Ask HN: How do I begin web development without local files? - <AUTHOR> So, for the moment and for the forseeable future, I'm stuck on an iPad and library computers. I know html and CSS relatively well, but I would like to learn how to build a fairly simple web app and database.
Am I stuck? I am primarily using cpanel to write html. It's kind of a bummer, but it works, slowly.
I've begun learning python on codeacademy, but I'm definately not at the point of writing an app with it. I don't even know how to install the thing on a server.
Sorry for the totally clueless post, but even a couple of web apps to google or something would help me out a lot! Thanks. <comment><USER2> Well, if you got a decent hoster, you can get SSH access (or "shell access", it's the same term). Then you can edit on the linux commandline using e.g. editors like vi, joe, emacs or nano.

Bonus point is that you will earn experience in Linux shell usage.

Also, leave your fingers off Python for web. It sucks already enough for commandline, and it's a nightmare for web stuff. Use PHP if you want to do web development, just as everyone other does (okay, Java and ASP.net exist, too, but these are enterprise-level solutions, not available at usual hosters).

<comment><USER3> > Use PHP if you want to do web development, just as everyone other does ...

I can't believe you just recommended PHP to a newbie. This is like recommending Fortran to someone asking about modern scientific analysis software.

In any case, the OP should probably start by learning static HTML design, before moving on to various automation methods. But PHP -- wow. It's like recommending BASIC instruction to a programming student.

<comment><AUTHOR> Hah, this was my impression of PHP. I am fine with static HTML design, I get CSS, tables, and I've set up a bootstrap site or two. I don't know anything about interacting with a database, which (I think) is where I need to go next.

<comment><USER2> For databases, you need a server side programming language. The choices available are basically: PHP (available just f __*ing everywhere, starting at 3€/month!), ASP.net (Windows Server only, also AFAIK needs MS Visual Studio, not sure about that), Java (do not use, do not use, do not use), Python (sucks), Ruby (sucks even worse).

PHP has the widest adoption among hosters and user-bases, also there exist lots of proven OpenSource projects where you can borrow code from (e.g. Wordpress, MediaWiki). The lack of user-base is what discredits Python and Ruby for me, they're just too exotic.

<comment><USER4> Would you mind elaborating on how Python and Ruby suck in ways that PHP doesn't?

There are a bunch of PaaS providers that have free hosting for Ruby and Python projects if infrastructure and cost are a problematic for sroerick. They are both fairly mainstream too, the tiobe index[1] ranks PHP at 4.8%, Python at 4.4% and Ruby at 2.2%. This isn't a perfect measure, but I think it puts PHP, Python, and Ruby in the same ballpark.

[1] [http://www.tiobe.com/index.php/content/paperinfo/tpci/index....](http://www.tiobe.com/index.php/content/paperinfo/tpci/index.html)

<comment><USER2> The TIOBE index is not usable for web development, simply because it is focused on general-purpose programming languages... which include the four "C" variants with 43% of the share. None of these (okay, C# excepted due to MS ASP) is widely used for web development.

Now PHP ranks second behind Java (though I'd guess if you made a strictly web- focused index, PHP would outrank Java!).

For the "Python/Ruby sucks vs PHP" part:

* the user-base is damn small compared to PHP. Go into any web-development agency and ask if someone uses PHP for web-dev and if someone uses Ruby/Python for web dev. The percentage of shops using PHP _will_ be significantly higher.

* Ruby and Python do not originate from web development, but from "normal" programming. Web capability got "bolted on" onto them with CGI and various frameworks, while PHP originated from the Web and only recently acquired usability as a scripting language.

<comment><USER4> I brought up the TIOBE index not as an absolute metric but to show that Ruby and Python are not totally obscure languages and have usage similar to PHP. I think your "go into any web-dev shop" test fails for software of interest to developers here who are developing web applications rather than dynamic sites. The web-specific part of PHP is it's ability to act as a template language, inline with HTML. I don't think this is an advantage for web apps as there is often significant logic and infrastructure other than the user interface and frequently several interfaces are desirable (e.g. API, mobile, and web). Mixing together logic and presentation, that is to say the web-specific parts of PHP, make this goal much more difficult.

Ruby and Python were not originally made for web development, but they have been extremely successful and popular in that role. Twitter, Github, Stripe, and Hulu have significant Ruby components, and Instagram, Dropbox, Mixpanel, Pinterest, and Yelp use Python. There are smart people choosing these languages to build their companies with for a reason.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Have you see Koding? <http://koding.com> . Web-based IDE and terminal access to cloud servers they host for you. I've played around with it a bit and it is really, really cool.

</comment><comment><USER6> Just curious, why can't you get a computer? You'd be better off with even a 10 year old model than an iPad, if for no other reason than having a keyboard.

<comment><AUTHOR> Oh, I actually have a bluetooth keyboard. I also have a chrome netbook, but they end up being about... equal frankly.

</comment></comment><comment><USER7> Try cloud9: http:/c9.io</comment>


Would you find this new "Tool" finding service useful? - <AUTHOR> http://whattouse.com

<comment><USER2> What is the benefit of this service rather then just using Google to find a tool?

<comment><AUTHOR> Discovering new "tools" by following users with similar interests to that of your own.</comment></comment>


Silicon Valley Disrupts Discrimination: Now It's for Middle-Aged White Guys, Too - <AUTHOR> http://nymag.com/thecut/2014/03/tech-ageism-shows-men-what-works-like-for-women.html

<comment><AUTHOR> How do you think the tech/startup world can better diversify?

<comment><USER2> There's a lot that would need to be done. I don't think the answer is just "oh tell companies to hire more minorities/older people/{insertGroupHere}". Something needs to be done to change the perception of intelligence & ability in our country/world, and it probably starts on the individual/family-level. From the time we're born, we have these images crammed down our throats "people who look like this do this", and then many of us subconsciously internalize this and treat this as "the norm". We set our own expectations (internally), and then this gets reflected out externally.

I can only speak from my own perspective as black male in his 20s (so not the age problem described in the article), but it was the fact that I was raised to NOT buy into & instead be critical of stereotypes of "what black males are supposed to do" that I even allowed myself to believe that I could start learning C++ — when I was 10 years old.

Had I spent most of my time watching/INTERNALIZING what's on BET, the news, TV, I would probably feel like there's no chance for me in tech, and I wouldn't even consider it as a possibility — therefore never apply for the job, or apply to college for a CS degree, or subconsciously set myself up for failure.

Mind programming has subtle, but POWERFUL impact on the young developing mind. I'm realizing this all later and all I can say is "holy shit, I'm grateful. Thank you, parents. Bullet dodged."</comment></comment>


NYC Just Converted 10 Payphones into Free WiFi Hotspots - <AUTHOR> http://thenextweb.com/us/2012/07/11/nyc-is-turning-payphones-into-free-wifi-hotspots-10-kiosks-launch-today/

<comment><USER2> But doesn't this hurt private Internet providers? Free wifi damages their ability to succeed in the marketplace.

I said that tongue-in-cheek but that is the counter argument to free or municipal wifi projects.

<comment><USER3> Other city-run free wifi initiatives have actually been run with AT&T. So, in conclusion: I have no idea.

</comment></comment><comment><USER4> Somebody Zero Cool, Acid Burn, and Crash Override - they can now rollerblade up to payphones again.

</comment><comment><USER5> I wonder how long it'll take someone to set up a fake hotspot with an identical name right next to it.

<comment><USER6> This is actually a pretty serious legit concern that I'm surprised we haven't seen a proper solution for.

I feel like there should be some sort of trusted certificates or other method to determine whether or not you can trust the access point and alert the user when they may be moving sensitive info over that network.

<comment><USER7> For a variety of reasons it doesn't really matter if you authenticate the hotspot if the rest of the traffic goes in the clear as unless you also do key exchange as part of the authentication and then use it for protecting your traffic someone could just forward the authentication to a real box and then take over or simply hijack your connection after you've authenticated. There is also the problem of wide deployments like coffee shops making it pretty easy to steal certificates.

WPA Enterprise / WPA2 Enterprise with PEAP (and several other flavors) includes a server certificate as part of the authentication process that you can validate before supplying your credentials. While it's not perfect, you can run public wifi with WPA2 Enterprise and just set the login to guest and a blank password (and say that in the ESSID). That allows anyone to connect but still allows them to authenticate the hotspot and have a fair level of protection from session snooping or hijacking.

Realistically future versions of 802.11 should use some type of system like that for unprotected connections, but they don't seem very interested.

<comment><USER8> Yea, EAP-TLS was one of the oldest EAP methods, and the client certificate is actually optional per the spec, though most supplicants require it (using a dummy cert is the workaround).

</comment></comment></comment></comment><comment><USER9> Hong Kong already does this. Practically all their pay phones are WiFi hotspots operated by PCCW. In fact, it's hard not too find a WiFi hotspot within 100m in Hong Kong.

<comment><USER10> Do you know if the wi-fi coverage is sufficient to where you could ditch having a cell phone? Just use an iPod Touch with Skype + Gtalk or something?

<comment><USER11> wi-fi does not allow you to take calls while driving. So, it's just a question of how much convince your willing to give up to avoid a cellphone bill.

<comment><USER12> My employer has "roaming" wifi. I can walk around, change floors, change buildings and not lose connection. I don't know how they do it. It's very cool.

Compared to... I was contracting at AT&T Wireless for a few months. Worst enterprise IT I've experienced. Getting a desk phone to work was near impossible. No one could access their voicemail. No voicemail - email bridge. The in-house chat/voice conferencing didn't work (stutter, dropped connections, couldn't login). You'd lose wifi connection walking down the hall, requiring full reauthentication for everything (signin, VPN, db connections, etc).

</comment></comment></comment></comment><comment><USER13> Random event: I just walked by one of these (Grand Central-UN area) on my way to the library today and said "Wow. I wonder why I didn't hear about this before...or see it before?" So I started looking for other payphones/WiFi- stations and didn't see one.

Great idea.

<comment><USER14> I wonder if hotels, and other businesses that want to attract taxi drivers awaiting fares, will push to convert nearby pay phones to WiFi, thinking drivers might prefer to wait near a WiFi hotspot.

</comment></comment><comment><USER15> I always wondered why telcos haven't made a business model out of this. It is too late now that 3g/4g is pervasive and fast enough, but for a period of about 7-8 years they could so easily have wired DSL to all those idle pay phones around the city and I would easily have paid $10/month (or more) to have Wifi connectivity when I was out and about.

<comment><USER16> I remember in 2000 or 2001 a company in Chicago negotiated with Ameritech to put hotspots on the top of telephone poles around the city for something like $3/mo. The deal ended up falling through... I think too many parties had to get involved that it just became a nightmare to deal with.

<comment><USER17> You might be referring to Ricochet Wireless. <http://en.wikipedia.org/wiki/Ricochet_(Internet_service)>

</comment></comment></comment><comment><USER18> I'm wondering what some of the legal consequences would be if a project like that were implemented in Europe.

In Germany (and other countries), if you as a private person do not secure your wi-fi, and someone else piggybacks on it to do something illegal (say, download pirated data) you are liable.

What is the situation in the states? If the legal situation is similar, does it make a difference if the open wi-fi is provided by a city rather than a private person? Obviously it wouldn't be piggybacking when the free wi-fi is intended to be used by others, I wonder if that makes a difference. Also, could ToS be used to avoid the liability issue for a city?

Also, in the EU, ISPs are required to store the connection data of all customers for six months. Would a city that provides free wi-fi be considered an ISP and thus have to store all connection data too?

</comment><comment><USER19> The Swedish telco Telia converted all their phone booths to Wifi hotspots a few years ago, but it's a pay service.

</comment><comment><USER20> Ah yes, standing around and taking pictures in the bike lane. Just like everyone else in NYC...

<comment><USER21> ... while the bikers attempting to use the bike lanes get ticketed for riding in the street when a bike lane was available. (yes, this does happen, despite the law saying that a biker can leave the bike lane if an obstruction makes it unsafe to ride within it)

</comment></comment><comment><USER22> If people like the government setting up wi-fi hotspots, would people be open to sharing their wi-fi hotspots (securely) for the chance to roam across other wi-fi hotspots? As in, blanket the city in a grass roots network.

Love to see cities that care about their users..er citizens.

<comment><USER23> I don't feel like having SWAT storm my house at 3am because some idiot posted a death threat using my wifi.

</comment></comment><comment><USER24> The Telekom (parent of T-Mobile) has been doing that as well in Germany, although they are not free. Berlin has probably almost full coverage.

</comment><comment><USER25> I don't get the 'free' bit. I mean a pay phone was just that an opportunity to plug into the communication network for money, why not a 'pay hotspot' ? Now I could see that NYC could create a token system which would make using a licensed paid hot spot practical, but don't see what they are trying to achieve with free access here.

<comment><USER20> _I don't see what they are trying to achieve with free access here._

Probably the same thing they're trying to achieve with free streets, trees, parks, and so on: making the city more livable for those that pay taxes there. (And trust me, we pay a lot of taxes.)

<comment><USER25> Fair enough, I think you can make a reasonable argument that network communication is a basic city service like sewers and sidewalks, so why wouldn't that argument also require a taxpayer funded phone service? If you go the whole basic service argument then not only do you provide a wifi hotspot but you also provide a way for someone to browse the web, send and receive email, and maybe chat at these same kiosks. If you don't provide that then you run into the social justice argument that you are discriminating against the poor who can't afford a smartphone or laptop to hop onto the 'free' WiFi in favor of the rich. Whereas if you charge for the access and dump that money into the general fund (after expenses of course) then its a service fee that achieves a socially acceptable taxation of people with more disposable income to provide services to those without. So do you see my confusion?

<comment><USER20> All I can tell you is that's not how the world works. My taxes pay for a ton of things I can't use; I don't have a car, so I can't drive through the Lincoln Tunnel. That doesn't mean it's not in society's best interest to pay for it anyway.</comment></comment></comment></comment>


A newly discovered film shows Franklin D. Roosevelt, who had polio, walking - <AUTHOR> https://www.washingtonpost.com/news/retropolis/wp/2018/06/27/a-newly-discovered-film-shows-franklin-d-roosevelt-who-had-polio-walking/ <comment><USER2> For those here who've never encountered polio or know survivors of it, it's one of the scariest diseases imaginable. My father's generation was one of the last to commonly grow up with it, and medicine was entirely unable to provide much support to sufferers of the virus. I know he grew up in a large family, and I also know that 2 or maybe 3 uncles and aunts of mine were killed in childhood from it.

One of my uncles also had it and survived, but was crippled for the rest of his life. He was able to get around okay with braces and a cane until his mid-50s. And then the trauma from the disease finally caught up to him and he spent the rest of his life as a paraplegic with breathing troubles that finally killed him in his early 70s.

My father may have caught it, but was able to fight it off. He also has Guillain-Barré syndrome and attributes it to that period.

Medicine was so unable to cope with the volume and severity of the patients during the 30s and 40s that "alternative" remedies came into full fashion. In 1949, a researcher named Fred R. Klenner claimed to have found that high doses of vitamin-C could ward off the virus. As a result households stricken with polio often found themselves stuffed to the gills with donations of fruits, vegetables and strangely goats as it was believed that goat milk had high doses of the vitamin.

Salk's discovery of the vaccine, the trials around it and the mass global uptake afterwards have _almost_ rendered the virus extinct. But it could almost never happen today.

<comment><USER3> > . In 1949, a researcher named Fred R. Klenner claimed to have found that > high doses of vitamin-C could ward off the virus.

This was referenced in an episode of the tv show House

> the mass global uptake afterwards have almost rendered the virus extinct.

This is one of the things India (and from what I've heard, Pakistan) did really well. Every year around vaccination time (there used to be two doses taken around a month apart) there used to be almost propaganda like mass advertisements, camps, etc. When I was a kid I knew of a handful of older people that had polio; a kid born today is unlikely to meet someone with polio. Unfortunately, a very small minority is trying to argue that polio vaccination is a conspiracy by [pharma companies | government | rich people] :(

<comment><USER4> _Unfortunately, a very small minority is trying to argue that polio vaccination is a conspiracy by [pharma companies | government | rich people] :(_

Not without some justification: [https://www.theguardian.com/world/2011/jul/11/cia-fake- vacci...](https://www.theguardian.com/world/2011/jul/11/cia-fake-vaccinations- osama-bin-ladens-dna)

This CIA-backed program should have been seen (and prosecuted) as a crime against humanity, but for some reason, it wasn't.

<comment><USER5> But the anti-vaccination movement is arguing that _real_ vaccinations are a conspiracy - the post you linked is about CIA agents infiltrating a vaccination program in order to attempt to verify Bin Laden DNA in a local population.

I've read several articles about this incident and none of them claim the vaccines themselves were tampered with, or poisoned, so it seems neither the article or the operation described support the premise held by anti-vaxxers that vaccinations either don't work or are actively and intentionally harmful.

<comment><USER6> The antivaccination weirdos never got to see my grandmother (in NZ, a western country) walk in a leg brace her entire life, they are dangerous, we don't shame them enough

</comment></comment></comment></comment></comment><comment><USER7> He was able walk for short distances, but only with difficulty and a lot of pain. He often used a cane to help him out.

Winston Churchill records seeing Roosevelt slowly walk over to greet him, and knew how difficult it was for Roosevelt to do that.

<comment><USER8> That's what the article is about, and what the film shows. Apparently there wasn't this kind of footage before.

</comment></comment><comment><USER9> Youtube link: [https://www.youtube.com/watch?v=BYN1apQHPx0&feature=youtu.be](https://www.youtube.com/watch?v=BYN1apQHPx0&feature=youtu.be)

</comment><comment><USER10> > Roosevelt was left permanently paralyzed from the waist down. He was > diagnosed with poliomyelitis at the time, but his symptoms are more > consistent with Guillain–Barré syndrome (GBS) – an autoimmune neuropathy > which Roosevelt's doctors failed to consider as a diagnostic possibility.

[https://en.m.wikipedia.org/wiki/Franklin_D._Roosevelt%27s_pa...](https://en.m.wikipedia.org/wiki/Franklin_D._Roosevelt%27s_paralytic_illness)

</comment><comment><USER11> The footage was less surprising to me than the fact that Photographers and cameraman had the upmost respect and empathy back then to not video or photograph him walking or getting out of a car or such.

In this day n age there is absolutely 0 respect because negative news sells.

</comment><comment><USER12> Ok, I have to ask, what kind of camera was that? Did we really have film cameras small enough that could be casually carried by tourists in 1935?

<comment><USER13> My guess would be a Kodak 16mm handheld. The Cine-Kodak Model B was introduced in 1923 and a few subsequent models had been released by 1935: [https://en.wikipedia.org/wiki/Cine-Kodak](https://en.wikipedia.org/wiki/Cine- Kodak)

</comment></comment><comment><USER14> FDR often leaned on people's arms to get support so he could appear to be walking or standing. In this video he does it too.

</comment><comment><USER15> If you saw Ken Burns' series on The Roosevelts, there was plenty of film of this.

FDR had developed a way of moving stiff legged in his braces. It was painful and difficult.

</comment><comment><USER16> Url changed from [http://time.com/5325424/video-president-roosevelt- walking/](http://time.com/5325424/video-president-roosevelt-walking/), which points to this.

<comment><USER17> The Washington Post link is subscription-only at least for users in Europe, and the video itself is hosted on YouTube. It should probably be reverted to the original link

<comment><USER8> [http://archive.is/DuM4w](http://archive.is/DuM4w)</comment></comment></comment>


Chrome gets a new look for its 10th birthday - <AUTHOR> https://techcrunch.com/2018/09/04/chrome-gets-a-new-look-for-its-10th-birthday/ <comment><USER2> One thing I wish was configurable is how the ominbar now shows both titles and links. I navigate by link and would like to disable the presentation of titles.</comment>


BOS Ice Tea from South Africa has an unbelievably good website - <AUTHOR> http://bosicetea.com

<comment><USER2> Do you work for them?

The design of the website is visually quite appealing, but a total no-go in today's world is a business website _totally_ based on Flash. I'm no flash- hater, but the webpage in question is excluding a lot of people by using flash-only.

I also made sure to navigate around the page, which proved particularly difficult because the navigational elements are very hard to find within the flowers (same color, same style). One should not try to find navigation elements, they should just be _there_ and pop out.

</comment><comment><USER3> It's like their PHB said "you know what's never been done before? a ROUND website! Make it so!"

</comment><comment><AUTHOR> Be sure to navigate around from the front page to see the amount of care that's gone into the individual interfaces.

</comment><comment><USER4> You're right, I don't believe that's a good website. It's all gimmick.</comment>


Ask HN: Which newspapers do you read? - <AUTHOR> <comment><USER2> "De Tijd" I pay for.

It's Belgian/Dutch and more economical focused

</comment><comment><USER3> I read over 20 newspapers in 4 different languages: german, french, arabic and english. The more and diverse I read, the better I understand what's happening.

I came to the conclusion, that what counts is not how left wing, right wing or neutral a media is. It's understanding the dynamics of power and geopolitical issues, who will benefit from specific news, who is likely pushing for that news to be published. Keep an open mind about each media you consume and try not to be passive by consuming only.

</comment><comment><USER4> None.</comment>


A deep understanding of reality is exactly the same thing as laziness - <AUTHOR> http://dilbert.com/strips/comic/2011-03-20/

<comment><AUTHOR> I know hacker news isn't the place I'd usually post comics, but I found something about this to be profound. I joke a lot about being proud of being lazy, or that the best programmers are the laziest, but "lazy" is a really loaded term. I think the punchline captures it perfectly:

"A deep understanding of reality is exactly the same thing as laziness. Have you ever seen a statue of buddha jogging?"</comment>


Covid19 DIY Face-Mask - <AUTHOR> https://mask-id.web.app/EN.html <comment><USER2> From what I read, these are only useful if you're sick and trying to reduce transmission. While they're better than nothing, they're not better than proper masks. [1] Isolation, social distancing, covering your mouth/nose correctly when you cough/sneeze and handwashing are more effective measures. [2]

I don't imagine that these DIY masks should be used more than once (as is the case with most masks), so you'll probably need to make a lot of them.

[1] [https://www.researchgate.net/publication/258525804_Testing_t...](https://www.researchgate.net/publication/258525804_Testing_the_Efficacy_of_Homemade_Masks_Would_They_Protect_in_an_Influenza_Pandemic) [2] "Should I wear a mask to protect myself?": [https://www.who.int/news- room/q-a-detail/q-a-coronaviruses](https://www.who.int/news-room/q-a- detail/q-a-coronaviruses)

<comment><USER3> > From what I read, these are only useful if you're sick and trying to reduce > transmission.

Governments have been telling this, as well, but it cannot be 100% true. I supposed it was a white lie to prevent people from stockpiling.

Otherwise, there would be no use in medical personnel using masks.

I can understand that face masks might not be the best measure for healthy people, I can understand that they might not be super-effective, I can also understand that only certain types of masks are effective, but I cannot rationally believe all masks are completely useless.

<comment><USER4> Surgical-style masks are designed to catch droplets from the wearer, and therefore prevent the wearer infecting others. They are _not_ useful in the reverse direction, only those other super-tight masks are.

So if you are healthy right now, you should probably not be wearing a surgical mask. However there is a use for healthy medical professionals wearing a surgical mask, which is to prevent them from becoming a vector for the virus as much as possible. Since a medical professional may see many patients in a day, and only days later learn that one of their patients was infected (and therefore they may be also), the surgical mask will be moderately effective at preventing infection of the numerous people they have seen in the meantime.

Hypothetically it would be great if we could all wear masks for the protection of others, such as they have been doing in Taiwan (amongst other places). However, the shortage of masks means that we should deploy them where they are most effective, which is medical professionals. (Taiwan actually mobilised their military to ramp up mask production, it's not like they just magically had enough masks for everyone).

<comment><USER5> Surgical-style masks catch droplets going in either direction (of course) -- whatever protection it offers going out it offers going in as well, which is fairly obvious from a basic analysis. Of course it won't protect against individual viruses, but for many vectors that are not actually airborne but instead are in relatively large airborne droplets of fluid -- including this virus -- it can be of some use. Certainly better than nothing.

As a secondary benefit it stops you from touching the critical areas of your face. Given that we touch our face hundreds to thousands of times a day, a few adjustments of a mask aren't going to offset that.

The myth that the mask purely protects others is a myth that needs to die. At this point it is truly destructive.

Given that a surgical mask is only of limited protection, and not total protection, of course in actual contagion situations medication professionals should have something _much_ better. Though we're in a situation right now where the CDC is telling medical professionals to fashion masks out of bandanas.

But when you see the streets of China where everyone is wearing surgical masks, or you see some old person walking around with one, note that it absolutely does reduce their risk. Not anywhere close to completely, but to some degree.

<comment><USER4> It is a nuanced issue though. There are recommendations from the World Health Organisation which say that in a community setting, for a well person "a medical mask is not required, as no evidence is available on its usefulness to protect non-sick persons", but that a person with respiratory symptoms _should_ wear a mask [1].

In a medical setting (or very close contact, like a few metres or so) they do help in both directions, this is standard "droplet precautions" one usually takes with a patient.

So while I agree with you that it does help in the medical setting, there is really no evidence that wearing a mask on the street protects yourself, rather than protecting others.

[1]: [https://www.who.int/docs/default- source/coronaviruse/advice-...](https://www.who.int/docs/default- source/coronaviruse/advice-on-the-use-of-masks-2019-ncov.pdf)

</comment></comment></comment></comment></comment><comment><USER6> If you just want a surgical type face mask, you can always do this [https://www.youtube.com/watch?v=aNjpH5lBZ8w](https://www.youtube.com/watch?v=aNjpH5lBZ8w) which is even easier to make.

Yes I know it's not the best filtration. I know it's also not sealed like it should be. It's not a respirator.

But at least it should keep some obvious droplets in/out. And it's still "better than nothing at all".

Bonus, also explaining how to make a quick DIY face shield.

</comment><comment><USER7> Simple Respiratory Mask[1]

[1] Emerg Infect Dis. 2006 Jun; 12(6): 1033–1034. doi: 10.3201/eid1206.051468 [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3373043/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3373043/)

</comment><comment><USER8> Everyone not sick should be using Respirators classified as N95 / FFP2 / FFP3 or Half Mask with same class filters. This DIY is suitable only for already sick.

<comment><USER9> Ideally, yes, but if you didn't have a suitable respirator already you're going to have a hard time finding one now.

<comment><USER6> As some other people mentioned in other threads, aliexpress seems to be restocked on some "alleged" FFP2 and shipping them including express shipping with DHL. Risky and expensive bet tho.

[https://www.aliexpress.com/item/4000768665097.html](https://www.aliexpress.com/item/4000768665097.html)

<comment><USER10> China ramped up their production and now that the coast is (mostly) clear there, we we're bound to see this.

I've ordered a bunch at about $0.50 and if I get the order, I'll be driving most of them over to one of the local hospitals in Seattle.

</comment></comment></comment></comment><comment><USER11> [https://smartairfilters.com/en/blog/best-materials-make- diy-...](https://smartairfilters.com/en/blog/best-materials-make-diy-face- mask-virus/)

I was concerned with the use of cotton but there's room for flexibility.

Still.

Don't make masks so you can hang around outside for hours like you used to.

</comment><comment><USER12> Some furnace filters claim to filter viruses(e.g. filtrete 1500 and higher from 3M) and seem to still be available in stores/amazon. These should be repurposed for higher priority users. (Preferably with a better seal than this.)

<comment><USER13> From filtering point of view viruses are dust particles of roughly 100 nanometers in diameter and aerosols. Lots of filters are designed to filter this stuff, pretty much all ultrafine particle class filters.

</comment></comment><comment><USER14> For this purpose you can just use a scarf, put it over mouth & nose. It doesn't filter what you inhale, of course.

</comment><comment><USER15> What about those cotton pads women use to remove makeup?</comment>


Ask HN: Why aren't we using paired keys instead of passwords for authentication? - <AUTHOR>

I don't know why we don't have paired key support built into browsers, and extensions built for major web languages.
For users, it may seem similar to OpenID (sign in with google/facebook/twitter, etc.) but the public key could be provided automatically by the browser.
Of course, there may be portability issues, but with the availability and prevalence of smart phones, tablets, etc. and with the increasingly common "browser sync", I'm sure that could be easily dealt with.
So if anyone is working on this, where are they, and if not, why not? <comment><USER2> You can. You install a client certificate and configure your web application to demand that certificate during the TLS handshake. It works fine.

The reason it doesn't get used in practice is similar to the reason why HTTP Authentication doesn't get used in practice: login is something many apps want to keep control over, and delegating that feature to browser chrome (either in the form of the HTTP Authentication popup, or the [even worse] certificate selection UI) makes it difficult to control login, provide password reset, display user help, &c.

Over the medium term, expect to see 2FA products filling this gap. The phone- based 2FA products all allow web app developers to control their own login UX while mitigating the password vulnerability.

The incipient success of 2FA solutions is also a reason I wouldn't bet on browser-based public key authentication or federation happening; the latter solutions are competing with a more pragmatic, simpler alternative.

</comment><comment><USER3> Mozilla Persona is basically this, plus usability and fallbacks for older browsers.

</comment><comment><USER4> Because paired keys aren't user friendly to a non-developer. Which is most people in the world.

<comment><AUTHOR> In the current incarnation, no they're not, but built into the browser? The user wouldn't need to see anything more than a "sign in with you private key" button, next to the "sign in with google" button.

<comment><USER5> Handling them in the browser is a good idea, but still needs a lot of work to make it workable:

\- What happens when their computer crashes?

\- How do they transfer these certificates to other devices (multiple computers, phones, tablets, etc)?

\- How do they keep them in sync across multiple devices if they need to regenerate the certificate?

\- Certificates would be super easy to steal once you get access to a device (arguably easier to steal than installing a keylogger to get passwords)

The only way I can see it working for most users is through a third-party management solution (Google, iCloud, whatever).</comment></comment></comment>


Inside a Fake News Factory: 'This Is All About Income' - <AUTHOR> http://www.nytimes.com/2016/11/25/world/europe/fake-news-donald-trump-hillary-clinton-georgia.html <comment><USER2> This whole war on fake news thing bothers me. It leads to giving unprecedented power to private corporations in controlling what people are able to see and hear.

The other thing is that the US media is far from perfect as well. I can point to plenty of articles in the BBC, NYT, the Economist and WaPo that are classified as News--not OpEds--that ignore science, are politically motivated, and would loosely qualify as "fake news," or at least OpEds.

During the election cycle, I know a lot of people that were personally very turned off by the DNC corruption, yet US media coverage was scarce. When I type "DNC corruption" into Google and DuckDuckGo, there are no results on the first page from major media outlets. When I search site:nytimes.com "DNC Corruption" the first result is from 1860. The second is "Can we trust Julian Assange...?" I could keep going, but the point is, this is terrifying.

Censorship by private corporations and government is not the answer.

<comment><USER3> 1860? What are you talking about?

> site:nytimes.com DNC Corruption

> Debbie Wasserman Schultz to Resign DNC Post - The New York Times (Jul 24, > 2016)

> D.N.C. Hack Raises a Frightening Question: What's Next? - The New ... (Jul > 29, 2016)

> Released Emails Suggest the D.N.C. Derided the Sanders Campaign ... (Jul 22, > 2016)

> After Lying Low, Deep-Pocketed Clinton Donors Return to the Fore ... (Jul > 28, 2016)

<comment><USER4> Just because they play both sides of the field doesn't add credulity to the objectivity of their coverage.

I am so jaded to believe that both sides pay them for coverage. Either in money or political favors.

<comment><USER5> The weird thing is, it doesn't seem to have affected the election at all. From the article:

> He set up a website, posted gushing stories about Hillary Clinton and waited > for ad sales to soar. "I don't know why, but it did not work," said the > student, Beqa Latsabidze, 22, who was savvy enough to change course when he > realized what did drive traffic: laudatory stories about Donald J. Trump > that mixed real — and completely fake — news in a stew of anti-Clinton > fervor.

> But he, too, discovered that writing about Mr. Trump was a "gold mine."

> "It's all Trump," Mr. Egan said by telephone. "People go nuts for it."

Is it possible fake Trump news was the result, and not the cause, of Trump's appeal to the American people ? There's more in the paragraphs below that makes one think this is the case.

</comment></comment></comment></comment><comment><USER6> This may be a cynical take on things, but it seems to me that the 'fake news factories' figured out that the core product of a political website is confirmation of existing beliefs, then 'unbundled' it from everything else.

<comment><USER7> Unbundled from reality. Tied to profit.

It's an environment where they can rapidly iterate on what the most "click- worthy" stories are and dial in the content to meet audience expectations.

This is worse than the pure sugar being fed by useless news organizations like CNN where their coverage has almost zero informational value. This is like heroin where it's actively feeding wild misconceptions.

<comment><USER8> I find it funny how globalism is leaking back into the US in unexpected ways; who would have thought twenty years ago that a Georgian citizen would take flak for derailing a US election by producing pulp news? It was always supposed to be the American eagle spreading its freedom to the world who gratefully welcomed it with praise, they weren't actually supposed to influence the US back!

<comment><AUTHOR> Some geopolitical irony here. Georgia has been trying join NATO; President Trump will quite possibly recognize Georgia as being in the Russian sphere of influence.

</comment></comment></comment></comment><comment><USER9> Surprise! All for-profit companies exist with making money as the highest priority. As idealistic software engineers we're programmed to think of everything as a mission, but as soon as you look higher at most post- investment companies you'll see it's about money even if leadership doesn't believe that itself. There may be an ideological honey moon period but as soon as there's a bump/loss in confidence cash is king without fail. One counter example is a bootstrapped solo entity because there is no external authority/commitment to maximize shareholder value for anyone else, so they can burn money if they want.

A good way to confirm this in job interviews is to bring up B Corps in response to the founding/mission part of the pitch and watch them say it just hasn't been a priority. A B Corp is a certified for-profit company with a mission built in beyond quarter-over-quarter growth. If they really believe in their mission they should certify as a B Corp, if they're not and they're hiring with recruiters--implies some level of cash on hand, readiness to grow --it's lip service. I should note this isn't a deal breaker if they can pay, I just like to know who I am working with. In time I'd like to prefer employment from B Corps.

</comment><comment><USER10> It looks like the 'real news' is going to go down with the ship because the only response they have to discretization of there reporting is to double down on there false narrative.

I stopped reading mainstream media and watching TV many years ago because I consider 80% of what they report to be misleading, misinformation and yes 'fake news'.

The corporate media has finally lost the ability to control the public discourse. That was the only real value they still had to the handful of oligarchs that own them.

Nazi Frogs, Russian hackers, Fake news factories and what ever else they come up with next is not going to save them.

</comment><comment><USER11> So how is this different from say SNL perpetuating the false notion that Sarah Palin said she could see Russia from her house? Call it satire and you're free to propagandize all you want. Only after the anointed candidate of the power lost, must we examine the means by which propaganda (specifically that we find unfavorable) is disseminated. Fake news is the crop you reap when you show mass censorship. Trying to double down on the censorship will only hasten your irrelevance.

<comment><USER12> It's almost as if satire isn't propaganda at all. Weird, that.

</comment></comment><comment><USER13> Well, how is this different from the old supermarket tabloids? I vividly remember bat boy.

[https://en.m.wikipedia.org/wiki/Bat_Boy_(character)](https://en.m.wikipedia.org/wiki/Bat_Boy_\(character\))

</comment><comment><USER14> So, real-world Onion News?

</comment><comment><USER15> Just a different kind of spammers. News spammers.

<comment><USER8> True enough, but the damage is more nebulous and potentially greater. Also, will bag of words work well for news?

<comment><USER15> No, no, today we use bidirectional LSTMs with word embeddings. They work so much better.

</comment></comment></comment><comment><USER16> 'Fake News' took our jobs!</comment>


Apple did not invent emoji - <AUTHOR> https://eev.ee/blog/2016/04/12/apple-did-not-invent-emoji/ <comment><USER2> Who ever said, or thought, they did?</comment>


Proliferation of hydrocarbon-degrading microbes at the bottom of Mariana Trench - <AUTHOR> https://microbiomejournal.biomedcentral.com/articles/10.1186/s40168-019-0652-3 <comment><USER2> Are there practical uses for "hydrocarbon-degrading" microbes? Like cleaning up oil spills? Or eating the plastic that the oceans are filling up with?

<comment><USER3> Oil is constantly spilling into the ocean at small rates, and has been for eons. Without these bacteria it would build up forever, fortunately as long as the rate of introduction is not excessively high it gets metabolized.

<comment><USER4> Could you inject these microbes directly into oil wells, perhaps in drilling fluid, to prevent extraction of said oil?

<comment><USER3> The microbes are one step ahead of you. Apparently, "Accumulations of biodegraded oils are abundant and have been a problem for petroleum production since the beginning of commercial oil production." [0]

[0][http://www.scielo.br/scielo.php?script=sci_arttext&pid=S1517...](http://www.scielo.br/scielo.php?script=sci_arttext&pid=S1517-83822008000300007)

<comment><USER4> The challenge is now how to ramp this up if we're not willing to leave oil in the ground voluntarily.

<comment><USER3> According to this[1] paper, the bacteria are already essentially everywhere and the process is limited by the presence of water.

[1] [https://www.sciencedirect.com/science/article/pii/S187167841...](https://www.sciencedirect.com/science/article/pii/S1871678418316935)

</comment></comment></comment></comment></comment></comment><comment><USER5> "...three _Alcanivorax_ species that were isolated from 10,400 m water supplemented with hexadecane were able to efficiently degrade n-alkanes under conditions simulating the deep sea, as did a reference _Oleibacter_ strain cultured at atmospheric pressure."

</comment><comment><USER6> Interestingly the "Hadal zone" being referenced in the article is based on the greek myth "Hades":

[https://en.wikipedia.org/wiki/Hadal_zone](https://en.wikipedia.org/wiki/Hadal_zone)

> The cumulative area occupied by the 46 individual hadal habitats worldwide > is less than 0.25 percent of the world's seafloor

</comment><comment><USER7> Would bacteria from that region tolerate normal atmospheric pressures?

<comment><USER8> Eight orders of magnitude pressure difference, not likely in one generation.

<comment><USER8> yep that is wrong.

mistook 1 *10^8 Pa as, times "pressure atmosphere".

it is only three orders of magnitude greater psi

<comment><USER9> Three orders of magnitude qualifies as "a hell of a lot" in any reasonable estimate.</comment></comment></comment></comment>


AMD Presents New Horizon (live) - <AUTHOR> https://www.youtube.com/watch?v=4DEfj2MRLtA <comment><USER2> Now finished.

Curious to see what's going on at Intel HQ right now.</comment>


Bitbucket partial outage! - <AUTHOR> http://status.bitbucket.org/incidents/0rx8zyn68fjq

<comment><AUTHOR> Any idea how big this partial outage is?</comment>


Interview with Johnny Lee - the guy who hacked the Wii remote - <AUTHOR> http://hackedgadgets.com/2008/01/08/interview-with-johnny-lee/

<comment><USER2> Check the foldable display project too, it's amazing: [http://hackedgadgets.com/2007/11/14/foldable-displays-and- au...](http://hackedgadgets.com/2007/11/14/foldable-displays-and-auto- projection-calibration/)

</comment><comment><USER3> Why this guy is not doing a startup I cannot figure out.

<comment><USER2> Some data from his cv: \- He has 7 patents (some of those owned by Mitsubishi) \- He got over $ 600k on license fees and sales revenue from institutions. \- His small business Little Great Ideas Inc. got $250 k in gross sales. Sounds similar to startup'ing to me...</comment></comment>


UBlock Origin vs. Adblock Plus – Poll - <AUTHOR> https://twitter.com/firefox/status/848973594772226048 <comment><AUTHOR> Help us show everyone that Constructive Adblocking beats Destructive Adblocking by casting your vote!

<comment><USER2> ...You're not going to like the results.

Edit: A glance at said results is making my point fairly well. It would appear that when you try to make money blocking only _some_ ads, people... don't like that in their ad "blocker". When that blocker is a bloated CPU/Memory hog compared to the competitor which _doesn 't_ show you ads...

...

....

.....

You can see how this is going right? Maybe your strategy would have worked 5 or 10 years ago, before malware, loud ads, endless tracking and other miserable practices burned us all so thoroughly out on ads. When those practices had us by all by the balls, "This is unfair!" "This will end badly!" was roundly ignored.

Now that people have _options_ , suddenly it's, "We're all in this together guys! Lets be cool about this."

<comment><AUTHOR> As you mentioned we are indeed making money, after all, we're a normal business! However, 92% of all websites get to implement our solution entirely for free, and we're taking a cut from the earnings of the remaining 8% (the really big ones) based on what they earn via Acceptable Ads as those require a lot of work.

Tests were carried out on older versions of uBlock and ABP, so there's no telling if what you mentioned is still the case. For us, it's not all about a couple of seconds saved per year (this would be all you'd ever possibly save).

I'm sure we can both agree that there are many unacceptable ads - like some of the ones you mentioned - but as you mentioned people have options, which is exactly why users will always have the option to turn everything off if they don't agree with us on acceptable ads!

<comment><USER2> You are a normal business, monetizing users for a slice of dwindling ad revenue, but you're competing with something that _isn 't_ a business and doesn't monetize its users. That's... kind of the problem right there. People who use ad blockers are not looking for a compromise by committee which is out of their control, and people who don't use ad blockers don't even know you exist. Worse, new users of ad blockers are inevitably told to look into options such as your competitors, because they offer a more complete service without monetizing you. The only market for your product is defined by its desire not to use a product like yours, and the rest don't know you exist.

So, I understand your position... namely that someone lacking in foresight probably "suggested" that you engage on some social media platforms, with predictably tragic results. I'm sure there's a slice of the market that still uses IE or has really bought into the notion of a "community spirit" around advertising, but that is not a growing market.

Frankly I'd just keep a low profile and hope that existing users don't realize that they have options.</comment></comment></comment></comment>


Anyone want to buy rdio.com? - <AUTHOR> http://www.rdio.com

<comment><USER2> Men lie women lie the numbers don't whats the numbers for this site break it down who what when where why</comment>


Ask HN: Liberal arts colleges with strong CS programs? - <AUTHOR> An education colleague put out this request on Twitter:
"My daughter wants a computer science program at a liberal arts college, & we'd love suggestions of schools she maybe hasn't heard of. Anybody?"
The responses thus far are from a non-technical crowd. Thought the audience here might be able to help.
Thanks! <comment><USER2> Checkout the College of Wooster. My son is double majoring in mathematics and computer science and I've been really impressed with the quality of their program.

<comment><AUTHOR> Once upon a time I went to a basketball camp at the College of Wooster. Thanks for the suggestion!</comment></comment>


Being less friendly to advertisers insulates Snapchat from viral hoaxes - <AUTHOR> https://www.bloomberg.com/news/features/2017-10-26/how-snapchat-has-kept-itself-free-of-fake-news <comment><USER2> Snapchat is my favorite social network because it is too difficult to spread political opinions or share clickbait articles. The only easy things to do on it are to record a funny video and share it with your friends.

I can comfortably open Snapchat knowing I'm not going to be confronted with low-effort shares of third-party content or lazy copy+pasted political memes. Sharing that content is certainly possible to do in Snapchat, but it is difficult enough to discourage people to do so.

I certainly like to hear other political perspectives --because of my past career I have lots of friends with opposite opinions from the Bay Area prevailing beliefs. I just prefer it to be on my own time and not in the cheap clickbait reductive fashion popular on Facebook and Instagram.

If only Snapchat were profitable. I really hope they pull it off.

<comment><USER3> Email, regular chat and other low-engagement channels have also the same advantage of being viral-free.

<comment><USER4> Just don't forget to re-send this email to ten of your contacts or Hotmail will delete your account.

<comment><USER5> Can I combine it with the one about Bill Gates donating $10 per forwarded email, or does it have to be separate forwards?

Please clarify, happy to do either.

</comment></comment></comment></comment><comment><USER6> > _Sheryl Sandberg: "The responsibility for an open platform is to let people > express themselves. We don't check the information people put on Facebook > before they run it, and I don't think anyone should want us to do that."_

What a bunch of lies. Try posting a nude pic on Facebook and see what happens.

If they can check for nudity why wouldn't they check for "fake news"? Non-porn nudity is free speech, more than fake news. But fake news are viral and efficient at engaging people, while nudity scares advertisers away.

Everything Facebook does is business-oriented -- which is fine, maybe, and probably inevitable. But them lecturing us about morals makes me incredibly angry.

<comment><USER7> How does one check for 'fake news'? Its easy to throw around these words but they lack meaning and value. Rumour mongering is as old as society itself, global platforms amplify impact.

This kind of paranoia about 'fake news' ends up in the 'ministry of truth'. There is no other alternative.

<comment><USER8> >How does one check for 'fake news'? Its easy to throw around these words but they lack meaning and value.

Fake news has a well defined, explicitly understood meaning - the presentation of falsehood as legitimate news, and its virality on the web, particularly in social media.

Merely biased news isn't fake news, nor is news for which the facts are initially misunderstood at the time of reporting fake news.

<comment><USER9> Agree there are lots of clear cut cases. But, for example, would you consider articles that are talk about climate change (either for or against it's existence) fake or biased news?

<comment><USER10> Climate change might not have been the best example as its a closed and shut case from a scientific perspective. Maybe the merits of doing anything about it would be a better example?

<comment><USER9> Actually I chose that specifically because I think that it is a "closed and shut case". Yet many right leaning outlets like Fox News or National Review routinely cast doubt on this. Do you think they should be considered Fake News? Who gets to make that call?

<comment><USER11> "Fake News"ness can have article level granularity. Fox can have perfectly accurate reporting of an event, and then still be considered fake when they incorrectly state that there is "controversy" over global warming

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> > Being less friendly to advertisers also insulates the service from viral > hoaxes and propaganda

Not being a news platform also helps a lot.

<comment><USER13> Snapchat has an entire section dedicated to news (with a quite liberal use of that word). I get my sports news from the ESPN and Bleacher Report discover stories. NYT, WashPo, WSJ all do stories in the discover tab as well.

</comment></comment><comment><USER14> Snapchat has also avoided the GMO debate, by not being food.

<comment><USER15> I guess that also means Snapchat is gluten-free.

<comment><USER16> I got that mad cow on Snapchat, though.

<comment><USER17> just unfollow your girlfriend

</comment></comment></comment></comment><comment><USER18> Doesn't this has something to do with demographics? Most platforms have tried and expanded beyond the core social media demographics.

A lot of people, currently company included, still don't get Snapchat. While it might have younger audience and "engagement numbers" I am not sure if it is the place for fake news yet.

Turn this around to fake celebrity news or hoaxes and let's see how Snapchat fares.

</comment><comment><USER19> I'm not a snapchat user and I'm tired of using Facebook and WhatsApp.

Something I realized about the difference between these platforms (Instagram being an exception) is that Facebook benefits from the click bait fake news articles on FB and WhatsApp whereas Snapchat benefits from its users sharing the most valuable moments (no matter how quirky or lame they may seem) that wee recorded on the phone.

That's the reason why Snapchat users don't talk about Apple Cider Vinegar as a solution to all health problems and many Facebook/WhatsApp users do :)

</comment><comment><USER20> By not having news at all perhaps?

What a weird setup of an article.

<comment><USER21> Snapchat is full of "news".

I just opened the app and swiped one panel to the right, here are some of the "news" cards I can view:

      The New York Times
      The Washington Post
      Wall Street Journal
      Daily Mail
      ESPN
      NFL
      NBA
      National Geographic
      Bleacher Report
      Wired
      BuzzFeed
      IGN
      VICE
      Mashable
      Cosmopolitan

<comment><USER20> It seems you're partially right. My bad.

Between posts from my contacts, there's seemingly a "featured" section which I've unconsiously have ignored, just like I inadvertently started to ignore banner ads in the 90s.

My mind just don't _see_ noise like that any more.

I guess that's not exactly _representative_ though and some people may be using this weird news-feature in what is essentially an IM app.

</comment></comment></comment><comment><USER22> This webpage is physically painful to read.

</comment><comment><USER23> Who upvotes this kind of article, btw? You know that fake news means "stories that the current encumbment doesn't like" in contrast to "stories that the current encumbment likes" which is then called news. For you as the reader one is not more helpful or valuable than the other. Having both is what we call free media.

What this says is that Snapchat is a good example of government controlled media. Not something to like.

<comment><USER24> Actually, outside of Twitter arguments and comment section accusations, I think the real definition of fake news is news that is either partially or totally fabricated and presented as fact. For example, "Obama signs executive order banning the national anthem", or "Trump claims victory after Castro's death! 'I did it!'". These are untrue irrespective of the current incumbent...

In fact, your conflation of true fake news with "politically slanted journalist" is one reason it has such power. People just assume that they are reading real news that caters to their interests and doesn't cloud the truth like the "other guys," when in fact they may be reading and sharing complete nonsense.

<comment><USER23> "fake news is news that is [...] partially [...] fabricated"

that is ALL news not fake news. All news are written to influence you in one direction or another. There's always stuff that is left unspoken or added and things that are expressed this way or the other.

Example: Pro-Saudi news says "The people fight against Assad terror regime in Syria" and pro-Iran news says "Syrian government fights against terrorists" (that were the stories about 2014 if I remember correctly). Depending on which side you stand articles with your phrasing are the "news" and articles with the other phrasing are the "fake news".

The truth would have been "ongoing battle between Iran and Saudi Arabia for leadership of the Arab/Persian world". I don't remember a single news paper reporting that in US, Europe, Russia, China or local.

<comment><USER25> Pointless argument, so people can make up completely random stories, and as long as there's a tiny portion of truth, such as say person A being referred to actually existing, it should be considered news?

I'm sure even you don't believe that though, people seem to enjoy making pointless arguments a bit too much, at times.

<comment><USER23> No the other way around. You interpret my statement as "how to define what should be considered news" while I'm saying "what you consider news is not better than fake news but just as fake".</comment></comment></comment></comment></comment>


Dangerous Web Security Features - <AUTHOR> https://www.tunetheweb.com/blog/dangerous-web-security-features/ <comment><USER2> Disagree with HSTS being 'dangerous' in 2019. There are not really any good excuses left to have any parts of your website (new/different subdomains included) unable to use https. On the other hand, HPKP is a lot easier to mess up and is more situational, but HSTS should be standard by now.

The author's recommendations are still good (If everyone tried to set up strict HPKP+CSP on their websites, I can imagine how many would break), but I view things like "If you've a sub-site that you never got round to securing (e.g. [http://blog.example.com](http://blog.example.com)), then you've just forced yourself to upgrade with this policy." as a positive, not a negative (hence the word 'upgrade').

<comment><USER3> I definitely agree there's no excuse not to use TLS anymore.

I recently ran into this on a city of Vancouver website for voting information. While any page that had a form used HTTPS, all other pages forced the user to use HTTP. Like, for those pages, it redirected to unencrypted even if you typed in [https://](https://). Including the page with polling location information.

So any malicious actor in a privileged position, like a public WiFi network operator, could have effectively prevented people from getting accurate poll location information, effectively DoSing prospective voters.

I tried to bring this to their attention, but I got a response telling me their IT guy says it's not a problem because no user data is submitted on those pages. Never mind that it was probably more work to selectively enable TLS per URL and leaves important content vulnerable to manipulation. Incredible!

It's like the old "all of our download links use HTTPS", but the downloads page is served unencrypted. Frustrating.

<comment><USER4> Maybe all they can afford is a really old or weak server machine, and are afraid of the extra computational power that enabling https on all pages would incur.

<comment><USER5> Elliptical curve based keys are now supported by all major browsers and require much less processing power and overhead compared to traditional RSA keys.

</comment></comment></comment></comment><comment><USER6> (2015), edited (2018).

I've had week-long HSTS on my personal website for a few years (which is short enough that most clients ignore it) out of an abundance of caution/FUD, and it hasn't really been a problem - I _have_ had periods where my cert expired (for complicated reasons, I renew Let's Encrypt certs manually every three months, and sometimes I don't get around to it in time), but I didn't remove the regular HTTP 301 to HTTPS during that time. So I don't think permanent / preloaded HSTS would have been a problem.

On other sites I've set up since then, I've built them on top of hosting that assumes reliable HTTPS and renews it for me, e.g., Twisted with txacme or AWS Cloudfront with Amazon's CA. So I've been able to assume working HTTPS from day one.

In October 2017, Google announced plans to deprecate self-service HPKP for exactly the reasons outlined in this article, which took effect in late 2018. See [https://developers.google.com/web/updates/2018/04/chrome-67-...](https://developers.google.com/web/updates/2018/04/chrome-67-deps- rems#deprecate_http-based_public_key_pinning) and the links provided . If you're a major site and you really, really know what you're doing and you're confident the risks outlined in this article , you can still get a hard-coded HPKP entry in the browser source code.

</comment><comment><USER7> As others have pointed out, this post is from 2015 and a lot has changed since then. I've added an updated section at the end, to clarify my thoughts since then (mostly unchanged to be honest, except for CSP): [https://www.tunetheweb.com/blog/dangerous-web-security- featu...](https://www.tunetheweb.com/blog/dangerous-web-security- features/#summary2019)

</comment><comment><USER8> > The impact of an incorrect CSP policy, or browser issue could vary from a > "Tweet This" button not loading (no big deal), to ads not loading (hurting > your income), to stylesheets not loading (basically your whole website is > broken).

I really don't like the sentiment that you shouldn't add a security feature because it might be difficult. Any change comes with risk of regression, but CSP isn't even domain-level like the other ones, it only affects the resources it's attached to. It shouldn't be any scarier than making any other change to your site/app.

Replace with 'the impact of replacing your md5-ed passwords with properly hashed ones... basically your whole website is broken'. Of course, that's a reductio ad absurdum in some cases, but if it protects you from XSS it might be a good analogy.

<comment><USER7> OP here and I disagree. Implementing a CSP for a page is hard (given the many different browsers), implementing it for a site is really hard! And yes it does pretty much need to be "domain level" to be effective.

It's easy to test if a password algorithm change fails, not so much for CSP. And the reporting options are next to useless because they are so noisy.

That's not to say people shouldn't implement CSP - it's a great option (now - less so in 2015 when this post was written). But they shouldn't just copy and paste a CSP policy from a random blog post they found, get an A+ on a security scanning tool and feel proud, without realising that they may have broken part of their website or implemented a pointless CSP. That was intention of this post and apologies if it read as "don't use then cause they are hard".

<comment><USER8> > It's easy to test if a password algorithm change fails, not so much for CSP.

Probably a bad example, because the former is server-side. But why is CSP harder to test than any other client-side change, like rewriting your login page/component?

> And yes it does pretty much need to be "domain level" to be effective.

I meant to say that you can add it as a XSS prevention to example.com/app/ and not worry about example.com/static/ or example.com/blog/

<comment><USER7> > But why is CSP harder to test than any other client-side change, like > rewriting your login page/component?

Maybe not so much now. But when I wrote that post there were lots of bugs and missing features across the various browsers (examples in the post). It was early days for CSP and it's got better since (hence why I now do recommend CSP), but regardless CSP is a complex technology and tough to get right. Each page and each browser might have its own CSP requirements (e.g. when polyfills are included on a bad for example).

> I meant to say that you can add it as a XSS prevention to example.com/app/ > and not worry about example.com/static/ or example.com/blog/

Then your cookies are at risk. Yes cookies can be scoped to a path, but few do that. And they can be made HttpOnly which is more common, but still not used anywhere near enough (8.31% of cookies - [https://github.com/mikewest/http- state-tokens/blob/master/RE...](https://github.com/mikewest/http-state- tokens/blob/master/README.md)). Additionally if you have a vulnerability on /static/ then you can hijack the app link or login link to send users to badexample.com or similar when they want to login to the app.

It will still offer some protection if only on /app/ and is better than nothing, but still preferable to have it on the whole domain. It's like HTTPS - having it on just one page is an anti-pattern that shouldn't be used anymore.

</comment></comment></comment></comment><comment><USER9> Can we add minimum password complexity requirements to this list? There is nothing more annoying than having to adjust my already 128-bits of entropy password because the website feels I need a special character. Plus, now hackers have a guide for what the password looks like.

<comment><USER10> NIST 800-63b actually recommends against character class requirements[1] in favor of minimum length requirement and blacklists of breached passwords and other obvious passwords. Sites that require special characters are not following the current best practice.

[1]: [https://pages.nist.gov/800-63-3/sp800-63b.html](https://pages.nist.gov/800-63-3/sp800-63b.html)

<comment><USER11> Isn't any obvious password already in the list of breached passwords? ;)

</comment></comment></comment><comment><USER12> _And then we come to the most dangerous item, because you have least control over it: preloading HSTS right into the browser._

I can't say specifically why, but there's something about a browser that treats a certain list of sites specially, by default, that just doesn't sit well with me. I've had this feeling ever since I heard about the feature. Not exactly net neutrality, but somewhat reminds me of it.

<comment><USER13> Sounds similar to web browsers coming with their own CA certificates instead of using system-wide ones, leading to poor integration and inconsistencies. Though a centralized database of rules for websites sounds awkward on its own.

<comment><USER14> > Sounds similar to web browsers coming with their own CA certificates instead > of using system-wide ones, leading to poor integration and inconsistencies.

Well, the only notable browser which does this is Mozilla's Firefox, and not coincidentally the only root trust store where you can actually see how the sausage is made is Mozilla's. All the other big trust stores (Apple, Microsoft, Google) are black boxes. Presumably they have one or more employees dedicated to this stuff, but since we're not shown their working it might equally be the product of an intern throwing darts at a list.

Right now for example Mozilla is discussing Certinomis, a small CA which doesn't seem to be very good at the technical aspects of their job, issuing certificates for DNS names with spaces in them, typo'ing dates, filling parameters out incorrectly, nothing that screams "evil" but certainly more clumsy than we'd prefer. Are other trust stores thinking about Certinomis? You'll only find out if one of them announces a change.

</comment></comment></comment><comment><AUTHOR> [https://connect.ed-diamond.com/MISC/MISC-102/L-en-tete- HPKP-...](https://connect.ed-diamond.com/MISC/MISC-102/L-en-tete-HPKP-pour- securiser-un-peu-plus-les-connexions-sur-Internet) ?

[https://news.ycombinator.com/item?id=15089513](https://news.ycombinator.com/item?id=15089513) I'm giving up on HPKP, Aug 24, 2017

</comment><comment><USER15> This article is probably much more harmful than the security features it describes as dangerous...

</comment><comment><USER16> I still very strongly oppose HSTS's "No user recourse" policy, and don't deploy it on my sites purely for that reason.

I get the reasoning, but it's still unethical to the user.

(as an aside, hsts applies to all ports with no option to disable this, something to keep in mind.)

<comment><USER17> I agree with you. That is also why I hate HSTS and will not use it. The user must be given permission to override (for any reason they want to, including one you don't know) anything, and must have enough ropes to hang yourself and also a few more just in case.

HSTS is terrible, even if you support HTTPS (which you probably should).

<comment><USER18> > I hate HSTS and will not use it.

HSTS is just a flag. What you "hate" is that a piece of software under ~YOUR~ control (the web browser) happens to be correctly enforcing the intent of that flag. If you don't like HSTS, it is ~YOUR~ choice whether you use a web browser that will follow your instructions or someone else's. If your web browser does not offer a method to disable HSTS like Firefox does, switch to a browser that is willing to follow your instructions.

> HSTS is terrible

That is an absurd opinion. HSTS makes the internet objectively safer by _requiring_ trust between your web browser and web servers. Who would want _optional_ trust between themselves and their online bank to be the default state of affairs? If a website deals with money (or other items of value) and it is not HSTS preloaded, it is being stupidly and dangerously unsafe.

<comment><USER17> I know that about the flag, and managed to hack Firefox so that HSTS won't work. (Although I wrote a document how to write a better web browser program, but it isn't implemented.)

Trust between whatever (and other options about what features to enable/disable/alter, such as what fonts to use, any kind of URL redirections, etc) should be defined by the user. There are several reasons you may wish to alter the settings. (Anyways, you can configure cookies for secure connections only; the user should also be allowed to configure whether or not to use key pinning for secure cookies (individually per domain).)

(I also think that both HTTP and HTTPS are bad for banking anyways, and that a specialized kind of bank/money protocol that can be worked over SSH might be working better (preferably that can be used with text, so that even without specialized software you can still do some stuff with it; IRC does that too and that is what makes IRC good). This is independent of the above stuff, though.)

<comment><USER18> All of the above assumes that the broader population are well informed about the nuances of digital security. The reality is most people have better things to do.

As for your third paragraph—I would agree that banks should act more like APIs and less like their own countries. But that is independent from the use of a protocol. Arguing between TLS (HTTPS) and SSH borders on bikeshedding.

The reality is more than a billion people are successfully using HTTPS to safely and securely manage their money, and HSTS is improving the guarantees around that security. I'm sure you've solved every security and trust risk with this hypothetical bank-over-IRC-over-SSH protocol with non-mandatory security... but I'm not yet convinced.

<comment><USER17> You are correct about that; you could do HTTPS (or otherwise TLS) too would also work, to define such API; it does not have to be SSH.

(Actually, now that I consider, HTTP requests (with HTTPS) might be better than SSH anyways for many of the things being done, such as downloading a bank statement. So, it may likely do better. However, the common authentication protocols are better in SSH, but similar kind of authentication protocols is probably still possible with HTTPS too, just it does not seem to be as commonly used, but perhaps it should be.)</comment></comment></comment></comment></comment></comment>


Show HN: Citra – The communication app for the connected caregiver [video] - <AUTHOR> http://www.youtube.com/watch?v=sd9-pXCdQgQ

<comment><USER2> Original Developer here. This started as a project through the Ohio State University Social Innovation and Commercialization center. After proving the beta test it was finished by the Tony Wells foundation.

Really great to see this project out in the world.</comment>