Firefox 15 plugs the add-on leaks - <AUTHOR> http://blog.mozilla.org/nnethercote/2012/07/19/firefox-15-plugs-the-add-on-leaks/ <comment><USER3> I am very happy that the Firefox team has finally managed to lick this issue. When at every occasion I used to raise this issue, the typical Mozilla Evangelist would answer: "It is because of the add-ons".

My counter to this was that the whole Raison d'être for Firefox is its add-ons community. You cannot claim that there are great benefits to this approach while simultaneously ignoring the problems caused by it. Better late than never. It is critical to have a popular browser alternative to Either IE or Chrome.

One is closed source and the other is produced by a company whose entire revenue model is built around showing you the most targeted ads possible in the maximum number of ways possible.

<comment><USER4> >One is closed source

Actually, so is Chrome.

<comment><USER5> The differences between Chrome and Chromium are minimal - aside of Chrome bunding some mostly unwanted plugins:

[http://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoog...](http://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoogleChrome)

<comment><USER6> That list appears to be incomplete. For example, there is a windows-specific closed source software renderer for WebGL that is in Chrome and not Chromium.

</comment></comment></comment></comment><comment><USER7> This is awesome news. The single biggest reason that I initially moved to Chrome, from Firefox, was the memory consumption situation. But lately, Firefox has gotten a lot better, and I've basically switched back to FF now as my primary browser. Hopefully this will make the situation even better.

And that's good for everybody. Competition is a Good Thing and it would be a shame if Chrome become so dominant as to completely displace Firefox. A healthy ecosystem with a great Firefox and a great Chrome, along with IE, Opera, Safari, etc., should benefit everyone in the long run.

<comment><USER8> Chrome and Firefox been using memory at equal proportion. I use exactly two add-ons and comparing FF/Chrome to IE to check on memory consumption, I see IE doing much better.

</comment></comment><comment><USER9> As a webdev who use Firebug (and Adblock) a lot, I'm so glad about this. FINALLY !

However they are three years too late about that, from a market share perspective.

<comment><USER10> Firefox lost market share because Chrome was a leaner, faster, and better browser. I have started to hear more stories about folks switching back to Firefox because a lot of their issues with the browser have been fixed. And based on independent review sites like Tom's Hardware, there is no longer an appreciable gap in the performance of Firefox and Chrome.

As regards market share, Firefox's market share would be in the low single- digit percentages if all was lost. This is indeed not the case. With the profiling and telemetry tools and infrastructure, the Firefox team has built a foundation that will ensure future releases do not regress memory usage and overall browser snappiness. Market share is a fickle metric for success because it is amenable to change. The strides made in the last few months by the Firefox team have paved the way for adoption growth in the future. Let us have a constructive conversation around what they need to do next to ensure more switchers among the HN community.

<comment><USER11> >Firefox lost market share because Chrome was a leaner, faster, and better browser.

Not to mention secure. Sandboxed PDF reader, java whitelisting, sandboxed and auto-updating flash, etc while FF and IE were arrogantly telling users "Fuck you, update your own add ons, they're not our problem" even when all the exploits were from these add ons. Now IE and FF ape some of these features. I can't wait to hear the next angry Asa Doztler diatribe aimed at enterprise IT admins and their demands. Asa is a roadmap on how to lose users and quickly become 3rd best.

Good to hear FF is starting to get competitive again. I hope this trend continues.

<comment><USER12> I always wonder why Firefox gives the option to update Java and Flash et al when it never works. Has anyone ever gotten plugins to update from within Firefox?

<comment><USER13> Ha ha, "install missing plugins" is such a zombie feature, I hope some (ex-) development manager from Mozilla cringes every time they see that on a new installation.

</comment></comment></comment></comment></comment><comment><USER14> The about:memory feature is useful to get a glimpse into what extensions and tabs are chewing up the most memory, although I haven't had much luck in FF 14 using the GC/CC to correct that. I hope that FF 15 gives the user a bit more intuitive view and control over the memory consumption on tabs and addons/extensions.

<comment><USER15> Sure, for technical users that might be a nice value add. In fairness though, a regular person shouldn't have to care--Firefox should just work, stay responsive, etc.

<comment><USER13> _In fairness though, a regular person shouldn't have to care--Firefox should just work, stay responsive, etc._

In fact, that _isn't_ fair. Software has never been like that, and it's irresponsible to represent to non-technical users that it's possible.

</comment></comment></comment><comment><USER16> For anyone who wants to download the Nightly build for Firefox 15:

Windows version [http://www.mozilla.org/en- US/products/download.html?product=...](http://www.mozilla.org/en- US/products/download.html?product=firefox-15.0b1&os=win&lang=en-US)

Mac version [http://www.mozilla.org/en- US/products/download.html?product=...](http://www.mozilla.org/en- US/products/download.html?product=firefox-15.0b1&os=osx&lang=en-US)

<comment><USER17> That's the beta version. Release is on 14, beta on 15, aurora on 16 and nightly on 17.

Firefox nightlies are here: <http://nightly.mozilla.org/>

</comment></comment><comment><USER18> > Leaky add-ons usually cause zombie compartments by holding references to DOM > structures within a web page even after the page has been closed or > navigated away from. This prevents Firefox from garbage-collecting the > page's compartment.

If an add-on relies on persistent references to closed pages by design (such as a form data history plugin), is there a way to adapt it to this new feature to not let Firefox sever it's references under the assumption that it's a memory leak?

<comment><USER19> Copy them. I can think of no good reason that one would ever legitimately want or need to keep references to a page that is no longer loaded. It's like returning a pointer to a local variable from a C function; you should expect it to be invalid once it's scope is gone! Copying is likely to use less total memory anyway, because it will rarely result in having to allocate new compartments for the plugins, but it will allow an entire compartment for a page to be collected, that is otherwise kept around for the sake comparatively small objects.

This actually seems to me to have a lot of implications for the design of garbage collectors generally. In theory, correct garbage collectors are never supposed to collect objects that may still be used, which in practice usually means "that are reachable". But, we've already got such a thing as "weak references" to fudge that a little. This seems like kind of the opposite idea- having a sort of "superstrong" owner reference such that once it goes away, you know that the object will never be used again (or shouldn't be, anyway, with future uses constituting bugs), and can be collected despite what other references might exist.

It also seems like one of those obvious-after-the-fact genius ideas to have garbage collection running independently per compartment. Do Web Workers, e.g., get their own separate garbage collection, too? Any kind of shared- nothing concurrency model ought to be able to do the same thing to improve GC pauses; are there language implementations (I'm thinking probably Erlang here) that actually do that?

<comment><USER20> Each web worker gets its own compartment, and thus can be garbage collected individually.

</comment></comment></comment><comment><USER21> I'm on Aurora right now (15a2), and after YEARS of bitching am cautiously optimistic this is really it!

Just a few weeks ago I was closing FF once a twice a day as it approached almost a GB of RAM. Now it's holding steady at under 230mb! I have few extensions, but use firebug. I knew it was part of the problem but it's unfortunately essential for me.

With this fixed perhaps they can now work on tab isolation, another of their last major issues, (instead of rearranging the interface again).

<comment><USER22> Wow, that's actually very nice in terms of RAM usage. Right now in chrome, with only 6 tabs open I am using (according to about:memory)800MB of RAM[1]. I may very well switch back to Firefox if I can get performance like that.

[1]<http://puu.sh/JXL9>

<comment><USER23> Is it normal for a gmail tab to use 250+ MB?

<comment><USER22> I don't think it's supposed to, and that's what's making me thing it might be time to switch to Firefox.

</comment></comment></comment></comment><comment><USER24> I am really happy that Firefox 15 stops most of the leaks caused by firebug. Competition is good.

</comment><comment><USER25> Wuhu, finally! Let's see if FF does not take 1GB after a few days.

<comment><AUTHOR> You'll have to wait a couple of days - Firefox 15 is hitting Beta either today or tomorrow, I believe.

<comment><USER26> [http://www.mozilla.org/en- US/products/download.html?product=...](http://www.mozilla.org/en- US/products/download.html?product=firefox-15.0b1&os=win&lang=en-US)

<comment><USER16> OSX version:

[http://www.mozilla.org/en- US/products/download.html?product=...](http://www.mozilla.org/en- US/products/download.html?product=firefox-15.0b1&os=osx&lang=en-US)

</comment></comment></comment></comment><comment><USER27> One of the issues I've seen people complain about is having to close Firefox after a few days. I understand you shouldn't HAVE to close a program, but how are people using their browsers that this becomes such an huge problem?

<comment><USER28> I don't reboot my desktop for months at a time. Current uptime is 25 days... 25 days ago I moved offices. X stays up. Firefox and Chrome and most of the other applications I use regularly stay up. Why should this be exceptional?

What's faster than an SSD for loading an application? Switching to the already open window.

<comment><USER29> While this is basically true (and even more so for me, typically 3+ months before a security update finally nags me into rebooting 1 month after it was installed) Firefox saves your open tabs, so restarting takes no time and it is basically like it didn't even happen.

<comment><USER30> You're right (although re-starting firefox isn't quite an instant thing), but like dsr_, I don't turn my computer off - so why would I ever restart a program unless I need to? Killing firefox and restoring the session might not take a long time, but it's always going to take longer than not having to restart it.

</comment></comment></comment></comment><comment><USER31> I used to be an avid Firefox user. I switched to Chrome because it was faster and had all the same extensions I used on Firefox. Why should I switch back? Chrome is still faster no?

<comment><USER32> I did the ff-chrome-ff switcheroo a number of times. Now I generally use both: I find that chrome is a snappier startup and has a better flash runtime (since it does its own rather than relying on adobe). Firefox is more stable / uses less memory for a larger number of tabs.

I do believe in the mozilla mission for an open web, and it's got fairly comparable performance overall, so I use it for my main browsing / firebug. Chrome's for flash-heavy sites and playing with webrtc occasionally.

Inspector on chrome has certainly become quite good -- I've missed firebug less and less over time as I started using it. Though Firefox's new built-in developer tools are really sweet and might add enough functionality for me to miss in the near future. They're adding a command line thing that is super cool!!

<comment><USER33> > rather than relying on adobe

I may be over-thinking this, but in case you didn't know, Flash Player in Chrome is still developed mostly by Adobe. Chrome has a different plugin API, I think, and some extra sandboxing, but the core parts of Flash Player in all browsers come from the same Adobe-owned codebase, including Chrome's bundled version.

</comment></comment></comment><comment><USER34> Finally!

I've been using firebug for quite a long time and I can't even remember at what version things went off the rail. But ever since Firefox would consume 70% of my CPU and 2GB RAM which is complete nonsense.

Because of these memory leaks, I migrated to Chrome for browsing the web and constantly having an open tab for Gmail (because that was the only browser that wouldn't go banana on RAM), but still use FF for doing front-end development

</comment><comment><USER35> I think the fault is not just the add-on devs. If anything, the add-on SDK should prevent this by default. I'm not sure when Firefox got so memory-hungry and leaky, but it's the single reason I keep jumping around to Chromium and Opera. Really, really hoping that this time is for real. It's not the first time a blog post like this has been posted by Mozilla.

<comment><USER20> Hi, I'm the lead of Mozilla's MemShrink project (<https://wiki.mozilla.org/Performance/MemShrink>) and the author of the linked post.

Can you tell me what you mean by prior blog posts "like this"? I remember [http://blog.mozilla.com/nnethercote/2011/08/09/firefox-7-is-...](http://blog.mozilla.com/nnethercote/2011/08/09/firefox-7-is- lean-and-fast-2/), because I wrote it, but it was accurate -- FF7 did have some very large improvements.

This "Mozilla claims memory consumption improvements in every release" zombie lie is something I hear a lot, but it's just not true.

<comment><USER35> You're right. I was unfairly accrediting those posts to Mozilla. They were in the blogosphere at large.

</comment></comment></comment><comment><USER36> Does this mean Firefox will stop blaming add-ons for its own memory leaks?

</comment><comment><USER37> That's a cool blog post, and kudos to the Mozilla people, but I have to wonder about the mindset of the user whose stuck with Firefox even as his setup was unusable to the point of needing to _install a restart button add-on_. I mean, I know from being habituated to a given routine, but that seems particularly self defeating behaviour, especially considering that decent alternatives to Firefox exist?

<comment><USER38> I have a bunch of custom addons that I have written for my workflows - <USER2> to other browsers is not an option because they arent as easily extensible as firefox.

<comment><USER37> That makes sense. Speaking as someone who bought MachTen just to host Emacs on a Macintosh in the bad old days, I am sympathetic. I just am much more of a consumer of browsers than someone who relies on them to hack with.

<comment><USER38> Just looked MachTen up - <http://www.tenon.com/products/mt1.jpg> made me nostalgically remember afterstep which was the first window manager I used in linux.</comment></comment></comment></comment>


Ask HN: What does Apple's entry into mobile payments mean for Visa/MC? - <AUTHOR>

Hey guys - just curious on what people think Apple's entry into the mobile payments space means for incumbents like Visa/MC (the networks), online payment portals like Paypal etc.<p>Does Apple have enough clout to change the landscape?  Will Apple and Google dominate this space through a consortium? <comment><USER2> I see a few issues with this.

Problem 1 - A majority of the population doesn't own a smartphone.

Problem 2 - Assuming the that problem 1 doesn't matter, Apple doesn't have enough "smart" devices to hold enough clout. Even Google + Apple's smart devices wouldn't hold enough clout. You would have to get Nokia, RIM, WP7, Android, and iPhone on board before vendors would want to invest in new payment technologies.

What may happen is that an open standard will be set for all smart devices which let us connect to our already existing Visa, MasterCard, or PayPal accounts. It simply doesn't make sense to create an entirely new payment system when there are already tons of them out there...but I could be very very wrong. Apple is known for creating clutch products that everyone thought was impossible :)

</comment><comment><USER3> I'm sure the sentiment among these companies is similar to how traditional mobile companies felt when Apple announced the iPhone. Something along the lines of "this could be really bad for us if this thing catches on."

</comment><comment><AUTHOR> Also curious what that means for terminal companies like Verifone and CMT.</comment>


Health Insurers Warn of Market Turmoil as Trump Suspends Billions in Payments - <AUTHOR> https://www.nytimes.com/2018/07/07/us/politics/trump-risk-adjustment-payments-obamacare.html <comment><USER2> Dirty secret is/was that risk adjustment was often gamed by large insurers, so in that sense I agree it was a flawed program that disproportionately impacted small insurers with fewer resources to invest in a risk adjustment strategy and insurers with healthier than average populations which would have to pay into the program (which, combined with playing against "dirty" tactics used by large insurers probably meant overpaying into the program).

Health insurance is in general a weird business. People are dehumanized as a series of diseases. With risk adjustment insurers are literally trying to game these payments by trying to make you look sicker than you actually might be by chasing you down and coding you as having X or Y so they get more of these payments.</comment>


3 Reasons to Use an Escrow Service When Selling a Domain Name Through a Broker - <AUTHOR> https://www.elliotsblog.com/wp-admin/

<comment><USER2> Requires login.</comment>


Divided We Code: Undercover Conservatives - <AUTHOR> http://money.cnn.com/technology/divided-we-code/#/?page=undercover-conservatives <comment><USER2> Honestly, why don't people keep their politics out of the workplace entirely? Unless you are working at a lobbying firm or whatever, work should be about work, not about being a place to discuss gun rights, abortion, or immigration.

<comment><USER3> > Honestly, why don't people keep their politics out of the workplace > entirely?

Because the US is in the middle of a cold civil war that's heating up fast. Denying your enemy employment and therefore bankrupting them is remarkably effective.

<comment><USER4> > Denying your enemy employment and therefore bankrupting them is remarkably > effective.

Bankrupting your enemy is mostly effective at further radicalizing them and inspiring violence.

That attitude would make this "cold civil war" a hot war.

<comment><USER3> I completely agree, which is why I said it's heating up fast and also why I believe violence is unavoidable now. "That attitude" has been prevalent on both sides since Trump was elected and it continues to spread.

<comment><USER4> That attitude became prevalent long before the Presidential election. SJWs were calling for people to be fired back in 2013, perhaps earlier. I might also argue that that attitude has been prevalent in some circles - particularly academia - for decades, and spread from academics to their students (the SJWs) to Republican backlash against the SJWs to widespread Democratic backlash against the Republican backlash.

Still, I'm optimistic, because I have seen softening after the recent incidents of violence, and some mainstream rejection of leftist extremism.

For example, this CNN article treating the plight of their ideological opponents with sympathy rather than gloating.

</comment></comment></comment></comment></comment><comment><USER5> "John: If I walked into work with a "Make America Great Again" hat, there would be repercussions. Quite a few people would take it as a personal affront, and I would expect to be out of the company within weeks, if not a month."

If someone walked in with a young earth creationist hat I would similarly question their ability to think critically (and have a hard time not just categorizing them as stupid). Is this really about politics?

It's not because they're 'conservative', it's just given access to the same available information some conclusions are just weak and it's reasonable to lose respect for people when they hold them.

<comment><USER6> I think it is reasonable to question their competency. I think we _all_ do it to an extent with coworkers.

The mistake is _concluding_ it based on this type of scant information.

You treat it like any other unknown. You investigate deeper. If you work with the person for a while, you'll know his reasoning abilities far better than the information you gleaned from that hat.

>If someone walked in with a young earth creationist hat I would similarly question their ability to think critically (and have a hard time not just categorizing them as stupid).

And yet I've worked with a young earth creationist who was the best coder in his team (the rest of whom were not creationists). From my general experiences in life, his example is not much of an outlier.

Science Nobel laureates have believed in stupid things, as did many well known mathematicians of the past. Given that, why would you question his abilities?

<comment><USER7> _why would you question his abilities?_

Biblical literalists have no regard for empirical evidence.

You mention scientists having stupid beliefs. Scientists develop evidence- based explanations of phenomena through experimentation using available tools. Our tools are obviously imperfect; thus, imperfect observations are made and imperfect explanations can form as a result.

Biblical literalists, on the other hand, don't even _try_ to ensure that their beliefs are supported by empirical evidence.

People have argued that this behavior of biblical literalists is limited to issues relating to their religious beliefs only, so as long as their professional responsibilities don't encompass issues relating to their religious beliefs, there's no problem.

Unfortunately, the beliefs of biblical literalists encompass a wide range of issues. If I run a renewable energy company, do I really want to take a chance by hiring a biblical literalist who might now, or someday, believe that his unsubstantiated god wants humans to use fossil fuels[1] or that climate change isn't real because his unsubstantiated god promised to not flood the Earth[2]? No, thanks, I think I'll pass.

[1] [http://dailysignal.com/2017/10/20/trumps-epa-chief-charts- ne...](http://dailysignal.com/2017/10/20/trumps-epa-chief-charts-new-course- interview-scott-pruitt/)

[2] [https://www.politico.com/story/2010/11/shimkus-cites- genesis...](https://www.politico.com/story/2010/11/shimkus-cites-genesis-on- climate-044958)

<comment><USER8> So you're saying that you would reject otherwise qualified candidates based on their religion (a protected class in the U.S.), which is illegal?

<comment><USER9> It's not illegal for me to reject non-Flying Spaghetti Monsterarians on the basis of their religion. It is unconstitutional for the govmint to do so.

<comment><USER5> Actually if you're hiring - religion is a protected class and it is illegal for you to discriminate based on it.

<comment><USER9> I was under the misapprehension that candidate meant political candidate and not job candidate. My mistake.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I've worked places (not in tech) where I was not allowed to talk about my support for Barack Obama for fear of being shouted down, mocked, or forced to listen to racist diatribes about his history. I have been on the other side of this kind of bullshit. I moved from the small, Midwestern town that harbored these people and their insane beliefs to a liberal, coastal city that "gets" me a little more. I'm happier for it. I work with other coastal liberals and none of us have much respect for anyone who out-and-out supports Donald Trump, and we probably won't any time soon. A lot of us share this background.

I suggest these men do the same. Move to Dallas or New York or somewhere where conservatism is a little more appreciated. Move to Denver or Atlanta. Find somewhere that feels like home, where there are other conservative techies. Claiming the victim status as a white man in the most expensive city, in the highest paying industry comes off as a little entitled, at least to me.

<comment><USER11> I did that recently, moved from the Bay Area to a red state. But, what about the concept of engaging with and challenging people who have different beliefs?

People don't really change their minds when you call them a racist, fire them, etc. When I am talking to a liberal who I know wont try to cause problems for me (like getting me fired), I will ask lots of questions.

Why do you believe X? What facts support that opinion? I believe Y because ..., where do you think the flaw in my logic is? Why do you think value A is more important that counter-value B?

It's really depressing that someone such as yourself, who has known what it is to be descriminated against for what you think are reasonable beliefs, would perpetuate the same against others.

If you think someone's views are wrong, then ask them why they think that. At worst, you'll get a better insight into how to point out why they are wrong. At best, you'll have a chance of convincing them that your position is better.

<comment><USER10> I'm not saying I can't/won't/don't do that. I love discussing politics with my family, who are very conservative, and it's always nice and respectful. I just don't want to live in their society. Generally, they don't want to live in mine either. Not every liberal around me believes exactly the same thing. We'll quarrel about whether Black Lives Matter is doing good or whether UBI is actually an evil capitalist plot or whether someone like Hillary Clinton really represents what we're about. It's not as groupthink-y as the men in this article claim.

When I meet informed conservatives, I quietly rejoice because it's so interesting to talk to them. One of my best friends is also a "free market" type guy and we get along amazingly well, even when we talk politics. However, I haven't found many educated people who out-and-out support Donald Trump, and those I have found often express very caustic beliefs that get in the way of polite or fulfilling discussions. Hence, I just don't do it. There's a level of "coming to the center" that those people just won't do with me, so it ends up devolving into a series of fallacies that just don't need to happen.

<comment><USER11> It's nice that you have some friends that you can discuss opposing views with. I also cherish some of my liberal friends who I can have a genuine discussion with.

I've also had some bad experiences with family members who support Trump and are super emotional, vocal, and resistant to any discussion about him either on the policy- or simple behavior-level.

IMO there is a hidden wedge in politics between people who are willing to engage with their opinions and others who will take your beliefs in the worst possible context. It's not necessarily a right-left thing, or even a centrist/extremist thing either. I've had some of the most enlightening discussions about politics with people that are super extreme in their progressivism, communism, or conservatism, because they are so knowledgable about political philosophy or the data supporting their beliefs.

</comment></comment></comment></comment><comment><USER12> Yeah there's definitely some things that are taboo to talk about because it's too political. I for one, am a liberal gun owner, which gives me a unique perspective in that I understand where a lot of liberals are coming from, but I also understand how conservatives feel when liberals constantly attack their viewpoints and try to silence them. It's funny how many debates I get into with other liberals about guns when they've never held or shot a gun in their life and yet claim to know everything about it. And the amount of moral superiority they hold around their viewpoints is staggering, truly a "I'm right you're wrong and an idiot" mentality.

If there's one thing I recommend everyone to do is just listen to the other side and at least TRY to see their perspective even if you disagree.

</comment><comment><USER13> As someone who is in no way a part of Silicon Valley: does anyone really care how fiscally conservative or liberal you are? I always thought it was the social issues that caused the problem. Whether it's misrepresenting statistics to justify sexism or saying that some people deserve less rights because of their sexual orientation.

<comment><USER9> MAGA has _nothing_ to do with fiscal conservatism. As in Zero. Nada. Zilch.

President Obama was quite fiscally conservative.

<comment><USER14> ...as was Bill Clinton as well!

<comment><USER9> ...as was Carter. ...as wasn't Ronald Reagan, H and W and as isn't Cheeto.

Republicans are in no shape or form, fiscally conservative. They are anti-tax. But they'll happily spend the seed corn on defense, or rather, on right wing socialism.

</comment></comment></comment></comment><comment><USER15> One of the problems that we face in the US today is that our two political parties, which once divided the electorate across fault lines of policy or values, now appear to have reshuffled the electorate across epistemologies. I sincerely believe that one party now provides a happier home for those who prefer empirical science.

<comment><USER14> It depends on the issue (edit: and how it fits with their world view). The left can also be irrational when it comes to science on some issues as well:

[http://www.realclearscience.com/journal_club/2014/10/20/are_...](http://www.realclearscience.com/journal_club/2014/10/20/are_liberals_or_conservatives_more_anti- vaccine_108905.html)

Ending quote:

>The bottom line is that the CDC data makes it very difficult to argue that conservatives and liberals share equal blame in the anti-vaccine war. Anti- vaxxers are clearly more associated with the political Left.

I would tend to agree the left's leadership, however, tends to be less anti- science.

<comment><USER16> You forgot the absolute truth that a 36 week old baby is in fact a baby.

To pretend otherwise (to justify murdering it) is just plain denial.

</comment></comment></comment><comment><USER17> Everytime I read one of these viewpoints I hear: 'I think others should be descriminated against and for that I am getting descriminated against? How dare they descriminate against my right to descriminate!'

<comment><USER18> The reduction of conservative beliefs to "discrimination of others" is a lot of the problem here. Conservative politics is a broad space. Sure, there are racists and misogynists among them and they get a lot of publicity, but there are also people who believe that all human beings are equal and that something like laissez-faire capitalism leads to a more just and prosperous society for everyone. They might be mistaken in that, but it doesn't warrant accusations of malice. The fact that you sum up conservatism as "discrimination of others" is no different than any form of racism or sexism that generalizes people based on a single label. The inability to treat someone like a human being before you get to know them is why conservatives are terrified of speaking publicly in the workplace.

<comment><USER19> While it is true that there are economic conservatives who are not racists and misogynists, the Republican party platform is pretty discriminatory against several groups.

Someone can certainly vote for a candidate like Trump and not be pro- discrimination, but that person is saying they are willing to accept discrimination for the sake of the policies they do agree with.

That is certainly their right, but you can't act shocked when the marginalized groups and those who support them have a negative reaction when they find out you support candidates who want to take away their rights.

<comment><USER20> As Clinton put it,

> that "other" basket of people are people who feel the government has let > them down, the economy has let them down, nobody cares about them, nobody > worries about what happens to their lives and their futures; and they're > just desperate for change.

That's not a voter who has the luxury of setting aside their own livelihood and making discrimination (against strangers) a deal-breaker.

<comment><USER14> I'd never seen that 2nd half of the quote.

It's interesting how the full quote played out. Trump supporters assumed the deplorables she was talking about was a smear against them personally, rather than identifying with the 2nd half of the quote.

But then they also never heard the 2nd half of the quote as much as the 1st.

....still, an incredibly inpolitic statement.

</comment></comment></comment></comment></comment><comment><USER11> The ultimate irony is that many conservatives will hesitate before commenting on this here, because people don't want to be on the receiving end of a torrent of downvotes.

<comment><USER21> Anyone who cares about downvotes is a shallow idiot. I can think of more serious consequences, but caring about getting greyed out on HN is not one of them.

<comment><USER11> My main account is my reputation on the internet. That means there literally would be "serious consequences" if I posted conservative opinions. So, yeah. I'm a shallow idiot for not wanting to get fired.

</comment></comment></comment><comment><USER22> Why do people voice personal political views at work? Is this a California thing?

<comment><USER23> Sometimes it comes from the top.

"Managers and supervisors can now legally require their workers to participate in politics as a condition of employment. For instance, in most states, managers have the legal right to mandate worker attendance at a political rally for a favored candidate—and fire or punish workers who decline to participate."[1]

"On August 14 th 2012, GOP presidential hopeful Mitt Romney visited an Ohio coal mine to give a speech attacking the energy policies of opponent Barack Obama. A campaign stop such as this one might not seem that unusual in the midst of a heated presidential election. But this event was different, as the owners of the coal mine had told their workers that attendance at the rally would be both mandatory and unpaid." [2]

"Private employers can distribute materials that tell all their workers the company's positions on political issues. And if your boss were to send an email urging you to attend a rally for Donald Trump or Hillary Clinton this weekend, because electing his favorite candidate is 'essential for the future of the company,' legal experts say he'd be within his rights to do it." [3]

[1] [http://prospect.org/article/employer-political-coercion- grow...](http://prospect.org/article/employer-political-coercion-growing- threat)

[2] [http://scholar.harvard.edu/files/ahertel/files/empmobilpop.p...](http://scholar.harvard.edu/files/ahertel/files/empmobilpop.pdf)

[3] [http://www.chicagotribune.com/business/ct-boss-politics- at-w...](http://www.chicagotribune.com/business/ct-boss-politics-at- work-20161021-story.html)

</comment></comment><comment><USER24> Why would you _not_ expect your co-workers to take a MAGA hat as a personal attack? The MAGA platform is associated with explicitly barring some of them from the country. Remember that even some green card holders were briefly barred from reentering. [1]

[1] [https://en.wikipedia.org/wiki/Executive_Order_13769#Green- ca...](https://en.wikipedia.org/wiki/Executive_Order_13769#Green-card_holders)

<comment><USER25> What if you don't have the hat but don't favor liberal immigration policies? Would expressing this political stance be taken as a personal attack?

If so, that level of "we must stamp out the heresy!" is generally associated with more extreme religious types, not supposedly rational open-minded people. And that's where the danger lies: once you stop permitting the expression of contrary views, your ability to argue against them will atrophy.

<comment><USER10> The problem, of course, is that there's no way to tell from outward appearances what someone believes. A good example of this is the appropriation of Satanic imagery in rock music: few of these bands are theistic or LaVeyan Satanists, most of them are just doing it to send a message. The connotation of pentagrams and upside down crosses is "watch out, I'm evil, I like evil things, etc". Conservative Christians, however, often don't realize this and legitimately believe these people to be agents of the Devil, when usually they're just trying to provoke a reaction.

There's a layer of semiotics that's important to any outward appearance. Wearing a swastika but saying "Nonono it's a Hindu symbol of fertility" probably wouldn't go over well. Nor would saying "Well I didn't like the Holocaust but I really did think the Nazis had some good ideas about things". Similarly, wearing a hammer and sickle shirt will get you into trouble in more conservative places.

The MAGA hat's obviously on a different level than that, but it does explain some of the reasoning. That hat in particular represents (sometimes fanatical) appreciation for a man that liberals believe is doing immense harm to our nation, it's citizens and its image via racist, reactionary and backwards- looking politics. Because of far-right extremists, I get scared when I see that hat, to me it signals some form of white supremacy that I need to stay away from. So yes, wearing it at work might make people uncomfortable.

<comment><USER26> > That hat in particular represents (sometimes fanatical) appreciation for a > man that liberals believe is doing immense harm to our nation, it's citizens > and its image via racist, reactionary and backwards-looking politics.

Of course, many people believed that the previous president was doing immense harm to our nation, its citizens and the world at large … but I don't think many were fired for wearing their Hope & Change or Yes We Can hats …

> Because of far-right extremists, I get scared when I see that hat, to me it > signals some form of white supremacy that I need to stay away from. So yes, > wearing it at work might make people uncomfortable.

And yet people have no problem whatsoever bringing stuff expressing the opposite viewpoint into the workplace. It's _normal_ to hear people expressing moderately- and far-left opinions in the workplace. It's not to hear them express even centrist-right opinions.

FWIW, I don't subscribe to pretty much anything a MAGA hat conveys, and I didn't vote for the current president.

<comment><USER27> " _but I don 't think many were fired for wearing their Hope & Change or Yes We Can hats …_"

[http://www.businessinsider.com/voted-for-obama-youre- fired-2...](http://www.businessinsider.com/voted-for-obama-youre- fired-2009-10)

[http://www.allgov.com/news/unusual-news/another-case-of- bein...](http://www.allgov.com/news/unusual-news/another-case-of-being-fired- for-supporting-obama?news=840003)

[http://httpjournalsaolcomjenjer6steph.blogspot.com/2013/02/f...](http://httpjournalsaolcomjenjer6steph.blogspot.com/2013/02/fired- for-supporting-Obama.html)

[https://www.salon.com/2012/11/20/8_bosses_who_screwed_their_...](https://www.salon.com/2012/11/20/8_bosses_who_screwed_their_employees_after_obamas_reelection/)

[http://joemygod.blogspot.com/2013/01/utah-fired-for- supporti...](http://joemygod.blogspot.com/2013/01/utah-fired-for-supporting- obama.html)

Oh, and a bonus:

[http://shoebat.com/2015/04/28/teacher-in-georgia-declares- to...](http://shoebat.com/2015/04/28/teacher-in-georgia-declares-to-her- students-obama-is-a-muslim-christians-should-not-support-him-the-us- government-is-now-firing-her-for-criticizing-obama-another-story-of-christian- persecution/)

</comment></comment></comment></comment></comment><comment><USER28> Nice little plug for Quora there. Probably tells us something about who "John" really is. For the record, Quora is a very _poor_ place to have such debates. It's a very strict question and answer format, with many "why did Obama kill a hundred babies and drink their blood" questions on every political topic. Just about any other place, including here, is better for a political debate.

</comment><comment><USER29> Ignoring for a moment the moral judgement of whether conservatism is "right" or "wrong" ...

I imagine this is probably how closeted gay people felt for a long time, and still do outside of places like the Bay Area. It's poetic justice. The playing field will probably wobble back and forth for a little while and white conservative men will learn to play by the new rules - claiming victim status is as good a place to start as any.

<comment><USER30> When I was a child, I was taught that two wrongs don't make a right.

<comment><USER29> so you're saying it's wrong to shame/shun/undermine those at work because you disagree with their opinions on public policy?

<comment><USER30> I _am_ saying that it's wrong to shame people at work for their political opinions and I can't fucking believe that this stance is controversial. I will go further and say that politics doesn't belong at work.

<comment><USER31> Our words are insufficient.

I guess you are talking about big issue politics when you say they don't belong at work, because it is absurd to say that people shouldn't consider the political consequences of the things they create or actions they take on behalf of their jobs.

</comment></comment></comment></comment></comment><comment><USER32> Warning: fascinating article, but auto-playing video.

<comment><USER27> ...that cannot be paused until the ad plays.

</comment></comment><comment><USER33> Sorry, but if you don't have the courage to speak your truth, then you deserve the chains of slavery that you choose to wear and the dearth of self-respect that comes with it.

<comment><USER20> > When you find something you can't say, what do you do with it? My advice is, > don't say it. Or at least, pick your battles.

\- [http://www.paulgraham.com/say.html](http://www.paulgraham.com/say.html)</comment></comment>


Why open science failed after the gulf oil spill - <AUTHOR> http://arstechnica.com/science/news/2012/03/why-open-science-failed-after-the-gulf-oil-spill.ars <comment><USER2> I was involved with the state government and scientific response to the GOM oil spill, and I can say it was disturbingly disappointing to see the degree of subjectivity and bias in all aspects of estimates. Every academic had a model, every government official had a political agenda, and every lawyer had a client. A reasonable estimate of the amount of oil spilled will never be known publicly. But, I hear stories from GOM fishermen that massive oil globs are still out there.</comment>


Gut-Busting New York City Buffets That Won't Pinch Your Wallet - <AUTHOR> https://www.wsj.com/articles/gut-busting-new-york-city-buffets-that-wont-pinch-your-wallet-11553610600 <comment><AUTHOR> Tried to create an Outline but it seems WSJ blocks them. Very interesting article wrt economics of buffets in NYC. Apologies for paywalled link.</comment>


Part-Time Data Scientist - <AUTHOR>

I am looking for a data scientist who can help me create an algorythym which can help predict who would be the "best members" based upon certain data points, including answers to questions, personality test like questions, and basic career and education background, etc <comment><AUTHOR> P.S. This could clearly have many applications.</comment>


Trello Desktop Application Stores Authentication Token in Plain Text - <AUTHOR> https://medium.com/@vigneshgovindhan/trello-desktop-application-stores-authentication-token-in-plain-text-14cb7ab2998f <comment><USER2> Isn't this a case of

"It rather involved being on the other side of this airtight hatchway" ?

[https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...](https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283)

<comment><USER3> Exactly. It reminds me of that PostgreSQL CVE issue recently discussed, where the security breach was that someone with admin privileges on a PostgreSQL instance could execute code as the postgres user.

People fail to consider the threat model in some of these cases.

[https://news.ycombinator.com/item?id=19659684](https://news.ycombinator.com/item?id=19659684)

</comment></comment><comment><USER4> I don't think this is an issue. As rightfully responded by Atlassian.

<comment><USER5> It is sort of an issue. If anyone has an unencrypted disk and gets their computer stolen but not their login password, they would have access to their token when it's stored unencrypted, but if it were stored encrypted, they wouldn't have access to it. Atlassian's response is basically a cop-out. I've barely used Electron but I know about node-keytar.

SSH keys can be encrypted even if the disk isn't encrypted, and the password in /etc/passwd is usually hashed and will take a lot of guesses to crack if they have a good password.

<comment><USER6> If they steal your unencrypted laptop and you are logged in to your GMail in the browser, they can even access that and reset your password on any account you have.

Rightly, this is not part of the threat model for Trello.

<comment><USER5> I believe you're mistaken. They would need your password to boot up the computer or unlock your screen. I think the cookies on Chrome are encrypted using the same mechanism as node-keytar. I didn't say anything about stealing a laptop while it's logged in. I just mean physically stealing the laptop.

You could argue that the number of people who protect their computer by password but don't encrypt their disks is too small or isn't worth worrying about. But I know that there is a significant portion of users that has it set up this way.

<comment><USER7> If your disk is unencrypted, all I need to do is mount your disk on my computer and point my Chrome user disk to /mnt/stolen_drive/home/users/James/chrome_data and I have all your cookies.

I'm not sure about Linux, but on Windows this is trivial. If you are concerned about this attack vector, then encrypt this drive. If you are hit by an RCE, then your Trello keys are the least of your problems.

Physical access is game over.

<comment><USER5> You have the encrypted cookies. You can't use the encrypted cookie to login with gmail.

It might only encrypt some of the cookies, but encrypting cookies in such a way that you need to be able to log in or unlock the screen with your password is a thing. [https://stackoverflow.com/questions/22532870/encrypted- cooki...](https://stackoverflow.com/questions/22532870/encrypted-cookies-in- chrome)

Otherwise there would be no point in such projects as node-keytar.

<comment><USER7> > _Otherwise there would be no point in such projects as node-keytar._

On Windows, the DPAPI (which node-keytar uses) does not protect against physical access. Here's a nifty GUI tool that is easily found with Google: [https://www.nirsoft.net/utils/dpapi_data_decryptor.html](https://www.nirsoft.net/utils/dpapi_data_decryptor.html)

On Windows, DPAPI _may_ protect you against unprivileged code execution, but it will not protect you against a privileged RCE or someone physically mounting your unencrypted hard drive.

I'm not sure what the state of the art in Linux or OS X's keychain is, but I wouldn't be surprised if they don't try to protect against that threat vector as well.

<comment><USER5> From that page: "If the DPAPI data was encrypted with the logon password, you have to enter this password in the 'Windows Login Password' field."

<comment><USER7> And how many people do you know enter their logon password every time they start Chrome?

EDIT: I looked into it a bit more, and the particular workaround I was thinking of may have been patched sometime between Windows 8 and Windows 10.

<comment><USER5> I already went over this. Quoting myself:

> You could argue that the number of people who protect their computer by > password but don't encrypt their disks is too small or isn't worth worrying > about. But I know that there is a significant portion of users that has it > set up this way.

It isn't before starting Chrome. It's when unlocking their screen or when starting up their computer.

A typical scenario for having your laptop stolen is being robbed while carrying your laptop in a backpack. If the lid is closed, the screen should be locked, if good password settings were chosen. Better to have the whole disk encrypted, but NSAPI provides some security for those who only have passwords set.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I might be an idiot to ask this, but how is this different from the AWS CLI storing IAM keys in ~/.aws/credentials ?

<comment><USER9> Or the private keys in ~/.ssh?

<comment><USER10> The private keys in .ssh can be stored encrypted. I do that, and store the decryption key in macOS keychain.

<comment><USER11> Can you share how to achieve this?

<comment><USER12> On linux, I use ssh-agent. My key at ~/.ssh/id_rsa is encrypted.

When my shell starts, it boots ssh-agent (add "eval `ssh-agent`" to your ~/.bashrc)

Still in the shell boot, it tries to add the ssh key to the keychain (add "ssh-add" to your ~/.bashrc), and it asks for my private key password. Once I enter the password, my key is unlocked for as long at ssh-agent is running (usually until I shut down my computer).

My password is a long, I only need to enter it once a day so it's not really a problem. You can add multiple keys to the ssh-agent (ssh-add mykey.pem). The private key must have these permissions: 0400 (chmod 0400 mykey.pem).

<comment><USER13> I can already see the headline "ssh-agent desktop application stores private keys in plain text".

There is no solution to the problem of the author beyond demanding a password on every single interaction.

</comment></comment></comment></comment></comment></comment><comment><USER14> Seeing that electron application code can easily be inspected inside the asar container (I.e. you can't trust the client) :

How would you approach the problem to encrypt secrets locally? The only approach I could come up with involves receiving a symmetric key from a server with certificate pinning, but even that seems quite insecure).

<comment><USER15> For some use cases, you can use Keytar ([https://github.com/atom/node- keytar](https://github.com/atom/node-keytar)) which uses the credential system/keychain on the OS.

</comment></comment><comment><USER16> I'm planning an offline-capable PWA, and I've spent a fair bit of time worrying about how to store credentials/tokens for my pouchdb backend. Is there, in fact, an established best practice for this? I looked, but couldn't find anything compelling.

<comment><USER17> Either your application requires an in-memory-only decryption password at each start, or it requires a plaintext cached-on-disk decryption password for headless startup, or it requires a hardware security module (HSM) through which all encrypted storage requests are routed for decryption.

Encrypted filesystems are necessary for #2 to be safe, but merely move the problem of #1 up one step in the chain to OS boot rather than app boot. #3 isn't necessarily safe as the HSM could be used to decrypt data when an attacker has gained access and is undiscovered, unless you use it to issue a temporary decryption key at OS/app boot, at which point you're effectively back to #1 again.

In practice, if you're a server application author, either use the secure credentials storage service offered by your cloud provider or store your secure tokens encrypted on-disk with the decryption key either stored in a local config file elsewhere or entered at app startup.

</comment></comment><comment><USER18> This is a surprisingly complicated issue present in a great many applications.

At first, it seems that there is not much to see here. Generally speaking, there is no way that the token could be encrypted that would not still allow decryption for anyone with read access to the disk (that is, the decryption key will itself need to be stored somewhere on disk). This is what Trello support's response is getting at.

However, there _are_ exceptions to this situation, since most operating systems now provide some kind of storage protected by the OS at a higher level (OS X keychain, Windows DPAPI and other similar functionality). In some cases, these facilities are even backed by hardware capabilities (e.g. TPM, secure element) that provide a high level of assurance. They tend to be frustratingly platform-specific and come with a laundry list of limitations though.

So, what about this case? The reporter compares to Chrome, and that's an important comparison. At least on Windows, Chrome _does_ use DPAPI to encrypt user cookies.

But, now there's bad news again. Since operating systems do not generally provide a good way to associate these kinds of secrets exclusively with any given application (once again, there _are_ ways to do this, but they come with even more limitations and are not very common), the exact same situation usually holds! Any application running on the machine at the same privilege level, which tends to be most applications, can probably still get the key needed to decrypt the cookies (e.g. via calling out to DPAPI). OS X is better at locking this down than Windows, but still far from perfect. It's hard to make a blanket statement about Linux because there are many such systems available and none of them are particularly commonly used - on average, I would assert that the situation is worse than on Windows, SELinux notwithstanding for the ten people that use it on their workstation (the same capability is available on Windows but not widely used for the same reasons that SELinux is not widely used).

There _is_ a security advantage to using these types of facilities, as they are generally good at enforcing that anything trying to read a secret is running as the correct user, including things like using the user's account credentials as part of the key material. This provides protections against things like processes running as other users or even on other computers with access to the storage device (say, a stolen hard disk).

But, the bottom line is that you go from "any process with read access to the disk can gain access to the secret" to "any process running as the same user with access to the disk can gain access to the secret." This is better, but not nearly as much better as we'd all hope for... the most common case is still not effectively protected against.

At the end of the day: if it is possible to for any application to read the data from disk without getting additional external key material (e.g. a user entering their password every time), assume that any application with access to the disk can get it. There are ways to make this harder, and in narrow cases even ways to make it exceedingly difficult, but when it comes to bypassing operating system protections, where there's a will there's a way. Measures as unsophisticated as "encrypt the data and then store the key in a file elsewhere in the file system" are remarkably common and so ineffective as to probably be dangerous by giving false confidence.

<comment><USER16> FWIW, SELinux is probably more widespread than you think. Fedora desktop is pretty popular, and has shipped with SELinux enabled by default for a while now. Now whether it has a usefully locked down ruleset for the scenario at hand, I couldn't say.

<comment><USER18> I'm just going from my personal experience here, but I think on platforms with SELinux enabled (mostly just RHEL derivatives) most people are using unconfined web browsers. SELinux is tricky because you can enable it and still have it do very little or even nothing, and this tends to be the case on desktop distributions. If you install Firefox manually to get a recent version or install Chrome at all, then you most likely don't have policy for them and they're running unconfined, and so are their files (besides the policy that all other applications are likely to share).

This wouldn't be so much of a concern if they offloaded encrypting the cookies to some kind of security service that would be sensitive and so almost certainly have strict SELinux policy around it, but at least Chrome on Linux implements the encryption itself using a flimsy hardcoded key. It's hard to blame them, because there isn't really an option to offload secret-keeping in Linux that is uniformly available and usable.

</comment></comment></comment><comment><USER19> I suppose the reason this token is not encrypted is because supporting offline data access would mean there's some private key on the computer -- and the same read access that exposed this token would expose that key.

Is the Trello offline data at rest encrypted in any way?

</comment><comment><USER20> The real question is - how do you handle this in any electron app? Anyone who can access your laptop/computer will be able to retrieve that token because the token needs to be stored somewhere! Has anyone implemented this before and how did you implement it?

</comment><comment><USER21> Is there any other solution than allowing users to set a "local masterpass"? I mean even lastpass is vulnerable to this while unlocked right?</comment>


Charles Proxy now available on iOS - <AUTHOR> https://www.charlesproxy.com/documentation/ios/ <comment><USER3> This is awesome! The first thing I discovered was how much network noise crashlytics.com was causing. Used AdBlock's[0] DNS proxy feature to black-hole the offending domain (they even mention blocking crashlytics.com in their FAQ[1]).

Note that both AdBlock and Charlex rely on iOS's VPN feature, and only one can be enabled at a time.

[0] [https://itunes.apple.com/us/app/adblock/id691121579?mt=8http...](https://itunes.apple.com/us/app/adblock/id691121579?mt=8https://itunes.apple.com/us/app/adblock/id691121579?mt=8)

[1] [https://www.adblockios.com/privacy/](https://www.adblockios.com/privacy/)

<comment><USER4> Hm, I thought Apple cracked down [0] on VPN-based adblockers. Or is AdBlock running a _real_ VPN? I.e. your traffic goes through their servers.

[0] [https://www.google.hu/amp/s/www.macrumors.com/2017/07/14/app...](https://www.google.hu/amp/s/www.macrumors.com/2017/07/14/apple- ad-blocking-app-crackdown/amp/)

<comment><USER5> Looks like this app is the one mentioned in that article. They appear to do both Safari content blocking and use the VPN profiles to block DNS requests (as in no traffic hits their servers).

</comment></comment></comment><comment><USER6> Genuine question here: How is it not absolutely terrifying that an iOS App Store app can man in the middle HTTPS communications made by other apps? Is there some way in which this isn't poking a hole in exactly the sort of security sandbox that iOS tends to be good at? (And yes there probably is some part of what's going on that I don't understand, that's why I'm asking the question)

<comment><USER7> Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.

<comment><USER6> Supposed sandboxing against malicious apps is precisely why I run iOS rather than Android. I get that Charles isn't malicious, but what's keeping any random free game app from doing the same thing? (Again, intended as a real question not a rhetorical one)

<comment><USER4> 1\. You have to turn on VPN in the system settings.

2\. You have to trust the Charlesproxy root certificate; again, in the system settings.

<comment><USER8> 1a. This requires your passcode, and any time a system is asking for your permission to do something is worth questioning. Even my least technosavvy friends and family have learned that if something is asking for your password and you don't know why, abort.

</comment></comment></comment></comment></comment><comment><USER9> I use the desktop product daily so I picked this up. I frequently proxy my phone through my desktop but I figured this would be fun to play with if nothing else.

I turned it on for literally one second and the first thing it captured was traffic from an app I used briefly several years ago and not since. Cool!

<comment><USER10> That sounds like a great tool for enhancing battery life, if you delete all the "overzealous" apps.

Charles could show a list of recommended apps to delete.

<comment><USER11> This sounds pretty far outside the realm of what Charles does (it's a web dev tool, not a system scrubber).

But something like "Little Snitch for iOS" would fit the bill.

</comment></comment></comment><comment><USER12> Charles can already be used as an http/https proxy on iPhone via [https://www.charlesproxy.com/documentation/faqs/using- charle...](https://www.charlesproxy.com/documentation/faqs/using-charles-from- an-iphone/)

I generally would only be needing to inspect requests when developing at my workstation, so how is this native app providing additional value beyond what the Charles Mac software already provides?

Big fan of Charles over here, I just don't understand the use case for the native app.

<comment> trevor-e Straight from the announcement:

"Running Charles on your iOS device means you no longer need to fiddle with WiFi network proxy settings. It also means that you can capture and measure network traffic that goes over the Mobile / Cellular data network.

Measuring networking performance over Mobile data is especially important for your mobile apps (as that is how a lot of users experience your app), and it can reveal large or slow requests, as well as opportunities to increase perceived performance by parallelising network calls."

AFAIK before this you could only inspect traffic over WiFi connections since you had to set the proxy address via WiFi network settings.

</comment></comment><comment><USER13> If you are a developer, consider the free alternative [https://www.github.com/kasketis/netfox](https://www.github.com/kasketis/netfox) ;)

<comment><USER14> Came here to say the same thing: If you're interested in seeing the traffic caused by your own app (and also making that info accessible to other stakeholders during dev time), netfox is the way to go. Super easy to integrate and provides usually enough info. Also no tinkering with the system settings or third party apps required.

</comment></comment><comment><USER15> How widespread is certificate pinning nowadays in iOS apps? Does anybody have any experiences?

<comment><USER16> I'm working at a European bank in their iOS team. We use cert pinning for all of our apps, but I have never heard or seen teams using it outside of this project.

I guess it's mostly used if the application is doing something critical like money transactions etc.

<comment><USER17> Cert pinning seems to be gaining momentum in the US several high profile apps are using it now.

</comment></comment></comment><comment><USER18> Sucks that more and more 3rd party apps are adding pinning to their code so you can't sniff their traffic. This is a great tool for first party debugging though :) Nice work Charles!

<comment><USER19> Of course, pinning is trivially defeated if you have debug-level access to the app because you could just intercept any network call.

<comment><USER18> Could you go about describing how this would work for a 3rd party app like Uber for example?

<comment><USER19> I've never done this personally, but I'm pretty sure there is no way to protect against hooking and/or patching functions in Secure Transport (iOS's low-level TLS stack), since all network traffic goes through these APIs. I'm sure there's something similar in Android.

<comment><USER20> You're not forced to use system facilities for TLS on Android. Back when you needed up to date TLS support for your app on older Android versions you would use e.g. BouncyCastle instead of the system's TLS facilities. Probably the same for iOS.

<comment><USER19> So just figure out which library they're using and patch that.

<comment><USER20> That's right, there are many ways. I just wanted to point out that you could roll your own tls.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Awesome news. Charles has been such a helpful debugging tool over the years. Less so for web stuff in these days of browser dev tools being so advanced, but the ability to inspect traffic system wide is still really useful outside webdev, and sometimes it can be useful to verify something dev tools tell you.

All developers should get this for iOS, it's bound to be useful and if not it will at least be interesting to see what you'd phone is getting up to online!

</comment><comment><USER22> I'm trying to get it to work but whenever I have the VPN enabled all network traffic fails (HTTP and HTTPS).

Anyone else have this issue? The website isn't giving me much insight :(

edit: I'm on the latest iOS beta. Could that be why? funny that I'm troubleshooting an app which is largely meant for troubleshooting apps...

<comment><USER23> I found that it didn't work on WiFi networks that block client-to-client connections, if that gives you any pointers.

<comment><USER22> Damn I didn't even try disabling wifi.

Yeah it works once I disable it, kind of an important pointer the app could alert users to...

I was originally thinking that maybe the MITM VPN IP clashes with my LAN subnet.

</comment></comment></comment><comment><USER24> Wish I could get a more consistent way of intercepting websocket traffic from iOS (specifically, wss traffic).

<comment><USER11> Charles for the desktop can intercept secure websocket traffic.

<comment><USER24> Yes, but the problem with Charles (well, iOS related at least) is that iOS websockets don't go through the HTTP Proxy configured. They're just considered a raw socket. Thus, even on desktop Charles, it's a nogo.

<comment><USER11> I don't know about intercepting iOS apps, but I definitely do this exact thing for web app development targeting iPads using Charles for the desktop.

Be sure that your default proxy port doesn't conflict with the default WSS port.

Edit: for reference I'm on Charles 4.2.1

<comment><USER24> It works in Safari and Webviews, but definitely not in any native apps. That's what I'm referring to.

</comment></comment></comment></comment></comment><comment><USER25> I like this a lot, but most of the time I use Charles for more than recording traffic. For example, checking how my apps behaves if I throttle certain endpoints, or rewrite responses. Hoping those features makes it into a future version!

<comment><USER26> Maybe it is worth mentioning that iOS has the ability to throttle the network itself—it's under "Settings"->"Developer"->"Network Link Conditioner". There is also a pref pane in Addition tools download for Xcode which allows to do the same on the Mac.

</comment></comment><comment><USER27> mitmproxy has worked on iOS and Android for years now and is OSS and easy to use

<comment><USER28> This runs on the device itself.

<comment><USER26> And the desktop version allows to intercept the traffic of the machine it runs on. Mitmproxy cannot do that afaik.

<comment><USER29> What do you mean? This has been working since way before 1.0.

<comment><USER26> Ok, I need to clarify, I had macOS in mind and this note in the mitmproxy documentation:

      > Note that the rdr rules in the pf.conf given above
      > only apply to inbound traffic. This means that
      > they will NOT redirect traffic coming from the box
      > running pf itself. We can't distinguish between an
      > outbound connection from a non-mitmproxy app, and
      > an outbound connection from mitmproxy itself - <USER2>
      > you want to intercept your OSX traffic, you should
      > use an external host to run mitmproxy. Nonetheless,
      > pf is flexible to cater for a range of creative
      > possibilities, like intercepting traffic emanating
      > from VMs. See the pf.conf man page for more.

That's for transparent mode only though, maybe that had me confused.

</comment></comment></comment></comment></comment><comment><USER30> Awesome tool, picked this up immediately. Amazing what things you can discover with it.

</comment><comment><USER31> This is much easier than the proxy option we used to need to go through!

</comment><comment><USER32> It's neat that it works on the device itself, that will come in handy when during field testing.

However I'll continue to use wireshark for debugging my network code when at the office.

</comment><comment><USER33> Imagine if the user could compile their own kernels for iOS^W^W [edit] that can control an iPhone. She enables IP forwarding in the kernel configuration. Maybe she can also disable some crucial bits for interacting with the baseband. She only wants wifi to work.

Then she uses this phone with the custom kernel (phone #1) as a gateway for another phone (phone #2). She can easily block ads and other undesired traffic destined for phone #2, using a variety of methods of her choosing (firewalls, dns, proxies, etc.).

She does not use phone #1 for anything other than being a gateway for phone #2. There does not have to be any data of any value to an advertiser generated, sent from, or stored on phone #1 (e.g, logs). It is just a gateway.

Cant do this, but imagine if she could.

<comment><USER19> You're free to compile XNU yourself; it's just the part where you load it onto your iPhone that doesn't work.

<comment> yjftsjthsd-h ...then how does it help that you can compile xnu?

<comment><USER19> Uh, you can put it on another phone maybe?</comment></comment></comment></comment>


Google Profanity Words - <AUTHOR> https://github.com/RobertJGabriel/Google-profanity-words <comment><USER2> I don't understand what this is. Banned by google in what way? I can google for all these words.

> As they closed the api

What api?

<comment><USER3> You can't say these words in Google buildings or they escort you out.

</comment></comment><comment><USER4> I doubt these are words that a "banned". Probably more like words that trigger extra precaution in certain contexts. Medical terms like "testical" are perfectly reasonable words.

</comment><comment><USER5> > goatse

oh no, not this again

For those who don't know: [https://en.wikipedia.org/wiki/Goatse.cx](https://en.wikipedia.org/wiki/Goatse.cx)

</comment><comment><USER6> Is this accurate? How is it tested?

<comment><USER7> Check which ones don't get any suggested search results :-)

<comment><USER8> That doesnt make sense. I can search for asshole just fine.

[https://www.google.com/search?q=asshole&oq=asshole&aqs=chrom...](https://www.google.com/search?q=asshole&oq=asshole&aqs=chrome..69i57.656j0j1&sourceid=chrome&ie=UTF-8)

<comment><USER9> But 'bleached asshol' doesn't suggest or correct to 'bleached asshole'

</comment></comment></comment></comment><comment><USER10> This list is way too short. What is its provenance?

</comment><comment><USER11> arrse - there goes father ted.

</comment><comment><USER12> God?

</comment><comment><USER13> > testicle

hm.. ok.</comment>


DNC serves WikiLeaks with lawsuit via Twitter - <AUTHOR> https://www.cbsnews.com/news/dnc-serves-wikileaks-with-lawsuit-via-twitter/ <comment><USER2> Doubt this is a legal way of serving papers.

</comment><comment><USER3> hah, process serving via wordpress CMS.</comment>


Tumblr "Experimental Literary Piece" Leads To Threat Conviction - <AUTHOR> http://www.popehat.com/2013/08/21/tumblr-experimental-literary-piece-leads-to-threat-conviction/

<comment><USER2> Fun projects are cool. Fetishising a credit card is kinda weird though.</comment>


GIMP and GEGL in 2018 - <AUTHOR> https://www.gimp.org/news/2019/01/02/gimp-and-gegl-in-2018/ <comment><USER2> I still think the name is a critical failure that inhibits adoption, though it's probably too late now to do anything. Look up about masks in The GIMP, for example ... [https://www.google.com/search?q=gimp%20masks](https://www.google.com/search?q=gimp%20masks) for me in a fresh private browser window this search brings up "fetishwear" sponsored links. The secondary meaning, the primary one from my childhood [en- gb native]: "gimp" would be like calling someone a "spastic".

The software could never be widely used in UK schools IMO. The bracketing of "I know it's a weird name, but I've used this programme for years, ..." is just too cringey for me when sharing in polite [or perhaps timid] company.

I know it's hard to get cross-language, cross-cultural names, ... I still don't know why they didn't go with Imp [nor what creature Wilbur (Wilber?) is supposed to be!].

Sorry, not wanting to start a flamewar but it should be mentioned IMO. Here's 2 threads where it's raised so we don't need to cover any of that ground again (both/all sides are represented I think; selective quotes):

1) [https://arstechnica.com/civis/viewtopic.php?f=2&t=22973](https://arstechnica.com/civis/viewtopic.php?f=2&t=22973) 'Here's a sign of immaturity: Naming a product "GIMP".'

2) [https://www.reddit.com/r/opensource/comments/6cs6wk/small_gr...](https://www.reddit.com/r/opensource/comments/6cs6wk/small_group_of_users_decide_theyre_offended_by/) 'the GIMP's name has long been the classic example of how bad open source projects often are at branding and marketing'

<comment><USER3> Similarly MongoDB. Many commercial examples, too.

<comment><USER4> What's wrong with that? Offensive to Mongols?

<comment><USER5> Mongoloid was the word that was used at one point for those with Downs Syndrome. It's pretty close to this.

<comment><USER6> So words that are just close to other words that are deemed offensive should not be used? I'll avoid mentioning the well publicized political cases over the last decade or so and just ask, should we use the word "pluck"? Should those with the surname "Kuntz" or "Cockburn" have to change their name? Is the offense created by similar spelling or similar pronunciation, or both?

<comment><USER7> We're talking about marketing here, and if something leaves you with an odd feeling, it's no good marketing.

I must say as a non-native, I didn't knew gimp before and was not offended. Googling in incognito mode, I can absolutely see why people might want to avoid that.

<comment><USER6> I'm simply replying directly to the comment which is not about marketing.

<comment><USER2> We're taking about freely sharing things by name, if there's a chance my boss is going to fire me just for mentioning the name of your product then I'm going to just avoid recommending it.

I've actually, conversationally, shared "gimp" with a couple of people in the past but I don't any more because I don't want to make them feel uncomfortable or think I'm making a joke at their expense. In a workplace I'm not sharing something that could get me facing a sexual harassment suit (it's not likely, but why risk it), or fired for offensive language (ditto).

This thread _is_ about marketing.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> For those complaining about slow progress of the GIMP (I'm guilty as well) remember it's a part time project where most of the work is done by 3 people (from reading this post). One thing about "free" is that everybody wants it and almost nobody actually wants to DO it. I wonder how many projects that take donations actually do reasonably in terms of paying developers - I doubt it's very many.

<comment><USER9> I'm unsure how blender is organized but they seem to compete with the proprietary competition on a much higher level. Does blender have so many more developers working on it than Gimp?

Edit: Seems like blender is indeed better funded: [https://fund.blender.org/](https://fund.blender.org/) Nothing crazy tough.

<comment><USER10> At some point in the last 5-8 years Blender went from being "the gimp of 3D" no one seemed to really want to use (like Gimp) given the alternatives to actually being a competitor. I'm not sure what happened but it's on the list of things to discuss if I ever sit down with an industry veteran in the modeling space...

<comment><USER11> One of the things that happened is the Blender team hired a bunch of professional artists to make real commercial quality movies using blender, and when the artists had a complaint, the developers were in the same room to get the issue fixed in real time.

Meanwhile GIMP has a reputation of being written by software developers for software developers, and being actively hostile to suggestions from artists...

<comment><USER12> That was a turning point for us as well. We had a sprint at the blender institute in Amsterdam and had invited artists to come as well. And we sat down a whole Saturday, taping them while they were painting and complaining. Us developers, we weren't allowed to chat back, we were just there to look and listen. Very illuminating, and fun for the artists.

<comment><USER13> HN doesn't allow any more replies there, so...

> "How did you dare to hack on Gimp, doing this, without doing us the courtesy > of asking for permission first!"

That is a bit of an overstatement.

"It would be nice if you talked to us first" != "How dare you do this without asking for our permission"

Yosh wasn't even demanding permission, just basic courtesy.

Source: [https://marc.info/?l=gimp- developer&m=90221516928016&w=2](https://marc.info/?l=gimp- developer&m=90221516928016&w=2)

Free software projects don't usually have an abundance of contributors, as you very well know. So I kinda get why Yosh was disappointed, although I don't think he should've fretted that much.

</comment></comment></comment></comment></comment></comment><comment><USER14> In case there are others like me unfamiliar with what GEGL and babl are:

[http://gegl.org/babl/](http://gegl.org/babl/)

babl is a dynamic, any to any, pixel format translation library

[http://www.gegl.org](http://www.gegl.org)

GEGL (Generic Graphics Library) is a data flow based image processing framework, providing floating point processing and non-destructive image processing capabilities

</comment><comment><USER15> It was nice to hear that Jehan got hired by the French National Center for Scientific Research to work on GIMP and G'Mic related stuff for one year: [https://girinstud.io/news/2018/12/the-dream-of-lila-and- zema...](https://girinstud.io/news/2018/12/the-dream-of-lila-and-zemarmot/)

<comment><USER16> I wonder how actually useful all these cool features without the most basic thing - updated toolkit. GTK+ 2 is being washed out of Linux distributions like Qt4 before.

<comment><USER13> All these cool features are perfectly usable on GTK+2. And there is a GTK+3 port in the master branch.

</comment></comment></comment><comment><USER17> When Non Destructive Adjustment Layers finally arrive, it will feel as if Gnu Hurd 1.0 is released.

Been waiting for those for years now.

Common, MAKE IT HAPPEN!

<comment><USER18> It's pretty ridiculous since GIMP is 22 years old and GEGL is 18 years old.

In a lot of ways gimp feels like it's perpetually stuck as a clone of Photoshop 4.0 or 5.0. If it can finally get adjustment layers that will help somewhat.

You can theoretically do almost everything in gimp that you can in photoshop, but since CS, photoshop has lots of functionality that makes things much easier (fewer steps), so the ergonomics of GIMP seem pretty bad in comparison now.

<comment><USER19> My understanding is there are very few people contributing to GIMP development. The only regular GIMP-related anything I see on planet.gnome.org comes from the ZeMarmot project.

It's hard to progress anything without participation...

<comment><USER20> This is my understanding, as well. I don't know why it happened that way, but contributor mindshare really moved away from Gimp years and years ago. Other similar projects have been released and surpassed Gimp in feature compatibility in the time since Gimp has been released.

Sad, really, given the important role Gimp played back in the late 90's. Gimp was initially the G in GTK, and was closely related to the foundations of Gnome. (And Gnumeric.... which, to my understanding, has the same sorts of issues as Gimp.)

<comment><USER21> I have read that there are few contributors because the current maintainers are a little hostile towards people who want to try and improve GIMP.

<comment><USER13> Mmm... Hostile how? Improve how? :)

If you want to write a public API to access text layers and then patch the PSD plug-in for text layers support, you are welcome.

If you want to make the tool's options dock optionally horizontal and docked to the top (a-la Photoshop, Inkscape etc.), you are welcome.

If you want to improve OpenEXR support, you are welcome.

If you want to improve the text tool (easy text on path etc.), you are welcome.

There are hundreds of things GIMP could do better. We know that. We welcome contributions.

The only thing we don't feel good about is when people tell us to make GIMP look and work like Photoshop "because Photoshop". GIMP is not a clone of Photoshop. We need better reasons than that. Apart from this, you are welcome to come and propose changes.

Edit: to be fair, two other topics we don't exactly like are project name change and save/export :)

<comment><USER21> Yes, but the number one thing wrong with GIMP is that it is hard to use, "because Photoshop" is what everybody knows.

Perhaps GIMP would have more users and more contributors if it embraced a few things that have become de-facto standards in image manipulation.

I switched to Affinity a few years ago, and it was tough to "unlearn" photoshop, but it was worth it. (But it could have more painful if Affinity was as weird as GIMP)

<comment><USER13> > Perhaps GIMP would have more users and more contributors if it embraced a > few things that have become de-facto standards in image manipulation.

Such as...?

<comment><USER20> I was about to say 'draw a shape with a toolbar button'... but after looking at historical Photoshop toolboxes, it doesn't appear to have had that feature either. :-) (Pixelmator, however, does...)

I almost hate to write what I'm about to write, but...

When I needed to add some text and labeling to an image, it was easiest just to drop the $30 on a Pixelmator license. For dealing with RAW photos from a handful of cameras, it was $120 on a license for Adobe Lightroom. Both have generally served their purposes well. Some of those features I could've implemented myself, but some I couldn't, and none of that work fits into a schedule full of other obligations. (Technical and otherwise.)

I think the difficulty with open source end user app development is that it can ask a burden of its community that few people have the skills to bear up to and even fewer have the time or inclination to do so. From my point of view, this leaves me with a combination of gratitude for the people like yourself that actually do step up, but also a degree of frustration that there's no easy way to make the situation better.

At the end of the day, I think the strength of OSS application software is that, by virtue of being OSS, it's possible for it to be things that closed software cannot.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> I stopped following GIMP dev, but something that bothered me everytime I tried using it, is the subpar ergonomics. Kinda like blender pre 2.8.

I hope blender new release give people some ideas.

<comment><USER23> Ideas are easy to find. People willing to spend time and effort implementing ideas are very difficult to find.

</comment></comment><comment><USER24> I've been waiting for CMYK support for years

<comment><USER25> Anyone that says they need CMYK doesn't understand printing. At all.

Suggesting CMYK is holding something back is literally suggesting that the individual wants discrete control over the inks in the machine, without considering the colour of the inks, the paper colour, the saturation level of the paper, etc.

Clean plates for spot printing? Fine. CMYK painting? No.

Late binding has been the path forever, and is the only way forward. As a result, anyone suggesting they need CMYK has a debilitating grasp of how printing works.

<comment><USER3> Remarkably some professional(!) printers don't want to do late binding, instead telling clients to supply "CMYK PDFs" (color space? doesn't matter! Pick any CMYK!).

<comment><USER25> You realize that late binding means supplying the CMYK based on a conversion from RGB? Good.

> (color space? doesn't matter! Pick any CMYK!)

You realize that "color space pick any" has an implicit connection to the actual physical inks and what colours they print? Good.

As in it is a clear beacon that you don't understand a shred of what you are replying to. I'm sure your professional(!) print runs that you have done have taught you that, though.

<comment><USER13> You realize he was agreeing with you?

<comment><USER25> Entirely misread in a blind fit of rage.

</comment></comment></comment></comment></comment></comment><comment><USER16> It would be interesting to hear, probably in percentage on how GTK 3 porting is going, what is missing and what is work in progress.

</comment><comment><USER26> I wish at one point in the future it will allow us to save a picture as JPEG. And then to be able to simply quit the program.

It's pretty basic, I know GIMP have a reason to make it more complicated and painful, but I don't agree with it.

<comment><USER27> It used to, years ago, and then they made that change to "export", making it simply harder, I will never understand, it was a huge step backwards.

<comment><USER15> In professional creative software, you save to the project format (xcf in GIMP's case) and export (or render) to a "flat" format. Graphics, video, audio, it is roughly the same behaviour.

<comment><USER27> I know but before you could do both actions using the same dialog.

<comment><USER28> That's a good point. I understand the importance of having a default format that can preserve every bit of data Gimp is capable of creating. But it makes a lot of sense to have one dialog that can save in both formats, especially since the dialogs support choosing the format automatically based on the extension.

</comment></comment></comment></comment></comment><comment><USER29> I've been using photopea.com for a while, is much more usable than GIMP.

<comment><USER30> I use Krita, though it's perhaps not quite the same use case.</comment></comment>


AI is a tool, not a threat - <AUTHOR> http://www.rethinkrobotics.com/artificial-intelligence-tool-threat/

<comment><USER2> The threat isn't that robots will kill you, but that they will take your livilihood. If you are a worker in a capitalist society, you should be worried. The analogy is the internal combustion engine vs the horse. What happens when AI advances to the point of matching your general intelligence and learning capacity? If you work in IT, poof, firm management outsources your job to a computer. If the AI is attached to a robot that further matches your dexterity, poof there go most other jobs as well.

<comment><USER3> Jobs going 'poof' thru automation used to be a GOAL of modernization. Is the race going to work hard forever? Will we ever be free from the need to provide food and shelter? Wouldn't that be a good thing?

The real issue is, WHEN we no longer need to work to all have a great standard of living, HOW will we work it out.

</comment></comment><comment><USER4> If you're worried that a sentient robot is going to kill you, why are you not first worried about a non-sentient robot being able to kill you? If robots are in a position where they can kill, sentient or not, _humans_ will exploit them to do this far before an AI is conscious enough to do so. There is plenty of volition for this from humans, e.g. terrorism.

</comment><comment><USER5> I think the "high profile people" are not afraid of the robotic entity being nativity good or evil rather the affect the AI device has on humanity being detrimental to overall human advancement. For example, look at how smart phones have caused people to only be able to recall a handful of phone numbers.

<comment><USER6> Which has left us more capable of remembering other things, right?</comment></comment>


Ask HN: Is HN written using Ruby on Rails? - <AUTHOR>

Just curious because it seems that it is written using rails. <comment><USER2> It's not. I'm sure someone will hop in with the specifics. I think it's written in arc.

<comment><USER3> Correct. Considering PG created it, it makes sense.

</comment></comment><comment><AUTHOR> hmm. ya just got the source code here : [https://github.com/wting/hackernews](https://github.com/wting/hackernews)

</comment><comment><USER4> Why does it seem so?

<comment><AUTHOR> well that was just my intuition. may be because its easy to make such a thing with rails (may be i am getting biased here.)

</comment></comment><comment><USER5> arc was invented for hn

<comment><AUTHOR> :/ was invented for HN ? HN could have easily been built using rails or django.

<comment><USER6> which web development frameworks have you worked with so far?

<comment><AUTHOR> only rails and django :D</comment></comment></comment></comment>


Code golf for Christmas - <AUTHOR> https://perl6advent.wordpress.com/2017/12/23/day-23-the-wonders-of-perl6-golf/ <comment><AUTHOR> At my office, the golfing site in this article went a little "Viral" this week.</comment>


Prototyping iOS apps with Keynote - <AUTHOR> https://medium.com/@ramykhuffash/prototyping-ios-apps-with-keynote-4f1bf3c720fb

<comment><USER2> Apple hosts a WWDC 2014 video on the same subject: [https://developer.apple.com/videos/wwdc/2014/](https://developer.apple.com/videos/wwdc/2014/)

It's called: "Prototyping: Fake It Till You Make It."</comment>