List of Sites Affected by Cloudflare's HTTPS Traffic Leak - <AUTHOR> https://github.com/pirate/sites-using-cloudflare/blob/master/README.md <comment><USER2> Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact.

> As you may be aware, Cloudflare incurred a security breach where user data > from 3,400 websites was leaked and cached by search engines as a result of a > bug. Sites affected included major ones like Uber, Fitbit, and OKCupid.

> Cloudflare has admitted that the breach occurred, but Ormandy and other > security researchers believe the company is underplaying the severity of the > incident …

> This incident sheds light and underlines the vulnerability of Cloudflare's > network. Right now you could be at continued risk for security and network > problems. Here at Dyn, we would like to extend a helpful hand in the event > that your network infrastructure has been impacted by today's security > breach or if the latest news has you rethinking your relationship with > Cloudflare.

> Let me know if you would be interested in having a conversation about Dyn's > DNS & Internet performance solutions.

> I look forward to hearing back from you.

<comment><USER3> It's clever but feels at least a 3/10 shitty. Dyn is an old company and back in the day they provided free subdomains while nobody else did. I haven't used them recently because their pricing seems so high. How do others feel about them?

<comment><USER2> I still have a lifetime standard DNS subscription with them from back in the day when they were dyndns.org and you could physically mail them cash. The DNS hosting has been very solid (except for the day Mirai took them offline) but the standard query limits are way too low for any moderately trafficked website. All the managed DNS providers I looked at seem to have very restrictive query limits without a "enterprise - contact us" plan, one of the reasons why I decided to just do DNS-only on Cloudflare.

<comment><USER4> Why not he.net?

<comment><USER2> I use he.net DNS quite a lot for personal projects. I've had a few instances where DNS was not resolving that make me a bit cautious to move larger sites onto their service.

</comment></comment></comment></comment></comment><comment><USER5> I wrote this(1) script to check for any affected sites from local Chrome history. It checks for the header `cf-ray` in the response headers from the domain. It is not an exhaustive list but I was able to find few important ones like my bank site.

1: [https://gist.github.com/kamaljoshi/2cce5f6d35cd28de8f6dbb27d...](https://gist.github.com/kamaljoshi/2cce5f6d35cd28de8f6dbb27d586f064)

<comment><USER6> I wish 1Password had a feature where you could put in a list of domains like this or a "Auto Change Possibly Compromised Passwords" feature.

<comment><USER7> Isn't this what Watchtower is supposed to be for? I have no idea if AgileBits is going to add this list to Watchtower, though.

<comment><USER8> Disclaimer: I work for AgileBits, makers of 1Password

I am helping comb through a list of sites to see which of those has suggested password updates.

I think we've had very few sites suggest updating the password though. Have you all seen any sites explicitly state users should update? If so I'd love a list so we can get them in Watchtower.

Kyle

<comment><USER9> I would subscribe to Watchtower, or, heck, probably even 1Password Famlies, if AgileBits took a more aggressive/proactive approach to password updates: 1\. Prompt batch password resets for services whose vulnerabilities have been exposed _before_ those exposed admit their breach to consumers (e.g. _All_ services compromised by the Cloudflare dump - usually consumers are the last to know). 2\. Preformed _all_ password resets in a secure AgileBits browser (assuming the browser built-in to 1Password on iOS is secure). 3\. Had an optional prompt to prevent unintentionally syncing/backing-up 1Password data, and accessing said secure browser without first confirming VPN status with the operating system (maybe even prompt user to connect to VPN before unlocking if VPN connection isn't established)

Alternatively, I'd subscribe for integration of a 1Password browser extension for a reputable (regularly high, multiplatform AV-Test/NSS performance) internet security service's browser, and Watchtower was as sensitive as mentioned above and integrated with said internet security service.

This is coming from a longtime 1Password Pro user (3-6 yrs) who recently got his family on the 1Password bandwagon.

<comment><USER10> Yep, I totally agree. Before I read this thread, I actually tweeted to 1Password to ask if they would be willing to produce some way for me to quickly cross reference the Cloudbleed sites against my 1Password vault.

I think Watchtower alerts should be based on _any_ publicly known breach, not based on what the companies themselves say.

At this point, I consider any account using an affected Cloudflare service as potentially compromised.

This is a missed opportunity for 1Password to say that not _only_ is your vault safe, but we will _also_ help protect you from any potentially sites that had their data exposed.

</comment></comment></comment></comment></comment></comment><comment><USER11> Today I learned that uber does not have a change password option once you are logged in. You have to log out and pretend you forgot the password. Bad UX if you don't know.

<comment><USER12> Holy crap, really? I've been drawing up [profiles for the user account systems of a bunch of websites for the past few years][1], and I think I've only seen that _once_ before (on a Washington State website, no less).

[1]: [https://github.com/opws/domainprofiles](https://github.com/opws/domainprofiles)

<comment><USER13> Fairly common pattern on non-tech-oriented sites, in my experience.

</comment></comment></comment><comment><USER14> Worth noting this statement by Cloudflare CTO:

"I am not changing any of my passwords. I think the probability that somebody saw something is so low it's not something I am concerned about."

[http://www.bbc.co.uk/news/technology-39077611](http://www.bbc.co.uk/news/technology-39077611)

<comment><USER15> *Article says COO, but Twitter says CTO. Strange.

And he's fairly active on these forums. That seems like such an odd thing to say given how important security is/should be at CF...curious if jgrahamc would further clarify his position here.

<comment><USER16> Agreed on the importance of security, but if his credentials from outside their network are able to be used in any significant way to impact their services or systems then they're doing something _tragically_ wrong. For that matter if his credentials can be used _anywhere_ to impact their services it's a failure.

</comment></comment></comment><comment><USER17> Aww man I submitted my list hours ago but I guess it never made it past the New page. [https://github.com/pirate/sites-using- cloudflare](https://github.com/pirate/sites-using-cloudflare)

Original post: [https://news.ycombinator.com/item?id=13720199](https://news.ycombinator.com/item?id=13720199)

<comment><USER18> Hey! Super useful, thanks.

Quick question: news.ycombinator.com (as an example) is listed in the README as a potentially affected site, but I don't see it in the raw dump that I've downloaded. Am I crazy?

<comment><USER19> I suspect the raw dump is a list of sites that use the CloudFlare DNS servers, but HN uses a CNAME setup on their own authoritative DNS servers so it wouldn't appear in that list.

</comment></comment></comment><comment><USER20> That's a wide impact. While any hijacked account is bad, some of these are _really_ bad.

For example, [https://coinbase.com](https://coinbase.com) is on that list! If they haven't immediately invalidated every single HTTP session after hearing this news this is going to be bad. Ditto for forcing password resets.

A hijacked account that can irrevocably send digital currency to an anonymous bad guy's account would be target number one for using data like this.

<comment><USER21> I also noticed the domain waveapps.com, which is for Wave Accounting.

<comment><USER22> Cloudfare has advised that Wave data has not been affected/leaked. We've got engineering and security teams investigating, and we'll keep on it until we're ultra confident in the conclusion. Nonetheless, good practice for everyone to rotate all passwords today, for any services. Good security hygiene any time, and especially now.

<comment><USER23> How can they know that?

A broken web page could have been queried many, many times the last weeks and couldn't one of the responses contain Wave data?

<comment><USER22> Not 100% sure what their methodology is yet, and we're taking a cautious approach. At minimum, in the data that they've found in the wild, no Wave data was among it.

</comment></comment></comment></comment></comment><comment><USER24> You missed the "possibly" in the header.

And the disclaimer right at the top:

 _This list contains all domains that use cloudflare DNS, not just the cloudflare SSL proxy (the affected service that leaked data). It 's a broad sweeping list that includes everything. Just because a domain is on the list does not mean the site is compromised._

<comment><USER25> Affected sites leaked data from random other CF customers. So any site using CF regardless of settings could have leaked private data out there.

<comment><USER2> Sites using Cloudflare in DNS only mode won't have sent any requests that could be leaked.

<comment><USER26> Indeed, and it's pretty annoying having my site in that list despite _not_ using CloudFlare's reverse proxy service. If my website handled user logins or sensitive data no doubt I'd have customers contacting me or shying away from my site now. This list needs more vetting.

<comment><USER27> Do you have a concrete suggestion for the list maintainer to better vet the list?

Can you prove that your site did not use the reverse proxy service at any point while the vulnerability was live?

<comment><USER26> > Can you prove that your site did not use the reverse proxy service at any > point while the vulnerability was live?

This is a scenario where it's _impossible_ to prove innocence. Even if somebody provided you with the logs of their DNS server to show that the website never pointed to CloudFlare, I doubt these logs were stored in a way that their authenticity could be proved. In any case, the onus of proof should almost always be on the accuser, not the accused.

Since you pressure me for a suggestion: my suggestion would have been to only list websites that were using the reverse proxy service (as opposed to DNS) at the time the data was captured. This can be done by inspecting the http response headers, or maybe even just checking the DNS records against known CloudFlare servers (as opposed to checking the DNS _provider_ ).

But since you point out the transience of this, this method, as well as the method used to gather the list as-is are fundamentally flawed. I think a better way would be to locate DNS dumps throughout the vulnerability period & apply the above method to those.

<comment><USER27> Thanks for answering!

Your last idea is a good idea but more work for the list editor. I'm not sure the motivations of the list editor, but if he or she is just an impartial volunteer (important assumption), it seems like it's really Cloudflare's responsibility to deliver a comprehensive report of affected sites, so that we don't have to guess?

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> For what it's worth, as part of work on the effects of DNS on Tor's anonymity [1] we visited Alexa top-1M in April 2016, recording all DNS requests made by Tor Browser for each site. We found that 6.4% of primary domains (the sites on the Alexa list) were behind a Cloudflare IPv4-address. However, for 25.8% of all sites, at least one domain on the site used Cloudflare. That's a big chunk of the Internet.

[1]: [https://nymity.ch/tor-dns/](https://nymity.ch/tor-dns/)

</comment><comment><USER29> I wrote a simple website[1] to show if user have visited the websites included in the list automatically without browser plug-ins. It uses :visited CSS pseudo-class to highlight the site user have visited before. It is not 100% accurate, but it can be a fun way to quickly show people that they may visit sites on the list.

[1][https://cloudbleed.github.io/](https://cloudbleed.github.io/)

<comment><USER30> I want to share this with my more non-techy persons, but, on Chrome, turning of uOrigin, their are no names of companies listed. I can hover over every block for the name, but.. is this an error, or intentional to just have a large heart-block with no labels?

<comment><USER29> Could you suggest how the names of companies should be shown so we can improve the website? Appreciate your reply :)

<comment><USER30> Just a right-side text that highlights once you mouse-over would be great. It may be too much to display all of names, but having it populate gives some idea of where you need to go.

Perhaps just every "red"/affected site could be populated on the right side :)

Appreciate the layout outside of naming labels however, nice work.

</comment></comment></comment></comment><comment><USER31> Webmasters and App-devs running on CloudFlare. You (at least) have to "force- logout" your users that have a "remember me" cookie set.

At least change the cookie name so the token stops working. For example, in ASP.NET - change the "forms-auth" name in the web.config file

<comment><USER32> If you do that, then an attacker could just use the same token with a different cookie name and access someones account. You NEED to invalidate the token.

</comment></comment><comment><USER33> If I have an account on an affected site, but did not interact with the site (via my browser or through some other site with an API call) during the time period when the vuln was live, am I still at risk?

<comment><USER34> It seems very unlikely that you would be at risk, but there's some remote possibility that your past request data was in memory for some reason

</comment></comment><comment><USER19> This list doesn't appear to include sites that use a CNAME setup with CloudFlare -- i.e. sites on the Business or Enterprise plans that retain their authoritative DNS and use CNAMEs to point domains to a CloudFlare proxy.

There probably aren't many but with something this serious it could be important. I'm not sure how one would go about finding the sites that use the CNAME option. If it helps, they use a pattern like:

      www.example.com --> www.example.com.cdn.cloudflare.net

Hacker News is one such site, but it's listed in the "notable" section (it's not in the raw dump).

</comment><comment><USER35> In an email from Cloudflare sent out this morning they said:

> In our review of these third party caches, we discovered data that had been > exposed from approximately 150 of Cloudflare's customers across our Free, > Pro, Business, and Enterprise plans. We have reached out to these customers > directly to provide them with a copy of the data that was exposed, help them > understand its impact, and help them mitigate that impact.

Does this jive at all with the Google or Cloudflare disclosures? They are claiming that across all caches they only found and wiped data from ~150 domains, can that be true?

<comment><USER36> Every single thing Cloudflare has said about impact has sounded very suspiciously optimistic to me. For example, they claim that they would know if an attacker had been intentionally exploiting this bug, but I've seen no details to justify their confidence.

So no, I don't think we can assume that the scope was as limited as they're making out.

Edit: As my coworker points out, as of 2013, they only kept 4 hours of access logs (source: [https://blog.cloudflare.com/what-cloudflare- logs/](https://blog.cloudflare.com/what-cloudflare-logs/)). So basically their existing attack detection infrastructure (built without knowledge of this bug) may not have found anything suspicious, but it appears that that's the extent of what they can say about the last few months. They can claim that they found no evidence within the last week (one hopes that they stopped discarding logs when they found out about the attack), but if they want to convince us that they know this wasn't being exploited as late as two weeks ago, they need to provide specific evidence.

</comment></comment><comment><USER37> That list isn't that useful... First of all, there is a LOT of pages hosted by CloudFlare @taviso acknowledged that in the original bug report. ([https://bugs.chromium.org/p/project- zero/issues/detail?id=11...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1139#c5)) Furthermore, you can't say which sites were hit by this bug and simply listing all CloudFlare sites is more or less fearmongering. If you are a verified victim of this bug CloudFlare will contact you. Lastly, if you want to be sure to mitigate effects of the attack just do it... If you want to be absolutely sure that your session keys etc will remain uncompromised simply repeal all active session cookies.

<comment><USER38> While Cloudflare might contact their customers, it's no guarantee that the customers will actually notify their users, so I think this is a good way to find out which sites I might have to change my passwords and API keys on.

<comment><USER39> The email Cloudflare is sending out to customers where Cloudflare didn't find any cached info isn't particularly alarming: [http://pastebin.com/pUnKJE3J](http://pastebin.com/pUnKJE3J)

I wouldn't be surprised if people receiving this took no action.

<comment><USER40> Well, in the Google Zero Project issue ticket, the engineer said he felt Cloudflare tried to downplay the severity and it took them extra days and a lot of demanding from Google Zero Project team to finally get a draft (which from a legal and a company reputation PoV that makes sense; you need a lot of eyes on the draft before going out to the public).

I think not every "leak" is sensitive, but there are definitely instances Cf and Google both found very sensitive information.

</comment></comment></comment></comment><comment><USER41> Something I have a hard time understanding, is how Cloudfare's cache generator page had access to sensitive information ?

Were the 2 things running on the same process? If they were not, there's no way that the buffer overrun could read an other process memory, right? it would have failed with a segfault type of error.

If so, shouldn't Cloudfare consider running the sensitive stuff on a different process, so that no matter how buggy their caching engine is, it would never inadvertently read sensitive information?

<comment><USER42> SSL connections were terminating at the proxy, so the proxy used plain HTTP to the web service backends.

<comment><USER43> Are you sure about this? Just because they terminate ssl on the proxy doesn't mean the traffic between the proxy and the web service backends was plain HTTP. That's certainly not how we do things.

</comment></comment></comment><comment><USER44> This is ridiculous and somewhat irresponsible. This is just a list of domains using CloudFlare. The leak was only active under a set of very specific cases (email obfuscation, server-side excludes and automatic https rewrites).

I question Pirates ([https://github.com/pirate](https://github.com/pirate)) motives for even doing this? Karma? Reputation?

<comment><USER45> Only a few hundred sites were leaking, sure, but the leaked info could have come from any domain that was being proxied by the same edge server. So we would do better to assume that any domain that uses Cloudflare could have had their passwords and other sensitive info exposed via leaky neighbors.

</comment></comment><comment><USER46> I'm confused by the "not affected" remarks. I thought the issue was any site which passes data through cloudflare could be leaked by requests to a different site, due to their data being in memory. Have I misunderstood?

<comment><USER47> The update from 1password indicated that there was application layer encryption happening in addition to the TLS encryption, so a breach of the TLS protection did not expose any sensitive data. Presumably other sites are in similar situations. But don't take my word for it, go change all your passwords.

<comment><USER48> > Presumably other sites are in similar situations.

Not to my understanding. 1password uses client-side encryption, using keys generated from your master password. This means that any data transmitted over the wire is already encrypted, whether over SSL or not.

Most other sites do _not_ do this, at all, in any way. If you use a website that use'd CloudFlare's SSL termination, change your passwords, cancel your credit card (if you sent it to that site in the past few months, eg Uber/Lyft).

> go change all your passwords.

Yes, correct =].

<comment><USER49> If you'd seriously cancel your credit cards over this, I'd love to hear how you model that threat relative to all the other risks inherent in using a credit card anywhere (not just online).

</comment></comment></comment></comment><comment><USER50> Apparently root case was:

/* generated code */ if ( ++p == pe ) goto _test_eof;

"The root cause of the bug was that reaching the end of a buffer was checked using the equality operator and a pointer was able to step past the end of the buffer. This is known as a buffer overrun. Had the check been done using >= instead of == jumping over the buffer end would have been caught."

Detailed timeline:

"2017-02-18 0011 Tweet from Tavis Ormandy asking for Cloudflare contact information

2017-02-18 0032 Cloudflare receives details of bug from Google

2017-02-18 0040 Cross functional team assembles in San Francisco

2017-02-18 0119 Email Obfuscation disabled worldwide

2017-02-18 0122 London team joins

2017-02-18 0424 Automatic HTTPS Rewrites disabled worldwide

2017-02-18 0722 Patch implementing kill switch for cf-html parser deployed worldwide

2017-02-20 2159 SAFE_CHAR fix deployed globally

2017-02-21 1803 Automatic HTTPS Rewrites, Server-Side Excludes and Email Obfuscation re-enabled worldwide"

Seems like a pretty good response by cloudflare to me.

<comment><USER51> It's a good postmortem (describes WHAT happened), but it doesn't really communicate the impact to Cloudflare customers or their end users (describe WHY people should care).

</comment></comment><comment><USER18> I've been tinkering with a Python notebook for a few minutes to try to quickly assess how much of my LastPass vault is affected:

[https://gist.github.com/dikaiosune/0ca7829884b3b3f790418f0f1...](https://gist.github.com/dikaiosune/0ca7829884b3b3f790418f0f108fd38f)

Improvements welcome.

One interesting thing: the raw dump that's linked from the list's README doesn't seem to include a couple of notable domains from the README itself, like news.ycombinator.com or reddit.com. I may be mangling the dump or incorrectly downloading it in some way.

EDIT: disclaimer, be responsible, audit how the dump is generated, etc etc etc

</comment><comment><USER52> Authy is on the list. It would be _really_ nice if they confirmed whether they are vulnerable or not, considering they hold all of my 2FA tokens. Otherwise I'll have to re-key the database.

<comment><USER53> Wouldn't you rather just do that as a precaution? Then you won't be constantly worried that they might have had their data leaked.

</comment></comment><comment><USER54> I wrote a python script to help check your LastPass database for any potentially affected sites.

[https://github.com/RidleyLarsen/cloudbleed_check_lastpass](https://github.com/RidleyLarsen/cloudbleed_check_lastpass)

</comment><comment><USER55> Is there a "standard" in the works for changing a password? Stuff like this is happening rather too frequently for my taste. I need a tool I can use to update all my passwords everywhere automatically and store the new ones in my password manager.

<comment><USER56> LastPass has auto-password change: [https://blog.lastpass.com/2015/05/auto- password-change-now-a...](https://blog.lastpass.com/2015/05/auto-password- change-now-available-in-the-lastpass-security-challenge.html/)

<comment><USER57> Dashlane has that feature too.

</comment></comment></comment><comment><USER58> I ginned up this little tool tonight to help people out instead of grepping.

[https://bleed.cloud/index.html](https://bleed.cloud/index.html)

Sorry for the index.html, trying to figure out how to get index file to work on cloudfront.

You can also run the python script on the website anonymously on your computer to dig sites out of your email, which is a good indicator that you have an account with them.

</comment><comment><USER59> I have hundreds of passwords in my password manager. That's going to take a week, considering I also have to work.

<comment><USER60> Is your password manager 1Password?

[https://blog.agilebits.com/2017/02/23/three-layers-of- encryp...](https://blog.agilebits.com/2017/02/23/three-layers-of-encryption- keeps-you-safe-when-ssltls-fails/)

<comment><USER59> No, it's keepassx on my laptop. I don't trust my passwords to somebody else.

<comment><USER61> So why do you have to change them all?

<comment><USER59> My cleartext passwords could have been dumped into the responses of some other site together with my user names. That's the gist of this incident.

<comment><USER62> I still don't understand why you have to change every password (are not they supposed to be all different in a password manager?). Of course if you are super extra mega careful then change them all...

<comment><USER63> pmontra doesn't have to change every password, just every password used by a website using Cloudflare (thus the purpose of the list of affected sites).

</comment></comment></comment></comment></comment></comment></comment><comment><USER64> This list seems to be missing any sites that are using custom nameservers, which would be common on top sites using the enterprise plans. A better way to detect if the proxy is being used would be to resolve the IP and see if it lies in Cloudflare's subnets.

</comment><comment><USER65> And, I've found several of my domains on this list.. Some of which don't host web content etc and only use cloudflare for DNS. The list is currently ~4.3mil entries, which honestly feels like a rather low figure. I have no data to back up my gut feeling though ;)

Anyway, I'm OK with them being on this list, as I believe understanding the scope of the problem is important to figuring out how we prevent these kinda problems in the future.. (For example, answering this question requires understanding who uses CloudFlare: Why are so many sites concentrated on a single infrastructure?)

</comment><comment><USER66> Thanks for posting and curating this list.

</comment><comment><USER67> Oh crap. I've entered my banking password into Transferwise quite a few times.

Welp, time to change all my passwords.

<comment><USER68> > _Welp, time to stop using the same password for multiple services._

> _Welp, time to start using a password manager._

FTFY

<comment><USER69> OP isn't saying they used the same password for transferwise as for their bank. Transferwise allows you to log into your internet banking and authorize a transaction through their site. You actually give them your internet banking password, regardless of how you log into their site.

Which is pretty strange in itself, to trust a 3rd party with your internet banking password, but that's how it works.

<comment><USER70> This is the main reason I've never used Mint.

</comment></comment></comment></comment><comment><USER71> Do browsers still leak history info (eg [http://zyan.scripts.mit.edu/sniffly/](http://zyan.scripts.mit.edu/sniffly/)) is it possible to have a page show visitors if they are likely to be affected?

</comment><comment><USER72> What if I sign in with facebook or other? Should I change muy password con facebook or what?

<comment><USER73> TL;DR? You should be ok...

Long Version.

That (most likely) would of used oauth. So instead of sending your FB password to the site to log you into FB with. You give your FB password (if your not signed in) to FB and then facebook give the site using "sign in with Facebook" a token they can use with facebook to get account info / do actions on your FB account.

Now depending on which "sign in with" system you used then often the code handed back to the site (via a callback URL handled by the client) is a single use code. So once the site using "sign in with" has used the code with FB they get another set of tokens they will use with Facebook directly.

After the initial "sign in with" process the Facebook tokens are most likely never handed to clients (because they often need to be mixed with a site secret during requests to the likes of Facebook).

So you _should_ be ok if you used a decent "sign in with" system like facebooks as the only thing that would of been handed back to the client and then sent from the client to the site is that single use code. The communication with the site and facebook would of used an API endpoint.

Now... If you used another sites (not facebook) "sign in with" system and their API is also behind Cloudflare it could well be that some API keys could be in a cache somewhere. If those requests were signed with secrets you should be fine because without the sites secrets to lets say create a hmac signature for the request then while there might be some personally identifiable information in caches somewhere the signatures should of already expired meaning that they can't be used in say a replay attack and the data cached can't be used to create fresh requests.

BUT this all depends on everyone doing things right, which may not be the case. But either way, oauth tokens are often not revoked when you change your password. I.e. you might change your FB password and then still be able to auto login on somesmallsite.org because the tokens shared between FB and somesmallsite.whatever haven't changed.

<comment><USER72> Thanks for this answer, its perfect!

</comment></comment></comment><comment><USER74> Couldn't find a practical description of who is affected anywhere. Is it just the customers who have Cloudflare HTTPS proxy service being affected, or anyone using Cloudflare DNS is affected?

<comment><USER75> Anyone who passes HTTP or HTTPS traffic via CloudFlare might have had that data leaked into other users sessions.

</comment></comment><comment><USER76> Has Cloudflare fixed the issues? Should I update passwords now or wait?

<comment><USER77> Yes, they've fixed the issue, so it's safe to change your passwords now. But expect some websites to prompt you to change your passwords again once they disclose the breach.

</comment></comment><comment><USER78> It would be more useful if there was a way to see sites that actually were using the Cloudflare features that caused this bug. A large number of sites use Cloudflare, but few should have been affected by this bug:

> When the parser was used in combination with three Cloudflare > features—e-mail obfuscation, server-side excludes, and Automatic HTTPS > Rewrites—it caused Cloudflare edge servers to leak pseudo random memory > contents into certain HTTP responses. > [https://arstechnica.com/security/2017/02/serious- > cloudflare-...](https://arstechnica.com/security/2017/02/serious-cloudflare- > bug-exposed-a-potpourri-of-secret-customer-data/)

<comment><USER79> As has been mentioned elsewhere on HN, those 3 features were capable of triggering the bug. Once triggered, potentially any Cloudflare-enabled site could have been affected.

</comment></comment><comment><USER80> Unfortunately this seem to include news.ycombinator.com

<comment><USER81> > This list contains all domains that use cloudflare DNS, not just the > cloudflare SSL proxy (the affected service that leaked data). It's a broad > sweeping list that includes everything. Just because a domain is on the list > does not mean the site is compromised.

In this case, HN , IIRC, does not use the proxy.

Checking the certs, CloudFlare reissue using DigiCert, I think, whereas HN is using a Comodo cert.

<comment><USER75> You can upload your own cert to CloudFlare.

Hacker News does hit the CF proxy and was affected.

      $ host news.ycombinator.com
      news.ycombinator.com is an alias for news.ycombinator.com.cdn.cloudflare.net.
      news.ycombinator.com.cdn.cloudflare.net has address 220.127.116.11
      news.ycombinator.com.cdn.cloudflare.net has address 220.127.116.11

</comment></comment></comment><comment><USER82> The list of websites once again reminds me of what avenue Q immortalised in song: the internet is for porn

</comment><comment><USER83> Just received an email from Glidera, a Bitcoin exchange. This is the first service to ask me to reset my password. I wonder why Uber, NameCheap, FitBit, and many others have yet to warn their users? Is Cloudflare downplaying this?

> Hi [Username],

> A bug was recently discovered with Cloudflare, which Glidera and many other > websites use for DoS protection and other services. Due to the nature of the > bug, we recommend as a precaution that you change your Glidera security > credentials:

> Change your password > Change your two-factor authentication

> You should similarly change your security credentials for other websites > that use Cloudflare (see the link below for a list of possibly affected > sites). If you are using the same password for multiple sites, you should > change this immediately so that you have a unique password for each site. > And you should enable two-factor authentication for every site that supports > it.

> The Cloudflare bug has now been fixed, but it caused sensitive data like > passwords to be leaked during a very small percentage of HTTP requests. The > peak period of leakage is thought to have occurred between Feb 13 and Feb 18 > when about 0.00003% of HTTP requests were affected. Although the rate of > leakage was low, the information that might have been leaked could be very > sensitive, so it's important that you take appropriate precautions to > protect yourself.

> The actual leaks are thought to have only started about 6 months ago, so > two-factor authentication generated before that time are probably safe, but > we recommend changing them anyway because the vulnerability potentially > existed for years.

> Please note that this bug does NOT mean that Glidera itself has been hacked > or breached, but since individual security credentials may have been leaked > some individual accounts could be vulnerable and everyone should change > their credentials as a safeguard.

> Here are some links for further reading on the Cloudflare bug:

> TechCrunch article: [https://techcrunch.com/2017/02/23/major-cloudflare-bug- > leake...](https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked- > sensitive-data-from-customers-websites/) > List of sites possibly affected > by the bug: [https://github.com/pirate/sites-using- > cloudflare/blob/master...](https://github.com/pirate/sites-using- > cloudflare/blob/master/README.md)

> If you have any questions or concerns in response to this email, please > contact support at: firstname.lastname@example.com

<comment><USER84> Namecheap: [https://blog.namecheap.com/cloudflare-security- incident/](https://blog.namecheap.com/cloudflare-security-incident/)

</comment></comment><comment><USER85> I would like to point out that, if most sites used two-factor authentication, this leak would be at most a minor inconvenience. Maybe we should push for that more. Just days ago I talked to Namecheap about its horrible SMS-only 2FA and asked them to implement something actually secure, maybe contact your favorite site if they don't have 2FA yet.

<comment><USER86> If you setup TOTP (Authenticator) while this bug was out in the wild your shared secret key could have leaked. SMS would actually be safer than TOTP in this scenario.

<comment><USER87> That's insightful. So you shouldn't only reset your passwords, but your TOTP setup too (if you set it up in this period).

I think it's a flaw of TOTP though. The client secret should be client generated and should never leave the device.

<comment><USER86> Yes, unfortunately both the client and server need to have that shared private key to generate the same codes.

Transmitting the key over a 'secondary' channel would have protected people here.

It begs the question of whether or not TOTP is really 2FA if it is setup using a single channel of communication.

</comment></comment></comment></comment><comment><USER88> Do I need to change my cloudflare password?

</comment><comment><USER40> Would Internet Archive able to "cache" the leaks?

</comment><comment><USER89> this is another data point that supports my personal, hare-brained theory that the expectation of privacy on the internet is simply naive, a fool's errand. it never existed, and never will.

this is despite (or maybe because) of my best efforts to secure systems as a major part of my job.

</comment><comment><USER90> Volusion.com

</comment><comment><USER91> The title is misleading (for now). It is just a list of all sites using CF, compromised or not.

<comment><USER92> All sites are compromised. Anything which was in memory, which could be any site, would be spewed out. Regardless of which site was used as the trigger.

<comment><USER91> A quote from the page:

> This list contains all domains that use cloudflare DNS, not just the > cloudflare proxy (the affected service that leaked data).

</comment></comment></comment><comment><USER93> "List of Sites _possibly_ affected"

Sites using Cloudflare, really. However, Cloudflare say that only sites using three page rules were affected - email obfuscation, Server-side Excludes and Automatic HTTPS Rewrites. [1]

Is this over-estimating the impact, perhaps?

[1] [https://blog.cloudflare.com/incident-report-on-memory- leak-c...](https://blog.cloudflare.com/incident-report-on-memory-leak-caused- by-cloudflare-parser-bug/)

<comment><USER94> No! And this is why cloudfare's poor write up continues to confuse people. Sites with those features triggered the bug. Once the bug was trigerred the response would include data from ANY other cloudfare customer that happened to be in memory at the time. Meaning a request for a page with one of those features could include data from Uber or one of the many other customers that didn't use those features. So the potential impact is every single one of the sites using CloudFare. Not over-estimated at all.

<comment><USER39> The email Cloudflare is sending out to their customers has a pretty "no big deal" tone as well: [http://pastebin.com/pUnKJE3J](http://pastebin.com/pUnKJE3J)

I assume there's a separate email for sites where they happened to find Google cache data, but...</comment></comment></comment>


5 Tips on increasing your podcast audio quality - <AUTHOR> https://www.weeditpodcasts.com/5-tips-on-increasing-your-podcast-audio-quality/ <comment><USER2> Simple steps to follow which garner good results.</comment>


Theranos Sued for Alleged Fraud by Robertson Stephens Co-Founder Colman - <AUTHOR> http://www.wsj.com/articles/theranos-sued-for-alleged-fraud-by-robertson-stephens-co-founder-colman-1480364852 <comment><USER2> So there have been several suits from investors / lenders at this point. I read earlier an interesting point that these suits are essentially Theranos' investors & bondholders for priority in the inevitable bankruptcy.

Because in a bankruptcy judgments are given priority over debt, if you holding Theranos' debt you can try to jump to the front of the line by suing for fraud (etc), in the hopes that you can get a judgement in your favor.

So the real takeaway is, it seems all these companies have concluded that bankruptcy is inevitable.

<comment><USER3> I think not bankruptcy...

It's been reported that Theranos still has $400M in cash. And the founder has majority control.

So this is a very rare condition, where there is still assets in the company (so a judgement can be paid) but the company has no business plan. So you have a founder who's best play now is sit around for the next 10 years spending down that $400M on new business plans to see if something hits.

<comment><USER2> 400M isn't that much. Per Glassdoor Theranos has 790 employees; assuming that was before layoffs and the numbers in the news (~340 layoffs) are accurate, that's 450. Since it's an R&D company in Palo Alto, average total comp is likely north of $250k per person, but even at that it's $110M a year in payroll alone. And medical research isn't exactly cheap, I bet it easily spends over $100M in research costs. So at that burn rate Theranos has 2 years to keep the lights on. It takes more than 2 years for a medical company to bring a new product to market.

Go ahead, halve all my numbers and argue that Theranos actually has a burn rate of 4 years: It still doesn't matter, there is no way they'll get something through the FDA (especially given recent history) in 4 years.

<comment><USER4> Honest question. Why isn't the board just shutting everything down rather than let it continue to burn through cash? Are there sufficient insiders tin whose interest it is to continue their payday?

<comment><USER5> Board can't make that decision if the CEO has majority voting rights.

<comment><USER6> Honest question: what's the point of having a board then?

<comment><USER7> It's valuable to have prestigious board members when fundraising, even if they're essentially powerless and have no experience in your industry, like a retired United States Marine Corps general [1]. It give you legitimacy and credibility.

[1] [https://www.theranos.com/leadership/board-of- directors](https://www.theranos.com/leadership/board-of-directors)

<comment><USER8> Why should an old military figure lend credibility to a biotechnology firm?

<comment><USER9> Because you're being pitched on the biotech firm being able to land fat military contracts.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I think this exposes a great deal of how money and wealth concentrated at the top is flowing to people not based on merits but by their socioeconomic lineage.

Imagine that $15 million dollar invested in $50k USD increments into 300 startup ideas, the jobs that will be created, increased human capital and impact on their respective local economies, that are not there because of risk adversity (it still amazes me VCs would shun risk but still throw around "venture") towards people of lower class then them. For example, somebody coming straight out of university vs. the daughter of a CEO at a large company who also attends the same country_club/religious functions, suddenly looks like a safer bet.

It looks like a pretty hopeless situation for Theranos but it also exposes the crony capitalism that you'd find in other parts of the world with ease, with heavy hitters like Henry Kissinger (wtf) sitting on the board.

He will most likely never see that money again because he thought he was mitigating risk by piggybacking behind a powerful individual with powerful connections that's accessible by blood.

It's hard to feel any sympathy.

<comment><USER11> > Imagine that $15 million dollar invested in $50k USD increments into 300 > startup ideas, the jobs that will be created...

That sounds pretty naive. $15 million isn't a huge amount of money in business, and in most parts of the country $50k isn't a livable salary. I'm sure people can scrape by on that, but don't pretend it'd be doing them a huge favor.

The more I think about it, the more exploitive it seems. Great for tricking recent college grads into wasting a few years to build a website, but not so great for actually developing new technology.

<comment><USER12> > That sounds pretty naive. $15 million isn't a huge amount of money in > business, and in most parts of the country $50k isn't a livable salary.

Who's being naive?

The median net compensation last year in the U.S. was $29,930.13, meaning half of all wage earners earned less.

Median income for an entire household (ie more than one person) in the US is about $51k. Meaning about half of all households make less than that.

Assuming half the population of the country doesn't die suddenly in the next three weeks it's fair to say that $50k is "livable"

<comment><USER13> It also depends where you live: [http://www.seattletimes.com/seattle- news/data/80000-median-w...](http://www.seattletimes.com/seattle- news/data/80000-median-wage-income-gain-in-seattle-far-outpaces-other-cities/)

Consider that YC will throw you 200k but you're going to be moving to an area where the median income is $90k

This of course wouldn't be an issue if people didn't insist on living in the bay area, but nobody takes you as seriously if you're remote.

<comment><USER14> > It also depends where you live

Sure, but that doesn't change the actual...you know... _averages_ the parent cited. For every household with over $51k, there was a household with under $51k.

Pointing out that some corner of the US is expensive hardly changes the point.

<comment><USER13> I'm not debating the definition of the median... I assume everyone knows how percentiles work. I'm debating the idea that its meaningful to use the median income of the entire united states as a comparison.

Prices in San Jose aren't brought down by prices being lower elsewhere because location is basically the most important dimension in real estate.

The median house being 188k in america means nothing when all the houses you can choose from cost over 1mil. And you're stuck there because the bay area has a near monopoly on startups, especially if you receive funding from a bay area accelerator.

Let me take the parent's comment to the next level:

"The median net compensation last year in the world was around $1,200, meaning half of all wage earners earned less. Assuming half the population of the planet doesn't die suddenly in the next three weeks it's fair to say that $50k is "livable""

Equally inapplicable to someone who lives in the bay area.

<comment><USER14> Okay, have fun being an edge case I guess.

<comment><USER13> I don't live in San Jose but my city's on its way there so thanks ;)

We're all edge cases in the world as a whole.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Theranos Litigation Profile: [http://www.plainsite.org/profiles/theranos- inc/](http://www.plainsite.org/profiles/theranos-inc/)

Colman et al v. Theranos, Inc. Docket: [http://www.plainsite.org/dockets/3350guyw8/california- northe...](http://www.plainsite.org/dockets/3350guyw8/california-northern- district-court/colman-et-al-v-theranos-inc-et-al/)

</comment><comment><USER16> It's going to be mighty interesting to see what all comes of Theranos and these suits.

<comment><USER17> Indeed, early 2015 year a couple VC friends warned me that Theranos was a bunch of crock and everyone knew it, and that it was going to be the company that would send rippled through the venture market in 2016. Well 2016 was sure a cold year for venture. When I think about Elizabeth as an entrepreneur, on one hand I respect her for trying something so audacious, and sticking with it for so long. However, the one thing that the valley doesn't teach you (in fact quite the opposite) is that there are actually almost no short cuts in startup, get capital and deploy it building a strong and resilient product and business around it, then take it to market. Elizabeth got really caught up in taking absolutely nothing feasible to market, and that's a damn shame.

<comment><USER18> It's not just about "trying something audacious" or "sticking with it". Do that with your social photo sharing site.

People's medical diagnoses and health is on the line here. The cavalier attitude of "getting caught up in taking nothing feasible to market" makes me sick.

<comment><USER17> I agree, I think I sounded softer than I actually feel about it. She should probably go to jail, I just do think she tried something hard, and tried something hard for a long time (she started in 2003), and failed. She should have realized _when_ she failed though.

</comment></comment></comment></comment><comment><USER19> Theranos keeps providing its steady output of schadenfreundian porn ; not that i complain. Is this series of events unprecedented or is it standard practices after a typical fraudster collapses?

</comment><comment><USER20> Is there a reason as to why this company is not dead yet?

<comment><USER21> I get a sense that Holmes has surrounded herself by the kind of people who will stand by her crazy side to pretty much the end.

I'm not going to armchair psychologist and suggest a diagnosis... but she's gotta be something...

</comment></comment><comment><USER22> The Theranos story seems to get darker by the week...

</comment><comment><USER23> I hate these links to articles that are behind a pay wall. If people cannot read it, what's the point?

<comment><USER24> The "web" link beneath the submission title will bring you to a search page with a link to the actual article, which should get you around the paywall.</comment></comment>


Omnidrive CEO Nik Cubrilovic: We're Not Dead. Again. - <AUTHOR> http://www.readwriteweb.com/archives/omnidrive_ceo_nik_cubrilovic_responds.php <comment><USER2> Clay (angel investor) states, "Why did Omnidrive fail in my opinion? Something strange can happen in the valley and I think Nik got trapped by it completely. Too many parties, too many conferences, too much working between 1-4am, not enough working normal business hours, too much socializing, not enough focus, no business development, and not enough follow up and delivery."

If true, this is more a lack of self-discipline and prioritizing than the "SF effect."

</comment><comment><USER3> There have got to be thousands of online storage companies. Why does this particular one get write-ups?

</comment><comment><USER4> The SF effect itself is a lack of self discipline.</comment>


Building the New Twitter.com - <AUTHOR> https://blog.twitter.com/engineering/en_us/topics/infrastructure/2019/buildingthenewtwitter.html <comment><USER2> To the posted article, I think it's impressive they are shipping a single codebase for mobile and desktop. Modular features you can turn off for different views. It's smart and I'll be curious to see if other sites follow suit.

Unfortunately they've now ported one of the most offensive feature from mobile to desktop. The "Home" timeline, with tweets out of order. And the real kicker; you can still select "latest Tweets first" but then the app literally undoes your preference every week or two, forcing you back to their "Home" view. It's offensive.

Also a small thing, but the new desktop Twitter now has obfuscated CSS classes for everything. The names change frequently too, maybe at every deploy? Anyway it makes it a lot harder to modify the desktop HTML presentation with an extension or set of ad blocker rules.

<comment><USER3> One of the main things that keeps me using a third-party client (for as long as I can continue using one) is the Home vs.Latest Tweets feature. I NEVER want to see the home timeline. I always want a reverse-chronological list of tweets. It is user-hostile to have to continuously select Latest Tweets. I'm sure they see more engagement with the Home timeline, but I just want to be able to flip a switch and never see it.

<comment><USER4> Search results in reverse chronological order is Twitter's killer feature but, bafflingly, it seems like they've been going out of thier way to prevent that for years now, especially on mobile. Why? Also, if there's any Android app which lets you do that without having a Twitter account, I'd love to know about it. I used to use a nice little app called SearchBird for this, but it's disappeared and I can't find a replacement.

<comment><USER5> Either hard to efficiently implement at scale, or they want users to forget about reverse chronological ordering in hopes of monetizing feed rank

<comment><USER6> I'm pretty sure it's easier to sort by -timestamp than to run a complex ranking model across all recent tweets (which would have to be windowed by timestamp anyway), and then sort by the output of that.

Seems to me like they are going out of their way to force their "top tweets" algorithm on users.

<comment><USER5> It's a global platform with billions of users, with many users follow hundreds of people, some users followed by millions, huge volumes of media tweets, broad distribution of posting frequency... even with those basic scaling concerns, I don't see how consistent reverse chronology could be implemented as naively as "yo just sort by -timestamp".

I would bet "top tweets" improves engagement with the passive consumption audience while saving money by abandoning consistency and improving caching.

</comment></comment></comment></comment></comment></comment><comment><USER7> I just get the impression the PM's at Twitter don't actually use it, and worse, engage with people who use it, enough. I follow a ton of CMOs, social media directors, agency heads, people who use Twitter to drive business and commentate regularly on their industry, and they have expressed disdain for product direction decisions for years around the "mobile-ification" of the desktop experience. Now it seems they're pushing total usability-hostile 'features' to their desktop webapp.

Really, who on earth over there made the call that two tweets visible if there's an embedded image, even on a large 27" 1080p monitor, was a good idea?

<comment><USER8> Twitter isn't going to make money with a bunch of power-user features for non- paying users. They're going to make onboarding painless and the overall experience as unintimidating as possible. That means minimizing features that don't keep people on the site and viewing ads.

<comment><USER9> Non-paying users? These are the people and the businesses creating the most interesting and valuable content on the Twitter platform. They directly make Twitter as a platform more valuable and enjoyable for end users.

<comment><USER10> I don't think Twitter cares about "interesting" or "enjoyable", only "attention grabbing" — and even the political troll bots can produce that by themselves.

</comment></comment></comment></comment><comment><USER11> I find it all so bizarre. Everything from how big the font size is in the left nav, to the ordering of the nav items, to how the feed and right nav scroll together (can't see the top of the right nav if you scroll down the main feed) to how huge tweets with images appear (can only see 2 tweets if they contain images on a massive desktop screen) to the fact that you cant resize the left or right nav on your own...

<comment><USER12> What's bizarre about it? It looks a lot like the reddit redesign to me, and seems to be focused on emphasizing sponsored content more, if I had to speculate.

Large-picture tweets taking up a lot of space means that large-picture interstitial ads and promoted tweets also take up lots of space. I would guess also that scrolling the right-hand column gives a lot more automatic eyeball space to trending stuff in sections below the fold, and is no longer constrained to just screen height for what everyone will usually see there. Who's going to willfully scroll down the trending column of promoted stuff separately from the main feed?

The left-nav stuff seems much more straightforward for new users, even if it's a useless change for long time users who already know how to operate the site.

<comment><USER13> The "display" setting is a good start. Give me options to hide the left-nav, the trend, and I'll be cool with it.

<comment><USER12> Why in the world would they give users the option to hide trending stuff?

<comment><USER14> If I want my content based on others' opinion, I go to Reddit.

What's the point to follow accounts if you're not guaranteed to see their content, and not in the prefer they intended to?

</comment></comment></comment></comment></comment><comment><USER15> Why on earth is the text of Home/Explore/Notifications etc on the left bold and twice as big as the content aka the tweets?

You see the navigation every day. You know where it is. Its not that you have to read through it. So if anything, shouldn't it be smaller?

<comment><USER16> I would also like to be able to see my username somewhere. Its confusing when managing multiple accounts

</comment></comment><comment><USER17> I tried the new Twitter interface, it was so bad that if I hadn't been able to go back to the normal one, I would have stopped using twitter. It had successfully reduced the density of information by splashing whitespace everywhere on the page and navigation on it was way inferior.

<comment><USER18> I don't like it either. How do I use the older version?

<comment><USER19> Set your user agent to `Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko`

<comment><USER20> My twitter followers have confirmed that this works!

<comment><USER21> For me, deleting all cookies and logging back in works.

<comment><USER22> Neither this nor resetting one of the cookies to "off" (another method) works at all times. These are client-side overrides.

However, the user-agent spoofing works because it fakes IE11 on Windows 7 and it triggers a server-side override.

</comment></comment></comment></comment></comment></comment><comment><USER23> A high percentage of the time when I attempt to view a twitter page on mobile the spinner times out and just gives a "something went wrong" error. There is a Try Again button but clicking on it is futile, as it always goes back to "something went wrong" error after a second. The only thing that seems to work is to ask the browser to refresh the page, sometimes more than once.

Is this only happening to me? I always wondered what the hell is going on.

<comment><USER24> Happens to me too all the time on mobile and boy is it infuriating. I either get the "something went wrong" or the "you're being rate-limited," neither of which make any sense for someone opening tweets every now and then inside other apps.

I assume it's because when you open tweets with in-app browsers etc. Twitter wants to make it a poor experience in order to get you to use their app instead. Same reason they have been gutting their API features and limiting API tokens for 3rd party apps for years now.

</comment></comment><comment><USER25> Bring back full historical search back to the UI. Every search I do is limited to the past week. It used to be you could keep scrolling down and you'd keep seeing past tweets.

I don't care about this new UI thing. Don't care one bit.

<comment><USER15> I don't see such a limit. When I search, I still can scroll. Just tried and it worked all the way down to 2011.

<comment><USER25> Hah, it seemed like they only restricted it for my IP address. When I use a proxy, it works.

</comment></comment></comment><comment><USER26> Another prime example why UI redesigns are a waste of time - [https://debugandrelease.blogspot.com/2019/03/ui-redesigns- ar...](https://debugandrelease.blogspot.com/2019/03/ui-redesigns-are-mostly- waste-of-time.html)

<comment><USER27> But what if you have a total of 3000 engineers. What will all of them do? Perhaps a handful of them can investigate and try new things?

<comment><USER28> Or maybe you have them work on complementary products to your... oh wait Twitter leadership has no desire for a B2B presence, so it can't build B2B tools. Oops.

</comment></comment></comment><comment><USER29> Am I in the minority of folks that enjoy Twitter's algorithmic sorting?

In the classic timeline view, I always felt the urge to check my feed all the time, in case i missed part of the conversation or the like (a la "FOMO.")

<comment><USER30> I think the better way to handle this would be a tab that includes all the stuff they think you'd like. Good things you missed, things your friends have liked, discussions they're in, people you should check out, tweets that are probably relevant to you based on your behavior.

I honestly wouldn't mind seeing that stuff if I have a, "Oh, what else on here is good" feeling. But it makes me crazy that they keep insisting that I really must want to see it right now, when I am very sure I don't.

<comment><USER31> That's how [https://tweetdeck.twitter.com/](https://tweetdeck.twitter.com/) works. You have a Home column, which is strictly things the people you follow have tweeted and retweeted, in chronological order; and you have a separate Activity column for those other things (and optionally more columns for searches, lists etc.)

</comment></comment></comment><comment><USER32> Wasn't it great when we all had API access and could choose between different clients that had different emphasis? I'd be happy to pay too.

</comment><comment><USER33> This strong sign of the confidence Twitter has in React Native for Web[1]. In 2017, Nicolas Gallagher gave a talk[2] about why it was used for mobile.twitter.com.

[1]: [https://github.com/necolas/react-native- web](https://github.com/necolas/react-native-web)

[2]: [https://www.youtube.com/watch?v=tFFn39lLO-U](https://www.youtube.com/watch?v=tFFn39lLO-U)

<comment><USER34> How do you know they use React Native for Web? The article says they unified their desktop and mobile architectures, but doesn't specify how.

<comment><USER33> Opening in React devtools shows a number of hints[1]. "React Native Style Editor" section. "View" components with numeric "style" props. And the classname prefixes "css-" and "r-" match the generated identifiers from react- native-web[2].

[1]: [https://imgur.com/lFUvL7P](https://imgur.com/lFUvL7P)

[2]: [https://github.com/necolas/react-native- web/blob/45f94eb43da...](https://github.com/necolas/react-native- web/blob/45f94eb43daa3cb3d7fae0295877345a176c04c4/packages/react-native- web/src/exports/StyleSheet/compile.js#L81)

<comment><USER34> That's convincing :-) Thanks!

</comment></comment></comment></comment><comment><USER35> I have to use Tweetdeck, because not having a reverse-chronological timeline is such a dealbreaker. If they ever remove this ability from Tweetdeck, I will probably just leave.

I'm already on Mastodon and more active there anyway, it didn't turn into a ghost town like the last time I tried it.

</comment><comment><USER36> I like it, but I have a weird bug.

It could have something to do with some of my extensions, but every time I open the new Twitter on Firefox, it has me logged out...but if I refresh the page, I'm back to being logged in and I can browse my feed.

<comment><USER37> I experience this as well, but in Chrome.

I've tried it several times over several weeks, always revert back to old design.

</comment></comment><comment><USER38> Engineering at Twitter must be a constant context switch. Every quarter there's a new blog post about some new re-design they're working on.

</comment><comment><USER39> All that work, and still I had to use right-click "open image in new tab" to see the text of a meme?

Is anybody in there actually using that thing? (those in user-facing changes authority?)

<comment><USER40> Somebody worked very very hard on an algo that figures out which part of the image is important and they're not going to let some dumb users with silly opinions like "I want to see the whole thing" ruin it.

</comment></comment><comment><USER41> My biggest pain as far as missing features is new tweets. In the old interface if I had someone's timeline open, There'd be a number '(n)' in the tab that indicated there were new tweets. If I went to the tab I could click on a show new tweets button and see them. A nice side effect of this was that you could easily view deleted tweets as they were queued and shown normally.

The new interface has none of this.

<comment><USER14> Yes. Not the biggest, but a huge pain.

</comment></comment><comment><USER42> I know there are different opinions but I like it. I like the dark theme, the explore tab, the "data saver" option and also that the navigation experience got better (backward button points you back to the correct tweet). Well done!

I only hope they do not remove the "see latest tweets" in the home tab.

</comment><comment><USER43> I am not sure they could have added more white space to the new Twitter if they tried. I would not kill them to adapt to the amount of screen real estate that I have.

</comment><comment><USER44> The mobile-first page is a lot better than the old one. I've been using it for a while.

... When still using Twitter, that is. The platform decisions like showing me notifications of things I never subscribed to in any way ("look, some person you don't follow tweeted this") and can't unsubscribe from is 100% offensive to me and one of the major reasons I really don't like using the platform anymore (besides a crippled API and only now slowly improving mobile app).

That said: The website is amazing on mobile. It feels NOTHING like 99% of webapps out there. How are they doing it? Are they damn wizards?

<comment><USER45> Is the navigation on mobile for you on the left or on top? No matter how small I make the browser window on desktop it still shows the navigation on the left side as a vertical bar but on mobile it always shows as a top bar. It's a big difference in my opinion and I am curious which version you like.

<comment><USER44> I like the mobile version.

And shit, I thought they just made the old mobile.twitter.com the default. Instead they made a new site that also mobile.twitter.com points to, so you can't get the old style back.

Oh well, a lot of meaningful interaction for me already happens on the Fediverse and with Twitter's moves I don't think that will decrease.

Check out Pinafore ([https://pinafore.social/](https://pinafore.social/)) for a light weight client.

</comment></comment></comment><comment><USER46> On my 13'' MBP there are many tweets I can't see completely unless I scroll down. This is wrong.

</comment><comment><USER47> It's an odd choice to put the tweet button at the top of the dialog rather then the bottom where your eyes and mouse should be after finishing the tweet message.

</comment><comment><USER48> They got 1 code base. I got a UI that I don't like.

1\. There used to be a drop down for "copy link" to a tweet. So I could tweet then paste the URL across other platforms. Now I need to click the link, and copy the URL manually, and it's laggy.

2\. The darker dark mode dims the text too. 3\. The font size setting has no affect on making a new tweet...

As usual, company degrades experience for users on UI upgrade...

<comment><USER49> For 1, the link to the relative time the tweet was posted (1 minute ago, 15 seconds ago, etc) is a direct link to the tweet. Right click, copy link location (or your browser's equivalent). This has been the case as long as I can remember.

</comment></comment><comment><USER50> Nice to see they are still working with Progressive Web Apps.

I'm really interested in seeing if PWAs can reach first class citizen status everywhere. Still a bit skeptical as installation from web is still wonky in Chrome. Google was pushing PWAs pretty hard for a while on the developer side....browser felt like an afterthought... that worries me.

</comment><comment><USER51> Never used twitter. Just made an account using work email to test twitter login. Didn't do a single thing yet. And my account gets blocked for 'suspicious activity' and they want my phone as well. What a shady company.

<comment><USER52> This happened to me as well when I recently tried to make an account with an email address and no phone number. It was frozen almost immediately after creation, and when I requested it be unfrozen, twitter sent a message to my main email (NOT the one I signed up with!!) and required me to respond and say I had access in order to get the account back up. Made me very uncomfortable and virtually destroyed any desire I had to use their service.

</comment></comment><comment><USER53> Twitter has changed the front end like five times in the past five years and improved exactly zero of those times. They need to lay off 80% of their front end devs to keep them from just pointlessly churning the website.

</comment><comment><USER54> I quite like the redesign except the annoying sidebar on the right hand side, its way too big and pushes everything too far to the left for my liking

I wrote this Stylus rule to get ride of it and make the main box a bit wider. It's a blunt, brute force rule but it works for now...

      .r-1ye8kvj {
          max-width: 700px
      }

      .r-1ovo9ad {
        display:none;
      }

The downside is it gets rid of the search input.

Also I suspect those class names are auto generated by something so the above rules will probably break if they ever do a redeploy

<comment><USER55> As someone pointed out earlier, it seems they're changing CSS classes constantly to deter scraping, so this might not work for long.

</comment></comment><comment><USER56> After the reddit redesign and a twitter redesign I am starting to suspect that annual bonuses in those companies are tied in to the negative KPI.

</comment><comment><USER57> With the new Twitter in Firefox it logs me out immediately after I close the window (no, I'm not incognito.) Also if I sign in using a different browser none of the options are saved. It's pretty annoying. It is a bit snappier, but it has a lot of annoyances. I can no longer go back to "old Twitter," either...so, it's a mess.

</comment><comment><USER58> I wish they would fix the 'Report Tweet' bugs - I keep getting stuck in a seemingly endless rotation of pop up dialogs once I complete a report.

Or is this a deliberate dark pattern to curb people's enthusiasm for reporting bad content?

</comment><comment><USER16> I dont have strong opinion for their new design but i find it a bit goofy with those very rounded corners. I don't know if the single codebase is a good idea, time will tell if they will end up like Windows 8

</comment><comment><USER59> Is there some kind of cookie hack I can run to get the new UI? Would be nice if engineering posts included a way to change your feature flag so I can experience what is being discussed.

</comment><comment> martin-adams One area I wish they would improve is the DMs. Being able to organise them into folders would be amazing, but just marking one unread again would be a huge improvement.

</comment><comment><USER60> > So we enable these shortcuts whenever we detect a keyboard.

How exactly do they they do this? Is it just detect keypress so load the shortcut code, or more complicated?

</comment><comment><USER61> Cool, now when is Twitter going to adopt ActivityPub?

</comment><comment><USER62> Does anybody know what song is playing in the background? Or think it was custom recorded for this video.

</comment><comment><USER63> Is this why they were down a few weeks ago? Dual testing / feeding the feed in a secondary system

</comment><comment><USER64> Does anyone know what's under the hood? React? Vue? Something I don't even know enough to ask about?

<comment><USER65> It's React (I think they mention this in the article) and I believe they are actually using React Native for Web, the engineer behind that works for twitter and the generated markup and classnames match how that works. Perhaps they are considering moving to React Native for their mobile apps in future... though there are other valid reasons to use React Native for Web

<comment><USER66> Is using react-native for Web better than having react & react-native for your UI and nicely separated business logic that is reusable for both? If you use react native for Web, does it mean your UI will look exactly the same whether it is on the web or mobile?

</comment></comment></comment><comment><USER67> If they had just stopped developing Twitter years ago, it would be a better product today.

</comment><comment><USER68> so the new version is the mobile site that's been active for awhile right? Someone tipped me off about using the mobile version on desktop a few months back and I never went back. Faster/more streamlined etc

</comment><comment><USER69> I like it. Snappy & nice looking UI (with the bigger bolder fonts).

</comment><comment><USER70> The new twitter.com which turns out to be the mobile version they released years ago and that has been working ever since, but with two sidebars.

</comment><comment><USER71> There is no new twitter until the corruption involved in twitter is taken to a head. Any technology will never improve the lousy policy and posturing that they do as a company.

</comment><comment><USER72> Oh weird, I thought the new Twitter was called "Mastodon"...

</comment><comment><USER73> > The techniques and technologies we've used on the new Twitter.com mean you > only download and run code when it's needed. So a mobile user won't download > the sidebar you see on the home page, and may not download the settings > pages until they go to update their display name. However, it also means > that the full functionality of the site is still available to them should > they want to access it.

Can someone explain to Twitter's web developers that there's nothing groundbreaking about this idea? Like... lmao. That's how web apps should work. That's how traditional django and rails apps already work. I like JavaScript and React as much as any web developer but if you're loading unnecessary code that's actually degrading the usability then that's a problem to be fixed asap. And it's definitely not something worth mentioning in this press release.

Oh wait, this was post written by "software engineers", not "web developers". They're probably too smart for these details.

</comment><comment><USER74> Will there be an edit function? No? Still nothing like that in 2019? Well... twitter will go down. It's just a question of time at this point, imho.

<comment><USER75> Lack of edits is an important anti-abuse feature. If you can edit a tweet, you can make a tweet saying one thing, and then edit it to say something entirely different after someone else retweets, links, or embeds it elsewhere..

(Though frankly, given how poorly they've handled other abuse-related issues, I doubt this is their reasoning)

<comment><USER76> So give people 1 minute or something and maybe don't show it until that time period is up.

<comment><USER77> That would break the spontaneous nature of "live-tweeting".</comment></comment></comment></comment>


Smartphones may be leaking more radiation than we think - <AUTHOR> https://www.cnet.com/news/smartphones-may-be-leaking-out-more-radiation-than-we-think/ <comment> yoz-y What I don't get is that if this is true how come it was not captured before?

When doing any labelization testing here in France we had to go through an independent body using standardized test. Apple has criticized the Tribune saying that their tests were practically bollocks.

From MacRumors article on the subject:

> While tests can be conducted from up to 25mm away, The Chicago Tribune used > the distance that manufacturers choose for their own tests. In Apple's case, > that's 5mm. A second test was also done at 2mm to simulate the way most > people carry their phones.

What is this? How come manufacturer can choose the distance at which they measure the radiation?</comment>


Amazon Elastic Compute Cloud (N. Virginia) API Errors - <AUTHOR> POST https://console.aws.amazon.com/ec2/ecb?call=authorizeIngress?&mbtc=413645335 400 (Bad Request)
response:
{"__type":"com.amazon.ec2ux.backend.master#ClientError","error":"An internal error has occurred"}
Also seeing, perhaps related perhaps not, that the remote logging request is failing the options call due to: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://console.aws.amazon.com' is therefore not allowed access. The response had HTTP status code 403. <comment><USER2> My clients have been having issues with their ISP on the West Coast for the past 2 hours or so.

[https://news.ycombinator.com/item?id=11871712](https://news.ycombinator.com/item?id=11871712)

</comment><comment><AUTHOR> And I really need to adjust a firewall... uggh

</comment><comment><USER3> Anything on the AWS status page?</comment>


Should news feeds be separated by topic - <AUTHOR>

I can not help but notice, that the YC feed is starting to look more like that of digg, or reddit.
It would be great if we could add tags to articles so that they could be filtered on the fly by the hacker crowd.
I would suggest the raw feed, and then other feed tags might be business news, humor, hacks, edu, questions.
I just think it would be nice to get back to the "pure" news feed that was less a mirror of digg and reddit, but more about the inside details, of startups. <comment><USER2> I sort of agree. I'd like to see just:

1) Pure Startup

2) Everything Else

Might be a little bit difficult to differentiate at time, but one of the things I like about this site is that there is not a lot of clutter.

<comment><USER3> Nah. I didn't like it when this site opened up to topics other than startups because I thought we'd get a bunch of crap posts. The vast majority has been quality however, so I don't see any compelling reason to change anything.

</comment></comment><comment><USER4> We have topics!

1\. Ask YC: ...?

2\. This is my startup, feedback please!

3\. YC Application

4\. Everything Else

</comment><comment><USER5> I think the site might end up getting sold like Reddit, for some ridiculous sum, and then someone will start ANOTHER one about Lisp startups. (that's an attempt at humour :)

<comment><USER6> Humor or not, it's quite possible.

</comment></comment><comment><USER7> How about just going back to the startup news that this site was great at conveying?

<comment><USER8> I find most of the startup news boring. I can only count a few that are good, for example pretty much any essay by PG. I think the addition of "hacker" related articles is great because it adds a lot. Many of the startup articles from before seemed like the "Get Rich Fast" books.

<comment><USER7> hmm, you have a bit of a point. But seriously, how many of the "hacker" articles that are worth reading aren't already picked up by reddit/digg/slashdot?

<comment><USER9> <http://news.ycombinator.com/item?id=71827>

</comment></comment></comment></comment><comment><USER10> Implement tags and filter by tag.

John.</comment>


$10 laptop coming from India on February 3rd, or so they say - <AUTHOR> http://www.crunchgear.com/2009/01/30/10-laptop-coming-from-india-on-february-3rd-or-so-they-say/

<comment><USER2> Indiatimes link posted earlier: <http://news.ycombinator.com/item?id=458077></comment>


Terry Smith says the world is living in a fantasy - <AUTHOR> http://ftalphaville.ft.com/blog/2011/07/29/638071/terry-smith-says-the-world-is-living-in-a-fantasy/

<comment><USER2> >The size of the public sector which is an important part of our economy will have to shrink.

Yep, that's what they always say. Yet the only countries in Europe that are doing GREAT are countries with big and healthy public sectors: Sweden (+4%), Germany, Austria, Denmark etc.

<comment><USER2> care to explain, instead of just down-voting?

here's the link: (see: "growth") [http://www.economist.com/blogs/dailychart/2011/05/europes_ec...](http://www.economist.com/blogs/dailychart/2011/05/europes_economies)</comment></comment>


Foundations by Greg Egan (1998) - <AUTHOR> http://www.gregegan.net/FOUNDATIONS/ <comment><USER3> Diaspora by Greg Egan is one of the most amazing books I've ever read, in terms of the ideas it explores. A serious treatment of the future where humans' minds are scanned into machines: what senses do you have in a virtual world? How do you spend your time when you want for nothing? What do love and reproduction mean? Space exploration when you slow your subject day to a solar year. Wonderful, beautiful, and mind-bending.

[http://www.gregegan.net/DIASPORA/DIASPORA.html](http://www.gregegan.net/DIASPORA/DIASPORA.html)

It used to be hard to find, but these days it seems to be available [edit: at least digitally] (ebook, audio) from the retailers you'd expect.

It's not a "change your outlook on life" kind of book, but as a science fiction exploration of humanity's distant "singularity" future, set in 2975, it was the best I've read. (I would appreciate references to any other books on those topics - I haven't found many.)

<comment><USER4> Same here. It profoundly widened my ideas on the universe and how to deal conceptually with its immensity in time and space. It's a beautiful story.

His other books have been so-so, but his short stories are the hardest science fiction around. Nobody else has explored ideas of quantum mechanics intersecting with biology and humanity like he has. I think "Axiomatic" is a good set of them.

<comment><USER5> > how to deal conceptually with its immensity in time and space

Yes! Dimensions (not even the most objective, physical ones) are not absolutes but subject to changing, creative interpretation through the abilities of our tech.

Compare the meaning of a meter when squirming vs walking vs cycling vs driving vs flying... Modern computing makes a mockery of our past capabilities for information processing / storage / transmission.

Put another way, "there is no bad or good weather, only different gear requirements."

Same goes for everything, not only distance & information, but also scale, temperature, calories, food, output, wealth, energy, users, complexity, manufacturing effort, ... and time! Both time as speed (how much happens in a certain period) and time as something to traverse (need to wait for a result for decades or centuries). With Diaspora & Permutation City I first learned to imagine a future where we could treat centuries with the same amused detachment with which we now treat intercontinental distances as we jet over the oceans.

</comment></comment></comment><comment><USER6> Disclaimer: I've read and enjoyed most of his books and short stories, but Egan's not for everyone. He favors ideas and world-building over characters and storytelling.

I most like Egan when he avoids math and goes to a dark, cynical place. His short story _The Extra_ [1] is probably the best example. If you like _The Extra_ , you'll probably enjoy _Blindsight_ by Peter Watts[2]. Some of the late Ian M. Banks titles fit as well: _Against a Dark Background_ and _Matter_ are both grim, somewhat hard sci-fi.

If you're a fan of Greg Egan, you'll likely enjoy Ted Chiang[3]. He doesn't write much, but he writes well.

1\. [http://eidolon.net/?story=The%20Extra](http://eidolon.net/?story=The%20Extra)

2\. [http://rifters.com/real/Blindsight.htm](http://rifters.com/real/Blindsight.htm)

3\. [http://www.goodreads.com/author/show/130698.Ted_Chiang](http://www.goodreads.com/author/show/130698.Ted_Chiang)

<comment><USER7> and if you do like egan for the worldbuilding, check out stephen baxter as well. 'vacuum diagrams' makes a good introduction.

<comment><USER8> thank you both for these suggestions! Ive been searching to try and find something like Egan. Ill definitely give these a read!

</comment></comment></comment><comment><USER9> I'm reading Schild's Ladder atm, wherein the fictional Quantum Graph Theory plays a large role. This is the first paragraph:

 _In the beginning was a graph, more like diamond than graphite. Every node in this graph was tetravalent: connected by four edges to four other nodes. By a count of edges, the shortest path from any node back to itself was a loop six edges long. Every node belonged to twenty-four such loops, as well as forty- eight loops eight edges long, and four hundred and eighty that were ten edges long. The edges had no length or shape, the nodes no position; the graph consisted only of the fact that some nodes were connected to others. This pattern of connections, repeated endlessly, was all there was._

</comment><comment><USER10> If you've not read any of Greg Egan's books this is your lucky day - <USER2> incredible writer to discover! His books have an unusually high ideas/page ratio, and are very readable.

<comment><USER11> For some definition of readable. Be prepared to have yours eyes glaze over at certain points, but it's well worth the struggle to push on through.

<comment><USER12> I've had friends mention that they liked Neal Stephenson's "Cryptonomicon", except for the lengthy digressions into mathematics. One day, I'll get mad at them, and get revenge by suggesting an Egan novel.

<comment><USER13> That's funny: the _only_ thing I usually like about Neal Stephenson books are the digressions into nonfictional material. Everything else is just a needless exercise in people being shitty to one-another and Stephenson re-announcing his belief in '90s-era "hacker" ideologies.

</comment></comment></comment></comment><comment><USER8> Permutation City was completely unlike anything I have ever read. I love Egan's works and couldn't recommend them any higher!

</comment><comment><USER14> Axiomatic is one of my favourite short sci-fi stories books.

</comment><comment><USER15> 2/3 way through Incandescence (first GE book I've read). Not disappointed. Was on the hunt for Stephenson equivalent in brilliance of writing, but with slightly more hard science. Wow...

</comment><comment><USER16> I liked Eternal Flame and Clockwork Rocket, they are an interesting exploration of the possibility that the Time is an actual spatial dimension orthogonal to the other three spatial ones.</comment>


Apple Boss Tim Cook Hits Out at Facebook and Google - <AUTHOR> http://www.bbc.co.uk/news/technology-32991036

<comment><USER5> Previous discussion: [https://news.ycombinator.com/item?id=9650289](https://news.ycombinator.com/item?id=9650289)

</comment><comment><USER6> My problem with this is that it is pure marketing play. Apple isn't doing anything really great to enhance user privacy in absolutes - all they are doing is having all your data and not letting anyone else benefit from it - right now. Which is to say Apple still does benefit from your data in direct or indirect ways.

They are still, by default recording all your search queries on OS X. And Apple supporters' justification for that is well, Apple isn't a company whose revenue and profits are mostly dependent on ads. But if you look at facts, Apple wants to get a big pie of everything, not just hardware. And they go out of their way to try and get it - book sales (ref: antitrust case), iAd, Maps, Streaming Music - the list goes on and on.

Given this, how do you claim Apple won't use your recorded search queries or music you listened to (Genius Recommendations) or location data or whatever else they record and we don't yet know about - to increase their profits? They sure as hell will - that's why they are collecting the data in first place.

Google is doing the same thing by showing you ads that may be of interest to you, analyzing your Google Voicemails to increase their speech recognition accuracy, making their maps data more robust by giving you the best Navigation app for free, giving you useful reminders by looking at your email - they are doing it now and in return they are providing you with great products you can optionally use.

To claim that Google is doing something evil while Apple is not purely because they make money on hardware is naive and too simplistic. (Case in point - Microsoft made most of their money selling you boxed software - now a days they want you to use their services and will provide you with a free upgrade to Windows and free online Office suite down the line. They did not care about your data before, but now they do!)

Fact is you can either place reasonable trust on Google or Apple and continue to be part of the modern world or just drop all your devices, bank accounts, cards, get a car from 1970s and move off the grid. As much as it sounds harsh there isn't really such a thing as 100% privacy. Your data will always be vulnerable to becoming public in various degrees and to various effects.

<comment> k-mcgrady >> "Apple isn't doing anything really great to enhance user privacy in absolutes - all they are doing is having all your data and not letting anyone else benefit from it - right now."

1\. iMessage and FaceTime data is encrypted.

2\. Having my data and not letting anyone else benefit from it is 100x better than what most tech companies are doing. Also they don't have 'all' my data. They take what they need to improve my experience. Other companies hoover up everything they can because they need it to sell.

>> "They are still, by default recording all your search queries on OS X."

To improve the spotlight user experience. They're not selling my data and I can easily disable it.

>> "They sure as hell will - that's why they are collecting the data in first place."

No. The data the collect is to improve the user experience. They have no need to sell it - they're the biggest company on the planet.

>> "As much as it sounds harsh there isn't really such a thing as 100% privacy."

There never has been but there is a big difference between what Apple offers privacy wise and what Google or Facebook offer.

<comment><USER7> > they're the biggest company on the planet.

I agree with what you're saying, but this is just not true.

<comment><USER8> I don't think you understand what what is being stated at all.

[http://en.wikipedia.org/wiki/List_of_public_corporations_by_...](http://en.wikipedia.org/wiki/List_of_public_corporations_by_market_capitalization#2014)

Apple is the biggest company on the planet, based on Market Capitalization, which is the factor to determine the strongest companies out there.

</comment></comment></comment></comment><comment><USER9> This would have sounded credible if Apple didn't have an iAds business that mines user clicks and offers retargetting ads to paying customers.

Instead, now, this sounds like Microsoft's Scroogle campaign, where it accused Google of doing all the things that Bing also did, but wasn't successful at doing.

<comment> k-mcgrady "One very small part of our business does serve advertisers, and that's iAd. We built an advertising network because some app developers depend on that business model, and we want to support them as well as a free iTunes Radio service. iAd sticks to the same privacy policy that applies to every other Apple product. It doesn't get data from Health and HomeKit, Maps, Siri, iMessage, your call history, or any iCloud service like Contacts or Mail, and you can always just opt out altogether."

[https://www.apple.com/privacy/](https://www.apple.com/privacy/)

<comment><USER10> Google has a one-click opt-out as well:

[http://www.google.com/settings/ads](http://www.google.com/settings/ads)

I remain opted in, fwiw.

<comment> k-mcgrady I know about that but that's simply an opt-out of interest based ads - they're likely still collecting your data in case you enable the ads again.

<comment><USER10> You might be also interested in [https://myaccount.google.com](https://myaccount.google.com), which offers full visibility and fine-grained control into everything in one place.

I wasn't personally involved in building it, but in my opinion it's really impressive. I wish other companies would do the same.

<comment> k-mcgrady Yeh I really like Google's account section. They also do a nice monthly email report of your account activity.

</comment></comment></comment></comment></comment></comment><comment><USER11> It's a clever pivot by Tim Cook. He figured out that Apple is awful at selling advertising and has turned this into a marketing feature.

Steve Jobs was very excited about advertising, remember him describing iAds as a life changing experience that users would love? It completely failed, but hey.

[https://youtu.be/KwVaILbTqS8?t=45m55s](https://youtu.be/KwVaILbTqS8?t=45m55s)

<comment><USER12> It is true that it is failed, and that video looks silly in retrospect. But it's also true that Apple has always had an entirely different business model than, say, Google. This isn't a new "marketing feature." Apple has never sought to make large sums of money by selling user data.

<comment> qwerty-- Repeating a lie that Google sells user data doesn't make it right. Stop getting brainwashed by Apple and learn facts and learn how Google makes money. It doesn't sell your personal data.

</comment></comment></comment><comment><USER13> "Our business is based on selling products, not on having information about you. You are not our product."

Pretty easy to say "we don't do this" when it's not even a _significant_ part of your revenue stream.

Sort of like if Zuckerberg said "Our business is based on selling advertising, not on selling premium, high markup shiny things".

</comment><comment><USER14> If Apple is serious, the next step will be to open up the source for the encryption parts of iMessage, FaceTime, etc with the ability to verify the binaries, much like PGP used to do for their software. And also to verify the keys being used in the messaging to make sure additional keys aren't being added by apple.

<comment><USER15> if only

<comment><USER14> They don't have to open up the entire product - only the libraries for the encryption part.

</comment></comment></comment><comment><USER16> In reality using Apple products reduces your privacy. How ?

If you use Google's products(and who doesn't use Google Search ? ) , Google already knows plenty about you. And even if you don't use Google products, Google knows plenty about you, since it's tracking software is installed in large percentage of sites, etc.

And if you add machine learning on top of that , the amount that Google knows about you is great - even if you use Apple's products.

In reality, by using Apple's products, you don't gain privacy , you lose privacy - now two companies know a lot about you, instead of one.

Also this exposes your data for security bugs from both companies - <USER2> making it easier for third parties to go at it.

<comment><USER17> Really? All your documents, finances, photos, music, movies, messages, health data, viewing patterns - might as well just give that to Google since they already have your search queries? That doesn't make any sense.

<comment><USER16> You underestimate the amount of intelligence Google's search data + smart machine learning can deduce about you. Remember how in the sherlock holmes stories, sherlock can deduce huge amount about people , from tiny clues ?

How much do you think sherlock could deduce from Google searches - <USER3> people usually bare their souls ,on ALL their issues, from the insignificant to the critical?

Machine learning can, to some extent , be that sherlock, but if someone with the right investigantional skills diggs through your search data - he can be sherlock too.

And since Google does know all that about you, in most cases ,i think that keeping the rest of the data won't be the thing that "saves" you - maybe with the exception of your browsing patterns - but since Google has trackers in most web sites - they already know a large part of your browsing patterns - <USER4> you're quite defenseless there.

TL;DR - Google search knows a huge amount about you, And with that data, sherlock holmes(or a decent investigator, or probably an AI) can know almost everything on you!

</comment></comment></comment><comment><USER18> Google's and Facebook's business models revolve around analysing user data and using it for advertising. Apple makes money from hardware.

I think most users are aware of this, and in return for free or low cost products they sign away part of their privacy.

The reason Google Photos offers unlimited storage, Gmail is free etc is they can deep learn the f... out of their users to target their ads better.

Apple's privacy benefit is more of a side effect of their business model than a principle they design their products based on.

</comment><comment><USER19> Is Apple not collecting any user data?

<comment><USER20> I don't think the problem is so much collecting data, more what agreement the company collecting the data has with third party corporations and governments. Also, the fact that Apple includes full disk encryption for OS X, and encrypts all communications on iOS storage and in transit with personal keys, is a pretty good sign Apple is taking personal privacy seriously.

Facebook and Google haven't made such steps.

<comment><USER21> All the encryption in the world doesn't make any difference if it's easy to steal your account.

Unlike Facebook or Google, Apple practically had to be shamed into fixing an easily-gamed account reset process and adding two-factor authentication support (and then took their own sweet time rolling it out across their services) and had to be shamed again into adding rate-limiting on logins. Not to mention their spotty track record on other security issues (e.g."goto fail").

That doesn't mean that Apple hasn't done some things that are good for personal privacy. But their broader track record makes it clear that Apple only takes the appearance of personal privacy seriously. The reality, on the other hand, easily takes a back seat to things like UI simplicity unless that missing reality starts creating appearance problems.

</comment></comment></comment><comment><USER22> see [https://news.ycombinator.com/item?id=9652298](https://news.ycombinator.com/item?id=9652298)

</comment><comment><USER23> So does that mean I will be able to use PGP natively on my iOS Mail app soon?

<comment><USER24> GPGtools (plugin) works nicely with native Mac mail [https://gpgtools.org/](https://gpgtools.org/)

<comment><USER23> Yes, but what about iOS?

</comment></comment></comment><comment><USER25> Classic kettle and pot

</comment><comment><USER26> Any links to the actual video?</comment>