The Sad State of HTML Email Input Fields and IDNs - mike-cardwell https://grepular.com/The_Sad_State_of_HTML_Email_Input_Fields_and_IDNs <comment><AUTHOR> This reminds me of another HTML input type that's really poorly implemented across browsers. Namely, date and time input fields.

In that case, it varies so much across browsers to be almost unusable. Some (like Firefox) don't seem to support the calendar aspect, some have a terrible calendar UI, some fallback to the device calendar UI, some let you select invalid dates despite greying them out and that's before you get to the actual data, how it's formatted or the lack of any events associated with the fields.

Honestly, it seems like today's browsers just can't seem to handle any of the newer input types in any reasonable way.

<comment><USER2> Not only date/datetime/time fields are broken. Also type=number does not work consistently across different locales and different browsers. Some don't let you type decimal comma.

<comment><USER3> Is a "decimal comma" a thausands separator, or is it a decimal-point for locales where that is expressed by a comma?

<comment><USER4> I'm not sure this is universal, but locales which use a period for a thousands separator use a comma as a decimal point, and vice-versa.

<comment><USER5> It's not universal, that wouldn't be complicated enough!

</comment></comment></comment></comment></comment><comment><USER6> The article points at the regexp but fails to point at what the standard says about how that's supposed to be used.

[https://www.w3.org/TR/html5/forms.html#e-mail- state-(type=em...](https://www.w3.org/TR/html5/forms.html#e-mail- state-\(type=email\))

        User agents may transform the value for display
        and editing; in particular, user agents should
        convert punycode in the value to IDN in the
        display and vice versa.

ie you're supposed to be able to type human-readable addresses but they're converted to punycode for submission, because that's what the server will need in order to use the address. The regexp is used to validate the punycode _not what the user types_.

Which isn't to say this isn't a thorny problem; more discussion of the issue here [https://www.w3.org/Bugs/Public/show_bug.cgi?id=15489](https://www.w3.org/Bugs/Public/show_bug.cgi?id=15489)

<comment> mike-cardwell "they're converted to punycode for submission, because that's what the server will need in order to use the address"

I disagree with that. Neither the client nor the server need to know anything about punycode. The only time punycode is required is at the very last moment when it comes time to actually send an email to that address. Whether it's the email sending library or the mail server it's self, it doesn't matter.

A user should be able to type "person@ü.example.com" into a form. I should receive "person@ü.example.com" on the server side. I should save "person@ü.example.com" to the database. I should be able to send "person@ü.example.com" back to the browser for display, and I should be able to pass "person@ü.example.com" as the To address to my mail sending library.

Punycode is an implementation detail that I shouldn't need to think about.

<comment><USER6> That's a perfectly reasonable objection, and answered to an extent over here [https://www.w3.org/Bugs/Public/show_bug.cgi?id=15489#c18](https://www.w3.org/Bugs/Public/show_bug.cgi?id=15489#c18) tl;dr: "backwards compatibility"

I'd also agree that my code should be able to handle unicode, for a different reason: I never trust validation by a browser (old clients, bad clients, malicious clients)

</comment></comment></comment><comment><USER7> It's much worse than that. This doesn't even cover the rules for domain names, which are mapped to a subset of Unicode. Read the horrors of "Unicode IDNA Compatibility Processing".[1] This is an incredibly complicated scheme to deal with homoglyphs - characters which look the same, but are not. There's filtering for specific characters that look the same. There's detection of mixed left-to-right and right-to-left characters. This is all to prevent attacks where the domain name in a link looks like some trusted site, but isn't.

The "." in a domain name is no longer always a period. It can be any of

        U+002E ( . ) FULL STOP
        U+FF0E ( . ) FULLWIDTH FULL STOP
        U+3002 ( 。 ) IDEOGRAPHIC FULL STOP
        U+FF61 ( 。 ) HALFWIDTH IDEOGRAPHIC FULL STOP

Validating an email address is quite hard if done right.

[1] [http://www.unicode.org/reports/tr46/](http://www.unicode.org/reports/tr46/)

</comment><comment><USER8> This is why we badly need an alternative to input's `type` attribute, as the type attribute encapsulates many different things:

1\. Validation

2\. Autofill hints

3\. Native helper widgets (date calendar, number input spinner)

4\. Mobile keyboard layouts

And, confusingly, while most `type`s are text inputs with differing values of the above, others are very, very different (radio, checkbox, select, file, etc). Still others use completely different tags (like <textarea>) and you even have to switch on `value` or `checked` for checkboxes.

Many people use `type="tel"` or `type="number"` just for the mobile layouts, and spend a long amount of time working around all the awful bugs in number inputs. Our own `<NumberInput>` React component works around multiple browser bugs and took weeks to get right. The incidental complexity even creates very hairy React bugs ([https://github.com/facebook/react/issues/7253](https://github.com/facebook/react/issues/7253)).

Even if you get around all the bizarre failures in differing implementations, you still have ridiculous spec bugs like the (intended) lack of selectionEnd/selectionStart on number inputs ([https://www.w3.org/Bugs/Public/show_bug.cgi?id=24796](https://www.w3.org/Bugs/Public/show_bug.cgi?id=24796)) and the like.

I don't know if anyone is championing splitting these concerns into separate attributes, but the web really needs it.

</comment><comment><USER9> The problem goes much deeper than just HTML fields - sometimes the punycode will be converted to Unicode and then get rejected further down the chain. For example, Google accepts punycode domains for custom email domains but will convert it to a Unicode domain name when receiving it. It handles most IDN domains fine, but it fails at domains with Emoji within it (my domain which fails is [http://xn--p38h.ws](http://xn--p38h.ws)).

The real problem here is all the systems we use are more complex than people realize. Things like names ([http://www.kalzumeus.com/2010/06/17/falsehoods- programmers-b...](http://www.kalzumeus.com/2010/06/17/falsehoods-programmers- believe-about-names/)) & time ([http://infiniteundo.com/post/25326999628/falsehoods- programm...](http://infiniteundo.com/post/25326999628/falsehoods-programmers- believe-about-time)) just cause issues that most developers will end up just ignoring, because in the end its just edge cases that will happen maybe once or twice, ever. Why put in the effort?

<comment><USER10> The current standard for IDNs is IDNA2008, which does not allow emojis. There are some ccTLDs that don't abide by the IDNA standard, and I think you'll find different browsers will show the emoji and others won't. Permitted code points for gTLDs are listed here. [http://www.iana.org/domains/idn- tables](http://www.iana.org/domains/idn-tables)

So strictly speaking xn--p38h.ws is not an IDN, and Google is doing the right thing by not allowing it. This doesn't make your job any easier, of course.

If you really want to explore this rabbit hole some good reading. RFC 4290 RFC 5891 RFC 6912 RFC 7940

</comment></comment><comment><USER11> I don't understand why he quotes from w3.org. HTML5 is being developed by whatwg.org

"The WHATWG was founded by individuals of Apple, the Mozilla Foundation, and Opera Software in 2004, after a W3C workshop. Apple, Mozilla and Opera were becoming increasingly concerned about the W3C's direction with XHTML, lack of interest in HTML and apparent disregard for the needs of real-world authors. So, in response, these organisations set out with a mission to address these concerns and the Web Hypertext Application Technology Working Group was born."

<comment><USER12> Because we're now in a horrendous mess where the W3C has a fork[0] of the WHATWG spec[1], which semi-regularly takes selected patches from the WHATWG spec… but at times end up with the spec in an inconsistent state. As it is, basically all implementers are working from the WHATWG spec.

[0]: [https://w3c.github.io/html/](https://w3c.github.io/html/)

[1]: [https://html.spec.whatwg.org/multipage/](https://html.spec.whatwg.org/multipage/)

</comment></comment><comment><USER13> Validation is logic, it doesn't belong in markup. A rectangle to type text into is as far as the abstraction should go.

<comment><USER14> No one's asking for bulletproof validation. What I want out of input[type="fancy"] elements is:

1\. Better detection of the platform than I can do myself. That leads to a UI targeted at the platform (different default phone keyboards, etc).

2\. Uniform UIs across websites. I hate having to learn a new calendar widget on every website, it's worse for regular users, not to mention any users that need accessibility features that are prooobably not included in most home- rolled (or even popular) widgets.

3\. Basic validation. Just to help the user a bit. I'll validate it again on the back-end, and I might even be validating it myself on the front-end. But basic validation helps and, once again, that uniformity thing shows up again here since the user could be aware of how that widget reports errors on their platform already and could be looking for them.

</comment></comment><comment><USER15> This is a reasonable concern, but far smaller IMHO than the main problem with email fields on web forms today: there is no way to verify that someone actually entered a working email address, because fear of spammers has meant all the plausible techniques for doing so get closed down.

We've occasionally had an unusual but syntactically correct address cause problems in the past because it wasn't processed properly, but we get problems with people who have accidentally mistyped their address when signing up and then can't log in to our systems all the time. If you have a system where the email address is the primary ID for a user's account and you're charging real money, this is not a trivial problem and it does not have a simple solution: requiring active confirmation at sign-up time does horrible things to conversion rates, but anything else is potentially vulnerable to security issues later.

Only the local part of an email address potentially being case sensitive causes us more headaches in this area today.

<comment><USER16> you could inform your users that email addresses are case sensitive much like passwords usually are or just normalize the local part along with the host and use that as the primary ID and have less issues in the future

servers that have case sensitive mailboxes are more likely to be used for throwaways or the user may control the server anyways so they could still respond to normalized local parts

as for verifying the email at registration you could check to see what the remote smtp server responds to when you issue the RCTP command to check if they consider the email valid

<comment><USER15> _you could inform your users that email addresses are case sensitive much like passwords usually are or just normalize the local part along with the host and use that as the primary ID and have less issues in the future_

We could normalise, and as far as I'm aware none of the largest e-mail services allow distinctions based on case so most of the time it would be OK. It would still be a security risk, though.

 _as for verifying the email at registration you could check to see what the remote smtp server responds to when you issue the RCTP command to check if they consider the email valid_

You can, but many servers including some of the major services will just return a false positive for any mailbox to prevent that technique being used to collect addresses to spam, and even those that don't may consider such requests when not followed with a real message to be a black mark on the sender.

</comment></comment></comment><comment><USER17> Your blog post has a problem in that it seems to be converting double hyphens into a single en-dash.

</comment><comment><USER18> I only use type=text inputs and implement custom logic on top of it; the others are crap, implemented in a rush and very inconsistently across browsers.

<comment> mike-cardwell What about type="number" ? There are clear benefits to using it when a user is entering a number and I'm not aware of any drawbacks? One of the benefits is the way some software keyboards display a number based keyboard instead of a qwerty one...

<comment><USER19> 1\. type=number only accepts the period as a decimal separator, and there are lots of locales using comma for that purpose. Customers often ask us to support commas, which requires type=text and manual validation.

2\. One customer requested the ability to enter decimals in a field, but to keep up/down spinner in steps of whole numbers. You can't do that, the step attribute makes any values other than (min + N * step) invalid. I can see some sense in that, but I think the step attribute should only affect the increments/decrements done by the spinner, not completely reject certain values. (Though you can use step=any to mark all values valid and step by 1.0, which is good enough for common cases.)

</comment></comment></comment><comment><USER20> form/validation should be what HTML excels at, it should even one of the few things it does. and we should use another technology to do other things we've been commandeering it to do.

<comment><USER21> Client-side validation can be very useful. At this point I think that the inconsistencies between implementations are the primary pain points, similar to what prompted the Web Standards Project.[0] Is there anything similar to the -{webkit,moz} in CSS for HTML? Or abstraction libraries comparable to jQuery?

It would also be very useful if the validation is extensible, as different projects require different validation rules.

I'd also want validation rules that are portable between the client and the server to reduce code duplication.

One combination I've been toying with is using clojure.spec[1] with ClojureScript/Clojure with varying levels of success. I imagine you can do similar things using server-side JavaScript.

> we should use another technology to do other things we've been commandeering > it to do.

What types of things are you thinking of?

[0]: [https://en.wikipedia.org/wiki/Web_Standards_Project](https://en.wikipedia.org/wiki/Web_Standards_Project)

[1]: [http://clojure.org/about/spec](http://clojure.org/about/spec)

<comment><USER20> there should be a form language that works client/server and is just for classic web such as forms, something similar to meteor or volt. i'd even resort to using those in future or write a dsl on top that makes web development a breeze.

</comment></comment></comment><comment><USER22> The internet is interoperability. And IDN does not seem to be interoperable.

As such, it's just not a good idea use one for now.

As an aside, I don't even know why IDN's are allowed, it offers too many opportunities for domain spoofing and phishing.

<comment><USER23> Because a Latin-only Internet disenfranchises billions of people who are confortable with other writing systems?

IDNs will take years to be pervasive, just like Unicode before it, because it is a painful upgrade to something designed in a different era. It doesn't mean the endeavour isn't worthwhile.

<comment><USER22> > Because a Latin-only Internet disenfranchises billions of people who are > confortable with other writing systems

You know that statement clearly is not true. Just look at keyboard designs used the world over.

<comment><USER24> I'm not sure what their keyboards have to do with it. If you were a native Arabic speaker, wouldn't you want to to be able to see domain names in Arabic that are easy for you to read and type? If you're a company operating in an Arabic market and you want to put your domain name on the posters you're designing to display at bus stops, you probably would prefer an Arabic domain name so that your primarily Arabic-speaking audience are more likely to remember it instead of dealing with an alphabet which belongs to a completely different language they may not speak at all (or not very well).

I know English is increasingly pervasive, but there are still billions of people who don't speak it at all or speak it only very poorly (and it's not exactly very easy to learn). The internet is a global network, and so should allow people to communicate easily in their own languages. This current pain with IDN is just a legacy of the internet's origins in America and Western Europe.

Heck, the example in the article are just using one letter found in German. You don't need to go very far from English to find these problems.

<comment><USER22> All of the above are fair points, but IDN makes clicking on

www.cítíbank.com

instead of

www.citibank.com

a very real problem and will make the web more dangerous and will encourage the further growth of "walled gardens" on the internet which I think most here agree is a bad thing.</comment></comment></comment></comment></comment>


Thanks for Trumpet Winsock - <AUTHOR> http://thanksfortrumpetwinsock.com/ <comment><USER2> Oh man, the memories.

For people who have grown up in a hyper-connected always-online world, it's hard to explain the pure _joy_ of hearing the sound of your computer picking up the phone and sending those tones [0]. Because it meant going from isolated, disconnected and unitary to being part of a wider world.

Suddenly, everything was at your fingertips and it was intoxicating to me as a teenager. Fire up Trumpet Winsock and dial into the local mom and pop ISP. Suddenly you're surfing the early web using Netscape. Or open up WinVN and read some newsgroups. Or spend way, way too many hours playing MUDs (seriously, I think I spent almost every night MUDding during my teenage years).

Or learning cool HTML tricks by looking at the source of a page (back when pages were simple and you could tell things by looking at the source). Some of my earliest exposure to "programming" was because I wanted to make cool web things on my 1mb of ISP provided web space.

So yes, thank you Trumpet Winsock. Without you my formative years would have been very different and I likely wouldn't be in the career I'm in now.

[0] [http://www.windytan.com/2012/11/the-sound-of-dialup- pictured...](http://www.windytan.com/2012/11/the-sound-of-dialup- pictured.html)

<comment><USER3> > _those tones_

[http://evilrouters.net/56k.mp3](http://evilrouters.net/56k.mp3) (MP3)

It's my ring tone. I love the weird looks on people's faces when I'm in a meeting and my phone rings -- especially the "older" crowd (some of the "youngsters" don't recognize the sound).

<comment><USER4> Did you know each manufacturer had a unique sound for their v90 handshake? This one sounds like a Lucent WinModem. (Based on listening to the sounds here[1]. Yay for RealAudio!) The USR/3Com modems were two "bongs" (four if the higher speed failed). But I was always fond of the Rockwell sweep[2].

Of course, required reading is HN favorite Oona Räisänen's excellent analysis of a modem handshake.

[1] [http://modemsite.com/56k/trouble3.asp](http://modemsite.com/56k/trouble3.asp)

[2] [https://www.youtube.com/watch?v=vvr9AMWEU-c](https://www.youtube.com/watch?v=vvr9AMWEU-c)

[3] [http://www.windytan.com/2012/11/the-sound-of-dialup- pictured...](http://www.windytan.com/2012/11/the-sound-of-dialup- pictured.html)

<comment><USER5> Yeah, I listened to the file and immediately thought: that's not how my US Robotics sounded! It's amazing how one remembers it after all these years. In my case, it's probably because of the poor line quality, one _always_ connected with the sound on, and one prayed quite a bit to get a good connection.

<comment><USER6> Damn. Nostalgia hit right there. I had a lucent winmodem. I rrmembrr the time when i did my firts switch to linux ( redhat 7) and there was no way in making it work there:( luckily I found a isa modem (33k) that was compatible out of the box, those were the times

<comment><USER7> Anybody else here guilty of stripping the low pass filters out of their local lines at night? Sure improved throughput :)

</comment></comment></comment></comment></comment></comment><comment><USER8> > _Do you remember connecting to the Internet in 1994 or 1995?_

In 1993 I was already using Linux, with an actual TCP/IP stack, not some bolted-on thing. In 1994 I was doing _contract work_ on Linux already. One of the jobs was for these guys, still chugging along:

[http://www.infomine.com/](http://www.infomine.com/)

They employed a group of full-time people who continuously gathered new information about mining prospecting going on around the world, stuffing it into a database. This was turned into periodically refreshed web pages, for which subscribers could "click to pay". I hacked the CERN httpd to lock the click-to-pay data, and whipped up a billing system for invoicing customers. (Spat out TeX -> dvi -> laserjet: most beautiful invoices anyone ever got for anything.) I made a nice visual control menu for the whole system using a C program and ncurses, and even Yacc was used on the project for something.

One of the genius programmers on the database side claimed that "OMG, Linux causes data loss", because when the hundreds of megs of generated HTML was copied over to the servers (Linux ext2 FS), the disk usage was way lower than on the FAT. Haha!

In 1995 I got an Asus motherboard with two Pentium 100 processors, and ran Linux 1.3.x with early SMP support (big kernel lock heavily used). make -j 3 was only 27% faster than make.

<comment><USER9> Same here. I hardly used Trumpet Winsock because using first 386BSD 0.0 and later Linux was just the better way to get online :-)

I still think it's great that Trumpet Winsock was around though. The more people on the internet, the merrier. Who knows if the internet would be everywhere today if the Windows users had been left out.

<comment><USER10> > Who knows if the internet would be everywhere today if the Windows users had > been left out

I can answer that for you: yes, it would be. The value proposition is among the greatest that has existed in all of human history. The hardware was ready, the price was low enough, nothing was going to stop it; lack of a layperson standard mass-consumer OS would have just slowed it down briefly until one was inevitably created.

<comment><USER9> You're forgetting about the competition. If AOL had had an even larger market share, they could potentially been more attractive than the internet.

</comment></comment></comment></comment><comment><USER11> I wonder how much of his programming know-how could be attributed to the high school curriculum.

In the 1970s Tasmania was the best equipped Australian state for computer based subjects. A lot of the schools had terminals to a central computer[1]. Buses, I/O devices and assembler topics were covered as early as year 9 levels.

[1] [https://en.wikipedia.org/wiki/RSTS/E](https://en.wikipedia.org/wiki/RSTS/E)

</comment><comment><USER12> I have fond memories of the transition from local BBSes (my parents were annoyed enough by my constant phoning of the local BBS to download commander keen and the like), to IP connectivity via Trumpet. The reach of the internet (esp IRC!) was mind-blowing for someone living in a relatively isolated community in Alaska at the time.

I feel like I don't fully appreciate the gradual transition from dial-up and Trumpet to LTE and a supercomputer in my pocket :) I wonder what people born today will experience that has as great of an impact.

<comment><USER13> Heh. "local" \-- ~1988 I was calling into BBSs in San Jose from Tahoe... the phone bill got to $926!

I was grounded for a month.

We wanted to play trade wars and the pit. Super fun.

I also used to call up 411 (information, where you would call 411 and say "do you have a number for John Smith in lake tahoe ca?") -- and I would chat up the 411 operators for as long as possible - the contest being to see how long we could keep the op on the phone.

Then I tried to make blue boxes.

<comment><USER14> I racked up a hefty bill one month for my mom back in day connecting to the net at all times of the night. The old Web was such a glorious thing. My favorite activity was to download images and animated GIFs so that I could have them forever. You just never knew if you'd find them again and having access to new content was a novel concept to me. I still have that folder. Backed up over 17 years just because I still can't let go of them.

Now I just play survival games and hoard items. I have no fear that I won't be able to find something I saw on the Web. It's harder to lose things forever. Such a different world and one I could not have imagined.

<comment><USER15> Upload them to imgur. I'm sure it'll be a trip down memory lane for a lot of us.

<comment><USER14> That's a great idea. The backup is on my desktop so I'll have to wait until I can access it. Would love to share it.

</comment></comment></comment></comment></comment><comment><USER16> When I set that site up in 2011, it was really heart-warming how many people rallied around and chipped in.

It's doubly nostalgic to see it here again, 5 years later.

Edit: and there's still room on that donors page for any companies wanting to chip in something substantial.

Edit 2: _5_ years, not 4.

<comment><USER17> I'm interested in how much is being donated. Do you have any plans of releasing some stats?

<comment><USER18> I would be interested as well, it seems like the site should have been updated since then. Also I wonder what percentage of donations are a result of links to HN/reddit/social media rather than organic?

<comment><USER16> Almost all of what are technically post-payments came from HN and Reddit links.

On a normal day the site gets about 10 visits. In the last 9 hours it's had about 17k.

</comment></comment></comment></comment><comment><USER19> In 1995 I was an expert in setting up Trumpet Winsock, paid to consult on its installation and configuration - even though I had never once installed it myself.

That is to say, I was a tech support lackey, answering the phones and talking to dozens of dialup ISP users daily.

It was a small company, and of the three techs there, none of us were Windows users - two Linux, one Mac. Someone had helpfully printed screenshots of Winsock's various dialog boxes and taped them up around our cubicle. It was enough.

<comment><USER20> There was (and still is!) a great web site for this, letting you see where the various "Dial Up Networking" screens were in Windows: [http://www.chasms.com/](http://www.chasms.com/)

<comment> steve-howard What an amazing site. I was clicking through the advanced IPv4 settings on Windows 10 and clicking through the simulator for Windows XP and saw that they were exactly the same, beyond the different OS themes. So much overhaul for what network configuration looked like over the years, and the parts for experts are now deeply buried but unchanged.

</comment></comment></comment><comment><USER21> I was using an Amiga with the Miami TCP stack back then, which I paid for. My first Windows machine had Windows 95, which had networking built-in. But, I'm happy that some folks have made good on their shareware obligations. Writing software was a lot more difficult back then...I sometimes can't believe anything ever got done before we had the Internet to research things (and I know I personally was a much less effective developer before the Internet).

<comment><USER22> > Miami TCP stack back then, which I paid for.

Yeah, this whole thread brought back how TCP/IP and dialup stacks used to be commercial. Huge win for the BSD license if you ask me.

</comment></comment><comment><USER23> Here's the author's story, the making of:

[https://news.ycombinator.com/item?id=2283693](https://news.ycombinator.com/item?id=2283693)

Hint: from scratch, reading RFCs, in Turbo Pascal, as a part of his internet newsreader project!

Also, [http://petertattam.com](http://petertattam.com) is down currently, but

[http://www.trumpet.com.au](http://www.trumpet.com.au)

Works.

</comment><comment><USER24> Color boxes, Phreaking, ASCII art groups, zips broken up at 1.44m, LOTD and other door games. That was my youth. Donation sent.

<comment><USER25> Wasn't it "LORD" (Legend Of the Red Dragon)?

<comment><USER26> He might also be thinking of a variation of "Land of Devastation" ([http://www.smbaker.com/games/land-of-devastation- classic](http://www.smbaker.com/games/land-of-devastation-classic) )

</comment></comment></comment><comment><USER27> I had a PC Shop in 1995-1997 we sold copies of a software product called Internet in a Box. [https://en.wikipedia.org/wiki/Internet_in_a_Box](https://en.wikipedia.org/wiki/Internet_in_a_Box)

I think it competed with Trumpet Winsock. He had clients who used Trumpet Winsock but had problems configuring it so we helped them out.

It was later on with Windows 95 OSR2 that IE was bundled with it and it had a Winsock Dial Up Network stack that Internet in a Box and Winsock lost a lot of sales. I think they sold MSN subscriptions with it.

AOL and Compuserve competed with sending out free floppy disks and later on CD-ROMs. Then there was that $500 Internet rebate that made a PC basically free but had a $35/month dial up ISP bill to pay for it for five years.

But I remember people registering Trumpet Winsock for $25 and then choosing a mom and pop ISP. Trumpet Winsock was downloaded from a BBS, and was shareware and some ISPS gave out copies of it on a floppy disk when people signed up for service.

</comment><comment><USER28> Donated $50 now that I have the cash. I did not have the money back when I was 12 and first getting into computing. Cheers to winsock.

</comment><comment><USER29> I met Peter at BBSCon down in Tampa in 1995. A really humble guy and truly one of the nets pioneers.

</comment><comment><USER30> In 94 I got a job (my first in London) at a small company that made software with and for SGI workstations, and despite all this computational power they still used a 386 with Trumpet on Windows for their only internet connection.

It would dial up a few times a day to exchange email using Demon's inbound SMTP (tenner-a-month account!), or one could laboriously route through it if one really needed something specific.

In summer 1995 they replaced it with an ISDN line.

<comment><USER31> In '95, I was running a dual Pentium machine for doing FEA. With a $2,500 video card (I can't remember the make), it had 3x the bang-for-buck as a mid- range Unix workstation. (We upgraded to Pentium Pro's ASAP.) Another guy in a cubicle next to mine had the biggest, baddest workstation in the company: an RS10K that cost $80K.

This was in our pre-T1 days. Everyone was getting phone lines. I was using dual modems in my Windows NT machine. He was getting hooked up to a small ISP. The ISP's tech came in to configure his modem. It was taking awhile, so, as he struggled, I gave them both a hard time about how connecting my Windows NT machine to my ISP -- even with both modems -- took 15 minutes. He told me how Unix was "awesome" and that there were over 2000 options to configure. After 4 hours, he gave up and went back to the ISP to try from that end.

A week later, the engineer with the RS still had no internet connection. After another week, his ISP got him online... and immediately crashed his machine. They discovered a firmware bug in the SGI that caused the kernel to panic every time the modem connected. They got a patch, and he FINALLY got online to get his email.

And then we got a T1. But since this connection was SO hard-won, he kept his modem and his private domain. And then, soon after everyone started getting connected to ethernet and the T1, no one could get ANYWHERE. Lo and behold, the ISP tech had configured the engineer's modem connection to advertise itself as a route, and, since that hop was closer than getting 3 buildings away, every computer in my office started using it. It took several days to sort out.

I noted, for the record, that this option for a modem connection was a prominent and easy-to-avoid checkbox on NT.

It wasn't long before this other engineer left, and we were all glad for it. He was the biggest, narcissistic, pompous douchebag I've ever met, even to this day. And I soon began to prefer Linux to NT wherever I could get away with it. I don't know where I was going with all of this, but SGI and early internet days made me remember this anecdote.

</comment></comment><comment><USER7> [https://news.ycombinator.com/user?id=p_trumpet](https://news.ycombinator.com/user?id=p_trumpet)

<comment><USER16> Most of his comments were from this thread: [https://news.ycombinator.com/item?id=2282875](https://news.ycombinator.com/item?id=2282875)

FWIW, you should _not_ use Paypal donations. Use payments instead. Otherwise that account will probably get locked again.

<comment><USER32> > FWIW, you should _not_ use Paypal

FTFY. Someone should really hook this guy up with a Bitcoin address...

</comment></comment></comment><comment><USER33> And also thanks to Russell Nelson, who maintained the best collection of ethernet card packet drivers for many years -- if you wanted to connect a DOS machine to an IP ethernet network, that was your best option. Probably still is.

Looks like he still has that up at [http://www.crynwr.com/drivers/](http://www.crynwr.com/drivers/)

</comment><comment><USER34> My absolute earliest memory of going on the internet was my grade school librarian firing up Trumpet Winsock on some Windows 3.1 machine when I was in second grade (circa 1995). He navigated to nfl.com and then printed the website out.

I remember thinking "this is pointless" but went on to build my first web pages only a few years later (4th or 5th grade).

<comment><USER3> You just reminded me... I recently discovered that a website I made when I was a teenager is still online. I could still remember my username, was able to login, and was shocked to see the date stamps on the directory listing. The oldest file there is dated 19 May 1997 [0]. I intend to celebrate its 20th birthday in another ~16 months.

[0]: There's actually one slightly older (28 Apr 1997), but it's an image (.gif), not a .html file.

</comment></comment><comment><USER35> My startup [0] conducted the first, secure commercial transaction on the web in 1994. I have strong memories of taking people on the phone through the many steps of downloading Trumpet Winsock via ftp from Australia so that they could then install the NCSA Mosaic web browser. Thanks, Peter, for your essential work.

Here's a short video [1] Shopify released last month about the transaction, where I reference how hard it was at the time to get online.

[0] [http://www.nytimes.com/1994/08/12/business/attention- shopper...](http://www.nytimes.com/1994/08/12/business/attention-shoppers- internet-is-open.html) [1] [https://www.youtube.com/watch?v=eGyhA- DIYvg](https://www.youtube.com/watch?v=eGyhA-DIYvg)

</comment><comment><USER3> I'm trying to remember "the" big FTP site back then. There was one in particular that was the "go to" site for, well, pretty much everything.

ftp.cdrom.com, metalab.unc.edu, sunsite.something, ...

<comment><USER36> sunsite.unc.edu?

<comment><USER3> That's it

</comment></comment></comment><comment><USER37> My first experience with Trumpet WinSock was on a small project where the computer talked to some state of the art (at the time) network connected data acquisition devices. Coming from a Unix world at the time, the whole windows ecosystem and specially its networking felt stone age, ridiculously buggy and error prone. It quickly drove us back to the old SunOS and Silicon graphics Irix workstations.

</comment><comment><USER38> I paid $25 around 1993 but I sure got my money's worth and then some--so tonight I kicked in another $38 gratefully.

</comment><comment><USER39> Moderators: shouldn't the title have a (2011) at the end? That is when it was authored.

</comment><comment><USER40> I remember mine and my dad's first confusions at using the Internet. How could you do multiple things at the same time? Obviously, we were used to how BBSes worked and had no idea of TCP/IP at the time.. :-)

</comment><comment><USER41> I really loved the Trumpet Winsock debug mode which clearly showed packet types, syns, acks and other details. Since that I've been familiar with IP networking.

</comment><comment><USER42> I always thought Netmanage Chameleon worked better.

</comment><comment><USER43> I ran an ISP that used trumpet, before Windows 95 and it was way better than my SLIP account. Donation already sent! Thank you.

</comment><comment><USER44> This is great but should be tagged (2011).

</comment><comment><USER45> Similarly, thanks KA9Q & WATTCP. Oh, and Kermit too.

</comment><comment><USER46> As a mac user I mostly remember ButtTrumpet and giggling.

</comment><comment><USER47> Thanks to the original Netscape folks too.

<comment><USER9> No need to donate to them, they made millions :-)

</comment></comment><comment><USER48> Donated just now, wish there was a way to give 20 years of compound interest along with it :(

</comment><comment><USER49> Never work for free,we're not paying royalties to the ancestors of the inventors of the wheel.

Thanks for the free work,here are some stock options!

You're the lowly programmerz, I'm the IDEA GUY!

</comment><comment><USER50> On a related/tangential note, here [1] is the website for terminate, the world's most powerful communications software.

1: [http://www.terminate.com/](http://www.terminate.com/)

<comment><USER51> Haha thanks for that it sparked some memories. I used Terminate to connect to local BBSs and even set one up myself using Remote Access, which was a BBS software package. Before setting it up I printed the manual out on my old dot matrix and it took hundreds of pages.

</comment></comment><comment><USER52> Instead of PayPal, let's use Tilt for this. It's free and a YC company. I am happy to set it up, unless someone else wants to.

</comment><comment><USER53> Sorry, off-topic, but in recent months I cannot read "trumpet" without thinking of the sort of thing I saw on TV today. Winsock comes across as 'wind-sock'... also apt.</comment>


The Beta Program Behind a Startup's Winning Launch - <AUTHOR> http://firstround.com/review/the-beta-program-behind-this-startups-winning-launch/?ct=t(How_Does_Your_Leadership_Team_Rate_12_3_2015) <comment><USER2> Eero has paid a lot for press. I hope their product is good.

</comment><comment><USER3> Slightly off-topic: Does anyone know if Eero uses a single SSID or multiple? I was using a single and constantly having the problem of a client connecting to the wrong router and slowing to a crawl. Now I'm using multiple SSIDs but I have to change my wifi settings as I move around. If Eero solved this overall problem I'll buy their routers in a heartbeat.

<comment><USER4> Even if they support multiple SSIDs, you probably want to use a single SSID on your device. Realistically speaking, your device should detect that the signal strength is low and connect to a better Eero if available. Sticky clients are plenty though, enterprise APs generally handle this by monitoring client signal strength and forcefully kicking out sticky clients to force them to move to better access points.

Not sure if Eero does this.

<comment><USER3> > your device should detect that the signal strength is low and connect to a > better Eero if available.

My clients are all google. Chromebooks, tablets, and phones. Maybe they are particularly bad but I doubt it.

> APs generally handle this by monitoring client signal strength and > forcefully kicking out sticky clients

Interesting. How would they know there is a better one available to the client?

<comment><USER4> > Interesting. How would they know there is a better one available to the > client?

Low end APs just blindly kick clients based out on configured rssi threshold. Some enterprise APs do a periodic, rough triangulation of client location (How well multiple APs can hear client packets through on / off channel scanning) and take decisions.</comment></comment></comment></comment>


Ask HN: Laid off by not being 'cross-functional' - <AUTHOR> My team manager told me that our floor manager will not continue with me for I was not being 'cross-functional'.
I was shocked because my performance is very good and I had no problem of team integration. My team manager is equally surprised by this decision, and he raised an argument for me by showing the floor manager my github & jira stats which proved to be 'outstanding' (343 contributions & 6380 lines of code for last 3.5 months).
Background about my job: I was hired as front-end developer, and my contributions have been focused on company's front-end projects. One month ago the floor manager asked me the idea about 'cross-functional', I answered that the modern web apps are very complex both on front-end and on back-end, and is hard to master both sides at same time. Instead of doing a little bit everything, one should be professional at one side and contribute the best of his knowledge.
I am not saying that I will never take a look at back-end, I sometimes checked our Java codebase to understand related bugs. But I don't understand the definition of 'cross-functional': should one pick up a front-end story today, dive to back-end one tomorrow, and deliver both master quality? Am I wrong about my career goals (which is become a master of Web and focus more on front-end)? <comment><USER2> Yeah, that's some nonsense. Full-stack (your team manager's "cross- functional") today is mostly a delusion. Sure, you should be able to read some code on both sides to tackle the trivial parts of either, but I wouldn't expect _every_ developer to have semantic understanding nor constant involvement on both sides.

Sorry for your recent misfortune and I hope you find a more reasonable next gig ( _cough_ next manager _cough_ ).

</comment><comment><USER3> > I answered that the modern web apps are very complex both on front-end and > on back-end, and is hard to master both sides at same time. Instead of doing > a little bit everything, one should be professional at one side and > contribute the best of his knowledge.

You do need to be 'cross functional', you might prefer front end development, but you also need to be able to do back end development, and vice versa.

When you understand both, it will make you a much better developer.

And to quote Bill Gates, 'Measuring programming progress by lines of code is like measuring aircraft building progress by weight'

I'm sorry you lost your job but look at this as an opportunity to improve yourself and your skill set.</comment>


My Teespring Experiment - <AUTHOR> http://alexstechthoughts.com/post/66681764973/my-teespring-experiment

<comment><USER2> I'm slightly disappointed that you chose a vendor that doesn't accept bitcoin.

<comment><AUTHOR> :(

I know- sort of ruins it but teespring is the only company that works like this (ie you don't have to buy a set amount and sizes before).</comment></comment>


Ask HN: What computers can I install Mac OS X Lion on? - <AUTHOR>

<comment><AUTHOR> I have a dell. Do I need to buy a Mac of some sort? If so, of which sort? Tnx!

<comment><USER2> "Dell" tells me nothing. You can install Lion on a PC that meets the system requirements on Lion, which are as follows:

x86-64 CPU

At least 2GB of RAM

Mac OS X 10.6.6 or later (Mac OS X 10.6.8 is recommended)

At least 7 GB of free hard drive space

It may be possible to install it without first installing Leopard or Snow Leopard. I'm not sure. You will probably have to install Unix as well, I'm also not sure about that. In any case, it will be a massive pain in the ass and more trouble than it's worth, but if you really want to, go for it. Education is good for you.</comment></comment>


Show HN: SheetDB – Connect Remote SQL Database with Google Sheet - <AUTHOR> https://github.com/Xuefeng-Zhu/SheetDB <comment><USER2> Is something like this always just a hack/shortcut or are there people who want this as their ideal workflow? I'm curious because I see stuff like this all the time being submitted to YC.

For example, is this for IT / DBAs that need to gather info for data analysts, marketers and sales people? Are there many people in that position and what would the ideal flow look like? I can see startups and small companies willing to use this as a stopgap, but I couldn't imagine larger customers/companies willing to use something like this.

This isn't to say I don't know why this was built. The same forces are what drove us to build Wufoo. We were tired of building these tedious data collection apps. The DIY builder was out of laziness on our part.

But when it comes to accessing existing data, there's so many concerns about security and privacy that I worry an idea like this will always be limited in terms of adoption.

If people think differently, I would love to know.

</comment><comment><USER2> Oh, and you should add PostgreSQL support. Maybe it's already supported, but I didn't see it explicitly listed.

<comment><AUTHOR> I am using the JDBC built into Google App API. Based on latest, it has not support PostgreSQL yet.</comment></comment>


Moxtra acquires Twitter (2008) - <AUTHOR> https://www.crunchbase.com/acquisition/d26514e54ce4795a317348814e429127 <comment><USER2> Also not forgetting Twitter's history of selling user's data for hard cash:

[http://blog.datasift.com/2012/02/28/twitter-historic- data/](http://blog.datasift.com/2012/02/28/twitter-historic-data/)

[http://www.acxiom.com/acxiom-data-matching-globally- availabl...](http://www.acxiom.com/acxiom-data-matching-globally-available- twitters-new-tailored-audiences-product/)</comment>


How is the iPad a revolutionary educational tool? - <AUTHOR>

A local private high school has recently made iPads a requirement for upperclassman to own and use. My question is what is the primary benefit or usage for iPads in schools that laptops or books cannot provide. <comment><USER2> IMO laptops are too bulky and awkward. When I just need to take a quick note or look something up quickly I turn to my iPod or iPad. I hate to bother unpacking my laptop, turning it on, and waiting for it to boot just to do something quick.

For longer periods of use though I certainly prefer the laptop. Books are dead as far as I'm concerned. I prefer ebooks on the iPad because I can get errata updated more frequently and easily and it's easier to annotate, highlight, etc than a book.</comment>


Ask HN: How can I help startups exploit my state's zero income tax? - <AUTHOR> I live in a U.S. state where there's zero income tax (personal or corporate), and zero state estate tax.
There are already 2 kinds of thriving tax arbitrage businesses here:
1) Official "addresses" for people who live out of their campers all over the country. These businesses consist of a single building with little pigeonhole mailboxes, and each mailbox has a pretend address like it was a home address. (It so happens that this state also has some of the lowest registration fees for camper-trailers in the country). [I suspect there are also plenty of people who live in homes in other states, who own homes here and claim that they live here -- lots of empty homes here.]
2) The headquarters for the trusts of a large proportion of billionaires in the country.
My Ask: what are some ways I could help (say) Silicon Valley startups save taxes given this situation in my state.
(E.g.: I was thinking about how remote workers compute their state taxes. Is there any financial or legal vehicle I could create that could help them save taxes by (say) having an address here?) <comment><USER2> You could start a company that contributes to society and pay their employees more to join your company instead</comment>


OpenSSL is written by monkeys (2009) - <AUTHOR> https://www.peereboom.us/assl/assl/html/openssl.html <comment><USER2> I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible.

The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 means success, and sometimes it's a combination. This is really, _really_ bad for a crypto library since properly detecting errors is usually critical to security.

<comment><USER3> O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?

<comment><USER4> 1\. Other libraries do exist -- NSS, GnuTLS, etc.

2\. Do you have time for a rewrite? What makes you think anyone else would?

3\. The (generally correct) mindset is _don 't implement your own crypto_. This is particularly true of something like TLS, which is complicated and has subtle requirements that are easy to screw up. Unfortunately, this means that even people who have time are discouraged from doing an OpenSSL rewrite.

<comment><USER5> If there's alternatives then why do so many pieces of software (nginx, Apache, etc.) use OpenSSL as opposed one of these alternatives?

<comment><USER4> _Today_ there are alternatives. Once upon a time those alternatives were either not written, not stable, or not free. Now it is just a matter of convincing an enormous number of developers to carefully rewrite large parts of their systems to use a different library instead of new features (or ironically, security fixes).

</comment></comment></comment></comment></comment><comment><USER6> I'm getting a certificate warning on Chrome 33.0.1750.152. Is there a security corollary to Muphry's law?[1]

[1] - [http://en.wikipedia.org/wiki/Muphry's_law](http://en.wikipedia.org/wiki/Muphry's_law)

<comment><USER7> This might be intended. Supporting SSL is better than not supporting it (well, except in situations where an OpenSSL bug could leak your server's memory, but that's a bit of a stretch <[http://filippo.io/Heartbleed/#www.peereboom.us>](http://filippo.io/Heartbleed/#www.peereboom.us>) \-- but put this aside), because it's always better to encrypt traffic even in a way vulnerable to passive attacks; and some people may reasonably opt-out of the SSL CA business because they do not like the way it is structured, doubt the security it offers, or feel that they do not need it.

(I use a free StartSSL signed certificate, but only because it's free and not very hard to get. If there were no free provider with widespread support, I would be very happy to use a self-signed cert and think of it as a protest against the stupidity of browsers which present SSL+self-signed as less secure than plain HTTP).

<comment><USER8> If someone has passive access to snoop, the odds they can perpetrate an active attack are so close to 100% as to make the distinction immaterial. Encryption without authentication accomplishes nothing.

Worse, self-signed certificates train users to freely click through certificate warnings. People running servers with self-signed certificates are actively reducing what security we have available for the web.

If we ever do get anything better than the existing CA structure, it won't do us any good if users have been trained to ignore browser security warnings anyway.

<comment><USER9> Can you MITM public wifi? Real question, but I thought the answer was "no", which would make public wifi a compelling counter-example.

<comment><USER10> Yes. You arp poison the default gateway and route traffic through your own host instead.

<comment><USER11> Or spoof DNS responses to point to a machine under your control.

<comment><USER12> Or spoof a disassociation frame, then impersonate the access point so the victim connects to your computer instead.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Adobe's Flash Player used OpenSSL on Linux for a long time, but eventually switched to NSS because the OpenSSL project would repeatedly break their library ABI without changing version numbers. The OpenSSL developers said that a stable ABI was a non-goal of theirs. (Disclosure: I was an engineer on Adobe's Flash Player team.)

<comment><USER14> OpenSSL's thread safety policies is undocumented and unintelligible. We gave up and just put a single mutex around any call to OpenSSL within the process.

<comment><USER15> That's actually something openssl does okay. See [http://www.openssl.org/docs/crypto/threads.html](http://www.openssl.org/docs/crypto/threads.html) it's actually one of the few things that are properly documented.

</comment></comment></comment><comment><USER16> >OpenSSL is equivalent to monkeys throwing feces at the wall. It is, bar none, the worst library I have ever worked with

Ah, he haven't worked with MS Crypto APIs.

I was implementing TLS/SSL in one of the services working at _MS_. I couldn't figure out many things from MSDN and samples - they would not cover error and some variations code paths, and there was just no way to figure it out. And recovery would be something like "in third buffer there will be value x, you have to it pass to other function". And there was a need to do it correctly for obvious reasons, really. So finally I got IIS sources to see how it's done correctly, and discovered couple thousand lines of code with comments like this "xxx told us that buffer X will contain value bla if condition Z is met, and this is why we are doing it here". I had no choice but to cut-n-paste it to my service. I can tell you for sure, nobody outside MS can implement TLS/SSL correctly by using MS Crypto APIs. At least with OpenSSL you can read sources for both library and services and figure it out.

<comment><USER14> The absolute worst API in the history of computers is the Microsoft Text Services Framework (TSF) API.

It's incomprehensible, nearly undocumented, 10x more complicated than necessary, and even Microsoft doesn't understand how it works and hates it.

<comment><USER17> Don't forget x64 SEH. From [http://www.nynaeve.net/?p=105](http://www.nynaeve.net/?p=105) : "This layering violation is not the most egregious in the x64 exception handling scene, however."

</comment></comment></comment><comment><USER18> It looks like this was the precursor to assl, 'A library to hide awful OpenSSL API in a sane interface' which hasn't gotten much GitHub love.

[https://opensource.conformal.com/wiki/assl](https://opensource.conformal.com/wiki/assl)

[https://github.com/conformal/assl](https://github.com/conformal/assl)

</comment><comment><USER19> For more, and more recently:

[https://twitter.com/OpenSSLFact](https://twitter.com/OpenSSLFact)

</comment><comment><USER20> [https://web.archive.org/web/20140125144231/http://www.peereb...](https://web.archive.org/web/20140125144231/http://www.peereboom.us/assl/assl/html/openssl.html)

If you don't want to add a security exception.

</comment><comment><USER21> I am a bit reluctant to repeat myself, but I can't see any mentioning of the sheer _volume_ of code. It's more than 300.000 lines of code in the .c files of the official tarball.

My experience with code grown beyond >10⁵ LoC is that it _forces_ you to monkey-patch around any bugs (or even features for that matter). Surely there's a Potterson's Law or something that describes the situation.

In short: it's not the monkeys (quality), it's the volume of code.

(Of course now we're getting in a chicken-egg situation.)

</comment><comment><USER22> I seriously wonder what else is hidden in the mess called OpenSSL. And especially how much of the bugs are known by the NSA.

Something like Heartbleed would definitely make a live-injection attack feasible!

<comment><USER23> If the NSA is going to spend our tax dollars analyzing that code, the least they could do is contribute formatting cleanup patches!

<comment><USER24> i don't think the NSA works like that :)

remember "national security" equates to "we will watch you all the time and steal all your dataz". it would obviously be great if "national security" meant what it was supposed to...

<comment><USER25> The NSA wrote SELinux.

<comment><USER26> Has that been audited independently? A quick Google search didn't cough up anything.

<comment><USER25> You mean, has anyone formally audited SELinux to make sure the NSA didn't load it with backdoors? No idea, but it was accepted into mainline Linux kernel ten years ago. So if you don't trust SELinux, you can't trust Linux.

</comment></comment></comment></comment></comment></comment><comment><USER27> The following thread is not directly related, but might be interesting to those who would like to see a constructive response to the quality of OpenSSL.

[http://www.reddit.com/r/rust/comments/22gppc/when_life_hands...](http://www.reddit.com/r/rust/comments/22gppc/when_life_hands_you_lemons_is_this_rusts_time_to/)

</comment><comment><USER28> What's are the best alternatives?

I've recently started looking, and PolarSSL[0] and Botan[1] are on my trial list. Mozilla NSS looks a little low level, and GnuTLS hasn't faired much better lately, despite having _much_ better code hygiene than OpenSSL.

[0] [https://polarssl.org/](https://polarssl.org/) [1] [http://botan.randombit.net/](http://botan.randombit.net/)

<comment><USER4> I have some experience with NSS, and for simple things it is not terrible despite being a bit low level. With about an afternoon of work I was able to write a very simple TLS server using NSS -- in Lisp, using SBCL's FFI.

</comment></comment><comment><USER29> How can a library of this size and importance not be run through a linter, with violating patches rejected? And why is a cleanup effort of the simplest stuff not undertaken?

And with it being C, doing a proper operator spacing+indentation of the whole source should be as easy as running it through a tool (yes, auto indent is always better than a broken indent).

What's the next discovery? The core is all php and there are zero tests?

</comment><comment><USER30> Why is this so hard? I'm honestly curious to know. The theory is extremely well laid out, i.e. it's just number theory. We know to do stuff in a way that avoids side-channel attacks, i.e. try not to leak power usage when you're exponentiating, etc. Why do people keep using the awful mess that's openssl?

<comment><USER19> It's not just number theory; it's a web of interlocking state machines implementing the TLS protocol, which itself depends on a variety of different marshalling formats for the number theoretic parameters, built on the shifting sands of optimizations for different machines, all evolved over the the course of ~15 years, starting from a package that was, literally, Eric Young's "teach myself C" project.

<comment><USER31> That's kind of missing the point though. It would be relatively easy to define an interface that is simple to use and allows implementing 90% of the use cases with rather low danger of shooting yourself in the foot. We _know_ that this is possible because there are libraries out there that do it.

This whole thread is about OpenSSL somehow failing to do that, despite being called out on it for years.

<comment><USER19> I don't understand. What part of TLS are you calling "simple"?

<comment><USER31> The _interface_ between an application that wants to communicate using TLS and perform related tasks and a library that implements TLS can and should be simple - at least for the 90% of common use cases.

The whole point of the original article is that the interface of OpenSSL is horrible and undocumented. Consider how the article's author was not originally interested in looking at the internals of OpenSSL. All they wanted was a decent and documented interface for dealing with certificates; if OpenSSL had exposed such an interface, they would never even have looked at the source code of its internals.

<comment><USER32> It's open source, everybody can decide to invest his own time to do the fixes.

However, the functionality openssl provides is much bigger than most of the commenters can imagine. It's not easy at all.

</comment></comment></comment></comment></comment></comment><comment><USER33> The version at pastebin.

[http://pastebin.com/HMUjbnnN](http://pastebin.com/HMUjbnnN)

</comment><comment><USER34> Last year I took part in a similar project in which I had to issue both server and client certificates, signed by another certificate, for a company's sales site. I'm not by all means an expert in cryptography (not even close), and after googling around a bit I found "The Legion of The Bouncy Castle"[1] crypto library, which was relatively easy to work with, and enabled me to solve my problem quick enough. I just wonder what more experienced programmers have to say about this crypto library.

[1] [http://en.wikipedia.org/wiki/Bouncy_Castle_(cryptography)](http://en.wikipedia.org/wiki/Bouncy_Castle_\(cryptography\))

</comment><comment><USER35> Having worked with OpenSSL on only one occasion. I figured something was up when they have a function named SHA1_Update and SHA_Update that has the exact same signature and creates different outputs. A library designed by incompetents.

<comment><USER36> SHA_Update is for the SHA-0 hash, and SHA1_Update is for the SHA-1 hash, so it's hardly completely illogical. The main issue here, is that people that don't know the difference between SHA-0 and SHA-1 should likely not be in charge of computing hashes by themselves. Crypto requires some expertise or it goes awry very fast, but then the educational system is producing plenty people with good crypto knowledge, it's hardly the niche it was only 20 years ago.

Also SHA-0 support is left out if OPENSSL_NO_SHA0 is defined, which must at last be the case in the FIPS version of the library, the one your want to use for regulation reasons in many cases...

<comment><USER35> The problem was that the names are too close to each other and was one typo away from mysterious bugs. The non-existence of documentation didn't help either.

<comment><USER36> If you go that way there is also MD2_Update, MD4_Update and MD5_Update, that are also one typo away of _a bug you can 't miss at all if you test anything_.

Of the many many faults of the OpenSSL API you just didn't chose the right one.

<comment><USER35> Having been bitten by SHA1_Update with no expectation that SHA_Update would work as well. I'm sort of bitter about that.

</comment></comment></comment></comment></comment><comment><USER37> OpenSSL is a monoculture. Refactoring it or trying to prettify it would be a waste of time. The right response is to create a completely separate open source project that implements SSL/TLS. The biggest problem that comes to mind is that there are only so many people expert enough to do it right and lots of those people are already on OpenSSL, and produced the mess there. Then there's the adoption curve -- while there are probably quite a few people who'd jump on a better library, there is lots of inertia in the big and important projects.

</comment><comment><USER38> reminds me of this: [https://www.varnish- cache.org/docs/trunk/phk/ssl.html](https://www.varnish- cache.org/docs/trunk/phk/ssl.html)

</comment><comment><USER39> Date on the article might belong in the title: 2009-08-24

</comment><comment><USER18> What alternatives are out there?

It is time for a new open source SSL implementation, maybe minimizing what is supported to reduce attack surface?

<comment><USER40> Depending on your needs, but you can check:

[https://en.wikipedia.org/wiki/Comparison_of_TLS_Implementati...](https://en.wikipedia.org/wiki/Comparison_of_TLS_Implementations)

</comment></comment><comment><USER41> Readability matters (Zen of python).

This kind of thing make me appreciate saner languages like python & pascal.

But this make look C __too bad it is...

</comment><comment><USER42> a guy setting out to write a CA (with LDAP backend! cue in nostalgy for my old days at one well known BigCo ) for what seems to be a first time, and as a first timer he obviously goes for OpenSSL (has he ever heard at least about NSS?). Does it all sound like part of the same problem he talks about?

</comment><comment><USER43> I highly recommend fixing the style before attempting to read: [https://www.dropbox.com/s/euuuyrjydo8z5jy/Screenshot%202014-...](https://www.dropbox.com/s/euuuyrjydo8z5jy/Screenshot%202014-04-08%2020.14.31.png)

</comment><comment><USER44> Is there anyone with a more current read on this issue (heartbleed aside)? The linked article is 5 years old, lots can change in 5 years.

<comment><USER45> As having maintained a code base that uses openssl since 2004, no, not a lot has changed, openssl has just accumulated more of the same.

</comment></comment><comment><USER46> Article raises a good point.

Seeing this repeated 50+ times made me cringe though

        if ((req = X509_REQ_new()) == NULL)
            ERROR_OUT(ERR_SSL, done);

seriously..

also, writing new code and not using Rust, or D, or even C++. WTFs like the above are par for the course when you're writing in a 40 year old language without any features of modern low-level languages.

<comment><USER47> I don't think writing bad code is a reflection on the language. You can write rubbish code in any language.

</comment></comment><comment><USER48> Sounds a bit like Sun's Metro WS-Security implementation

</comment><comment><USER49> Chrome thinks this site is unsafe, which amuses me at least.

</comment><comment><USER50> this title is so offensive towards monkeys

</comment><comment><USER51> either monkeys or NSA programmers

</comment><comment><USER8> I'm going to assume "monkeys" is a poor translation from another language. Maybe it's supposed to say "OpenSSL is written by fuzzy hackers". It's impossible to tell without accepting a self-signed certificate I have no means of validating.

The irony is delicious, much like a banana.

<comment><USER52> Within the page you didn't bother to read, presumably due to the mortal terror well known to be inflicted by presentation of a self-signed SSL certificate for a resource for which there's no reason to give a damn about identity validation in the first place, there's an expanded version of the metaphor which involves a reference to flung feces. So, no, I'm pretty sure that when the author says "monkeys", it's monkeys he means.

<comment><USER8> It's not mortal terror, it's declining to enable someone who uses racially- charged language to attack their fellow human beings while configuring their server in a way that anyone competent to evaluate OpenSSL's merits in the first place would know was no better than not having SSL at all, and in fact much worse, since it trains people to ignore certificate warnings.

<comment><USER53> You're the only one bringing race into this. All that is meant is that the author views OpenSSL as approximately what you would get if you flung poo around for a while.

<comment><USER8> The author brought race into it by comparing human beings to monkeys, a common racist trope.

If your only defense for someone calling people sub-humans is "but it might not be racist!", you need to think hard about what you're defending.

<comment><USER52> If your only justification for calling someone a racist is "but sometimes racists use that word!", you need to spend less time on Tumblr.

<comment><USER8> I really have no idea what this crap about Tumblr is. I don't use it, and I don't really know anyone who does. When I click a link to it, it's almost always a cute animal picture or a piece of art that has no relation to any controversial subject. If there's something more to Tumblr, I wouldn't know, and there is no reason to assume I would.

People raised not to call others monkeys are not somehow the result of the latest social media fad.

<comment><USER54> It's because you sound like the "check your privilege" crew that tends to congregate on Tumblr. ([http://knowyourmeme.com/memes/check-your- privilege](http://knowyourmeme.com/memes/check-your-privilege))

By the way, the key line from the article you didn't read (yet presume to understand its author's intent): "I have come to the conclusion that OpenSSL is equivalent to monkeys throwing feces at the wall."

<comment><USER8> I did read it, after it was helpfully posted elsewhere. I wish I hadn't. Not surprisingly, it wasn't worth my time.

<comment><USER54> "Not surprisingly, it wasn't worth my time," says the guy conducting multiple conversations in the comments section of an article on the internet that he didn't agree with.

<comment><USER8> Says the person arguing with said guy. Did you have a point other than that you think you're better-qualified to judge how I use my time than I am?

<comment><USER55> Please stop.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER56> Apparently we don't have enough eyeballs.

</comment><comment><USER57> put the text up in a gist, to get around the dodgy cert.

[https://gist.github.com/anonymous/10204608](https://gist.github.com/anonymous/10204608)

<comment><USER58> dodgy cert for read only site + magic verisign fairy dust = unicorns and rainbows?

For future reference you can use archive.org in the future if you are afraid of dodgy certs: [http://web.archive.org/web/20140125144231/http://www.peerebo...](http://web.archive.org/web/20140125144231/http://www.peereboom.us/assl/assl/html/openssl.html)

</comment></comment><comment><USER59> Be security conscious folks. Don't click through to a site with a self-signed cert.

<comment><USER60> There is nothing wrong with self-signed certificates. If you need to trust a website that uses self-signed certificates, just make sure to verify out-of- band.

<comment><USER61> Yes, I trust my own self-signed certs and I _might_ trust the self-signed certs of certain sites. However, telling me that "There is nothing wrong with self-signed certificates." is irresponsible IMO. Who runs "peereboom.us"? #### if I know. I'm going to tell FF "It's okay - I'm good" this time b/c I'm not doing anything that matters but, as a rule, self-signed certs for unknown sites is not okay.

<comment><USER62> Would you trust visiting a site that's just HTTP?

Self signed certs for unknown sites are fine. There is zero problem visiting them.

<comment><USER60> @ScottWhigham I'm not being irresponsible. I'm with ghshephard on this one.</comment></comment></comment></comment></comment>


MIT Admissions Office sets up forum for rejected applicants - <AUTHOR> http://www.mitadmissions.org/topics/misc/miscellaneous/not_admitted_4.shtml <comment><USER2> There is some comedy gold there:

 _"I can't believe this. this is so incredibly ridiculous!!!!!! i'm leader of the debate team, the robotics team, the medical team, the card team, the literary magazine team, the church team, the basketball team, the football team, the science team, the math team, the environmental team, the foot lover's team, the stripper team, the alcoholics anonymous team, the science Olympiad team, the cross country team(i run a 13:30 5k and have placed first in states for the past 3 years),

i speak 13 different languages fluently including Klingon, python, c++, d--, oracle, I knit enough blankets for all the homeless people in quebec, in one night last winter, my stomach can digest grass, i've played multiple concerts in carnegie hall, i found the square of the circle, i have lots of friends(im incredibly popular), my painting of mother teresa's exhumed body is on display in MOMA, i communicate telepathically with my dog, my aunt the queen of england keeps my photo-realistic paintings on her refrigerator,

i've actually attended classes at MIT for the past 5 years even though i live in milwaukee, i tame unicorns on weekends, i worked for NASA for the past 13 summers, i've gone into outer-space, i got a 2600 on my SAT's, 5's on all the AP tests, i have 6.0 grade point average, and i'm black, hawaiian, hispanic, inuit, and native-american!

AND I RIDE A UNICYCLE!!!

i spent three years writing and perfecting my essays for mit: my interview went well, my resume is perfect, i am perfect, i just don't get it!

how didn't i get since i'm obviously so wonderful????? why doesn't mit want robots like me????"_

<comment><USER3> Good and if you haven't read Hugh Gallagher's college admission essay:

<http://www-users.cs.york.ac.uk/susan/joke/essay.htm>

</comment></comment><comment><USER4> My favorite, from an MIT administrator:

 _"Other imperatives might be the need for, say, a good bassoon player for MIT's prized symphony orchestra, or people more likely to be interested in, say, energy studies, as opposed to yet more computer science majors."_

So you founded your own startup at age 15 and sold it to Google? Impressive, but we're more interested in your bassoon skills.

<comment><USER5> There's a difference between "yet more" and "the most impressive"....

As far as I know, MIT has always been good about admitting people who have done things that, by definition, not a lot of people can do (such as place highly in a competition).

But, would a bassoonist or energy-studies focused person be better for the institution than compsci major #201? Probably.

</comment></comment><comment><USER6> This has been done before. Yes, it's a blog post, not a whole online forum. The blogs by the admission officers have become an integral part of MIT's outreach to prospective students.

One of the most useful blog posts by a (now former) MIT admission officer is

[http://www.mitadmissions.org/topics/before/recommended_high_...](http://www.mitadmissions.org/topics/before/recommended_high_school_preparation/many_ways_to_define_the_best.shtml)

One example of important breaking news breaking on the MIT admissions blog was

[http://www.mitadmissions.org/topics/misc/miscellaneous/messa...](http://www.mitadmissions.org/topics/misc/miscellaneous/message_from_ben_and_matt.shtml)

which must have been a very painful entry to write.

</comment><comment><USER7> I applied to MIT for undergrad, and I was thoroughly impressed by the openness of their admissions office. They are miles ahead of most schools I know of in terms of how reachable, responsive & transparent their admissions officers are.

</comment><comment><USER8> They should accept advertisements from CMU, UIUC, and UMich.

<comment><USER9> better yet, they should setup an affiliate link with them. 4% of $40,000/yr for a referral, is not that bad

</comment></comment><comment><USER10> How about a direct link to After Credentials?

</comment><comment><USER11> I'm surprised how soon they get a reply (for admission next fall, right)? I applied for grad school there recently, does anyone know if the chances are better or worse? :)

<comment><USER12> Grad school admissions is basically just done by the profs in your department. Also, these folks applied for Early Admission and get either a yes/no/deferred to normal admissions reply before the end of the year.

</comment></comment><comment><USER13> It's not a forum in a traditional sense, but a blog post.</comment>


Looking for data to make soft hacking of YC application process - <AUTHOR> Hi!
I would like to make soft hacking of YC application process. Lookig for breakdown of companies who made to YC by industry, country, b2b\b2c, Global \ US Market, business stage, product development stage, money raised befor applying, number of employees, number of founders, founders background - for the last 5 batches. I'm usually good at sucessfully entering highly competitive clubs - I made 50:1 to McKinsey, 16:1 to Stanford GSB, 100:1 to Citadel hedgefund. I know that selection triggers exist and numbers work.
  My team was rejected by YC with Moscow-based blockchain fintech b2b company. We checked logs - YC did it just because of our video, nobody never checked the product. So looks like some triggers did not go through - either b2b, or blockchain, or Russia.  Some other accelerators said us that YC is mostly for consumer startups, and Bay area in general is not big on blockchain. So need historical proof, and analyze successful startup cases that have the same pattern. Will appreciate help with statistics - this will help all of us avoiding info asymmetry in the future, and spend our time and efforts wisely.
Thank you
Igor <comment><USER2> I don't know if giving you data about YC applications would be fair.

I can confirm that when I applied, they only looked at our video and never saw our demo/prototype.

Some things I believe help making into YC much easier (but not guaranteed):

\- Female founders or co-founder

\- Very fast and demonstrable traction

\- Large potential market

\- Founders with successful backgrounds (looks like you got that covered)

\--

Stuff that won't help on its own:

\- Interesting / world changing project (unless you have demonstrable traction). They say they invest in idea-stage companies, I believe that only happens with founders with huge exits on their backs.

Note that this is just my own opinion and I did NOT get into YC and I'm still a BigCo employee.</comment>


Ask HN: Should I Open a Bank Account with N26? - <AUTHOR> Friends of mine only swear by them. I'd like to collect your opinions on this online banking service. Is it really that good ? What differentiates it from other such services ? <comment> macaroni-dash I am with N26 but move to comdirect now (based in Germany).

The reason: To be honest, I earn too much money as a software developer to trust a new StartUp with my money. Other reason: I want to invest in stocks which N26 is way too small to offer those kind of services in the near future.

So what is N26 good for? Answer: As a day to day account. Maybe even as your salary account. The pros: Push Notifications, easy transfers (especially to those who are also at N26).

But move big chunks of your income to a different bank. I trust the german regulators, but if shit is going down, I don't trust N26 to call me back and verify transactions etc.

So I would use it as a daily driver, but store your savings somewhere else.

</comment><comment><USER2> why not? it's free, i use it as secondary bank account, though i would not trust them with large amounts of money, but except the trust problem i don't see any problems and their transparent MasterCard had amazing design for people in IT

<comment><AUTHOR> Thanks for sharing your experience with me !</comment></comment>


Rails Security Vulnerability - <AUTHOR> http://blog.heroku.com/archives/2013/1/11/rails_security_vulnerability/

<comment><USER2> I got an email notification indicating the apps I manage were running on old Rails which I don't believe they are having updated them today.

When I push to Heroku I get "Using rails 3.2.11" but the email said one app was on 3.2.1 and the other on 3.2.9. The script they link to says both apps are up to date too.

So don't panic if you get the email and you know you have already updated.

Edit - False alarms acknowledged by Heroku in blog comment:

 _Dominic - Sorry for the false alarm! We collected data on a lot of apps, and ended up notifying some users that had already updated. If you already updated your app, no action is required._</comment>


Sheryl Sandberg's New Job Is to Fix Facebook's Reputation and Her Own - <AUTHOR> https://www.wsj.com/articles/sheryl-sandberg-leans-into-a-gale-of-bad-news-at-facebook-1536085230 <comment><USER2> Even if Facebook actually wanted to change, intended to change and put time, money, and talent to the task this would still be a serious uphill climb. The idea that anyone could rehabilitate their image when they have no such commitment is laughable. Does anyone seriously think what this really isn't just crisis mangement? Every quarter that FB can stave off inevitable backlash and regulation is money in their pocket, even if it's only a decaying orbit. Like the tobacco industry in its day, delay delay delay because thst delay is profitable. If you can't make your product "healthy" without throwing out your product, this is how you act.

<comment><USER3> Facebook is the cigarette of our generation

<comment><USER4> Really? Besides "feeling good" (I assume?), I would be hard pressed to think of a single beneficial thing about cigarette. Facebook certainly has more productive uses than just making you feel good... the question is whether they're worth the downsides.

<comment><USER5> [https://en.wikipedia.org/wiki/Nicotine#Uses](https://en.wikipedia.org/wiki/Nicotine#Uses)

"Enhancing performance: Nicotine is frequently used for its performance- enhancing effects on cognition, alertness, and focus.[38] A meta-analysis of 41 double-blind, placebo-controlled studies concluded that nicotine or smoking had significant positive effects on aspects of fine motor abilities, alerting and orienting attention, and episodic and working memory.[39] A 2015 review noted that stimulation of the α4β2 nicotinic receptor is responsible for certain improvements in attentional performance;[40] ..."

Not that this is how most people use it (esp. because those who do smoke are likely not allowed to do so inside an office building, meaning they couldn't be e.g. programming at their multi-monitor desk while doing it; seems the half-life of nicotine in the body is 1-2 hours, so perhaps it could be net- beneficial to go outside briefly); nor that it couldn't be done via skin patches or other delivery mechanisms.

<comment><USER6> Very interesting - the few times I've had a cigarette, I've definitely noticed a sense of clarity in thinking and alertness. For non-smokers, showers seem to be one of the rare times where one is left alone with ones thoughts to explore, while cigarette smokers may experience this with every smoking break.

<comment><USER7> Yes, I've never smoked cigarettes but I've always envied the way smokers could always just take a few minutes to gather their thoughts whenever they wanted. And smoking as a social activity cuts out all class and other boundaries.

</comment></comment></comment></comment></comment></comment><comment><USER8> To those of you saying Facebook provides no value, here are some concrete examples:

\- In countries where fraud is rampant and people try to sell basic goods on messaging platforms, marketplace allows small business owners and tradesmen to barter goods. This is leagues safer and more efficient than their old methods.

Facebook provides a place where people can plan events and create "websites" for their shops and activities for free via pages. Facebook connects people to their pages and gives people a place to hold forums with public officials without anonymity.

\- Facebook pioneered removing anonymity from a social media platform. On Facebook I can have more accountability and I am more likely to be myself. I can keep in touch with the real people who have passed through my life. I met my wife on Facebook this way.

\- Facebook allows me to stay connected to people I rarely see. I'm still friends with many people from highschool I haven't seen in over a decade. No other platform provided that type of value. Even if we rarely interact, they can always reach me on messenger even if they don't have my phone number.

\- Facebook gives me the ability to hear from people I don't agree with. Instagram and twitter are just echo chambers based on what I like or are just pictures of sunsets. On Facebook I have found that my friends and family often post opinions that I don't agree with during world events. This has led to discourse that has allowed me to broaden my perspective.

\- Facebook's ADs platform allows small business to compete against much larger entities on a small advertising budget through targeted ads. I have joined several hobbyist communities by having ads targeted at me that were relevant to my interests.

<comment><USER9> > Facebook pioneered removing anonymity

Not at all. There are so many fake accounts on Facebook that it's now impossible to tell who is real and who isn't. True, they removed anonymity, but they replaced it with fraud.

> Facebook allows me to stay connected to people I rarely see.

If you rarely see them or interact, how much true value are you gaining other than an abstract sense of nostalgia.

> Facebook gives me the ability to hear from people I don't agree with

Hearing people that disagree with you isn't enough. You need quality to build a rich library of ideas. Facebook does no vetting, giving everyone a microphone regardless of how thought-out or truthful the message is.

> Facebook's ADs

Good advertising on a platform may make the platform less bad, but it doesn't make it good. Who goes to Facebook to enjoy nice targeted ads?

Overall, the biggest issue is the first one. It's now impossible to tell what's real and what isn't on Facebook. The site is rife with bots and hacked accounts, you don't really know if you're talking to a person or someone with a hidden agenda.

<comment><USER10> > > Facebook pioneered removing anonymity

> Not at all. There are so many fake accounts on Facebook that it's now > impossible to tell who is real and who isn't. True, they removed anonymity, > but they replaced it with fraud.

While true, it's also true that for most people, most of their facebook friends _are_ real people using their real name. That's decidedly different from how people use Twitter, Reddit and the like.

<comment><USER9> If just 5% of your "friends" are fake, it ruins any trust you may have in your community, it doesn't need to be anywhere close to a majority. The other networks have similar problems, but Facebook is the worst offender at promoting a false sense of trust.

</comment></comment></comment></comment><comment><USER11> Fixing Facebook isn't a hard problem. Fixing it while keeping advertisers happy is pretty much impossible. If you try to be more vigilant on privacy settings then you give advertisers less choices to target people. And with Amazon moving into the ad market aggressively, and Google being the behemoth that they are the last thing you want is to hurt your advertising platform.

<comment><USER9> I don't think Facebook's problem is legitimate advertisers misusing personal information. Rather, it's the spammers, scammers, bots, and foreign spies that destroy trust in the system. If Facebook could get rid of those (not an easy problem), they could rebuild trust and keep legitimate big-money advertisers happy.

</comment></comment><comment><USER12> I loved hearing Tim Cook's response about the incident "we would never put ourselves in the position of selling our user data". Fundamentally the Facebook business model was flawed & destined to fail. We hope the new generation of applications learn and evolve to better & stronger platforms [https://www.youtube.com/watch?v=tkyH3JRxndc](https://www.youtube.com/watch?v=tkyH3JRxndc)

<comment><USER13> FB does not sell user data and Tim Cook knows this very well. Puzzling that he reduces himself to propagating such FUD.

<comment><USER14> Tim Cook never said that.

When asked what he would do if he were currently faced with the problems confronting Facebook CEO Mark Zuckerberg, Cook said: "I wouldn't be in this situation."

</comment></comment></comment><comment><USER15> "Move fast and repeatedly betray your users' trust" isn't a good strategy, long-term.

<comment><USER16> Their market cap begs to differ I suppose

<comment><USER17> >> "Move fast and repeatedly betray your users' trust" isn't a good strategy, long-term.

> Their market cap begs to differ I suppose

It seems to do OK in the short to medium term.

<comment><USER16> I just mean they are one of the largest companies in the world and don't seem to be going anywhere with the rise of Instagram. It more or less seems that they have had no penalty for using this strategy.

<comment><USER15> Everyone here is aware FB has had a good run. I wouldn't bank on them _long- term_. This stuff does not bode well...

        > Facebook on Thursday posted the largest one-day loss in
        > market value by any company in U.S. stock market history
        > after releasing a disastrous quarterly report.

<comment><USER18> 'Facebook' didn't post any loss, its short-term shareholders did.

</comment></comment></comment></comment></comment></comment><comment><USER19> [http://archive.is/H640P](http://archive.is/H640P)

</comment><comment><USER20> [https://outline.com/5PcXMf](https://outline.com/5PcXMf)

</comment><comment><USER21> There is nothing FB or Sandberg can do to fix Facebook's reputation in my mind. I have deleted most of the content I have posted to FB and keep my account only because I sometimes use Messenger.

<comment><USER22> I esp. would not use Messenger. That would seem to be the "spyingest". But I'm assuming you have someone who is all-in on Messenger you would lose otherwise.

Deleted FB and all content a year ago. Honestly, as I was on my way out, I was beginning to enjoy the "groups" I had discovered. Wish there were a lurker mode....

<comment><USER23> I found such too. But the quality of discussion is sub par even when the original idea was good.

Large share of the people who are still active on facebook seem to be types of people who have very few friends and like to shout their ideas into the abyss. Or alternatively very connected people who promote slogans to mindless crowd of agreeing zombies.

It's mostly result of "your aunt sees what you just said" which means that you rarely see anybody genuinely argue anything. Because the feeling of your aunt briging up your facebook discussion from two years back at summer cottage is not worth it. Facebook is shitty at managing interpersonal connections, kinda weird at this point. Then the lack of dislike button keeps noise levels high from people with no aunts. Even the few actual discussions typically develop into pointless drama.

Reddit has very bad problems with eternal September, but its not nearly brainless if you dig deep enough into subreddits.

</comment></comment></comment><comment><USER24> Seeing as I've never heard of her prior to reading this article, I think the best course of action on her part would be to make a ton of noise doing good things for the community so that it increases the chances of people who haven't heard of her, learning of her through those actions rather than these.

</comment><comment><USER25> MZ (screaming): you broke my Facebook, so you better damn fix it.

CS: Whoah Mark, you know people want me to run for president. I can't scorch my reputation fixing your dumb internet site. Plus enough of my shares have vested for me to leave with my pockets full of loot. It's not like I ever have to work again.

MZ: [redacted]

CS: OK, I'll do it.

What did Mark promise her? Would love to know what deal she cut.

<comment><USER26> He just promised not to publish whatever private FB messages she's been sending... /s

</comment></comment><comment><USER27> But... Who cares?

<comment><USER28> Maybe no one, but please don't post unsubstantive comments here.

</comment></comment><comment><USER29> Paywalled article :<

<comment><USER30> outline.com/[url]</comment></comment>


Twitter via e-mail - <AUTHOR>

I've been looking for a client that can access Twitter via e-mail -- in a convenient way. I didn't want too many emails, so it would have to be summarised. And I wanted the ability to reply.
Couldn't find one, so I wrote one at http://www.mixamail.com/
My reason was that I have e-mail but no Internet access on my BlackBerry.
Just wondering: is this a problem anyone else faces? What workarounds have you used? <comment><USER2> This is pretty neat. Nicely done. Honestly, I never needed a work-around like this but it's always good to have the 'via email' option.</comment>