I decided to disable AMP on my site - <AUTHOR> https://www.alexkras.com/i-decided-to-disable-amp-on-my-site/ <comment><USER3> There's a lot of backlash against AMP on principle, which I agree with and support. However, as a non-principled web consumer, I think AMP pages are 10x better than the ad-filled, slow as molasses, jump-around-as-JavaSript-loads, video autoplaying, 'stories you might like' suggested bullshit, auto-loading 20MB heaps of steaming garbage that current news sites are. I think that AMP is a stepping stone that shows the user experience that people want but lights a fire under web developers to give them that experience without relying on Google's walled garden. How many stories of "Company X made a great product Y, but Company X is anti-consumer/evil/eats puppies, so the OSS made their own and it has grown into something great" have you heard? I think AMP is another one.

The web has become bloated, where people use heavy JS frameworks like React to make their blog and then load 5MB of ad JS to load 10MB autoplaying videos. I dream of a day when static site generators like Hugo and Jekyll are the norm. Let's flex our muscles and make that happen and show the world that AMP is good but openness is better.

<comment><USER4> > However, as a non-principled web consumer, I think AMP pages are 10x better > than the ad-filled, slow as molasses, jump-around-as-JavaSript-loads, video > autoplaying, 'stories you might like' suggested bullshit, auto-loading 20MB > heaps of steaming garbage that current news sites are.

You don't need AMP to get rid of them though. We can appreciate that Google _encouraged_ developers to get rid of bloat __AND __to opt-in for AMP, but that doesn 't make AMP _technically_ superior. I think we should give a critique of ourselves and ask why did we wait for a corporation G to push us to get rid of the bloat we created?

<comment><USER5> _We can appreciate that Google encouraged developers to get rid of bloat AND to opt-in for AMP, but that doesn 't make AMP technically superior._

Depends what you mean by technically superior. In terms of benchmarks, AMP pages are lightning fast. Isn't that the only metric that matters?

<comment><USER4> I meant that you could achieve the same by reducing the bloat, applying the best practises etc. To be fair, Google has been encouraging people to do so through the PageSpeed suite for quite a long time...

What I found unfair about AMP is Google preloading your AMP-enabled webpage. So that even if your not-AMP-enabled page is equally efficient, an AMP-enabled page would feel faster because Google preloads it in the background. And then there is the fact that Google hosts your own content under their domain, and all other points raised in the article.

<comment><USER5> Right, but users don't care about the reasons why it's faster. They just know it's faster. Hence they use AMP, and AMP gains traction. We can say it's unfair, but that's life.

If we want to defeat AMP, we have to beat it at its own game. That requires us to come up with an alternative that's equal or faster than AMP. And clearly we've failed as developers to push for non-bloated solutions.

It might be possible to create our own version of AMP -- to take the best ideas from AMP and integrate it into some centralized system that isn't controlled by Google. It'd be tough, but the alternative is to let AMP steamroll us. A few rebellious developers aren't going to make much difference in terms of total AMP adoption.

Even if the AMP alternative was just a standard way of stripping bloat from websites, that might get us 50% of the way toward beating AMP.

<comment><USER6> Isn't AMP itself just a standard way of stripping bloat from websites? You could take the AMP library, include it in your web page and do anything you want with it.

What is the precise element of AMP you are trying to beat?

<comment><USER5> I think people are uncomfortable with the idea of Google controlling every aspect of your website down to the presentation. It'd be better for this to be centralized and standardized independently of Google's tendrils.

Part of what makes AMP fast is the preloading, so any AMP competitor would need to tackle that problem. You'd also need to demonstrate that websites rank better if they use your solution. And they should, if Google plays fair. If not, then at least this would be a public demo of that fact.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> The author has some very valid points against AMP from a technical standpoint, but for me there is a single reason that is sufficient: _the Web is, and should stay, free and open_. Indeed, I'm having really hard time trying to understand how people can be fine with AMP while fighting for the net neutrality and so on.

<comment><USER7> I fail to see what, in AMP, makes the web less free or open. I am usually among the first on the stockade on invasive tech, but I have a hard time to understand the fuss around AMP.

Yes, the cache is problematic, as it may allow Google, in a possible future, to filter some content, censor some other or not refresh often some pages. The thing is, if it does that, people will start using Google's caching, that's as simple as that.

<comment><USER8> > _I fail to see what, in AMP, makes the web less free or open._

Google serving your pages?

Hijacking your domain for the server pages and obscuring links to the original content?

Use of a proprietary technology (whether open sourced or not, it's not a standard)?

Abuse of power with veiled threats of punishing content publishers who are not using recommending AMP to make their pages "fast and responsive"?

The only way to be any more against the free and open web is if they made Google search a web proxy where you never get access to the underlying page...

<comment><USER9> > The only way to be any more against the free and open web is if they made > Google search a web proxy where you never get access to the underlying > page...

Give it some time. They are pulling more and more content into the search results pages which has roughly that effect, since people no longer click through.

<comment><USER10> Interestingly, assuming it works well, that's kind of exactly what I want as a user. Whenever I'm searching for one of the following (which form a large fraction of my searches):

      - definition of a word
      - lyrics of a song
      - summary of a movie
      - phone number and/or address of a business
      - distance between places
      - unit or currency conversions
      - <USER2>

I have no desire to "click through" to anything. I want my piece of information, a raw fact. That I have to select from various providers, each with their own (non-standardized) UX and possibly various "value-added" crap like ads and popups, is at best a nuisance, at worst a big time-waster. In this way, the "content providers" are becoming annoying middlemen between me and the information I seek.

So while I don't want to see Google monopolizing the Internet, I also don't like the model in which information is served by individual web pages (which can, and do, disappear all the time and get replaced by something different). So I wonder - how can we promote and develop the open web, while also making it better and more productive for people?

Maybe if people served data streams instead of web pages, things would be easier? Related, I'm all for every kind of way of taking control over the way a page looks _away_ from their authors. The Web is increasingly becoming a place for designers to show off, and this wastes both users' time and resources. Ad blockers, noscript and reader modes are huge wins in this space, but I think we need more. Maybe some self-hosted auto scrappers that would help me answer my information queries _without_ actually visiting full pages?

<comment><USER8> > _I have no desire to "click through" to anything. I want my piece of > information, a raw fact._

Do you also want the original content creators to starve and die off and the only competent content source left to be either Google's archive or Google's lacklustre service for the same thing?

<comment><USER10> As I said many times in discussions about ad-blockers - I think that content that can't exist in a non-ad-supported way can stop existing, we'll all be better off. Almost anything that's valuable on-line is either a marketing expense or done pro bono.

Also, I didn't mean I want a Google-dominated reality. Only said that this particular feature - content in search results - is a step in the _right_ direction; it showcases a better way to use the Web. The reality I want is made of free and open-source tools doing that, not Google.

<comment><USER11> > I think that content that can't exist in a non-ad-supported way can stop > existing, we'll all be better off.

I'm not sure what is stopping you from doing that now. You can blacklist domains that serve ads and stop visiting them. Or even better yet, hire someone to write a browser plugin that blocks websites with ads, should be fairly trivial to do. And release the source code so others can benefit.

<comment><USER10> It's even simpler and I alerady do it - all it takes is to install an _ad blocker_.

<comment><USER11> Right, I thought you were principled. My mistake !!

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> AMP is bad and should be resisted. It is an attack on the distributed nature of the web.

The web is slow because every page of text comes with megabytes of javascript cruft to spy on users and serve ads. The solution is to make web pages that don't suck.

AMP puts even more power in the hands of Google. Just say no.

</comment><comment><USER13> To me, AMP is the same wallet garden that Facebook is.

Google and Facebook both say: "Give us your content. But without the crap. Just the content. Since we don't allow crap, users prefer the experience over here. So your content will have more readers then on your own domain.".

And for some reason publishers are crazy enough to do that. Instead of removing the crap on their own domains in the first place.

<comment><USER14> you are forced to login to FB, is the same true with AMP?

<comment><USER13> Whatever Google wants you to do to access the content. Once it is on their domain, they have full control over it.

<comment><USER14> so, do you need to log on to access AMPs content?

<comment><USER15> Not yet.

<comment><USER16> What a relief.

</comment></comment></comment></comment></comment></comment><comment><USER17> > It "traps" users on Google. If user were to click "x" in the screenshot > above, they will be taken back to Google search results. A normal redirect > would have landed users on actual BBC site, maximizing their chances of > staying on that site. Instead, AMP makes it easier for users to return to > Google.

As a user, this is what I want. I don't care about the BBC's site, I care about what I searched for. If I want to see their front page, I'll go to bbc.com.

I think this article (and most AMP-bashing articles) are mostly fluff about how Google is "taking over" and "forcing" people down a certain path. When in reality everybody knows this is helping users.

As I've said many times: propose a better solution for users to be able to load article content very quickly.

The real, valid issues I'm seeing mentioned in this article are:

* Links are to google.com, which really screws up sharing.

* Apparently images and scrolling can be wonky, though I have never noticed this myself (and sounds like it could be easily solved[0] if it's true).

So again, if you can solve this problem for users in a free, publisher-opt-in, global way without the links pointing to a third party, please share your solution.

By the way, if you use CloudFlare, you can enable AMP without breaking normal links[1]. It is only the Google search engine that breaks links for AMP, not AMP itself.

I do hope that Google adds an option in your account settings to opt-out of AMP results. That way the detractors can turn it off, and everyone else can be happy that pages load in < 1 second instead of 4-5 seconds.

[0] [https://github.com/ampproject/amphtml](https://github.com/ampproject/amphtml)

[1] [https://blog.cloudflare.com/accelerated- mobile/](https://blog.cloudflare.com/accelerated-mobile/)

<comment><USER18> > scrolling can be wonky

Last time this came up someone linked to a Google employee submitting a bug report to Apple about the scrolling. Their response was "that's how it's supposed to work - the rest of the system is wrong and we will fix that". So iPhone users might not have much choice anyway soon!

Kind of reminds me of how terrible mouse acceleration is on OSX, and how Apple gradually removed all the options for fixing it - now the only option is to install a completely different commercial mouse driver (SteerMouse).

<comment><USER19> I'd be shocked if Apple's official stance was that tapping the status bar to scroll to the top of a page is wrong and should be fixed.

<comment><USER20> The person you are replying to is talking about the scroll speed.

</comment></comment></comment></comment><comment><USER21> @alexkras Sorry this comes from me in Nigeria using a second-hand MotoG (1.Gen). May be your website is not loading 23 trackers + unnecessary js. But many websites, load such crap. Please especially in third-world, we have so poor phones. Only google-CDN avoids all these. (yes, google does track me but we do not all have unlimited bandwidth).

<comment><AUTHOR> Thank you for your response, and I am glad you find helpful and I am sorry that I speak up so much about it. Use cases like this is the only reason I've kept AMP on for so long.

Have you tried disabling your JavaScript and if so could you share your experience with that?

<comment><USER21> Well thanks. Many websites do not work without js. Also, I can everytime go to settings (android/chromium) and disable js. But a standard user? She/he does not know much. Pays a lot for data + have possibilty of nagging install my app in lower section of page. google-amp-CDN solves a lot.

</comment></comment></comment><comment><USER22> > On iPhone, AMP seems to override the default browser scrolling. As a result > scrolling of AMP pages feels off.

Good news! iOS 11 fixes this. Safari actually has an inconsistent scrolling speed compared to the rest of the OS. iOS 11 makes all Safari pages scroll at the same speed as AMP sites (-webkit-overflow-scrolling: touch)

Also important distinction for people to remember - AMP is two products:

\- CDN with preloading pages in Google Search results

\- Framework/guidelines for building performant results

The 'morals' and impacts to the 'free and open web' of these two are completely different.

<comment><USER23> Re: two products, I realized this but never really thought about it. Can one self-host an AMP (framework) implementation? Does Google still promote such content, even if it isn't part of their CDN?

<comment><USER22> Sure. It's just a stricter subset of HTML and a JS library for custom components. Self host it.

No, Google won't give you the special AMP-bolt - nor should they because they can't provide the instant load as they can for other AMP sites that they self- host on their CDN.

<comment><USER23> That's where I have trouble accepting AMP. I love the concept and Google's support would be huge, but Google doesn't seem to be truly promoting making the mobile web better with AMP. They are promoting making the mobile web better with their CDN (i.e. by centralizing/controlling the content).

</comment></comment></comment></comment><comment><USER24> I have a visual impairment and one of the things I love about Chrome on Android is the ability to override sites blocking pinch to zoom (i.e. "force enable pinch to zoom").

AMP, also made by Google, seems to somehow get around this browser setting, making AMP sites unreadable and therefore completely useless to me.

Why does Google have these obvious discrepancies between their own products?

<comment><USER25> Google's approach to design has always seemed to be to wall off a bunch of teams in separate soundproof rooms with no communication with each other, meetings, or contact with the outside world. Also they're only allowed to use iPhones.

This is the only way I can imagine we ended up with 437 different messaging apps and counting, and the problem you described.

<comment><USER26> > Also they're only allowed to use iPhones

Why is that? Seems a bit ironic...

</comment></comment></comment><comment><USER27> Funny thing is - I, as a reader, _love_ AMP sites. If a website offers AMP, I will prefer it from normal thing.

It has less ads, less bloat, better signal/noise ratio, and the AMP websites look pleasant to eye. So I prefer them even on desktop, ironically.

I still have the issues with Google's AMP caching. But AMP itself is _great_.

<comment><USER28> You can use Firefox and have 0 ads with uBlock Origin.

<comment><USER27> AMP sites still look better.

I am using this simple extension that shows me when a website has AMP version and I switch to it (not sure if there is an extension that does this automatically). Doesn't work 100% though

[https://chrome.google.com/webstore/detail/amplifier- ampcanon...](https://chrome.google.com/webstore/detail/amplifier-ampcanonical- sw/ennckgigejppolagdoadgaaodkhopjnb/related?hl=cs)

edit:

oh, this one seems to do it automatically. Nice

[https://chrome.google.com/webstore/detail/%E2%9A%A1%EF%B8%8F...](https://chrome.google.com/webstore/detail/%E2%9A%A1%EF%B8%8F-desktop- amp/igokgmnkplcfgnegidccbgmlnecaffhh/related)

<comment> yoz-y The problem that the tech to make any page look like an amp page existed long before amp. But Google, rather than heavily penalising heavy websites decided to push AMP. They could have just pushed for normal HTML but no, now everybody has to write two versions of the pages. (Granted, à cms can handle generating AMP alongside RSS and so on)

<comment><USER27> Yeah, everyone can do non-bloated websites that load fast and look good, but nobody does. Market doesn't value those? I don't know.

AMP is a good idea, unfortunately it needs strong actors like Google or Twitter to push it.

</comment></comment></comment></comment></comment><comment><USER9> Why would anybody enable it to begin with?

There is absolutely no reason for sites such as the one linked here to have AMP enabled. It's a pox on the web and Google has enough power as it is. The sooner AMP dies the better. If you want your site to load faster _get rid of the cruft_.

<comment><USER29> I enabled it on [https://www.gitignore.io](https://www.gitignore.io) a few months ago because it suggested that it would improve my mobile users experience. After posts like these, I think it's time to take it back down.

<comment><USER30> Only an anecdote, but AMP trashes my mobile experience. Using Chrome on Android (so it ought to be good...) it rewrites back-button functionality, so that even after I've changed through 5 different pages, a single 'back' press takes me all the way off the site to Google search results. It also eats a bunch of screen real estate with the AMP bar for longer than the normal address bar.

</comment></comment></comment><comment><USER31> There's a deep irony in AMP also, purely anecdotally it doesn't seem to help with slow connections. I'm traveling and as such my US carrier restricts me to 2G speeds while roaming somehow, which is resulting in me seeing a lot of butchered pages. As the author mentions:

> AMP tries to load an image only when it becomes visible to the user, > rendering a white square instead of the image. In my experience I've seen it > fail fairly regularly, leaving the article with an empty white square > instead of the image.

Text content is very fast, but images either don't load or partially load making the reading experience pretty poor.

<comment><USER32> You're saying that AMP doesn't help with slow connections, based on AMP not loading all resources on 2G. But you're missing the data point for non-AMP pages on 2G. Are you sure it's not even worse?

It's hard to believe how bloated many modern websites are, before trying to load them over 2G. We're talking megabytes of data and tens of connections to display what should be a 20kB of text.

<comment><USER33> AMP puts 100KB of JavaScript in the initial render path, and a bunch of CSS. That doesn't mean that other sites cannot be worse but it means that there's no way to make an AMP page which doesn't require transferring at least that much data.

I notice this fairly regularly in marginal network coverage (subway tunnels/platforms) where AMP pages load no faster than any well-optimized site unless the stars are aligned and you actually get a cache hit.

<comment><USER34> Keep in mind that this AMP JS library is being loaded from the CDN only once for all AMP pages, then cached in the browser.

<comment><USER33> If that works. In my experience, you're eating the initial DNS lookup, connection and SSL setup, etc. more frequently than expected.

The general rule about inclining render-blocking resources matters here, too.

</comment></comment></comment></comment></comment><comment><USER35> The author is dead-on. I wish more publishers would resist and stop supporting AMP. As an end-user I dislike its UX and how it obfuscates the actual source in links I send and receive. Its man-in-the-middle approach is also highly undesirable.

I've found one way to mostly work around it while still using Google as my default search engine and that is to use encrypted.google.com. Obviously this doesn't remove AMP from links sent to me but it's something.

I'm sure it's only a matter of time before Google closes that loophole.

</comment><comment><USER36> Since your site is actually going through Google's cache, they could add any additional tracking, etc they like, I'm sure they're already doing this. If you don't run Adsense or Google Analytics or anything else Google JS already on your site this gives them a new opportunity to further track users behaviour with a seemingly "friendly" mobile method. It's all about tracking users and selling more ads while keeping eyeballs on Google. You're giving up control of your own site and brand, at a great expense, for their benefit.

No thanks.

<comment><USER37> > I'm sure they're already doing this.

Could you verify that? It should be a matter of popping open the Developer tools.

<comment><USER38> Well since the AMP cache is hosted exclusively by Google they already have the request logs to all those files. That contains your User-Agent header, your IP address, language and maybe cookies if they set those in the future.

</comment></comment></comment><comment><USER39> Good! I stand firmly against AMP and the centralisation of the web, it's a predatory move to increase Google's prevalence online, and one I will not be supporting with any of my upcoming projects.

<comment><USER40> You remember Akamai, right? AMP is just another CDN. Back in the 90s, when Akamai was fighting to establish themselves, you'd see tons of fetches from hosts like a123.d.akamai.com on big name properties like CNN. Nowadays it's pretty much hidden, and pervasive.

Google is attempting to entrench a reverse proxy cache the same way Akamai has for years. AMP is nothing new. The only difference here is that they make it obvious you're using a CDN, whereas Akamai is almost completely transparent and runs close to 80-90% of the traffic of the "open" web -- you just don't know about it.

<comment><USER38> Yeah but Akamai is optional. Google's CDN / cache in AMP isn't. Big difference.

<comment><USER41> How is Akamai optional for a user? If you're saying that it's optional for publishers, then your argument doesn't make sense since AMP is optional for publishers as well (I mean, the author disabled it and all).

<comment><USER38> It's not when the technology gives you an advantage in search ranking through the AMP green square in the search results and the quick answer tiles.

</comment></comment></comment></comment></comment><comment><USER42> Maybe I don't understand AMP, but what value does it bring over having a very lean CSS and keep JS to the strict minimum? Last time I checked, a plain vanilla HTML page with a bit of embedded CSS (and perhaps a few _async_ JS functions for stats) is lightning fast even on mobile.

<comment><USER43> That's the problem: no one is using plain vanilla HTML pages with lean JS/CSS anymore. Just go to any news website, disable your cache, disable any adblockers you might have and see the total data transferred or number of network requests.

Example: [http://edition.cnn.com/2017/06/26/middleeast/western-wall- is...](http://edition.cnn.com/2017/06/26/middleeast/western-wall-israel- netanyahu/index.html)

That link is in the frontpage of cnn.com right now. I disabled my cache, disabled uBlock and refreshed the page. 329 network requests and 3.9 megabytes of data transfer later, the page is still loading.

</comment></comment><comment><USER44> Amp was the reply to Facebook articles the problem was because Facebook pages loaded faster more people were posting and sharing Facebook pages which is worse than Google Amp.

<comment><USER45> Back when FB release FB Instant, it increased my engagement with shared links significantly. Usually, on a phone browser, the thought of clicking on a link which would navigate away from the app and load a heavy full-fledged website would make me not want to click on shared links at all.

But with the lightning symbol next to Instant-supported links? Click right away. In the worst case, if the content is bad, you will back where you were in a second.

</comment></comment><comment><USER28> The fact that website content is stored on Google servers and being served from Google is just disgusting.

<comment><USER46> Giving you free hosting all across the world, much closer to your users, is disgusting?

Unless you're hosting a webserver on your computer, your server is most likely being hosted in the cloud somewhere (aka some random computer somewhere in the world). How is it being on a Google server, instead of company X's server, suddenly disgusting?

<comment><USER47> Because such centralization gives Google immense power. The sheer potential censorship implications alone are very concerning, for example.

<comment><USER46> By that logic, does AWS have huge amount of power? Why does it matter what server the content is hosted on? Aren't almost all websites hosted on a remote server? The only difference is Google gets to choose what shows up on their search, and they always had that control anyway.

<comment><USER48> Yes, AWS has a huge amount of power, and no, they shouldn't have it. You need an economy of small businesses to allow innovation and startups. No startup can compete in an economy full of big players.

</comment></comment></comment></comment></comment><comment><USER49> > Do you own a WordPress site? Turn AMP off or don't enable it in the first > place.

A warning - I turned off the AMP plug in and it effectively removed my site from Google for a week or so.

[https://shkspr.mobi/blog/2016/11/removing-your-site-from- amp...](https://shkspr.mobi/blog/2016/11/removing-your-site-from-amp/)

The Google cache takes ages to clear away all the now-dead links and will serve 404s to your users. A nice incentive to stay trapped in their monoculture.

<comment><USER50> I'm curious, besides the short term problem, how was your ranking affected overall?

<comment><USER49> Hard to say. The 404s have dropped off, and I still appear in the results. But I'm not sure of any way to tell definitively.

</comment></comment></comment><comment><USER51> > On iPhone, AMP seems to override the default browser scrolling. As a result > scrolling of AMP pages feels off.

Oddly enough Apple is changing the scrolling behavior in Safari for iOS 11 to scroll how the amp pages do.

[https://www.macrumors.com/2017/05/22/scrolling-changes- comin...](https://www.macrumors.com/2017/05/22/scrolling-changes-coming-to- mobile-safari/)

</comment><comment><USER52> I think every site should get an amp logo in Google search results and preference (same as an amp site) if the load time of the page is under 100ms. So now you have a choice, either DIY or use Google's tech to get it.

This way will create dozens of tech companies competing with AMP focused on making the web faster - the end result that Google supposedly wants and everyone wins!

<comment><AUTHOR> Great idea

</comment></comment><comment><USER53> AMP has all the charisma of Silverlight. When I see it, I am impelled away from it, and toward anything closer to normal, no matter how ugly or slow.

</comment><comment><USER54> AMP is coming for ecommerce next. Will there be checkout options other than Google? What's going to happen when voice interfaces take over. Amazon Echo already prioritises its own products.

I've switched to Firefox and DuckDuckGo and started moving non-tech people over (and they seem happy enough too). It's not in our interest to let the whole tech market consolidate into 5 walled gardens

<comment><USER55> I've just done the same myself. I am also having everyone I know use FF and DDG where possible.

</comment></comment><comment><USER56> AMP somehow doesn't work right on my smartphone.

When I go to news.google.com an click of any of the AMP links on the front page, I always get thrown back to news.google.com when I scroll on the AMP page.

<comment><USER57> And frustratingly, you can't background-open AMP links from Google News. Instead, AMP articles open wuth their own (annoying) navigation, where swiping goes a completely different article.

</comment></comment><comment><USER58> "I would use a browser with javascript disabled".

See, this is the point where AMP provides actual benefit. Many sites don't function _at all_ without JS. AMP gives me a site that actually works without the extra crap.

<comment><AUTHOR> Valid point, but a surprising amount of sites do work. I.e Reddit, BBC, All Wordpress sites. The kind of content you would consume on a cheap phone and a slow connection.

JS in my mind is for fancy apps like Google Maps (non amp) and serving ads.

</comment></comment><comment><USER59> I've read quite a lot about AMP, but I still don't really understand for what technical reason a new markup language (AMP HTML) and an additional javascript library is required to achieve the (claimed) effect.

More specifically: Is there any evidence that AMP is able to provide a better result (at least in terms of performance) than just using a small subset of standard HTML, a little bit of CSS, getting rid of any javascript, and ensuring that the total page size is less than 100KB? If yes, I would be interested in the technical reasons.

<comment><USER34> AMP JS library enables lazy loading of images/videos, so if you have a page with tens of them, you will notice the difference.

> getting rid of any javascript

Try to find a popular website without JS. Even HN uses it, so this is a moot point.

<comment><USER33> > Try to find a popular website without JS. Even HN uses it, so this is a moot > point.

There's a big difference between not using JavaScript at all and doing it correctly with progressive enhancement. Any site which doesn't depend on a ton of JavaScript to render and uses lazy-loading where appropriate will see the same benefits and will be significantly more robust as well.

</comment></comment></comment><comment><USER60> If everyone creates fast websites that don't suck, Google will consider AMP a success and kill the format.

<comment><USER54> So why not just release AMP for use on domains as a reference implementation (with server side rendering for pre-cache), measure speed instead of implementation, and not use the google cache.

They want the Google nav buttons on your site to keep the user inside their experience

</comment></comment><comment><USER61> Let me stress this major point. Google is NOT the web. They are but one major player. Yet when we speak of "SEO" we mean "pleasing Google". I find that reprehensible. Google is NOT fighting for a better web experience. They are trying desperately to achieve what Facebook has done... keeping users engaged. While I appreciate what Google has done to encourage web standards, they are totally screwing up with their attempt at recreating AOL. AMP is simply the latest example of keeping users on a Google site.

</comment><comment><USER62> > Of course, the reason we have AMP is because Google wants users to see ads, > something that is mostly missing with JavaScript disabled.

Ding ding ding — this is IMHO the real reason for both AMP and the downvoting (and down-moderation) of anti-JavaScript comments on online forums (to include HN). It's all about money. Google aren't evil; neither are publishers, startups or venture capitalists. But it's _hard_ to make money from a web in which end users are in control, and _easy_ to make money if they are relatively powerless. Google, publishers, startups & venture capitalists alike all want to make money, and thus it's in their interest to encourage technical measures which decrease end-user power. It's also in their interest to discourage social discussions which support technical measures which _increase_ end-user power. They don't consciously think in this terms, of course (in the words of Upton Sinclair, 'It is difficult to get a man to understand something, when his salary depends on his not understanding it'), but that is why they act as they do.

The thing is, every one of is an end-user at some point. Every Google employee, every CNN investor, every startup founder, every venture capitalist _uses_ technology constantly.

It's vitally important to the freedom of the web that we resist the temptation to require JavaScript, that we resist the lure of AMP, that we resist the siren song of further net centralisation. We have nothing to lose but our chains!

</comment><comment><USER63> > I am really surprised that big publishers are not bothered by this fact as > much as I am.

I suspect they _are_ just as bothered, but don't really have a choice about this either. Placement on the search results page is so valuable that Google holds a really big stick when introducing new 'standards' like this.

Just look how little of a typical mobile SERP is real 'organic' content now: [http://imgur.com/UhNZvL2](http://imgur.com/UhNZvL2)

<comment><USER48> I did the same: Content that is NOT organic search results is marked on the right side in Google's colors: [https://s3.kuschku.de/public/serp_annotated_web.png](https://s3.kuschku.de/public/serp_annotated_web.png)

Notice how 2/3rds of the page is taken by the app's own UX, and of the shown results, another 40% is taken by embedded content.

The page shows only 9 search results, and zero above the fold.

</comment></comment><comment><USER64> I agree with most of the article, but I think that my browsing experience with news (and similar) websites has been improved overall by AMP in a way that I almost regret visiting websites that offer no support for it. On the other hand, I also think that publishers need more control over their content and how they serve it to their users. Having said that, if AMP were to be integrated with GCP it could improve the service for everyone involved, not only publishers and consumers (yes, even for Google itself); for example, a publisher could have an AMP Cloud Storage bucket configured under the domain of the publisher in order to use the its identity and not google's one. On the consumer's end it could be as simple as a switch to turn off amp results for a single session or for every single one. At the end of the day, lets not forget that it is a fairly new approach to improve the web experience (and not a bad one at all) and there are options and many paths that AMP could follow in order to become a better experience for everyone.

</comment><comment><USER65> I was about to post that AMP breaks scrolling on my iPhone (thus rendering all AMP-intercepted websites unusable), but it looks like they finally realized it and stopped showing AMP results to my version of iOS. :thumbsup:

</comment><comment><USER66> People should also stop making Android apps whenever a website is perfectly suited, but of course that won't happen.

A webview is a bit like AMP but it is still better then a true native Android app (when it is easily avoidable).

</comment><comment><USER67> From a user perspective, the speed of AMP is nice but I absolutely hate not being able to see the original URL of a site.

I want to see the original URL, certainly not a CDN mirror URL that could obfuscate or muddy the source.

</comment><comment><USER68> AMP is bad for publishers, but even worse for publishers who don't get on board.

It's similar to Yelp's strategy: create a new problem for businesses, then sell them a (partial) solution to it.

</comment><comment><USER69> I have enjoyed this AMP saga, and really look forward to the finale: how turning off AMP impacted SEO. Since the author has the "before" picture with AMP enabled, I'm really curious what the "after" will look like.

EDIT: I'm curious about the downvotes - care to elaborate what you disagree with? The author indicated that SEO was a driving force for using AMP, so I think that being curious about the outcome would be acceptable...

</comment><comment><USER70> On one hand google's AMP is ruining the open web.

On the other hand, mobile pages suck. Too many ads, annoying popups and interstitials, and tracking scripts.

<comment><AUTHOR> Between the rock and a hard place

</comment></comment><comment><USER71> I find it frustrating bookmarking and/or sharing the AMP url with others.

Ideally it would save / share the original URL, not the AMP url.

</comment><comment><USER72> The only good thing that came out of AMP is that Apple finally fixing scrolling in overflows.

</comment><comment><USER73> Don't be evil. Just a little is fine. No one will notice. Go on then!

</comment><comment><USER74> I don't even know what AMP is for, but I know if I click an AMP result on my phone, it won't load anything but a white screen. So one of my content blockers must be working...

</comment><comment><USER75> AMP is the perfect way to punish big publishers for their slow websites. Google can't punish them by simply lowering their rankings, people want to see those big publishers.

</comment><comment><USER14> AMP news articles lack comments. This is often were most of my interest lies. I want to see if anything in the article is called out in the comments.

<comment><USER76> I actually think suppressing comments (sometimes called "the sewer of the internet") is a feature, not a bug. I block Facebook comments using a Chrome extension mainly because I don't want to send huge amounts of information to Facebook when browsing random web pages, but not having to see the comments is also a bonus.

<comment><USER14> Just calling them names doesn't change anything. You are assuming the article is more truthful than the average comment.

FB posts are often not about anything, unlike news articles. FB and YT are entirely different.

<comment><USER76> The average article posted via a web page (or AMP) is definitely more well written, and generally more truthful, than the average Facebook comment. I would think this is pretty self-evidently obvious.

</comment></comment></comment></comment><comment><USER77> This is the most Microsoft-esque thing Google has done IIRC!

</comment><comment><USER78> > On iPhone, AMP seems to override the default browser scrolling. As a result > scrolling of AMP pages feels off.

Thought it felt wrong. Makes me want to use Google less and less

</comment><comment><USER79> please change your hn discussion link

>[https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fwww....](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fwww.alexkras.com%2Fi- decided-to-disable-amp-on-my- site%2F&t=I%20decided%20to%20disable%20AMP%20on%20my%20site)

<comment><AUTHOR> It's auto generated, clicking submit will redirect to the right discussion

<comment><USER79> I thought it was a typo but it seems all your post contains link like this :)

</comment></comment></comment><comment> torrent-of-ions In the 90s web pages loaded instantly. Now we have faster computers and faster networks, but apparently we need something like AMP to make the web fast. We have regressed.

<comment><USER80> Those are some extremely rose colored glasses you are wearing if you think web pages loaded instantly in the 90's

I remember using the web on a 56k modem (which was pretty damn fast!) and waiting 30+ seconds for pages to fully load.

<comment><USER81> The text was still fast. And I NEVER saw had the text disappear for a second while the page updated the font... The text was still fast, and the developers assumed you had a crappy modem in at least 80% of cases. The web is getting slower.

</comment></comment></comment><comment><USER82> AMP also sucks for accessibility. Try this on Android's Chrome:

* Do a Google query containing an AMP result

* Zoom in the Google search (since it's not very accessible either)

* Open an AMP page

Result: You can't zoom out anymore and left-to-right scrolling is unavailable in this state. So you have to go back, zoom out and click the link again. After which you can sometimes zoom back in again.

This makes browsing a real hassle. I know Google doesn't care that much about accessibility, but boy this drives me crazy almost every day of the week.

<comment><USER83> I have trouble reading small text and images, and I've experienced this as well. It's particularly bad when an article has an infographic that's clearly designed to be viewed on a desktop. Completely disregarding my "force enable zoom" browser setting, AMP won't let me make those images any bigger than the width of my phone. I always have to switch to the actual site, wasting my time loading two pages.

</comment></comment><comment><USER84> Having suffered through unbelievably atrocious mobile news sites, I now refuse to open any news website that's NOT AMP.

Those criticizing AMP have it wrong, Google could have very well just bypassed AMP for "instant publisher app" (something that if Apple did the same people (Gruber etc.) would wax poetic about how it was stroke of genius), instead you at least get to keep HTML/JS/CSS stack, without any "gatekeepers" like the Apple App Store.

So yeah unless you are a mobile App developer, AMP is great for both developers and readers!</comment>


Twitter.com Domain Seized by Syrian Electronic Army - <AUTHOR> http://whois.domaintools.com/twitter.com

<comment><USER2> [http://www.networksolutions.com/whois/results.jsp?domain=twi...](http://www.networksolutions.com/whois/results.jsp?domain=twitter.com) doesn't show the update

<comment><USER3> saferwhois.com shows the change (fetching the data from the domain's apparent current registrar, via whois.melbourneit.com).

</comment></comment><comment><USER4> What is the significance of this? Not being critical, just wondering what the key impact is. Twitter.com still works fine, but email@example.com is most definitely not owned by Twitter.

</comment><comment><USER5> The whois is correct. Whether they can make DNS changes is whole other question. I doubt they have taken over ownership of the domain.

<comment><USER6> Can you explain this a bit more please? We're having conversations about this in our office and are still confused.

Is it just that the whois has been compromised and showing wrong information? Or have actual DNS changes been made?

Looks like domaintools.com is NOT the only one showing the DNS changes, so we're mighty confused at our end. :| Appreciate any insight you might have.

<comment><USER5> Administrative data, such as name and contact information may not necessarily be available at the same security level as DNS (nameserver) data. Also note that domain contact details are _not_ the same as DNS. Read more about DNS at a more reliable source, i.e. [http://en.wikipedia.org/wiki/Domain_Name_System](http://en.wikipedia.org/wiki/Domain_Name_System). You'll soon get what's happening.

</comment></comment></comment><comment><USER7> I see it is still registered to Twitter Inc. in San Francisco? Anyone have a screenshot?

<comment><USER8> The admin and tech names are "SEA SEA" with emails of 'email@example.com'

</comment></comment><comment><USER9> Twitter's image service, twimg.com, is showing SEA in whois as well.

</comment><comment><USER10> For those interested in what the internals of government monitoring of communications is like, do check out the BlueCoat logs leaked by Telecomix which I linked below.

A vast multitude of hits relate to families, sexual habits, religious affiliations.

What SEA does with news orgs is derail them as much as possible. There is very much an internal campaign to 'cleanse' the terrorists, repopulate parts of Homs with Alawites.

This is real. Please don't hell ban me for it again.

<comment><USER3> I'm pretty sure hellbanning is _not_ primarily an evaluation of whether the user is writing about "real" topics or not.

HN is a discussion website for hackers and topics that interest them. If you're dropping wall-of-text posts in the middle of unrelated discussions, it's completely irrelevant whether you're talking about something "real" or not.

Here already you're complaining about (re)posting into the void, and copy/pasting things you've apparently already posted elsewhere. This is a discussion site -- that is not discussion. You have more comments on this post than anyone else, half of them complaining about being hell-banned; that's also not discussion.

Finally, I read what you wrote and still have little clue of what you're talking about. It's probably worth finding a single solid source for what you're talking about, post it, and then discuss it (not just flood the comment thread...). I.e., see what people are wondering about, or what other people know... that's how discussion works. Good luck.</comment></comment>


How I built a web app that is ranked #169,170 by Alexa traffic Rank in 4 months - <AUTHOR> I launched my website/web app four months ago and wanted to share how I quickly ranked it.
I wanted to start a Side Project and wasn't sure what would it be ! I wanted to learn ReactJs and so decided to try out with very simple project. My background is in Web development and I have 3 years work experience. I would consider myself as Beginner in coding. This post is mostly catered to Reactjs developers. You guys must be already familiar with lots of stuff but I just want to share my experience.
#1 Niche or Competitive Website? I started my research 4 months ago, and what I found was everyone recommending to start a niche blog/site. Although niche website have its advantage in terms of easy SEO, I think there is good potential for high traffic competitive domains. In my case it was a dictionary app and its been a saturated product. But still I decided to go with it.
#2 UI is King I think very good design can help to intrigue users. Since this was my strong suite, I put lot of time for it. Here are few sites that I found to be helpful with Front End/UI Design. https://www.behance.net/ https://codepen.io/ https://dribbble.com/ https://www.awwwards.com/ https://www.cssdesignawards.com/ I think google fully crawls & indexes now in mobile version and it is very important to be responsive. Google chrome console can help you with that.
#3 Coding This is the challenging part for me. Although the application itself is not complicated, I had some struggles in between. I think ReactJs is a good framework/library for my kind of project. I also used couple of npm packages so to just fast track. I don't want to link entire packages that I used. Here is the main website though — https://www.npmjs.com/
Check out the full medium article
https://medium.com/@oxfordify.en/how-i-built-a-web-app-in-four-months-that-is-ranked-169-170-according-to-alexa-traffic-rank-6fca2b521db0 <comment><USER2> Thanks for sharing. Motivated.</comment>


Laptops that run on the sun - <AUTHOR> http://www.theglobeandmail.com/technology/tech-news/laptops-that-run-on-the-sun/article12843604/

<comment><AUTHOR> This link is from a post here: [http://www.reddit.com/r/linux/comments/1hpra2/solar_powered_...](http://www.reddit.com/r/linux/comments/1hpra2/solar_powered_linux_laptop_yes/cax53e6)

This seems to be some guy involved into the development of [http://www.solaptop.com/](http://www.solaptop.com/) .

</comment><comment><USER2> I would have liked to have seen a photo of the actual laptop (I'm not sure the photo in the article is it).

Is the Ghana market a rich enough one for this device? Should they be taking a play out of Tesla's gamebook and developing high-end high-priced systems for a small number of users who want solar first, and then go down-market to supply those without access to reliable power?</comment>


PSA: Intel WICS broken for years with official press release, do not buy - <AUTHOR> https://communities.intel.com/thread/96038 <comment><AUTHOR> [https://web.archive.org/web/20151107205621/http://www.intel....](https://web.archive.org/web/20151107205621/http://www.intel.com/support/wireless/wlan/sb/CS-034535.htm)

The press release has since been deleted since the thread was created, thank god for Archive.org.</comment>


Show HN: Speech to text and synchronized transcript with audio - <AUTHOR> https://voicen.com/en/ <comment><USER2> Does it support

1\. Dual channel audio? Speaker labels 2\. Custom vocabulary? 3\. Keyword spotting?

Does the API have an option for real-time and how many languages does it support?

Also do you have a HIPAA compliant solution for healthcare?

<comment><AUTHOR> 1\. No 2\. Yes 3\. Yes

Yes API have real-time option. Currently support 4 languages - english, russian, turkish, azerbaijani.

And link to privacy policy -> [https://voicen.com/en/privacy/](https://voicen.com/en/privacy/)</comment></comment>


Poachers Hack Environmentalists' GPS Signals to Hunt Endangered Animals - <AUTHOR> https://heatst.com/life/tech-savvy-poachers-hack-gps-signals-to-hunt-endangered-animals/ <comment><USER2> The article claims the most well known incident is when eight grey wolves introduced to Yellowstone were tracked down and shot through of their GPS transmitters:

> "Cooke said the worst known case of GPS interception by poachers was when > eight grey wolves in Yellowstone national park were hunted down."

This claim of the use of GPS trackers to hunt wolves in Yellowstone, stated as the worst known case, appears to be fabricated.

The research journal article does not make the same claim cited in the linked article. (Which fails to link to or cite the article it is sourcing; it is "Troubling Issues at the Frontier of Animal Tracking" for those interested.) The journal article mentions instead "speculation in the media suggests that hunters may target tagged wolves from Yellowstone to interfere with research.... websites operated by some wolf-persecution groups provide strategies for figuring out tag codes." Speculation, not evidence or proof.

Efforts to reintroduce wolves into the Yellowstone area have been ongoing for decades and have been so successful that there are now legally sanctioned wolf hunts in order to help control the population. Of the wolves killed in the vicinity, some have had VHF radio collars which can be picked up in the near vicinity with radio trackers, and one, 832F, had a more modern GPS collar. Of the 11 wolves that were being tracked with either radio or GPS collars in Yellowstone, 4 were shot by hunters, all legally, in permitted hunts. This is not poaching. Poaching is illegal. Nor is there proof that any of these legal hunters used the collars to find the wolves. Suggestions they did so far have just been wild speculation by media, wolf enthusiasts, and journal authors who refer to legal hunters as "wolf-persecution groups", a tell of their viewpoint bias.

<comment><USER3> This kind of reply is what I love about HN. So many stories come out biased or simply factually inaccurate. I wish newspapers like the NYT and WSJ had a prominent chat feature to promote fact-checking.

<comment><USER4> > I wish newspapers like the NYT and WSJ had a prominent chat feature to > promote fact-checking.

We both know what really happens when news website get comment sections and chats. Toxic communities appears out of thin air.

<comment><USER5> Every once in a while I'll check the comments on a politico story just to see if there's anything interesting someone has added. Hasn't been anything yet. It's name-calling from the get-go.

<comment><USER4> I often wonder how much of that is triggered by paid employees. Be it the competition or state actors.

</comment></comment></comment></comment></comment><comment><USER6> Seems like a good opportunity to deploy some honeypots.

<comment><USER7> Exactly what I was thinking.

Side note, anyone available to go on a poacher hunt?

<comment><USER8> I'm game. Let's go protect the wildlife. Though the best course of action would be finding ways to temper demand for poached animals. Easier said than done I know.

<comment><USER9> How about legalizing fraud in these narrow contexts, e.g., passing off fake ivory for the real thing is no longer illegal?

<comment><USER10> I doubt you'd get busted for passing off fake ivory even without such a change, probably not many people want to out themselves as an ivory buyer to authorities and media.

<comment><USER8> Education might also help rhinos from losing their tusks. Too many believe that the tusks help verility of all things. Without sounding ethnocentric these cultural beliefs are harmful and incongruent or unbecoming of an educated society

</comment></comment></comment></comment></comment></comment><comment><USER11> The first time I heard of HeatStreet was as a claimed source by the Trump administration that Obama had wiretapped him. Is HeatStreet a credible source? Given its association with Breitbart in the wiretapping allegations and others comments that parts of the story are fabricated I have to wonder.

</comment><comment><USER12> Does anybody know if the devices are spread-spectrum radios, or are they trackable with a simple HT or scanner?

Encrypting the data would do very little if basic direction finding was sufficient.

</comment><comment><USER13> So with a satellite-based system, the signals only go straight to the satellite huh? They don't radiate out in all directions like all other EM radiation?

<comment><USER14> Yeah, that is odd. I assume what they're getting at is that this is encrypted packet data, instead of whatever the RF system used.

</comment></comment><comment><USER15> Radio freq's aren't private.

FCC licensing.

Anyone w/ a Radio scanner or RTSDR can just camp out in the woods and identify the old fashioned way.

GPS signals don't work that way.

<comment><USER16> If the beacon data happened to be encrypted, then breaking that encryption might be a violation of the law. Although you could just use directional finding to locate the source of the beacon. That's assuming these animal collars transmit data at some interval without any input. A more secure system would be to have a call and response system using a secret key. Each collar would have a unique ID number, a unique private key, and a GPS receiver. The tracker system would contain a list of collar public keys and a GPS receiver as well. To find any specific collar, the tracker would use the public key to encrypt the ID number and a time stamp from the GPS data. Any collars in the vicinity would see the transmission, try to decrypt it, then compare the ID number with their own. If it's junk data, ignore the transmission. If the ID matches, the time stamp is compared with the collar's own GPS data to check if was anytime within the last few seconds (or however long it takes to lock onto a GPS signal). The collar would then reply with the ID number and GPS location data encrypted using the tracker's public key. The tracker receives the data, decrypts it, and displays the location on a map. Thus, the time stamping would prevent any replay attacks by only allowing the collars to respond when the real tracker is requesting its location. Controlling how often a collar is allowed to respond would prevent a replay attacker from getting any responses once the collar receives a legit request from the tracker. The only way to really attack this system would be to setup a directional finding system to pinpoint the location of the collar but this would only work during the times the tracker happens to be looking for an animal you are trying to poach. Another option is to steal the tracker device and beat a park ranger until they give up the password to it.

</comment></comment><comment><USER17> Paging EFF? Civil liberties for endangered animals maybe /s</comment>


Mortality rates for Covid-19 may be up to 15.2% outside China - <AUTHOR> https://www.thelancet.com/journals/laninf/article/PIIS1473-3099(20)30195-X/fulltext <comment><USER2> Thank you for posting.

Staggering wake up call to always see how data presented is actually calculated. There is something about the simple percentage figure that seems so easy to confuse people - even experts. Take the concept of interest rates (cumulative vs annualised).

In this case, what is the denominator? Good god, of course it doesn't make sense to divide the recently dead with the total cumulative population of infected!

Thank you for this post.</comment>


Coding Horror: Why Isn't My Encryption.. Encrypting? - <AUTHOR> http://www.codinghorror.com/blog/archives/001267.html <comment><USER2> "If you find yourself typing the letters A-E-S into your code, you're doing it wrong". Obviously moreso if you're typing D-E-S.

We give our clients a very simple recommendation when it comes to encrypting things:

* If you're encrypting data in motion, rely on SSL.

* If you're encrypting data at rest, rely on PGP/GPG.

There are plenty of libraries that will GPG a blob for you, and you can assume GPG got all the details right. That would have been the right call here (as opposed to figuring out CBC and --- importantly, for someone who is still fetishizing "salts" in 2009 --- how to safely set an IV).

<comment><USER3> That just isn't true.

As an obvious counter example, asymmetric encryption (gpg,et. al) is very slow. Which means that if I need to encrypt a lot of data at rest it sometimes makes sense to use a symmetric cipher.

Security (even just the subdomain of encryption) isn't that easy - there is no one-size-fits all solution.

<comment><USER2> GPG is a program. It isn't an algorithm. Consider reading it before you propose alternatives, which are likely to be broken.

Like I posted upthread, there's a laundry list of things that program is going to give you besides picking a better algorithm than "Triple DES" and a better block cipher mode. But listing them is just begging for a bunch of people to propose wack-ass alternative solutions that other people will feel obliged to waste time knocking down.

</comment></comment></comment><comment><USER4> The worst thing about this is that he had to actively decide to use CipherMode.ECB. It's not like it's some kind of dumb default, hidden from view. A human being had to type that string of characters in there. Did he look at the doc and just pick one at random? Perhaps CipherMode.ECB the first hit IntelliSense gives you?

<comment><USER5> two words:

"copy" "paste"

<comment><USER6> Copy and paste coding is often its own punishment.

</comment></comment></comment><comment><USER7> Probably because you don't know how to code and you write a bunch of articles and annoy everyone with your pseudo-skills by clogging up every internet news aggregator with your blog spam.

<comment><USER8> Give the guy a break, he clearly does now how to code, he writes well crafted blog entries in which he humbly explains some of the mistake's he's made for the benefit of others. If he's being voted up in news aggregator then a lot of people must appreciate what he's doing. Why is that so bad?

<comment><USER9> I'm a fan of his and I think a lot of what he writes about is pretty poor. I don't mind because he is a good writer and he doesn't pretend to be an expert about most of what he writes about. I do mind that he thinks it's not important a lot of the time. I can't fault his record though, he's a successful in his field, and his latest ventures have been really wonderful. I disagree on his views (I don't know C well but I understand why you might want to learn it Jeff!) and I don't think we should see every article of his here, but he's hardly the worst pundit out there.

</comment></comment></comment><comment><USER10> _In our case, we were using this Encrypt() method to experiment with storing some state data in web pages related to the login process. We thought it was secure, because the data was encrypted. Sure it's encrypted! It says Encrypt() right there in the method name, right?_

!!!!!!!

There are two cases when you might want to send sensitive data to the end user: You may wish to send them something and have them send it back in an unmanipulated block, or you may wish to have them manipulate it in some way and send it back to you.

In the first case the best practice is to store the data on the server side and send a pointer (key) to the data. The key is inherently meaningless and sparse relative to its space, and is therefore difficult to attack in any meaningful way.

The second case would rely on the web server sending a piece of (javascript) code to the browser to manipulate the crypto data. If you can see the encrypted text and the plaintext javascript routine you're a trival hack away from rewriting the javascript to have it change the encrypted text. This moves the problem from a crypto problem to a javascript coding exercise. The proper solution in this case is to use a form of crypto that is outside the realm of the HTTP session (read: SSL).

</comment><comment><USER2> The timing on this post is funny. I just submitted Nate's blog post from yesterday:

<http://news.ycombinator.com/item?id=615446>

On how a trivial implementation error (one we're familiar with already) in Debian's OpenSSL means that any message signed with Debian OpenSSL DSA reveals private keys. That's a micro-error; Debian and OpenSSL may have got almost everything else right, but fucked up one tiny detail, and now exposing the _ciphertext_ of certain messages leaks your private key.

This isn't crypto-geek chauvinism. If crypto isn't a big part of what you do in your day-to-day, you're just not going to get this stuff right. That may be the point Jeff is actually trying to make (and the reason he isn't offering a neat solution in his article), but look at the comments on how to "do it right", and you can see that isn't the message that's getting transmitted.

There's a much bigger flaw in Atwood's cryptosystem than has been discussed here --- forget CBC --- but I'm not going to post it, because it will just result in 20 comments about how easy that is to fix, and here's 15 crazy heuristics to do it, so nyah!

</comment><comment><USER11> Is his salt even really a salt? I thought salts had to be different every time to actually meaningfully prevent precomputing a dictionary.

<comment><USER12> A salt is different than a nonce. Either one hampers time-space tradeoff attacks significantly.

<http://en.wikipedia.org/wiki/Salt_(cryptography)>

<http://en.wikipedia.org/wiki/Cryptographic_nonce>

<comment><USER2> I don't know why you'd debate trivia when his key derivation function is just MD5(keystream), and even that is optional (why-oh-why would you have a "bool useHashing"?).

In this case, the "salt" is completely irrelevant, because there's no precomputed dictionary you can build for this function.

But I still dispute that a distinction needs to be drawn between the word "salt" and "nonce".

<comment><USER11> Personally, I was curious. Why doesn't a distinction need to be made between a random salt and the same salt used every time? Don't they have dramatically different results in terms of security?

And yeah, his choice of MD5 is an abomination, but that wasn't something that I thought was even nonobvious.

<comment><USER13> If you're trying to crack a specific password, there's no difference: you still need to hash (password + salt) for all passwords. If you're trying to crack all passwords out of a database, however, you need to hash (password + salt) for all salt. In the latter case, increasing the number of distinct salts in use increases the time-complexity of cracking, without doing anything to the time-complexity of authentication (though requiring O(n) space).</comment></comment></comment></comment></comment>


Ford's designers are learning to create 3D cars in VR - <AUTHOR> https://www.cnet.com/roadshow/news/ford-virtual-reality-design-gravity-sketch/ <comment><USER2> They obviously showed a lot of meticulously mated actual 3D components but those were all prepared in a CAD program.

Sure, the VR sketch might be useful, but the visual part of the video is quite a lot of marketing spin when it's not showing the abstract lines.

And I'm not sure that VR is the best way to "feel" a car in this way either. A car is an extension of your body, so it's just as important where/what your shoulders, knees and legs are/feel as to what the eyes can see.

<comment><USER3> Basically any usage of VR outside of gaming right now is guaranteed to just be marketing nonsense. The hardware simply isn't there for real world professional usage as a productivity enhancing device. Some day we'll be there, but the current state of even the most advanced HMDs is little beyond toy prototypes at this point.

<comment><USER4> Lots of people are doing some really cool art using VR headsets. Those two Facebook groups are really nice to join if you're interested.

Animations: [https://www.facebook.com/groups/virtual.animation/](https://www.facebook.com/groups/virtual.animation/)

Paintings: [https://www.facebook.com/groups/virtual.paintings/](https://www.facebook.com/groups/virtual.paintings/)

<comment><USER3> I should have included art as well. There's definitely a lot of cool visual stuff being done. But the ergonomics just aren't there yet for the use cases constantly being touted in the media like virtual desktops and CAD modeling.

</comment></comment></comment></comment><comment><USER5> I'm working on something similar (not announced yet).

Tools like Gravity Sketch, and the tool I'm making, are great for conceptualization and communication.

In seconds to minutes you can take an idea from your head and show it to someone else. You can have an idea for a product ready to show your peers and in moments they can offer feedback and make changes.

Tools like this aren't replacing the final engineering yet, but they're making the planning and communication stage dramatically more efficient.

<comment><USER6> we're using VR for some progressive design stuff, do you have a contact you can provide. It might be that we're a good opportunity to test out something as it nears announcement.

<comment><USER5> Sounds interesting. And I'd love to have more eyes on the product closer to release!

Reach out to me at my personal email: email@example.com

That goes for anyone else reading this as well. If anyone is working in this space or wants to chat about VR design tools I am interested in talking to you.

</comment></comment></comment><comment><USER7> I design mechanical stuff for a living and I can't imagine that designing cars in VR is more efficient than CAD. There isn't any barrier right now from idea to CAD. If an engineer (or a scientist) can imagine it, an engineer will be able to design and create it digitally with current technology. I would say the current limitation is the manufacturing tools rather than the designing tools.

Side note, I think the work process for designing the exterior of cars is to create a sculptures with clay, transfer to clay to CAD, and rinse and repeat. I wonder if VR will ever beat manual sculpting.

<comment> d-sc Also design mechanical stuff for a living. I've spent multiple days over the course of the past six months creating drawings to demonstrate how a design will 'feel' once made. A 1:1 3d model that other stakeholders could walk into would be so much more effective.

<comment><USER8> As a hobbyist - the CAD tools I've used (Fusion360 and Inventor) - are clunky with arbitrary 3D shapes (e.g. a Porsche door panel). How do people in the "real world" do it? Iterate in Maya / similar and then export? Think in parametric curves? Something else entirely?

<comment><USER9> An industrial designer would sketch the outline then the images would be brought into parametric CAD software as references. The 2D image can be built into 2D/3D lines, then these curves are used to create surfaces which finally are stitched together. The nature of complex surfaces interacting and joining seamlessly is where the difficulty lies. "A class" surfacing is an entire speciality and can take a career to master. [https://en.wikipedia.org/wiki/Class_A_surface](https://en.wikipedia.org/wiki/Class_A_surface)

</comment></comment></comment></comment><comment><USER10> I'm having trouble with the title.

Wouldn't the title be equally as correct written as "create VR cars in 3D", or even just "create cars in VR".

And that's before mentioning that 'create' is ambiguous. Build or design???

Could someone convince me on the use case? I get that designing a car in 20 hours is 'better' than in 20 weeks. But with all the 1000s of hours put into other considerations, is this going to make any appreciable difference to anything?

<comment><USER11> My takeaway was that the designs might be different not just the same but done more quickly in VR. They stressed the point that in VR the designer can place themselves in the car and design at a "human scale." "We can get ourselves into the mind and the body, the virtual body, of our customer."

As far as the title, I think just dropping the "3D" might make it better?

</comment></comment><comment><USER12> This is beautiful because I think this is just the beginning. Who knows if we'll still be designing cars in VR in the long run. But it is really nice that people are beginning to experiment and tools to help them do so are emerging.

As Paul Graham says, all good ideas have an "ugly duckling" phase.

<comment><USER11> Yes, I was thinking that many people thought that designing cars with a computer was silly in the early days of 3-D computer aided design. It seems the jump from creating tactile prototypes to designing on a computer is a much larger jump than moving from a flat computer screen to a VR HMD. I'm surprised there is such a negative response so far on HN.

</comment></comment><comment><USER13> Were they making 2D cars before?

<comment><USER14> My first thought exactly. Perhaps '3D models of cars in VR' would've been a more solid title.

</comment></comment><comment><USER15> So what? The industry is far too conservative to bring any sort of radical design to mass market. This may as well be "Ford designers are learning to use A1 paper instead of letter sized"

<comment><USER14> >> So what? The industry is far too conservative to bring any sort of radical design to mass market.

I don't think we _need_ a radically new design for cars? 'The Homer' comes to mind. >.>

</comment></comment><comment><USER16> Cool. I'm more of a mechanical designer so it is hard for me to understand why this is an improvement because I'm used to requiring a lot of precision in my modeling. That said when he mentioned the ability to get line-of-sight on different curves I could appreciate it a bit more.

I still don't think that the hand controllers they're using are the best input device. I can imagine a hybrid approach where design teams are using standard surface modeling like Alias/3Ds Max/Blender for the bulk of the design work and then VR systems like this for review.

</comment><comment><USER17> I'm surprised there isn't actual CAD software for VR yet.

When I tried tiltbrush for the first time I was immediately struck by how easy it was to create some things, but how much of a pain it was to modify things, or make things like parallel lines or surfaces.

Maybe everyone is waiting for someone else to do it. Even the linked software (gravity sketch) seems to be missing constraints, dimensions, and snaps, though it has control points so modification of existing geometry is at least possible.

What gives?

<comment><USER18> Why bother just yet, when the most important part/killer feature will be subpar (for now) - reviewing the models in high res 3D.

</comment></comment><comment><USER19> When I was at Edmunds.com, I worked on a few "greenfield" projects, including VR. I'm generally bearish on VR, but I think if there's a space where VR can truly usher in a paradigm shift, it's auto -- both for design/development, as well as showcasing (think potential buyers, auto shows, etc.).

<comment><USER10> "for design/development"

Could you expand?

</comment></comment><comment><USER20> funny, I was thinking that CastAR (now Tilt Five) would be a good compromise for that. Having your CAD display in front of you of you, the reflecting mat on the side and no too intrusive glasses. So that you just have to turn your head to see the 3D. You don't really need virtual reality when you're just working on an object, you just need a bit of 3D to help you grasp the shapes.

</comment><comment><USER21> Maybe they could use all that expertise to design a smaller truck.

</comment><comment><USER22> What is a "3D" car? Seems needlessly redundant.

</comment><comment><USER23> Too bad their engineers are not learning how to make cars that don't need several recalls.</comment>


Hunting Dinosaurs in Central Africa (2019) - <AUTHOR> https://contingentmagazine.org/2019/03/18/hunting-dinosaurs-africa/ <comment><USER2> It always makes me a little sad that we have explored most areas of the planet and there isn't much mystery left. It would be so cool to find an area where there are still dinosaurs or another unknown life form.

<comment><USER3> There are a lot of things swimming in our oceans that we don't know about.

So I'm hopeful that something very old, and very strange is still down there, since so little of the ocean has been explored I can still dream.

</comment></comment><comment><USER4> suddenly lizard people</comment>


Perl 5.16 and Beyond - <AUTHOR> http://www.slideshare.net/obrajesse/oscon-2011-perl-516-and-beyond

<comment><USER2> Also available as PDF or text:

[http://dl.dropbox.com/u/10190786/oscon2011-perl5-16andbeyond...](http://dl.dropbox.com/u/10190786/oscon2011-perl5-16andbeyond.pdf)

[http://fsck.com/~jesse/tmp/2011-07-05/221c115e-a9cb-43fa-b94...](http://fsck.com/~jesse/tmp/2011-07-05/221c115e-a9cb-43fa-b949-6a58192e91e7/slides- for-yapc-na)</comment>


Show HN: Website valuator, and SEO script - <AUTHOR> http://gluestat.com/

<comment><USER2> It says that my website worths $50K.. I wish it was true. I would be happy to sell it for 1/10th of that price..

[http://gluestat.com/archimodels.info.html](http://gluestat.com/archimodels.info.html)

edit: I checked other websites and most of them are overvalued. You should tune your valuation model.

<comment><USER3> You can make an exact replica with the same script [http://codecanyon.net/item/website-value-calculator- script/9...](http://codecanyon.net/item/website-value-calculator- script/9990820)</comment></comment>


Show HN: 10 Best Web Animations - <AUTHOR> http://www.creativebloq.com/inspiration/10-best-web-animations-by-chris-gannon <comment><USER2> I also tried to get my feet wet in SVG animation. Made with inkscape and animated in GSAP.

[https://happy-halloween.alfred-eichenseher.de/](https://happy- halloween.alfred-eichenseher.de/) (Halloween animation - click on the ghost button in the middle of the page)

<comment><USER3> Reminds me of Limbo :)

</comment></comment><comment><USER4> It seems like all the animations in this article are GIFs, not actual animated SVGs :(

I wonder why he chose to export them as GIFs after going through all the work to create SVGs. They also seem to be pretty choppy as a result. Maybe whatever CMS the article is using doesn't support SVGs?

<comment><AUTHOR> I converted them to GIF for portability (and because CB asked for that format).

Yes GIF is horrible but it's a necessary evil in this current social media climate.

</comment></comment><comment><USER5> What? No Pablo the flamingo? [http://pablotheflamingo.com/](http://pablotheflamingo.com/)

</comment><comment><USER3> The fan is rad, clearly the most attention to detail put into it.</comment>


Which Linux based 0S is best for computer programming? - <AUTHOR>

There are multitude of  Linux based OS out there such as Ubuntu, Fedora etc. Can anyone suggest an OS that is apt for computer programming? <comment><USER2> This is a complex question. There are many right answers. bediger is right, in that Arch and Slackware will be by far the most powerful and flexible tool. However, distrubtions like Ubuntu have by far the easiest use and set up. If you are new to Linux, going to Arch wouldn't be impossible, but it would be incredibly difficult. I personally would recommend Ubuntu. It is very easy to use, customizable, and has great package management. I text edit in Vim, run a LAMP server, run my programs from Terminal, and customize my shortcuts via the Ubuntu menu for workspace management. My experience with Fedora is limited, as is mine with SUSE (though mine with SUSE was negative). You can email me at firstname.lastname@example.com if you need more help or have more questions.

<comment><AUTHOR> Thanks for your reply. I am familiar with ubuntu and its a great Linux distro. The only problem I have is slow internet speed (i live in a developing country). It feels annoying to download heavy packages e.g Qt and java sdk. I prefer a distro which i have to download it once and comes pre-installed with essential programming packages i.e it should be specific to computer programming.

</comment></comment><comment><USER3> I'd go with either Arch or Slackware. The folks behind Slackware shoot for robustness, which sometimes means "not the latest versions". The Arch people shoot for bleeding edge, which can be nice from a developer's perspective.

</comment><comment><USER4> What type of programming? What are you aiming for? I'd generally pick something light and stable, so you are on the same platform as some of your customers, and you can easily run VM for the rest, or you're writing for the web and none of this matters.

</comment><comment><USER5> quite honestly, any of them.

all the "big ones" i.e. debian/*buntu, fedora/redhat, etc. will have (nearly) any language's compiler/toolset in their package manager, and therefore just a couple minutes away from install. and even if they didn't, they're 2 google searches away from a download and install.

so, you're in luck! take your pick and dive in :)

</comment><comment><USER6> Slackware</comment>


Facebook Meets Skepticism in Bid to Expand Internet in India - <AUTHOR> http://www.nytimes.com/2015/10/26/technology/facebook-meets-skepticism-in-bid-to-expand-internet-in-india.html?ref=business <comment><USER2> I see even the NYT incorrectly calls Facebook's offering "Internet". I wonder if it believed the same if Internet.org offered a choice of 50 free-access sites where the NYT wasn't included.</comment>


Advice I Wish Someone Had Given Me for My First Job - <AUTHOR> http://lifehacker.com/5985903/advice-i-wish-someone-had-given-me-for-my-first-job <comment><USER2> Most of that is really good advice, despite it seeming obvious. When I got my first job I remember imagining that my boss would think less of me every time I took a day off.

</comment><comment><USER3> Luckily I read up on what it was like in the corporate world before starting my first job, so I knew what was what. What I wish someone had given me before I took my first job was a _better_ job. More money, more freedom, less BS, etc. Or maybe a college environment that wasn't as hellish and miserable as the one I was in. Maybe then I would've had the time and patience to assess the job I was taking instead of getting nervous and taking the first thing that came along.

It's hard to think clearly and make good decisions when your self-esteem, sense of self worth, and belief in yourself is so slowly and thoroughly eroded to nothing. It's like the were doing it on purpose. It's hard to function when others try to destroy you and ruin your life because they are jealous of your accomplishments, disagree with the way you do things, are fully insistent on making you just another cookie-cutter university graduate, and think that because of your ethnicity they shouldn't let up until they've turned you into and exposed you as being the idiot they so strongly want you to be.

"Bow your head and submit."

"You are nothing."

"Do what you are told."

"Show up on time."

"Talk more, especially to people you don't like. You're not supposed to enjoy yourself, you're supposed to suffer."

"You are black, so you're stupid."

"If you go anywhere in life, then it's not because you are talented, it's because we felt sorry for you, and were so kind as to let you."

"The courses are hard, you're not supposed to breeze through them."

"You dress different, you're dumb."

"You dress well, that means you don't know what you are doing."

"You are 'popular,' that means you never actually do anything."

"Don't try anything new, unless we're so kind as to let you."

"Don't do things properly, do them in this mediocre half-assed manner, so we can insult you as being the idiot we so desperately want to say you are."

And it's weird, because as weak as my grades ended up being going into my first job, I still deserved better than that BS.

For some reason, even after all I read, and after all the internships I had, I didn't think I would end up working in a Dilbert cartoon, but then there I was. And when they started following me home, following me around, and sticking their nose into every aspect of my life, I knew I had arrived. And I knew it was _really_ official when no one did anything but celebrate that I was, once again, getting shitted on.

The best advice for those going into the workplace is to do whatever you have to do to ensure that you don't end up in a crappy job. Only certain types of people thrive/survive in those terrible environments, and I think it doesn't take much to realize that there is no low too low for them to stoop to shit on someone's life. And just as part of their day to day job, not because of any specific reason. But it's especially pronounced if they are threatened, or see someone with talent/potential. Also, all it takes is one idiot manager to completely destroy your life, but remember not to submit to them. If they are holding that threat over your head ("I'll destroy you, unless.."), then just realize what you are dealing with and that they are going to do whatever they've threatened to do, no matter what you do.

A world filled with idiots is designed to do nothing but beat the ability and uniqueness out of you, so they can turn their nose up at you and talk down to you, to distract themselves from the shit that they are. I don't say any of this to depress you, even if it ends up having that effect, I say it so that you don't get caught off guard. Yes, this is all they are. Yes, this is all they are going to do. Yes, they have nothing else to look forward to in life except ruining your own. But don't just accept it. Don't let them do it.</comment>


Nexus One learns a new trick, Wireless N - <AUTHOR> http://androidandme.com/2010/04/news/nexus-one-learns-a-new-trick-wireless-n/

<comment><USER2> Funny, when Apple had Wireless N hardware in old Macbooks that was not enabled at the time of sale, it required users to pay a small amount for a firmware upgrade under the guise of complying with Sarbox.

Really glad that Google has chosen not to be evil here.</comment>


Faster Than Life - <AUTHOR> https://www.fasterthan.life/blog <comment><USER2> This looks like an odd introduction to Vulkan with a strong meme focus. Content seems reasonable.</comment>


FBI asks public for help breaking encrypted notes tied to 1999 murder - <AUTHOR> http://news.yahoo.com/s/yblog_thelookout/20110329/ts_yblog_thelookout/fbi-asks-public-for-help-breaking-encrypted-notes-tied-to-1999-murder

<comment><AUTHOR> Quoted:

The bureau isn't offering any reward for assistance in solving the case at this time, but the FBI is asking people who believe they may have some insight into the notes write to the address below:

FBI Laboratory Cryptanalysis and Racketeering Records Unit 2501 Investigation Parkway Quantico, VA 22135 Attn: Ricky McCormick Case</comment>