Why We Love QUIC and HTTP/3 - <AUTHOR> https://www.fastly.com/blog/why-fastly-loves-quic-http3 <comment><USER2> QUIC costs something like 2x to 4x as much CPU time to serve large files or streams per byte as compared to TCP. This is because the anti-middlebox protections _also_ mean that modern network hardware and software offloads that greatly reduce CPU time cannot work with QUIC. When combined with the fact that QUIC is userspace, that's just deadly for performance. I'm talking about TSO, LRO (aka GRO), kTLS, and kTLS + hw encryption.

Let's compare a 100MB file served via TCP to the same file served via QUIC.

      TCP:
      - web server sends 2MB at a time, 50x times, via async sendfile (50 syscalls & kqueue notifications)
      - kernel reads data from disk, and encrypts.  The data is read once and written once by KTLS in the kernel.
      - TCP sends data to the NIC in large-sh chunks 1.5k to 64k at a time, lets say an average of 16k.  So the network stack runs 6250 times to transmit.
      - The client acks every other frame, so that's 33333 acks.  Let's say they are collapsed 2:1 by LRO, so the TCP stack runs 16,666 times to process acks

      QUIC:
      - web server mmaps or read()'s the file and encrypts it in userspace and sends it 1500b at a time (1 extra memory copy & 66,666 system calls)
      - UDP stack runs 66,666 to send data
      - UDP stack runs 33,333 number of times to receive QUIC acks (no idea what the aggregation is, lets say 2:1)
      - kernel wakes up web server to process QUIC acks 33,333 times.

So for QUIC we have:

      - 4x as many network stack traversals due to the lack of TSO/LRO.
      - 1000x as many system calls, due to doing all the packet handing in userspace
      - at least one more data copy (kernel -> user) due to data handling in userspace.

Some of these can be solved, by either moving QUIC into the kernel, or by using a DPDK-like userspace networking solution. However, the lack of TSO/LRO even by itself is a killer for performance.

Disclaimer: I work on CDN performance. We've served 90Gb/s with a 12-core Xeon-D. To serve the same amount of traffic with QUIC, you'd probably need multiple Xeon Gold CPUS. I guess that Google can afford this.

<comment><USER3> In addition to those downsides, the QUIC spec points out middleboxes tend to time out UDP streams pretty agressively, so it recommends a ping timer of 10 seconds.

Additionally, since QUIC streams allow for client IP mobility, that creates an additional challenge for IP level load balancing as well as handling at the host level. In a well configured host, TCP packets for a given stream will always arrive at the same nic queue, on the same CPU, allowing the TCP data structure to be local to that CPU and avoid cross-cpu locks. In QUIC, the next packet can come from a new IP, which could be ECMP routed to a different host, or arrive on a different NIC queue and a different CPU. Perhaps, your ECMP router and NIC can be taught to look for the QUIC connection IDs, but that doesn't seem at all certain.

<comment><USER4> That's not really a fair comparison. In the case that the IP changes for quic, tcp would have to completely re-establish the connection. A cross core memory access is tiny in comparison.

</comment></comment></comment><comment> move-on-by As far as I've been able to determine, QUIC suffers from the same SNI data leak that existing TLS versions with TCP has. I understand that ESNI is being (or is already?) included in the TLS 1.3 spec, but it's obviously optional at this point.

Anyways, since QUIC is being touted everywhere as being very secure:

> [QUIC] protects both the data and the transport protocol itself

It seems like missing ESNI as a required feature is a bit of a glaring omission. Does anyone have a better understanding? To me, it seems like a great opportunity to make ESNI required for HTTP/3\. Much like how browsers made TLS required for HTTP/2\. I would love further insights if anyone has any.

<comment><USER3> The ESNI spec I've seen has clients request DNS TXT record to get the public key for the encryption. My pessimistic assumption is that a majority of clients are configured to use recursive DNS servers that will be unable to serve TXT results because or network issues.

In any case, it's hard for a client to determine if a TXT record is not present, or unavailable because the authoritative server has no such record, or because something in the middle has blocked it (due to network incompetence or active malice), so if you want that to work, you're going to need to specify dns over https to a trusted third party, and de-decentralize DNS.

That said, from a brief look at the spec, the ESNI extension includes a digest of the key record, so while an observer can't directly read the SNI, given a sufficient effort to find the keys, they could correlate the digests with matching hostnames.

Reaching key agreement to exchange identity information without disclosing the identities in the clear is somewhere between really hard and impossible.

<comment><USER5> > That said, from a brief look at the spec, the ESNI extension includes a > digest of the key record, so while an observer can't directly read the SNI, > given a sufficient effort to find the keys, they could correlate the digests > with matching hostnames.

I think you've probably misunderstood what's going on here

ESNIKeys, the data structure you're talking about, isn't a key for a specific name, it's the key for the frontend server that's agreed to do ESNI and can be used for ALL names offered on that frontend server.

Whatever name you're asking about, you get the same ESNIKeys values, whether you wanted cat-photos.example.org or nazi-death-squad.example.net or boring- corporate.example.com if they are all hosted on 10.20.30.40 (or that's a TLS load balancer for perhaps different backends that don't face the outside world) they all have the same ESNIKeys.

The fact they're shared is why there's a length field. We can only safely protect names by padding them. Otherwise it doesn't take a genius to spot that this-very-long-name.subdomains-matter-too.example.com encrypt to a far larger structure than short.example. The length field says I promise all the names I'm protecting with ESNI will fit in a name structure this long, just pad the shorter ones.

The digest is in the ESNI setup because this way a server can go "Oh, you've got last week's keys somehow. No, those won't work" or equally "Those are my Cloudflare keys! We only use Cloudflare in North America, this is a European server, we do AWS here, why have you got those?". Without a digest you have no clue why this idiot client is sending you gibberish and you can't do diagnostics.

</comment></comment></comment><comment><USER6> This is a timely post, since IETF 104 is happening this week in Prague[1]. The QUIC working group will be meeting on Tuesday and Wednesday to make progress on standardization[2].

[1] [https://datatracker.ietf.org/meeting/104/agenda.html](https://datatracker.ietf.org/meeting/104/agenda.html)

[2] [https://datatracker.ietf.org/doc/draft-ietf-quic- transport/](https://datatracker.ietf.org/doc/draft-ietf-quic-transport/)

<comment><USER7> What about QUIC and L4S / TCP Prague? Are people working on something equivalent for QUIC as well, or are they reimplementing TCP Reno in QUIC?

<comment><USER8> tl;dr; congestion control is basically pluggable.

Much like in TCP, congestion control really isnt something required for interoperation between peers. Given the userspace nature of QUIC I would expect to see a lot of iteration on this front - for good and bad. (but hopefully the bad iterates quickly).

The current drafts describe newreno is detail, but also explicitly call out the ability to run other things. I've seen reno, cubic, and bbr all run with quic and anticipate others to happen as well. That's one of the exciting things here.

</comment></comment></comment><comment><USER9> QUIC will also usher in a new era of volumetric DDoS attacks. No longer can content providers use upstream ACLs to block udp garbage and fragments. The only option will be to use Fastly, AWS, or Cloudflare to ride out attacks.

QUIC is the tool to bring about the next phase of Internet centralization by the mega players.

<comment><USER10> QUIC actually requires that request packets must be larger than the responses, until a handshake has been performed, in order to prevent reflection attacks.

<comment><USER11> Do you mean larger or smaller? I thought the problem was amplification.

<comment><USER10> Woops, fixed, thanks :)

</comment></comment></comment></comment><comment><USER12> > These interposing network elements, called middleboxes, often unwittingly > disallow changes to TCP headers and behavior, even if the server and the > client are both willing.

There is nothing worse than finding out that someone not even at the company anymore decided years before to deploy some crap like this. Drives me absolutely crazy to impose stuff like this where silos in companies means transitioning involves on the order of 4-5 different "components" need to change.

<comment><USER13> Oh, modern networks are basically just a single huge middlebox with servers on one side and intra|internet on the other side.

There isn't much opportunity for people to plug random stuff between your server and the middlebox (the main middlebox would disallow it, like anything else), but there is still plenty of crappy rules everywhere and nobody knows why they exist or what they are. And you can't even call your ex-coworker and ask for help, because it's an ex-employee of the middlebox company, not yours.

</comment></comment><comment><USER14> " _TCP Fast Open is a stellar example of one such modification to TCP: eight years after it was first proposed, it is still not widely deployed, largely due to middleboxes._ "

Anyone remember TTCP?

<comment><USER15> Fast Open is a bad idea for a bunch of other reasons, mainly the client spoofing their address yet still being able to use a lot of resources on the server.

<comment><USER5> Where would the client get a valid cookie from if they are "spoofing their address" ?

If they don't have a valid cookie Fast Open costs the same as regular TCP in the face of adversaries trying to DOS you. You examine the packet, it doesn't have a valid cookie, you discard it. No further work, just like ordinary TCP.

</comment></comment></comment><comment><USER16> aka let's just put everything in the application layer because solving it at the protocol layer is too difficult.

<comment><USER17> The article mentions gives an example of why it's difficult to improve TCP further.

TCP Fast Open was standardized 8 years ago and is barely used. This is because updating TCP requires kernel updates, which just isn't going to happen on most mobile devices.

Thus, moving the protocol to userspace makes a lot of sense.

<comment><USER18> > Thus, moving the protocol to userspace makes a lot of sense.

Raw IP sockets are accessible from the same userspace facing APIs as e.g. UDP sockets and don't require climbing up the stack. Unfortunately operating systems started to consider custom protocol implementations security risks but rather than reverse that thinking we've just continued to abstract up past it.

In reality I think "where it is implemented in code" was a small portion of QUICs design choices compared to "IPv4 NAT & external firewalling has ossified protocols" which is a similar story of "just abstact up to avoid the issues". Unfortunately in that case I don't think abstracting up isn't as permanent a solution as it was on the OS side.

<comment><USER19> Raw sockets don't really allow for multiple applications to use the same custom protocol. If, for example, chrome and firefox were both running, which gets packets destined for the QUIC transport protocol? The kernel wouldn't know; without the UDP header it can't distinguish flows.

Likewise NAT devices typically support UDP flows today due to their prevalence in games, but if you introduce a new transport protocol at the IP layer, they wouldn't be able to identify which flow (and therefore which NATed endpoint) the packet is destined for.

<comment><USER20> Chrome and Firefox could develop standardized system service which will deliver package to a proper application. NAT is not needed in a bright IPv6 world of the future.

Though I don't know what's wrong with UDP. 8 bytes of overhead for 1450 bytes IP payload is 0.5% bandwidth. Checksum overhead should be negligible.

<comment><USER21> > system service which will deliver package to a proper application

That's expensive. Even if you avoid copying the packages by sharing memory between processes, there are still a lot of context switches...

</comment></comment></comment></comment></comment></comment><comment><USER22> Hopefully vendors like Forcepoint are trying to keep up. The first rollout of QUIC worked terribly in a lot of corporate environments because these MITM content filtering solutions didn't pay attention.

<comment><USER23> It will be interesting because it's a problem for all middleboxes that do any sort of deep packet inspection. Most of the devices that fall into this category today leverage many performance gains made by the assumption that 1) the majority of network layer traffic is TCP and 2) they have access to certain levels of metadata for free.

Things are changing and getting a lot more difficult with HTTP/3 (IETF QUIC) and TLS1.3. Many vendors are claiming TLS1.3 support today, but the interesting thing is nobody is talking about the dismal performance implications it has on packet processing. With TLS1.3 and without HTTP/3 all sessions must use PFS for transform selection. And on top of it with 0RTT if a client gets to the server before the middlebox does - then, I believe, it becomes a failure scenario at the end user experience. Security vendors like Fortinet, Forcepoint, Palo Alto Networks and Cisco are all up against the wall long term. Consider they sell these devices for millions of dollars per device in larger variations. Now we're moving back to taking a device that claims tens to hundreds of gigabits of deep packet processing to, hundreds? They won't share the performance impact with customers - because that will impact financials, which will flow down to stock price, etc, etc. I feel as though companies that bank on the middlebox (ie NGFW) know of the impending apocalypse but are choosing, collectively, to stay quiet. Cisco did have an article that indirectly admitted this but only in context of TLS1.3 and not HTTP/3 [0].

What is the general consensus of others as we see HTTP/3 gain popularity? None of the aforementioned vendors do MitM decrypt with Google properties riding Google QUIC today, as ultimately they can't. The "security" coverage then moves to software / endpoints to pick up the pieces (where plaintext traffic is still available). But in the meantime I feel like the consumer of these products is being told nothing for the sole upside of financials. I used to be a huge proponent of NGFW and the visibility they brought. However I feel as though those devices now give a very high false sense of security as they are only able to catch very low hanging fruit and are simple to bypass [1]. I'm curious what the collective here thinks about the futures of hardware network security, and with that even SaaS based (eg ZScaler).

TL;DR If you're a CISO/CSO is it now a fools errand to continue to invest money in middleboxes with the strong stronger crypto enforcement on the horizon?

[0] [https://blogs.cisco.com/security/tls-1-3-and-forward- secrecy...](https://blogs.cisco.com/security/tls-1-3-and-forward-secrecy- count-us-in-and-heres-why) [1] [https://http-evader.semantic- gap.de/](https://http-evader.semantic-gap.de/)

<comment><USER5> In the cases I've noticed the middlebox vendor claims TLS 1.3 only meaning that now their product isn't critically insecure in the face of TLS 1.3. It can't actually speak TLS 1.3 it just knows to say "Sorry, TLS 1.2 only" without breaking everything.

In my country we had many televisions labelled HD Ready when HD television first became available. Were these actually ready to play HD television? Er, no. They could however tolerate existing in a world with HD while not being HD themselves and this was what they marketed as "HD Ready".

Do you have examples where they actually do TLS 1.3?

<comment><USER22> Good article on that topic, _" TLS 1.3 and Proxies"_: [https://www.imperialviolet.org/2018/03/10/tls13.html](https://www.imperialviolet.org/2018/03/10/tls13.html)

HN discussion here: [https://news.ycombinator.com/item?id=16564935](https://news.ycombinator.com/item?id=16564935)

<comment><USER5> Months after that post, at least two famous brand middleboxes were found to be incompatible with the finished TLS 1.3 because somebody cut corners as follows:

The specification says: YOU must choose RANDOM numbers otherwise bad things could happen.

[ TLS 1.3 final hides a downgrade signal in those random numbers if you appear to only speak TLS 1.2. The TLS 1.2 specification says nothing about a downgrade signal, so if you recognise the signal that means you wanted TLS 1.3 but the server has been told you wanted TLS 1.2, a downgrade attack is being attempted. Abort! ]

These famous brand middleboxes were too lazy to make random numbers, they'd just take the exact numbers the real server picked and use those. Those are random right? What could go wrong?

The result was that the TLS 1.2 Downgrade signal would get copied into supposedly "fresh" TLS 1.2 connections and trip the abort mechanism.

Just an incompatibility right? Nope. For the years that this idiocy was in those products they weren't actually delivering security, the requirement that you pick RANDOM numbers is there for a good reason - if sophisticated bad guys knew this "bug" was present in the famous brand middleboxes they could definitely have exploited this to snoop connections.

</comment></comment></comment></comment></comment><comment><USER24> I'm currently working with HTTP/2 (more specifically HAS with HTTP/2 Server Push) and it's just a huge pain to find a high-level library that can help with this. I fear that it'll take even longer for HTTP/3 to be adopted or HTTP/2 might just be skipped altogether. Why are there so many server-side implementations available for a variety of languages though many still lack some features or a client-side implementation altogether?

<comment><USER20> You can implement HTTP with a few hundreds LoC. It's an extremely simple protocol. TLS is not simple, but it's independent of HTTP, so you can use a separate implementation. HTTP/2 seems much harder.

</comment></comment><comment><USER25> /offtopic

Good folks at fastly, I hope you're reading... I've been waiting very patiently for part 3 of this series for a good part of 2yrs now: [https://www.fastly.com/blog/building-and-scaling-fastly- netw...](https://www.fastly.com/blog/building-and-scaling-fastly-network- part-2-balancing-requests)

</comment><comment><USER26> Are there ready to use mobile libraries for QUIC?

<comment><USER27> [https://developer.android.com/guide/topics/connectivity/cron...](https://developer.android.com/guide/topics/connectivity/cronet)

</comment></comment><comment><USER28> so the arista's are gonna be able to ecmp on it?

<comment><USER29> It still has UDP headers with port numbers that can be used for ECMP. [https://tools.ietf.org/id/draft-ietf-quic- manageability-00.h...](https://tools.ietf.org/id/draft-ietf-quic- manageability-00.html)

</comment></comment><comment><USER30> It seems that QUIC is a new transfer protocol created to replace TCP. QUIC uses UDP and LTS/3 and solves the head of line problem addressed in HTTP2. Furthermore, sending the data encrypted allows QUIC to begin transfering data earlier. An experiment by google shows that in connections with high latency or loss QUIC gives a 15% reduction in highest latency.</comment>


Ask HN: What does it mean to be successful? - <AUTHOR> We read a lot of articles on how to be successful but what does it really mean to be successful? <comment><USER2> It's _entirely_ subjective, and you can't define it. Whatever definition you use someone else will always be able to say "That's not what I'd call success." For some people it's something external like money or fame, for others it's internal like being happy or enjoying time with your family.

Consequently you have to find your own definition, and understand that people are bound to disagree with you if you tell them.

</comment><comment><USER3> Success is when the ones you looked up to becomes your competitors.</comment>


Ask HN: Need some advice about school. - <AUTHOR>

Basically after this summer I'll have approximately 1 year left to get my degree (I already have a diploma).<p>I've always hated school, I find it boring and tedious.  I really just want to work full time with a startup.  If I am able to find a full time job, should I just drop out of school? Or should I tough it out through all the bull shit classes and get the paper? <comment><USER2> I'm not sure what you mean by having a diploma and not a degree, typically those are equivalent.

If you have enough credits to get the diploma but have not satisfied the degree requirements, then that is a tougher decision. And it will depend on how much value you perceive in meeting the additional requirements, but as PG writes running up the stairs (take the harder path) usually has a bigger advantage.

That does not mean you can not work full time. Lots of distance education courses available. Check with your school and find out the rules/regulations in this area.

Also you can network while in school, possibly this can lead to a company/start up that will let you start work while you finish your schooling.

<comment><AUTHOR> Well, here in Canada a diploma is basically from a 2 year program, and a degree usually from a 4 year program. I finished a 2 year program and transferred into the 4 year one.

Also, thanks for the input, I'll look into the stuff you mentioned.

<comment><USER2> Thank you for the clarification on the diploma versus degree. U.S. refers to 2 year degree as Associate's degree, with diploma usually indicating a completed degree of any level. Always fun to find out ways English speaking countries use words differently.

Definitely pursue completing the degree, as you are almost done.

Find a way to make it interesting to you. Analyze how an assignment, or information, applies to a business.

If you can find an open source project to work on, then that could be fun. You could also start your own start up or start researching ways to make a start up successful.

Research start ups and find out how you can increase your 'value add' as you complete your degree. So you can hit the ground running once you do graduate.

</comment></comment></comment><comment><USER3> At this point you should finish because it helps to have a degree if you ever want to work in a different country.</comment>


Running feature specs with Capybara and Chrome headless - <AUTHOR> https://drivy.engineering/running-capybara-headless-chrome/ <comment><USER2> Earlier this month I wrote an ETL extractor using Capybara & headless browser (to work-around a lack of API - PS: only do that as a last resort!).

One thing I learned and wanted to warn about here is that Chrome headless currently doesn't support file downloads [1].

PhantomJS won't work either (unless you use a custom build) [2].

I also tried with capybara-webkit, but no luck either [3].

The only driver which ultimately allowed me to download files at this point was Selenium + Firefox (with some tweaking on profile options browser.download.dir, browser.download.folderList = 2, browser.helperApps.neverAsk.saveToDisk set to the MIME type of files to be downloaded).

[1] [https://bugs.chromium.org/p/chromium/issues/detail?id=696481](https://bugs.chromium.org/p/chromium/issues/detail?id=696481)

[2] [https://github.com/ariya/phantomjs/issues/10052](https://github.com/ariya/phantomjs/issues/10052)

[3] [https://github.com/thoughtbot/capybara- webkit/issues/691](https://github.com/thoughtbot/capybara-webkit/issues/691)

<comment><USER3> >One thing I learned and wanted to warn about here is that Chrome headless currently doesn't support file downloads [1].

Not true. At least with C# You can use

                var client = new WebClient();
                client.Headers[HttpRequestHeader.Cookie] = cookieString(driver);
                client.DownloadFile(reportURL, savePath + fileName + ".xlsx");

Along with:

                string cookieString(IWebDriver driver)
                {
                    var cookies = driver.Manage().Cookies.AllCookies;
                    return string.Join("; ", cookies.Select(c => string.Format("{0}={1}", c.Name, c.Value)));

                }

Edit: Just wanted to emphasize that this ensures all the steps you did to login won't be lost since you're using the logged in cookie. The idea is to use Selenium to get the download url and then use a regular download method using the selenium cookie.

<comment><USER2> Yes - I could have done that on other cases, but not in the specific case I tracked, where I don't know the report URL at all, nor I can construct it (it's generated by some enterprise app / javascript code). I think the bug report I mentioned relates to that.

(otherwise you could use pretty much whatever you want to download the file, indeed).

</comment></comment></comment><comment><USER4> Chrome headless migration has been my bane for the last two weeks. It's _almost_ ready, but not yet.

The short version of what's wrong: chrome headless does not support extensions. The chromedriver used by selenium works via starting chrome with an automation extension that gives it certain needed functionality. So things like setting the window size, taking screenshots, and a few other important features just cause chromedriver to crash or hang.

There's bugs filed and some clever googlers are trying to fix it all- but it's not ready for our purposes yet. I don't want to rewrite dozens of tests that work with phantomjs to get around chrome's bugs.

<comment><AUTHOR> Indeed, some features are not supported yet (setting size, alerts, ...). We're lucky not to use too many of them in our actual test suite!

<comment><USER5> Just implemented headless testing for a rails app today, and discovered that alert support has been worked around in the latest Capybara (2.14.4).

[https://github.com/teamcapybara/capybara/commit/12c100597093...](https://github.com/teamcapybara/capybara/commit/12c10059709346bfeadb2cea18f510174d842303)

</comment></comment></comment><comment><USER6> I hear a lot of folks mentioning the pain working with headless chrome. This was the inspiration for Navalia, which is inspired by the API from nightmare. It also handles the case where you want to run simultaneous scripts by using new tabs (and even multiple chrome instances as well). It's still early in life, and I'm about to do another breaking release, but here is the repo [https://github.com/joelgriffith/navalia](https://github.com/joelgriffith/navalia)

</comment><comment><USER7> Kind of off topic, but. Is running automation as complicated as this? I recently wanted to log in to a website, click some page and download a .csv file. I saw that chrome can be run headless, nice.

So I opened it headless and there's this REPL, nice I can do JS directly into the website. Now how do I automate this.

This leads me into all sorts of things that doesn't seem related at all (I is, but still). Selenium stuff, automation setups, drivers, language bindings, chrome-api-stuff and no end in sight.

All I want is something like "chrome -headless -js script-flow.file [http://URL"](http://URL")

Am I to overwhelmed or is there no simple way without buttloads of 3rd party tools and setups required?

<comment><USER8> What does headless Chrome provide that a web scraper in any given language can't?

<comment><USER7> I was hoping it would let me automate a few tasks with a "user" flow (i.e. enter details, click, click). With e.g. curl or python I didn't even get through the login screens because they seem to require some special dealing with cookies, request/response cookies, smfd, itc, id_ado, _ip_xat and so on.

Basically auth on websites seems to require a whole bunch of stuff and I just started looking at simpler forms of automation instead. Still not sure which one I'll continue looking into.

(If anyone sees this, I am trying to log into iTunes Connect and Fabric and download metrics)

</comment></comment></comment><comment><USER9> "It is also supposed to improve memory usage and stability"

Did you do a comparison of memory against phantomJS?

<comment><USER10> Just this morning my team migrated from phantomJS to chrome headless for our Karma plus Jasmine tests. Did a bit of researching before the move and we found tests ran faster plus chrome used less memory than phantomJS. ~ 2000 specs compiling html and stuff

<comment><USER11> Any guess at how much faster the tests are running?

</comment></comment></comment><comment><USER12> I tried switching from poltergeist to Chrome headless last week using a very similar setup, but it was much, much slower. I assumed it was Selenium's fault, but didn't dig any deeper as it seemed to be expected from the guide I was using[1] ("I can anecdotally report that Capybara-Webkit seems significantly faster").

[1]: [https://robots.thoughtbot.com/headless-feature-specs-with- ch...](https://robots.thoughtbot.com/headless-feature-specs-with-chrome)

</comment><comment><USER13> Wow, I completely missed the announcement that the maintainer and sole developer of PhantomJS is stepping down.

</comment><comment><USER14> Poltergeist had a network_traffic mode which we found quite useful. (Seeing if requests were made etc)

Does Chrome headless have an equivalent? It's the only thing preventing us from moving across. And if not where should I raise it?

<comment><USER15> Headless Chrome is controlled using the Chrome DevTools protocol, which has quite a few options for tracking and modifying network requests.

Everything you get in the Network inspector in Chrome DevTools should be available in Headless Chrome.

[https://chromedevtools.github.io/devtools- protocol/tot/Netwo...](https://chromedevtools.github.io/devtools- protocol/tot/Network/)

</comment></comment><comment><USER16> When specs are failing you actually want to see what's happening in the browser. Xvfb + normal Chrome + ffmpeg screen capture. This can be run in Docker and thus on Macs as well.

</comment><comment><USER17> > To prevent some issues in PhantomJS when elements would overlap, we had a > lot of calls like this:

I don't understand. How would you do it when it's not overlapping?</comment>


Computer Algorithm Can Recognize Sarcasm (Which Is Just Soooo Cool) - <AUTHOR> http://www.popsci.com/technology/article/2010-05/computer-algorithm-can-recognize-sarcasm-which-soooo-cool <comment><USER2> This is a hard problem to solve. Many people can't reliably detect it either!</comment>


Why now, more than ever, we need a Twitter that works - <AUTHOR> https://techcrunch.com/2016/11/21/why-now-more-than-ever-we-need-a-twitter-that-works/ <comment><USER2> What we need is a Twitter that doesn't ban accounts and suppress opinions solely based on opposing political viewpoints.</comment>


Meet the man who sells $89 million of diapers each year online - <AUTHOR> http://www.inc.com/magazine/20090901/the-way-i-work-marc-lore-of-diaperscom.html

<comment><USER2> It shows you can still make money on the internet even if your product is full of shit.

</comment><comment><USER3> I don't doubt their execution, but its domain(diapers.com) might have helped big time in their success.

<comment><USER4> Hands down, but at the same time if he hadn't run the site properly the domain would probably be linking to amazon.com or something by now.

The domain grab really was like the land grab of the west in the US, first come first serve and if you defended your property then you're now a millionaire!

<comment><AUTHOR> What I personally find interesting about the story is the execution and optimization to get such remarkable margins in what should be a commoditized business:

"We built software with computational algorithms to determine what the optimal number of boxes to have in the warehouse is and what the sizes of those boxes should be. Should we stock five different kinds of boxes to ship product in? Twenty kinds? Fifty kinds? And what size should those boxes be? Right now, it's 23 box sizes, given what we sell, in order to minimize the cost of dunnage (those little plastic air-filled bags or peanuts), the cost of corrugated boxes, and the cost of shipping. We rerun the simulation every quarter. Using the right box probably adds close to 1 margin point."

1% is incredible - that works out to being 890K+/year (though that might depend on what their "null" case is/was).

<comment><USER5> I remember being shocked that "packaging" was a four-year bachelor's program when I went to my university. After some examination of the curriculum, I was convinced. (Though I still don't know what you do for a PhD....)

Anyhow, my point is that rather than stunning innovation, that sounds rather like Packaging 101. However, I'm sure that's because that's the summary for the journalists and I wouldn't be surprised that they are doing actually innovative stuff beyond a journalist's grasp... because as we should all know by now, getting past a journalist's level of knowledge is not a challenge.

</comment></comment></comment></comment><comment><USER6> > The year we started, our gross margins were 4.6 percent. Today, they're in > the teens.

Does this mean that they earn 8.9 million every year? Or the headline mentioning "89M $" is already a "clean income" figure?

<comment><USER7> I read the 89M as a topline gross revenue -- so 11.57M if that "teens" (i.e. 13%) figure applies to the past year. He's more or less admitting he can't scale while retaining that, but it's still a nice chunk of change to reinvest into growth.

<comment><USER6> Thanks

</comment></comment></comment><comment><USER8> Sounds like fun. I wonder though: if all he wanted to do was maximize his net worth, would he be better off hiring a statistics graduate student who knows R and training his replacement so he could go start another company?

<comment><USER9> No, since maximizing net worth involves much more to do.

<comment><USER8> Please elaborate.

</comment></comment></comment><comment><USER10> Throughout the story I kept wondering 'how old is this company?'. Till the end I could not tell.

<comment><USER11> Founded in 2005

<http://www.crunchbase.com/company/diapers-com>

<comment><USER10> Wow I learned so much more from crunchbase than that piece. This is very rare: I usually _really_ dig pieces written by the founders.

Just in this case the writing was very scattered and repetitive.

Most of my questions like what were they doing before diapoers.com; how they got the domain; what venture did they do before remained unanswered.

</comment></comment></comment><comment><USER12> Heh, reminds me of Ashton Kutcher in the movie "A Lot like Love". His startup (which ultimately tanked in the movie) was an online diaper store.

<comment> brown9-2 Sounds like this guy sells a lot more than just diapers (such as car seats), the title might be a little misleading.

Pretty interesting story, thanks for posting.

<comment><USER13> It's one of those meme title formats - a flat out lie too.</comment></comment></comment>


Get email addresses of leads that are tweeting / following about relevant topics - <AUTHOR> http://allmails.to <comment><USER2> A concept that sounds completely illegal in the EU. A website that asks for your email in order to find out more about getting other people's emails.

Hmmmmmmmmmmm.</comment>


Book II – Why Can't I Compile All This Bloat? - <AUTHOR> https://fglt.nl/agora/book-02-why-cant-i-compile-all-this-bloat.html <comment><USER2> Gr8 article but if anything it underestimates the difficulty of unbloating the hardware and os which for one thing means breaking software since it depends on abstractions that get in the way.</comment>


Firefox 26 is released - <AUTHOR> http://www.mozilla.org/en-US/firefox/26.0/releasenotes/ <comment><USER2> > Improved page load times due to no longer decoding images that aren't > visible (847223) ( > [https://bugzilla.mozilla.org/show_bug.cgi?id=847223](https://bugzilla.mozilla.org/show_bug.cgi?id=847223) > )

This is pretty cool

<comment><USER3> And it was even cooler when Opera did it several years ago.

<comment><USER4> If you were to construct a graph of all the features implemented by one browser and then copied by the others, after a while it would look like a chain link fence.

<comment><USER5> As correct as you are you'd be surprised how many features we use where implemented in Opera first. Surprisingly large amount, which they then threw away...

<comment><USER6> I give the Opera guys a lot of credit (I met a few engineers years ago at a conference and they seem like awesome dudes too), but one can hardly blame them for "throwing it away."

</comment></comment></comment></comment></comment><comment><USER7> Love this - All Java plug-ins are defaulted to 'click to play'

I tried convincing my coworkers to disable java and failed (we are not developers).

<comment><USER8> I do not think this is a good solution. This is once again just smashing another security trade-off in the face of the end-user. Once the user is responsible they can be blamed and the browser is considered secure with stupid users.

If the developers at mozilla can't verify the security of the applet, how on earth would my grandmother be able to?

Note: This is not an attack against mozilla in particular, almost all vendors does this (e.g. "antivirus: wanna allow suspicious file?" or "browser: invalid certificate". These questions are asked as if everyone is a computer scientist. We developers need to start formulating these questions so they can be answered by a normal person.

Note 2: I guess it's better than doing nothing at all, since it might stop some drive-by attacks.

<comment><USER9> The main security benefit of click-to-play plugin schemes is not to question the user about the security of an object, which is unknown in most cases anyway, but to prevent accidental drive-by loading and other annoying (and risky) usage. Clicking an overlay to run a plugin should be as natural as clicking on a video to begin playback.

<comment><USER10> Yes. Drive-by is big deal imo.

</comment></comment></comment></comment><comment><USER11> According to the #ux channel on irc.mozilla.org, Australis will be relegated to Nightly builds (Firefox 29) for a while yet, and might be as late as Firefox 30 depending on the speed at which bugfixes roll in. Sorry, Aurora users. :(

<comment><USER12> That still means it would only be about 5 months.

<comment><USER13> Yeah. to clarify for people who are not clear, see this [https://wiki.mozilla.org/RapidRelease/Calendar](https://wiki.mozilla.org/RapidRelease/Calendar)

<comment><USER14> will the linux version still show the window frame on top of the tabs?

Update: seems so [http://people.mozilla.org/~shorlander/blog- images/australis-...](http://people.mozilla.org/~shorlander/blog- images/australis-landing-on-nightly/intro-image-large.jpg)

why didnt they take this chance to fix this, chromium does it>

<comment> quaint- Chromium does it, to a pretty useless extent. With so many window managers, it's pretty hard to draw correct window borders on every machine, and Chromium doesn't even try: with Ubuntu, for example, it draws the titlebar buttons in the "wrong" corner.

Let's face it, the Linux version will only show the window frame if you choose to draw it: not all do (with tiling wm's it's pretty rare, even). Firefox is easy to customize, which allows every distribution to match it looks to whatever theme they use. Linux doesn't have the DE like OSX and Windows do.

</comment></comment></comment></comment></comment><comment><USER10> > Support for H.264 on Linux if the appropriate gstreamer plug-ins are > installed

\o/

<comment><USER15> I don't think that's a good thing for the open web.

:'(

Then again I do like that I can watch more YouTube Videos in a reasonable resolution now. Most webm transcodes are just available in low quality.

<comment><USER16> I just download youtube videos[1]. It has many advantages over youtube.com. Hardware acceleration is one but also no stalling when skipping ahead, no disappearing videos that you planned to watch later, no need to sign in.

Actually, youtube as a repository of material for download works much better than youtube as a streaming site.

[1] [http://rg3.github.io/youtube-dl/](http://rg3.github.io/youtube-dl/)

<comment><USER17> On OSX I highly recommend YouView[1]. It streams H.264, and CPU usage during playback is 1/3 of what the browser player uses. I guess it really inconsequential unless you are on a laptop. On a laptop it's a difference in 1-1.5 hours of battery life.

[1] [https://mrgeckosmedia.com/applications/info/YouView](https://mrgeckosmedia.com/applications/info/YouView)

<comment><USER18> I used YouView for a while, but I switched to Mactubes because YouView doesn't have Retina support. But I much prefer YouView's interface, and I would switch back in a moment if they released a Retina-enabled version.

<comment><USER17> I have a rMBP as well. You can use a little program called Retinizer[1] to convert YouView to retina compatible app. Retinizer works on almost any cocoa app, I have tried it on a bunch. All it does is set a flag in the info.plist file that tells OSX that the app is HiDPI compatible, the OS does the rest. You should also get Maximizer[2] to add full screen app option for it.

[1] [http://retinizer.mikelpr.com/](http://retinizer.mikelpr.com/) [2] [http://chpwn.com/apps/maximizer.html](http://chpwn.com/apps/maximizer.html)

<comment><USER18> Retinizer is nice, but it only "retinizes" the UI controls in YouView, not the actual video view, which is the part that matters.

<comment><USER17> Ha! You are right. I usually watch videos in 720p, because my connection isn't all that great to YouTube servers, so I never noticed. Just tried it with a 1080p clip, and sure enough, the content isn't running in retina resolution. I guess if I haven't noticed after this long, I am not switching, but good catch.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> EXIF rotation was long overdue but I'm happy it finally landed!

</comment><comment><USER20> > There is no longer a prompt when websites use appcache.

Quite happy with this one. I had to develop an offline web-based application a few weeks ago and it really bugged me that I had to allow the application to use the offline cache.

<comment><USER21> I'd like to know if some web developer has decided to use 5 GB of offline storage for their app.

<comment><USER22> IIRC most (all?) browsers prompt you when usage goes above a certain limit (5MB, I think). Firefox was the only one that asked you before the site saved a single byte.

</comment></comment></comment><comment><USER23> I have a silly request, can timings on Network tab be displayed on mouse hover? I hate having to click to measure which part took much time? This is @Mozilla Web inspector

<comment><USER24> I think bugzilla, mailinglists and irc channels might be better places to request a feature request than a comment on hacker news.

<comment><USER23> I got no clue how to get to Bugzilla. I made other bug request, but I have no idea where those went (It was one of those Feedback sites for Mozilla with I have an idea, etc.)

<comment><USER25> If you made the suggestion through a feedback mechanism, it goes into a big database along with the millions of other feedback entries. The support team at Mozilla is responsible for combing through that database looking for common themes and especially for trending issues.

I'd guess your request probably isn't very common, so you probably wouldn't get the same potential attention that you would get if you were to go to bugzilla.mozilla.org and file a bug there.

</comment></comment></comment></comment><comment><USER26> Is there any way to update Firefox on Linux without resorting to ugly methods like running it as root and using update UI, or downloading the mar file manually and running the updater CLI tool with that file (as sudo / root)?

The issue is that I use stock Mozilla build (I prefer it to Iceweasel on Debian), so I just placed it in /opt, but I don't want to give write permissions to the firefox directory to my primary user (it's kind of bad security wise). Because of no write permissions, updating UI can't update the browser naturally, unless I run it as root. And manual mar + updater method isn't nice either.

Potentially there can be some better ways for updating:

1\. Firefox can work with policykit and request authorization for updating (if user has it - it can ask for password). That's much better than running as root.

2\. updater CLI tool can detect all the settings, channels sources and etc. from Firefox local DBs, and instead of forcing the user to manually grab some mar file, it can go and perform all that automatically. updater can be run with sudo still, but avoid all the manual steps.

Both these methods would be much neater than what I usually do now.

<comment><USER27> Honestly, when I've used official Firefox builds, I've just downloaded the tarball and extracted it to my home directory. Any malicious code that could corrupt your Firefox install can trash your entire home directory anyway, so there's not much gained by making it non-writable.

Also, running a browser (or anything as complex as a GUI app, but especially anything as wildly complex as a browser) as root is probably a bad idea security-wise anyway.

<comment><USER26> _> Also, running a browser (or anything as complex as a GUI app, but especially anything as wildly complex as a browser) as root is probably a bad idea security-wise anyway._

Yes, that's why using mar + updater is probably the only "right" option, but it's way too manual. I even thought about writing some script which would extract http sources for mar file based on the current update channel but didn't figure out yet where it's configured.

</comment></comment></comment><comment><USER21> These frequent updates are going to kill Firefox and it's partially Google's fault. Basically, Google has managed somehow to coax Firefox developers to rapid release cycle with frequent Chrome updates. But this goes against Firefox users.

Why do people use Firefox? Most users claim extensions. What breaks extensions? Frequent updates. Effectively annulling the most compelling reason to use Firefox.

This is certainly my experience. Pentadactyl, the most compelling reason for me personally to keep using Firefox is more broken than not. Every single update in the last year has broken it and sometimes in non-trivial ways, and stretching my patience to the limit. If I have to abandon Pentadactyl, I really don't have a reason to use Firefox anymore.

UI changes proposed in Australis are not something to look forward to either esp. if you like hiding Firefox UI elements and basically just keeping undecorated minimal window with Pentadactyl.

<comment><USER28> Is that a troll attempt? Not sure.

Haven't had any of my 15 extensions break in 20 releases. I don't expect any breakage any time.

The reason for rapid release is that they need to get new features out to load stuff properly like google docs, yes.

The main reason to use firefox IMO is that its as fast or faster than others (and has all the features of course) AND has this: [http://www.mozilla.org/en- US/about/manifesto/](http://www.mozilla.org/en-US/about/manifesto/) to tip things on it's favors.

Also, I'm using Australis and its just fine. I switch back to release sometimes and I don't really notice the difference anymore. I do prefer the australis tabs contrast.

<comment><USER29> They are changing the js API all the time. E.g. in ff26 they disabled the old download manager and replaced it with a new module that's available only since ff26. When the extensions you use didn't break, it's because the developers are busy updating them.

</comment></comment></comment><comment><USER30> See also the Firefox 26 for Developers: [https://developer.mozilla.org/en- US/Firefox/Releases/26](https://developer.mozilla.org/en- US/Firefox/Releases/26)

And Site Compatibility for Firefox 26, [https://developer.mozilla.org/en- US/Firefox/Releases/26/Site...](https://developer.mozilla.org/en- US/Firefox/Releases/26/Site_Compatibility)

Of note, images with EXIF rotation data are now rotated correctly! And you can inspect :before and :after elements in the built-in inspector finally.

</comment><comment><USER31> As a developer, it would just peachy if they'd start supporting HTML5 input elements.

<comment><USER32> Firefox has support for a bunch of them and that's been steadily improving – i.e. the input type=range landed in (IIRC) FF 23.

You can see the current status for just about everything here: [https://bugzilla.mozilla.org/show_bug.cgi?id=344614](https://bugzilla.mozilla.org/show_bug.cgi?id=344614) As you can see from reading some of the linked tickets not all of the remaining work is trivial – there are questions about the spec, compatibility with webkit, etc:

type=color: [https://bugzilla.mozilla.org/show_bug.cgi?id=547004](https://bugzilla.mozilla.org/show_bug.cgi?id=547004) type=number: [https://bugzilla.mozilla.org/show_bug.cgi?id=344616](https://bugzilla.mozilla.org/show_bug.cgi?id=344616) type=date: [https://bugzilla.mozilla.org/show_bug.cgi?id=446510](https://bugzilla.mozilla.org/show_bug.cgi?id=446510)

</comment></comment><comment><USER33> I am curious about this change in the changelog. "Password manager now supports script-generated password fields" I couldn't easily find any details about. Would someone be kind enough to elaborate on what it does and where it is useful?

<comment><USER34> see [https://bugzilla.mozilla.org/show_bug.cgi?id=355063](https://bugzilla.mozilla.org/show_bug.cgi?id=355063)

<comment><USER35> Wow, that bug is over seven years old!

It's oddly gratifying to see bugs that old getting fixed...

</comment></comment></comment><comment><USER36> I'm using Archlinux and I have the H.264 GStreamer plugin installed (as well as base+bad+good+ugly codecs), but with Firefox 26 I still can't play a lot of YouTube videos when Flash is disabled, for example when I try to play Gangnam Style it tells me "The Adobe Flash Player is required for video playback".

Is that related to advertisements? Would it be possible to develop a plugin or a GreaseMonkey script that would allow to play every YouTube video in HTML5 with Firefox? If yes, does it exist?

<comment><USER37> [https://userscripts.org/scripts/show/87011](https://userscripts.org/scripts/show/87011)

No need for Flash anymore, works on every video

</comment></comment><comment><USER38> Maybe I'm biased, but jor1k is my FF benchmark of choice these days. Sadly I'm not seeing any major performance increase over FF 25 (posting this from jor1k via links [1]).

1: [http://s-macke.github.io/jor1k](http://s-macke.github.io/jor1k) (had to edit in the link as the ':' and '-' keys don't appear to be working)

<comment><USER39> hm, that's simple 'does this use case run 1 thing particularly well.'

EXIF rotation and ability to use gstreamer for video are massive feature improvements that may result in slower page generation, but the returns are far more significant.

not everything has to be 'better, faster, smaller' making things generally better with _no_ regressions is difficult enough.

<comment><USER38> Yeah, I phrased that poorly (was fighting with links and not thinking about my words too carefully). I didn't mean to knock the release by any means. I was only making the observation that there didn't appear to be much in the way of asm.js performance improvement this time around.

And you're absolutely right; the fact that there are additional features/improvements and I get to keep the same (awesome) performance from FF 25 is very impressive and laudable. I can enumerate several FOSS projects for which this sort of thing is an issue.

</comment></comment></comment><comment><USER26> About gstreamer video playback: I didn't find a way to prioritize formats. Let's say some video is available in VPx (WebM) and H.264 (mp4). Firefox will pick first whatever is listed first on the page. So for me it always picks H.264 on Youtube. I prefer to use open codecs though when there is a choice, but there is no apparent way to set the priority.

<comment><USER40> I think the browser is supposed to load them by the order listed in the HTML.

        <video>
          <source src="foo.mp4">
          <source src="foo.webm">
        </video>

Unfortunately, I think there were bugs in older browsers, so they broke if mp4 was not listed first. So most websites list mp4 first.

<comment><USER26> May be an add-on can allow overriding the priority. I'll take a look if it's possible.

</comment></comment></comment><comment><USER41> Just clicked on "About Firefox", the upgrade was downloaded and installed.

And a smaller download than downloading the new version.

</comment><comment><USER37> If you are on beta channel and the integrated updater is too slow for you, you can grab 27b1 here: [https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27....](https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0b1/)

</comment><comment><USER42> Anyone with memory problem with Firefox? My FF is currently using 2G memory while I only have 13 tabs opened and most of them are just plain simple pages. I am sure it will keep sucking up memory until I do restart. This problem is not new. Is there a memory leak problem with FF?

<comment><USER43> First of all, it's hard to tell how much memory a process uses. If you're on Linux or on OS X and you're using "top", there's difficulty in interpreting the results.

For example right now my Firefox 26 with about 20 tabs is being reported by "top" as using 2190MB VIRT and ~1030MB RES. VIRT reports the total amount of memory allocated, including memory that's shared between processes, including memory-mapped files, including virtual memory, including the loaded shared libraries, or anything that takes up address space, but address space is not real, the measure is next to useless. RES is the relevant measure, which in my case reports about 1 GB, however that's a little misleading too because it also counts memory that's shared between processes, although in my case I think 1 GB is an accurate measure. And if you're using some kind of GUI that doesn't specify exactly how it calculates memory consumption, then you can't trust what it says.

Second, free memory is unused memory. Browsers are caching stuff for example. Unused caches in memory-strained systems end up being flushed to disk. The kernel is quite efficient in flushing memory pages on disk and reloading them later when needed. That's why it's very hard to tell how much memory a process needs to be usable.

If you want to claim that some application leaks memory, then you need to look at _growth_. And if you want to claim that it's a memory hog, then you need to take a look at how it behaves on top of memory constrained systems.

In my experience, Firefox is very memory efficient, which is why I'm using it and not Chrome. And I'm on the beta channel now, so I've been on Firefox 26 since a week ago and it's OK.

<comment><USER42> In my case, everytime I open a new tab, the mem usage goes up. But when I close a tab, it does not necessarily go down, or just goes down a little. So the overall trend is it goes up, until it can no longer function (freezed up on my old 4G computer). Then I have to kill and restart it.

I use OSX's Activity Monitor to see the mem usage.

<comment><USER44> Can you try running in Firefox's safe mode and let us know if you have the same issue... sound to me like one of your extensions is leaking.

</comment></comment></comment></comment><comment><USER39> >Support for H.264 on Linux if the appropriate gstreamer plug-ins are installed

I was trying to do this for ages using plug-ins, nothing works- was told to run nightly- but I need this browser.

can't wait until it makes it's way into repo's :D

</comment><comment><USER45> The Android version has received a facelift as well, and it looks nice. However, I suppose there still isn't a way to manually pin sites to the about:home page if they do not show up there already?

<comment><USER46> This is possible in Nightly, so it's likely to be live in release in a couple months or so.

</comment></comment><comment><USER47> Lol. I like the unresolved finger given to Flash.

<comment><USER48> I encounter this issue frequently, so I'd prefer if it was resolved.

</comment></comment><comment><USER49> Great Browser. Thank you Mozilla.

</comment><comment><USER50> Can we see the gzipped size side by side with real size on network panel?

</comment><comment><USER51> Firefox 25 hanged most of the time, it seems was because of Firebug. I disabled Firebug.

Firefox 26 hangs at start up. CPU stuck at 100%. Almost 1 GB of ram used with 1 tab open (I can't even open a new one).

What happened, Mozilla?

I'm giving up with this browser.

<comment><USER52> Anecdata: I use FF<current> heavily on a daily basis and haven't seen any of these problems. Issues of this magnitude are "set the internet on fire" problems. If a few web searches don't turn up _tons_ of other users having these problems then it's best to assume there are local issues that need troubleshooting. Some suggestions on that:

1\. Have you tried troubleshooting Firefox via Safe Mode? [https://support.mozilla.org/en-US/kb/troubleshoot-firefox- is...](https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using- safe-mode)

2\. If troubleshooting via #1 doesn't help, consider using the Profile Manager[1] to create a new, blank profile and see if your problems reproduce there.

[1] [https://developer.mozilla.org/en- US/docs/Profile_Manager](https://developer.mozilla.org/en- US/docs/Profile_Manager)

<comment><USER51> I didn't want to be so negative but I'm actually frustrated with this. Because:

1\. I used to be in love with Firefox. So much.

2\. A few web searches turn up tons of _other_ problems [1], maybe mine also. Maybe not.

3\. At this point, this is not just a one shot problem to sort out. This is something mining my daily productivity.

[1] [https://www.google.com/?q=firefox+hangs&safe=off](https://www.google.com/?q=firefox+hangs&safe=off)

</comment></comment></comment><comment><USER53> I wished they would improve the PDF viewer.

<comment><USER54> How would you like it improved? I rather like it as it is--I've completely stopped using Adobe Reader, in fact--but I'm curious to know what you think is missing.

<comment><USER55> Speed mainly: it's unbearable on my machines. But maybe I'm a niche market: cheapskates with 5 year old laptops.

<comment><USER56> I have a brand new beefy machine with lots of cores a big GPU and plenty of RAM, it is also dog slow on PDF documents of any appreciable length.

Then again I tend to load multi-hundred page PDFs.

</comment></comment></comment></comment><comment><USER57> "has been released" or "is out".

<comment><USER58> Technically speaking, "released" can also be a state, so "is released" (as in "is in the released state") works too.

<comment><USER57> Technically maybe, but when has a native speaker ever written that?

<comment><USER59> I would guess that most of the 12,000,000+ hits [0] on G has been written by natives.

[0] [https://www.google.com/search?q=%22is+released%22](https://www.google.com/search?q=%22is+released%22)

<comment><USER60> Or even better, on Google Ngram viewer:

[https://books.google.com/ngrams/graph?content=is+released%2C...](https://books.google.com/ngrams/graph?content=is+released%2Chas+been+released&year_start=1800&year_end=2013&corpus=15&smoothing=3&share=&direct_url=t1%3B%2Cis%20released%3B%2Cc0%3B.t1%3B%2Chas%20been%20released%3B%2Cc0)

Hey, "is released" is more common than "has been released"!

</comment></comment></comment></comment></comment><comment><USER61> How can this tiny minor changes be worthy of a whole version number? Firefox is the software equivalent of the Zimbabwe dollar.

<comment><USER62> A lot of software is developed via some sort of agile software process these days. This means a new version of the software quite regularly, released on a time basis rather than a feature basis. This is what made version numbers meaningless. There are three common solutions:

time based: Ubuntu 12.04

increment the major number: Chrome 31

increment the minor number, never or rarely changing the major numbers: Linux 2.6.39

None of these solutions work well.

<comment><USER63> What is your solution then if these don't work well?

<comment><USER64> I'd suggest Semantic Versioning[1]: <major>.<minor>.<patch>

[1]: [http://semver.org/](http://semver.org/)

Major releases break the API, so programs that depend upon them may not work. Minor releases add or improve features while preserving existing functionality. Patches fix bugs.

This is exactly why having version numbers is important. Even if the number becomes arbitrary, it's existence is necessary to build dependency trees.

Aside: I'm not certain, but it seem as though Firefox does have a major.minor version scheme: my user-agent reads "Mozilla/5.0 ... Firefox/25.0"; Firefox 5.25 is probably the most correct.

<comment><USER62> Most, if not all releases of Firefox have minor API changes. Sometimes it's visible via HTML, sometimes they are only visible to plugins. By semantic versioning, 25.0 is the correct version.

</comment></comment></comment></comment></comment><comment><USER65> Firefox 3: Yay!

Firefox 3.6: Let's see what's new!

Firefox 4: oooh pretty UI (at least that's what most thought)

Firefox 26: _sigh_ another one?

I think only every 10 versions should be news. Since they moved to this useless release cycle (basically replacing bugfix releases with major releases), we should shift our news upvoting from major releases to major- major releases (i.e. treat the decimal sign as if it were 2.6x instead of 26.x).

<comment><USER66> For me personally FF 26 adds a major feature, specifically h.264 video playback in Linux. Finally I'll stop needing Flash to view videos on Vimeo (and a few other sites).

<comment><USER26> It actually was already available in 25, it was just off by default.</comment></comment></comment>


How do you get a job in North Korea? - <AUTHOR> http://www.nknews.org/2013/11/how-do-you-get-a-job-in-north-korea/ <comment><USER3> From what my parents told me, during the communist Bulgaria people have been quite happy with the "jobs assignment" process.

After graduation from college and if they are not going to continue their education they were given a list of available positions so they can pick few and they are placed according to their grades if there is a competition for a given position.

On the other hand, the less meritocratic positions(like blue collar jobs in factories) were often subject to placement-by-bribery. Many would like a position where they can steal stuff for themselves.

The seemingly meritocratic system gave them feeling of security but obviously the system was not working that well so the communist state collapsed and when it did, my parents lack of sense of the capitalist system left them in a limbo state. Those stealing, bribing folks did quite well in the communism-to- capitalism transformation period but many well educated people could not adopt and moved to well established capitalist economies where the meritocracy existed(at least they were finding jobs based on their credentials). However, at least my parents, never grasped the idea of entrepreneurship. They just don't have the basic instincts for doing a business and they failed miserably when they tried to start one. They are still working for other people.

If the North Korean government fails, probably the turmoil will last for generations, until new culture emerges through a new generation of young people who can have an idea about how a capitalist society works.

PS: We were from a discriminated minority, so maybe it was easier for the native Bulgarians however the North Korea seems to be much worse even than the last days of the communist Bulgaria.

<comment><USER4> I wholeheartedly concur. It was the same here in Romania.

Interesting anecdotes:

\- my parents (who studied EE) worked in a "research institute". Most of the research was taking electronics from the west apart and figuring out how they worked so that they can be manufactured in the "eastern block"

\- my first computer was a HC80 computer which was a ZX Spectrum clone

\- many big "western" companies were here trough local partnerships (Citroen -> Oltcit, Renault -> Dacia) just like IBM and Coca-Cola worked with the Nazis. Money trumps ideology always :-)

<comment><USER5> Yeah quite often they sold a couple of examples that where then ripped off - Rolls Royce found that out the hard way as the the Pilots in Korea shot down by MIG 15's with knockoff Jet engines

</comment></comment></comment><comment><USER6> I'm an american currently teaching Undergrad level CS in pyongyang.

Most of the students here know that they want to work at one of the two government research labs: Korean Computing Center, or Pyongyang Information Center. One of the Seniors told me he thinks he has an 80% chance of getting a job where he has access to the internet and an email address for communication.

Many of the anecdotes in the article fit with what I've seen here. I've been told that the going rate to get in to the top high school in pyongyang is about $5000US. One of the government liaisons working at the university studied Malaysian in college, and got told that there were too many Malaysian speakers when he graduated and was assigned to our university instead.

I think the main takeaway is that everything here is based on connections and who you know.

<comment><USER7> How did you get to NK, and ... why?

<comment><USER8> Whilst I can't speak for the OP, I got there on an aeroplane and left on a train. The means of getting there are pretty standard :)

</comment></comment></comment><comment><USER9> Fascinating. This article (esp the part about young people not even thinking about their future knowing its already decided for them) reminds me of the novel 'Never Let Me Go' by Kazuo Ishiguro. Great novel but one of the criticism directed at the novel is "why are certain characters so passive towards their condition", "why don't they do something about it"? An instilled sense of duty is indeed a very powerful motivator.

<comment><USER10> Every time I read about life in North Korea I'm reminded of "Meeks," a spooky little novel by Julia Holmes. Nothing in the book says it's about North Korea, but I think she must have been inspired by it.

</comment></comment><comment><USER11> Having just watched <I>Catching Fire</I> last night (I read the novels a couple years ago), and reading this piece this morning, I can't help notice the similarities between DPRK and Panem. Careers that are decided for you, fear-based policies, total control of the press and communication..

The difference is that in the movie, there's a sub-plot of all-out revolution, but in real life, the only thing we hear about that are in the dreams of North Korean ex-pats. I wonder how realistic revolution is, and how it would play out if it actually happened.

<comment><USER12> Welcome.

</comment></comment><comment><USER13> NK's problem isn't so much socialism as it is a horrendously managed totalitarian state and poverty.

<comment><USER14> The problem is that socialism and totalitarianism are separated only by degree. Socialism, by definition, uses government force to take resources/freedom/time/opportunity from some people and redistributes those goods to politically favored groups.

<comment><USER15> By your definition, every government that has ever existed is socialist. Consequently I doubt the utility of your definition.

<comment><USER16> by definition, every government has to be socialist to a degree. It's how far it's taken that really matters.

</comment></comment></comment></comment><comment><USER17> >Basically, people in North Korea do not have the freedom to choose their occupations. Once you're assigned a job from the government, it is your lifelong job.

The tour guide I had described in some detail the previous job he'd had - <USER2> weeks before becoming a tour guide. He worked at the zoo and was tasked with coordinating the exchange of animals with other countries.

He gave me the impression that he requested to become a tour guide too, in order to improve his English.

<comment><USER18> Why do you assume the government tour guide of North Korea would be honest? I'm sure it was a fascinating tour, but not one rooted in accuracy.

<comment><USER17> Equally, people who run away from North Korea might also be tempted to bend the truth, most especially when they're being paid to write about it.

A lot of what they said was clearly lies. This rang true though.

<comment><USER19> In a place with such tight information controls, why either of you would assume any of these people had any idea what the lives and information access of the others were like is beyond me.

I don't think it's any kind of contradiction to suggest that both of these things are true: That many people aren't given a choice, and that those who are do not necessarily know about the fact that others are not.

</comment></comment></comment></comment><comment><USER20> Not so much different than in some periods of old USSR - depending on time and place/sub-SSR, at times it was much more liberal, at times it was exactly like that.

</comment><comment><USER21> I can't help but sing the article title (which, in case it changes, is "How do you get a job in North Korea?") to the song from _The Sound of Music_ , "How Do You Solve a Problem Like Maria?".

</comment><comment><USER22> It baffles me that some people still support socialism.

<comment><USER23> I'm baffled by the nuanced analysis of the pitfalls of socialism you've presented.

<comment><USER22> You're pretty easily baffled.

</comment></comment></comment><comment><USER24> At least they have jobs.

<comment><USER8> Not as we define them. As we define it, a job is an exchange; the employee puts in work and they get back money and the like. What they have (as described in the article) is a legal requirement to be at their assigned place of work and do their assigned task, without getting back money and the like. That's more akin to slavery.

<comment><USER25> It seems that a lot of workplaces don't even have any work for the assigned workers to do (e.g. factories are out of raw materials), and no salary to pay, so the "employees" just go freelancing elsewhere. This is worse than slavery. With slavery, at least there's a general expectation that the master will feed his slaves.

North Koreans are getting the worst possible form of communism (indentured servitude in a micromanaged economy) and the worst possible form of capitalism (must earn your own survival, no safety nets whatsoever) at the same time. That's crazy.

<comment><USER24> Maybe just maybe because of all the embargoes by the rest of the world?

<comment><USER26> There are two giant economies that border NK, China and Russia, that do not economically embargo NK. But as is always the case with socialist workers' paradises, it's always the fault of external villains that they have any remaining problems at all. Surely it can't have anything to do with the internal policy of forcibly transferring decision-making power from the people to the political elite in Capital City.</comment></comment></comment></comment></comment>


Physicists planning to build powerful lasers that could rip apart empty space - <AUTHOR> http://www.sciencemag.org/news/2018/01/physicists-are-planning-build-lasers-so-powerful-they-could-rip-apart-empty-space <comment><USER2> Don't have sufficient background, but could a chain reaction of electron- positron splitting and gamma rays radiation occur?

I played with lasers, but whenever I read something more in depth like this, I am awed by the nature of light and photons. I especially like the bit of diffracting the laser beam to not damage the amplifier, and then bringing it back to together again - no damaged amplifier, but a high energy beam!</comment>


Linux Local Privilege Escalation via SUID /proc/pid/mem Write - <AUTHOR> http://blog.zx2c4.com/749

<comment><USER2> Well, that's mind-bending. I couldn't figure out how/where the actual exploitation of su happened since it seemed to require some careful synchronization, until it hit me: His exploit essentially starts up a process which, when it writes to stderr, is writing to its own memory. Then, it lseeks to the correct position which would cause su, when writing its error message, to overwrite its own exit() with shellcode. And then it just exec()s su with these preconditions, and it works. Dang.

<comment><USER3> Makes sense.

But this strategy for me begs an important question: why the <bleep> is it even possible to write directly to memory over an fd? I get that "everything is a file", sure, but you've already got ptrace for insane use cases that require trashing another other process's memory (i.e. a dev toolchain).

I've been twiddling bits in C(++) almost every day for over a decade and I've never once felt the need for such a feature, except when theorizing about exploits. Alas.

<comment><USER4> I have used the ability to write to /proc/pid/mem to _TEST_ safety-critical software intended for deployment on Linux systems. The apps I wrote were designed to ensure that altered binaries were not being run on the target system - in order to test the effectiveness of this "TEXT Segment check", I wrote many test cases to overwrite memory using this mechanism. Its useful in that context.

</comment></comment></comment><comment><USER5> This type of clever problem with confused trust relationships is remarkably common in OS Kernels. If you'd like to know more about finding, exploiting and fixing kernel bugs then I'd highly recommend Attacking the Core[1] as an introductory book.

[1] - <http://www.attackingthecore.com/>

</comment><comment><USER6> Clever. Reminds me of OpenBSD's rfork bug:

<http://www.openbsd.org/advisories/rfork.txt>

<comment><AUTHOR> I hadn't read about this oldie (97) before. Awesome! Good read.

</comment></comment><comment><USER7> The use of goto[1] in this code surprises me. Isn't use of it still generally shunned?

Appearing in the Linux kernel makes me reconsider my avoidance of it[2]. A quick google throws up a discussion with Linus in 2003[3] which can be summarised as: don't blame the tool, blame the programmer and as a tool goto has a place.

[1] XKCD comic on the subject <http://xkcd.com/292/>

[2] On my infrequent visits to C++ land, I generally live in Python land where goto doesn't exist.

[3] <http://kerneltrap.org/node/553/2131>

<comment><USER8> The reason why Linus Torvalds and others prefer to handle errors using goto is that it avoids the main branch of the code receiving an additional indentation, as it would if it were wrapped in a conditional. Not to do so would make the code less readable.

Note that these gotos are always local jumps (that is, they are in the same code block), at the same indentation level, and they are forward jumps (so the control flow is much the same as for a conditional). They are easy to understand and audit, and not similar to the goto examples that Dijkstra criticised for making code hard to reason about.

<comment><USER9> This. Also python's execeptions can be treated as limited goto's: <http://docs.python.org/faq/design.html#why-is-there-no-goto>

</comment></comment></comment><comment><USER10> [http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6...](http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=198214a7ee50375fa71a65e518341980cfd4b2f0)

The commit message (10 months ago) when the vulnerability has been introduced is quite interesting:

"With recent changes there is no longer a security hazard with writing to /proc/pid/mem. Remove the #ifdef."

I'm wondering how long it will take in a proprietary software without any good commit messages to discover such bug...

<comment><USER11> What makes you think that proprietary software doesn't have good commit messages?

<comment><USER10> I mean commit messages accessible to a large potential audience that could review them.

</comment></comment></comment><comment><USER12> Neat. I updated one of my VMs running debian Sid from 2.6.32 kernel to 3.2.0-1-686-pae just to see if it would work. It works on the 3.2 kernel. Kind of scary. I checked to see if I had access to any 'real world' servers running and exploitable kernel and none of them seemed to.

<comment><AUTHOR> Yulp >=2.6.39 :-)

<comment><USER12> Strangely, it doesn't work inside of screen. I'd bet that it's because of the parent ID?

</comment></comment></comment><comment><USER13> The presented vulnerabilities is so easy to exploit mostly because distros do not compile `su` with PIE and lose the ability to hide memory addresses with ASLR. Just few days ago there has been a discussion about how PIC/PIE is only a performance loss and should not be present in modern Unix systems.

[1] <https://news.ycombinator.com/item?id=3472618> [2] <https://news.ycombinator.com/item?id=3473068>

<comment><USER14> "because distros do not compile `su` with PIE"

Really? Every single distro I've tested has su compiled with PIE.

<comment><USER13> From the article:

> It turns out that su on the vast majority of distros is not compiled with > PIE, disabling ASLR for the .text section of the binary!

I tested on Ubuntu 10.04 LTS, likely to be installed on many servers, and 11.04. On these two versions `su` has not been compiled with PIE.

Edit: just to make things clear: in these Ubuntu versions su is compiled without PIE, but are not vulnerable because they have kernels < 2.6.39.

</comment></comment></comment><comment><USER15> Is a grsecurity[1] patched kernel safe? I only have a machine with a 2.6.32-grsec kernel, so I can't test the exploit.

In the features list they state:

        /proc/pid filedescriptor/memory protection

But I'm unaware how they implemented that.

1: <http://grsecurity.net/features.php>

<comment><USER16> it affects only 2.6.39 and up.

EDIT: sorry, misread the parent.

<comment><USER15> I know. I want to know if someone with a kernel >=2.6.39 and applied grsecurity patch can successfully use this exploit or if grsecurity protects from this exploit.

<comment><USER17> Just tried it on 3.0.4 with grsecurity enabled, and it didn't work, so there.

<comment><USER15> Thanks. I guess It's finally time for me to move every machine to a grsecurity kernel.

<comment><USER18> Would you be interested in a grsecurity distro?

<comment><USER15> I'd love to see up to date stable grsecurity kernel repositories for the major distributions (ubuntu, debian, rhel/centos) that provide patched versions of the distribution kernel. You can configure most of grsecurity via the sysctl interface. At the moment it is always a bit of hassle to patch & compile a kernel from hand even with the great debian/ubuntu kernel-package.

I don't think I'll use an extra distribution. But something like a hardened LAMP/LAPP stack for shared hosting out of the box in a distribution would be great (I think in terms of easy chrooting of users and php, secure permissions, etc.pp) However, I guess everyone has different needs and there is no one size that fits for all.

<comment><USER19> Why is grsecurity not merged upstream?

<comment><USER15> I don't know. I'm just on the end-user side. Just a guess from my (pretty limited) understanding of the issue: The grsecurity[1] patch includes PaX[2] that can break a lot of software. e.g. Java and X11 and there are sometimes other unwanted side effects as well. And I've found a blog post stating that the author does not want to maintain a upstream patch[3].

1: <http://en.wikipedia.org/wiki/Grsecurity>

2: <http://en.wikipedia.org/wiki/PaX>

3: [http://www.corsac.net/?rub=blog&post=1535](http://www.corsac.net/?rub=blog&post=1535)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> No workie here on ArchLinux:

        $ uname -a
        Linux sekhmet 3.2.1-1-ARCH #1 SMP PREEMPT Fri Jan 13 06:50:31 CET 2012 x86_64 Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz GenuineIntel GNU/Linux
        $ ./mempodipper
        </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>=
        =          Mempodipper        =
        =           by zx2c4          =
        =         Jan 21, 2012        =
        </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>=

        [+] Waiting for transferred fd in parent.
        [+] Executing child from child fork.
        [+] Opening parent mem /proc/3196/mem in child.
        [+] Sending fd 3 to parent.
        [+] Received fd at 5.
        [+] Assigning fd 5 to stderr.
        [+] Reading su for exit@plt.
        [+] Resolved exit@plt to 0x401a60.
        [+] Calculating su padding.
        [+] Seeking to offset 0x401a57.
        [+] Executing su with shellcode.
        zsh: segmentation fault  ./mempodipper

<comment><USER20> Also works on Arch with minor modifications.

Had to change 'exit@plt' to '<exit@plt' where it searches for the relevant function and change the program run from /bin/su to /bin/mount.

<comment><AUTHOR> Thanks for the improvement. I've made the < modification in this commit: [http://git.zx2c4.com/CVE-2012-0056/commit/?id=49174152d57ffc...](http://git.zx2c4.com/CVE-2012-0056/commit/?id=49174152d57ffc2fb7ab56b91211a3a0f78fbabb)

And made a separate branch for /bin/mount: <http://git.zx2c4.com/CVE-2012-0056/commit/?h=mount>

</comment></comment></comment><comment><USER19> There are a lot of local root exploits in Linux the past few years. But ever since Linux dropped the stable-unstable version numbering scheme, different distributions ship a wide variety of kernels + their own patches instead of "the latest kernel" because the latest may not necessarily be stable. How do I find out which local root exploits my distribution's kernel is vulnerable against, and how do I find out how quickly they get fixed? I'm on Debian 6 right now.

<comment><USER21> If you read the article it says that only versions >=2.6.39 are vulnerable.

</comment></comment><comment><USER22> On my system, all SUID binaries are executable yet not readable, e.g.

      $ ls -l /bin/su
      -rws--x--x 1 root root 52144 Mar  5  2011 /bin/su

Doesn't this effectively stop the exploit? It still works when I insert the <exit@plt> function address, but I don't think it's possible to trace this without root rights, which kind of defeats the purpose.

<comment><USER23> It doesn't stop the exploit, as it is still possible to use ptrace to essentially dump the binary, even though it's not readable.

<comment><USER20> Or if you know the distro, it is trivial to get the package containing the su executable and locate the address.

<comment><USER22> I compiled it myself, so that is not an option.

<comment><USER24> Presumably they only need to guess the flags you used then. There is really not all that much entropy there.

And I suspect doing so is fairly uncommon in production environments anyway.

</comment></comment></comment></comment></comment><comment><USER25> Tried this on 126.96.36.199 but it hung while waiting for the fd from the child.

      [+] Executing child from child fork.
      [+] Opening parent mem /proc/11045/mem in child.
      [+] Sending fd 3 to parent.
      [+] Waiting for transferred fd in parent.

I waited 2-3 minutes.

<edit> Argh, I need 2.6.39, sorry.

</comment><comment><USER26> Just tried this out on my ubuntu laptop (3.0.0-15-generic) and it worked like a charm. Scary.

</comment><comment><USER27> Very good read.. this post is actually "Hacker News", Seems my Fedora hosts are not susceptible as they compiled with -pie and the kernels at work haven't been updated in sometime.

<comment><AUTHOR> This version works on Fedora: [http://git.zx2c4.com/CVE-2012-0056/tree/mempodipper.c?h=fedo...](http://git.zx2c4.com/CVE-2012-0056/tree/mempodipper.c?h=fedora)

</comment></comment><comment><USER28> Arch Linux, 3.2.1

        ....
        [+] Executing su with shellcode.
        [1]    18663 segmentation fault  ./a.out</comment>


How To Get My Job - <AUTHOR> http://www.jerrypournelle.com/slowchange/myjob.html

<comment><USER2> Fortunately, since 1996, the task of getting Jerry Pournelle's job has gotten much, much easer: start a blog, write on a schedule, promote your content, and become popular. Then pitch the blog (and it's topic) to the publishing venture of your choice.

</comment><comment><USER3> Pournelle is the guy who said, in the 80s, "By 2000, anybody will be able to get the answer to any question (for which there's a known answer)." (Possibly a paraphrase; I stopped looking when I found a quote).

</comment><comment><USER4> Anyone else notice how this kind of overlaps with the recent Malcolm Gladwell book's thesis?

[http://www.guardian.co.uk/books/2008/nov/15/malcolm- gladwell...](http://www.guardian.co.uk/books/2008/nov/15/malcolm-gladwell- outliers-extract)

</comment><comment><USER5> Jerry helped end the Cold War. <http://www.nss.org/adastra/volume13/butrica.html></comment>


Ask HN: Best way to respond to "What is your name?" - <AUTHOR> Perhaps I'm just tilting at windmills, but does anyone else think that it's stupid/annoying/pandering/insincere/invasive for a business to want to put your name into their database when it is not necessary?
Why does Burger King ask for your name when you order a burger?  AT THE DRIVE-THRU!?!?  The same goes for Taco Bell.  THE TACO DOES NOT NEED TO KNOW MY NAME!  Your company doesn't need to know my name in order to give me a haircut.  Harbor Freight, I don't need to give you my name (and phone#, and address) to buy a screwdriver, even though you ask me for them THREE TIMES during the same checkout.  I don't care about your loyalty programs.  I'll keep the receipt if I need to return it.  The list goes on and on...
I don't want to be rude to the person behind the counter; they are just doing their job.  But how do I express to the company how UTTERLY infuriating it is becoming to be constantly prodded.
The simple answer is to just not go to those places.  Which means that now I have to cut my own hair, grow and cook my own food, build my own tools, and never buy anything ever again.  Surely there is a better solution! <comment><USER3> Here are some options f you don't want to use corvallis's suggestion.

"John Smith, 123 Main St."

Back when Radio Shack started doing this, my Dad like to give them the store's own address.

There's no reason to give your legal name. Some hikers have trail names - <USER2> can have a business name.

Say, "I'm visiting from overseas. I live in Germany. My address is Willy- Brandt-Straße 1, 10557 Berlin and my phone number is country code 49, then 180 272 00 00." Or use a UK address so you can give them a post code lik "SW1A 2AA".

There are phone numbers like [http://rejectionline.com/copycat.html](http://rejectionline.com/copycat.html) which are used to be given to people pestering for your number.

The main reason I know of for asking for a name is to reduce mixups in ordering. For that they only need a relatively unique token. You could give them a new name each time.

The main reason I know of for collecting zip code/address is for marketing purposes, either to gather demographic information, or for advertising.

</comment><comment><USER4> > Why does Burger King ask for your name when you order a burger? AT THE > DRIVE-THRU!?!? The same goes for Taco Bell. THE TACO DOES NOT NEED TO KNOW > MY NAME!

Must be trying to make sure that they give the right order to the right person. I don't think that this is pernicious. I also suspect that it's ephemeral data unlikely to be used for much beyond the scope of this location on this day.

> Harbor Freight, I don't need to give you my name (and phone#, and address) > to buy a screwdriver

They only ask me once and I usually decline with "no thanks" and the transaction occurs without much friction.

</comment><comment><USER5> I just say "I'd rather not give you my personal information." The transaction is completed without issue. Try it, it's much easier than cutting your own hair and growing your own food.</comment>


The Last Days of Target - <AUTHOR> http://www.canadianbusiness.com/the-last-days-of-target-canada/ <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=10956638](https://news.ycombinator.com/item?id=10956638), which ended up being the more active discussion.</comment>


The Results are In: Final Linux Distro Scorecard Revealed. - <AUTHOR> http://www.linux.com/news/enterprise/biz-enterprise/313442-the-spring-2010-distro-scorecard-part-2

<comment><USER2> For comparison, I think they should have included Centos in the scorecard. It's a popular good distro.</comment>


No Secret Software! - <AUTHOR> http://www.tbray.org/ongoing/When/200x/2008/07/27/No-Secret-Software <comment><USER2> Am I alone in having serious doubts of the ability to have an open source implementation of a voting machine?

The problem is that to have any benefit from having an open source solution, _all_ of the code in the system needs to be open source, including all of the drivers etc. As drivers need to be adapted to the specific hardware that they run on, it is normally only the manufacturer of the equipment that can write them. Think video drivers in Linux, as an example. Hardware manufacturers probably see little commercial advantage in providing their source code, and even if they do, there is no guarantee that what they give out as source code is really what they have loaded into the voting machine.

<comment><USER3> It's not about them seeing the "commercial advantage" in free market terms; it's about mandating a particular approach (in this case, open hardware and software from top to bottom) because it's the only way to insure that the basic infrastructure used in elections _works_. This is not a case where the whims of the market should decide the approach taken.

If no one gets rich on the design and implementation of electronic voting systems, that's _fine_. I'd rather see it run by well-intentioned, poorly-paid academics within a strict peer-review model than by unknown private entities.

</comment></comment><comment><USER4> In The Netherlands a group has succesfully fought against the use of voting machines with secret software. For now the use of voting machines is not allowed anymore and the Dutch people have to vote using pen and paper. More info: <http://www.wijvertrouwenstemcomputersniet.nl/English>.

"On May 16, 2008 the Dutch government decided that elections in the Netherlands will be held using paper ballots and red pencil only. A proposal to develop a new generation of voting computers was rejected."

<comment><USER5> I'm not averse to voting machines provied:

* The code is publicly available

* The code is publicly verifiable - eg, every voter is provided with a 'voting receipt' with a non-identifying UUID and their voting results. Users are allowed to look up this info online at any time they wish.

<comment><USER6> think again. <http://cm.bell-labs.com/who/ken/trust.html>

<comment><USER5> This is a classic, but how does it relate to my post? Are you pointing out that a trojan could still be hidden in public code?

If so, I agree. But I think making that code public reduces the risk of it being malicious. Eg, for one you've already made it so that the malware must be implemented as a trojan, rather than being obvious. The other is the code would be under massive scrutiny (hopefully without the developers OKing changes without actually looking at what they do, ala OpenSSL).

<comment><USER6> Read again. You cannot trust code, and making it public is almost irrelevant in this regard. You need the full resources of an "emerging" country, like China, to fully develop your own (e.g. Longsoon).

"Moral

The moral is obvious. _You can't trust code that you did not totally create yourself_. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. _A well installed microcode bug will be almost impossible to detect_."

I would be awfully surprised, if people who made millions (from Verisign) by "looking" at ssl would have made that kind of a mistake (effectively freedom frying the French National Guard).

<comment><USER7> Certainly, everything can be hacked, but if the code is running on a machine using standard off-the-shelf hardware, and running OpenBSD or another equivalently open *nix distro, and the code is interpreted code running on that machine, using the standard interpreter from that (open) language, then the chances that someone might manage to introduce a hack are heavily reduced, due to the number of eyeballs which can verify that the code is safe.

I agree that you have to look at every element of the chain, but my point is that you can construct such a trusted chain that goes all the way from the hardware to the vote-tallying software. There is still some potential for hackery in the hardware, but that could also be ruled out by designing and implementing some open hardware - a project which, I'm sure, would gather plenty of support from the open source community.

<comment><USER6> you still look @it as a technological problem. It isn't. It is a social (moral) problem, thus cannot be solved by any interpreter, BSD fork (which deceivingly, towards the BIOS pretends to be Windows ;) etc.

<comment><USER7> The social problem exists whether or not you have e-voting. It has been solved to a satisfactory level already by having election observers, etc.

One of the cool things about social problems is they don't need exact solutions. If you can solve things for 99.9% or even 99% of the cases, that's considered good enough when it comes to people

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> What blows my mind is how fubar the voting machine industry has been when it has a model example of regulation in the gambling machine industry. I realize that some of the technical design goals are different but many of the regulatory aspects are extremely similar.

Reliable and trustworthy voting is the linchpin of democracy. There is no excuse for voting "irregularities" in this day and age.</comment>


Will Android Succeed - <AUTHOR> http://www.typepad.com/site/blogs/6a00e00981da57883300e00981da5d8833/post/6a00e00981da578833016762717e22970b/edit?saved=e

<comment><USER2> Moving to the TypePad sign in page not good:(</comment>


New Book: Ionic in Action – Hybrid Mobile Apps with Ionic and AngularJS - <AUTHOR> http://manning.com/wilken/?a_aid=yauh&a_bid=1f0a0e1d

<comment><AUTHOR> Also you can get a 50% discount as an early adopter when using the code mlwilken</comment>


Science, American legal system confirm barefoot shoes are bullshit - <AUTHOR> http://www.vox.com/2014/5/9/5695290/science-american-legal-system-confirm-that-barefoot-shoes-are-bullshit <comment><USER2> No, they didn't confirm that barefoot shoes are "bullshit", only that there's not enough research to support Vibram's claims, much like there's not much research to support traditional shoes, the raised heels of which are descendants from medieval times when heels were used for stability in the stirrups of a horse, allowing the rider to shoot a bow while in motion (and in modern times, allow you to appear taller than you really are).

</comment><comment><USER3> Don't wear them, I have no skin in the game. But those two movies of runners, one with shoes and one without, are not convincing. Anybody who hasn't run barefoot all their life is likely to adopt a conservative, mincing gait. Doesn't prove anything about the indian tribe referred to. Unless that movie was of one of them, which I doubt.

</comment><comment><USER4> I've run in minimalist shoes (puma H-street, not the five fingers) for years and significantly prefer the experience to the heavy, inflexible Nike / New Balance shoes.

I have a forefoot strike though. Wouldn't recommend using "barefoot" / minimalist shoes if you're a heelstriker.</comment>