Show HN: Test your JavaScript modules simultaneously in 32 different versions of Node.js - <AUTHOR> http://victorbjelkholm.github.io/autochecker/ <comment><AUTHOR> This is a utility I build to be able to make sure my JS CLI's actually work across the version I want to support.

Right now, the tool also works across any language where there is docker images with versions, not just for JavaScript/NodeJS. It's enough with having a Dockerfile with $VERSION (that will be replaced by the tool) and changing the test command. I will make this easier in the future.

Thanks for taking a look and please let me know what you think about it.

<comment><USER2> Just out of curiosity, can't this be implemented with `nvm` and some sand boxing? Why did you choose to use docker?

<comment><AUTHOR> Yes, it can indeed. I have three reasons for not doing it though.

The first is that nvm is nodejs specific and since I knew I wanted it to eventually work with multiple languages, nvm is out.

Second is that docker has a API I can work with (via Dockerode in this case), makes it easier to use/debug and such.

Third is the easy of isolation. It's basically what docker is about while nvm is more for just managing versions.

I still use nvm locally, when developing. But when I want to rapidly test in multiple versions, I use docker with autochecker.

</comment></comment></comment><comment><USER3> Dumb question, from someone who doesn't work with Node.js: Why are there 32 versions of it?

<comment><USER4> There are actually 303 versions of node (including iojs, according to the Node Version Manager):

        $ nvm ls-remote | wc -l
             303

Most of those are patch releases. There are 47 minor releases and 6 major releases:

        $ nvm ls-remote | grep -oE 'v\d+\.\d+' | uniq | wc -l
              47
        $ nvm ls-remote | grep -oE 'v\d+' | uniq | wc -l
               6

Most language implementations probably have similar number of releases.

<comment><USER5> yeah -- perhaps there's a lot of negative things to be said about node, but the fact that they've released multiple versions? really?

[https://clojure.org/community/downloads_older](https://clojure.org/community/downloads_older) [http://www.scala-lang.org/download/all.html](http://www.scala- lang.org/download/all.html) [https://www.python.org/downloads/](https://www.python.org/downloads/)

etc...

<comment><USER6> I don't think the issue is that they've released multiple versions, it's more that they've had so many _backward-incompatible_ releases.

Python and OCaml have had _3_ each. Libc has had 6. 32 for something that's been around less than a decade is a bit excessive.

Are all these 32 actually backwards-incompatible?

<comment><USER7> There have only been 3 major releases with known backwards-incompatible changes. The reason you would want to test your code in so many versions of Node would be to check that you aren't depending on newer features that aren't in older versions that you want to still support.

Testing across 32 versions is probably very overkill for most people though.

<comment><USER7> (Oh, I meant to say 3 major releases since 0.10, which I arbitrarily picked as what seemed to be the earliest version still in any significant use today.)

</comment></comment></comment></comment></comment></comment><comment><USER8> Very nice project. I built something similar for PHP: [https://github.com/vectorface/dunit](https://github.com/vectorface/dunit)

<comment><AUTHOR> Oh, that's very nice. Thanks for sharing this here, always nice to see how different people implement the same thing basically :)

<comment><USER9> I've implemented something similar to be able to run tests with different MongoDB versions: [https://github.com/variety/variety/blob/master/test.sh](https://github.com/variety/variety/blob/master/test.sh)

</comment></comment></comment><comment><USER10> This is definitely something that's needed, by myself, and many other developers. Determining module compatibility across versions is always a pain. Great tool!

<comment><AUTHOR> Thanks a lot for those kind words!

Yeah, it was needed by myself as well, so I had to scratch my own itch for a while.

</comment></comment><comment><AUTHOR> Thanks everyone for the feedback and discussions, been very helpful and also motivating to see that people like/dislike the project in different ways!

As a small update, I've now made autochecker completely language agnostic, so you can test basically anything you can put in a docker container. There is some examples on how to use this here: [https://github.com/VictorBjelkholm/autochecker/tree/master/e...](https://github.com/VictorBjelkholm/autochecker/tree/master/examples)

Again, thank you all for taking the time to give feedback, I'm forever grateful to the HN community.

</comment><comment><USER11> Have you thought of running this as a service? Would be nice to just through an NPM module at it and make sure it will run across multiple versions. Without having to install docker, etc. Not sure I'd pay for it, but maybe somebody would...

<comment><USER12> Other languages have this sort of test service available for open-source modules. One example is cpantesters.org, which is integrated into Perl's package repository. Not only is it easy to check what passes in your environment, it also makes it easy for module authors to fix bugs in environments that the author has no (other) access to.

<comment><AUTHOR> Funny you should say so, the origin of the idea behind autochecker, is actually CPAN's and CRAN's way of automatically test packages.

</comment></comment></comment><comment> full-of-foo Awesome job! Can't wait to try it.

An aside - over the last few months I began running my containers on two popular CI services and have had some serious pain. I have a slight feeling you will regret the words: "works well with CI as well!"

<comment><AUTHOR> Hah, we'll see! Did some initial testing on Circle, Travis and Jenkins but still have a lot to test left.

Maybe I should be more careful with my words in the future...

</comment></comment><comment><USER13> A few months ago, I wrote something similar with the goal to test on multiple Linux distributions: [https://github.com/jgillich/chimera](https://github.com/jgillich/chimera)

It however doesn't execute the containers simultaneously, that is really cool!

</comment><comment><USER14> Would you implement binary search? A feature like git-bisect could be usefull to find breaking changes.

<comment><USER15> I might give it a go. That was one of the first things I thought of!

<comment><AUTHOR> By all means, please do :) Would be very interesting in having this as a feature.

</comment></comment></comment><comment><USER16> I can't help it - the first thing I thought of was doing a mashup of this and leftpad as a service :)

</comment><comment><USER17> Finally... a place to make sure my left pad module works cross-version.

</comment><comment><USER18> Nice one Victor :)

</comment><comment><USER19> Frankly, I feel like this is an indictment of all software development, everywhere. When you need to do this kind of a thing, you are doing it wrong. I do not mean I am doing it any better, I have the same issues e.g. working on Android, but there are probably some fundamental things we could be doing to avoid all these horrible symptoms. Things like NixOS come to mind, where people are actively researching and experimenting with possibly better alternatives. I pray somehow somebody smart and motivated can find some fundamental solutions instead of this rube goldberg overkill type answer.

<comment><USER20> Wouldnt the only solution to "see if you code worked with changing apis" to either

1) never change apis even if you were wrong or you have more opportunities or 2) know everything beforehand and implement the api perfect

<comment><USER21> also 3) have enough time to implement all the features after having this magic insight. A lot of people take for granted that successful software makes tough choices to ship

</comment></comment></comment><comment><USER22> This is why I hate ES6. JavaScript used to be a write once, run anywhere language.

We sacrificed that for syntactic sugar.

<comment><USER23> Then just write es5. It'll still run everywhere forever.

<comment><USER22> That's my plan. But it means I can't use other people's modules anymore.

<comment><USER24> Why? Put a transpiler inside your build chain.

<comment><USER22> This almost always leads to broken debugging, which I think is a bad tradeoff.

Most node developers seem to not use a debugger, but I think that's a huge productivity sacrifice.</comment></comment></comment></comment></comment>


When Microsoft Plans to End Its Free Windows 10 Upgrade Offer - <AUTHOR> https://hothardware.com/news/heres-when-microsoft-plans-end-free-windows-10-upgrade-offer <comment><USER2> Microsoft will never end the Windows 10 upgrade offer. They want _all_ Win 7 and 8/8.1 users on Win 10. The advantages of having a device upgrade from 7->10 include the following:

\- Windows 10 has a more restrictive license. Telemetry sharing and automatic updates cannot be turned off on all Win 10 upgrades.

\- The shrinking and eventual elimination of Windows 7 devices means fewer older devices to support, fewer patches to backport, etc.

\- People that have paid for their Windows 7 license offer no further revenue to Microsoft. Microsoft is basically losing money on them, being obliged to continue supporting a device that paid for its license five years ago. People on Windows 10, however, provide "value" (as a stand-in for direct revenue) to Microsoft in the form of analytics and telemetry.

\- People on Windows 10 are inherently more likely to participate in Microsoft's other, more profitable subscription-based models ala Office 365.

<comment><USER3> Microsoft has established support timelines. They will have to backport fixes and carryout whatever level of support they do regardless of how many people upgrade, because it will never be 100%. More users on Win10 just means a better pitch to app developers about using the latest Store-enabled APIs.

But you're right they want to show improving numbers and then mine users for ads. MS absolutely hates how they let online/mobile/advertising slip out of their grasp due to terrible management. So they're poorly trying to implement the Google model to compensate.

Thing is, they are sucking at it. Let people turn off telemetry, little to lose - unless they want to condition people all they are doing is fomenting anger towards MS. And if you're going to go all in, then have some taste. Fix the store. Stop spamming shit in the start menu. But take a look at XBox with its ad-covered dashboard and we can see MS just does not get it and is doomed to poorly trying to ape others and doing it with zero class.

But hey at least we are getting nicer dev stories from them! I love that enterprises enjoy paying crazy prices for Azure "solutions" as it subsidizes MS investing in dev tech.

<comment><USER4> I don't even mind the telemetry data as some of the in your face passive advertising and additional "features" and apps I could care less about. I finally went linux on my home desktop a few months ago, I was so sick of it. No, I don't want Edge as my main browser. No, wtf is this contacts thing you added in that I can't seem to remove. Can you please get rid of these cards for apps I don't have installed? No, I don't want to install MS-* now..

I mean, just give me a nice OS to work with.. hell, I like Windows 10 fine, if they'd stop shoving adware down the update channel.

<comment><USER5> > No, wtf is this contacts thing you added in that I can't seem to remove.

HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People, key PeopleBand of type Dword, set to 0.

However, normal people should not resort to configuring their system via registry. This should be normal, disableable feature, if it has to be there at all.

Do not forget to re-check after earch update.

And yes, I do mind the telemetry data. So do I mind resetting the user preferences by updates and forced updates too.

<comment><USER6> "Normal people" are right-clicking the taskbar and clearing "Show People on the taskbar" checkbox.

Or even more straightforward: Settings -> Personalization -> Taskbar.

</comment></comment></comment></comment></comment><comment><USER7> Article synopsis: "When do they plan to end the offer? This article doesn't know. Probably the end date MS themselves specify. Oh you thought it was over already? Well did you know that if you need assistive tech, or say you do on the honor system, you can still get the Win 10 free upgrade? Interesting, eh?"

<comment><USER8> Strange thing is, I didn't realise the regular offered ended and successfully upgraded 4 Windows 8.1 machines in the last month or so without any issue or doing anything regarding "Assistive tech".

I just put the Windows 10 ISO from the Microsoft site on a USB, kicked the install off, entered the Windows 8.1 licence key from the OEM sticker on the machine and it happily installed and activated.

Not sure if I'm an edge case with some peculiarity with our hardware vendor, but was surprised to learn the upgrade window finished sometime ago...

<comment><USER9> If the machines are branded laptops (or branded desktops like Dell or something) this can be an expected behavior: the license key that the Windows 10 licensing code checks and accepts by design could have been stored in the machine. It is still machine and vendor dependent.

If you've made any of the machines, e.g. by buying a motherboard or a barebone and then by installing Windows 8.1 yourself, it's a news to me.

EDIT: I'm especially interested in upgrades, not in "clean" installs. Most of the users don't want to start from the scratch with configuring every program they use.

<comment><USER10> I did an W10 clean install on a friend's selfbuilt PC using his 8.1 product key. Activated just fine.

OEM BIOS unlocks tend to not work between Windows versions. I've experimented with this a little. My go-to method to upgrade these is to clean install the version that will BIOS unlock, activate it, then upgrade that to Windows 10. After you upgrade, you can clean install Windows 10 on the system and it will activate normally.

</comment></comment></comment></comment><comment><USER11> You don't even need to do the trick in this article. According to Paul Thurrott, you can still activate with a Windows 7 or 8.1 key: [https://www.thurrott.com/windows/windows-10/142616/yes- can-s...](https://www.thurrott.com/windows/windows-10/142616/yes-can-still- clean-install-windows-10-windows-78-x-key)

<comment><USER8> Ah, I just posted about my experience below on this. I can confirm this worked for me, with no lies about "Assitive Tech" within the last month with 4 different OEM Windows 8.1 licences.

<comment><USER12> Yep, I've installed a fresh copy of Windows 10 using a Windows 7 key that has never been used to upgrade to Windows 10 before just the other week - it all worked without any issue, the system activated itself fine. No tricks needed.

</comment></comment></comment><comment><USER10> Microsoft never stopped allowing you to activate Windows 7/8 product keys on Windows 10 installation media. I think they've stopped advertising the free upgrades as it was (supposedly) putting a damper on new PC sales[1].

1\. [https://www.networkworld.com/article/3098044/computers/its-o...](https://www.networkworld.com/article/3098044/computers/its- official-sorta-windows-10-kneecapped-pc-sales.html)

</comment><comment><USER13> Still can't actually opt out of forced updates (non-critical security at least)? Still can't actually kill the extremely invasive telemetry? Still can't get LTSB/equivalent as an individual user to help resolve the aforementioned issues?

Still not interested.

<comment><USER14> I've got rid of updates and some of the tracking on my Win10 pro by disabling the associated windows services. Other annoying quirks like the OneDrive icon can be removed by editing the registry. I do wish that Microsoft would provide an easier way to do this.

<comment><USER4> There are a few automated scripts that do this... what was it, 98 lite or something like that back in the day... need something similar for windows 10.

</comment></comment></comment><comment><USER15> Interestly the US page[0] gives an end date of the end of the year but the GB page[1] doesn't and the FAQ for the GB page states they "will make a public announcement before ending the offer".

[0] [https://www.microsoft.com/en- us/accessibility/windows10upgra...](https://www.microsoft.com/en- us/accessibility/windows10upgrade)

[1] [https://www.microsoft.com/en- gb/accessibility/windows10upgra...](https://www.microsoft.com/en- gb/accessibility/windows10upgrade)

</comment><comment><USER16> I work faster on win7. Why switch

<comment><USER17> They're the same OS, how would you be "faster" on 7?

<comment><USER16> when OS doesnt get in the way, and keyboard shortcuts work.</comment></comment></comment>


"Nones" on the Rise: One-in-Five U.S. Adults Have No Religious Affiliation - <AUTHOR> http://www.pewforum.org/Unaffiliated/nones-on-the-rise.aspx

<comment><USER2> A quote from the article: "In the last five years alone, the unaffiliated have increased from just over 15% to just under 20% of all U.S. adults."

I doubt that the true unaffiliated percentage has changed that much over such a short time period. I think these numbers actually reflect people's willingness to reveal that they're unaffiliated, in other words, to publicly "come out" as atheists or agnostics.

Don't get me wrong -- I see this as a good thing overall, I just think the reason for the change is not what it seems. The first step is to discover religion has nothing to offer an intelligent person. The second step is to be willing to let your neighbors know what you've decided, to "come out". The second step is often much harder.

But the big change is still a long way off -- the day an atheist can run for president without being laughed off the stage.

<comment><USER3> While I think this "coming out" is an intelligent observation, I don't agree with your "first step", discovering what religion (not) has to offer to a person. With that comment I can't upvote the entire statement.

To start with, it probably offers a sense of community. It can also help bridge gaps between different parts of our society. I appreciate the charity work. However, I'm part of the 20%, so I'm standing at the sidelines on this one.

<comment><USER2> > To start with, it probably offers a sense of community.

With all respect, the religious aspect of a human community is a coincidence -- on can have a community without the religious context. I personally think it's an unfortunate accident of history that so many human communities are built on a scaffolding of religion.

> It can also help bridge gaps between different parts of our society.

It is here that you touch an important point, indeed a critical one. History shows us that, overall, religion creates gaps, it doesn't mend them. For each religious endeavor to reach across a chasm between people, there are ten religious endeavors to create the chasm in the first place.

<comment><USER4> First you say the religious aspect of communities is coincidental then you say that religion forms chasm-surrounded communities.

Which is it?

<comment><USER2> > First you say the religious aspect of communities is coincidental then you > say that religion forms chasm-surrounded communities. Which is it?

The dichotomy you think you see doesn't exist. They're both true.

Let me spell it out for you:

* The fact that many human communities are religious is a coincidence, an accident of history.

* Those religions that do form, tend to isolate themselves from other communities, sometimes by trying to convert or kill everyone they meet. This doesn't prevent them from being a community, any more than a community of rattlesnakes is not a legitimate community solely on the ground that it's dangerous to surrounding communities.

Clear now?

</comment></comment></comment></comment></comment><comment><USER5> Without going into religious talk, one of the things I'm interested in with the growing acceptance of religious unaffiliation is the gap left by churches/synagogues/etc.

As a decidedly non-religious person raised in a Christian household, I grew to love the sense of community and charity fostered by the organization. With the current trend of urban migration, I'm not sure what's going to replace that.

</comment><comment><USER6> I think this is more of a reflection of the current state of religion in the country and its move to the extremes rather than a change in people's beliefs.

Religion has become so occupied in polarizing issues (e.g. politics) and scandals, that belonging to one of these organization's has changed from being part of a philosophy/community to an extremist organization.

Don't get me wrong I'm a strong contingent of the 20% but I believe there is a place for religion as well. I believe that religion has both the ability to be productive for a community as well as very destructive for an individual.

The founders got it right with the first amendment and the separation of church and state. It's too bad that the same people who clutch the constitution so firmly in one hand also carry the bible in the other these days.

<comment><USER7> So, if I understand you correctly, an (for example) ex-southern-baptist (by upbringing) would be far more loathe to consider going to a (for example) Unitarian/Universalist church or even become a Buddhist than to forego religion altogether?

As someone who was brought up religious but now does not go to church/temple - I would probably fit your mold.

However, I would be interested in joining some community organization just to get that greater sense of belonging that I'm sure I could use.

</comment></comment><comment><USER8> Ah yes, Hacker News... the go-to place for all your news on religion.</comment>


Square Market Accepts Bitcoin - <AUTHOR> http://corner.squareup.com/2014/03/square-market-accepts-bitcoin.html <comment><USER2> This is a strange case for bitcoin, competing with credit cards. Most consumers would be better off paying with a card: same cost (none), more protections (the ability to dispute bad merchants over defective goods).

It's not a bad idea for Square to add it, since some people have bitcoins obtained through speculation, mining, cheap money transfers, and so forth. But even so, they would be a little better served paying by card, due to the extra consumer protections they'd enjoy.

Where bitcoin makes more sense to me is in replacing cash. But that mostly makes sense to me in the real world where you can inspect goods and whatnot in advance of cash payments. (There's maybe some potential for it online in the form of micropayments, where trust and protections don't matter so much.)

But for online sellers that already accept cards, I have yet to hear why bitcoin reflects a better choice than cards for the consumer. Anonymity maybe? For the average consumer, not worth the tradeoff in lack of ripoff protection.

 _Sellers_ would be better off, sure, but don't forget it's a two-sided market and consumers are heavily incentivized to use cards. Most of those "high fees" are funneled back to the consumer's pocket in the form of benefits and rewards. It's a form of lock-in to the CC system.

<comment><USER3> > Most consumers would be better off paying with a card: same cost (none)

Correction here: There IS a credit card cost, but it is billed to the merchant _and passed along to the consumer by being built into product prices_. The fact that you think it is "none" when it is merely "hidden" speaks volumes.

<comment><USER4> In that case, a merchant would have to offer a discount in order to make Bitcoin worth pursuing.

<comment><USER5> Don't the credit card companies require that you charge the same price for cash or credit?

<comment><USER6> I believe it's ok to offer a discount for cash as long as you don't have to pay more than the posted price when you use credit.

<comment><USER7> Some gas stations allow you to pay for Diesel with cash at a discount. As a side note, Flash Foods has a card you can get that uses ACH with your debit account (I'm probably not saying that right). You get a flat $0.05 off of gas. They claim it's because of credit card charges (and because ACH doesn't cost them anything).

</comment></comment></comment></comment></comment></comment><comment><USER8> How is Square/Stripe getting around the issue that most exchanges wait for 6 confirmations before a transaction is accepted? Are they ignoring the risk of a double spend and just going ahead once a transaction has propagated to the network for mining?

<comment><USER9> Probably. Unless you're working in concert with major mining power, it's still hard to engineer a successful double-spend. And by pushing their preferred observed transaction to major pools, Square _could_ help ensure a double-spend can't succeed, or get a near-instant indication that a competing transaction exists. (I don't know if they're doing this.)

It also looks like most 'Square Market' purchases take more than an hour to deliver/ship... so the payment validity will be known before a hypothetical fraudster benefits.

<comment><USER8> Makes me wonder - would we ever get to a point where it's in Square/Stripe/Coinbase/et. al's interests to contribute mining power to help their own transactions along? Or is that pretty much taken care of by transaction fees?

<comment><USER9> I suspect they'd just strike deals with existing mining specialists, if and when necessary, perhaps even via out-of-band (non-Bitcoin-transaction) exchanges of considerations.

</comment></comment></comment></comment><comment><USER10> A not-insignificant group of existing payment processors / ecommerce platforms are now supporting Bitcoin. Shopify, Balanced (sort of), Stripe, and now Square. Am I missing any?

<comment><USER11> Hey, Steve from Balanced here. Curious as to why you say 'sort of' for us: if it's that we're in beta, so is Stripe.

(We're hoping to get out of beta in the near-ish timeframe.)

<comment><USER10> Last I saw, you accepted Bitcoins only from Coinbase accounts. Until I can directly pay with Bitcoins from my own wallet I consider that "sort of".

<comment><USER11> Ahh gotcha. Yes, we believe that's a pretty important distinction. Fair enough!

<comment><USER12> What's the reason for this? Is it part of Coinbase's payment integration? I don't recall any other websites doing this (although there's the possibility that I simply haven't used other sites that also do this)

<comment><USER11> There are a couple of reasons, actually. This will be a short version of something I'm still in the process of writing, so consider this very high level, broad strokes. Consider "Coinbase" a stand-in for any service like it. I also know that lots of Bitcoin enthusiasts won't agree with me, and that's fine.

The most important one is that merchants generally want USD, not BTC. Instant Exchange is a really important feature of Coinbase, and so even if we did support bare addresses, they would still be generated through Coinbase anyway, because giving our merchants USD is killer. Since Balanced isn't interested in getting in the business of holding and selling BTC, we'd need to do that through some sort of service, and Coinbase is the biggest and best one.

Secondly, the UX for Coinbase-only payment is vastly superior to using bare addresses. People are generally familiar with "sign in via Facebook," and Coinbase's OAuth works the same way. Using a Bitcoin wallet to buy something on a site is very strange until you've done it a few times. Enthusiasts will know what's going on, just like any early adopter will. But for most cases, Coinbase only is waaaay better.

Coinbase <-> Coinbase transactions have another special property: they can be off-blockchain. I don't remember offhand if they are for all purchases, but they are for microtransactions, at least. Coinbase can (could?) not wait for the ten minutes to confirm a transaction, since they'd just be updating balances within Coinbase itself. They could build options in that consumers have come to expect, like chargebacks, holds, and other things, that the protocol would not inherently have to support.

Next, we feel that Bitcoin is best thought of as cash. Like, physical, printed notes. Websites don't actually accept USD, for example: they accept Visa, which is a financial instrument that happens to be denominated in USD. You can't mail a twenty dollar bill to most SaaS products: that'd be really silly, for a number of reasons. Using bitcoin-qt is like paying with cash, and paying with cash works great in some ways, but is a pain in others. Chargebacks, for example, are an incredibly important part of the advantage consumers see in using credit cards, and nothing like that exists with 'raw' Bitcoin in any significant capacity.

I guess that could all be summed up with "Most people don't actually use cash, because it's pretty inconvenient. They use a financial instrument on top of cash, because it offers a bunch of advantages for online purchases. A successful Bitcoin will be no different."

<comment><USER13> Sorry Steve, I have a lot of respect for everything you're doing at Balanced, but wow.. everything about this is wrong.

1\. "Merchants generally want USD, not BTC". Coinbase supports BTC -> USD. It's an exchange. You don't need to use their OAuth to convert BTC to USD.

2\. "The UX is vastly superior to using a bare address". If you're using Bitcoin, you better know how to use an address. Not sure how that would be confusing to anyone using Bitcoin. Most sites use bare address + QR code.

3\. "You can't mail a twenty dollar bill to most SaaS products". This is what Bitcoin solves! People are using Bitcoin to get away from the credit card paradigm. This is a broken implementation of "accepting BTC". You don't accept BTC, you accept Coinbase.

<comment><USER11> 1\. Yes, I understand Instant Exchange is separate. This is about how we wouldn't roll our own solution, _someone_ would be powering our Bitcoin integration.

2\. Yes, as I said, if you know what's going on, it won't be weird to you. That said, cart abandonment is a big problem, as is keeping checkout pages as simple as possible.

3\. Again, this is where we'll have to disagree. You say "people are using Bitcoin to get away from the credit card paradigm", but I say "people are not using Bitcoin because it's too far away from the credit card paradigm." If the Bitcoin community wants to grow outside of the fringe libertarian set, they'll need to understand people's needs more and their dreams less. I myself stayed away from BTC for years simply because of the rhetoric. People that aren't inherently interested in cryptocurrencies aren't going to use them unless they solve a problem they actually have.

<comment><USER14> Regarding raw addresses, I would encourage you to look into the payment protocol (BIP70). Once that is widespread (it is already implemented in some wallets), the average BTC user will never have to worry about raw addresses, without the downside of having to route everything through coinbase. As a plus, the UX is IMO, better than that of typing in a CC number.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Does anyone have an opinion on why the price of Bitcoin doesn't seem to move on news like this? It seems significant in my opinion and I would think that wider acceptance would lead to a higher price, but that hasn't been the case over the past few weeks / announcements.

<comment><USER16> It seems to be following a repeating pattern.

* Bitcoin builds infrastructure.

* People notice bitcoin isn't going away

* Media says Bitcoin will make everyone Gazillionairres

* Bitcoin skyrockets until infrastructure comes under strain.

* Something involved with bitcoin breaks

* Media(not neccisarrily the same media) says Bitcoin is all over, and everybody will lose their bitoin, their home, and their dog.

* Price drops.

* Bitcoin builds infrastructure.

* People notice bitcoin isn't going away

We seem be going into the build infrastructure phase. That's where genuine value actually gets added, and doesn't actually stop at the other times, It's just when the craziness is going on it's hard to see from the noise.

<comment><USER17> > * Bitcoin skyrockets until infrastructure comes under strain.

Source? Unless you consider the failure of Mt. Gox an "infrastructure" problem, then this is not the case.

<comment><USER18> It's hard to see how that wasn't an "infrastructure" problem. Mt Gox was the largest BTC exchange - an integral bridge from old world to BTC world.

</comment></comment></comment></comment><comment><USER19> Sort of starting to feel like all the crappy Bitcoin-specific businesses are about to get replaced by their "normal" equivalents who will just suddenly start taking Bitcoin. Much less disruption than new privacy/security/anonymity focused companies who were early Bitcoin adopters replacing old institutions, but much more likely to actually work.

Kind of the equivalent of NYT becoming a major website for news, rather than something organic to the Internet becoming the main news site of record.

<comment><USER20> I don't really think this is a problem, though. The point of bitcoin is not to distrupt businesses, it is to disrupt traditional currencies. That traditional businesses are accepting it is a sign of good, not bad.

<comment><USER19> I agree that it's a sign of maturity and success for Bitcoin itself; it's just not a great sign for people who invested in Bitcoin-specific businesses.

A great position right now would probably be "products and services to help service providers integrate bitcoin into their core products". Simple merchant integration is one thing, but more in-depth integrations would be interesting.

</comment></comment></comment><comment><USER21> Looks like this is only for square market stuff right now.

Any clues on when this will get pushed out to mobile clients? Because that will be absolutely huge.

[https://squareup.com/market](https://squareup.com/market)

</comment><comment><USER22> It'll be interesting to see if this announcement actually helps increase the price of Bitcoin which has taken a few hits over the last few months due to countless exchanges being hacked and collapsing (one of those being Mt Gox), to the IRS's announcement proclaiming Bitcoin is property not currency and other bumps in the road.

Initial indications seem to suggest this far the announcement has done little to raise the price of Bitcoin. Time will tell and I personally think this is a great step in the right direction, eventually even Paypal will allow you to accept Bitcoin, it is only a matter of time.

</comment><comment><USER23> When Bitcoin's are converted to a fiat currency that's now a taxable event correct? That's when the gain or loss is "realized" So if you pay in Bitcoin and the platform/processor immediately converts it into $US to pay the merchant does that create a taxable event for the seller? I suspect people would like to pay in Bitcoin to a merchant who accepts and keeps it in Bitcoin so that a gain is not realized and no taxable event occurs. But really am curious/scratching head/not sure.

<comment><USER24> I believe the taxable event is exchanging Bitcoin for something that isn't Bitcoin. Even if the merchant holds on to the Bitcoin, a gain has been realized.

<comment><USER23> Got it. So that makes sense. If I pay someone in 100 shares of Google vs $US for a service I no longer own the shares but have transferred them to someone else and would be on the hook for the gain or the loss.

<comment><USER25> This is perhaps the most useful way of looking at Bitcoin today. Now that the tax treatment of Bitcoin has been established, using Bitcoin as currency makes about as much sense as using stock as currency. In other words, it doesn't.

<comment><USER24> Can I transfer stock to you with three taps on my phone? Bitcoin makes far more sense than stock as currency, especially if higher sustained demand reduces fluctuations in value, which isn't typical for stocks.

<comment><USER25> Based on your comment, I would guess that you have never had to file a long Schedule D. Accurately tracking your short and long term capital gains and losses is not always as straightforward as it might seem, especially when you have lots of transactions. Additionally, there are often associated matters (such as carryovers) that you wouldn't want to address without the assistance of a qualified professional. Unless you're an investor/trader who is familiar with these issues and has enough money at play to make it worth your while, the hassle, costs and liability that could arise should you make a mistake are going to quickly eliminate the utility of using Bitcoin over USD.

Additionally, you need to look at this from the perspective of a merchant. The average merchant has expenses denominated in US dollars and accepts payment in US dollars. There is no FX risk. Bitcoin changes that. Do you honestly believe that the average merchant is equipped to manage FX risk, or has any appetite for FX exposure in the first place?

Please note that volatility is a red herring. Volatility has no bearing on the costs associated with tracking capital gains and losses (you need to accurately track your transactions regardless), and while the level of volatility will certainly impact _how_ you manage FX risk, low volatility doesn't mean that there is no risk to address.

<comment><USER24> Merchants don't need to expose themselves to FX risk to accept Bitcoin. Square does that for you, as do Coinbase, Bitpay, and similar companies.

I don't think the tax issues will be prohibitively complicated for consumers. Whichever exchange someone uses to buy Bitcoin and whatever app they use the spend it can easily generate the necessary paperwork. The companies have hundreds of millions of dollars on the line that require Bitcoin to be easy to use. They're going to do it.

<comment><USER25> > Merchants don't need to expose themselves to FX risk to accept Bitcoin. > Square does that for you, as do Coinbase, Bitpay, and similar companies.

Allowing your payment provider to handle currency conversion for you does not mean that you have eliminated FX risk. You have simply outsourced it, and you (and in many cases your buyer) almost always pay for this.

> I don't think the tax issues will be prohibitively complicated for > consumers. Whichever exchange someone uses to buy Bitcoin and whatever app > they use the spend it can easily generate the necessary paperwork.

I suspect you've never had to file a tax return with a significant number of transactions involving capital gains and losses. There are often associated matters, such as carryovers, that the average person will need the services of a tax professional to address.

As for the notion that somebody is going to do the paperwork for you: the nature of Bitcoin makes the generation of the paperwork you refer to incredibly difficult.

Currently, when dealing with securities like stock, brokers must provide you with a 1099-B which reports information about the transaction, including the cost basis and sale proceeds. If you transfer securities between brokers, the broker transferring your securities is required to report the cost basis data to the receiving broker.

To the best of my knowledge, Bitcoin is not a covered security for which institutions must provide a 1099-B, so no third party is obligated to provide you with accurate records. More importantly, it may be impossible for third parties to do this for you. For instance, consider this hypothetical yet almost certainly common transaction scenario:

1\. I buy 1 BTC using Provider A.

2\. I transfer .5 BTC from my account at Provider A to a local wallet housed on my computer.

3\. I later transfer that .5 BTC to Provider B.

4\. Using Provider B, I send the .5 BTC to a merchant.

In Step 2, Provider A will be faced with the challenge of determining whether my transfer of .5 BTC represented a sale for tax purposes. It should not, as I was transferring the BTC to myself. But how does Provider A know who I transferred the BTC to?

In Step 3, Provider B has no way of obtaining my cost basis and in Step 4, it is faced with the challenge of determining whether or not the transfer of .5 BTC represented a sale for tax purposes. How does it know that I wasn't transferring the .5 BTC to myself?

Now imagine this across _n_ wallets, including desktop wallets, and with lots of fractions of BTC. You're going to be investing a lot of USD in bookkeeping/accounting.

Bottom line: I can't for the life of me imagine why anybody who actually understands the implications of this would ever use Bitcoin as a currency going forward. As far as I'm concerned, it makes absolutely no sense except as a vehicle for investment or speculation.

<comment><USER26> Having to treat it as a stock or a commodity makes it a bad currency, but it was already a bad currency due to volatility. Using a currency that has major deflation is just as silly as using one that has major inflation.

A currency's utility is directly linked at how many people use it as a unit of account, and it's really hard to become people's real unit of account when your value changes a lot, and is unpredictable. Just look at Argentina during the crisis: Even when taxes in the country were paid in pesos, people really used the US dollar as their unit of account.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> I know this is offtopic... but I recently emailed the squareup's support over an issue that got me really mad at their development team (or whoever is reponsible). I was trying to buy some elementary OS stickers as I've been using it for over a year now and I'm extremely happy with it. Turns out you cant order anything from squareup if you are accessing outside of US. What made me write to their support is that there is no notification about it when you try to buy a product. It just shows you "add product to list" button but hides "buy" or add to cart button and does not display any info on why the buttons are missing. I mean... if you implemented a solution that detect non us ips and made an effort to hide the buy button... at the very least put some notification in there. Sometimes I really cant understand stuff like this >.>

My first post here is a rant... dang it.

</comment><comment><USER28> Good to see. Businesses that offer marketplace services should have no objection to integrating bitcoin as a payment option. It does not deteriorate the merchant or consumer experience (regardless of whether or not they use or hold bitcoin), so they have nothing to lose, and all to gain.

For Square, it's just an extra payment method that they're hoping will help their merchants (and them) tap into the very small percentage of evangelistic early adopters who have made large gains and are now willing to spend some of their coins.

Square is most probably _not_ a supporter of the vision of bitcoin taking over e-commerce payments. Most of their business stems from partnerships with large credit card companies. This is a pure (and smart) marketing play.

<comment><USER29> No need to speculate on their motives, Jack Dorsey explains them here: [http://www.youtube.com/watch?v=0zJe4PUVx3c](http://www.youtube.com/watch?v=0zJe4PUVx3c)

</comment></comment><comment><USER30> Curious if they are going to take a lower transaction fee on Bitcoin payments as opposed to credit card purchases. They really should.

<comment><USER21> Why? They are incurring a potentially-substantial risk in facilitating the transaction for you, as well as providing the infrastructure for you.

That's why CC fees exist, and that's why people providing bitcoin-related services should be able to charge fees too.

<comment><USER31> Because otherwise people will just stick to credit cards?

</comment></comment></comment><comment><USER32> It's great to see the adoption of bitcoin payments by major players like Square and Stripe! Super exciting

<comment><USER33> Next milestone: for me to stop confusing the two...

</comment></comment><comment><USER34> Companies like Square and Stripe making it easy to pay with Bitcoin will have a huge affect on whether the general population accepts the cryptocurrency.

</comment><comment><USER35> So has the Square app been banned from the Apple App Store yet?

EDIT: I guess if its just the square market, which is just a website (I think).

</comment><comment><USER36> I find it cool!

</comment><comment><USER37> Umm... April fools?

<comment><USER38> Is not an april fools joke. Was a hackday project that turned cool.

</comment></comment><comment><USER39> This has to be an April Fool's joke.</comment>


Open Distro for Elasticsearch (By AWS) - <AUTHOR> https://github.com/opendistro-for-elasticsearch <comment><USER2> A sign that these new "source available" licenses and business models were not the right path?</comment>


When will stackexchange be available? (it's now 9/1 everywhere) - <AUTHOR> http://stackexchange.com/

<comment><USER2> I predict it will be ready in 6 to 8 more weeks.</comment>


CapOneMe – a vulnerable cloud environment to demonstrate the Capital One breach - <AUTHOR> https://github.com/avishayil/caponeme <comment><USER2> To be fair to the folks at Capital One, the mitigation leverages a feature that wasn't released until well after they were compromised.

[https://aws.amazon.com/blogs/security/defense-in-depth- open-...](https://aws.amazon.com/blogs/security/defense-in-depth-open- firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/)

I would also suggest taking a look at the various articles around AWS IAM privilege escalation:

[https://rhinosecuritylabs.com/aws/aws-privilege- escalation-m...](https://rhinosecuritylabs.com/aws/aws-privilege-escalation- methods-mitigation/)

[https://know.bishopfox.com/research/privilege-escalation- in-...](https://know.bishopfox.com/research/privilege-escalation-in-aws) (just shared on HN recently)

<comment><AUTHOR> I have nothing against Capital One, but I must say that Netflix published this article in November 2018: [https://medium.com/netflix-techblog/netflix- information-secu...](https://medium.com/netflix-techblog/netflix-information- security-preventing-credential-compromise-in-aws-41b112c15179) I would expect folks to be prepared for this kind of vulnerability. Anyway the repo is for educational purposes and it's sarcastic name is, well, saracastic. Cap One is a great technology company.

<comment><USER3> Interestingly, the author of that Netflix article had joined CaptitalOne about a month before the incident.

<comment><USER2> CapOne also maintains Cloud Custodian, which a lot of people use to great effect to help prevent stuff like this.

Ultimately I think it just shows that securing cloud infrastructure is difficult to do consistently when you move quickly and broadly at scale. It also shows that the specific mechanism for authenticating EC2 instances had some design issues. These have been known about for a long time of course and it is kind of disappointing how long it took AWS to do something about it.

<comment><USER4> Cloud custodian is maintained by the community, capitalone has not had any maintainers on staff for around a year, though they still use and occasionally contribute prs. The major contributors and maintainers over the last year have been the cloud providers. The community has been working with capitalone to move it into cncf in 2020.

<comment><USER5> Huge fan working with you on one issue and glad to see you are everywhere setting the record straight, Kapil!

</comment></comment></comment></comment></comment></comment><comment><USER6> AWS IAM is a hot mess. Even setting up an S3 bucket with an access key for uploading is a 15 step process, minimum, with a lot of opportunity to fuck up.

<comment><USER7> Maybe through the GUI, it's a single step with the CLI.

<comment><USER6> Please elaborate. How is this achieved in one step with the CLI?

<comment><USER8> Well, you'll have a two-hundred line IAM policy and a half-dozen API calls encoded into a script, but once you have that script its just one step! All you do is run the script!

<comment><USER9> And if something in the script goes wrong midway through, you've automated a big mess! I love it!

Really should, I've always thought AWS was just a bunch of hacked together services and it kinda shows. This is why you don't let the engineers talk to the customers... er design for the customers.

</comment></comment></comment></comment></comment><comment><USER10> You could also partially prevent this using vpc endpoints for s3. You can set the bucket policy to only allow if the connection is via the endpoint (vpc) so the bucket's no longer internet accessible. Vpc endpoints also reduce traffic charges since you pay for internal AWS bandwidth instead of internet bandwidth.

I'm kind of surprised AWS doesn't just enable VPC endpoints for all services by default. Having to leave the network to talk to services seems like overkill for most things.

<comment><USER11> Completely agree. I also don't see the need to egress to the public internet to access AWS services.

It's also worth noting that whilst I'm a HUGE believer in VPC endpoints, it comes with a cost. Which then makes it a security vs cost trade off. As you'll still pay bandwidth charges on the network interfaces (ENIs) for the VPCEs, along with the hourly price for said ENIs.

If Amazon changed this, I'd happily change all my networking to use VPCEs for all AWS services (where applicable). Unfortunately it seems they're not going to do this, despite continuously adding new services to the list of VPCE- enabled services.

</comment></comment><comment><USER12> Some others in this space:

\- flAWS (flaws.cloud / flaws2.cloud) by Scott Piper

\- CloudGoat ([https://rhinosecuritylabs.com/aws/cloudgoat-vulnerable- desig...](https://rhinosecuritylabs.com/aws/cloudgoat-vulnerable-design-aws- environment/)) by Rhino Security Labs

<comment><AUTHOR> Must say I was inspired by them

</comment></comment><comment><USER13> [https://application.security](https://application.security) for a better demo of the CapOne hack !

</comment><comment><USER14> The LMGTFY link is, as usual, unnecessarily hostile.

<comment><USER15> It wasn't just hostile, it was completely bizarre. The whole point of the web is to link pages together with hyperlinks. Why do that and then put a big "F U" behind one of those links?

</comment></comment><comment><USER16> SSRF to metadata service to S3 access was the entry point. There's a lot of focus on the SSRF and metadata service components but the S3/IAM component is possibly more intriguing. Did the role/account follow the principle of least privilege? If not, how did they miss it? This is the company that opened sourced Cloud Custodian. They're capable of identifying risks and creating tooling to reduce lead time on finding those risks.

Possibly more intriguing: I'll bet Capital One deals with more compliance initiatives than 99% of the public sector. Another Heartland Payment Systems example? Did leadership have a false sense of safety after passing an audit?

<comment><USER2> That was a bush league SSRF that should have been caught by just about any static analysis tooling. That tells me something broke down early in the process.

That said, it's almost impossible to implement least privilege with EC2 instance roles unless you manage application identity in a separate control plane. Otherwise you have a single role that must satisfy the union of all access requirements for infrastructure automation, software deployment, logging, monitoring and discrete application runtime components. It's a mess and IMHO a terrible architecture.

The fact that the STS creds for that role are then made available via unauthenticated network service which _then_ are by default active from any endpoint on the planet unless explicitly locked down is insanity. Furthermore, locking said roles down requires discrete references to VPC endpoints and CIDR ranges that are unique to individual regions and have to be able to breathe with the environment. This makes your IAM lockdown policies gnarly and volatile, not a good recipe for availability.

It's no mean feat to really prevent this kind of thing in a fast-moving environment. Defense in depth is essential.

</comment></comment><comment><USER17> Check out application.security for a great interactive demo of the capital one breach

</comment><comment><USER18> Condition Context Keys [0] are pretty powerful. Even if an attacker obtains credentials vended by the EC2 instance metadata service, they wouldn't be able to make use of them.

I don't know why this isn't 'enabled by default' for IAM roles associated with EC2 instances.

[0]: [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition- keys.html)

<comment><USER19> These should absolutely be the defaults; I can't think of a single reason why an EC2 instance's IAM role credentials should be used outside of that instance other than perhaps troubleshooting.

To me, IAM is one of the most difficult AWS services to design securely. Every service has 20-50 sub-permissions (so developers simply default to using wildcards instead of carefully tuning each policy), there are 4+ different systems that combine to create each policy (a trust relationship, the permission body, optional conditions, plus managed policies and group policies), IAM roles can now have permission "boundaries" that further complicate their access rights, roles can be assumed by services (EC2, Lambda, etc.) and yet the credentials obtained as part of that role assumption can be used outside of those services (as demonstrated in the Capital One incident), and some services (e.g. S3, ECR) have additional permission policies at the resource level that interact with IAM policies in a two-way trust of sorts.

The entire thing is woefully complicated and it shows when AWS is in the news nearly every week because someone misconfigured yet another service.

</comment></comment><comment><AUTHOR> caponeme is a vulnerable cloud environment that meant to mock Capital One Breach for educational purposes

</comment><comment><USER20> All these finance companies keep trying to brand themselves as "tech companies" when they're really just technologically literate banks, even ycombinator is like this.

<comment><USER21> Are there any technologically illiterate banks? Between banking and insurance where did technologists operate at scale pre-internet (WWW)? Even with the rise of the internet banks were quick to adopt online features. Even my small credit union in Idaho had online banking in the 1990s.

If Facebook, Google and Amazon are technology companies banks definitely are.

<comment><USER22> > If Facebook, Google and Amazon are technology companies banks definitely > are.

Only if the banks actually write the software. A credit union that pays someone else for an online banking solution is as much of a tech company as the motel that pays for an online reservation system. At that point the term is useless.</comment></comment></comment>


Ask HN: Whats the hardest part of running your startup? - <AUTHOR>

<comment><USER2> I haven't been involved in running a startup for a few years now, since shutting mine down, but I remember when I was trying to start up I can tell you my greatest struggle.

I had an inheritance invested in parts to build my company's flagship rental product- a high end sound system which would have been rented to bands coming into town. I couldn't afford a new one so I assembled mine out of used assemblies I would rebuild into a new working unit for my own purposes. I had acquired all the parts I needed to build it right down to the tiniest nuts & bolts, but I was running out of money & needed to work on the company's business plan so I could get financing.

So I spent my time writing the business plan while the sound system sat there in pieces unassembled, unfit for rental. I needed to start selling it to generate income but I couldn't because it had yet to be assembled, & I had no time to build it- no money to hire help to assemble it, and found myself in a catch-22.

Then halfway through writing the business plan, I got sick & had to go to the hospital for a month, which _really_ took the wind out of my sails. With no insurance, this was the last straw, I had to call it quits to pay for the hospital stay. Thus my startup ended.</comment>


The Owl Thieves of Sweden - <AUTHOR> https://www.theatlantic.com/magazine/archive/2018/06/stealing-owls/559136/ <comment><USER2> It is an interesting phenomena that when 'easy' crime is eliminated the criminals move up to more violent things.

There has been speculation that the legalization of marijuana has led to an upswing in petty theft and muggings because of the loss of jobs as 'drug dealer' (well at least for pot). And the weird thing for me is that if you think of criminal activity as a job market it sort of makes sense, what is your low level criminal to do to earn a living?

Wouldn't it be odd if UBI was a solution to criminal activity? (or would that narrative be more paying off the criminals?) Interesting things to contemplate.

<comment><USER3> Any short term upswing as a result of idle criminals is likely to be drowned out in the long term by reduced financial feasibility.

Also a 15% increase in crime for a country with a fairly low crime rate could just be a statistical fluke...

For example, if the 2 bank robberies becomes 3 next year, I'm not sure it's fair panic over a 50% increase in bank robberies :)

</comment></comment><comment><USER4> _A single great gray owl—known as the "phantom of the north"—now goes for 1 million kronor (about $120,000) on the dark web._

So, teach the Police in relevant areas how to breed Grey Owls and pretty soon the market value precludes owl theft and the species is no longer on the red list. I'll hand-wave the economics and feasibility at this point ...

OK, sillies apart, crime is here to stay and if you gradually exhaust one seam (mining analogy here) then you may cause another to become profitable - gradually. If you set fire to the seam then don't be too surprised if things change rapidly. On the bright side: journalists can publish articles about those rapid changes.

Also on the bright side: the article doesn't ramble, is informative and is an enjoyable read - a good example of a journo in great form.

<comment><USER5> The entire article only references owls once. As an owl enthusiast. I found the lack of bird related content extremely dissatisfying.

Also in reply to your idea about breeding owls. I'm sure you can guess that it is difficult to breed these animals in captivity. If it were not, owl breeding would be more profitable than owl stealing.

There are 3 reasons for this.

1) Owls are monogamous during the breeding season.

2) The hooting season is very short.

3) Owl eggs are delicious.

<comment><USER4> I too felt a little sold short on owl refs in the article. I live next door to a park with a very decent owl population judging by the row the buggers make (Tawny and Barn owls at least)

I've never tried an owl egg and I trust your assertion is not based on personal experience.

<comment><USER5> These are the only owl eggs we eat at my house.

[http://therebelchick.com/deviled-owl-eggs-recipe- california-...](http://therebelchick.com/deviled-owl-eggs-recipe-california- ripe-olives-calolivecrafts/)

<comment><USER4> Nice one. However - chicken eggs is ... ... ... are they better? ... ... ...

The olives are probably unperturbed.

</comment></comment></comment></comment></comment><comment><USER6> "Crimes against people—assault, robbery, fraud—are also on the rise. The Swedish National Council for Crime Prevention found that in 2016, 15.6 percent of the country's citizens fell prey to at least one such offense—the highest rate since the council launched its annual crime survey, 10 years before."

That... seems extremely high?

<comment><USER7> It also includes other crimes such as harassment and is not based on actual police reports.

[https://www.thelocal.se/20171116/a-growing-number-of- swedes-...](https://www.thelocal.se/20171116/a-growing-number-of-swedes-are- victims-of-crime-survey-assault-sexual-harassment)

</comment></comment><comment><USER8> I would not ordinarily link to reddit, but

[http://www.reddit.com/r/suberbowl](http://www.reddit.com/r/suberbowl)

not what you might think it is, from reading the URL.

<comment><USER9> One of the coffee shops I frequent has had big Superb Owl events every year for the last few. It's quite something.

It positions itself as the anti-bar.

</comment></comment><comment><USER10> How many (unused) post-it notes do you have to take with you for it to count as Stealing, rather than just "stealing"? If you take one normal stack a year home, is that enought to be a thief? Asking for a friend.

</comment><comment><USER9> _> Swedish bank robbers and light-fingered cashiers have gone the way of ABBA hit singles. _

I guess Swedish police should be ready for two bank robberies in December: [https://www.rollingstone.com/music/news/abba-record-first- ne...](https://www.rollingstone.com/music/news/abba-record-first-new-songs- together-in-35-years-w519624)

</comment><comment><USER9> Slightly off topic -- What do tourists do when they go to Sweden? When I go to a foreign country, I bring at least enough currency with me for the first few days to pay for transportation from the airport, tip the bellman and the room service and maid.

Do people just pick up a local cash card, like getting a local bus pass at a kiosk or a tobacconist?

<comment><USER11> My debit card from my bank works just fine overseas (I only ever have issues in the US where some places only seem to accept magnetic stripe, which seems less reliable).

<comment><USER12> Americans have the opposite problem: machines that require chip and pin. We have chips now, but not pins. When I visited Sweden with a chipless debit card it meant getting a passport photo taken in a Swedish photo booth at midnight involved convincing a cashier to give me 150 kronor in 10kr coins as change to feed the sole change-eating booth in the Stockholm central station

</comment></comment></comment><comment><USER13> Owls are useful.

Rather than using rat poison and setting up mouse traps, an owl can take care of rats very effectively.

<comment><USER5> That's an expensive (120k), mousetrap.

<comment><USER14> Nobody likes a rat, so it's worth it. Especially in prison.

</comment></comment></comment><comment><USER15> hm... the range map on wikipedia for that species doesn't even have them in sweden</comment>


Land of Lisp: Learn to Program in Lisp, One Game at a Time - <AUTHOR> http://oreilly.com/catalog/9781593272814/ <comment><USER2> I'm the author- The book is printing as we speak and should be hitting the stores late Oct/early Nov. Around that time a lot more info on the book will also be available at my new site landoflisp.com.

I'm really happy with how it turned out and I hope the new site (which I don't want to launch before the book is truly ready) will entice more folks to learn Lisp!

<comment><USER3> Why don't you come talk about it at the D.C. HN Meetup this Monday?

It would be a pleasure to have you over, Dr. Barski.

<http://www.meetup.com/JoinHNDC/>

<comment><USER2> Sure- I'll be there (I was at the meetup a couple months ago BTW)

<comment><USER3> Perfect! See you then.

</comment></comment></comment></comment><comment><USER4> Folks looking for a practical place to start with Lisp should consider using the Emacs editor. I just recently went down this road myself. I am now a huge fan.

For about 6 months in 2006 I made Emacs my default editor. (Xemacs, actually). But I did not learn Lisp, at that time, and there are other IDE's out there that have a nicer GUI. So I started using simple text editors like Kate, and then sometimes NetBeans.

And yet, for years, I've been wanting to work with a fully scriptable editing environment. I often have the need to grab a large amount of text data, transform it in various way, and save the finished product. I kept thinking that at some point I would learn sed and awk, but I never got around to it. Usually, if I needed to make some quick changes to text, I'd write a one-off PHP script to do what I needed.

Then I got interested in Clojure, and through Clojure I got familiar with Lisp's syntax.

Then it occurred to me to go back to using Emacs. So now it is my main editor, again, my default programming environment. I use it for everything. And I've learned Emacs Lisp. Every single day, the combination of Emacs and Lisp helps me be more productive.

Way back in 1999, I started to learn PHP. One thing that made PHP easy to learn, back then, was that I did not need to compile it. I only needed to put it on a server running PHP, and that was most servers. It was an easy programming environment to step into.

Lisp is like that when you are working in Emacs. You can write a line of Lisp anywhere you like, then invoke it with a special key command. You can write quick one-off scripts to move text around inside a file. Or, if you like some code and want to reuse it, you can just save it as a function and put it in your .emacs file and then that function is available to you whenever you are running Emacs.

I have heard of Emacs greatness since at least 1999, and yet somehow, not till this year did I dive deep and learn both it and Lisp. I realize now, everything that people have said about Emacs over the years, it really is true - to have a programming environment where every element of the environment can be programmed and re-programmed using the language of the environment gives you an extremely powerful tool.

If anyone is looking for a simple place to get started with Lisp, I would say, simply, use Emacs. We all need to edit stuff, and so your work will provide you with a practical place to practice your Lisp, everyday.

Those of you who prefer some kind of GUI, look into Xemacs. It can be set up to respond to your mouse-clicks.

Also, if you'd like to learn about Emacs and Lisp, the book that Robert J Chassell wrote is a very good introduction:

[http://www.amazon.com/Introduction-Programming-Emacs- Lisp/dp...](http://www.amazon.com/Introduction-Programming-Emacs- Lisp/dp/1882114027/ref=sr_1_1?s=books&ie=UTF8&qid=1287092649&sr=1-1)

<comment><USER5> Dont want to start a religious war here, but how does slimv (<http://www.vim.org/scripts/script.php?script_id=2531>) for vim compare ?

<comment><USER6> I never used slimv, but I started developing in Clojure using Vim and connecting it to a repl as explained here:

<http://writequit.org/blog/?p=386>

I do not know how it compares to Emacs and Slime, but I'm quite satisfied by it.

</comment></comment></comment><comment><USER7> Previously: <http://news.ycombinator.com/item?id=841117> including comments by the author.

<comment><AUTHOR> Thank you for the reference. I hope that the publishing date is still October 2010... as it was foreseen already 1 year ago.

<comment><USER2> Yes that's accurate- It's all done and printing as we speak.

</comment></comment></comment><comment><USER8> Since the author is Conrad, the well balanced human, and the book is named LoL, does it show how to implement the first Lands of Lore? :) [http://en.wikipedia.org/wiki/Lands_of_Lore:_The_Throne_of_Ch...](http://en.wikipedia.org/wiki/Lands_of_Lore:_The_Throne_of_Chaos)

<comment><USER9> Coincidentally (or maybe not), Let over Lambda has the same acronym... [<http://letoverlambda.com/>]

<comment><USER2> You just blew my mind :-)

</comment></comment></comment><comment><USER10> Is this going to be using Lisp bindings for cross-platform graphics libraries like SDL? ( <http://code.google.com/p/lispbuilder/wiki/LispbuilderSDL> ) Here's to hoping you get to build 2D/3D games and not 1970s style terminal games you will never show anyone.

<comment><USER2> The book includes a chapter on building a crude web server and then uses it to build a graphical HTML5 game as a finale.

I considered options like SDL, but the fact is that there's so many graphics APIs in the world (and in the Lisp world) that I didn't want to force the reader to learn one they might not ever have practical use for.

Knowing how a web browser & HTML5 work, on the other hand, is universally useful.

<comment><USER10> > _build a graphical HTML5 game as a finale_

sounds great, I'm interested.

My favorite programming class was an intro course in python where we generated fractals, programmed maze solvers, built conway's game of life, and had an option of creating a 3D pool game for final project, etc: [http://cs.northwestern.edu/~akuzma/classes/EECS110-s10/index...](http://cs.northwestern.edu/~akuzma/classes/EECS110-s10/index.htm)

Although the course is intended for people who have _never programmed before_ , it allows you to do a lot of cool stuff by deliberately not explaining how the libraries used are implemented. I don't think using external libraries in tutorial books is bad, as long as you change\vary the library being used each problemset or chapter. Then no one library is enforced as canon. The student just learns the generalized methodology of hooking in with other people's code and writing a decoupled application, which are essential practical programming.

I think it's OKAY to risk throwing in slightly off-topic components in a learning-by-doing book. The best "django" book I've seen had a chapter all about jQuery\JavaScript.

Games are still always good problem domains for enhancing student engagement even if they are text-based. Having now looked at the sample chapter, I'm sure you did a great job and I'll put it on my to buy list.

</comment></comment></comment><comment><USER11> Dr Code, will this book be on Safari Online? How do you get paid if I read the book online or have it bookmarked as one of my favorites?

<comment><USER2> I guess I get paid some kind of fee from your subscription :-)

Haven't seen that website before- pretty cool.

</comment></comment><comment><USER12> I love the concept - is there anything like this for Python?

<comment><USER13> Check out his book since it looks like it might be good, but if you really want to learn Python and need a good place to start, I've written one:

<http://learnpythonthehardway.org/>

It's free, you can download a PDF, and you can hit:

<http://learncodethehardway.org/>

To ask questions if you get stuck.

If you already know how to code it might be too simple for you.

<comment><USER12> Thanks for the suggestion :-) I had a ton of experience with C and Java back when I was in high school and somewhat through university, but after I finished university I fell out of it. Your book looks like a great introduction for a complete newcomer to programming, but I've picked up "How To Think Like a Computer Scientist" and it seems to be more on my level.

You are an amazing person, however, for releasing all of your hard work for anyone to learn from!

</comment></comment></comment><comment><USER14> Why "Lisp" if it is book about "Common Lisp" only? It is misleading.

<comment><USER15> Is not Common Lisp a Lisp?

<comment><USER14> ... 'Europe' book about Britain only.

<comment><USER16> In the main heritage line of Lisp (Lisp 1.5, MacLisp, Lisp Machine Lisp, CL), Common Lisp is still THE common Lisp. One can run run old code from the 1960s with relatively little changes. Neither with Scheme and Clojure you can do that. Both are Lisp dialects. Clojure is basically incompatible with every other Lisp and porting Lisp code to and from Clojure is basically done by completely reimplementing it.

So, Common Lisp is not THE Lisp, but the common Lisp.</comment></comment></comment></comment>


A cartoon intro to DNS over HTTPS - <AUTHOR> https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ <comment><USER2> As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free?

Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are popular, from which locations and from which type of device.

TLS (and therefore HTTPS) provides a very useful fingerprint based on accepted cipher suites, extensions, compression methods...

[1] [https://developers.google.com/speed/public- dns/privacy](https://developers.google.com/speed/public-dns/privacy)

[2] [https://developers.cloudflare.com/188.8.131.52/commitment-to- priv...](https://developers.cloudflare.com/184.108.40.206/commitment-to- privacy/privacy-policy/firefox/)

[3] [https://devcentral.f5.com/articles/tls-fingerprinting-a- meth...](https://devcentral.f5.com/articles/tls-fingerprinting-a-method-for- identifying-a-tls-client-without-decrypting-24598)

<comment><USER3> Cloudflare itself never made sense to me. What possible incentive do they have to stop their primary purpose (DDoS protection) - They have value in _promoting_ the behavior.

Whats worse, is everyone and their dog is using them. What happens when they push a bad config to their core routers, or foobar their anycast?

<comment><USER4> It probably doesn't make sense because you misunderstand their primary purpose. It's not DDoS protection. Cloudflare has a pretty wide-spanning platform of products and services, but if you had to pick one out as their "primary", it would be their CDN product. The DDoS protection is just more visible because of the nature of the product (a good CDN will never make you aware it even exists), and because mitigating DDoS attacks makes for good news headlines.

Even if DDoS _was_ their main business driver, what you're saying is similar to "doctors don't make any sense to me. what possible incentive do they have for keeping people healthy? they have incentive for _promoting_ bad health."

As someone who works in security, believe me, there are _plenty_ of cyber attackers out there that will easily keep companies like Cloudflare in business, no "promotion" of bad behavior required.

<comment><USER5> > what you're saying is similar to "doctors don't make any sense to me. what > possible incentive do they have for keeping people healthy

People do say this, all the time!

</comment></comment></comment></comment><comment><USER6> There are 3 major protocols available for DNS privacy:

* DNSCrypt

* DNS over TLS

* DNS over HTTPS

DNSCrypt is the one with better client support and a long list of providers available. If you pick DNS over TLS or DNS over HTTPS you will be restricted to 3 or 4 major players (google, quad9, cloudflare and cleanbrowsing). If you trust them, you are good.

For example, this is the list of providers with DNSCrypt support: [https://download.dnscrypt.info/dnscrypt- resolvers/v2/public-...](https://download.dnscrypt.info/dnscrypt- resolvers/v2/public-resolvers.md)

For DNS over (HTTPS|TLS), there is very little client tools available for troubleshooting. The best one I found was these 2 in PHP:

[https://github.com/dcid/dns-over-tls-php-client](https://github.com/dcid/dns- over-tls-php-client) [https://github.com/dcid/doh-php- client](https://github.com/dcid/doh-php-client)

<comment><USER7> DNSCrypt is also the fastest and most secure.

It doesn't require sessions (uses UDP by default, like regular DNS, but prevents amplification), enforces safe cryptography and pinned certificates, is trivial to implement, doesn't need OpenSSL, implements padding without inventing yet another DNS extension, and can use unique keys for each question (so that DNS providers can't fingerprint clients, unlike other options due to TCP sessions and TLS tickets).

<comment><USER8> If it's the fastest and most secure, why are people throwing their weight behind DNS-over-HTTPS? There must be a reason for it.

<comment><USER9> Because it's much more complicated to implement, where-as DNS-over-TLS and DNS-over-HTTPS are far simpler to integrate into existing software and operations.

<comment><USER10> How?

Both HTTPS and TLS implementations require custom software in order to work, as no OS supports this natively (yet).

It boils down to install a stub that your local resolver will use instead of the upstream directly.

<comment><USER9> Well, basically because there are TLS libraries available in nearly every language. DNSCrypt is a custom protocol.

For example here is my implementation over rustls in TRust-DNS: [https://github.com/bluejekyll/trust- dns/blob/master/rustls/s...](https://github.com/bluejekyll/trust- dns/blob/master/rustls/src/tls_stream.rs)

Basically that's a thin wrapper over the TLS library, and I was able to do three different libraries. DNSCrypt on the other hand was a much larger project, and I gave up on implementing it when I saw the DNS-over-TLS RFC complete.

</comment></comment></comment></comment></comment></comment><comment> mike-cardwell I kind of hate this. Taking a decentralised service, and replacing it with a service provided by a small handful of tech giants.

"But this doesn't mean you have to use Cloudflare. Users can configure Firefox to use whichever DoH-supporting recursive resolver they want. As more offerings crop up, we plan to make it easy to discover and switch to them."

Only defaults matter. Your average web user wont be interested in knowing about or configuring this, no matter how simple the explanation/choice is made.

<comment><USER11> If only defaults matter, then it's already a dead horse, as the majority of users don't know what DNS even is, and are using their ISP's servers by default.

<comment><USER10> Why does the amount of people knowing about DNS matter? Especially in the context of decentralization?

<comment><USER12> Depending on your ISP and/or country of origin, it can matter a lot.

</comment></comment></comment></comment><comment><USER13> There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity).

At the time my only real recourse was to pump my whole house through a VPN, as even Google's DNS (18.104.22.168) was being hijacked, but ONLY when it was coming from my home IP. (Full disclosure, i'm not very well versed in the networking stack. I know enough to get myself in trouble, but not much more. This was what I understood to be happening, but I could be way off base. However it was happening on multiple devices, multiple OSs, multiple verizon IPs, multiple DNS servers, both with and without a router, and would stop instantly if any of those machines were pointed at a wireless hotspot, or a VPN was turned on. At one point I even sent my router's WAN connection through my phone's hotspot and the problem went away)

After talking with verizon many times and each time having to spend an hour or so trying to get through to someone that knew even remotely what I was talking about, all they were able to do was reset my IP, which fixed nothing.

Now that DNS-over-HTTPS is becoming more common, i'm going to use it everywhere I can. Yes, DNSSEC might be a "better" solution, but I can use DoH right now to protect myself on all sites and (hopefully soon) all devices.

Just the other day I discovered Intra [0] a (still unreleased) app by Google for android which has your whole android phone use DNS-over-HTTPS.

I've been running it the last few days and i'm quite pleased with it. Does anyone know of a way to force all DNS queries in windows to use DoH?

[0] [https://play.google.com/store/apps/details?id=app.intra&hl=e...](https://play.google.com/store/apps/details?id=app.intra&hl=en_US)

<comment><USER14> > Does anyone know of a way to force all DNS queries in windows to use DoH?

I think you could use pi-hole to do this. [https://docs.pi- hole.net/guides/dns-over-https/](https://docs.pi-hole.net/guides/dns-over- https/)

<comment><USER13> Thanks a ton, this looks fantastic! Do you know if it's possible to setup Pihole to use this (and possibly other features) but not do any adblocking?

<comment><USER15> I'm using cloudflared [0] for this. Allows me to have system level DoH and everything uses it (unless explicitly configured not to). Working on Linux machines (amd64 and aarch64) and MacOS.

The documentation is not great / accurate but with a bit of fiddling I have it running as a systemd service (launchctl on MacOS). I'm using the /metrics endpoint to get details in Prometheus on the stats.

0\. [https://github.com/cloudflare/cloudflared](https://github.com/cloudflare/cloudflared)

</comment></comment></comment></comment><comment><USER9> I am very conflicted about DNS-over-HTTPS vs. DNS-over-TLS.

Most of DNS-over-HTTPS' interesting use-cases start coming into play when you're using the same HTTPS session as the one being used to serve the site you're visiting. Otherwise, DNS-over-TLS is sufficient for the same level of privacy.

At that point though, DNS-over-HTTPS has a provenance issue that I don't fully grok how we're going to avoid. What I mean by that: if the site you're visiting supports DNS-over-HTTPS, where requests to that site for DNS records are requested, what happens when they decide to issue custom responses to DNS requests that ignore or supplement actual data in a zone? Won't that lead to a bifurcation of the DNS network, where web-sites can start issuing custom response to DNS queries?

Cloudflare, and Quad9, both offer DNS-over-TLS, this will be preferable for non-HTTP use-cases. Some of the points in the article imply that DNS when using DNS-over-HTTPS can't be used for tracking you, but really that just means you're passing that trust to Cloudflare, Quad9, or Google. I suppose the choice is open to you at that point.

<comment><USER16> I'm not sure I understand.

I was under the impression that DNS-over-HTTPS was nothing more than just an alternative DNS protocol just like DNS-over-TLS, where you perform an HTTPS request in order to query for a DNS name, and that DNS-over-TLS was just plain old DNS wrapped in TLS.

You seem to be implying that DNS-over-HTTPS would enable sites themselves to deliver DNS records. I don't see how that is possible, because connecting to HTTPS with a hostname requires resolving a DNS record. Am I misunderstanding?

<comment><USER9> You are correct for the initial request. I've seen many arguing for taking this to another level of actually sending DNS requests over the same HTTPS session being used with a site the browser is currently connected to.

<comment><USER16> Is this standardized/drafted? I am curious how one might implement this.

<comment><USER9> See this thread with one of the authors of the RFC: [https://news.ycombinator.com/item?id=16728600](https://news.ycombinator.com/item?id=16728600)

<comment><USER17> Everybody is right in this thread :)

First, just to avoid confusion, the post linked to this HN article is just about the classic recursive resolver model. That's the scope of what is being experimented with actively.

Second, the notion of resolverless dns (where dns records are obtained from somewhere other than your recursive resolver) is indeed something DoH contemplates but does not yet allow. That's because issues around tracking, correctness, and attacks haven't been fully explored. So unsolicited DNS is interesting but its not something any browser would accept yet.

There are some other opinions on how HTTPS matches the needs of DNS here: [https://bitsup.blogspot.com/2018/05/the-benefits-of-https- fo...](https://bitsup.blogspot.com/2018/05/the-benefits-of-https-for-dns.html)

<comment><USER18> Also notice how the plan is to push not only DNS entries but also TLS certificates:

"Right now, people are really keen to get HTTP/2 "out the door," so a few more advanced (and experimental) features have been left out, such as pushing TLS certificates and DNS entries to the client — both to improve performance. HTTP/3 might include these, if experiments go well."

[https://www.mnot.net/blog/2014/01/30/http2_expectations](https://www.mnot.net/blog/2014/01/30/http2_expectations)

Some of those things could be used for bootstrapping SNI encryption as well:

[https://www.ietf.org/mail- archive/web/tls/current/msg17474.h...](https://www.ietf.org/mail- archive/web/tls/current/msg17474.html)

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> "Threats to users' privacy and security are growing."

s/privacy/&, autonomy/'

Case in point about autonomy is on HN front page at present: [https://news.ycombinator.com/item?id=17196888](https://news.ycombinator.com/item?id=17196888)

The author cites a hypothetical example where a user shopping at Megastore is blocked from accessing her preferred source of DNS data in order to prevent her from checking a price.

Extending this hypothetical, imagine if in response to her request for an unbiased price quote the user was shown unwanted ads with inflated, customised pricing (informed by data gathered about her through tracking).

Choice of DNS data is an effective way for users to block advertising and tracking.

The issue with user control over DNS also arises with mobile and other devices (e.g. Chromecast/Google Cast/Google Home) that discourage or prevent a user from using her preferred source of DNS data, forcing her to use a commercially-oriented source which may block certain lookups.

This is relevant with any computer that connects to the internet.

It is an issue of _autonomy_.

There is a long tradition of HOSTS files and later non-commercial DNS where users can autonomously determine where on the network they want to "go". They have the final control over the source of DNS data the computer will use. They can delegate DNS service to someone else, _however_ , following that long tradition, they still retain the autonomy to choose the source of the DNS data, whether it is another third party, their own DNS servers or perhaps /etc/hosts in place of DNS.

When an organization (e.g. running an "app store") seeks to circumvent the ability of the user to choose her own DNS data source on her own computer, that is an attack on _autonomy_.

The author mentions that Firefox will allow users to choose their own "DOH DNS" servers. If so, this respects users' autonomy.

(No one seems to be mentioning one obvious advantange of DOH DNS for browsers: bulk DNS "prefetch" lookups. One can use HTTP/1.1 pipelining to retrieve the IP addresses for every hostname contained in an HTML page, with _a single HTTP request_ , instead of numerous, simultaneous DNS requests. As for privacy problems with TLS fingerprints, HTTP requests can be secured by CurveCP as an alternative to TLS - example is in my profile.)

<comment><USER20> I see additional problem with this, which actually endangers autonomy.

The resolving is not only done for user-initiated action, but is being done by many programs, even which you might not want to do it. For the same reason, many users use a local firewall to block outcoming connections, like Little Snitch.

(Sidenote: if you are using MS Office 2016 for Mac, and are not satisfied with the choice of telemetry that Microsoft offered you in the last update, and you are interested in third option, "None", the hostnames to block are nexusrules.officeapps.live.com and nexus.officeapps.live.com)

With apps using DoH and ignoring the local resolver, that firewall will now have a problem, especially if multiple, separate hostnames resolve to the same IP. Until now, Little Snitch used a guess (last resolved hostname that matches the IP); now it won't have that chance.

That's why, if the user wants to have a chance to who their local processes talk to, they must be forced to use a local resolver under user's control, not implement their private resolver. And of course, on non-public networks, it should be supplie-able by DHCP or RA.

<comment><USER12> As long as you can configure DoH, you can setup your own resolver and do what you want. In the end DoH will probably eventually be an option in the OS level, or not for lighter OSes. I think having it at the application layer is to add a nudge in the OS developer direction.

</comment></comment></comment><comment><USER10> I tried DNS over TLS (somewhat similar) and it has some potential. But not with those strict timeouts. 18.104.22.168 closes the TCP connection almost instantly after the query response, 22.214.171.124 waits a bit longer, about 10 seconds (need to check again).

So everytime you want to make a query, you have to wait several RTTs before getting a response.

The connection need to be open for as long as possible, at least 5 minutes.

I used stubby as forwarder with idle_timeout: 6500000, the idle timeout in ms. The connection gets closed by the remote party, not by stubby.

<comment><USER7> Because DNS servers were never designed to keep many open TCP connections.

<comment><USER10> Doesn't matter what they were designed for. With TCP they need to behave that way. Otherwise this is a solution for people with latency <10 ms to the server. So not a whole lot.

I'll argue that the TCP and TLS handshake take more processing power then keeping the connection open.

<comment><USER21> The limiting resource with large numbers of idle sockets on the server side is memory, not processing power.

<comment><USER10> Which I doubt is a problem for Cloudflare or Quad9. Anyway, a TCP based DNS service needs to consider those things. Otherwise it is becoming unusable due to very high response times.

A standard 8 GB system with Debian 9 gives me 1048576 max file descriptors. I am sure this can be optimized still.

<comment><USER21> The default socket receive and send buffers are ~200KB, so you would actually need 400 GB of memory in order to have each of those 1048576 file descriptors connected to a unique socket.

And if you were keeping them open for 5 minutes as suggested, that would still limit you to only 3400 clients / second.

I do actually agree that they need a longer idle timeout on these connections, but I just wanted to point out that comparisons with the processing power required to set up a TLS connection aren't apt.

<comment><USER12> I'm pretty sure that they don't _HAVE_ to use the defaults, and for something like DNS, they probably shouldn't be... The buffer should probably be limited to what the largest request segment would be for creating the TLS/HTTPS connection in the first place, which just guessing would be closer to 1K.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> > "Threats to users' privacy and security are growing."

Website won't load without allowing a call out to googleadapis.l.google.com

Yeah, you're right they are growing.

</comment><comment><USER23> Was just wondering... what value will DNS over HTTPS provide if/when we all move to IPv6 and presumably everything could potentially be identified by IP address directly? Will datacenters/ISPs be incentivized to do NAT with IPv6 or have some other way of introducing indirection into the routing?

<comment><USER24> Think about Cloudflare itself. Millions of websites hosted behind a handful of IP addresses.

<comment><USER23> So we go back to re-centralizing for privacy? I love Cloudflare, but... if that's really the answer to this... sigh.

<comment><USER12> Well, about 8M websites are already behind Cloudflare... if you add the top 50 hosting providers, that's probably 95% of the internet. Traffic is already relatively centralized.

</comment></comment></comment></comment><comment><USER25> Now just wait for your browser (or any other random application) to stop using your OS's resolve completely (at least Chrome does at times already by simply accessing DNS services via port 53 when it considers the configured OS DNS 'not good'. I have no idea about the exact criteria) by accessing its desired DNS-over-HTTPS server and bypass your carefully setup DNS filtering / monitoring.

Notes 1: I have NO idea if Chrome (or any other random application) accesses DNS-over-HTTPS already since I have not paid too much attention to it.

2: At least Chrome (on OSX) likes to access 184.108.40.206 & 22.214.171.124 & your configured DNS server on port 53 (happy eyeball protocol). This might only be on flaky networks like mine, where I tend to make all sorts of configuration experiments.

</comment><comment><USER26> I applaud the efforts to increase privacy,reduce data collection and hardened security. Do we really want a SPOF in Cloudflare for this though? A single outage (or AT&T snafu) and many millions of users would be affected.

<comment><USER27> In fact, it already happened between this Mozilla announcement and now: [https://www.cloudflarestatus.com/incidents/2mz3wly2g7dy](https://www.cloudflarestatus.com/incidents/2mz3wly2g7dy)

I think encrypting DNS transport is as important as the next guy (though DoH is bad), but am super unhappy about Mozilla apparently signing on with Cloudflare's ongoing fairly successful attempts to centralize the internet. Sure, they say they'll delete your data "within 24 hours" (they shouldn't be keeping it at all), but pretty soon they'll get a Nat'l Security Letter like everyone else does.

<comment><USER12> Which begs the question, do they have a canary page?

In any case, it would be unreasonable to require logging for more than that... even a week would be too much data for many ISPs. Also, they have to have some logging to be able to even try and troubleshoot a problem.

</comment></comment></comment><comment><USER28> Encrypted DNS is an awesome idea. But routing all of your DNS requests to a private US company should not be enabled by default.

And what about SNI that shows domain name in clear text for HTTPS connection? Please do something with it too.

</comment><comment><USER29> Why is DNS taking so long to have security patched in as if governments are pressuring to make sure they can snoop on things easily. Same goes for email.

Having an opt in security mechanism is easy to deploy as in keeping the http version of a site available while running https on a new port for clients that want to use it.

</comment><comment><USER30> Doesn't TCP, TLS, HTTP, and finally DNS seem like overkill? Why not DTLS + plain DNS requests?

<comment><USER10> Standard HN response: Because my corporate firewall does not allow me to use UDP! Which is the nowadays excuse to use 80/443 for everything. Customers at home don't have this problem.

But there are alternatives, DNS over TLS (essentially the same without HTTP) and dnscrypt which uses UDP.

<comment><USER31> This is why I run an openvpn server on port 443 in tcp mode, not UDP, for places like shitty airport captive portal wifi.

</comment></comment></comment><comment><USER32> As a good and responsible parent DNS over HTTPS will never be an option. I run a DNS server on my local network.

<comment><USER12> You _could_ still have that DNS server use an upstream DNS over HTTPS or other encrypted channel that unifies traffic, which has the effect of anonymizing.

</comment></comment><comment><USER33> DNS over HTTPS uses DNS in the protocol. Does that make it extra-recursive DNS?

<comment><USER7> Not necessarily.

You can connect using an IP address. At least to bootstrap the process. This is where DNS Stamps come in handy [https://github.com/jedisct1/dnscrypt- proxy/wiki/stamps](https://github.com/jedisct1/dnscrypt-proxy/wiki/stamps)

</comment></comment><comment><USER34> >That means that your ISP can still figure out which sites you're visiting, because it's right there in the server name indication. Plus, the routers that pass that initial request from your browser to the web server can see that info too.

Well there goes the interest I had in this.

<comment><USER17> we're coming after SNI too. One step at a time.

(also, 1] dns leaks are worse than sni leaks as typically more people are exposed to the dns query and 2] HTTP/2 can carry more than one hostname on a connection so some hostnames that appear in dns are never leaked through sni.)

<comment><USER35> The TLS WG currently has only a problem statement for Encrypted SNI. Even the weak selection of two possible ways forward didn't achieve consensus as I understand it.

I don't see any way to have encrypted SNI without paying a price of one additional round trip. That's a fair price for something you must have, but for anybody to benefit we must insist everyone use it always, or adversaries will simply block it. And a round trip is a high price for users who don't (believe they) need this.</comment></comment></comment>


Chromely – HTML5 desktop framework for.NET/Core adds websocket/real-time feature - <AUTHOR> https://github.com/mattkol/Chromely/wiki/Real-time-with-Websocket <comment><AUTHOR> Hi All,

Chromely - [https://github.com/mattkol/Chromely](https://github.com/mattkol/Chromely) was introduced earlier. Thanks to all that gave feedbacks.

Based on demands from some developers, there are new features added - <USER2> Websocket implementation for real-time apps development, frame handling (to execute JavaScript functions see - [https://github.com/mattkol/Chromely/wiki/Frame- Handling](https://github.com/mattkol/Chromely/wiki/Frame-Handling)) and "iframe" support.</comment>