the registry.

In 2017, the httpbis working group chairman Mark Nottingham (mnot) sought to get 418 removed from libraries everywhere (since it wasn't registered and wasn't serious); this met with popular resistance (people like their fun) and so he changed direction and sought to have 418 registered properly instead, with [https://datatracker.ietf.org/doc/draft-nottingham-thanks- lar...](https://datatracker.ietf.org/doc/draft-nottingham-thanks-larry/). But that draft was allowed to expire and I'm not sure why.

<comment><USER17> The draft was simply integrated into a larger-scope document, still actively maintained (last draft published 12th of July):

[https://www.ietf.org/id/draft-ietf-httpbis- semantics-10.html...](https://www.ietf.org/id/draft-ietf-httpbis- semantics-10.html#name-418-unused)

Note the description doesn't say 'I'm A Teapot'.

<comment><USER18> Ah, good to know; thanks. I'm disappointed they're aiming for unused rather than a regular entry, but it's definitely better than unregistered.

</comment></comment></comment><comment><USER25> If you encounter problems with HTTP 418, you should consider implementing RFC 7168 - The Hyper Text Coffee Pot Control Protocol for Tea Efflux Appliances (HTCPCP-TEA). [https://tools.ietf.org/html/rfc7168](https://tools.ietf.org/html/rfc7168)

<comment><USER26> It's true. I should...

</comment></comment><comment><USER27> My school had a class called CS 418 Computer Graphics. One of the final projects was to render a scene reflected off the surface of a teapot STL. I often pondered on the coincidence.

<comment><USER28> The Utah Teapot is the Hello World of 3D rendering, and a teapot model is included somewhere in almost every 3D rendering application.

I learned about it when I received a copy of BRL-CAD from the Army Research Lab in the mid-90s and it had a teapot, which I thought was quite odd for an application designed for ballistic research.

[https://en.wikipedia.org/wiki/Utah_teapot](https://en.wikipedia.org/wiki/Utah_teapot)

<comment><USER20> The British wouldn't think it odd to mix ballistics with tea:

[https://en.wikipedia.org/wiki/Boiling_vessel](https://en.wikipedia.org/wiki/Boiling_vessel)

> A boiling vessel is a water heating system fitted to British armoured > fighting vehicles that permits the crew to heat water and cook food by > drawing power from the vehicle electrical supply.[1] It is often referred to > by crewmembers (not entirely in jest) as the most important piece of > equipment in a British armoured vehicle

</comment></comment></comment><comment><USER29> I guess the 2020 version of this status code would be "Sir, this is a Wendy's"

<comment><USER30> I don't get it

</comment></comment><comment><USER31> Useful for when you get requests to brew coffee on your smart teapot

</comment><comment><USER32> I had a project were in case of a 400 errors 418 error would be used.

<comment><USER33> Me too, kind of.

I have nginx reply with a 418 page to _bad bots_ requests. Funny easter egg. As a bonus, that makes nginx avoid checking the filesystem for inexistent files, and makes filtering logs easier.

Nginx config snippet:

      # Nothing to hack around here, I'm just a teapot:
      location ~* \.(?:php|aspx?|jsp|dll|sql|bak)$ {
          return 418;
      }
      error_page 418 /418.html;

Example: [https://FreeSolitaire.win/wp- login.php](https://FreeSolitaire.win/wp-login.php)

<comment><USER34> Nice. I used to use that for all php requests to my websites (like you, I do not have php installed on my servers). Now I just use the nginx 444, which immediately drops the connection.

I wonder if it actually saves much time. Probably not.

</comment></comment></comment><comment><USER35> "HTCPCP was an April 1 joke by Larry to illustrate how people were abusing HTTP in various ways. Ironically, it's not being used to abuse HTTP itself -- people are implementing parts of HTCPCP in their HTTP stacks." \- [https://tools.ietf.org/html/rfc2324](https://tools.ietf.org/html/rfc2324)

</comment><comment><USER36> I had a coworker who found about 418, found this hilarious and started returning this in case of error.

It made for an interesting troubleshooting session, because at the time, not all browsers would display a meaningful result. Some would return a blank screen - which is easy to find. But not as easy when it was a single call among many others in the page...

</comment><comment><USER37> Some time ago after realising how GraphQL (don't) use http code, I decided that I wouldn't use http code for business logic like everybody does, but let that responsibility only to the webserver (not auth 401, not found 404, exception 500, and few others). Is that absurd? Should I reconsider going back?

<comment><USER38> It's not absurd. If you have tuits to spare, strive to be in compliance with the standards to your best ability. Do not just relegate error handling to code you will not touch.

For example, status 422 is used for syntactically correct, but semantically invalid request bodies. Augment your graphql library or application code where appropriate.

That way, you reap the benefits of interoperability. Being in compliance makes you a good Internet citizen in the eyes of your peers.

</comment></comment><comment><USER39> 418 - The status code for a passionate debate! It's a joke, it's wrong, it's funny, it's right. And finally, oh dear, we need to have a chat about how you prepare your tea. Discussions on the famous 200, 404 and 500 are usually only lukewarm, though 488 stories can get racy.

</comment><comment><USER40> I'm sure you can run Apache or nginx on the pi zero w on this and communicate with a walking robotic teapot.

[https://www.raspberrypi.org/blog/robotic- teapot/](https://www.raspberrypi.org/blog/robotic-teapot/)

<comment><USER41> The original teapot server was an Acorn Archimedes, so this is a nice legacy.

Edit: I misremembered, it was a coffee pot. Bloody barbarians!

From RFC 2324, " [CBIO] "The Trojan Room Coffee Pot, a (non-technical) biography", Q. Stafford-Fraser, University of Cambridge Computer Lab, <[http://www.cl.cam.ac.uk/coffee/qsf/coffee.html>](http://www.cl.cam.ac.uk/coffee/qsf/coffee.html>)

</comment></comment><comment><USER42> Obligatory Google Teapot:

[https://www.google.com/teapot](https://www.google.com/teapot)

</comment><comment><USER43> For Zarquon's sake, the least they could have done is listened to him about tea [https://hitchhikers.fandom.com/wiki/Tea](https://hitchhikers.fandom.com/wiki/Tea).

</comment><comment><USER44> As more of a graphics guy than a HTTP guy, I immediately though of the Utah Teapot.

[https://en.wikipedia.org/wiki/Utah_teapot](https://en.wikipedia.org/wiki/Utah_teapot)

</comment><comment><USER45> A bit more than 5000 web servers return HTTP 418 :)

[https://beta.shodan.io/search?query=http.status%3A418](https://beta.shodan.io/search?query=http.status%3A418)

</comment><comment><USER46> This reminds me of Hurds EIEIO

[https://www.gnu.org/software/hurd/faq/eieio.html](https://www.gnu.org/software/hurd/faq/eieio.html)

<comment><USER47> One of POWER's ordering primitives is enable in-order execution of input/output, or eieio.

</comment></comment><comment><USER48> 718 - I am not a teapot

[https://github.com/joho/7XX-rfc/pull/180](https://github.com/joho/7XX- rfc/pull/180)

<comment><USER49> 718 - I'm a Porsche

</comment></comment><comment><USER50> [https://github.com/vpetersson/im-a-teapot](https://github.com/vpetersson/im- a-teapot)

</comment><comment><USER51> We use it in our product [https://punterz.club/](https://punterz.club/) just for fun :)

<comment><USER52> The longest thread at a hacker space I frequented was fighting over adding a 418 status to the mainline iot kettle stack.

The argument went that a kettle is not a tea pot since before adding a tea bag you can use the hot water for anything, including instant coffee. Someone added a tea bag dunker to the kettle. People started complaining about taking away choice by forcing everyone to use the kettle as a tea pot, so I added a empty tea bag as one of the selections. The argument then went that since it can load empty tea bags it is not a permanent tea pot even though it is mostly a tea pot so it shouldn't include 418 as per RFC 7168.

The last I'd heard of it, they had added peristaltic pumps that can be accessed individually, so if you sent an HTCPCP request to the tea designated pump for coffee it would return 418, but if you sent it to the beverage server it would route your order to the correct pump.

</comment></comment><comment><USER53> More work was put in for this joke than I've literally put into any development related thing all summer. I like it.

</comment><comment><USER54> On my licence plate I have the number 418 :D

</comment><comment><USER8> Please if you're reading this, don't add this status code and don't suffer anyone to add this to your code either. It's not funny, and it's not clever. Please don't do it. Find another way to be clever and funny.

<comment><USER55> Who exactly put you in charge of deciding what's funny?</comment></comment>


Chinese iOS compay's xcode installing file has been hacked, adding  backdoor - <AUTHOR> http://drops.wooyun.org/news/8864 <comment><AUTHOR> [http://researchcenter.paloaltonetworks.com/2015/09/novel- mal...](http://researchcenter.paloaltonetworks.com/2015/09/novel-malware- xcodeghost-modifies-xcode-infects-apple-ios-apps-and-hits-app-store/)

English version.</comment>


WebOS Internals : The homebrew team for webOS - <AUTHOR> http://www.webos-internals.org/wiki/Main_Page

<comment><AUTHOR> From the previous discussions about TouchPads (<http://news.ycombinator.com/item?id=2638537>), I figured it might be helpful to provide a link to those interested in exploring webOS.

It really is quite nice and very very hacker friendly.</comment>


Rosetta Code - <AUTHOR> http://rosettacode.org

<comment><USER2> _A Sysadmin's Unixersal Translator (ROSETTA STONE) OR What do they call that in this world?_ <http://bhami.com/rosetta.html>

Quite helpful if you find yourself having to deal with some ancient box from the age of the Unix Wars.

</comment><comment><USER3> You should also visit this website which is in the same vein : <http://99-bottles-of-beer.net/>

"this Website holds a collection of the Song 99 Bottles of Beer programmed in different programming languages. Actually the song is represented in 1323 different programming languages and variations. For more detailed information refer to historic information."

</comment><comment><USER4> And <http://pleac.sourceforge.net/></comment>