Show HN: Grayscale the Web – A Chrome extension to help avoid mindless browsing - <AUTHOR> https://chrome.google.com/webstore/detail/grayscale-the-web-save-si/mblmpdpfppogibmoobibfannckeeleag <comment><USER2> I love this idea, but sadly it's not for me. I tried this on my phone (going grayscale) and turned it off after 1/2 a day. Too many apps rely on color to differentiate different parts of the app.

It definitely gave me a greater appreciation for the plight of the colorblind, and it's why for my own company's products, we always test in B&W, to make sure no functionality is lost.

Relatedly, does anyone have any links to some good research on _why_ this works?

Edit: OP has pointed out that this tool lets you choose sites to have in color or grayscale, so that's a bit of a game changer, as on the phone it was all or nothing.

<comment><USER3> I work for a university making some of their websites ADA compliant. Simulating several different colorblindnesses is part of doing so. It always surprises me how even universities can be up-to-date with accessibility but sites as popular as Facebook or google can fail many of the checks we do.

It must have to do with the university receiving federal funds..

<comment><USER4> The irony about Facebook is that Marl Zuckerberg is red-green colorblind.

<comment><USER5> There's very little irony in that. Zuckerberg made Facebook for _others_ to use; not for himself (OK, for himself, but not for himself _to use it_ ). This just underlines that further.

</comment></comment></comment></comment><comment><USER6> If you are on windows you can use this awesome tool to have it globally: [https://zerowidthjoiner.net/negativescreen](https://zerowidthjoiner.net/negativescreen)

nice plus: inverted mode with correct colors (only brightness inverted)

You could even write your own translation matrix. It's a bit tricky at first, but fun. e.g. true black and white without greys.

For your own matrix this might help (but definitely another format :/ ):

[https://kazzkiq.github.io/svg-color-filter/](https://kazzkiq.github.io/svg- color-filter/)

[http://alistapart.com/article/finessing- fecolormatrix](http://alistapart.com/article/finessing-fecolormatrix)

<comment><USER7> If you are on macos you can do it globally and natively by going in the accessibility settings.

<comment><USER8> Check out Nocturne (originally from Blacktree, of QuickSilver fame). It even has a full red monochrome option (in case you need to finish that paper at 2 am but don't want to keep your roommates awake).

I really wish Android and iOS had a full red monochrome night-vision mode.

Short of that, for Android, you can switch to monochrome directly in Developer mode: [https://www.trishtech.com/2016/02/how-to-turn-android- lollip...](https://www.trishtech.com/2016/02/how-to-turn-android-lollipop- screen-monochrome/)

<comment><USER9> iOS does have a red monochrome option! Settings > General > Accessibility > Display Accommodations > Color Filters > Color Tint

Not the easiest to find, but it's there for people who need/want it.

<comment><USER5> > (in case you need to finish that paper at 2 am but don't want to keep your > roommates awake).

Like iOS, macOS has native Night Shift mode as well. Or you can use F.lux

</comment></comment></comment></comment></comment><comment><USER10> This is very cool. Last week I went full greyscale on my ipad and iphone, and over the weekend on my macbook pro.

It definitely forces me to think about each time I use each device - the stark contrast in colors to the real world requires a sense of intentionality that I really like.

<comment><USER11> I did the same earlier this morning and I agree with this sentiment so far. I find it difficult to be mindless on the screens, and it makes me appreciate the colors of the offscreen world so much more.

</comment></comment><comment><USER12> For Firefox you can use the Stylish addon and "filter: grayscale(100%)" for similar effect.

<comment><USER13> Thanks, exactly what I was looking for. I went to "Create New Style" and added the following and now I'm all set:

      html {
        filter: grayscale(100%) !important;
      }

<comment><USER14> Thanks. pairing this with 'dark night mode' is pretty nice.

<comment><USER13> oh wow, that is nice. I've been looking for something like dark night mode for a while now, glad you pointed it out

</comment></comment></comment></comment><comment><USER15> Thank you. I use the grayscale option on my Android Phone. I have to say, with the exception of reading on it, everything else is boring as fuck, which is great. Everything around seems so much more colorful than that device.

I'd like to see this pattern (intentionally making the experience worse, to prevent the facebook shithole effect)used in more devices.

<comment><AUTHOR> Thanks! I'm glad you like it. I started using the grayscale option on my iPhone a while back and found the same thing. Sites were suddenly way less engaging. It almost felt like going through withdrawal after using it for a few days.

Have you heard about the upcoming Android P? It's got a lot of tools to help you control your browsing, looks pretty helpful - [https://www.theverge.com/2018/5/8/17327302/android-p- update-...](https://www.theverge.com/2018/5/8/17327302/android-p-update-new- features-changes-video-google-io-2018)

<comment><USER15> Yes, I'm enrolled in the beta and the advertised features for wellbeing are not there. But it's ok anyways cus I have grayscale full time on my phone.

</comment></comment></comment><comment><USER16> Text based browsers have had this option for ages, though some say they copied it from printers.

Notably this doesn't help with food, I've been only buying greyscale (Rice, Oreos, Guinness, etc.) for a while now and my mindless consumption hasn't dropped.

<comment> Harvey-Specter > Oreos

You need to take them out of the original packaging and put them in a greyscale container as well.

</comment></comment><comment><USER17> Nice idea!

Would be great if it was not just On/Off switch, but one could set timer (per site) and it would gradually desaturate website the longer you stay (1%, 2%, ...).

When timer turns 0, then site becomes fully grayscale (100%). When page is closed, then the timer is reset (after the same period of time?).

<comment><AUTHOR> Thanks!

Originally I was going to implement a slider where you could adjust the amount of grayscale, but wasn't sure if anyone would use it. I really like the idea of having it gradually go gray, I might look into that when I get a chance to work on this again.

</comment></comment><comment><USER18> I'll definitely try it, thanks! I've been "on" grayscale on my phone for a few months now and I've enjoyed it very much.

One "proof" that I have of grayscale's benefits is that when I switch back to color (which happens at most once every 2 weeks), I find the colors to be extremely (visually) "loud".

Is it reasonable to think that we get desensitized to color, and that using grayscale re-sensitizes us? i.e. can this be compared to avoiding sugar or salt as much as possible, and then noticing how much the "old", "normal food" was actually sweetened / salty?

<comment><AUTHOR> I know what you mean. If I'm good about using the grayscale, when I see a site with color it's almost overwhelming. You get desensitized to all that color.

</comment></comment><comment><USER19> FYI: you can go black&white on Windows 10 by pressing Win+Ctrl+c

Edit: does anybody know if there's a way to do the same on GNU/Linux ?

</comment><comment><USER20> Too monochrome? Try ponyFilters! [https://github.com/webdev23/ponyFilters](https://github.com/webdev23/ponyFilters)

</comment><comment><USER21> Sounds like an interesting idea but would be awesome if rather than grayscale it just lessened the contrast and made colors a lot less vibrant. That would still help a lot

</comment><comment><USER22> Here's perhaps a silly question. Even more so since I haven't read all the comments, only the top ones. How does grayscaling the web avoid mindless browsing?

<comment><USER23> From the extension description:

>You may not realize it, but all of that color is designed to hijack your brain and keep you browsing.

>Grayscale the Web is a great solution to help with this. It removes all of the color, giving sites a plain, grayed out look. They will appear much more boring, and that's the whole point. You'll soon find that time wasting sites hold your attention less, and this will hopefully help you focus on whatever it is you really need to be doing.

<comment><USER24> That's the claim, but not an explanation. HN isn't multi-color.

<comment><AUTHOR> You have a point. But even though HN doesn't have a ton of color, it still feels different on grayscale I think.

Most of the evidence is anecdotal, but it seems to work for a lot of people (myself included). I went into it more here - [https://news.ycombinator.com/item?id=17133984](https://news.ycombinator.com/item?id=17133984)

</comment></comment></comment></comment><comment><USER25> This is an excellent idea, and makes me realize just how much I'd love to be able to have an Android phone with an e-Ink only display.

</comment><comment><USER26> Anything similar for Firefox?

<comment><USER27> Yeah, I think this should work: [https://userstyles.org/styles/160346/greyscale-4206969](https://userstyles.org/styles/160346/greyscale-4206969)

Just try it out and let me know if it doesn't.

<comment><USER26> This is just perfect - thank you!

</comment></comment></comment><comment><USER28> It's well-intentioned but why not just use the OS to solve this? Seems like too narrow of a solution to a much bigger problem.

<comment><USER29> Because I want my IDE, github and the app I am working on to be colorful and everything else blunt

</comment></comment><comment><USER29> Very cool, I will test it thought the week and see if I can notice any effects

I like this idea better than those extensions that just block websites altogether, those do not work for me cause I just disable them when I want to go "mindless browsing"

</comment><comment><USER30> Awesome! Thanks for building this. I have been using grayscale on my phone and I love it.

</comment><comment><USER31> Seems very useful, thanks. Curious how it affects cpu usage. Would be cool if you can explain how it works. I can see even the gifs and videos(which I think makes this even more useful) are rendered black & white.

<comment><USER32> My guess is that it just applies a CSS filter on the entire page.

<comment><AUTHOR> Yep, you got it. For the most part I'm just adding filter: grayscale(100%) to the html element.

There some other stuff going on though. I noticed that for the html and body elements, if they had a background image/color, the grayscale trick wouldn't work for them.

So, on the options page I added a toggle to "Remove All Background Colors and Images No Matter What". This goes through the page and checks if there is a background image or color, then uses this library ([https://github.com/bgrins/TinyColor](https://github.com/bgrins/TinyColor)) to check the perceived lightness of the color and changes the background to use a shade of gray instead.

Performance wise, I don't have any specific numbers, but I did a lot of dogfooding on my own before releasing and didn't notice any perceivable slowdown.

</comment></comment></comment><comment><USER33> does anyone have a link to the people who made this? I see 'Dev Astora' but can't find them on the web.

am always hesitant to install browser plugins that have no website link, about, and privacy policy..

</comment><comment><USER34> Is there a way to do this in Linux/Ubuntu/Debian?

I've looked as hard as I could but I couldn't find any solutions, at least not one that didn't require writing your own drivers.

</comment><comment><USER35> Super useful, thank you! Is there anything like that for Safari?

<comment><AUTHOR> Thanks! I took a quick look and it doesn't seem like there's any plugins out there for grayscaling in Safari right now.

If you're talking about mobile safari though, you can do it on an OS level and toggle it by pressing the home button three times in a row - [https://www.ped30.com/2018/01/13/apple-iphone- gray/](https://www.ped30.com/2018/01/13/apple-iphone-gray/)

<comment><USER36> I just set my iPhone up for that. I am hoping it makes a positive difference.

</comment></comment></comment><comment><USER37> This is actually pretty cool, I installed it and it already feels a bit easier to maintain control over what my attention is on.

</comment><comment><USER38> Pretty cool, I like it!

</comment><comment><USER39> This made my day! Thanks Dev Astora for working on it :)

<comment><AUTHOR> Thank you! I'm glad to hear that : )

</comment></comment><comment><USER40> This will be awesome for my e-ink monitor.

<comment><USER34> You have an e-ink monitor? When did they hit the market?!

<comment><USER40> I'm expressing a hope to the point of lying.

</comment></comment></comment><comment><USER41> This extension should be one CSS line, why does it load 3 libraries as content scripts?

        :root {filter: grayscale(1) !important; background: #fff}

I wish extensions had a native way to whitelist/blacklist websites. Until then, you're better off adding that line to Stylish.

<comment><AUTHOR> Do you mean three separate js files? Two of them are plugin specific files I separated out to make managing the different features easier.

The only library I'm loading is tinycolor.js, which I added for the togglable feature where it checks the site background colors and adds an appropriate gray for it. You'll find that making the background always be white doesn't actually work some of the time, especially for sites with darker backgrounds.

The extension is (god forbid) more than one line of code because I wanted to add features and controls I didn't see in other plugins, like:

* setting it for specific tabs

* setting it for all sites

* being able to save sites to always be gray

* being able to exclude sites from being gray when the "tab" or "all sites" settings are on

I too wish extensions had the built in functionality to add/remove saved sites, tabs, etc, but as that's not the case today, I had to do it myself with the chrome extension APIs.</comment></comment>


You can use recursion in real life - <AUTHOR> http://rocketships.ca/blog/674/

<comment><USER2> Just a thought and I've only glanced at your code but could some of the functionality in the Carbon library come in handy? especially for the logic in weekendDates()?

I like to think of it as DateTime on acid ;)

[https://github.com/briannesbitt/Carbon](https://github.com/briannesbitt/Carbon)

<comment><AUTHOR> Quite possibly, I'll check it out. We're already using the CakePHP framework, do you think Carbon would be compatible with it?

</comment></comment><comment><USER3> Why don't you cache $weekends though? Given that you're constantly recalculating it, it probably has a serious performance impact?

<comment><AUTHOR> I think the framework caches it automatically, but good point, I should check that.</comment></comment>


The most dangerous thing about the Amazon fires is the apocalyptic rhetoric - <AUTHOR> https://www.spectator.co.uk/2019/08/the-most-dangerous-thing-about-the-amazon-fires-is-the-apocalyptic-rhetoric/ <comment><AUTHOR> [...] the number of fires in Brazil this year is more than last year, but about the same as in 2016 and less than in 2002, 2003, 2004, 2005, 2006, 2007, 2010 and 2012. [...]</comment>


One in every 600 websites has .git exposed - <AUTHOR> http://www.jamiembrown.com/blog/one-in-every-600-websites-has-git-exposed/ <comment><USER2> Imagine you implement every type of possible security...

Keeping your entire server-stack up-to-date, making sure you have SSL, using strong encryption for logging-in, hashing the passwords, making sure your server can only be reached via SSH, adding firewalls, filters, etc. etc.

Then some hacker in Eastern Europe comes along (or some beginner at the NSA/GCHQ) and finds out that your .git is exposed and somehow gains all vital user-data and admin data.

Being bashed with a boulder repeatedly would probably be less painful than the torture of knowing "I did it all, but they got me with an HTTP request... because nobody thought of double-checking what our VCS is doing".

How many other glaringly obvious mistakes might be out there right now? I can only imagine.

<comment><USER3> Wrong lesson.

Don't put secret keys in your repository.

Someone getting a copy of your code should be a big annoyance at worst.

<comment><USER4> Where is the right place to store db passwords, api keys, etc? What is best practice in this area?

<comment><USER5> I use AWS for a number of applications, so I've started doing the following:

1\. Create a JSON file containing encrypted secrets (DB pass, etc.)

2\. Upload the file to a secure S3 bucket with fine-tuned permissions and server-side encryption

3\. For the instance that is launching, include the permission in the IAM role that allows it to "S3:GetObject" on the specific JSON file you uploaded.

4\. Deliver decryption keys to the app in some manner (Chef, Ansible, etc.)

5\. When the app starts, it downloads the JSON file and loads the environment variables.

I wrote a blog post[1] about this with more detailed info and an NPM module if you use Node.js.

[1] [http://blog.matthewdfuller.com/2015/01/using-iam-roles- and-s...](http://blog.matthewdfuller.com/2015/01/using-iam-roles-and-s3-to- securely-load.html)

<comment><USER6> This system is truly beautiful, I think one of the best suggestions in the thread (definitely the best self-rolled solution not using other tools)

I have a question about redundancy or "What happens if your gatekeper EC2 instance goes down"? If you have multiple gatekeepers could they be set up this way:

\- let's say you have five different web apps using a gatekeeper to hold their secrets

\- let's say you have n gatekeepers (let's say 3) and each of the apps knows the address of all three gatekeepers.

\- If the primary gatekeeper is unreachable, all five apps would try to contact the secondary gatekeeper, but that gatekeeper would only (ever) respond in the event that the secondary gatekeeper _also_ found the primary gatekeeper unreachable.

It's like a sleeper cell - at any given moment you have multiple replacement gatekeepers ready and waiting to serve, but each of them is unable to respond unless the one above it in the list stops responding. In this way you could lose gatekeepers (even permanently) and build a little bit of resilience into the apps depending on it while you're able to sort out what happened and restore normal behaviour.

Is this a good idea?

<comment><USER5> I'm confused by your reference to "gatekeeper EC2 instances." In the scenario I described, the secrets are housed on S3, not a separate EC2 instance. So, theoretically, as long as the underlying instance running the application code can access S3, and S3 doesn't go down (very unlikely), there shouldn't be any issues.

</comment></comment></comment></comment></comment></comment><comment><USER7> For Apache,

        <Directorymatch "^/.*/\.git+/">
          Order deny,allow
          Deny from all
        </Directorymatch>
        <Files ~ "^\.git">
          Order allow,deny
          Deny from all
        </Files>

[https://serverfault.com/questions/128069/how-do-i-prevent- ap...](https://serverfault.com/questions/128069/how-do-i-prevent-apache-from- serving-the-git-directory)

<comment><USER8> Probably better to link to the stackoverflow you quite possibly copied this from so that people can see discussion / alternatives, etc: [https://serverfault.com/questions/128069/how-do-i-prevent- ap...](https://serverfault.com/questions/128069/how-do-i-prevent-apache-from- serving-the-git-directory)

See also the nginx question: [https://stackoverflow.com/questions/2999353/how- do-you-hide-...](https://stackoverflow.com/questions/2999353/how-do-you-hide- git-project-directories)

Note, if you actually did take it from the stackoverflow, you just infringed on someone's copyright; SO's user content is 'creative commons, attribution required'.

Edit: Thanks for adding the attribution, all clear with copyright now :)

<comment><USER9> _Note, if you actually did take it from the stackoverflow, you just infringed on someone 's copyright_

Does a simple access rule, which I can't see there being many sane ways to express, meet the minimum level of creativity/originality to be eligible for copyright...?

<comment><USER10> Probably not, but it depends on the court and the skill of the lawyers.

</comment></comment></comment></comment><comment><USER11> Obviously you shouldn't be storing sensitive information in your codebase (I hope everybody knows that), but the problem here is that you might have been _way back when you were prototyping and then moved them out of the codebase_. It's really common to start a codebase just by hacking something together with hardcoded secrets.

If you have the proper secret segregation now, but you're deploying by doing a git pull, now you run the risk of not really having segregated secrets all over again.

<comment><USER12> Growing a project from one shot mindset prototyping is really problematic. Every time I wish I started by using a real project structure and design philosophy.

<comment><USER13> And then every time I actually start a project with a real project structure and design philosophy, it goes nowhere and I wish I hadn't wasted the time. Or best case, it's used by a few people internal to whatever company is currently employing me, and security doesn't really matter.

The tech industry is shaped like a funnel, with lots of raw, bad ideas at the top and a few smash mega-hits at the bottom. 99% of the ideas at the top are bad; investing more time than is necessary to prove them out is a mistake. 100% of the ideas that make it to the bottom wish that they'd spent more time designing things at the top. But y'know, if they'd actually done that, they wouldn't have made it to the bottom, they'd be outcompeted by the guy who got a quick and dirty prototype up, made his users happy first, and then closed the gaping security holes (hopefully!) before anyone noticed.

<comment><USER12> I can't deny that nature likes quick n dirty, but I wish I could just find a balance between reckless and too slow.

<comment><USER13> The balance is whatever works, gets people using the product, and ideally keeps them happy.

The balance is generally far more on the quick 'n dirty side than most engineers (myself included) would prefer, but we could look at this as a cognitive bias of engineers rather than a failing of nature.

</comment></comment></comment></comment></comment><comment><USER14> Is there an automated "security as a service" service that if I subscribed to it, it would have told me that this is a problem on my websites?

It really annoys me randomly hearing about critical security issues through tech news websites - there should be a more systematic way for "non-security professionals" to ensure their sites are protected to best practice levels.

<comment><USER15> There's a service called Detectify that might fit the bill. [https://detectify.com](https://detectify.com)

</comment></comment><comment><USER16> It seems Google doesn't like people looking into the extent of this problem [1].

When googleing for "inurl:.git", it returns no results. And on top of that, I need to enter a captcha first?

[1] [https://www.google.be/search?q=inurl%3A%22.git%22](https://www.google.be/search?q=inurl%3A%22.git%22)

<comment><USER17> The .git directory wouldn't be crawled though, correct?

<comment><USER3> Most of the time it wouldn't be crawled.

But zero results is blatantly wrong.

</comment></comment></comment><comment><USER18> It seems like if you're storing secrets and the like in your code's repo, the solution is to not do that, rather than just putting a bandaid over it by hiding the repo.

Deploy the secrets separately: they don't belong in your site's codebase.

<comment><USER19> Hiding the repo is hardly a bandaid. It should never be exposed even if the repo is perfectly secret-free.

Except in the rare cases where it is intentional e.g. an open source repo and you happen to want people to download it from the same domain not github or git.domain.com.

<comment><USER18> Can you elaborate on why it shouldn't be exposed?

Presumably, for most commercial entities, the parts of the site that are valuable are the assets, which are served from the site as part of it doing the thing it's meant for. For a large percentage, they're running a CMS like Wordpress or Drupal or whatever, where the codebase is public anyways. And for even more, we're talking about a directory of hand-crafted HTML files, where the version control is the HTML of the site plus some "damn, I always forget to close my tags" commit messages.

<comment><USER19> > Can you elaborate on why it shouldn't be exposed?

Because there is no need to expose it. If you expose it then you need to vet not only it's head but it's entire history, and for what purpose?

> For a large percentage, they're running a CMS like Wordpress or Drupal or > whatever

I doubt someone running Wordpress would be using version control anyway. Most of the time it is WP + some standard plugins and no custom coding.

> And for even more, we're talking about a directory of hand-crafted HTML > files

And anything else you happened to have in your directory. Your passwords file? Even if you commit a delete there is still history!

</comment></comment></comment></comment><comment><USER20> In nginx, best to just not serve dot files:

        location ~ /\. {
            deny all;
            access_log off;
            log_not_found off;
        }

<comment><USER21> This returns 403 and in my opinion logs should not be turned off for that. I would return 404 to not expose that you are blocking . files with your server. My suggestion to put in each server { ... }

        location ~ /\.  { deny all; return 404; }

</comment></comment><comment><USER9> More precisely, it's "one in every 600 websites _examined_ "

Git is popular, but I find it hard to believe that 1/600 of all websites on the Internet use it.

<comment><USER22> You find it hard to believe that 0.17% of all websites use git? I'm sure 10x that many do, most probably don't misuse git to deploy rather than solely as a source code manager.

<comment><USER23> Most websites are made through Wordpress, Squarespace, Wix, and similar products. I bet the number here is far lower than 1/600.

</comment></comment></comment><comment><USER24> Related question: Is there any risk to exposing .git if your Git repository is already publicly available (e.g. on GitHub)?

<comment><USER25> If it's exactly the same repository - no. If it contains some extra branches with local changes, or potentially commits with private information / passwords - definitely.

So in general - it's better not to have it in the first place, because it's unlikely that the person doing the commits knows the whole deployment strategy.

</comment></comment><comment><USER26> Not going to name names, but there are mobile apps have their .git packaged up with them too.

</comment><comment><USER27> 90% of security incidents are due to human errors, not to some secretive hacker group spending $10m to crack TLS. Doing system administration right (eg. no secrets in repos) has a lot more impact on security than implementing all the other complex controls.

Of course, doing everything is much better.

</comment><comment><USER28> I wonder what would happen if you searched for .svn, too. I'm sure you'd run into the same problem in many places. But would it be more or less likely to occur?

<comment><USER25> I think less likely. Svn actually had an `export` command, which allowed you to do a checkout of a specific commit with no svn metadata. If someone was actually using svn for deployment, they likely knew about it. ([http://svnbook.red- bean.com/en/1.7/svn.ref.svn.c.export.html](http://svnbook.red- bean.com/en/1.7/svn.ref.svn.c.export.html))

<comment><USER29> git has `archive`, which is essentially the same thing.

[1]: [http://git-scm.com/docs/git-archive](http://git-scm.com/docs/git- archive)

<comment><USER25> No, archive is very different. `svn export` could be used at the target side. Basically you can export from remote repository to the chosen directory without any extra operations, so .svn is never created.

`git archive` requires you to have a clone of the repo from which you can create an archive. That means people are more likely to just do a local checkout than play with archive on top of it.

Deploy with svn export:

        svn export url.of.repo destination/path

Deploy with git archive:

        git clone url.of.repo
        cd repo_name
        git archive --format=tar some_commit_or_branch | (cd destination/path && tar -xf -)

<comment><USER30> I completely agree, every time I do a new deployment script for git, I miss the old svn export command, I hate the idea of cloning on the deployment machine, having to git sync in the script etc. Whereas 'svn export' feels stateless, and is clean by construction.

</comment></comment></comment></comment></comment><comment><USER31> Some of the other commenters suggest adding git-dir and work-tree to the git commands, but there's a better solution: use the --separate-git-dir option when cloning the repository.

For example:

        git clone --separate-git-dir=<repo dir> <remote url> <working copy>

where <repo dir> is outside of any directory served by the web server and <working copy> is the htdocs root.

This option makes <working copy>/.git a file whose content is:

        gitdir: <repo dir>

The advantage is that all git commands work as usual, without the need to set git-dir and work-tree, and that there's nothing special to add to the web server configuration.

<comment><USER32> I disagree

It may be possible that gitdir is still accessible through a misconfiguration or security issue (and you're giving them exactly where to look)

Production servers have no business having the .git directory anywhere.

<comment><USER31> > Production servers have no business having the .git directory anywhere.

I agree with you in principle, but in practice this is not always possible, there are situations when having a git checkout in production is better than nothing.

I've seen WordPress sites where a semi-technical administrator updates plugins and themes directly in production: with that git checkout I would at least be able to track the changes and pull them in a dev or staging environment.

This could be the first step to a saner deployment workflow for those sites, where production gets changes that have been tested and validated elsewhere.

</comment></comment></comment><comment><USER33> A comment mentions this deep below, but I think this deserves a bit more attention:

If you're using a modern framework with url routing, you don't need to worry about hiding .git or .hg in your webserver config file.

</comment><comment><USER34> I once jumped-in on a PHP project where the previous developers had written:

        $page = $_GET['page'];
        include ($page.".php");

Whilst allow_url_include ([http://php.net/manual/en/filesystem.configuration.php#ini.al...](http://php.net/manual/en/filesystem.configuration.php#ini.allow- url-include)) was set to false, I could still craft a URL like:

[http://example.com/?page=admin/index](http://example.com/?page=admin/index)

which expanded to [http://example.com/index.php?page=admin/index](http://example.com/index.php?page=admin/index) where the real admin was at [http://example.com/admin/index.php](http://example.com/admin/index.php) and offered complete access to the backend without authentication or authorization - let alone other files in the file system.

In another project, I found that the server had register globals turned on, and therefore could craft a URL like:

[http://example.com/admin?valid_user=1](http://example.com/admin?valid_user=1), where valid_user was a PHP variable set to true iff their session cookie could be authenticated in the database.

I think it's terrifying that these things still make it through to production websites

</comment><comment><USER14> Someone on StackOverflow says this will tell nginx not to serve hidden files.

location ~ /\\. { return 403; }

My question - do I need to put this once at the top of my configuration file and all it good or does it need to go into multiple places in the nginx config?

It would be great if there was a simple, universal way to say to nginx "don't serve hidden files from anywhere under any circumstances".

<comment><USER21> it has to go in every server { ... } section. Also use "deny all;" to really block. See my other answer here in comments.

</comment></comment><comment><USER35> Looks like this returns some results inurl:.git "intitle:index.of

</comment><comment><USER36> Why are people serving web traffic to a folder with a .git folder anyways? I thought it was basic deployment practice to export your code OUT of the VCS before deploying... every shop I've worked at had this in place.

Other solutions just seem hackish to me, but every project is different I suppose.

<comment><USER37> So that deployment is "just" git pull.

I don't get it either.

</comment></comment><comment><USER38> I have a fake /.git on my personal website to troll would-be hackers into wasting their time. (PROTIP: I don't run Laravel there.)

So far a few people have requested my .git/ directory but none have attempted to plunder the riches they think they'll find within.

</comment><comment><USER39> What I find more interesting is that github is full of passwords and credentials.

</comment><comment><USER40> This is one example for why hierarchical directories are bad. They're not all bad, but with all their power and flexibility, they carry some inherent flaws. It's much the same as JSON, which is also versatile and highly useful. However, both of these abstractions tend to lead to the ad-hoc creation of more complexity and more details to remember, while having no clearly delineated way to be self-describing.

(Is JSON an abstraction? Not really, as it's a concrete spec, but its general kind of serialization format is an (incomplete) abstraction.)

</comment><comment><USER41> It always felt unclean to have the source repo on production, so we use deployhq.com (similar: circleci.com, Jenkins) to push changes up when code changes are made, rather than pull them from git. We also use a clean-up script that removes any SASS, Grunt, etc source files when deploying to production.

</comment><comment><USER21> How to check all your nginx access logs (also compressed) in Ubuntu if anybody has accessed your .git directory (example with root access):

        apt-get install zutils
        zgrep -r "\.git" /var/log/nginx/

</comment><comment><USER42> How can a project be accessed/downloaded with just the .git folder?

<comment><USER43> Even with directory listings disabled, you could request [http://example.com/.git/refs/heads/master](http://example.com/.git/refs/heads/master) to get the sha of master, then get [http://example.com/.git/objects/<sha](http://example.com/.git/objects/<sha) 2 char>/<rest of sha> to download the data for that one sha, then you can get the rest.

Wouldn't be terribly difficult to write a script to crawl it. Git's format is well known and documented.

</comment></comment><comment><USER44> It's clear the problem involves some PHP sites developed with git and instead of using a specific www directory inside the project the server points to the root folder of the project thus exposing .git (and the rest). Classic dumb error by PHP developers. I have hard time believing one would be able to expose the .git folder in a Rails,Spring or Django application since the public folder isn't the root folder of the project.

I wish servers would be configured so they don't server ^\\..+$ files by default. I wish servers would behave as secure as possible then it's up to the developer to whitelist features rather than the other way around.

<comment><USER45> Excluding anything that starts with a period also doesn't work - RFC 5785 specs the folder .well-known with special meaning.

<comment><USER46> True, but you can whitelist /.well-known/. I don't think anything else uses dot-filenames in URLs, because not all operating systems and software even allow such file names (for instance, the file browser in Windows forbids it when creating a new file or folder).

</comment></comment></comment><comment><USER47> There are configs within nginx that prevent this from happening. Also, I symlink only the publicfiles from a different directory into my /var/www/html folder.

</comment><comment><USER48> The author doesn't give any suggestions for alternative ways to deploy.

What are the best practices here? What should operators that currently deploy this way do instead?

<comment><USER49> 599 out of every 600 sites don't have the problem of a public facing .git folder. I don't think alternative deployments need to be suggested as they are commonplace.

It depends on what sort of platform and server you're running on but just do what you have to do so you're not serving your .git.

<comment><USER50> Doesn't change anything, but worth noting, these are not necessarily 599 git- using websites being compared.

</comment></comment></comment><comment><USER51> I see a lot of discussion here about best practices to avoid this, but nothing about the obvious question: Why is it that the go to version control system for developers everywhere is designed such that there it puts a single file at the root that magically gives anybody that can see it the ability to download all the source code in the repository?

That is:

      - completely non-obvious and unexpected
      - a terrible idea

Why, instead of trying to figure out how to avoid handing this magic file out to everybody, are we not trying to fix it so that no such magic file need exist?

<comment> grey-area Where else would you suggest Git keeps the version control information for a repository, if not at the root of that repository? SVN tried it in every subdirectory, which is worse, using a separate db server would add unwelcome external dependencies. It could be in a non-hidden folder, but that's annoying for those who just want to see their files under VC, not an implementation detail of the VC method. Also, there are hundreds of dot files scattered around your computer, and none of those should go anywhere near your host - .git is just one example.

The error here is uploading sensitive or hidden information to a web host into a public directory, not how it is stored locally.

If you use the root of your app, including source code and _hidden files_ , as the public directory of your website, one permissions error means all sorts of things might be exposed, e.g. other dotfiles would also be exposed, and potentially all of your source code too, because you're relying on the web server to hide it somehow in every instance. That's the problem that needs fixed here (exposing the wrong files to public root), not that one particular hidden folder exists.

</comment></comment><comment><USER52> Imagine you find a typo or bug on some site that you use daily and it really annoys you. How awesome would it be able to just `git clone [http://www.microsoft.com/`](http://www.microsoft.com/`), fix the issue and then either host your own version of the site or submit a pull-request. Seems like it's already possible on 600 websites :) (well they probably didn't run `git update-server-info` ).

</comment><comment><USER53> For all those using github pages (gh-pages) to host their website, don't worry they've got you covered :D

</comment><comment><USER54> I discovered almost the exact same problem in a very large production site once, except it was the .svn directory.

</comment><comment><USER55> I'm not surprised in the slightest given the current trend to build everything in production.

</comment><comment><USER56> Wait, do people store repo passwords in .git? Otherwise a simple remote address means nothing.

<comment><USER57> I think it's more they have access to your codebase, which could then be analyzed to look for exploits.

</comment></comment><comment><USER58> git (and hg and svn and tar and cpio and pax and zip and ...) should set the permission of the archive (vcs db) to the most restrictive of the permissions of those added.

Also ... webservers should make it very hard to offer up .dotfiles as webcontent.

</comment><comment><USER59> Not rocket science, block it with "deny" ...

</comment><comment><USER60> tor exit node scanning my site 6:20pm PDT.

<comment><USER46> I found what seems to be a botnet scanning for /.gitattributes in my logs. First scan was on 2015-06-02

</comment></comment><comment><USER61> I'll get on tangent here, and blame PHP.

The model of exporting a Unix directory as the structure of a website is barely good enough for static sites (you'll get into all kinds of problems with URL management), and is completely unsuited for applications.

Now, of course, PHP was created as a tool to add a visitor counter at the bottom to your pages. With a bit of caution, it's indeed secure enough for that. Nowadays people create huge applications using the same security model, and PHP developers don't even think about changing it.</comment>


Who's Guilty When a Brain-Controlled Computer Kills? - <AUTHOR> https://motherboard.vice.com/en_us/article/wj8qan/whos-guilty-when-a-brain-controlled-computer-kills <comment><USER2> Brain control via induction vs. brain control via keyboard and mouse vs. brain control via fob or joystick. It's all the same brain, you aren't fooling anyone. The owner of the brain and/or the hardware that is causing harm is at fault. They can sue the vendor if they believe the hardware malfunctioned.</comment>


CloudFlare Route leak - <AUTHOR> https://www.cloudflarestatus.com/incidents/3zcnm4rnl0vv <comment><USER2> This is over. The organization that was leaking CloudFlare routes had been contacted and they have stopped.

If you are interested in knowing about route leaks affecting different companies I recommend: [https://twitter.com/bgpmon](https://twitter.com/bgpmon)

</comment><comment><USER3> Anyone else experiencing issues with CF more frequently lately? We appreciate the service provided, but we're averaging about 1 customer-impacting issue per week over the last few months. And we are considering alternatives. Today's incident was particularly bad, and you'd have no idea that NA was impacted from the status page.

<comment><USER4> No issues with over a year of running > 1B reqs/month.

Route leaks aren't really something they can defend against anymore than other ISPs until we get a better system in place.

</comment></comment><comment><USER5> This affected way more than Doha. Half of our US requests got dropped for 45 minutes while this was getting resolved.

<comment><USER6> I'm in Chicago and was impacted.

</comment></comment><comment><USER7> What is a route leak? DuckDuckGoing was unhelpful.

<comment><USER2> We wrote about this in the past when Google went down: [https://blog.cloudflare.com/why-google-went-offline-today- an...](https://blog.cloudflare.com/why-google-went-offline-today-and-a-bit- about/)

<comment><USER8> That was an interesting read. Perhaps I'm misunderstanding, but doesn't this mean a rogue ISP could take down a large chunk of the internet if they wanted to? If Moratel hadn't fixed the issue at their end, would Google have stayed down indefinitely?

<comment><USER2> No, because if the offender didn't stop misbehaving they'd find themselves disconnected from the Internet completely.

<comment><USER9> "disconnected from the Internet completely".

Perhaps a blog post on exactly how that is done. And after what particular time would that happen and is that something that needs to be coordinated or??

<comment><USER10> If there is a rogue actor on the internet, even at a large scale, the rest of the Internet blackholes their traffic, and treats them as a failure point. Various routing tables are updated across the internet to not consider them a viable destination or source, and traffic normalizes without them connected.

It isn't the action of one central authority, more a natural response to failure by separate parts of the internet.Its akin to shoppers and suppliers refusing to go to a particular store anymore. No one shuts the store down, but it no longer has products or customers.

</comment></comment></comment></comment></comment></comment><comment><USER11> Here is a traceroute from multiple locations during the incident: [https://pulse.turbobytes.com/results/56129a5becbe400bf8001c9...](https://pulse.turbobytes.com/results/56129a5becbe400bf8001c9f/) [https://archive.is/bsq2y](https://archive.is/bsq2y)

Note the 10 references to qatar.net.qa. Hacker News uses CloudFlare so a traceroute from my current location was going to qatar.net.qa as well.

</comment><comment><USER12> I still have Cloudflare disabled.... is everyone sure it's safe to re-enable it?

<comment><USER13> Looks like it to me [https://img42.com/g8maM+](https://img42.com/g8maM+)

</comment></comment><comment><USER13> It was quite a big hit, look at my activity graph [https://img42.com/g8maM+](https://img42.com/g8maM+) . Other than this instance CF has been rock solid though.

</comment><comment><USER14> I wondered why all my routes were going to Level 3 London, then to Qatar... from Tampa, FL for sites using CloudFlare and then dying.

</comment><comment><USER15> Perhaps explains why I was having trouble with Feedly today. Past tweets from them[1] indicate that they use CloudFlare.

[1] [https://twitter.com/feedly/status/480809578368487425](https://twitter.com/feedly/status/480809578368487425)

</comment><comment><USER16> Fundamental flaw in how services like Cloudflare are architected is that they propagate route leaks from obscure places all over the world.

<comment><USER17> Fundamental flaw in how BGP was designed from the old days. Give me a transit or peering connection where filters aren't in place, and you can announce anyone's IP blocks with their AS (SS7 is very similar, as it was built for a closed telcom ecosystem where all participants were trusted: [https://www.youtube.com/watch?v=lQ0I5tl0YLY](https://www.youtube.com/watch?v=lQ0I5tl0YLY)).

There are efforts to move to a more secure version of BGP, but that'll be done around the same time the transition to IPv6 is complete.

</comment></comment><comment><USER18> Fine now</comment>


Ask HN: Recommendations for combined CRM/support software? - J-H Hi everyone,
Maybe this is more of a dream than a reality, but I am looking for software that can act as both a CRM (categorizing leads, people, keeping track of follow-ups) and support software. So at one glance, I could see every communication that my team has had with a person, since the beginning.
Right now, we are tracking this with email and Zendesk, and it's becoming cumbersome. Is something like this out there? <comment><AUTHOR> Hubspot has both on their free plan, also marketing</comment>


Ask HN: How many Tabs/Windows open on average?  - <AUTHOR>

How many Tabs do you have on average? Desktop app? Does it affect your productivity. For me I find myself with an average of 6. I work best when I have 4 or 5 open simultaneously and I loose it at 12. <comment><USER2> When I'm in the zone, I have two browser tabs and dozens of editor tabs.

When I'm shaving yaks, I have one editor tab and 10 browser tabs.</comment>


Show HN: 12Kb open source minimal image editor - <AUTHOR> https://minimage.tk <comment><AUTHOR> I have a shit android phone. I can barely install 3 apps before it's full. So I made this very simple progressive web app to annotate photos/screenshots before I send them. Everything happens on the client and it works offline.

It also works on desktop browsers of course. You can paste bitmap data, draw on it, and right click/copy to have it in the edited form.

Feedback are really welcome. I think it should be split in 2 versions, one minimal for mobile, and one for screenshot annotation on desktop with more options (like a "pixelate for privacy" tool, a highlighter tool, etc ..).

Source is accessible here : [https://github.com/renanlecaro/minimage](https://github.com/renanlecaro/minimage) (PR and issues are welcome :) )</comment>


Covid-19 now exists in two forms, indicating it's already mutated at least once - <AUTHOR> https://academic.oup.com/nsr/advance-article/doi/10.1093/nsr/nwaa036/5775463?searchresult=1 <comment><USER2> There's some pretty sharp criticism of this paper on the r/COVID19 subreddit (which is the one where the scientists hang out):

[https://www.reddit.com/r/COVID19/comments/fdsltf/about_the_l...](https://www.reddit.com/r/COVID19/comments/fdsltf/about_the_l_and_s_strains/)

Basically, there are 111 different mutations, not 2, and it's misleading to point to a single point mutation and set that as the arbitrary division point between strains while ignoring the other 110 mutations that have been catalogued. There is currently not enough evidence for the researcher's claims that this particular mutation causes observable differences in the virus's reproduction or virulence characteristics that the other mutations do not.

<comment><USER3> What about whether or not you can "catch it again" once your immune system has beaten one version?

<comment><USER4> Immune system is amazing. It can actually detect different strains of the same virus, even if it has never seen that specific mutation. [https://www.sciencedaily.com/releases/2018/04/180430212353.h...](https://www.sciencedaily.com/releases/2018/04/180430212353.htm)

> "After exposure to one strain of virus, these memory cells are then better > able to recognise variants of the virus if they encounter them in the > future. The immune system learns to protect against a whole group of related > viruses, not just the one it experienced."

<comment><USER5> This is kind of a double edged sword though.

Say the virus mutates so that only 50% of its features are recognizable.

You'd think that the fact that your cells can recognize this is good, and it is to some extent, but, it also prevents new cells from learning about the virus(in efforts to prevent autoimmunity in analogous scenarios with non malicious objects; our immune system has to walk the fine line between being too permissive and allowing infections, and being too restrictive and murdering its own host through nasty autoimmune diseases).

So, it mounts a 50% response, which is often good enough, and more than makes up for the more limited response with speed.

But what happens when the % recognizable drops to like 3%? Some percentage of cells will recognize the 3%, and be able to mount a weak response, but more critically, block other cells from developing new responses. This limited response will slow down a proper response and itself will be likely ineffective.

Its known as "original antigenic sin", if you want to read more.

<comment><USER6> I hope COVID-19 isn't reading this.

<comment><USER7> I'm pretty sure covid-19 doesn't read Hacker News.

</comment></comment></comment></comment></comment></comment><comment><USER8> The key part of the summary to me is this:

 _Although the L type (∼70%) is more prevalent than the S type (∼30%), the S type was found to be the ancestral version. Whereas the L type was more prevalent in the early stages of the outbreak in Wuhan, the frequency of the L type decreased after early January 2020. Human intervention may have placed more severe selective pressure on the L type, which might be more aggressive and spread more quickly. On the other hand, the S type, which is evolutionarily older and less aggressive, might have increased in relative frequency due to relatively weaker selective pressure._

It's too early to really know for sure, but one thing that often happens with viruses is that over time, the less fatal versions spread more effectively. It might be that the L type is the more lethal type which killed so many people in Wuhan, and the S type is the more silent type that is spreading around the world with a lower mortality rate.

Probably just wishful thinking on my part, but it's interesting to be aware of the possibility.

<comment><USER9> > It might be that the L type is the more lethal type which killed so many > people in Wuhan, and the S type is the more silent type that is spreading > around the world with a lower mortality rate.

I suspect this is the main reason we're seeing divergences in different countries, with South Korea getting the "good" type and Italy getting the bad one.

> but one thing that often happens with viruses is that over time, the less > fatal versions spread more effectively

The key here is selection pressure more than time, with no controls in place there's no selection pressure until it runs out of hosts, until then it's highly successful and does not need to adapt. In this case we've added some artificial selection pressure.

If there are places with only the bad type of the virus I wonder if we could ethically introduce the good type? On one hand your saving overall lives but you'd be purposefully infecting people with something that potentially has life long effects.

<comment><USER10> I think it has to do with the number of hospital beds per capita. South Korea has over 12 per 1000 but Italy only has 3.1. That is probably making a huge difference.

The US only has 2.8 per thousand which is horrifying, I hope the Italy situation doesn't happen here.

<comment><USER11> Wow, how are those numbers so different? You would think a functioning health care system in any developed country would be similar. The controversial topic in the US isn't really the quality or quantity of healthcare, it's about who pays for it.

You might tell me it's because of something unique and bad in the US system, and we should see the Scandinavian countries to see how it should be done - but no, Denmark 2.6, Canada 2.5, Sweden 2.2 all have fewer beds per capita than the US. It's Japan and Korea who are the outliers at the top at 12 and 13. [0]

It really must be a cultural/lifestyle thing. Would I really spend 4 times as much of my life in a hospital bed if I lived in Korea? And if so, would that really be a good thing? I assume usage is reasonably high in both, the beds don't sit empty waiting for a pandemic.

Or you might remind me that those countries have famously old populations. But that's not it either. Japan has an old population, but still only twice as many 70+ as the USA (according to the population pyramids at [1]). And Korea has the same proportion as the US.

It makes me wonder if they are comparing like with like: maybe some of the reported hospital beds in Korea would be considered to be in nursing homes or convalescence centres in Europe or the US.

[0] [https://en.wikipedia.org/wiki/List_of_OECD_countries_by_hosp...](https://en.wikipedia.org/wiki/List_of_OECD_countries_by_hospital_beds)

[1] [https://www.populationpyramid.net/republic-of- korea/2020/](https://www.populationpyramid.net/republic-of-korea/2020/)

<comment><USER12> It is indeed very strange that Korea and Japan should have 400% more hospital beds per capita than the U.S., Canada, or Scandanavia. I tried to dig into the OECD methodology[0] to see if they mentioned anything noteworthy, but nothing grabbed my attention. Their notes about the U.S.[1] and Korea[2] seem pretty similar. I'm wondering if in Japan and Korea, people stay in hospitals for longer periods for the same condition than in the U.S. For example, in the U.S. mothers giving birth would stay in the hospital for a week or more in 1950s from what I heard, but these days they are discharged after a couple days. What's a typical stay for uncomplicated childbirth in Japan and Korea? If it's a week or 10 days, then that would give a possible datapoint for having many more beds.

[0] [https://stats.oecd.org/index.aspx?DataSetCode=HEALTH_REAC](https://stats.oecd.org/index.aspx?DataSetCode=HEALTH_REAC)

[1] Notes about the United States: Coverage: AHA-registered hospitals in the United States. U.S. hospitals located outside the United States are excluded. Includes all the AHA registered hospital beds for all types of hospitals. Estimates are for all AHA registered hospitals. AHA-registered hospitals include facilities such as short-term general, psychiatric hospitals, wards, rehabilitation institutes, maternity homes, tuberculosis hospitals, leprosariums and alcoholic treatment institutions. Estimates exclude U.S. associated areas such as Puerto Rico and AHA non-registered hospitals.

[1] Notes about the Korea: Coverage: Hospitals: all sorts of medical institutions equipped with wards of at least 30 beds. Excludes day-care beds, emergency beds, surgical tables, recovery trolleys, delivery beds and cots for normal neonates.

<comment><USER11> The methodology sounds quite similar, indeed.

Maybe the stays are just longer. In Ireland we've seen the same trend in maternity hospitals: mother and baby used to stay for a week, now a couple of days. But I thought that was just best practice now and keeping them longer doesn't improve health outcomes.

</comment></comment></comment></comment></comment></comment><comment><USER13> Covid-19 is the name of the disease. The virus is called SARS-Cov-2.

The virus has mutated plenty of times already and exists in many forms not just two. The paper talks about being able to group existing mutations into two types. Within each type the genomes share more common elements than differences.

<comment><USER14> The disease differs too though, the mutations are not inert, and they have a measurable effect on the severity of the complications.

<comment><USER13> the disease does differ greatly already within a subtype, the same subtype may cause severe or mild effects - the response is primarily host-related, not virus related

</comment></comment></comment><comment><USER15> See also: [https://nextstrain.org/ncov/gisaid](https://nextstrain.org/ncov/gisaid)

</comment><comment><USER16> Go look at [https://nextstrain.org/ncov](https://nextstrain.org/ncov) if you want to see all of the mutation paths! Wonderful site/org with contributors doing great work around the globe sending in sequences.

</comment><comment><USER17> A critique of this paper by some scottish virologists: [http://virological.org/t/response-to-on-the-origin-and- conti...](http://virological.org/t/response-to-on-the-origin-and-continuing- evolution-of-sars-cov-2/418)

</comment><comment><USER18> [https://bedford.io/blog/ncov-cryptic- transmission/](https://bedford.io/blog/ncov-cryptic-transmission/) \- For anyone looking for more info around how the transmission/mutation works. Quick read.

</comment><comment><USER19> Can we please correct the title? This is in reference to the virus SARS-Cov-2. Covid-19 is the name of the disease.

<comment><USER20> To back your claim: "The disease caused by infection with SARS-CoV-2 is now called COVID-19."

Source:[https://www.worldaware.com/resources/intelligence- alerts/sar...](https://www.worldaware.com/resources/intelligence-alerts/sars- cov-2-and-covid-19-coronavirus-intelligence-center)

</comment></comment><comment><USER21> Detailed rebuttal: [https://docs.google.com/document/d/1niBInt7tgQ57iihgenPFMyn7...](https://docs.google.com/document/d/1niBInt7tgQ57iihgenPFMyn7O1NHLLxsrgEQQnxXLSA/edit)

tl;dr this paper should be retracted

</comment><comment><USER22> Why does it take so long to develop a deactivated vaccine version of the virus to teach our immune system what to attack?

</comment><comment> Munky-Necan What was interesting about this, that is contrary to common understanding of virology and pandemics, is that there as a mutation that significantly increased the virulence of one strain of SARS-CoV-2. Over time, viruses will become less virulent as they continue to infect new hosts.

<comment><USER23> They used the word "aggressiveness", which does not necessarily associate with "virulence". As they are only looking at frequency data at the genomic level it is everyone's guess on how the distribution is achieved. I take it to mean shorter incubation time so that it spreads faster but also more easily impacted through infection control measures.

<comment> Munky-Necan > It is also unclear whether the L type is more virulent than the S type

You're right. I finally got a chance to read the study fully, but was basing my comments from the r/COVID-19 thread.

</comment></comment></comment><comment><USER24> Genes do what genes do. Nothing here is unexpected, surely? But, if the lethality drops and becomes sustaining in the population, we're still net- worse-off overall compared to not having had this virus. Its just 'choose the least-worst outcome' time.

I think at this point, public health initiatives are aimed at moving the shape of the curve, not the final trajectory of the virus. It's going to spread everywhere but if it does so more slowly the health system will not be overloaded by point-explosions of calls on staff and equipment.

I feel for the Tasmanian toilet-paper workers who will work overtime to meet a panic-demand, and then be unemployed with a mountain of un-wanted rolls, as we consume the 6 month supply we bought in a frenzy.

</comment><comment><USER25> One of the problem is naming. What is the difference of all these names? The L and the S type are they the one found in patient. Why stress non-recomb...

And all those mainland chinese academics ... sorry but CSB we trust them.

<comment><USER8> Ah, those untrustworthy Chinese academics who are calling for the controversial action of... more comprehensive followup studies.

<comment><USER26> That is controversial in some circles:

"Academic journal editors were banning unqualified FRIN statements as early as 1990"

[https://en.wikipedia.org/wiki/Further_research_is_needed](https://en.wikipedia.org/wiki/Further_research_is_needed)

<comment><USER27> Remainder of sentence:

", requiring more specific information such as what types of research were needed, and what questions they ought to address."

Article:

> Further studies investigating how the different alleles of SARS-CoV-2 > viruses compete with each other will be of significant value.

> If these changes are not due to sequencing errors, it would be interesting > to test whether and how these mutations affect the transmission and > pathogenesis of SARS-CoV-2.

> Thus, it will be interesting to investigate the function of the S84L AA > change in ORF8, as well as the combinatory effect of these two mutations in > SARS-CoV-2 pathogenesis.

> follow-up analyses of a larger set of data are needed to have a better > understanding of the evolution and epidemiology of SARS-CoV-2. There is a > strong need for further immediate, comprehensive studies that combine > genomic data, epidemiological data, and chart records of the clinical > symptoms of patients with SARS-CoV-2.

I'm not sure if I would call those unqualified statements. Some are a bit vague, but they do identify questions that should be addressed and that a larger dataset is required.

<comment><USER26> I was being mildly facetious.</comment></comment></comment></comment></comment>


China Should Have Stopped SARS-CoV-2 - <AUTHOR> https://svgshare.com/i/JKZ.svg <comment><USER2> There are definitely problems with the China system, but this was not the example of where it failed.

More "democratic" countries would have provably handled it worse — even with the existing information available from China, they did act worse. They, uhm, still _are_ acting worse.

Lockdown in China happened at fewer than 800 confirmed cases — in Italy at more than 9000!</comment>


Is Android Open Source or Not? Let's settle this once and for all. - <AUTHOR> http://tech.shantanugoel.com/2010/10/25/android-open-source-or-not.html

<comment><USER2> Android IS open source. That's really not the issue people who complain about it not truly being open though.

Android DOES allow carrier locking, as well as filling up the phone with utterly stupid carrier based bullcrap. The use of the OS by the carriers to shove stupid carrier specific stuff down our throats is what is annoying to most everyone. Occasionally, those UIs are a bit better, usually no.

<comment><AUTHOR> Do you think a mobile OS which mandates manufacturers not to lock would find any takers in the commercial world?

<comment><USER2> I personally don't think the people complaining about Android being open have merit, just as I don't think the people saying "Android is soo open" have merit either.

It's a carrier controlled OS which just has fewer regulations on it's appstore, however doesn't do centralized OS updates making development more expensive. I view it as a much more mixed bag than either "side" puts it.

On the true openness spectrum I rate it:

WinMo6/Android/WinMo7/Apple/BREW (Can't speak to Blackberry, haven't touched it).

</comment></comment></comment><comment><USER3> Everthing's relative. Android is more open than iOS. Debian is more open than Android.

<comment><AUTHOR> That is true. But saying that Android is closed in an absolute manner is incorrect, and also many people raise some points that are in fact arising because Android is open (e.g. carrier locking) which need explanation.</comment></comment>


ECHR orders Greece to pay damages over probe of death in wiretap case - <AUTHOR> https://www.reuters.com/article/us-greece-court-death/echr-orders-greece-to-pay-damages-over-probe-of-death-in-wiretap-case-idUSKBN1DH1WY <comment><AUTHOR> For those that don't remember or never heard of the case: [https://badcyber.com/the-great-greek-wiretapping- affair/](https://badcyber.com/the-great-greek-wiretapping-affair/)</comment>


Unix time - 15:30:08 UTC on Sun, 4 December 292,277,026,596 - <AUTHOR> http://en.wikipedia.org/wiki/Unix_time#Notable_events_in_Unix_time

<comment><USER2> At first i thought that year was the UNIX time stamp...

</comment><comment><USER3> So Earth-centric! Won't someone think of the post-human Andromeda colonists?

<comment><USER4> CHEKOV: We do believe all planets have a sovereign claim to inalienable human rights. AZETBUR: Inalien... If only you could hear yourselves? 'Human rights.' Why the very name is racist. The Federation is no more than a 'homo sapiens' only club.

-Star Trek, Undiscovered Country.

<comment><USER5> You know, her anger was bullshit.

First off, the word inalienable means: "unable to be taken away from or given away by the possessor."

Secondly, no shit, Earth came up with the idea of rights for humans well before space travel. So did other planets in the Federation. Checkov basically said, 'these rights we believe we all have, we believe we all have regardless of species.' Had we been talking to a Orion, he would have talked about Orion Rights. But, no, she just wanted to be angry.

And thirdly, "The Federation is no more than a 'homo sapiens' only club" is demonstrably false as the Federation was made up of many member races and earth was only one of several founding races.

<comment><USER3> The leadership of the federation at that time was almost entirely human. And I don't agree about the term "human rights". What if everyone used the term "European rights" even when talking about people on every other continent? It would be very awkward.

<comment><USER4> The obvious comparison that jumps to mind would be the word "mankind" in our (theoretically) post-sexist society.</comment></comment></comment></comment></comment>


If LinkedIn was actually useful then it would be worth 50 billion - <AUTHOR>

There has been lots of discussion following LinkedIn's IPO about whether it is really worth 9 billion dollars.
The thing is that LinkedIn is the best and only true social network for professionals.
The problem is that basically LinkedIn is largely optional, largely an amusement, and for many people, just not necessary.
It's an absolute disgrace that LinkedIn has not worked out how to actually be useful.  It SHOULD be an absolutely critical, essential part of every professional persons working day.
Instead it's basically a resume storage site which doesn't do much more than say who has just connected to who.  Ho hum.  I am actively bored by being hit with a list of who has connected to who - I just don't care.
HOWEVER, if LinkedIn actually managed to work out how to stop being bloody useless then it would easily be comparable in value to Facebook.
The question is, can Reed Hoffman and his team manage to work out how to make the largest network of professionals into something more thana trumped up resume publication service with a dash of twitter on the side?
Problem is that there is NO SIGN that the people running this company have any idea of the value of what they are sitting on, nor to they seem to have ANY CLUE how to turn LinkedIn into something of value.
What a waste of a HUGE opportunity.  Reed's good idea was to connect professionals, but that's where his good ideas ended.
And yes, I DO think I could do better.  It just doesn't seem that hard. <comment><USER2> >And yes, I DO think I could do better. It just doesn't seem that hard.

So if you can do better and it's easy, how about you actually do something about it other than whine on HN? And it's Reid.

<comment><AUTHOR> I meant I could do better if I actually was part of LinkedIn management. Obviously I am not proposing I could rebuild the entire achievement to date, that would be silly.

It's not whining, it's a reasonable comment - why the heck hasn't LinkedIn built something useful instead of resumes that are only shown to a few people, even though no-one actually seems to care if they are totally public.

LinkedIn has to be held to account for their failure to capitalize on owning the biggest (only) professional network in the world - why have they not been able to effectively capitalize/monetize it?

Answers please, not snippy comebacks.</comment></comment>


We've analyzed performance (CPU/memory consumption) of selected Java libraries - <AUTHOR> https://tech.ringieraxelspringer.com/blog/big-data-and-machine-learning/cause-i-remember-everything-measuring-performance-of-persistent-collections-for-java/hs620kl <comment><AUTHOR> While developing applications at scale, both performance and resource utilization truly matter. In the world of horizontal scaling, a lot of instances of the application could work across many instances of commodity machines with only limited resources - CPU and RAM in particular. Ability to lower memory consumption or CPU required while maintaining similar performance may result in lower costs - you can use less hardware to do the exact same job.</comment>


Daring Fireball: iPhone 4 Impressions and Observations - <AUTHOR> http://daringfireball.net/2010/06/iphone_4 <comment><AUTHOR> Apple appears to have really focused on hardware innovation for iPhone 4:

steel alloy antenna acting as frame

custom A4 chip

gyroscope

camera backslide illumination sensor

engineered glass and retina display

This seems like the biggest hardware upgrade to the iPhone to date. I think people will respond by making it a record-selling iPhone.

<comment><USER2> I mentioned this in the other thread, but hardware (and industrial design) is where Apple has greater expertise (and competitive advantage) over the competition. They are widening their moat.

Most of these hardware innovations translate directly to new/enhanced user experiences. And competitors like Google don't build phones - they build software. They are limited to what phone manufacturers (experts in phones - not software) can develop technologically.

This is not to say Android won't have greater market share - I just believe Apple realizes Google as a threat, and now heading in a direction that will be tricky for them to follow.

<comment><USER3> I think your right on the money there. Tha appeal of Aplle to Le has always been the integration of hardware and software and there's just no one else doing it at the same level. They don't get an unconditional pass from me when the screw up (mice!?) but they really seem to be playing to their competitive advantage with the new iPhone. The hardware is just bar none it seems. (not talking about spec sheets) Or they can certainly sell it as such.

</comment></comment></comment><comment><USER4> They did a great job hitting the big outstanding issues with the iPhone and pulling ahead in some key areas. When you combine the hardware refresh with all the new iOS4 features it really is a gigantic upgrade. It puts the last 12 months of Android/iPhone competition into better perspective. 3 months ago I would have said Google was outpacing Apple on hardware & software but I'm not sure now. What do you guys think?

<comment><USER5> It's irrelevant. Saying the iPhone has been losing marketshare to Android due to any hardware specs is like saying Coca Cola was losing marketshare to Pepsi in the 80's due to Pepsi tasting better. It seems logical, but it's just not the problem. That's why New Coke was a disaster, and it's why Android will outsell iOS soon (if it's not already).

Android is gaining because of carriers. What Apple really needed to announce (and why their share price dropped when they did not) was launching on Verizon.

<comment><USER6> Note that in the UK, iPhone 4 will be simultaneously available for three carriers: O2, Orange, and Vodafone.

Does anyone have any insights as to how AT&T is maintaining its iPhone exclusivity in the US? It's obviously great for AT&T, but seems to be very bad for Apple.

<comment><USER7> _Does anyone have any insights as to how AT &T is maintaining its iPhone exclusivity in the US? It's obviously great for AT&T, but seems to be very bad for Apple._

Yes: Apple signed a contract that gave them exclusivity until 2012. I'm guessing AT&T lawyers did a good job wording that clause.

<comment><USER6> [http://www.engadget.com/2010/05/10/confirmed-apple-and- atand...](http://www.engadget.com/2010/05/10/confirmed-apple-and-atandt- signed-five-year-iphone-exclusivity-de/)

I had always thought it was a 3-year deal expiring in 2010. I didn't see this news when it broke last month. So, no great mystery here.

</comment></comment></comment></comment></comment><comment><USER8> _Google remains the default search engine in iOS 4, but on all the demo phones in the hands-on area for the media, the search engine was set to Bing._

An interesting message! I'm guessing the map app is still using Google?

<comment><USER9> They may have just been showing off the new features since Bing was added in this version.

</comment></comment><comment><USER10> > _After using so much aluminum in recent hardware designs, it's interesting > that they're using stainless steel for the iPhone 4._

I wonder if this is related to the steel frame serving as the iPhone's antenna. Would steel be a better material than aluminum for this purpose?

<comment><AUTHOR> It's likely that steel is a better antenna but also it's probably stronger than aluminum. Their videos says they've made a special stainless steel that's even stronger than regular stainless steel. It'll also help for the stronger part of the phone to be the edges in case people drop their phone.

<comment><USER11> I wonder what the specs on the strength of this 'new stainless steel' are. I highly doubt that Apple is now pioneering new innovations in the realm of metallurgy "just to bring you a better iPhone," though their marketing would probably have you believe otherwise.

<comment><USER12> "Strength" of a metal is always a tweaked compromise of hardness and toughness. It could be that their steel is formulated specially for the particular structure of the iPhone 4. This wouldn't be a new pioneering branch of metallurgy, though it could be spun like that by marketdroids.

<comment><USER13> Agreed, drop a little more carbon into the steel and you've got your own new stainless steel that for all intensive purposes is probably identical to 3,000 types of steel already on the market by different producers globally.

Steel is steel, they probably researched the steel that works best as an antenna whilst not compromising the physical strength of the unit (for instance, you don't want the metal case to be the thing most likely to shatter on the device).

<comment><USER14> > intensive purposes

I love that eggcorn. It's "intents and purposes", btw.

</comment></comment></comment></comment></comment></comment><comment><USER15> From what I've been reading, the hardware seems rather nice.

Not sure I like the iAds (concept) though especially if the ad data downloaded is counted against the data limit before extra charges occur. Has anyone seen anything on the details for this?

Still thinking Android since I have a choice of vendors.

<comment><AUTHOR> Most likely all data is counted for with AT&T. But ad data probably is negligible because the whole ad is not downloaded, just the banner. It's only when you click on the ad that the rest of the ad is visible as html 5.

<comment><USER16> Is this confirmed? I understood (from the OS 4 intro a couple of months ago) that the whole ad was cached on the device, which obviously makes opening it faster.

</comment></comment></comment><comment><USER17> _It also improved the field of view for the display — you can view the display from an oblique angle and it looks great._

This could get annoying in public places, where you don't want people looking at your phone.

<comment><USER18> I noticed that it was real common in Japan for people to place a protective cover over their mobile's screen that prevents viewing from an angle. With so many people so closely grouped together on trains, it's a necessity.

<comment><USER19> > With so many people so closely grouped together _trying to read porn_ on > trains, it's a necessity.

At least, that was my experience of trains in Tokyo, anyway.

</comment></comment></comment><comment><USER20> I wonder, does the HTC Evo have the same fusion of touchscreen and glass? So no more dust-under-the-glass issue as well or is Apple the poinere here?</comment>


Wafer Chocolate: The Way I like it (A different Design) - <AUTHOR> http://rikacomet.blogspot.in/2013/01/wafer-chocolate-way-i-like-it-what-is.html

<comment><USER2> You can get something similar to what you describe in England: [http://www.aldi.co.uk/uk/media/product_range/02_frozen_foods...](http://www.aldi.co.uk/uk/media/product_range/02_frozen_foods/icecreamwafers_pdff.jpg)

See the one on the left. I am able to confirm that they are 10x more delicious than choc ices and wafer ices individually.</comment>


Simple Statistics is stats in node.js & the browser for humans - <AUTHOR> http://macwright.org/2012/06/26/simple-statistics.html

<comment><USER2> Another library to check out: <http://www.jstat.org/>

Although this looks nice for its simplicity.</comment>


Outline – An Open Source Team Knowledgebase - <AUTHOR> https://github.com/outline/outline <comment><USER2> Good old DokuWiki[1] has few dependencies (not even a database), is super easy to set up without Docker and comes with a zillion useful plugins. Its wiki markup format is supported both for import and export by pandoc.

Just saying...

[1] [https://www.dokuwiki.org/](https://www.dokuwiki.org/)

<comment><USER3> The better thing about dokuwiki is that it's easy to maintain. The documentation tells you all the data/Metadata directories you need to backup. I messed my install somehow the other day and it was easier to backup those data directories and start a clean install. And it's also easy to backup the data to git since it's just text, and that's what I do.

</comment></comment><comment><USER4> Mandatory Google or _shudders_ Slack account for registration without any other option? Why?

</comment><comment><USER5> If anyone is after a different approach, or alternative requirements, I've been working on BookStack [1] for the last few years in my free time.

[1] [https://www.bookstackapp.com/](https://www.bookstackapp.com/)

</comment><comment><USER6> The self-hosted requirements are pretty hefty.

Node.js >= 12 Postgres >=9.5 Redis >= 4 AWS S3 storage bucket for media and other attachments Slack or Google developer application for authentication

Requiring Postgres and Redis for a documentation site seems overkill. Also not a fan of requiring S3, an option to save the media to the local disk would be nice. This seems somewhat over-engineered for a knowledgebase, especially when some of the competition has no runtime requirements other than a webserver (DokuWiki, statically generated Gatsby/Hugo sites). And I can still get Slack notifications on edit from MR notifications.

</comment><comment><USER7> Outline looks clean and very similar to Notion. We use Notion in our company. Wondering if Outline could be a cheaper alternative (and with an API).

</comment><comment><USER8> I'd recommend giving "DynaList" a look as well. Use it daily.</comment>


Cities Are Recklessly Unprepared for Self-Driving Cars - <AUTHOR> https://scout.ai/story/cities-like-seattle-are-recklessly-unprepared-for-self-driving-cars <comment><USER2> >municipal 5G wifi or a public blockchain to help vehicles communicate with one another

What the hell am I reading?</comment>