'Stop using paper checks,' says agency in charge of them - <AUTHOR> http://fusion.net/story/309392/stop-using-paper-checks/ <comment><USER2> Business accounts are even worse - they're governed by the Uniform Commercial Code rather than consumer law, and you only get 24 hours to report fraud. If someone sucks $200k out of your account and you don't catch it in 24 hours, there's a possibility you'll never see that money again.

What a lot of people do is set up an 'incoming payments' account, an 'outgoing payments' account, and a 'storage' account. Have your bank block all external withdrawals from the incoming account, block all external deposits to the outgoing account, and automatically move money once-a-day from the incoming account to storage and from storage to outgoing(keep say $10,000 in there at all times). Never write checks against the storage account, or give the number out in any way.

On one hand, ACH is technically insecure. On the other hand, if a scammer can get away with the money a terrorist could get funded with the money, so money laundering and anti-terrorism laws have the side effect of making it hard for people to get away with it. And then you just throw the scammer in jail.

The article mentions handing a check to your landlord. Personally, as a landlord I set up an incoming rent checking account, hand out the checking account information to tenants, and let the tenant deposit the money electronically or by driving to the bank. I've asked my bank to reject withdrawals but accept deposits from that account, and use a debit card to pay for maintenance and utilities. I'm considering using SaaS software to collect this, mainly to ease accounting; I'm not worried about security here.

<comment><USER3> As a fellow landlord, I agree that checks are a giant pain. I'm actually working on making a mini-SaaS just for myself to use, using Stripe to handle ACH payments.

</comment></comment><comment><USER4> > The physical check itself – the piece of paper – has to be genuine,

This is wrong, right? There is no such thing as a genuine check outside of conventions for repudiation(out of order check numbers, not on _my_ check paper). Whether it came from the checkbook my bank sent, or out of my printer, it is just as good. Legally, writing it on a napkin would probably work, but draw lots of scrutiny becuase it looks suspicious and can't be processed automatically.

<comment><USER5> That's correct. I worked at a bank for years and once a month I would get a check written from the same older gentleman on half a sheet of yellow legal pad.

He apparently thought buy checks were a scam and he saw no reason to buy them when he could just use a sheet of paper.

<comment><USER6> And he was exactly right!

How do you know who wrote the check? You should only see the recipient.

<comment><USER5> The first couple of times I called and confirmed that he did write the check. Also the banking systems keep copies of signatures so I checked the signatures as well.

Once it became a regular thing, we made a note on his account.

</comment></comment></comment></comment><comment><USER7> Anyone coming to the US from most of the world is painfully aware of how antiquated the whole system is. For a business accepting relatively few large payments, a major issue is the cost of payment.

For all their absurdity, paper checks are the only universally accepted almost-costless way to transfer money. ACH, wire transfer, card payments all come with an added cost of up to 3%, and every single proposed replacement system we've seen comes with new fees attached. For a payment of $10,000, payment by check costs perhaps $1. Payment by a 1% fee wire transfer system (most of them cost more) would be $100. Flat fee wire transfers range from $30 / transfer up.

Given how big and archaic ACH is now, and how expensive replacing it would be, I can't see a way out of this unless banks are required by regulation to provide an aggressively low-cost transfer mechanism.

<comment><USER8> Banking regulations in Europe require electronic transfers within Europe* to be processed for free within one business day. I've ordered computer hardware, international flights, and paid lawyer fees this way.

*Specifically, I believe any country within SEPA.

<comment><USER9> I don't think that's quite right.

I think they require SEPA transfers (roughly, transfers to other euro countries) to cost no more than domestic transfers.

Banks charge around 5-75 cents to business customers for electronic transfers, depending on the customer.

</comment></comment></comment><comment><USER10> I believe such a system is Safer to use for the average customer because the law is on his side. A routing number is (as far as I know) not considered a secret and very judge will rule that it's the banks fault for authorizing the transaction, not the user's. If the user were to use any kind of authentication (such as typing a pin in a card reader), the bank can claim that it's the user's fault because he used his code carelessly and they are often right, people write the code on cards directly or use their birthdates but even if the pins are random, they can still be easily "cracked" (some people are super skilled in reading them from a distance while others have implemented key loggers in those readers). So you can't really use a password/pin for authentication either (because it is not that secure after all). In my country, debit cards are quite common and debit cards never use a signature – they use a 4 digit pin instead. If your debit card was stolen, and somebody went shopping with it, you have to pay the bills because you did not protect your pin enough and it's not the bank's fault — they had enough proof for authentication. (I know quite a few people who had bills from $300-2000 after their debit cards were stolen and I can tell you for sure that some protected their PIN properly).

If you have to authenticate a withdraw in any way, the bank will have a better chance to win a fraud case because they had enough reason to believe the transaction was authentic and it is your fault not for protecting your pin or password enough. The bank might voluntarily rebook the transaction but why even bother if they had to do that anyways (even without a pin). The consumer is not the victim here, the bank who has to get the money back is. So why would you want to fix a system that works in your favor.

<comment><USER11> This is an interesting point. The article complains about checks being zero- factor authentication. Well, in practice, traditional chip-less credit cards are also zero-factor authenticated. The notion that our card numbers are supposed to be "secret" is plain stupid, since we give it to every single vendor we interact with.

PIN-based cards _are_ authenticated, but the practical security around those PINs is laughable.

So would you rather have obviously insecure but resilient system, or unobviously insecure and fragile system?

...

Making checks secure is relatively "easy". Simply have a mechanism for the person to review and authorize every credit/withdrawal via SMS or email. The problem, however, becomes keeping _that_ mechanism secure, especially in the age of easily stealable and hackable mobile phones.

<comment><USER10> I want to have a system which protects me from money loss (through my own fault, a malicious third party, or my bank's fault). I don't care how as long as I'm protected. With Chip-and-PIn cards, I'm not protected because I have to proof that it was not my fault (which can be incredible difficult to do). So, I personal prefer cards that require a signature.

It doesn't matter to me if it has a chip or not (the chip has nothing to do with the pin, there are also chip-and-signature cards and cards that support both. The chip makes it hard to physically clone the card).

If you are interested in the downsides of the new pin card, checkout this video: [https://youtu.be/Ks0SOn8hjG8](https://youtu.be/Ks0SOn8hjG8)

So, if zero authentication means that I am not liable for financial damages, I'm happy with it but I wouldn't bother to use a pin if I had the same liability. Unfortunately, the pin adds _laughable_ authentication which makes me liable for many types of fraud (see the video).

</comment></comment></comment><comment><USER12> I use paper checks a lot these days. It costs me about $1 to clear a check, and $25 to send a wire transfer.

I'd much prefer to do everything electronically, but I'm not going to pay an extra $24 to do it...

<comment><USER13> >I use paper checks a lot these days. It costs me about $1 to clear a check, and $25 to send a wire transfer.

Is ACH not an option?

<comment><USER12> Not within Canada, and it's nontrivial (both in terms of paperwork and cost) for moving money from the USA to Canada.

I inquired at my bank about electronic funds transfer (think ACH, but in Canada) and it would have cost around $100/month to sign up for that.

<comment><USER14> Ya, I sometimes feel like Canada is the only developed country with a more insane banking system than the US. But in reality I think we're both about equally insane, in different ways.

<comment><USER12> Canada is about 15 years behind the US in terms of banking. (But about 3 years ahead in terms of credit cards, interestingly enough.)

We avoided the mortgage securitization nightmare literally _because Canadian banks hadn 't gotten around to it yet_. If the market crash had taken a year longer before happening, Canadian banks would have been along for the ride.

<comment><USER15> Although Canadian banks, at least 2 years ago, were unable to issue a VISA debit card linked to my business account. They wanted me to get credit, and appeared to be totally confused as to what a VISA debit card was. When I asked how I could go about registering, say, domain names, or purchasing stuff overseas, they said "Interac". It's almost adorable.

<comment><USER12> I really don't blame them for being confused about VISA debit cards. They hardly exist in Canada; they were originally a scheme to allow credit card transaction processing fees on debit transactions, and Canada quite reasonably didn't buy in.

The problem is really that Canada's interac system -- which was very advanced for its time -- never reached outside of the country or online, and market share means that you really want your payments to go through the major international card networks. But that's a matter of getting unlucky in backing the wrong horse more than anything else.

<comment><USER8> In many other countries with domestic card schemes, EMV cards are often co- branded with other domestic schemes to allow the same card to be used internationally. Domestically, low fees are maintained, but internationally the card would still function. This was more or less forbidden in Canada (see item 6):

[http://www.fcac- acfc.gc.ca/Eng/forIndustry/publications/laws...](http://www.fcac- acfc.gc.ca/Eng/forIndustry/publications/lawsReg/Pages/CodeofCo-Codedeco.aspx)

According to some of my colleagues, these regulations were explicitly made to protect Interac against Visa debit and Maestro which were characterized as domestic schemes from the Visa and MasterCard network.

Because there are no co-branded cards, it also means that Maestro is not really accepted at many POS devices in Canada.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> At my first startup, checks were the industry standard and we naively thought that we could change behavior by introducing modern payment tools to our customers.

It turned out that our customers used checks because it helped with their cash flow. They could tell us they "cut a check" on Friday, mail it on Monday, we'd receive it on Wednesday, and the money would be in our bank account Thursday. They basically were able to hold onto that cash for an extra 5 days, compared to a wire transfer.

<comment><USER17> It would seem this is only helpful if you have more outflow of payments than inflow. If other customers/suppliers are using the same tactic, all it does is slow down delivering products and services.

<comment><USER18> Accounts Payable and Accounts Receivable:

Generally, for services provided, Accounts Payable aim for 60 days after service provided, and Accounts Receivable aim for 30 days since service provided.

I dislike it, and have a far nicer relationship with companies that pay on- the-spot. Indeed, I bend over backwards for such clients.

<comment><USER19> I've seen companies in B2B contracts ask for 90 day or even 120 day payment terms. It's just part of the negotiation.

</comment></comment></comment></comment><comment><USER20> Why is the US so incredibly backward with day-to-day use of money? As a Kiwi it's like jumping back thirty or forty years in time when I visit.

<comment><USER21> It's a scale thing, I think. In NZ if you are a bank wanting to introduce new technology for payments then you have exactly 5 other banks that you need to get on board. In the US there's many thousands.

e.g. The NZ banks jointly own the company that processes EFTPOS payments. A system like that could never emerge in the US. Instead, people have debit cards, which are manageable because they go through the credit card companies and there are only a handful of those.

But yeah, it's all incredibly primitive and fraud-prone compared to NZ or Europe (I've lived in all three).

<comment><USER22> Scale might explain NZ but not the EU?

<comment><USER23> Well, the EU isn't a country.

Scale might explain it for individual countries situation

<comment><USER24> _Well, the EU isn 't a country._

But it still has introduced SEPA over its whole area. If anything, a country should have less of a problem than a still somewhat disjoint union of 28 countries.

</comment></comment></comment></comment></comment><comment><USER25> Always when it is about payments in the US I understand more and more why fintech startups are so successful in the US. In Germany I don't really see the point. Wire transfers and deposit entries are cheap, reliable and they work with every bank.

So fintech startups here have a much harder time to explain, what is different about them.

BTW. The case what is describe in the article sounds for me like some kind of deposit entry fraud. Something I feared for a while in Germany, because deposit entries are very common for e.g. phone bills. But they seem to be one difference, in Germany you can simply cancel it and get your money back, usually 6 weeks but courts already ruled that this is just the minimum time.

</comment><comment><USER26> A computer generated check is absolutely as valid as a paper check from your checkbook. I routinely generate images of checks which I then snap a picture of right off the monitor in order to remote deposit. Of course this is always done with the written and signed consent of the account holder.

Since you can't ACH outside of the US (I think) and any bank in the US has pretty strict "Know Your Customer" requirements, you will know for sure at least the first hop of where the money went.

I've heard of "work from home" schemes to include people acting as a middle- man for funds like this. They receive the ACH funds, and then they wire them overseas or send them via Western Union. These people, whether they were honestly duped or not, have committed a felony.

So when people worry about checks containing all the data you need for someone to empty your account, the first thing to consider is deterrence is very strong in this area because the penalty is massive, and tracking where the money was sent via ACH is easy.

That said, it would be nice if they could phase in a new standard which used one-time codes and provided real-time validation for this sort of thing. ACH transfer fees are extremely low compared to credit cards after all.

<comment><USER27> Relying entirely on KYC to identify abusers is very fragile. Not only does the USA not have a modern banking system but it also lacks robust ID verification procedures.

<comment><USER28> As far as I know bank tellers / officers receive no ID document training. Bouncers are better at detecting fraudulent documents.

</comment></comment></comment><comment><USER29> Donald Knuth was saying this how many years ago? It's got to be something like 10 years now. This is why he stopped sending out checks for people finding bugs in his books.

[http://www-cs-faculty.stanford.edu/~uno/news08.html](http://www-cs- faculty.stanford.edu/~uno/news08.html)

<comment><USER30> Most of Retail stopped accepting checks about 15-20 years ago, iirc. It was about the time laser printers and copiers came about that everyone realized how insecure they were. Now, banks are one of the few places that accept that form of currency.

Edit: Judging from the replies, my personal memories are incorrect.

<comment><USER31> The security of checks have never depended on difficulty of duplication. Most places checks at least used to be valid if you simply wrote the right information down on an arbitrary piece of paper.

</comment></comment></comment><comment><USER32> The percentage based fees for electronic transactions are absurd. We're talking about moving a number from one database to another. The effort doesn't scale with the size of the number. It's not like we have to move a truckload of gold. There's absolutely no reason it should be based on a percentage of the money being moved.

</comment><comment><USER33> I remember reading about Patrick Combs [1] depositing a "sample check" from some junk mail and it ended up clearing, despite it saying "not negotiable" on it. I wish his original story was still on the web because it included a _ton_ of detail about what happened, but alas ...

Previous mentions of Patrick Combs on Hacker News: [https://news.ycombinator.com/item?id=4344720](https://news.ycombinator.com/item?id=4344720) [https://news.ycombinator.com/item?id=2020631](https://news.ycombinator.com/item?id=2020631)

[1] The best link I could find today: [https://www.reddit.com/r/todayilearned/comments/37b74g/til_t...](https://www.reddit.com/r/todayilearned/comments/37b74g/til_that_a_man_called_patrick_combs_deposited_a/crlgqcn)

EDIT: added additional Ycombinator links.

<comment><USER34> I remembered reading this on bored.com back in the 90's when, well, I was bored. Here the original story from the Archive:

[http://web.archive.org/web/19971210082324/http://www.dnai.co...](http://web.archive.org/web/19971210082324/http://www.dnai.com/~pcombs/$$tablecontents.html)

</comment></comment><comment><USER35> > By using a debit card, you're moving money over the relatively secure Visa > or Mastercard rails, rather than over the ACH rails.

Well... Someone who has your Debit card number and expiration date can remove money directly from your checking account just as someone who has your routing number and account number can. I never use ANYTHING connected directly to my checking account to pay, unless it's the only option. There are a few things I need to pay with a check, but I see literally zero reason to use my debit card. My credit cards are accepted in all the same places and they provide me with more protection (in the sense that there's a buffer between them and my cash - even if I get reimbursed for fraudulent debit usage, the money is gone from my account for some period of time, allowing checks to bounce and other bad things to happen).

<comment><USER8> This is more an issue with your bank being too lazy to do 2-factor authentication properly than the network itself, which supports authentication mode for almost all channels. My company provides tools for testing payment terminals/networks and I always make sure I use my actual debit card when I demonstrate our tools. My bank will not authorize transactions without proper authentication, so it really doesn't matter if people see my PAN/expiry date. Even using my credit card online requires proper authentication when the site supports 3D Secure.

</comment></comment><comment><USER36> I would love to move away from checks, but (ironically) they're the cheapest, quickest, most robust way for me to transfer money digitally between family and friends. Write a check, endorse the back, take a photo with a banking app, and money is moved from one account to another without any additional fees.

<comment><USER37> Wow, what a massively convoluted process. So you don't have the concept of bank account numbers in the US?

Speaking as a Scandinavian expat, in Norway, a bank account number is _all_ that's required for an IB transaction - whether to a private individual or an institution for paying bills etc (which will also require a reference, typically). The account number incorporates all required processing information.

In Australia it's slightly more complex by the availability of options; the routing info is split out into a BSB (bank branch identifier) so you need that as well as account number - and account name - for a payment to an individual.

For bills you have BPay through your Internet Banking (very similar to a BSB+Account No payment yet a different method, and it doesn't require you to enter a name as the BPay number will resolve to a named organisation). There are typically no transaction fees.

Outside of Internet Banking there is also a similar Australia Post system, as well as credit card payment methods.

Anyway I thought the Australian system was a bit hard or confusing at first, but the concept of creating digital images of cheques sounds outdated and painful.

<comment><USER38> > So you don't have the concept of bank account numbers in the US?

Was that really called for? Checks have account numbers on them. And checks aren't the only way to pay for things.

The signature is a security measure. Not a very good one, but in terms of the process is the same as your password or whatever authentication you use. You do authenticate, right? You do need more than a single bank account number to complete your transaction, no?

By comparing the security procedure of US checks to the information needed without security elsewhere, you're exaggerating the difference. It _is_ easier like you say, and checks should die as fast a death as possible, but the process you replied to takes 30 seconds to perform, not massively longer or more difficult than authenticating with your bank and doing it online.

<comment><USER37> Sorry by "account numbers" I meant a standardised system of these, serving as foundation for electronic banking.

In Norway: That single account number is all that's required to send someone money, with amount mandatory and an optional reference. From what I know, they've tightened security down a fair bit and require TFA devices etc, so it may not be as easy as in Australia.

In Australia: On my Android device I use biometric authentication (fingerprint) as a shortcut to the username password that is required on first time login; the username is different to my account number.

When transferring to a new recipient, an SMS confirmation code must be entered. I already explained what destination information was required, but omitted that for BPAY, we require our customer number reference.

Once entered it is saved, which means a manual bill payment is easy as: Log in, select payments, select recipient, dollar amount, submit then confirm => done. (Including login I can pay say my ISP bill in less than 30 seconds). Of course these can be made recurring.

I would say this electronic, biometric model sounds significantly easier, but then I've never lived in a place where banking is so paper based so that's just my world view.

(I received a bank cheque some time ago and honestly had no clue on how to cash it, so rare is this. I learned that our ATMs now feature scanners for depositing, but it took nearly a week to clear).

</comment></comment></comment></comment><comment><USER39> Does anyone here still use paper checks? I'm 29, living in Australia, and have received maybe 3 paper checks in my entire life.

<comment><USER40> If you rent an apartment, you'll probably be asked to supply your bond in the form of a paper cheque.

<comment><USER41> Yes, although they usually demand a bank cheque (which I think is what is called a "cashier's check" in the US), not a personal cheque. You go to the bank teller, you pay them the amount plus a fee (usually out of your bank account), and the teller issues a cheque in the bank's name not yours.

I also occasionally get bank cheques in the mail from companies. If you have a utility account, and you close it, and it is in credit, they'll mail you a bank cheque for the credit amount.

Actual personal cheques - my grandparents used to give me those for my birthday. That's probably the last time I can ever remember encountering one.

</comment></comment></comment><comment><USER4> No actual news, just ACH as it has been for many years. The author was annoyed that credit card companies allow users to pay by "eCheck" without prenote or deposit confirmations.

> The good news is that online ACH fraud is relatively uncommon, just because > it's rare to find an online vendor who will allow you to pay using ACH rails > instead of your debit card. The case of paying off a credit-card bill is a > unique one, because you can't use a credit card to pay off a credit card.

</comment><comment><USER42> I don't understand why people set up automatic payments on the payee's site. If you initiate the payment from the bank, you have more control over when it goes it out, can review the bill before authorizing the withdrawal, can see all of your pending payments and their effect on your balance, etc. I don't like giving anyone access to one of my accounts. Credit cards are a decent buffer against this, as you get time to review the bill before paying.

<comment><USER43> I used to work for the largest provider of bank bill pay in the US (contracted with ~80% of banks, IIRC). I would say that 95% of customers using the service had no clue how it actually works.

In fact, the _default_ payment method of bank bill pay is to mail a paper check. Sometimes they cut a check with your account information, sometimes they will go ahead and pull the money from your account, but send a check drawn from their corporate account. Sometimes they mail the check 2-3 days before your payment date, so that (in theory) it has time to get there, sometimes not. The only time they send electronic payments is of the payee has set up electronic payments with them, and even then they may decide to switch your payment to a check at any time for any reason.

What makes it even worse is that they try very hard to make sure customers have no way to tell how their payments will be processed, and there's never any kind of warning that something has gone wrong until you get a call about a late bill. For example, even your payment should be sent electronically, something as simple as a typo in the account number so it doesn't match the expected length or format might result in them sending a check to your payee (with the wrong account number), meaning that your payment sort of vanishes...

Personally I _always_ set up payments through the payee's site, using a credit card whenever possible. If they screw up the payment then it's their problem to fix.

<comment><USER42> Yes, this is what I mean. I know it's often a paper check. Much like some of the other comments, sending a paper check gives me several advantages.

I've had really bad luck with using a credit card and automatic payments. In particular, it led to my insurance being cancelled. I seem to have my card number marked bad by the bank at least once per year, and either get a new number, new expiration date, or just have all transactions blocked.

Having a scan of a cancelled check in my online banking account has worked a lot better in proving those sort of payment disputes than anything else.

</comment></comment></comment><comment><USER44> I'm not sure ACH is so much less secure than debit. You hand your card out to far more people than you ever send a check to and it has the info they need to use it online unless avs restrictions are enforced by the merchant, which is less secure than a merchant enforcing ACH micro-deposits imho. With both of these authentication methods it is up to the merchant to enforce and they are liable in the end for the most part when they don't. American express doesn't feel the need to enforce micro-deposits because they've already lent you the money so if a payment fails they're not at more risk than they were before the payment was made. In the end, it's easy to obtain the information for both and both have systems for reversing.

</comment><comment><USER45> Checks can be forged, but passwords can be cracked, and data can be stolen. At the end of the day, it's the responsibility of the company to ensure sensitive information is safeguarded and to minimize fraud. Customers still need to understand and practice good habits, but ultimately this ends up in the hands of one or multiple companies that need to be responsible.

<comment><USER46> I used to work in bank fraud detection/prevention. In general, adding a small barrier is often enough to cut crime rate drastically. This is why people lock their doors even though a robber can break a window, or why people hide their phones in their shoes at the beach even though a thief can just check under everyone's shoes. These small barriers are actually very effective because they increase effort and the risk of being caught. Checks are by far the most frauded financial instrument and at the highest dollar amounts. It's basically the financial equivalent of keeping your door unlocked or your phone laying around unattended. [http://www.stopcheckfraud.com/statistics.html](http://www.stopcheckfraud.com/statistics.html)

No one should use checks, and no one should accept them.

</comment></comment><comment><USER47> I work in a business that provides ACH services. This article over dramatizes the risk of fraud.

First, for a business to even use ACH, they need a bank account to receive payments. This involves an underwriting process and a cash reserve for any returns.

Second, businesses have daily limits they can process. This is usually well below their cash reserve.

Finally, any hint of fraud will cause the bank to drop them like a hot potato and seize their reserves for a period of time to ensure sufficient funds to process any returns. One example of fraud indication is a high return rate

</comment><comment><USER48> The only time I write paper checks anymore is for larger charitable contributions, where I assume the organization would prefer the handling burden over processing fees.

</comment><comment><USER49> I like how both the use of ACH by Stripe and Plaid and this story are on the front page at the same time. ACH transactions are interesting but as the article points out reversable as well. All financial organizations agree to reverse them on demand AFAICT. That is why scammers really want you to send them cash via western union or something.

That said, its truly annoying to deal with.

</comment><comment><USER50> For those interested in a more technical dive into the system, see this blog: [http://engineering.gusto.com/how-ach-works-a-developer- persp...](http://engineering.gusto.com/how-ach-works-a-developer-perspective- part-1/)

</comment><comment><USER51> We already have good alternatives to these things. My financial life runs entirely in bitcoin, except for the shrinking list of payees who are still allowed to request payment in fiat money. Of course, I had to move out, live elsewhere, and continue trading from there, to make it happen. But then again, everything is so much cheaper here ...

<comment><USER52> > who are still allowed to request payment in fiat money

Is Bitcoin not a form fiat money itself? It has nothing physical backing its value...

</comment></comment><comment><USER53> The banking system is a disaster.</comment>


Chinese RFC proposes separate, independent, national internets and DNS roots - <AUTHOR> https://tools.ietf.org/html/draft-diao-aip-dns-00 <comment><USER2> "Internet autonomy" = we want to have our own _intranet_ so we can cut off the rest of the world from our population without causing technical trouble.

"Unilateral action" = we're gonna do this whether you like it or not.

But you know what, the Chinese already have the means to do this. Just block anything that doesn't end in ".cn", and block port 53 on all foreign DNS servers. Then what's the point of this internet draft? Just something that somebody can cite later to lend an appearance of support when China does break away from the internet?

<comment><USER3> Just trying to be fair-minded here.

We probably should have foreseen this and fixed our system earlier. I remember being at Interop back before it was cool, think industry at Gopher not Mosaic (more 'People Sometimes Need Data Processing', and not so much of the 'All'). Anyway, even then I was flabbergasted at the way networking was being implemented. The truth is, there ARE really good reasons to have a multiple DNS roots. We probably SHOULD have thought about languages with non latin alphabets. It is also true that we SHOULD have considered allocating more internet addresses to China than we allocated to, say, Stanford University. And, yes, the list goes on and on.

Having mentioned all that, I am inclined to try to fix the internet we currently use. And, to be fair, even the Chinese will concede that we have been TRYING to do just that. These things take time though. No one, (and by no one I mean Governments), really has the motivation to be very proactive in the attempts to fix a lot of these issues. This is just one manifestation of the diverging interests.

<comment><USER2> > _we SHOULD have considered allocating more internet addresses to China than > we allocated to, say, Stanford University._

That might actually have been a good justification for China being in control of its own addressing scheme (which the draft proposes) if we didn't have IPv6. But now there is no need, since the cost of implementing a nationwide NAT (sort of) might rival, if not exceed, the cost of transitioning to IPv6.

<comment><USER4> Don't confuse IP addresses (which are finite and especially in the early days could only be handed out it big chunks) with DNS names (which are infinite and as hierarchical and granular as necessary).

</comment></comment></comment></comment><comment><USER5> It's not an RFC, it's an Internet Draft (which anyone can submit without review), and anyway it's offensive and incoherent enough that nobody will take it seriously, and it certainly won't make it as an actual RFC.

<comment><USER6> Why is it offensive? How is it incoherent?

<comment><USER5> Proposals to fragment the Internet generally do not go down well, for obvious reasons.

The proposal is needlessly complicated, notwithstanding the poor quality of writing. The authors' rationale is to "realize autonomy", yet AIP suffixes are globally namespaced and still need IANA assignment, which is really no different to the current situation in relation to TLDs. It breaks backwards compatibility when applications need to cross AIP networks and also introduces the issue of conflicting AIP network-internal names. The authors make no attempt to discuss these obvious issues or any others, and also blindly wave off security considerations, saying "there is no additional security requirement".

Also, the authors are on Yahoo/QQ free webmail addresses, which isn't very professional.

<comment><USER7> The '@qq.com' part seemed more professional to me than the '644247110' part.

<comment><USER8> Phone number style email addresses are quite common in China.

I assume it's because you can't have unicode email address? (can you?) And there are only a hundred or so different names (in pinyin without tone marks)...

<comment><USER9> >And there are only a hundred or so different names (in pinyin without tone marks)...

My instinct tell me that's not correct. So I did the calculation:) From the ancient Chinese surname document "百家姓" [1], there're more than 500 hundreds surnames listed. And by removing the tone marks, I got 295 unique surnames in pinyin. But these are just surnames commonly used thousand years ago. Multiple by thousands unique first names, I believe that there're at least hundreds of thousands different names in pinyin.

Of course this is still far less than the number of different names in western countries. But it's not the main reason that some people in China use number style email addresses.

[1] <http://en.wikipedia.org/wiki/Chinese_surname>

</comment></comment></comment></comment></comment></comment><comment><USER10> We like this Internet, but we would like one without the "Inter", and possibly without the "net".

<comment><USER11> My thoughts exactly ... and by definition, this RFC is an Intranet (although on a very large scale). See <http://en.wikipedia.org/wiki/Intranet>.

I've actually done what this RFC proposes twice before simply by configuring my DNS server carefully. Once I left an open wifi AP at a tradeshow that served our company's website regardless of the domain entered. The other time I specified that all hosts used the address of our proxy-filter so that there was no need to configure a proxy server on your computer.

I'd have to think it through a bit but I think these techniques would work on a larger scale (like a country). Perhaps I'll write an article about these unorthodox DNS configurations if people are interested.

</comment></comment><comment><USER12> I see a lot of people complaining about the quality of English in the draft. This makes me wonder about something:

Is it legal to discriminate in hiring based on English skills? It seems like it would necessarily have a disparate impact based on national origin, which I believe is a protected class. But to forbid hiring on the basis of English skills would seem very strange in an English-speaking company, where English is critical to communication.

<comment><USER13> It is certainly ok to require excellent communication skills in hiring certain positions. Probably not for all positions across an enterprise, though.

</comment></comment><comment><USER14> I'm having trouble understanding what this buys even the Chinese. As far as I can tell, this proposal is the equivalent of all clients putting "search cn" (for example) in their resolv.conf; local "cn" domains will then be searched first, falling back on non-cn domains only if no .cn domain is found. The only difference is that the code to handle this "search cn" directive would be in the DNS server instead of the client.

This doesn't have any "teeth" unless they also blocked non-Chinese DNS servers. But they could do that already, even today. I just don't get why they're coming to the table trying to convince the rest of the Internet to do something, when they seem to already have the tools they need to do this themselves.

<comment><AUTHOR> There is a worldwide political pressure around DNS filtering, redirection and manipulation. [1,2,3] The same pressure is going to come to IP as soon as DNS- poisoning workarounds will spread to more lay people.

Probably China is trying to show the way, even the technical way, on how to apply internet-wide censorship to other "freedom loving" countries. I think China may also be seeking some kind of official recognition of the fact they are not the only bad guys in town, that other countries are implementing the same measures, although with much less bad public reaction. If other countries will reference that Internet Draft in their (leaked) technical manuals or even participate in the discussion of it, China could much more easily justify its actions.

[1] [http://m.zdnet.com.au/dns-poisoning-the-thin-end-of-a- wedge-...](http://m.zdnet.com.au/dns-poisoning-the-thin-end-of-a- wedge-339338101.htm) [2] [http://vrritti.com/2012/05/23/dutch-justice- department-wants...](http://vrritti.com/2012/05/23/dutch-justice-department- wants-dns-blockade-for-gambling-sites-even-when-such-a-blockade-will-have-a- limited-effectiveness/) [3] [http://www.guardian.co.uk/technology/2012/apr/30/british- isp...](http://www.guardian.co.uk/technology/2012/apr/30/british-isps-block- pirate-bay)

</comment></comment><comment><USER15> I wonder if this is just because they would like as much control over their population as possible and they want their _own_ Internet, as they would like their own "Twitter", and own "Facebook" and so on, out of a strong sense of nationalism, or because they are worried that US wants more and more control of the Internet, and could be why they are also support getting the Internet under UN's control (among other things).

<comment><USER16> IMO it's to keep the country together. Super-large nations tend to promote separatist movements along its fringes. In the case of Russia and China they're held together with a strict regime. Other countries provide levels of autonomy on a more granular level. As a rule: monolithic = dictatorial. The moment they get true democracy in China will be the start of armed conflicts and calls for independence along the border regions. Again, just my opinion.

<comment><USER8> Except that in any "democratic vote" such a 'call for independence' would be voted down, as the number of Han chinese outnumber the ethnic minorities in those regions.

They've thought of that problem already.

True democracy... (Is that like a true scotsman? ... Who has a true democracy?)

</comment></comment></comment><comment><USER17> Setting aside the motivations for this draft, the idea of removing the one single DNS 'root' is a reasonable one. It acts as a single point of failure for the DNS system and puts the entire DNS hierarchy under the jurisdiction of the United States Department of Commerce. There are already existing alternative roots[1], but no interoperability between them and no standards governing them. Indeed, the IETF is strongly against them at present [2].

With that in mind, let us examine the flaws in the proposal at hand.

* 1. Lettered roots

This proposal puts the existing DNS root under a lettered virtual root above it, with implicit resolution to the local AIP. The existing DNS root locations are ALREADY indexed by letter, so this is a recipe for confusion. Even more importantly, this system _will not scale_: There are 26 possible letters, if drawing from the ASCII set only, which permanently restricts the number of autonomous zones. What happens then?

This could be resolved by using a unique suffix scheme that does not conflict with the existing or requested TLDs, but would make it that much harder to type an external DNS address. yahoo.com.extdomA for general use would be quite unfortunate.

* 2. Who hands out the AIP designations?

If every AIP must have a single unique designation, there must be an organization handing them out. The ICANN would be the obvious choice, but that brings us back around full circle.

* 3. Ownership conflicts

As rfc2826 points out [2], the internet is built on the assumption that domain names are unique. With multiple implicit zones, either the same entity must be able to control their domain within each or we will end up with conflicts. If yahoo.com resolves to the 'Yahoo' corporate entity in most AIDs, but is controlled by Baidu in one, can they claim it? If not, what about the user confusion that would entail?

Regardless of the answer to this question, I expect in an AID world everyone would start using external domains for the stronger guarantees they provide. So Yahoo would be permanently yahoo.com.A. Which is complicated by...

* 4. Blocking.

If AIPs start blocking resolution of specific external domains, what happens? Obviously China would like this, but for the internet at large, having siloed intranets would likely be a huge problem. Every time someone misconfigures BGP and one region of the internet cannot talk to another, things break. A shifting set of resolvable domains would likely cause exactly the same headaches, only they wouldn't go away with the next BGP update.

* 5. Proxying and scale.

The AIP DNS are required to proxy requests to external domains (3.2 from the draft). Presumably this is to facilitate blocking, but it would also impose significant load issues and key bottlenecks. Note that right now the only equivalent is the root DNS, and it only handles resolution for the TLDs. Something far larger would need to be set up to be able to handle the load of proxying all external requests.

Overall, this proposal has far too many foundational issues to be seriously considered. I am personally happy it was drafted - work to break the One True Root should be done in the open with all relevant parties involved. But this draft isn't going to cut it.

[1] <http://en.wikipedia.org/wiki/Alternative_DNS_root> [2] <http://tools.ietf.org/html/rfc2826> (IAB Technical Comment on the Unique DNS Root)

<comment><USER18> _If every AIP must have a single unique designation, there must be an organization handing them out._

I've got an idea; let's use two-letter ISO country codes...

<comment><USER19> Countries sometimes disagree about what is or isn't a country, and also on what lands/people are in what country.

<comment><USER20> Of course, it's something we already know what we disagree about. Whereas using another set of names is an additional thing to disagree about on top of the existing things we already disagree about.

</comment></comment></comment></comment><comment><USER21> From the draft:

> ...network A, B and ... are AIP networks; Domain node "www.yahoo.com" in > network B is expressed as "www.yahoo.com.B" for its external domain name.

It mean that www.yahoo.com can co-exist in AIPs A and B. The "external domain names" will be www.yahoo.com.A abd www.yahoo.com.B. Would HTML documents be linked using local names or external names? Local only names are not going to work across APIs unless www.yahoo.com maintains same document hierarchy in all of them!

<comment><USER2> I don't think China would care at all. If all the links to www.yahoo.com suddenly becomes invalid by default, now the Great Firewall can do whitelisting instead of blacklisting!

On the other hand, they already have access to a ".B" suffix, and it's called ".cn". For exampe, www.yahoo.com.cn.

<comment><USER8> I suspect the Great Firewall already does whitelisting rather than blacklisting.

When an external (out of china) domain is visited from within china (for the first time), it is blocked. It is then later unblocked.

I've experimented with this a few times, and it always happens like that.

</comment></comment></comment><comment><USER22> I wonder if they thought about what would happen if Canada, the United States, and the rest of the world adopted this RFC?

For example, lets say an entrepreneur develops a new product and wants to have it manufactured by an outsourced company. Searches for it on Google, but thanks to this RFC the results from China either don't show up, or don't load at all. The entrepreneur therefore opts for a manufacturing company in Des Moines, Iowa.

I guess perhaps the same could happen if only China adopts this RFC, i.e. business people in China who don't know better launch their website on a Chinese only DNS system and wonder why nobody from the rest of the world calls them.

</comment><comment><USER23> The proposed draft breaks the whole concept of URI's, as they become not unique. Not speaking about the web, even on the identifier side it is quite important that something.org is a single concept, regardless from where it is accessed. Requiring all URI's to have explicit lettered roots (such as something.org.A or something.org.cn) would be a possibility; but implicitly translating from something.org to something.org.B would break things in a million places if sometimes or someplaces it is translated differently.

</comment><comment><USER24> Perhaps we are all wrong, the authors just want the world to know what the Chinese gov is doing with DNS poisoning and what will be ended up with if we cannot stop it.

<comment><USER4> Wait ...I think I've almost gotten it decoded now ... wait ... it's a cookbook!!

</comment></comment><comment><USER25> I can barely read it... the spelling and grammar are terrible.

This can NOT be a real effort... can it?

<comment><USER26> Access to people that write good english can be very hard to get in China, so that is probably not a good indicator of anything in this case.

<comment><USER27> Unless the Great Firewall also blocks websites offering proofreading services, I'm not sure if that's a valid excuse.

<comment><USER28> On the flip side, I often see equally poor translations of English documents to Chinese. I'm not sure if we have a similar firewall preventing access to proofreading services.

</comment></comment></comment></comment><comment><USER29> You know, putting the merits of the Draft RFC aside, at least this was submitted as an RFC and they didn't just go ahead and unilaterally do this. This way, the RFC can be properly ignored. Or, on the other hand, when China completely disappears from the Internet and starts using its own DNS root system, we'll at least know what they are doing.

<comment><USER30> Keep in mind this was proposed by someone at a business school and two people who work at phone companies, not by government officials.

<comment><USER27> 'though they are all government employees, indirectly.

<comment><USER8> No, they aren't. Working for a government owned company is not working for the government. They can have no affiliation with the CCP (which isn't possible if you work for a government department).

<comment><USER31> What distinction do you make between the Chinese government and the CCP? Aren't they pretty much the same thing?

<comment><USER8> They are the same thing. Government owned companies are not "part of the government" like government departments are. The CEO's and directors are probably all members of the party, but labelling every employee as a party member running the party agenda is false.

There are even 'members' (large numbers) of the party who do not agree/encourage the party agenda.

</comment></comment></comment></comment></comment></comment><comment><USER32> Why not just take an ax to the Internet cables crossing China's borders, and implement this internally?

I suppose bitcoin mining might suffer.

</comment><comment><USER33> It doesn't make sense to do this just to block sites. They are already doing it.

Can it be a fallout from the SOPA fiasco? Assuming best intentions :)- It seems like running your own autonomous root DNS enables them to stay up even if the domain name is taken down by domain hosts.

</comment><comment><AUTHOR> From the draft,

«The main rules of the Autonomous Internet DNS are defined as following:

* Rule 1: Each AIP network itself has a complete set of Domain Name System, which support traditional domain name resolution within the AIP.

* Rule 2: Each AIP network has its own numbered name that is different from the others. The numbered name is taken as the default domain name suffix when the internal domain name of this AIP network is cited by external AIP network. And any IP node's external domain name is consist of its internal domain name and its AIP network default domain name suffix.

* Rule 3: When communicate between AIP networks, the access to IP node of external AIP network must use the IP node's external domain name.»

</comment><comment><USER34> No! No national internets! I've already paying an extra $10/month just to read blog posts (mainly IT-related) those are blocked by that e __l gov (Great Firewall).

</comment><comment><USER35> Still a draft not a RFC. Miles to go before it can become a RFC.

</comment><comment><USER36> > _Chinese RFC proposes separate, independent, national internets and DNS > roots_

See how it's ALWAYS about politics and never about technology?

I say that for hackers that believe that political action doesn't matter, and that technology will just liberate us every time, because we can always "find workarounds for closed systems, surveillance technologies, DRM" etc...

Will it do much good for you to be able to use some obscure technical workaround, when 99% of your country's population cannot or fears to get to the outside "internet", including all your friends and relatives?

Not to mention, that would only work for your private computer use. I mean, let's say (a contrived example) your country forbids standard SMTP. OK, you can still use it over SSL, over a proxy, etc. But would you be able to use the same workarounds also in your business? Would you be able to give your employees the same ability? What if one of them rats you out to the police?

<comment><USER37> Cory Doctorow has an excellent examination of this issue (which he coins "nerd determinism") and another similar issue ("nerd fatalism") in his _Guardian_ piece "The problem with nerd politics": [http://www.guardian.co.uk/technology/2012/may/14/problem- ner...](http://www.guardian.co.uk/technology/2012/may/14/problem-nerd- politics)

For those on the go, here's a direct link to the podcast of said column: [http://archive.org/download/Cory_Doctorow_Podcast_229/Cory_D...](http://archive.org/download/Cory_Doctorow_Podcast_229/Cory_Doctorow_Podcast_229_The_problem_with_nerd_politics.mp3)

</comment></comment><comment><USER38> The world is divided into two parts: China and Out of China.

In WWDC'12, Apple introduced many features for chinese in the same reason.

<comment><USER39> Is that distinction into two parts, how you are seeing the world, or are you quoting the Chinese government? If it's your view, can you please elaborate, why you see this as the way to spli up the world, rather than let's say "the world is split up into EMEA, Americas and Asia, to give another arbitrary split.

As to the features Apple announced: There are multiple parts that play into this: First the completely different character set, which requires it's own input system and secondly that the Chinese government try's to cut foreign Internet services off and encourages local solutions it can control/manipulate. Those two issues require to address this market separately. Similar things, however might be true for other markets as well (maybe for different root causes) like let's say in Japan or North Korea. However, these markets aren't big enough to warrant effort on this scale. So I see this as a bad indicator to substantiate separating the world this way. If there was higher monetary value for Apple in this, weight see theworldseparated into Butan andtherest, with the same argument.

</comment></comment><comment><USER40> the Chinese can take their proposal and stick it where the sun doesn't shine as far as I'm concerned. buy this is hardly surprising, since just as crazy ideas came from less abject governments (acta, usa) of which I had higher expectations. :(</comment>


Flux in practice – a guide to building UIs with React - <AUTHOR> https://medium.com/@garychambers108/ec08daa9041a

<comment><USER2> I already commented on a different thread about the Flux architecture, but I'll state it again here: Flux seems like a slightly more constrained, perhaps less effective way of doing the same kinds of things that state machines do.

Is there something about Flux for typical use cases that makes it a better solution?</comment>


Show HN: Divvy - fast and intuitive unsupervised machine learning. - <AUTHOR> http://divvy.ucsd.edu/

<comment><AUTHOR> Hi all, I'm the main developer behind this and I'll be lurking around for a couple hours in case folks have any questions.

</comment><comment><USER2> Interesting! Unfortunately, your application seems limited to the mac, so I won't be able to use it.

Also, I couldn't watch your video entirely, it got stuck on the middle. I'm not sure if the problem is on my browser's part of if the video is corrupt, but maybe you could mirror it to youtube for people like me?

<comment><AUTHOR> Good idea--I'm uploading the video to Vimeo now and I'll link to it or use it for the embedded video.

</comment></comment><comment><USER3> This could be especially useful for any project where you don't really know much about your data set and you're just getting the lay of the land. Makes me want to throw some data from <http://www.kaggle.com/> in there.

<comment><AUTHOR> Yes, the goal is for Divvy to be a step in your workflow where you get a feel for your data. We make it really easy to export the clusterings, embeddings and visualizations you come up with to csv and png for additional analysis with other tools.

</comment></comment><comment><USER4> hmm, I use a window management app called Divvy. Would you mind renaming this to ember.js?

</comment><comment><USER5> For me, to get it to run, I had to create a "configuration" in Models called "DivvyIsomap".

But I got it running and it looks cool. Thanks!

<comment><AUTHOR> Looks like there was an Xcode 3/4 confusion that crept in. I imagine you were compiling in Xcode 3--I've fixed the issue now and pushed the change to the repository, though you may need to do a clean after pulling. If you're still having issues you can try removing the files in Divvy's application support directory. Thanks again for bringing this to my attention.

</comment></comment><comment><USER6> I like hearing the fan kick in on your laptop after you start a couple of parallel reductions :)

<comment><AUTHOR> Yeah, you really feel like you're there, haha.

</comment></comment><comment><USER7> Name conflict: <http://mizage.com/#divvy>

<comment><AUTHOR> Yes, I've seen this app. Hopefully machine learning and window management are different enough that the app's author doesn't mind. Any alternate name suggestions are appreciated :)</comment></comment>


Ghana: Digital Dumping Ground (2009) - <AUTHOR> http://www.pbs.org/frontlineworld/stories/ghana804/video/video_index.html

<comment><AUTHOR> >"Within minutes, he is scrolling through intimate details of people's lives, files left behind by the hard drives' original owners."

>"There is private financial data, too: credit card numbers, account information, records of online transactions the original owners may not have realized were even there."

I believe people should always encrypt their hard drives.

Also worth checking out: [http://www.dban.org/](http://www.dban.org/).</comment>


Meetups by place - <AUTHOR>

Hi everyone,
This is my first post on Ycombinator (I'm a serious noob). I was wondering, has there been any success on place based meet ups of Ycombinator advocates? Anyone in Vancouver?
TLChan <comment><USER2> There used to be Hacker News meetup in Vancouver, but it died a year or two ago. That said, other types of meetups here have been quite successful. I started VanJS in 2009 and we get 50-80 attendees nowadays. Feel free to organize a new one.

<comment><AUTHOR> You got it. See you there.

TLChan</comment></comment>


Hey, eBay Actually Did Ok With Skype  - <AUTHOR> http://www.techcrunch.com/2009/09/01/hey-ebay-actually-did-ok-with-skype/ <comment><USER2> The thing with Skype is the lost potential.

Skype has been happily sitting on all those PCs for so long at the centre of the so-called virtual office. I recently updated my skype & noticed the screen sharing, which for me makes it far more useful then go-to-meeting. The should have eaten that lunch years ago.

The skype phones should have been a game changer. Something to makes phone companies sweat.

</comment><comment><USER3> where "ok" is having ~half your money returned after four years.

<comment><USER4> You didn't do the math.

The announced deal was $4.1 billion. They actually paid a billion less than that because a billion dollars of performance payout wasn't paid. They realized $324 million in revenue. The value of what's left is $2.8 billion in 2005 dollars. They just sold it for $2.75 billion. That's a wash.

The return on the deal gets even better when you note that they paid for a lot of it with stock whose value has declined.

The headlines make them look like idiots. But those numbers show a wash, which is pretty good given the market declines. If the numbers in the article are correct, then my impression of how well they did was wrong.

EDIT: I initially misread how much they sold for. I thought they sold FOR $2.75 billion, and not AT a valuation of $2.75 billion. I've edited this accordingly.</comment></comment>


Ask HN: hosted time tracking tools for distributed teams? - <AUTHOR>

I have a distributed team of a couple of software developers who work on hourly basis. I am looking for recommendations of online tools that let them submit the hours they work in a way that is minimally intrusive and that help me keep track of the hours. I'll be using this for billing purposes too. I'm currently using assembla.com for bugs/svn,  they have some time-tracking feature but it's not very easy to get reports on hours worked. I want to keep using assembla for svn/bugs and I am looking for an additional tool. <comment><USER2> We're using Harvest. I don't handle the administrative end, but from a usability standpoint it's pretty awesome:

<http://www.getharvest.com>

</comment><comment><USER3> We use TickSpot.com with a team of 50. Nice UI, good basecamp integration is a plus for us, and has an API for custom stuff.</comment>


10 Beautiful Sketches for Website Prototypes - <AUTHOR> http://woorkup.com/2009/12/28/10-beautiful-sketches-for-website-prototypes/

<comment><USER2> So, they're pretty. But from my trained eye, not earthshatteringly interesting, inventive, useful or usable.

The point of prototype sketches is not to be beautiful.

Thus, the article is pointless.</comment>


OpenSSH vulnerability - <AUTHOR> http://seclists.org/oss-sec/2015/q3/173 <comment><USER2> [https://news.ycombinator.com/item?id=9924632](https://news.ycombinator.com/item?id=9924632)

</comment><comment><USER3> I guess I must be missing something -- why would you ever want the client to specify auth mechanisms to the server at all?</comment>


Sourcegraph Server 2.6: Symbol search for 75+ languages - <AUTHOR> https://about.sourcegraph.com/blog/introducing-sourcegraph-server-2-6/ <comment><USER2> Sourcegraph CEO here. Happy to answer any questions.

Sourcegraph is code search and intelligence across all your code, integrated with your code host (even giving you IDE-like hovers, definitions, references, etc., when viewing code files and diffs on GitHub/etc.).

In addition to the things mentioned in the announcement, we've been making steady improvements to code intelligence. Check out [https://about.sourcegraph.com/docs/code- intelligence](https://about.sourcegraph.com/docs/code-intelligence).

One of the things we see is that basically 100% of devs at Google and Facebook use those companies' internal Sourcegraph-like tools for code search/intelligence, and it makes them a lot happier and more productive as devs. We think 100% of devs at every company should have amazing code search and intelligence.

<comment><USER3> Do you have support for Code Intelligence with Flow (for JavaScript) or Ruby on your roadmap?

<comment><USER2> Flow-typed JavaScript works well with our existing JavaScript support. Post an issue if you have any issues when trying it out: [https://github.com/sourcegraph/issues/issues](https://github.com/sourcegraph/issues/issues).

For Ruby, we haven't investigated the situation in a few months. Last time, we checked out [https://github.com/mtsmfm/language_server- ruby](https://github.com/mtsmfm/language_server-ruby) but it was not far enough along. We maintain a table of language servers at [http://langserver.org/](http://langserver.org/), and once they have support for hovers, definitions, and references, we begin to plan to integrate them. We'll be releasing a roadmap for Sourcegraph language support soon with a lot more docs for how to integrate existing language servers, too.

</comment></comment></comment><comment><USER4> "75+ languages" \-- Does this mean that non typed languages are now supported? Ruby, python, and etc?

<comment><USER5> We have full language support for Python, see [https://sourcegraph.com/github.com/ansible/ansible/-/blob/co...](https://sourcegraph.com/github.com/ansible/ansible/-/blob/contrib/inventory/apache- libcloud.py#L70:18).

We also have symbol support for Ruby and many other languages, see [https://sourcegraph.com/github.com/Homebrew/brew](https://sourcegraph.com/github.com/Homebrew/brew) and symbol search screen recording [https://cl.ly/0p2a131B3r04](https://cl.ly/0p2a131B3r04).

\-- Linda, PM @ Sourcegraph

<comment><USER6> Is there a list of what exactly are these 75 languages ?

<comment><USER5> Yep. Sourcegraph uses Universal Ctags in our symbol search, you can see the full list of supported languages here [https://github.com/universal- ctags](https://github.com/universal-ctags).

</comment></comment></comment></comment><comment><USER7> Eager to take the new server for a test spin. Great work guys. :)</comment>


The Little Typer - <AUTHOR> https://mitpress.mit.edu/books/little-typer <comment><USER2> The book is fantastic. If you think this model is interesting, please consider trying Idris and reading the Idris book:

[https://www.manning.com/books/type-driven-development- with-i...](https://www.manning.com/books/type-driven-development-with-idris)

<comment><USER3> I learned a bit of Idris on the book you link, but I gave up after trying to implement Quicksort (the classical Haskell one-liner) in Idris vectors. You need to manually write a page of theorems for Idris to accept it. It's crazy.

<comment><USER2> So don't write quicksort in Idris. It's not going to work very well anyways. It's not at all well-suited, and isn't really even an especially important sorting algorithm in a world where linear time sorting and constant time indexed searches are a thing.

But most of the work you'd be doing to write quicksort is writing the machinery for structurally recursive sorting, which a lot of tutorials write not because you have to, but because it's a very good exercise for learning how to write total functions that are recursive in a way DT systems can prove totality on.

Most of these tools are in the contrib library (and the book mentions this). For example the preorder interface you need:

[https://github.com/idris-lang/Idris- dev/blob/master/libs/con...](https://github.com/idris-lang/Idris- dev/blob/master/libs/contrib/Decidable/Order.idr)

</comment></comment></comment><comment><USER4> This book is a real joy to read. I got to peek at a draft at OPLSS 2017 and have been waiting impatiently for it to come out. The detailed, carefully worked examples one after another that this style of book is famous for is adapted beautifully to dependent type theory. Check it out! The code implementing the language in the book is here: [https://github.com/the-little- typer/pie](https://github.com/the-little-typer/pie)

<comment><USER5> Does the book discuss the implementation of the language or just usage of the language?

<comment><USER6> I believe it's more just how to use a dependently typed language (my copy is still in the mail). Like the Little Schemer, it's written in the Socratic style. I think the idea is that you can do it all in your head if you want, with a piece of paper covering up the column with the answers.

If you are interested in the implementation, you can read more about it from one of the authors: [http://davidchristiansen.dk/tutorials/nbe/](http://davidchristiansen.dk/tutorials/nbe/)

</comment></comment></comment><comment><USER7> I'm going to order it right now. I highly recommend the little schemer and the seasoned schemer too! I have read all the titles (MLer and Java too) in the series and those are my favorites. The only one I have not finished is the reasoned schemer although I hope to try again in the future.

<comment><USER8> I am just now (as of reading your comment) becoming aware of the "Little" series. Is there a particular order in which one should read the books?

<comment><USER7> Little Schemer first and Seasoned Schemer second. The other ones are about different independent topics and can be read in any order once you have read the first two ones.

</comment></comment></comment><comment><USER9> Several comments elaborate on the big gap between normal programming practice (e.g. structurally recursive algorithms) and the great difficulty of dependent typing those practices. Some of these comment on how dependent types are "just out of the lab".

This brings into focus a question I've had for a long time: Why this gap, and especially in this direction? E.g. in aerodynamics we had Bernoulli's principle for a couple of hundred years before we could build airplanes, which depend on it. In formal language theory we had lambda calculus, Turing's universality results, etc. decades before we had Lisp and Fortran.

We often see the difficulty of building a practice to exploit theory.

So it seems very strange to me that we are able to write / plug together literally world-spanning software systems -- which do have bugs but fact work correctly nearly all the time. But we can't easily well-type even simple algorithms with extremely well understood properties.

Why this huge gap, in this direction?

<comment><USER2> I'd argue that there aren't many "simple" programs with "well-understood" properties in use in industry.

Software is a bit different from architecture in that partial failures tend to work and can be refined around repeatedly (a partially failed building tends to rip itself apart, partial failures in software can linger for years and only cease when their dependencies fault out). People are just more amenable to altering their processes, products and lives around bad software.

I think dependent typing reveals to us, to some extent, what a house of cards we truly have built for ourselves.

<comment><USER9> Several interesting points but maybe they show something different from what you intend.

Network stacks, databases etc. that correctly handle trillions of interactions, some of them adversarial, have indeed been "refined around [their failures] repeatedly" and have gotten pretty robust along the way.

On the other hand useful formal accounts of their behavior (distributed, highly parallel, loosely coupled, asynchronous) seem far, far way.

It would be helpful to have an account of approximation to formal properties, especially if that can help us understand how repair and refactoring can lead to progressively better approximations.

Perhaps the house of cards that is revealed is formal methods not software.

<comment><USER2> > Network stacks, databases etc. that correctly handle trillions of > interactions,

But they have also _incorrectly_ handled a similar order of magnitude of transactions! Routing failures and issues that people troubleshoot around, misconfigurations and bugs, and simple electromechanical glitches exist in the real world and they're not some kind of zebra, you can force them by pining a server.

Our networking systems "mostly work" because they're persistent, and because (interestingly) the difference between a perfectly coordinated networking system and a purely chaotic networking system with random traffic is actually rather small compared to other domains.

> On the other hand useful formal accounts of their behavior (distributed, > highly parallel, loosely coupled, asynchronous) seem far, far way.

Generally what makes a difference between a "robust" program and a brittle program that simply falls over is how much of its own failure it attempts to take into account. Even bad models of self-failure (pre-OTP erlang, for example) are better than no model at all.

> Perhaps the house of cards that is revealed is formal methods not software.

Given that almost no one applies formal methods and dependent typing is by no means a part of that discipline, I'm not sure it's fair to draw those comparisons in this conversation.

Dependent Typing is not formal methods, nor is it verifcation. It's code that allows for automated reasoning. It's closer to the machinery of formal methods, like datalog or an SMT solver.

<comment><USER9> Again lots of interesting points. Only time for one response.

You highlight networking but I also mentioned databases. Schematizing your comment "Our... systems "mostly work" because... the difference between a perfectly coordinated... system and a purely chaotic... system... is actually rather small".

I think banks and customers would disagree rather violently regarding the (distributed, asynchronous) system that handles credit card transactions.

And yet this system is certainly subject to a lot of attacks, not just random errors.

<comment><USER2> > I think banks and customers would disagree rather violently regarding the > (distributed, asynchronous) system that handles credit card transactions.

Do they? Most customers accept without question the idea that they have an "available" balance distinct from their "current" balance.

It's also the case that when attacked the system typically fails and then the fungibility of currency combined with the massive power of insurance is used to pave over it.

</comment></comment></comment></comment></comment></comment><comment><USER10> I can't tell if my question is off-topic or not, but..

Can anyone recommend a book (or whatever) that introduces the aspects of type theory relevant to a would-be language designer?

<comment><USER3> I recommend these introductory lectures to Category Theory. I'm going through them right now.

I assume you know some math/set theory and some Haskell, otherwise you may want to work though some of the chapters in Real World Haskell first.

Oh and put the videos at 1.25× or 1.5× otherwise you will fall asleep.

[https://www.youtube.com/user/DrBartosz](https://www.youtube.com/user/DrBartosz)

<comment><USER6> Don't get me wrong - CT is a super handy thing to learn, and it pops up a ton when thinking about any software, including type checkers and compilers, but the OP was specifically asking about type theory and programming language implementation. Yes, you _can_ express lots of category theory in terms of type theory (the dream is to implement all of it in terms of TT so that we can mechanise it), but it won't be the best use of your time if you want to build a type system.

<comment><USER3> I probably phrased my suggestion wrong. Yes, it's not central to OP's enquiry. But I did find a basic understanding of CT to help a lot when reasoning about types, and that lecture series gives just that in a relatively simple way.

<comment><USER6> Fair enough! Yeah, I've heard good things about that series.

</comment></comment></comment></comment></comment><comment><USER11> Source code of pie (used in the book) at [https://github.com/the-little- typer/pie](https://github.com/the-little-typer/pie)

</comment><comment><USER12> Is there a reason dependent types are not more common?

<comment><USER13> They can make libraries a pain. Like imagine if someone write a library in C#2025 with dependent types where functions took parameters like [i: i%2 == 0] or whatever. And your big project has no existing dependent types. There's no way to adopt this library unless you pull dependent types all the way in.

Or even if you did, but _your_ types were [i: i%4 == 0] or [i: (i+1)%2 == 1] or whatever, you'd have to write proofs that they types were compatible. Even some simple things are just not worth it.

<comment><USER14> If the project had no existing dependent types at all, couldn't you just perform a runtime check before calling the library? The check would return evidence that [i: i%2 == 0] for the particular i, or fail at runtime. If it succeeded, then you could invoke the library using the new evidence.

One appealing aspect of dependent types is that they let you decouple validation of inputs from the function calls themselves, while still disallowing passing wrong inputs to the function by mistake.

<comment><USER6> Yup, lots of people are under the impression that you need to prove everything when it comes to DTs. That's not true - you can indeed push these checks to runtime, and just have the compiler make ensure you do it.

</comment></comment></comment></comment><comment><USER15> As an aside, it's great that Duane Bibby is still providing the art for these. Without him, nothing would be the same.

<comment><USER16> Here's a 2006 TeX-user-group interview with Bibby: [http://tug.org/interviews/bibby.html](http://tug.org/interviews/bibby.html)

</comment></comment><comment><USER17> Will there be a Kindle edition eventually?

<comment><USER18> There doesn't appear to be kindle versions of older books including _The Little Schemer_ , _The Seasoned Schemer_ , etc. so most likely not.

<comment><USER19> there is one for _the little mler_.

</comment></comment></comment><comment><USER20> > An introduction to dependent types, demonstrating the most beautiful > aspects, one step at a time.

Is there a companion book detailing the ugly downsides of dependent types and how to avoid them, one step at a time?

<comment><USER21> I feel like people are misreading this comment, which is asking how to avoid the pitfalls of dependent types, not how to avoid dependent types.

<comment><USER20> This. Thank you. I'm being rate limited, so this is the only post I'll be making on this thread. My question was genuine. I want to learn both the positives and the pitfalls of dependent types. I mimicked the book's description because it amused me from a linguistic perspective. Looking back, I probably should have phrased it differently.

</comment></comment></comment><comment><USER22> I'm glad I checked HN today because this sounds like a fantastic read. I went ahead and picked up a copy of it for myself!

</comment><comment><USER23> What language does this book use? A dependently typed LISP? Or something Haskelly?

<comment><USER4> it's a pretty standard type theory lambda calculus, written as sexps because it's inside racket, but it's its own thing.

</comment></comment><comment><USER11> Is there a place where you can download the source code that is used in the book?

<comment><USER24> [https://github.com/the-little-typer/pie](https://github.com/the-little- typer/pie)

</comment></comment><comment><USER9> See related HN thread <[https://news.ycombinator.com/item?id=18050706>](https://news.ycombinator.com/item?id=18050706>)

</comment><comment><USER25>
        This space reserved for JELLY STAINS!

</comment><comment><USER26> I know that typescript doesn't have advanced types, but can a book like this be adapted to use typescript ?

<comment><USER27> This book does not talk about static typing, but about dependent types. Dependent types are more powerful and expressive than simple types because they convey more information. For example you could have [Int] to represent a list of numbers, but you could also have [x: Int, x > 20 && x < 50]. Or you could have an ordered array and know this fact by the type associated to the array. Moreover, you need to use a theorem prover to show that applying a function to a particular dependent type will result in the output dependent type. This kind of programming is not well suited to be implemented into typescript.

<comment><USER28> So dependent types aren't static?

How does Idris solve this problem when compiling to JavaScript?

<comment><USER29> Dependent types are static. GP was trying to say that this book is about more than just normal static typing (of the kind that TypeScript adds to JavaScript).

There is no problem compiling dependent (or static) types to JaveScript, as the type checks are done at compile time, and don't require any support from the JavaScript runtime.

</comment></comment></comment></comment><comment><USER30> Sad to say the book isn't on Library Genesis, so you'll have to drop $40 if you want the knowledge. [http://libgen.io/search.php?req=little+typer](http://libgen.io/search.php?req=little+typer)

Also Library Genesis is amazing: [http://libgen.io/search.php?req=knuth](http://libgen.io/search.php?req=knuth)

It's everything I dreamed of when I was a kid. I used to spend hours at the local library scouring through crummy "Learn C++ in 24 hours" type books.

[http://custodians.online/](http://custodians.online/) is worth a read too.

<comment><USER31> I feel like there's so much to say about this comment, that I don't even know where to start.

So firstly I agree, $40 seems like a lot. I personally couldn't justify it at the moment. Particularly when the reproduction cost is nearly zero.

But $40 also doesn't seem like a lot to pay for a book that will probably not sell more than a few thousand copies. Most likely revenue generated won't fully cover the time and effort required to create such a book.

But... the author is also a professor at MIT. I feel like if this work wasn't somewhat publicly funded, it really should have been.

In the end, I'm left morally confused. But it feels like something is wrong in the world when a book like this is available only to a select few, when for the same capital outlay it could be available to everybody.

<comment><USER32> > In the end, I'm left morally confused. But it feels like something is wrong > in the world when a book like this is available only to a select few, when > for the same capital outlay it could be available to everybody.

Only to a select few? For $40? The book costs less than most console video games.

<comment><USER30> Another way of phrasing that: The book costs as much as work that took dozens of people years to make.

Also if you were to somehow poll everyone reading this and ask "Did you buy this book?" you'd get some number, x. But if the book were priced at $5, then $5 _y would be much greater than $40_ x.

I bought a bamboo fineline pencil for $50 the other day. It's a tool that will serve me for at least a year. It's unclear whether this book would.

I want work like this to exist, and for the author to be rewarded for it. But ultimately, in an era when words are infinitely and instantaneously copyable, the economic value of words seems to drop.

Given the choice between stealing knowledge and not stealing knowledge, when you wouldn't have paid for it anyway, where's the harm?

<comment><USER33> The harm is less people writing books like this in the future. Every dollar this book gets in revenue not only goes partly to the author, but goes into the record as profits for that "genre" of books. Every dollar of revenue for this book increases the value of the advance the author receives for the next book, increases the probability that another author writing the same kind of material will get accepted for publication. The harm you create by stealing this book is that the market for that knowledge is destroyed.

<comment><USER30> Technology destroyed the market, not users of it.

I think you could've made the same sort of argument against movies or music before netflix and napster, but here we are, and the markets still seem thirsty for new content.

<comment><USER32> > I think you could've made the same sort of argument against movies or music > before netflix and napster, but here we are, and the markets still seem > thirsty for new content.

Because reasonable adults are paying for content which they want, directly via movie tickets, indirectly via e.g. Netflix and Spotify.

<comment><USER31> Libraries, the same arguments apply to libraries. Which by your logic are not morally justified.</comment></comment></comment></comment></comment></comment></comment></comment>


Bootstrap Live Editor - <AUTHOR> http://wrapbootstrap.com/preview/WB0DFT966

<comment><USER2> The OP has linked to the demo running on Wrapbootstrap (a bootstrap marketplace). The overview page for the editor on Wrapbootstrap is here: [https://wrapbootstrap.com/theme/bootstrap-live-editor- WB0DFT...](https://wrapbootstrap.com/theme/bootstrap-live-editor-WB0DFT966)

</comment><comment><USER3> Its good to see a good set of custom widgets coming out for bootstrap. Bootstrap become a really good framework to bootstrap a web app. <http://jhollingworth.github.com/bootstrap-wysihtml5/> is another rich text editor I came across. Its based on wysihtml5.

</comment><comment><USER4> Excellent, I'm sure that will be very useful at some point.

wrapbootstrap (the marketplace this is on) is awesome in general. I've purchased loads of bits from them over the last few months. I just wish they had a better way to search and filter the themes, it was fine when there were just a few but it's getting unmanageable now!

<comment><AUTHOR> Thanks! :) I'm glad you like the site.

Search and categorization are implemented in a reboot of the site design that will be released in the next few weeks (along with other neat changes and additions). It should make it a lot easier to narrow down what you're looking for.

</comment></comment><comment><USER5> I'd be very interested to see some sort of visual grid editor for bootstrap or a similar framework.

<comment><USER6> I'm not quite sure what you mean, but my tool Jetstrap (<http://jetstrap.com/>) has grid support. You can drag in a grid row and then drag in grid columns. The UX on the grids isn't quite where I want it yet though.

<comment><USER5> Thanks! That was what I meant. I'm building a CMS and I'd like to include a layout manager.. I'll certainly be checking out Jetstrap for inspiration.

<comment><USER7> a WYSIWYG editor may not suitable for layout manager. The idea is separating content from the template (layout/grid). However Bootstrap Live Editor also provides a basic grid insertion function as in the demo, which can be used to insert multi column text, etc.

</comment></comment></comment></comment><comment><USER8> The UI components visually do not adhere to the general Twitter Bootstrap appearance.

And it uses tables (!) for laying out the toolbar buttons.

</comment><comment><USER9> _Use it in as many as website projects._

Might want to clarify that language a bit.

<comment><USER7> Yes, it can be used in as many as clients' commercial projects or websites/domains (unlimited). However, re-packaged in a template product for distribution is not covered (separate license is required).

</comment></comment><comment><USER10> Hey James, sorry to post here but I used the wrapbootstrap.com contact form 2 or 3 days ago and haven't received a reply in regards to not being able to download the theme I purchased.

<comment><AUTHOR> Hi Danny, I just shot you an email with your item. Let me know if I can help with anything else.

</comment></comment><comment><USER11> Amazing to see the ecosystem rising around bootstrap.

</comment><comment><USER12> I never understood these live editors. Why throw all the great features of your local text editor out the window?

<comment><USER13> Because now you can get your "startup" up and off the ground within 12 hours instead of 24!

In all seriousness though, why is this kind of thing necessary? Who exactly wins here? Certainly not developers since you'll probably never learn how to write basic HTML/CSS with this Dreamweaver approach.</comment></comment>


PagerDuty makes their security training public - <AUTHOR> https://sudo.pagerduty.com/ <comment><USER2> In a few years, employers are going to start screening for and rejecting / hiring employees based on how secure they think they are in their personal lives.

A user who is compromised in their personal/computer life is 99% going to be a user who is later compromised in their work/computer life.

From a legal scholarship point of view, this is going to initiate some very interesting federal court cases. Like for instance, can an employer mandate that their already hired employees use an iPhone in their personal life? Can they require that all of their employees use a password manager? What about a specific brand of password manager? The questions are endless.

<comment><USER3> Yes, an employer can mandate that employees use password managers for work- related accounts and are already doing it, from my experience. Also, for the precise reason you say, corp accounts exist. Employees in some companies already can't turn off 2FA for some accounts whether they want it or not.

Let's not reinvent solved problems. Questions are not endless.

</comment></comment><comment><USER4> The engineering list is a decent start! Multiple vulnerability categories I see day to day appear to be missing though, such as race conditions, direct object references, and file inclusions. Would be nice to add a slide stating "Don't trust user input".

If anyone is interested in security training, or looking for an application security review, feel free to get in touch with us! [https://www.oneupsecurity.com/](https://www.oneupsecurity.com/)

</comment><comment><USER5> It's public but there are quite a few "redacted" slides there :(

<comment><USER6> Even so, there is still a good overview that remains.</comment></comment>


In 10 millennials say they would vote for a socialist: poll - <AUTHOR> https://thehill.com/homenews/campaign/467684-70-percent-of-millennials-say-theyd-vote-for-a-socialist-poll <comment><USER2> Well that headline is one way to guarantee that we'll actually click on the link and read the article before commenting.</comment>


Ask HN: What is your favorite RFC? - <AUTHOR> <comment><USER2> To LinuxBender: RFC2549 also clarified the key words: MUST Usually. MUST NOT Usually not. SHOULD Only when Marketing insists. MAY Only if it doesn't cost extra.

</comment><comment><USER3> RFC2142 - I like it when organisations use standardised email addresses such as support@ and security@ for different business units.

Unfortunately many orgs either don't have these mailboxes set up, or they aren't actively monitored.

</comment><comment><USER4> RFC-6919 [1] The key words "MUST (BUT WE KNOW YOU WON'T)", "SHOULD CONSIDER", "REALLY SHOULD NOT", "OUGHT TO", "WOULD PROBABLY", "MAY WISH TO", "COULD", "POSSIBLE", and "MIGHT" in this document are to be interpreted as described in RFC 6919.

[1] - [https://tools.ietf.org/html/rfc6919](https://tools.ietf.org/html/rfc6919)

</comment><comment><AUTHOR> I'm working on writing a paper for a class on the DNS system. I really like rfc1035 [1]. It describes the goals, and terms involved. Also it goes into details on their design tradeoffs, and how they made it distributed.

[1]: [https://tools.ietf.org/html/rfc1035](https://tools.ietf.org/html/rfc1035)

</comment><comment><USER5> _A Standard for the Transmission of IP Datagrams on Avian Carriers_

[https://www.ietf.org/rfc/rfc1149.txt](https://www.ietf.org/rfc/rfc1149.txt)

"There is persistent delivery retry, until the carrier drops."

</comment><comment><USER6> RFC 2468.

[https://tools.ietf.org/html/rfc2468](https://tools.ietf.org/html/rfc2468)

</comment><comment><USER7> RFC1178. I take my PC naming seriously.

</comment><comment><USER8> RFC 4042 which details UTF 9 in good detail.</comment>


Show HN: Backseat Writer – write like Shakespeare and others - <AUTHOR> http://trevorah.github.com/backseat-writer

<comment><USER2> Looks like it produces a lot of spam blog comments ...

</comment><comment><USER3> Happy April Fools Day to you too =D

</comment><comment><AUTHOR> Opinions?

<comment><USER4> What is it supposed to do? I try to type a sentence but it is immediately garbled by random words. If there were two boxes, one for input and output, things wouldn't get mixed up, or perhaps a "Shakespearize" button. Right now the edit box is not really usable because the script interferes with normal editing.

EDIT: Another note, while the references to Shannon & Markov chain are correct, in NLP this would more commonly be referred to as a character n-gram model.

<comment><AUTHOR> It's meant to interfere with your writing, like a backseat driver interferes with your driving. Your idea of separation is interesting, do you see it as a kind of translator?

<comment><USER4> I imagine a backseat driver shouts suggestions, but does not take over the wheel; like the way autocomplete is there without preventing you from typing something else. It doesn't have to be a translator, but there should be some distinction between user input and what comes from the model, and the user should have the final say.</comment></comment></comment></comment>


Mozilla's Data Privacy Principles Revisited - <AUTHOR> https://blog.mozilla.org/privacy/2014/11/11/mozillas-data-privacy-principles-revisited/

<comment><USER2> I wonder if this means that health reports and crash logs are no longer submitted by default.

</comment><comment><USER3> Zero mention of Mozilla's dependence on advertising revenue (via Google) and the inherent conflicts with privacy.</comment>


XSS (Cross Site Scripting) Cheat Sheet - <AUTHOR> http://ha.ckers.org/xss.html <comment><USER2> This thing is oooooold, but useful ;)

<comment><AUTHOR> _"Also as a consequence of the introduction of new bugs, program maintenance requires far more system testing per statement written than any other programming. Theoretically, after each fix one must run the entire batch of test cases previously run against the system, to ensure that it has not been damaged in an obscure way. In practice, such regression testing must indeed approximate this theoretical idea, and it is very costly." -- Fred Brooks, The Mythical Man Month (p 122)_

</comment></comment><comment><USER3> Surely a checklist is missing the whole point.

Don't go through the list checking for each one, treat _everything_ as evil, and only allow through what you _know_ is good.

<comment><USER4> That's a much better general principle, but oftentimes you have to use third- party software which you're not sure is safe. A checklist gives you a bunch of tests that you can quickly run to see if the developers were paying attention to XSS issues or not. You can decide whether or not to use the library based on the results.

Spez said recently that over half of Reddit's XSS issues were caused by Markdown. It's not unusual for websites to require 3rd-party forums or comment engines or skinning systems, too.

<comment><USER3> Good point. Relying on other peoples code is horrible. Has to be done _sometimes_ though ;)

</comment></comment></comment><comment><USER5> Guess this is in light of Google's App Engine page getting hacked?

<comment><USER6> despite <http://code.google.com/p/google-caja/></comment></comment>


Google App Engine Java security sandbox bypasses - <AUTHOR> http://seclists.org/fulldisclosure/2014/Dec/26 <comment><USER2> It a pretty fair assumption to expect the Java runtime itself to be in an OS- level sandbox, Google would never treat that much native code as the last layer of security.

The App Engine CPython runtime can also be subverted in a variety of ways, but about the most exciting thing you can trigger here is for the process hosting your code to immediately be killed.

</comment><comment><USER3> Google have a very good track record in security and that's the reason why GAE-J is my system of choice. I am ignorant on their bounty offerings though, but I would have assumed Google are state of the art there. Can someone fill me in on the background and intentions of Security Explorations?

<comment><USER4> Security Explorations is a well-known security research company. Most of their research is related to Java.

See:

* [http://www.security-explorations.com/en/SE-2011-01-press.htm...](http://www.security-explorations.com/en/SE-2011-01-press.html)

* [http://www.security-explorations.com/en/SE-2012-01-press.htm...](http://www.security-explorations.com/en/SE-2012-01-press.html)

* [http://www.security-explorations.com/en/SE-2013-01-press.htm...](http://www.security-explorations.com/en/SE-2013-01-press.html)

* [http://www.security-explorations.com/en/SE-2014-01-press.htm...](http://www.security-explorations.com/en/SE-2014-01-press.html)

</comment></comment><comment><USER5> Just JVM things.

</comment><comment><USER6> Can somebody explain me why GAE does not use virtualization as a security layer? Xen is a powerful, free, mature product that utilizes clever techniques along with hardware support to provide the best isolation layer yet available. AWS EC2 runs just fine on Xen, GAE seems to have lots and lots of hiccups.

<comment><USER7> GAE appears to be an evolution of Google's internal platform which does not use virtualization. Why invest in learning about a technology that is very different from Linux when such knowledge would not benefit 99% of Google's workloads? Given the number of kernel developers at Google, if they want security I would expect to see them improve Linux rather than adding virtualization.

Of course, Google now has virtualization (GCE) because some customers demanded it, but if GAE already works there's no reason to redesign it.

<comment><USER8> For whoever downvoted:

This post is accurate. AppEngine-the-PAAS uses containerization for resource control and as a security layer on top of the (J)VM security.

GAE-the-EC2 competitor uses virtualization to segment machines. The Google Docker offering uses Docker containers, and segments each customer into a VM.

</comment></comment></comment><comment><USER9> Keep in mind that Oracle is one of the companies actively working with NSA as per some of the Snowden leaks. I trust anything java based not at all. (on the more practical side)

<comment><USER10> "Never attribute to malice that which is adequately explained by stupidity."

-Robert J. Hanlon

Seriously, it's probably an issue with the Java Security Manager. This will no doubt help the JVM community be better.

<comment><USER11> More accurately, Google's implementation of the Java Security Manager. The JVM running on GAE is modified by Google. This is why there is no Java 8 on GAE and probably never will be. It is a metric ton of work for them to port their changes to each new JVM release.

Managed VM's are the new direction because now you just install the latest Oracle or whatever VM you want. [https://cloud.google.com/appengine/docs/managed- vms/](https://cloud.google.com/appengine/docs/managed-vms/)

<comment><USER12> > This is why there is no Java 8 on GAE and probably never will be.

Do you have sources for this? Java 7 on GAE took really long and eventually shipped only shortly before Java 8 was released. From history I would expect the same to the case for Java 8 on GAE. It will take years and ship around the time Java 9 is released. OTOH if Google created a maintenance horror for themselves by patching the fuck out of the JDK and Jetty (I don't think Servlet 3 is ever going to happen) I don't really have many sympathies for them.

<comment><USER11> No, I'm just reading the writing on the wall. I'm just paying attention to things as I run a business on GAE.

They didn't have such a strong focus on GCE and managed VM's before. It is clear with the release of the public beta of managed VM's, they want people to really test it so they can get it out of beta as quickly as possible. I imagine that most of the team that was allocated to work on GAE is now working on GCE and managed VM's.

I'll be switching to managed vm's at some point in the near future (when I can find some time for it). They are also less expensive, which is nice.</comment></comment></comment></comment></comment>