Promiscuous cookies and their impending death via the SameSite policy - <AUTHOR> https://www.troyhunt.com/promiscuous-cookies-and-their-impending-death-via-the-samesite-policy/ <comment><USER2> Just a nit on this point -

"Quick note on Microsoft's implementation: their first shot at it was buggy and caused the "None" policy to omit the SameSite cookie attribute altogether"

This isn't a bug, just unfortunate naming and a lack of prescient engineers. When it was written, None was not a valid enum value (and frankly still isn't) and the default was Lax. To remove Lax, you set it to None in dotnet, which did the standard behavior at the time - emit nothing.

If every framework implemented every random extension proposed to every standard, we'd be in a very messy world with half-baked and sometimes contradictory standards implemented. Special casing because it's Chrome doing the breaking change to the standard/Internet is not a precedent I want to see.

<comment><USER3> >and frankly still isn't

It looks to me like it was added on April 9, 2019:

[https://github.com/httpwg/http- extensions/commit/fa624b1358b...](https://github.com/httpwg/http- extensions/commit/fa624b1358be1ef77a4fd2560c94593ecf7f508d)

<comment><USER2> Note that this is the draft, and 6265bis-03 expired in October. While it's presumed that this proposal will be accepted and become the new standard, a single commit does not make the standard.

</comment></comment></comment><comment><USER4> Chrome seems to have made one change recently -- maybe related to this? -- that made it so YouTube videos embedded in other sites no longer have you logged into YouTube.

This means that if you have YouTube Premium, where you pay $10/mo so you don't have to see ads on YouTube videos, you still see them when the video is on someone else's site. Oddly, it still works as it used to in Brave.

Since this is sort of cross domain cookie related (YouTube uses an iFrame typically when embedded, whether embedded by pasting html or by using the JavaScript API), does anyone know why this happens? If you ask YouTube Premium support, their canned answer is "we don't guarantee no ads except on the YouTube site." But they can't explain why it works with no ads in non-Chrome Browsers.

<comment><USER5> _Is_ that cross-domain cookie related? I thought by virtue of being in the sandbox that is the iframe it has access to the cookies associated with the domain(s).

It sounds like an excuse to serve you ads, honestly.

<comment><USER6> It would break other features (like the "Watch Later" button) too.

According to Occam's Razor, this is very likely to be a bug rather than a conspiracy against YouTube Premium customers.

<comment><USER4> I agree it is probably a bug, partly since other browsers aren't affected.

</comment></comment></comment></comment><comment><USER7> I work for a company whose endpoints end up being embedded in iframes in external systems, and this change is currently causing no small deal of heartburn for several folks here.

I really don't like that the Powers That Be have decided to make this change, for many reasons:

1\. Changing the default behavior of a thing on the 'net that's been around for so long. Like the article says, I can't wait to see the various and sundry things that are all broken as a result.

2\. To set SameSite=None and get back to the old behavior (more on this in a second), you need to do... user agent sniffing, because some browsers (as the sibling comment by swang says) will choke on None and fall back to Strict. Great, so _sometimes_ set SameSite=None, sometimes don't set it or else things will break. _eye roll_

3\. As the article says, SameSite=None is only allowed on Secure cookies, which means you actually _can 't_ get back to the old behavior. Now, my company has been telling people for years to stop using HTTP (and customers have to contact support to even get HTTP support enabled). However, there are a few enterprise-y holdouts. In several cases, we've had to go be the bearers of bad news. Albeit, there is an undercurrent of glee in finally forcing them to stop being bad stewards of data (assuming they don't just enterprise-policy it away), but still, from a business perspective it's very frustrating.

So, in sum, it'll break stuff that's not updated (my guess: a lot of stuff), setting SameSite=None requires a user-agent-sniffing hack, and even setting SameSite=None is not a complete solution if you're using HTTP for some reason.

And for what, exactly? This would've been nice in 1995, but it's a bit late now. Though, I guess maybe twenty years from now we can rip out (or stop writing) some anti-CSRF code or something.

<comment><USER8> You don't fix security problems with the Same Origin Policy because you're trying to free up some anti-CSRF code to make developer lives easier. You do it because mistakes with that anti-CSRF code result in vulnerabilities, which harm users, who are an externality both to developers and standards authors. And those mistakes happen all the time.

The SameSite change we're talking about decisively mitigates most CSRF vulnerabilities. Once widely deployed, it probably kills the bug class, turning it into another bug bounty eye-roller like ClickJacking, rather than what it is now: a bug that is routinely exploitable on significant sites. It is more than worth it; it's one of the smartest things the browser vendors have done in awhile.

<comment><USER9> > turning it into another bug bounty eye-roller like ClickJacking

When did clickjacking get mitigated by default by browsers? As far as I know it's still up to websites to prevent framing explicitly.

<comment><USER8> I'm not saying that CJ has been mitigated by default the way CSRF is poised to be, but rather that it's very rarely exploitable, which is soon to be the case for CSRF as well.

</comment></comment></comment></comment><comment><USER10> Adding annoyance to this change is that Safari has a bug where if you send a value with an invalid parameter in SameSite, ("lax" being considered an invalid value), Safari will default to Strict (rather than None) and thus there is another check developers have to handle, which is to user-agent sniff for a Safari/Webkit browser, then explicitly send "None" or not send the SameSite value of "Lax"

I'm pretty sure the WebKit team is aware of it but I don't recall a timetable for a release that addresses the issue, so up to Nov 2019 (when I last look this up) Safari still has this issue.

<comment><USER11> Hey, there are some important mistakes in this warning:

1\. The value that is invalid for older browsers (including older versions of Chrome!) is None, not Lax. It is always (as far as anyone knows safe to explicitly set SameSite=Lax in all browsers, assuming your site is ready for that.

2\. The latest Safari (v13) has changed their behaviour to match the latest spec.

See this article for details on detecting/dealing with it: [https://www.chromium.org/updates/same-site/incompatible- clie...](https://www.chromium.org/updates/same-site/incompatible-clients)

TL;DR: old (but not too old) Chrome responds by rejecting the cookie entirely (which Google says was an valid interpretation of the spec, at the time of those versions) and old (but not too old) Safari responds by interpreting the None value as Strict (I think there is some debate on whether the spec allowed this back then, but at this point it doesn't matter/I don't care).

<comment><USER12> The latest safari may have changed the behavior. But the bug is tied to the OS version, and Apple has said they won't backport the new behavior to iOS 12 or Mac OS 10.14. So people who can't or won't (for example users of old iphones) upgrade the OS will not get the fix. So user-agent sniffing will probably be necessary for years.

> See this article for details on detecting/dealing with it: > [https://www.chromium.org/updates/same-site/incompatible- > clie...](https://www.chromium.org/updates/same-site/incompatible-clie..).

Yes, they recommend using a few dozen lines of user-agent sniffing code. Despite the fact that user-agent sniffing is generally considered bad practice.

<comment><USER11> > So user-agent sniffing will probably be necessary for years.

Only if you set None (either to opt-out or to do a None/Strict pair). Setting Lax doesn't require sniffing.

But yeah, that seems like a safe bet.

</comment></comment></comment></comment><comment><USER13> 100% of the warnings i see are ad cookies from google. We get it google, you no longer need cookies to track us

<comment><USER14> This won't stop cookie-based tracking though, they can just set "SameSite=None" with their cookies

<comment><USER15> Wouldn't that make it trivial to block them all?

<comment><USER11> You mean block all SameSite=None cookies? They have legitimate uses too.

Consider that SameSite=Strict even breaks cross-origin links (<a> tags): if a 3rd party site links to you and a user clicks that link, the GET will be sent without cookies.

To get value out of Strict for typical sites the new pattern is to have two cookies: one is SameSite=None and allows you to do GET/HEAD/etc. requests ("read-only operations", assuming you are following those parts of the spec) and one that is SameSite=Strict and allows you to do POST/etc. ("write operations").

If [https://evil.com](https://evil.com) adds a link to your site (an <a> tag) you can allow deep linking by only checking for the None cookie. The strict cookie won't be sent for <a> tags. But POSTs/form-submissions, and any page/resource you don't want to allow deep-linking for, you would check for both the cookies.

I've seen this pattern referred to as "reader and writer cookie pairs".

\---

This really is specifically aimed at killing CSRF attacks. It's not about tracking either way (it's orthogonal to that).

<comment><USER3> Why None instead of Lax? The uses cases you mentioned for the None cookie seem like they would still work with a Lax cookie.

<comment><USER11> Ah, good point. So it depends on your site. Some sites need to do things like serve embeddable content or be an OAuth identity provider, etc., and SameSite=None is required in those cases. Sorry for not being more clear about that.

</comment></comment></comment></comment></comment></comment><comment><USER16> I like the idea behind the change, but it's the first time I've heard about it (and I assume I'm not alone), and it's being deployed in less than a month?! Seriously Google ?

<comment><USER17> I dont mean to be dismissive, but it has been long announced, discussed, and noisily in the console.

My honest question would be how you've missed it (because I'm assuming your missing means others would also reasonably miss this) but I have no idea how you could know the answer to that.

<comment><USER18> > and noisily in the console.

This is true but not necessarily helpful because what the console is often noisily complaining about is cookies from Google properties and the like.

For many cases where I'm not making use of those cookies myself that's simply irrelevant... noise: what I need to understand are changes required for my own cookies, on which the console has remained silent. Also, not something I'm going to be paying attention to if I'm debugging something unrelated.

(I'm not saying the console is a bad place to show these warnings - far from it - but there are plenty of reasons people might not spot them.)

I found out about the changes a while ago through HN but even that was months after the announcement was made. I don't closely follow announcements from Google simply because the vast majority of them aren't relevant to me. That being the case it's quite easy to miss things, or find out about them further down the line via another source.

<comment><USER17> I understand the complaint about noise, but the message is fairly explicit as to what is changing and what you need to do and where to go for more info:

"A cookie associated with a resource at [http://google.com/](http://google.com/) was set with `SameSite=None` but without `Secure`. A future release of Chrome will only deliver cookies marked `SameSite=None` if they are also marked `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at [https://www.chromestatus.com/feature/5633521622188032."](https://www.chromestatus.com/feature/5633521622188032.")

A quick google (ha!) check shows articles from plenty of development and security blogs (i.e. not from google direct) going back to May (though a LOT seem to be from the last few months, not sure if that's because chatter picked up or because Google is giving me more recent results, and I'm too lazy to experiment - I definitely heard about it from multiple sources before the original impact date in Oct)

Focusing on the point - Obviously this is a change Google should give "enough" notice for (both time-wise and breadth-wise). What would you recommend them doing differently than they have? At the end of the day, I'm not really sure what they can do that they didn't do - indeed, since they delayed the original release, there's a real risk of people ceasing to pay attention if you delay too much.

I'm asking out of curiosity, not accusation.

<comment><USER18> No stress, and I do get it, but it's bound to happen that people don't find out.

My issue with the console warning is that, as explicit as it is, unless you know at least some of the background it's not immediately obvious why it's relevant to me as a developer of mysite.com.

</comment></comment></comment></comment></comment><comment><USER19> They mention changing your password with a POST request, but at least what I have seen require the old password to be included in the request too.

Nevertheless, this is also problem of web apps in general. In many cases there are better protocols and better programs anyways.

In the case of the cookies, there can be user settings; if the user defines a cookie manually they can define if it is sent with cross site requests or not, and if the server sends the cookie to you then by default it won't be sent with cross requests. Cookies would always be sent for <a> links outside of frames, though, unless the user configures otherwise (such as to disallow it if there are query strings, for example).

Another thing I thought is a "Web-Option" request header. This is similar to cookies but cannot be set by the HTTP response nor by document scripts; the only way to set it is for the user to set it by themself. The response can include a "Web-Option-Schema" header, which is a link to a file specifying what options are valid; the user can use this or can specify their own options which might or might not conform to the schema. (This is not meant for authentication. For doing authentication, use basic/digest auth instead.)

</comment><comment><USER20> Another great article from Troy. I personally believe that Google is intentionally flagging their ad network to ensure a large majority of the 'web' and subsequent developers are made aware of the impending changes. However, the console does not make it clear that we're talking about a change that is being implemented in less than a month.

</comment><comment><USER21> I wasn't really following this whole SameSite thing but between Safari and Chrome and various versions it looks like they made the problem worse.

The idea is great. Basically browser vendors finally realized that most websites don't need cookies for cross-site requests so it switched from opt out via CSRF busting techniques to opt-in.

Except isn't following cross-site links basically a GET request initiated by a different referer? So now will the strict mode not have me logged in when someone follows a link to some site that set it? Is that why the default is LAX? And under Lax, what about html form posts to top-level documents? That should go without cookies, right?

</comment><comment><USER12> I agree that making SameSite=Lax the default is the right thing to do. However, I think chrome is moving too quickly. Making SameSite=Lax the default while a substantial amount of users use browsers that don't support SameSite=None seems like a mistake.

</comment><comment><USER22> So these cookies may die but it's a perpetual arms race. Browser fingerprinting will (or has) replace(d) cookies for tracking purposes.

<comment><USER23> Browser fingerprinting is a hack, and exploits clear loopholes in browser privacy models.

I wouldn't rely on it because it's committing to an ongoing arms race against the browsers. One that I expect them to win.

<comment><USER24> > Browser fingerprinting is a hack, and exploits clear loopholes in browser > privacy models.

> I wouldn't rely on it because it's committing to an ongoing arms race > against the browsers.

It doesn't seem to me that browsers are trying to win at all. For example, one of the greatest discriminators - font list - has been known about since people were talking about browser fingerprinting.

The fix would be pretty easy too: in incognito mode (or when toggled by the user), only support 2 fonts: 1 serif and 1 san-serif that ship with the browser on all platforms.

I don't think any of the browsers want to do that.

There are a number of other longstanding fingerprinting issues that are similarly easy to fix.

<comment><USER25> You'd need a standardized font rendering engine to defeat fingerprinting via canvas.

<comment><USER26> "Same canvas image looks the same on every browser" seems like a desirable state of affairs to me?

<comment><USER3> I think the problem is that canvas can be GPU-accelerated, and GPUs don't have an exact standard for how each pixel will look.</comment></comment></comment></comment></comment></comment>


VVVVVV 60% Off On The Mac App Store This Weekend - <AUTHOR> http://distractionware.com/blog/?p=1748

<comment><USER2> Warning: do not buy VVVVVV if you haven't yet finished your taxes. You will not get anything done.</comment>


Are people with bigger brains smarter (on average)? - <AUTHOR> https://twitter.com/scientific_bird/status/1154846441325694977 <comment><USER2> This doesn't seem to mesh with studies I've seen that, for instance, indicate women and men score effectively the same on general intelligence tests despite male brains being on average 10%, or 130cc larger than female brains.</comment>


Why do you need a LinkedIn account? - <AUTHOR> http://bush-dev.com/why-do-you-need-a-linkedin-account/ <comment><USER2> Over the last 6 months I've read and had to make decisions on somewhere north of 500 cvs.

(I am a software developer, but I'm also doing hiring right now)

Linkedin means you exist[1]. It adds some (ie more than zero) legitimacy to your experiences[2]. It gives a canonical link to places you've worked[3]. It standardizes the way experience is described[4].

Let me clear: I hate linkedin. It sucks, I get it. The last time opened it with an intention other than for hiring or updating my status due to a job change was well over a decade ago. But I also hate CVs, and you have to make calls somehow.

[1] People send in fake or dishonest names to imply they are a single developer, but the goal is for you to hire their outsourcing company, or to obfuscate themselves because... (I never got to the bottom of all of them)

[2] People lie. This doesn't completely solve that but it creates links you can at least vaguely understand, connections implied you've worked with others etc

[3] When you hire from every single company "Generic Corp" isn't helpful, and it's often the case the company name people say is ungooglable, or at least gets multiple potential hits, then you have to try to guess which one the mean by where they live, if you can work that out from other companies they've listed... it's a mess

[4] everyone writes CVs differently, which is great for self expression, but makes it harder to get a common feel for things

</comment><comment><USER3> Maybe Linked In was bad for me, or maybe I was using it incorrectly but...

I deleted my account. I don't know if I'd ever make another one or not. I'm a self-taught developer with three years of experience, two in a single company that I still work for.

To be clear, I actually do want to find a part-time contract on the side, but I'm loathe to create yet another profile on yet another page. I already have GIthub/gitlab ( which actually doesn't showcase the work I've been doing for the past two years since I can't put any of that code on there ).

I deleted Linked In partially because I kept getting recruiter spam for my previous career (teacher), and also because I was tired of all the spam posts from different companies bragging how nice their gym is or what it's like to work for them.

Quite frankly, I think my CV gets passed over a lot due to my age, and my experience. So yeah. I don't think Linkedin would even help me.

Oh, and Linkedin looooovves data mining. They ask so many invasive questions that it gives employers a free pass on judging you without even interviewing you.

</comment><comment><USER4> Oh god I hate LinkedIn. Full of "I'm awesome and smart" people. But maybe it's just me.

<comment><USER5> I would replace "awesome and smart" with "self promoting".

LinkedIn is a social network aimed at recruiters and job seekers. Of course there's a lot of posing on each side to get what they are looking for.

</comment></comment><comment><USER6> The problem with Linkedin is that after certain amount of connections, it loses exclusivity and just turns into any other social media out there....

<comment><USER5> LinkedIn was always a social media thing, no matter the amount of connections.

It's just that some people simply decide to include in their network people who they don't even know if they exist at all.

</comment></comment><comment><USER7> Until I figured this out, I just left my LinkenIn account bare, with very few connections:

\- LinkedIn is where new jobs are announced. You may have noticed in finance that there's a layer of recruitment consultants who have placed themselves between the banks/funds/fintechs and the potential employess. Quite often one of them will post a list of jobs they are working to place someone in. Quite often these job listings also include salaries and perks. And the big plus is that the experience is interactive. You simply ping them about the job and they chat with you. If it's not for you, not much time is wasted.

\- Recruitment guys are not picky about who they link with. I've turned my news feed into a continuous stream of jobs from various people. Now and again, I'll ping one of them and find out who the employer is and what exactly they want. It tells me what's going on in the industry.

\- If you pepper your LinkedIn CV with tech keywords, you will get a load of people contacting you with potential jobs. Most are not quite what you want, but how many jobs does one person need? I've gotten really good offers as well, just by sitting there and doing nothing.

\- People who want to sell you stuff are there too. I'm a hiring manager, so I get a lot of "hey I've got this guy, do you want him?" messages. Or "We are looking to partner with someone with xyz skills". You can quite quickly decide if there's any interest.

So that's why it's worth having a LinkedIn profile.

I wish they'd update their site though, it's getting pretty stale. They need a dark theme (fairly minor) and they need a way to group your contacts. That last one is especially important, as I often add people who don't know me but seem interesting.

</comment><comment><USER8> I created a throwaway account to get the details of someone who crashed into me approximately 10 years ago. It still periodically attacks my spam box and it hasn't been used excerpt for that 1 time.

</comment><comment><USER9> This article reads like an ad for LinkedIn. Also the new hype is to have a GitHub account with plenty pet projects when you apply for a position (not that it matter anyway, none going to actually look at them).

<comment><USER5> I've been involved in a recruitment process some years ago and I can assure you my company combed through all GitHub accounts referred by clients.

In a couple of cases these accounts supplied critical clues to the chasm between the experience a candidate claimed to have and the skill actually exposed in the repos.

</comment></comment><comment><USER10> I was getting repeated spam from LinkedIn ("x wants to connect with you") around 2012. Hitting unsubscribe would stop it for a calendar month, but then it would start again.

I ended up sending them an email threatening court action under UK spam legislation if I ever had another unsolicited email from a LinkedIn.com domain again, and since then it's been blissful silence. Highly recommended.

Having since moved to Sweden, I can tell you that not having an account here is viewed as somewhere between wilfully contrarian and bizarre. It doesn't seem to have affected my career though.

</comment><comment><USER11> The "do you know this person on LinkedIn" have been quite successful in making sure I never make a LinkedIn, something I would like to uphold even as we enter an economic recession.

</comment><comment><USER12> Some time ago I realized that over the years I never started a new job that was coming from a LinkedIn connection. So it was basically useless to me, now more than ever as it's just like any other social media out there full of "success" stories and noise. I already keep "connections" with ex colleagues with IM apps. For now I just removed the app from my iPhone and already experienced I got some time back like when I deleted my facebook and instagram account a couple of years ago. Eventually I'll delete linkedin as well. If I need to find a new job or make new "connections" I'll use hn like I did before

<comment><USER5> > Some time ago I realized that over the years I never started a new job that > was coming from a LinkedIn connection.

Personal experiences may vary, but in my experience from the last decade or so, all the recruitment processes I was involved and all the jobs I had involved linkedin in some way or another.

</comment></comment><comment><USER13> Linkedin can be very helpful when doing business dev and looking for key contacts in your target companies.

But I must say my good-looking woman colleague is much more successful than me in acquiring connections. Go figure...

</comment><comment><USER14> I've never had a LinkedIn account and don't intend to start. Where I work, there's an "our staff" page which used to have links to staff webpages, LinkedIn etc, and from the web-stats, I know that I used to get 4-5 people a month clicking on the "web page" link. About a year ago, they changed the design of the page so that it had only LinkedIn links, so I have a LinkedIn link which leads to my website. Since then not a single person has clicked that link.

People do not want to read your LinkedIn page.

</comment><comment><USER15> Nice advertisment. As long as there is no single negative thing about LinkedIn mentioned (and we all know there are plenty), this article can't be taken as anything else. Flagged.

</comment><comment><USER16> I think that for me there's _some_ value in having an account and very little value in spending significant amounts of time on the platform.

</comment><comment><USER17> Perhaps, if you are at a stage in your career where you might be changing jobs somewhat regularly, LinkedIn might be useful. However, be prepared to be spammed.

I am in a steady job, nearing retirement. I used to get a lot of spam loosely related to my work. Since I deleted my LinkedIn account, the volume of such spam emails has decreased by at least 80%.

</comment><comment><USER18> LinkedIN thinks of your career as a monolithic thing--that you have the same career path, growing ever upward, your experience a rationally clear whole.

In all the years I've been on LinkedIN they have not responded or innovated nor altered the basic template.

</comment><comment><USER19> I got my two last jobs via Linkedin so for me at least it has been useful.

But yes, lots of noise there.

</comment><comment><USER20> It can be useful. I have one rule when it comes to Linkedin though; I only connect to/with people I have either met in person or spoke to with over the phone.

<comment><USER21> Why would you optimize for smaller public stats on a marketing website?

</comment></comment><comment><USER22> Its becoming the facebook for the workforce, lots of noice.

</comment><comment><USER23> To be fair HN is probably not LinkedIn's typical audience :P

I say this as a techie who embraced the Dark Side and started using LI a few years ago...

</comment><comment><USER24> the true value with linkedin was always the one-click apply for this job integration it spawned, no cv no filling out 200 fields over and over with the same information.</comment>


Rust for the Web - <AUTHOR> https://thefullsnack.com/en/rust-for-the-web.html <comment><USER2> Web developers may be also interested in [https://gotham.rs/](https://gotham.rs/), which was released very recently and looks to be a promising competitor to Rocket.

<comment><USER3> And for those who care, unlike Rocket it runs on stable rust. IMO that is useful as I personally prefer running on stable than nightly.

</comment></comment><comment><USER4> Man Rust is super hard already! I mean people told me it would be harder to think functionally but after clojure, i think lisps are super easy. But i feel Rust is way harder than anything. Infact i feel Haskell is comparatively easier than Rust. So i am not sure why one wants to use it for web. I think Rust has a place and that is to replace C++ for system software, possibly even C for writing Kernels because why not? But definitely not for web. Go is probably the right choice for that sort of performance scenario in the backend. But for frontend neither Go or Rust are good simply because of the huge size of the runtimes. Clojure-script comparatively has a smaller runtime than either Go or Rust runtimes compiled to JS.

<comment><USER5> I disagree. I think Rust is pretty easy once you've spent a bit of time learning about lifetimes.

It should be substantially less surprising when it's got non-lexical lifetimes, though.

Rust seems to me eminently suited to write high-performance web applications.

<comment><USER6> Let's be serious, Rust will never be as easy to use as a language with GC. It will perform better on many metrics, but you have to pay that cost.

<comment><USER7> Unless you care about resources other than memory. GC doesn't help to make sure mutexes don't deadlock and files are closed. As far as I know there is no general purpose algorithm for those.

<comment><USER6> Even still, you can opt-in to those features in a GC language when you need it, but the contrary is not the case in Rust at the moment.

<comment><USER7> But you can't opt out of the problems with garbage collectors without dropping the language.

<comment><USER6> Most common GC "problems" have fairly simple solutions. If we're talking about 50GB+ heaps, then we're already talking about a problem that's getting significant engineering investment, so custom solutions become warranted, ie. a special purpose library that manages its own resources that plugs into the safe runtime, similar to unsafe Rust, just less integrated.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I built [https://dtmf.io/](https://dtmf.io/) using Rust. The first prototype was using the Iron framework but then after fighting some parts of Iron, I pared it back to just using async hyper & handlebars-rs directly for the HTTP and templating. The glue to put them together is really minimal. Overall, I've been really impressed with Rust.

</comment><comment><USER9> Nice overview, it might be worth mentioning that Emscripten isn't a tier 1 platform[1]. We've seen some asserts thrown in LLVM when building debug but go away when build release.

I've been trying to isolate it down to a reproducible sample but haven't nailed down exactly what's causing it yet.

Even with that issue it's been great to work with. I find myself so much more productive with Rust compared to C/C++.

[1] [https://forge.rust-lang.org/platform-support.html](https://forge.rust- lang.org/platform-support.html)

<comment><USER10> If you've got something large that asserts consistently, you could consider throwing some CPU time at it via creduce. It is designed for C, but Rust is close enough that a lot of its heuristics still work just fine.

Alternatively, since setting up/running creduce can be bit fiddly, if the code is open source, I suspect that someone would do it for you if you filed a bug against Rust pointing to an exact commit that demonstrates the problem with `cargo build --target=...` (or xargo) and requested/suggested creduce.

<comment><USER9> Thanks, I'll give that a shot. Unfortunately the code which is why I was trying to pair it down to a simple sample.

</comment></comment></comment><comment><USER11> > NamedFile::open(Path::new("www/").join(file)).ok()

Is this vulnerable to the classic "../../../../../../../etc/passwd"?

<comment><USER12> I was thinking the exact same thing. Rust being a more memory-safe language does not mean it is a secure one. Still needs proper input validation.

EDIT: I opened the documentation and found [https://api.rocket.rs/rocket/request/trait.FromSegments.html](https://api.rocket.rs/rocket/request/trait.FromSegments.html) I don't fully understand if the checking they do on '..' fixes the attack vector here.

<comment><USER13> Slashes aren't allowed, so wouldn't be able to do any path traversals: [https://api.rocket.rs/src/rocket/request/param.rs.html#298](https://api.rocket.rs/src/rocket/request/param.rs.html#298)

<comment><USER14> > On Windows, decoded segment contains any of: '\'

And on Japanese and Korean windows? It uses the yen symbol as path separator. Depending on how the path is read or interpreted, filtering the yen may be necessary.

[https://msdn.microsoft.com/en- us/library/dd374047(v=vs.85).a...](https://msdn.microsoft.com/en- us/library/dd374047\(v=vs.85\).aspx)

</comment></comment></comment></comment><comment><USER15> Just a small nitpick, but #3 is not actually an isomorphic app, it's just a regular server-rendered one. Isomorphic typically means that the app is rendered in the same way (e.g. via React) on both the frontend and backend, and the frontend degrades gracefully when JS isn't enabled.

More on-topic: I just recently started a new web app using Rust on the backend. Though there is definitely a lot still missing, it's amazing how far the language and its ecosystem have come in the past year or so. I expect that within a couple years, Rust will be a viable alternative to Python and Ruby for backend web development.

<comment><USER16> > I expect that within a couple years, Rust will be a viable alternative to > Python and Ruby for backend web development

I like Rust, but I don't see this happening. Python, Ruby and PHP/Node.js languages became popular (and thus useful) because their learning curve is not steep - which is not something one can say about Rust. I consider myself capable developer but I struggled with many concepts. It's true that I didn't use it for a real project though, it might have been easier if I had clear goal in my mind.

<comment><USER15> That's true, and I don't mean to imply that I think it will replace Python/Ruby/etc. But I think Rust may find a sizeable niche as a high- performance, lower-level backend programming language for the web, sort of like Elixir. I've personally found the learning curve to be a lot smaller for web development than other projects because you don't have to learn everything at once; web development doesn't typically call for things like manual threading, so the borrow checker and other advanced features don't come up nearly as much or as early as they might for other codebases.

</comment></comment></comment><comment><USER17> It's cool that you can do this, but it's probably not something you want to do unless you have an unusual application. A reasonable application might be a heavily used API at the HTTP level, where the web-facing part is really a subroutine call interface, performance may be a big issue, and safety against bad parameters is a big issue.

</comment><comment><USER18> You are cool, and it's all is amazing work. I bet it was very interesting to implement. But reading comments I think people don't understand that it's just demonstration of how much Rust evolved, not a tutorial of what they should do to use Rust for the Web. Kind of overkill :)

</comment><comment><USER19> The 'Client-sode JS in Rust' part is a promising showcase for WebAssembly and I hope to see more languages compiling to WebAssembly soon. But looking closer at the code which does not a lot compared to its size I rather prefer the JS version.

<comment> ryan-allen I do believe big change is coming over the next few years, as we can develop reliable solutions on Web Assembly we're going to be able to use better languages.

It's going to be glorious!

</comment></comment><comment><USER20> This makes no mention of the size of these applications. Given the recent focus on shipping less JavaScript to the browser to better support mobile and slow networks, I wonder how feasible this project even is?

<comment><USER21> Well, that focus is if you are looking to market your apps in those markets. If your market has ubiquitous fast affordable internet, shipping more javascript is not that much of an issue, specially if it makes your web application faster and easier to run or develop or provides other benefits.

</comment></comment><comment><USER22> I can't help thinking something like Wt, but in Rust, would be an awfully handy way to write webapps.

</comment><comment><USER23> Nice blog! Do you have a RSS feed? Can't find any...

</comment><comment><USER24> This is all good and dandy but I don't like the webpage font-color! Can we have more of black on black so that it's even more modern and minimal? Or white-on-white which is more of a trend these days?

<comment><AUTHOR> ;(

<comment><USER24> Lol, I'm sorry it was a bit snarky! You've obviously done a great job but if anything the jab was not at you but at the trend...

</comment></comment></comment><comment><USER25> Rust is cool. But I don't think it's good for web backend at this time. I will try it when working with WebAssembly.

<comment><USER26> I don't understand why you are downvoted : that's absolutely true, Rust isn't quite the best choice for web backend ATM, by far.

It's way better than last summer though, rocket and the recently announced gotham framework look great, and I'm really excited to see how it evolves in the next few months.</comment></comment>


Wi-Fi Usage Drives AT&T to Raise Prices - <AUTHOR> http://www.lightreading.com/document.asp?doc_id=216754 <comment><USER2> I assumed they had just figured out a way to make a few extra bucks from each of the customers that will switch to them in droves next month when they release the iPhone 4S LTE and iPad3 LTE.</comment>


Road map to clean energy using laser beam ignition of boron-hydrogen fusion - <AUTHOR> https://www.cambridge.org/core/journals/laser-and-particle-beams/article/road-map-to-clean-energy-using-laser-beam-ignition-of-boronhydrogen-fusion/8BE057DC1BC9E0A588FB3ABAA993078C <comment><USER2> Reminds me of Bussard's Polywell, their website doesn't seem to have been updated since 2014 though [1]. Bussard also wanted to do proton-boron fusion due to the same advantages mentioned.

Edit: Apparently there has been progress, with a slideshow called "ready for commercialisation" presented this August by Jaeyoung Park [2][3].

[1] [http://www.emc2fusion.org/](http://www.emc2fusion.org/)

[2] [http://www.talk- polywell.org/bb/viewtopic.php?f=10&t=6072&st...](http://www.talk- polywell.org/bb/viewtopic.php?f=10&t=6072&start=270)

[3] [https://arpa-e.energy.gov/sites/default/files/5_PARK.pdf](https://arpa-e.energy.gov/sites/default/files/5_PARK.pdf)

<comment><USER3> The polywell at least has some sensible suggestions on how to capture the energy.

</comment></comment><comment><USER4> This is the process Tri-Alpha Energy [1] is working on.

[1] [https://en.m.wikipedia.org/wiki/Tri_Alpha_Energy,_Inc](https://en.m.wikipedia.org/wiki/Tri_Alpha_Energy,_Inc).

<comment><USER3> It's the same nuclear reaction, but I doubt tri alpha is doing laser ignition.

</comment></comment><comment><USER5> Here's another project that is working towards using boron-hydrogen fuel for nuclear fusion:

[https://lppfusion.com/](https://lppfusion.com/)

Brief description of how the device works:

[https://lppfusion.com/fusion-power/dpf-device/](https://lppfusion.com/fusion- power/dpf-device/)

To be clear, Dense Plasma Focus is the type of fusion device, and LPP Fusion is one of the teams researching them (there are others working with DPF devices).

The following quote should help in understanding why it's an important project:

[http://m.digitaljournal.com/tech-and- science/technology/star...](http://m.digitaljournal.com/tech-and- science/technology/startup-lpp-fusion-s-device-exploits-instabilities-to-fuse- atoms/article/503354)

""In the critical measure of how much energy out, we get per unit energy in, we're No. 2 among all the experiments in the world," Lerner says. "And we're only one-third behind the JET [Joint European Torus] experiment in the United Kingdom—which has almost a thousand times our resources. In terms of results per unit dollar, we're clearly No. 1, by a long way.""

They're running a crowdfunding campaign, if you're interested in investing in fusion energy:

[https://wefunder.com/lppfusion](https://wefunder.com/lppfusion)

</comment><comment><USER6> The main advantage of this fusion reaction is that it is aneutronic, i.e. it doesn't produce any neutrons, so it is relatively safe.

Petawatt class lasers are nowadays possible and several examples exists (Los Alamos, Oxford central laser facility, ELI Prague, South Korea). The technology used to compress photons energy in short length pulses is called "Chirped Pulse Amplification". This opened the way to femtosecond laser pulses.

</comment><comment><USER7> > 14 milligram HB11 can produce 300 kWh energy

That's an enormous amount of energy from a minuscule amount of mass. Using their predictions, I could run my house for a year on less than 1 gram of HB11.

How does this compare with the energy output of current-day fission reactors?

<comment><USER8> With mainstream present-day fission technology, it takes about 200 tonnes of natural mined uranium to fuel a 1000 MWe reactor for a year:

[http://www.world-nuclear.org/information-library/nuclear- fue...](http://www.world-nuclear.org/information-library/nuclear-fuel- cycle/introduction/nuclear-fuel-cycle-overview.aspx)

The same 300 kWh would then require about

(300 / (1000 * 24 * 365 * 1000)) * (200000000) = 6.85 grams of natural uranium.

Note that this is well below the theoretical energy density available from the fission of uranium. The main loss is because the naturally fissile isotope of uranium, U-235, is less than 1% of naturally occurring uranium. The much more common U-238 can be used completely in a breeder reactor, but there are currently only two operating breeder reactors in the world that generate electricity:

[https://en.wikipedia.org/wiki/BN-600_reactor](https://en.wikipedia.org/wiki/BN-600_reactor)

[https://en.wikipedia.org/wiki/BN-800_reactor](https://en.wikipedia.org/wiki/BN-800_reactor)

</comment></comment><comment><USER9> > 10 petawatts laser for one picosecond

> magnetic field plasma containment

> produces 300KWh

I'll admit, while I've always been interested in lasers, I'm definitely below amateur level with them, but these requirements:

1) seems like its multiple orders of magnitude higher power than anything I've heard of in laser tech. Like 5-7 orders of magnitude. Is there research I'm unaware of here?

2) let's assume for a second that the laser could be made, wouldn't it require multiple orders of magnitude more power (as in 2-3 at least) to fire than what this reaction produces?

3) have we been able to contain plasma (as in super high energy plasma, not the stuff you see in novelty shops or older TV sets) for very long in a magnetic field? I thought the record was in number of seconds, certainly not long enough to be used for any continuous power production.

Edit: Guess I was wrong on #1/2, had forgotten about this research[0] I'd read.

[0] [http://www.iflscience.com/technology/world-s-most- powerful-l...](http://www.iflscience.com/technology/world-s-most-powerful- laser-2000-trillion-watts-what-s-it/)

<comment><USER10> There are definitely petawatt class lasers currently (ex. the Texas petawatt). I think most are of order 100 fs.

<comment><USER9> Per the research I just did, 2PW has been done for one picosecond, 10PW is being built. Apparently because of the very very short pulse, the energy required is trivially small (as in less than a light bulb in your house for an hour)

</comment></comment></comment><comment><USER11> Why not apply plasmonic nanoparticles for electromagnetic field enhancement via nanofocusing?

(source: [http://iopscience.iop.org/article/10.7567/JJAP.55.08RG01/pdf](http://iopscience.iop.org/article/10.7567/JJAP.55.08RG01/pdf))

I've seen this paper floating around for a while but not many attempts at experimental validation.

<comment><USER12> I've had an ongoing conversion with a few other people about using electromagnetic metamaterials for field enhancement and focusing in a plasma channel. We had previously worked on optical metamaterials for chemical sensing, and the idea for plasma enhancement was for considering staging and filtering methods for plasma wakefield accelerators in order to generate enough GeV for free electron lasing. The same idea could be used for proton acceleration for fusion. Possibly a concern is heat generated in the material by an accelerated plasma may be incompatible with passive coloumb-mode filtering. We had considered a target might be something like a disposable cartridge similar to other laser fusion designs. A very clever result in wakefield staging (out of the research labs) involves using a VHS tape for sacrificial optical coupling. The 10PW 1ps laser described in the parent post is not practical and would require similar staging methods.

</comment></comment><comment><USER13> "14 milligram HB11 can produce 300 kWh energy" – I guess it means thermal energy, how much of it can be used for electricity? What do I need for producing this? How small can be such a power plant be or how big must it be to be viable?

Of course this could be all answered in the paper but it is a physics paper not a business or economics paper.

<comment><USER14> Their is a wide range of thermal efficiency but something ~30% to 64% is possible. We can also use the heat directly in some applications making it useful number on it's own.

Unfortunately making those pellets is fairly expensive an you only get 8$ or less worth of energy from them. Which is why the economics of this idea is simply terrible and the only value is for validation of H-bomb simulations.

<comment><USER15> Since most of the energy output of boron fusion is in fast-moving charged particles, you aren't necessarily restricted to a thermal cycle. Focus fusion, for example, gets a pulse of alphas in a tight beam, which they can just aim through a coil for electricity. Tri Alpha also has plans for direct conversion, but I don't know how theirs works.

</comment></comment></comment><comment><USER16> "...a few kiloteslas..."

This is a really cool paper and abstract. I had to giggle a bit at that line... I think the MRI machine I had images of of my knee was something like 6T?

</comment><comment><USER17> This asks for $35 to read the article, to save other non-academics the click.

<comment><USER18> [http://www.cambridge.org.https.sci- hub.tw/core/journals/lase...](http://www.cambridge.org.https.sci- hub.tw/core/journals/laser-and-particle-beams/article/road-map-to-clean- energy-using-laser-beam-ignition-of-boronhydrogen- fusion/8BE057DC1BC9E0A588FB3ABAA993078C)

</comment></comment><comment><USER19> Dr. Emmett Brown: 10 petawatts! 10 petawatts. Great Scott!

McFly: Wait - what the hell is a petawatt?

Sorry couldn't resist.

</comment><comment><USER20> And ten years from now, someone will submit something, maybe also from Cambridge, saying we're really, _really_ close to a breakthrough allowing clean fusion energy.

They've been saying _exactly this_ for longer than the 42 years I've been in this planet.

<comment><USER21> The problem with fusion was that until recently it was extremely expensive to build experimental facilities with necessary parameters for meaningful progress. Nobody was ready for that.

What happens recently is that due to technological improvement (powerful superconductive magnets, better simulations and faster controls) it is now possible to test things at regimes close to positive energy output on much smaller scales. So these days one can do useful investigation with 1e7 in funds, not 1e9. This is the reason for all various fusion startups.

Now, it does not mean that we are going to have fusion soon, but at least it is now only 20 years from any moment, not 40.

<comment><USER20> The line has _always_ been that fusion is twenty years away. In 2017, in 2007, in 1997, in 1987, and in 1977.

It will be the same line in 2027.

</comment></comment></comment><comment><USER22> Whenever I read about "ignition" my mind goes strait to weapons research. There is a blurred line between those looking wanting to use fusion for purposes of generating power, and those seeking to further nuclear weapons. 'Ignition' generally draws a good line between the two. For instance, the National Ignition Facility isn't doing reactor development. If I were the author, I'd reconsider the title to emphasize that it's focus is the generation of electrical power.

<comment><USER23> The title already says "road map to clean energy" \- how much clearer does it need to get?

Besides _ignition_ is a well understood scientific word and nuclear fusion isn't useful for weapons.

<comment><USER24> Fusion is used for boosting, boosting is needed for miniaturization. In the absence of explosive testing I believe a facility like NIF is useful for weapons.

<comment><USER22> Boosting is something that can be done in all sizes of weapons. It just means adding some hydrogen into the primary fission device, as simple as filling the otherwise hollow pit/core. When you read about "dial a yield" technology, that is about adding or removing the boosting hydrogen from the primary. Vent it off and you get a lower yield.</comment></comment></comment></comment>


Is desktop software dead? - <AUTHOR> http://successfulsoftware.net/2013/10/28/is-desktop-software-dead/

<comment><USER2> > Web advantage 4: Distributed architecture > If you are writing web apps, you > get a distributed architecture for free. No need to do socket programming.

I wouldn't call it free, but it can shift the difficulties.

Also, as long as local disk access is noticeably faster than what your servers can deliver data-"intensive" applications will have a place on the desktop, especially if the data would have to be uploaded first. Those that people might want to use on the road will take even longer.

On the other hand, I'm often surprised how bloaty and slow many desktop apps feel. Stuff that runs without HTTP calls in the browser (or over a fast connection) often is just as fast.

Funnily enough, I think some of the slowness comes from developers trying to be nice and resource-efficient, whereas as user I would want a "YOU are the main application now, use as much as you need to work as fast as possible"-button sometimes.</comment>


NaCl: DJB's new crypto library - <AUTHOR> http://rdist.root.org/2009/07/14/nacl-djbs-new-crypto-library/ <comment><USER2> _It's nearly impossible to prevent side channel attacks when your crypto is implemented in a high-level language._

AMEN!

I've been trying to make this point to people for years, but it has been hard to get anyone to listen -- it's good to have someone else singing from the same songbook.

<comment><USER3> So how is C immune from this? You don't control the actual codegen anymore, and that can even be at runtime now. (Different codepaths for different invocations of the same function, potentially leaking information via timing.)

<comment><USER4> There's a lot of answers for this, but a simple one is that C gives you (much more) control over the memory hierarchy. A carefully written C program can, for instance, keep things most in or out of cache. High-level languages also abstract bignum math, which in number-theoretic crypto is a source of timing channels.

<comment><USER5> Yes, the conventional wisdom is that C is less secure than high-level languages. If you're talking memory management, that's correct. DJB does nothing but stack variables for NaCl to avoid performance and potential for memory leaks.

But for side channels, C is almost too high level. For example, it takes assembly code (cpuid) to figure out cache configuration. Even worse, a language like Java or python gives you no control over the memory layout of the key in RAM.

So the right combo in my opinion is a carefully tuned C implementation (possibly with a little assembly or compile-time tweaking). Then add your language bindings to call it from a HLL.

<comment><USER4> Of course, NaCl isn't written in C; it's written in a combination of C and dynamically-generated assembly (Bernstein wrote his own macro assembler/"high level assembler", qhasm).

</comment></comment></comment></comment></comment><comment><USER6> It still sounds like Keyczar is the way to go among current available libraries, despite its now multiple discovered exploits (which have presumably been fixed by the time they were disclosed).

Regardless of what feature set and implementation is ready for primetime today, I have a question for security folks: Wouldn't it make sense for "the rest of us" (those of us who do not understand crypto beyond a basic comprehension the types and how to use them from a high level) just to pick the most popular crypto library (and backed by a major corporation that has a very strong vested interest in security that works)? Age seems to have merit, as well. We're using OpenSSL, plus Perl bindings, and GPG for our various crypto needs in our products, but if we were doing something fancy, beyond https and encrypting billing data with a public gpg key, what would be the safe choice at this point in time?

<comment><USER4> The problem with your second graf is that Nate isn't just talking about library implementation bugs. He's saying that the interfaces to some of these libraries are insecure. For instance, you're using OpenSSL; OpenSSL's crypto primitives do essentially nothing to protect you from a host of implementation failures, from failing to properly MAC your messages to leaking error information to checking parameters.

Keyczar and OpenSSL are not only not on the same playing field, they aren't playing the same sport. Keyczar is saying, "you want to do crypto, you're not a cryptographer, so we'll make all the hard decisions for you and give you a programmer-proof interface". OpenSSL is saying "here are the control rods, try not to blow the reactor up".

As for your first graf, I think it's a bit strange to take a post where a noted, respected expert on crypto is telling you not to use Keyczar, and extract from that the comment that Keyczar seems like the way to go. If Nate says not to use Keyczar, my advice is that picking it right now might be a professional embarassment in the coming year.

<comment><USER6> _As for your first graf, I think it's a bit strange to take a post where a noted, respected expert on crypto is telling you not to use Keyczar, and extract from that the comment that Keyczar seems like the way to go. If Nate says not to use Keyczar, my advice is that picking it right now might be a professional embarassment in the coming year._

I read his comments as being "there is nothing good; here's why all of these things suck, but I grudgingly guess Keyczar works for some people". The only alternatives under discussion are cryptlib, which only has C bindings currently, and djb's new thing which uses brand new (well, four year old) ciphers that nobody other than djb really understands or knows to be secure. Given that Keyczar has some major corporate backing, _and_ a reasonable level of community support, it seems a pretty solid choice...despite its imperfections. djb's thing _might_ be an awesome choice...but we don't know and I'm definitely not qualified to figure it out.

Again, I'm just some guy, you know? I don't understand the nuances of security very well, but I read what I can and try to make some sense out of the kinds of answers security experts provide (which, for some reason, always seem to be qualified into being no-op statements; I guess because committing to recommending something means you can be proven wrong later when that recommendation proves insecure).

So, my reading comprehension I guess is as weak as my crypto knowledge, since I came away thinking, "Well, there's nothing good to use. But maybe Keyczar or cryptlib is better than what we're doing now; djb's might be awesome in the future. cryptlib has an annoying deployment aspect and would require me to write bindings that would probably be insecure, so Keyczar seems maybe the best of a bad lot."

<comment><USER7> djb's little creation needs more cooking, that much is for certain. Brand new all but unreviewed ECDH, stream and hash functions. The hash isn't even in the SHA-2 competition. It doesn't matter who djb thinks he is, using this library in its current form is _irresponsible_.

<comment><USER4> Salsa20 is an ECRYPT eSTREAM Phase 4 cipher, tied with Rabbit for the #1 software stream cipher. eSTREAM is to stream ciphers what what the AES competition was to block ciphers. The eSTREAM committee included Bart Preneel, Vincent Rijmen, and Matt Robshaw. If the thing you're reacting to is that NaCl doesn't use AES, note that the peer review Salsa20 got was _substantial_.

Elliptic Curve Diffie-Hellman (ECDH) isn't "all but unreviewed". ECDH is a NIST standard. Curve25519 is just an implementation of ECDH over a set of parameters that admits to especially fast implementation.

The hash function in NaCl is SHA-512.

Poly1305 isn't a hash function. It's a polynomial MAC, similar to what's used in the NIST standard GCM. If that's what you were referring to as "the hash function that isn't even in the SHA-2 competition", note that none of the NIST authenticated encryption modes use (comparatively slow) generic hash function constructions like HMAC, and none of the MAC functions they do use (OMAC, CBC- MAC, GCM's poly eval) have been entered, like apples, into SHA-2's orange competition.

I don't know who you think Daniel J. Bernstein is, but the short answer is: extremely reputable cryptographic researcher.

The sad thing is, your core argument --- that it would be "safer" to use NaCl using the NIST curves and AES --- is valid, and would have been informative if you hadn't chosen to phrase it in such a dismissive way. As it stands, I'm left thinking you don't know what you're talking about and just stumbled on this critique, particularly as your professional background contains basically no crypto or security.

Either way, you are almost certainly better off using NaCl with DJB's bespoke algorithms than you are trying to patch AES, HMAC-256, and RSA together using OpenSSL. We break actual peer-reviewed cryptographic algorithms in the field during penetration tests basically never. We break homebrew AES and RSA constructions about once a month.

<comment><USER5> What I was trying to get across in my post is that there is no easy answer currently. cryptlib may be best if you are ok with the license. Keyczar is a good start, but it needs more time to be fully-baked. GPGME is a bit clunky and C-only. I have no clear recommendation, and that sucks.

Hopefully people will rally around these. Cryptographers to review these libraries and NaCl. Developers to add the HLL bindings. Note that NaCl has a high-level API, so the HLL binding may just be SWIG + wrapper to convert length-counted byte buffers into the appropriate sequence type.

</comment></comment></comment></comment></comment></comment><comment><USER8> I'm not well-versed in crypto libraries, but is there any reason not to use OpenSSL? That's where I turned when I needed a SHA256 implementation (for a C program), and it worked like a charm. Didn't seem too convoluted to use, either. It has been around long enough that just about every platform has it packaged and ready to use, and dynamically linking against it worked fine everywhere I cared to try.

<comment><USER7> OpenSSL has a history of major security bugs. I haven't seen any filed against it recently, and it is widely used, but it gives people the heebie-jeebies, sort of like BIND does. If memory serves it also is a little inflexible if you want to do something a little unconventional.

Now, that said, there are certainly sound engineering reasons to continue to use OpenSSL, and in no way should you use any other library that has not seen extensive, extensive security review in its place. NaCl is certainly included there.

<comment><USER9> Both OpenSSL and BIND have the unenviable position of being the _defaults_ , and thus get banged on constantly and frequently get integrated poorly.

OTOH I think the comparison to BIND is a bit inapt, as OpenSSL was never historically the pile of poorly-architected shit that BIND was.

<comment><USER4> If OpenSSL has the kinds of blatant implementation errors that Graham is alluding to (e.g. memcpy memory corruption problems in ASN.1 parses and padding checks), we all have bigger problems than whether he's right about it being a crappy library. A huge number of critically important systems depend on it.

I don't love OpenSSL's code --- it's a mess with a zillion different authors and styles --- but the bar for finding horrible problems in it is quite high. The position of being the oft-banged-upon default isn't necessarily unenviable; in OpenSSL's case, it means a lot of crap has been shaken out.

The comparison to BIND is superficial; BIND's problems are architectural, OpenSSL's problems stem from it dating back to Eric Young's code, which predates integer overflows and hails from a time when we thought you could mitigate a buffer overflow by malloc'ing instead of allocating on the stack.

Don't use OpenSSL --- it's the wrong level abstraction for lay coders --- but yes, don't bash it for the wrong reasons.

<comment><USER7> Conceded that technically OpenSSL is much better off than BIND ever was. When I was a lay-sysadmin many years ago, I ran BIND because what else was there? but always in the back of my head was the possibility that someone found Yet Another Hole in BIND. I'm not nearly as concerned about the implementation quality of OpenSSL _today_ ; it's been long enough it's probably okay (but at the wrong level of abstraction). But it historically had enough issues to show up on my warning radar as a lay sysadmin, and that meant that I never really trusted it afterward.

Could be complete paranoia at this point.

</comment></comment></comment></comment></comment><comment><USER10> Just in case someone is rusty on their chemistry:

NaCl == Sodium Chloride == Salt

<http://en.wikipedia.org/wiki/Salt_(cryptography)>

<comment><USER4> I think it's unlikely that the name is based on password hash salts. That term occurs only very rarely in the cryptographic literature.

<comment><USER11> True, but there is still a namespace conflict within the security world. Google's Native Client (<http://code.google.com/p/nativeclient/>) is called NaCl by the developers, and more and more externally as well :P

<comment><USER3> There is also a Common Lisp implementation called NaCL:

<http://www.cliki.net/NaCL>

</comment></comment></comment></comment><comment><USER12> This looks like a really killer library. I like the ease of use as well. Now we need Ruby bindings.</comment>


Founders – how do you identify and listen to your potential users/communities? - <AUTHOR> Trying to apply the "don't build hoping for interest" motto. Before conducting user interviews (via Mom tests), I wanted to start listening to specific communities online. How do you do that yourself? <comment><USER2> I've been a part of the communities (develop) for a long time and later started a business once I deeply understood (enough, years) the hardest problems we face

<comment><AUTHOR> I see - you ended up crafting for your own community. What if you are not part of the community yet and you want to join one, how would you do?

<comment><USER2> I'd join a community primarily because I'm interested in the same thing, not because I want to find somewhere to sell / market research. Most communities will reject you for too much business unless it's a part of who they are or you've been around long enough to know how this is normal done and received.

I would not say I crafted a community (trying to do that now actually). More that I'm a developer and we hang out in certain places, and that I simply hung out</comment></comment></comment>


Ask HN: Why Docker in Addition to Ansible onto VMs? - <AUTHOR> (In this discussion, I'm going to say "Ansible" a lot, but what I really mean by that is "your favourite deployment and configuration tool". I just use Ansible as an example of the broader category.)
To begin with, I'll clarify what I think is the sort of scenario where this question becomes relevant. If I have to run a bunch of services, some continuously, and others as cron jobs, I imagine my options are to either
a) Deploy them onto separate virtual machines using Ansible, or
b) Create Docker images of them, which I then deploy onto a machine, again using Ansible.
I can't imagine a scenario where it would not be useful to know Ansible. This is where I feel the primary cost of Docker is incurred: it is an additional layer of abstraction that has to be learned, taught to new admins, troubleshot, and kept in sync. Troubleshooting any Unix system including a VM is the same, but a Docker container has to be troubleshot differently.
----
Due to the submission character count limit, I have submitted the most common arguments I have heard in a comment. Please read that first.
-----
In summary, this is my picture of the situation:
- Docker cannot replace regular configuration management tools like Ansible. Docker, being an additional layer of abstraction, comes at a maintenance cost.
- Performance is not enough of a reason to offset the maintenance cost.
- File system management is not enough of a reason to offset the maintenance cost.
- Upgrade handling is not enough of a reason to offset the maintenance cost.
I get the sense that it's a wash, and the deciding factor is whether you are more experienced with Docker administration or Unix administration.
But there are very experienced Unix sysadmins who have switched to Docker and never looked back. I just haven't heard a satisfying explanation as to why.
It'd make my day if any of you guys could do that. Thanks! <comment><AUTHOR> So some reasons people bring up for using Docker:

" _A full virtualized system gets its own set of resources allocated to it, and does minimal sharing. You get more isolation, but it is much heavier (requires more resources)._ "

Is that really true? The few recent-ish comparisons I find between Docker and VMs indicate that services running under both perform comparably, thanks to modern advances in hardware-assisted virtualisation. (I also get the sense that people frequently use Docker on top of virtual machines.)

But _if_ VMs do not use resources efficiently for your purposes, you can use the exact same Ansible scripts you installed the VM with to install your services onto a dedicated physical machine instead. No need to change anything.

" _AuFS is a layered file system, so you can have a read only part and a write part which are merged together. One could have the common parts of the operating system as read only (and shared amongst all of your containers) and then give each container its own mount for writing._ "

Am I misunderstanding something if I think this is exactly how regular mount works? It's literally a layering of disks (or disk images.)

If you mount / as read-only (which is not a bad idea in general either) then you can have multiple virtual machines sharing the same base disk image.

" _Regarding consistency, Docker images are immutable. It should be self- evident that it is easier to maintain something that does not change. Your config won 't suddenly break because the OS updated itself._"

Sure, freezing software in points of time is very easy to deal with. But what about security updates? If you are going to do updates anyway, you still have to have workflows in place to deal with changing images.

I'd also argue that if your config breaks all the time for OS update reasons, you should probably consider running a different OS in your production environment.

" _the following is a speed comparison of start and stop times for the two different technologies:_ "

Yes, I recognise that Virtual Machines can take up to several minutes to provision, while Docker containers can be spun up in seconds. I do see how Docker is a huge deal if, at the core of your problem domain, you find "needing to spin up new instances of services in seconds but no ability to run hot spares". That sounds like a very limited domain, though.</comment>


Amazon launches shopping via Twitter - <AUTHOR> http://www.bbc.com/news/technology-27289401

<comment><USER2> I... guess this is the obvious next step. All we need now is "one click purchasing" for twitter, where you can just send a single tweet, and then lie back and have the product delivered straight to your doorstep. That's the next step from here, and I'm sure Amazon is working on it.</comment>


Show HN: Kubesail.com – one-click free-tier kubernetes hosting - <AUTHOR> https://kubesail.com <comment><USER2> Nice service! +1

>Error from server (Forbidden): configmaps is forbidden: User "system:serviceaccount:pascalgn:pascalgn-user" cannot list resource "configmaps" in API group "" in the namespace "pascalgn"

Is that intended? Because I can get secrets, but not configmaps

Also, currently (?) there is no way to create services, so for now we can create Pods, but they cannot serve any data (or I did something wrong)

<comment><AUTHOR> Yes! Config maps are coming very soon, just doing a bit of testing to ensure they're safely isolated. This is the next feature we'll add for sure!

As for services, that gets tricky due to our shared cluster design, and for now services can only be created thru the interface. Were working on tools that show users what their service yaml ought to be, but we're mostly focusing on demoing and educating users about the Deployment object. Via the interface you can expose an HTTP service (and we'll handle HTTPS termination), and TCP <-> internet is coming soon!

Thanks for giving it a test run!!

</comment></comment><comment><USER3> It should be noted that the free tier is 256mb of RAM and 0.02 cores.

Tiny, but still pretty cool it's free.

<comment><AUTHOR> We figured it's better to start small and increase the limits as we can, rather than have to back-peddle and decrease them, but for most "demo" applications this limit gets you pretty far. Also, we don't document it (we should and will!) but the CPU can burst, so you're not strictly limited to 0.02 cores, that's just what you would be limited to assuming 100% utilization on our end, which shouldn't occur do to our cluster auto-scaling.</comment></comment>


Ask HN: Are we in a Bubble? - <AUTHOR>

<comment><USER2> This topic is discussed here every single bubbly day</comment>


We're not taking enough lunch breaks, and why that's bad for business - <AUTHOR> http://www.npr.org/blogs/thesalt/2015/03/05/390726886/were-not-taking-enough-lunch-breaks-why-thats-bad-for-business

<comment><USER2> I noticed a lot of younger people at my office tend to eat lunch at their desk and watch netflix ,youtube or hulu on their phones. I suspect that there is generational gap at play here as well.</comment>


Frank Chimero on losing control of creative works - <AUTHOR> http://dcurt.is/frank-chimero-on-losing-control

<comment><USER2> Flagged. Those blooming circles are the blink tags of 2012.</comment>


Review my startup: sanetax.com - A real Tax Professional prepares your taxes - <AUTHOR> http://sanetax.com

<comment><USER3> The value proposition is extremely compelling (especially for someone like me who is still procrastinating filing...). Take a picture and have a professional do the work?! Yes, please.

That being said, I need to know more before committing. Who are these professionals? How much will it cost me? Am I guaranteed the max allowable refund? I applaud you for bringing simplicity to a field as complicated as taxes, but the devil is still in the details.

Overall looks great though! Let me know if I can help test at all, emails in my profile.

<comment><AUTHOR> Thanks for the feedback.

Yes most of the last few months I have spent on is getting tax agents to sign up.

. Tax Agents currently using the Sanetax are independent tax professionals and EAs(Enrolled agents). Some have 14yrs of experience in the industry.

. Depending on how complicated your tax filing tax agents tend to charge anywhere from $40 to $200. Again, this is between tax agent and customer to agree upfront.

. As a customer you can talk to them and feel comfortable before agreeing to go forward - just like what you would do for any purchase. At any stage, customer can back off from the agent if he/she is not satisfied. We can assign a new agent.

<comment><USER4> You might want to pitch some distilled form of this summary on your page.

It's also the first question that popped into my head when I looked at your site (which otherwise, is pretty good).

<comment><AUTHOR> Thanks. I will have that included on the site.

</comment></comment></comment></comment><comment><USER5> SaneTax is a good idea, yes. But remote accountants do exist.

I have an accountant who handles everything remotely. I live in Los Angeles and he lives in small-town, Nebraska. I met him once when he did a tour of the country to meet clients and drum up new business.

Here's my process:

1) I download a PDF worksheet from his website.

2) I scan all my documents and fill out the worksheet.

3) I send it over https to his LeapFile account.

4) We talk on the phone for a few minutes. He asks a few questions to make sure we're "on the same page."

5) He e-files for me.

6) If I have a refund coming, I get it direct deposited. If not, then I pay with EFTPS and CA web pay.

If I want tax advice, I can ask him. If I want to start a business, he can help out. If I get audited, he can defend me. All without me being there.

Another nice project would be to make a directory of accountants who can handle the whole tax process remotely.

<comment><USER4> Your accountant sounds great. Now how would I have known about him?

SaneTax aims to be this marketplace between tax preparers and accountants. It's a good model.

Now, the question that I have is, how are the accountants verified and how do I know I (as a preparer) am dealing with someone I can trust?

<comment><USER5> _Now how would I have known about him?_

Right. That's why I said, _another nice project would be to make a directory of accountants who can handle the whole tax process remotely._

But maybe there's no business model in that. Enter SaneTax.

<comment><AUTHOR> Eventually, we will open up the tax professional directory. So that you as a customer can choose your own agent. We already have the code in place for it.

<comment><USER4> I'd recommend looking at how ServiceMagic does it. They choose and list 3 professionals (which are chosen by area, which adds an artificial funnel to a natural one). If I want more, I can request more, but often 3 is just right to compare prices/rates and professional knowledge/fit.

I would strongly recommend this approach if you aren't already doing it (have yet to sign up).

</comment></comment></comment></comment></comment><comment><USER6> Couple more thoughts:

1\. The first thing a user does should not be to register. I should at least be able to see how many tax preparers are in my area and their profiles before registering. Do the preparers have a linkedin or yelp page with endorsements? Is there someone in my FB network that has used this person or liked their services? Nothing compels me to enroll.

2\. I think the key to all this is helping tax preparers find new customers by leveraging their existing customer base. Tax prep is a word of mouth business and your goal should be to digitize the word of mouth to maximize reach of potential new customers. For example, make it easy for customers to endorse tax preparers by "liking" their sanetax profile,etc.

Your sales pitch needs to be: "By using SaneTax, you can leverage your existing customer's social network to find new customers." or something like that.

<comment><AUTHOR> We already have #1 implemented in the code, just that we haven't enabled it. We will be adding this once we have considerable number of tax agents on the system.

I was solving my own problem with running around the tax professional. Thanks for the pitch.

</comment></comment><comment><USER7> As an accountant and tax lawyer who works 100% remotely with clients, I'd like to chime in. I definitely think that there is a place for a service that can help people find accountants and lawyers. The average person has no way of knowing how to choose -- what makes a good preparer/counselor? How much should they cost? How available should they be? This is the obvious part of what could make Sanetax very helpful.

The less obvious part to folks who aren't in the "industry" is that accountants and lawyers really struggle with technology issues. Technology is not their primary skill and yet tax preparation has become very tech intensive. Add to this all the issues around privacy. There aren't any good solutions that have been widely adopted in these communities for handling confidential material online--i.e. your social security number.

Speaking for myself, I use Magic Vortex where I can for file transfer, but have only recently transitioned to using encrypted pdf's in emails and have had considerable problems with client confusion with the files. I cannot imagine the extra technical support that I might have to provide while trying to use encrypted email, even though it's totally warranted. Perhaps Sanetax can help with these issues.

I would also like to strongly agree fully with fourply's post. The entire industry is not as simple as it might appear from the outside. Like most things we live with these days, regulations are multiplying even as we speak, and they vary widely from state to state. Accountants and lawyers have to meet restrictive federal and state regulations, including around how we get clients in the first place. Hopefully Sanetax will find ways to work with all these rules.

<comment><AUTHOR> Thanks for comments.

Yes it is so true about how inconvenient it is with the whole pdf encryption and complicated technology in general. Speaking of attachments, we are also the makers of <http://www.getdropandlock.com> \- which did fine but still lot of inconvenience with remembering passwords and everything.

If you attended IRS Live March 30th session, it was clear from the session that we are going to get more regulations. However, we also expect regulations should improve IRS efforts in protecting consumers.

With the Sanetax, we would like to fix the convenience part of taking an expert's advice in taxes.

</comment></comment><comment><USER8> as a tax attorney and someone with 4 years experience as a volunteer at an IRS VITA site, i am not sure that i'm entirely comfortable with the idea - <USER2> maybe i am missing something.

first of all, there are preparer regulations that require - well, lots of things. this system could run afoul of those quickly and easily.

secondly, the interview process is crucial for me. it can be driven by a form, but it's extremely important to talk with folks about what happened during the taxable year to identify not only potential pitfalls and ensure that everything gets the right treatment, but also to talk about planning opportunities that can save them big $$$ down the road.

for people that are foolish enough to go to H & R Block anyway, maybe this would be a valuable thing - but it's not a cookie-cutter process and treating it as such can result in serious fines and/or jail time for taxpayers and preparers.

my thoughts: make sure you find yourself a tax law badass to make sure you're doing things right. it will be complicated, and costly - but if you don't get it right out of the gate it's not even worth doing.

<comment><USER5> Could you expand on or quickly summarize why going to H&R Block is foolish?

(I don't use them. Just curious).

<comment><USER8> They hire folks with no education or experience, train them for a week, and turn them loose - generally paying $9/hr plus a percentage of fees they generate. The majority of their business comes from taking advantage of poor people - they prepare a return that takes me 6-9 minutes, offer a 'refund anticipation loan' that gets people instant gratification, and charge them $200-$400. Eff everything about that. I am thrilled to see the RAL on the way out and look for VITA sites to become much more heavily utilized soon!

</comment></comment></comment><comment><USER9> I think a major value proposition you could offer (eventually) is ratings of tax professionals. More than just rating though. For example, if someone owns several rental properties, certain Tax Preparers specialize in that, whereas most would be out of their element. So a Tagging system might come in handy. You could tag your return with "Real Estate", or "Home office", or "Moved several times", etc. Perhaps, if sanetax has access to the completed returns, this tagging could be automated. Even if not automated, you can easily restrict the tagging/voting to people who actually used the Tax Preparer, thereby mitigating the problem of fake reviews.

The end result is real, reliable information about which Tax Preparers specialize in what I need. That would be awesome.

<comment><AUTHOR> Great suggestion. We will open up the directory once considerable number of agents are part of the network. We should add specialties part of the individual tax agent page/blurb. We could automate the whole rating system as well.

</comment></comment><comment><USER10> Is anybody aware of a similar service for finding (traffic) lawyers? Searching for such is unpleasant (especially in a different locality).

Edit: I've now signed up to the service, as I've procrastinated equally with my taxes, however- I still don't know what to do. I appreciate the goal is to match taxed/preparer, but I'm not sure what forms are appropriate, which makes uploading them difficult.

I see there is a progress indicator to communicate how far along the preparer is with the submitted paperwork, maybe a similar guide for what to submit, and what might be missing? (Also possibly augmented by the preparer if the site doesn't want to become a guide?)

<comment><AUTHOR> Great! Our support person should have sent you an email. If you haven't received an email from us feel free to send a message to srini -at- sanetax.com

</comment></comment><comment><USER11> I signed up, and was expecting a very different workflow.

IMO, asking me to upload my tax documents without having chosen a tax professional feels backwards. I want to know who is going to be looking at my tax documents. The way things work now, it feels like I'm sending my docs up for bidding. I'm sure that's not what is going on, but that's the perception.

Perhaps some general questions up front to help properly route the customer to the right tax professional, then allow for a match, and then finally, once the customer is paired with a tax professional, present the rest of the features.

<comment><AUTHOR> Yea, please don't upload until tax agent is finalized and you feel good to go.

Coding point of view, we should have created a wizard kinda flow. Will fix it in next revision. Thanks.

</comment></comment><comment><USER12> I like the concept, but the domain is a bet iffy. I read it as "sanitax", which might be misconstrued. Other than than, I like the idea. I would use an actual tax preparer if it wasn't for calling and/or driving.

<comment><AUTHOR> :) Supposed to be "sane tax" - Bringing back sanity in taxes. Signup as a customer or send an email(email in profile) if you like to discuss.

<comment><USER13> Just as a data point, I think it sounds like a feminine hygiene or household cleaning product.

</comment></comment></comment><comment><USER14> Is this service for the 85-90% of people who have simple returns consisting of a W-2, a few 1099s, and a 1098? My question is how it'll handle issues like multi-state tax returns, oodles of K-1s, and tracking the basis for those, and figuring out stuff like foreign tax credits? Would the designated Preparer know to ask such questions and wholly handle everything on their end?

(I'm guessing that for those complex issues, you'd still stick to a live accountant, and this service isn't geared towards that particular segment of the population.)

<comment><AUTHOR> Thanks for the comment.

There are two models a customer can use.

1\. Stick with your existing tax professional:

Ask your tax professional to signup as an agent. Free for him/her and then you can work with them through the app. For their own customers, agents can start using the service immediately.

2\. Let us assign a tax agent:

Tell us more about your requirements, we can assign agents who is suitable for you.

All agents are mandated to list their PTIN number and phone numbers so that you can call and talk to them.

So anytime, if you are not satisfied, we can drop you from the customer list of a particular tax professional.

Hope above answered your concerns.

</comment></comment><comment><USER4> I can see why tax professionals could be threatened/worried by this.

Effectively someone like myself living in a state with a high Cost of living can outsource to someone in say, IL (who may have CA tax knowledge but now lives elswhere) who would charge much less than the CA-based local accountant.

It's also a killer business plan for the marketplace vendor (ie, SaneTax). Who would have known that Amazon could have become such a giant by selling _books online_?

<comment><AUTHOR> Thanks a lot for kind words. Well, we think that we are a great asset to tax professionals. They can use SaneTax as the CRM/support service and improve the customer satisfaction and get new customers.

</comment></comment><comment><USER15> Is this only for personal taxes, or can my very simple corporation benefit from this? Right now I have an accountant in my home state handling my corporate taxes, but he's not very internet-savvy so things like secure file transfers and even timely email replies are beyond him. I'm looking for a remote accountant for my state that can handle my very simple corporate return --but it looks like Sanetax is only for personal returns? Please correct me if I'm wrong.

<comment><AUTHOR> Sure. You can use Sanetax for any type of tax situation. You can request your agent to signup <https://app.sanetax.com/agentsignup>.

If he can use email, he should be able to use <http://sanetax.com> without any problems.

If you share your state, I can see if any one of our existing tax agents can help you out.

<comment><USER15> My corporation is based in IL. Ideally I'm looking to simply change agents, as while mine is competent, he's expensive and not good at remoting. I work exclusively from remote locations so it's essential that my accountant be comfortable with that. How would I go about getting a price quote for a basic S-Corp return in IL via Sanetax?

<comment><AUTHOR> Can you email your contact info srini -at- sanetax.com

If you are already signed up at sanetax.com our support person should be contacting you soon.

</comment></comment></comment></comment><comment><USER6> Have you looked at Snap Tax? <http://turbotax.intuit.com/snaptax/mobile>

If I'm doing a simple filing, what is the value proposition of paying $100s for a tax professional using sanetax when I can use snaptax for $20 and submit right on my phone?

<comment><AUTHOR> Great question. We get this many times.

Two things: 1\. Who does the taxes? With snaptax, you still have to file your own taxes. Go through the questionnaire, go through the numbers and select right options.

With sanetax, you are letting an expert handle your taxes. Regardless how simple or how complicated are your taxes.

2\. Expenses: With sanetax if you have simple returns, I have seen agents charging the customer $40. With snaptax, you need to spend both ~$20 and your time to complete taxes.

</comment></comment><comment><USER16> Typo in the first Agent FAQ: "How can Sanetax help my bussiness?"

<http://sanetax.com/faqsagents.html>

<comment><AUTHOR> Thanks. Fixed.

</comment></comment><comment><USER17> The "Take a picture, upload, tax agent files your returns" sold me. Too bad I already filed my taxes.

<comment><AUTHOR> Well may be your friends or next year :)

</comment></comment><comment><USER18> I got Access Restricted page What is mean exactly? Yes, I can fill captcha for access but page dont looks friendly, specially I sure that my machine clean from viruses.

</comment><comment><AUTHOR> Sanetax is a service where a real Tax Professional prepares your taxes with the convenience of online interaction.

</comment><comment><USER19> Kudos to sanetax, but my earnest hope is that tax reform will abolish the use case for such a service.

</comment><comment><USER20> I love it. Time to disrupt the status quo.</comment>