Login Forms Over HTTPS, Please - <AUTHOR> https://hacks.mozilla.org/2016/01/login-forms-over-https-please/ <comment><AUTHOR> > _If you're submitting your login form over HTTPS, that's good, but it's not > enough. You have to_ deliver* the form over HTTPS too.*

I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http.

Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http which is even less noticeable.

There's also a more detailed post [0] with reasons and explanations. You can enable this setting in Firefox 44+ by setting `security.insecure_password.ui.enabled` to true.

0: [https://blog.mozilla.org/tanvi/2016/01/28/no-more- passwords-...](https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords- over-http-please/)

<comment><USER2> As I understand it, if not everything is HTTPS, the attacker could just inject JavaScript that changes the page to the login page when the user clicks "Log in". That way, they can still record the password.

<comment><USER3> Yes, it's disturbing how many sites still do this. Most of the big shopping sites like amazon.com, ebay, Target, WalMart are http until you log in. Was also until recently very common on credit card sites, though all of mine are all https now.

<comment><USER4> This is because most people are browsing and not buying, so the caching advantages of unsecured catalogue pages is likely quite large.

At least for most of those the login is a separate protected page rather than a https iframe.

<comment><USER5> Uhh, what caching advantage are you talking about? Everything that can be served cached over HTTP can also be served cached over HTTPS. Unless you are talking about a caching proxy outside of the website control. In that case, they aren't needed, CDNs solved that problem in a much better way.

<comment><USER6> > Unless you are talking about a caching proxy outside of the website control. > In that case, they aren't needed, CDNs solved that problem in a much better > way.

There are still parts of the world where caching proxies are used to conserve limited transit bandwidth; CDNs don't solve that.

</comment></comment></comment></comment></comment></comment><comment><USER7> I wish they outlined a plan to push this icon out to Stable. Even better the plan should call for the browser to eventually refuse to submit forms with password fields unless HTTPS was used for both loading the form and submitting it.

I think that developers who are still using HTTP with passwords either don't understand the implications (and a tiny icon won't help), don't care, or don't have "management buy-in" to spend the time to fix it. Having the browser force best security practices will benefit them and everyone using their websites.

<comment><USER8> Browser should display a scary warning popup when submitting form to http (either always, or maybe at least when there is input type=password in a form). This would be annoying enough to get management buy-in to implement https, if someone still maintains the app - better than a tiny icon.

Breaking stuff is a last resort, nuclear option. There are many forgotten, old web apps that would totally stop working and people would switch to another, less secure browser as a result.

<comment><USER9> They used to -- see [http://www.kentlaw.edu/faculty/rwarner/classes/legalaspects/...](http://www.kentlaw.edu/faculty/rwarner/classes/legalaspects/digital_signatures/VeriSign%20OnSite%20for%20Secure%20Server%20IDs.htm) (§2.4, about half-way down) and [http://labs.ft.com/2014/05/do-we-really-need- to-hide-the-url...](http://labs.ft.com/2014/05/do-we-really-need-to-hide-the- url/)

But it was removed in later versions of Netscape and Internet Explorer, because everyone turned it off as soon as they made their first search engine query.

<comment><USER8> I remember that, though honestly internet was a bit different 15 years ago - it was in (almost)-pre-HTTPS, pre-public-WiFi, pre-Snowden times. It's time to progress now that the realities and technical capabilities changed.

Today there should not be "do not display this anymore" checkbox.

</comment></comment></comment></comment><comment><USER10> I have recently deployed Content Security Policy (CSP) on a website. When I first looked at violation reports, my jaw dropped. The amount of malware (rouge extensions, toolbars, viruses, ...) that is blocked is staggering.

If you really want to help your (clueless) users, never _ever_ serve a login, registration or credit card form without CSP. It really helps - at least until the malware catches on (I already see "Kaspersky Labs" is injecting its domain _into the CSP itself_ ).

<comment><USER11> Is there a pre-built tool to capture and manage CSP violation reports? I believe its mainly just a POST request with some JSON right?

<comment><USER12> [https://getsentry.com/](https://getsentry.com/) added support for CSP a few months ago, but I haven't tried it out yet. [https://github.com/getsentry/sentry/pull/2154](https://github.com/getsentry/sentry/pull/2154)

</comment></comment></comment><comment><USER13> I don't understand the distinction between the login form and every other page of the site. If someone is logged in and then back to normal http, someone can just grab the _cookie_ and pretend to be that person already-logged-in.

I suppose if one uses the same password for every account they have then knowing their password is more harmful than just having access to 1 site... but other than that it seems like a distinction without a difference.

<comment><USER14> > If someone is logged in and then back to normal http, someone can just grab > the cookie and pretend to be that person already-logged-in.

If the cookie is set through HTTPS, the browser won't send it when loading HTTP resources. So the cookie won't be exposed that way.

We should still be using HTTPS for all traffic in 2016.

<comment><USER15> If a website only uses HTTPS for login, then it has to set a cookie for HTTP as well, otherwise how will the user navigate the site after login? From top of my head, you can implement this by associating the randomly generated session ID that you assign to all visitors, with the login ID.

Regardless, what jordanlev said still applies. The session can be hijacked.

<comment><USER13> Exactly! What is the purpose of being "logged in" if when you then go to browse the rest of the site you are no longer actually "logged in" (because the secure HTTPS cookie isn't being sent on those insecure http: pages).

</comment></comment></comment></comment><comment><USER16> The best solution is just to make everything use HTTPS. Using HTTPS for all traffic also helps to obfuscate which connections are the important ones.

Certain unnamed three letter organizations and nation states have the computing power to crack HTTPS encryption if they really want to, but using that power is expensive. Making sure all your traffic is encrypted makes it a lot harder for potential snoops to decide which traffic is worth spending the time and money decrypting and which isn't.

By using strong encryption for everything, even just reading wikipedia pages, you're doing everyone a favor by helping to make user privacy that much harder to violate.

<comment><USER17>
      Certain unnamed three letter organizations and nation
      states have the computing power to crack HTTPS encryption
      if they really want to

Some ciphers and key lengths are vulnerable, but I do not believe it to be true to say that the NSA can "crack HTTPS", outside of a suborned-CA MITM attack, which isn't at all deniable or subtle.

</comment></comment><comment><USER3> I don't think many people pay much attention to the address bar, let alone a little lock icon with a red line through it.

If they want to get serious about it, they should just disable http support and require https for all actions. Or throw up a big in-your-face warning on http pages, not just make a small change to an obscure icon that nobody really understands.

<comment><USER18> > If they want to get serious about it, they should just disable http support > and require https for all actions. Or throw up a big in-your-face warning on > http pages, not just make a small change to an obscure icon that nobody > really understands.

Even though I agree with you, I think that it's still a little bit too early for that. My prediction is that the browsers are going to start experimenting with this near the end of 2016 and that it'll become a part of stable versions of browsers somewhere in 2017.

</comment></comment><comment><USER19> There are too many security holes and corner cases to serve _any_ authenticated page over http. It's better to have your login page be served over https, but if you use authentication cookies, any MITM can easily pick them up from the following http pages and do what they want (for as long as the cookie is valid).

And that's beside a whole rake of issues from having http and https on the same domain. It's just easier to have https everywhere.

<comment><USER20> > It's just easier to have https everywhere.

For what it's worth, this was not true ten (or maybe even five) years ago.

I'd say it's true today, for most websites, but it's worth keeping in mind that it's a relatively recent phenomenon that HTTPS is now pretty easy to set up, use, and maintain. That wasn't always the case!

<comment><USER19> Five years ago was 2010. Other than Let's Encrypt, AFAIK, there hasn't been exactly leaps and bounds in terms of making https easier, at least for self- managed servers. It's still buy a certificate and set it up in nginx/apache/your favourite load balancer/etc.

<comment><USER21> I have found Caddy ([https://caddyserver.com](https://caddyserver.com)) really helpful in this regard. By default it grabs a Let's Encrypt cert and serves your site over HTTPS (oh and it handles renewals too.) Caddy + LetsEncrypt = easy https everywhere :D

</comment></comment></comment></comment><comment><USER22> Prominent? A crossed over lock icon in the address bar? Try again.

A prominent warning would be something ridiculous, like a full page cover saying "THIS PLACE IS NOT SECURE – HERE BE DRAGONS!" or something. Browser vendors should do more of this for egregious errors on the publisher's side. Unless users complain loudly that stuff is uncomfortable and broken and scary and what not, you can write articles like this every day of the week and publishers still won't do anything about it, and the only users to care will be the geeks who understand what the damn icon means in the first place.

<comment><AUTHOR> Would be an interesting thing to do as a network operator - doing MITM to alert people about the dangers of HTTP.

<comment><USER23> they're already doing it - for different reasons though

there have been reports of replaced adds on unrelated pages with banners from the ISP and similar things

</comment></comment></comment><comment><USER24> What I don't understand about authentication over HTTPS is, though, why not making login a part of the protocol? Wouldn't it be much better to authenticate a user with a public key of the user like in SSH, instead of password authentication over the public key of the server? It'd be more resistant to attacks such as MITM or stealing the private key of the server. If a user can register a password on a website, why does it have to be a password rather than a public key? The only hindrance is the fact that the protocol doesn't support it.

I have no idea why this easy change hasn't been made in the protocol.

<comment><USER25> Check out the abandoned Mozilla Persona, and the SRP protocol.

[https://developer.mozilla.org/en- US/Persona](https://developer.mozilla.org/en-US/Persona) [http://srp.stanford.edu/whatisit.html](http://srp.stanford.edu/whatisit.html)

</comment></comment><comment><USER26> The most secure approach is to serve everything over HTTPS _AND_ redirect HTTP to HTTPS _WITH_ "Strict-Transport-Security" header [1]. Even this is not perfect, but it's the best approach available AFAIK.

1.[https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)

<comment><USER27> You can also submit your site for inclusion on the HSTS preload lists:

[https://hstspreload.appspot.com/](https://hstspreload.appspot.com/)

This fixes the remaining hole of the first visit.

However, one warning, if you like privacy, you should turn off HSTS or clear it on browser close at least. It's effectively a giant supercookie and it provides little security benefit over checking URLs for SSL yourself.

<comment><USER26> Thanks, that's good to know. :)

</comment></comment></comment><comment><USER28> I'm puzzled. As a developer the sites I work on are (mostly) going to be hosted on my local machine. I usually don't bother with all the effort to set up SSL certificates for my development web server unless I've got an SSL- specific issue to investigate. Is this feature disabled for sites that are local? If not I'd expect I would just come to ignore it quite quickly. Then when I then look at the production version of a site I'm more likely to continue to ignore it as I've been conditioned into assuming it's a false indicator.

At the same time, for normal web users I can see how such a warning could be helpful. But it seems normal editions of Firefox won't have this enabled by default.

Or are my development practices unusual in some way?

<comment><USER29> The comments indicate that the icon will never be displayed on `localhost`.

I'm not sure what the situation is like for websites hosted on a LAN or using something like zero-conf, but I wouldn't be surprised if they _do_ display the icon in those scenarios.

</comment></comment><comment><USER30> Hiding mixed content warnings (like Chrome did last year [http://arstechnica.com/information- technology/2015/10/chrome...](http://arstechnica.com/information- technology/2015/10/chrome-finally-kills-off-the-http-https-mixed-content- warning/)) would probably also really help some sites with SSL everywhere.

On sites that allow users to embed things like images (forums, comments, etc), in order to avoid mixed content warnings or interstitial confirmation dialogs, you either have to pipe everything through an SSL proxy, or severely limit the types of things users can embed.

</comment><comment><USER31> I'm not writing login code personally but this sounds like something fundamentally broken in the web and asking devs to fix it case by case is a complete copout. If a browser can detect this shit, why can't it fucking proxy it or do something clever to mitigate it automatically instead of putting up stupid hyroglyphs and expecting to shame developers into duplicating a bunch of work case by case and thereby probably getting it wrong in many cases? .. like.. ff detects insecure login form.. Browser DON'T FUCKING SEND CLEARTEXT PASSWORD (instead sending some encrypted bs to firefox grand central station, where it is securely forwarded through a secure backchannel? Maybe it has to talk to the isp directly who has to inject the password back into your process, and they charge u extra tax for securing your shit.. and then.. gasp.. problem solved and not every aspiring developer needs to become a cryptographer.

Passwords are stupid. The internet is broken. My Spyware infested machine and browser knows all my passwords anyway.

Note to any techies reading this.. fix this problem. Here is your killer app. Disrupt this shit.

</comment><comment><USER32> Facebook had this problem for _years_ , even after they started hiring industry veterans who would know better ([https://www.sslshopper.com/article- how-to-make-a-secure-logi...](https://www.sslshopper.com/article-how-to-make- a-secure-login-form-with-ssl.html)). Amateur hour lasted for so long that just thinking of their codebase makes me ill.

</comment><comment><USER33> I don't know why sites don't just use HTTPS for everydamnedthing. It's 2016. SSL is not _that_ computationally expensive and it's just easier to develop an entire site that way anyway (rather than making some pages secure and other non-secure). Just redirect everything to https and forget about it.

<comment><USER34> I work on a site with a long history. I recently created a benchmark and found that I could make around 500 synchronous HTTP requests to our infrastructure per second (essentially localhost calls). If I switch my benchmark to HTTPS I can only make about 5.

That's a big difference. I'm a developer, not a hardware guy, so I don't know what causes the slowdown for us. I assume it's the actual setup and teardown of the HTTPS connection. That is a fairly significant difference when I want to use API's via HTTP/HTTPS and I need to make a lot of calls quickly.

My point is that HTTPS still seems to be 100x more computationally expensive than HTTP.

</comment></comment><comment><USER35> Injecting JS into the page with the form isn't my main concern, even -- it's changing the form POST action to their own server rather than the one I think I'm logging into. That's much harder to detect and block without encryption.

Plaintext HTTP is scary stuff these days.

</comment><comment><USER36> Login forms over HTTPS, everyone. This time we'll finally fix web security.

This time we'll be safe.

</comment><comment><USER37> Wow, this is still even a thing.

The form, all its js assets and form api endpoint all have to be secured. And https for everything that contains code. Deploying SRI for web pages over https is also another layer of defense against js tampering.

Also, sending passwords across the wire in any reversible manner is really more dangerous than is necessary. Passwords/passphrases could be salted hashed by the browser in JavaScript using a PBKDF similar to scrypt or bcrypt, before being sent to the backend for constant-time comparison... it just takes a little more prudence and effort, but it's absolutely doable.

<comment><USER38> > Passwords/passphrases could be salted hashed by the browser in JavaScript > using a PBKDF similar to scrypt or bcrypt, before being sent to the backend > for constant-time comparison... it just takes a little more prudence and > effort, but it's absolutely doable.

This is not safe! Now an attacker just needs to intercept the hashed password and replay that, and he gets to login without knowing what the password is.

Use https. And don't do client-side hashing, it's no improvement.

<comment><USER39> This doesn't make any sense to me. If attacker can intercept connections I'd rather he get the hash than the plaintext password. At least then actual password is still not compromised, which is good, given how _many_ people share passwords accross services. If he can tamper with connections, there's nothing that can be done anyway.

It would be very nice if there was a feature in web browser that allowed _user_ to opt in to something like this:

When there's a password input on a website: 1] automatically take website's domain concatenate it to plaintext password 2] generate a secure hash from 1] 3] Derive some reasonably portable text password (20-30 characters) from 2] 4] Make it so that original web page never has access to user's plaintext password 5] Submit result of 3]

Downsides:

1] Stupid websites enforcing password rules other than length (can be worked around mostly transparently). 2] Extra stupid websites limiting password length. (requires user interaction and configurable exceptions for such websites) 3] Can't login with browsers that don't implement this.

This would be very nice for people who share passwords between services. Also would make web service data leaks less valuable to attackers. User would not depend on service password handling quality and/or operator's morality.

I use different passwords for each and every service. But many people can't be bothered or don't get the risks of password sharing, so it would be at least some help to them.

<comment><USER37> Exactly. That's the risk to mitigate. Here's scrypt for js using emscripten on actual scrypt C source... the site has to provide and adjust/migrate the three factors over time to ensure a sane amount of cpu/memory is used: [https://github.com/tonyg/js-scrypt](https://github.com/tonyg/js-scrypt)

For real-world, practicality's sake, the client-side of an app would contain the PBKDF or some AA code, as opposed to the traditional, slightly-riskier "let the server handle all of it"-approach... the server still has final say on authentication and authorization, just move some of it into client-side js. There's really not much impact on FE development considering most FEs and BEs are codeveloped these days anyhow.

Btw, for web devs Two-factor auth is cheap and easy to do, Google Authenticator OTP has open source libs and requires no calls to Google to work.

</comment></comment></comment></comment><comment><USER40> I love this, but would prefer they didn't re-use the "invalid certificate" icon.

As a devs, we use self signed certificates for building our products and we have trained QA to ignore the HTTPS with a slash through it as an error that is acceptable in dev.

(And ourselves for that matter)

That makes this one easy to miss.

My preference would be a browser-level warning bar to roll out over the page. Like the one used in 'this plugin is not installed'

This is a huge error and its much harder to miss that way.

</comment><comment><USER41> A little red padlock? It's a start... but why not refuse to load the page if it has a form tag but no https. That's how you solve this.

</comment><comment><USER42> This is how the Tunisian government scraped the Facebook passwords of Tunisian internet users in 2011:

[http://www.theatlantic.com/technology/archive/2011/01/the- in...](http://www.theatlantic.com/technology/archive/2011/01/the-inside-story- of-how-facebook-responded-to-tunisian-hacks/70044/)

</comment><comment><USER43> I've used this Chrome Extension for years.

[https://chrome.google.com/webstore/detail/unsecure-login- not...](https://chrome.google.com/webstore/detail/unsecure-login- notifier/ledomejmbiemgdfiekmhoheabhonihmi?utm_source=chrome-app-launcher-info- dialog)

It seems we are finally getting it built in, as it should be!?

</comment><comment><USER44> How about "Ads over HTTPS, please"? Can't upgrade our sites if our ad revenue drops through the floor.

<comment><USER45> Hmm. When technology basically took away musicians's ability to sell digital music files, the world pretty much said, "figure out a new way to sell music."

So, "figure out a new way to advertise." Welcome to disruption.

</comment></comment><comment><USER46> Now if only I could convince firefox (and chrome) that this asterisk-input text field is _not a login form_.

</comment><comment><USER47> So, if I understand it correctly, HTTPS costs developers money (annual rent for renting an SSL Cert).

Google too is about to start shaming non-HTTPS connections (according to a recent article).

I've heard about the free one-year Cert. Is there any way to do HTTPS all in- house (permanently), without resorting to an external agency?

<comment><USER48> [https://letsencrypt.org/](https://letsencrypt.org/)

<comment><USER47> Thanks.

</comment></comment></comment><comment><USER49> Now this is the use of HTTPS that matters. This should get a major browser warning. It's far more important than "HTTPS Everywhere", which is mostly security theater.

</comment><comment><USER50> The icon is nice addition, but a much better option is an animated icon. A heartbeat / pulse kind of alert icon for insecure web page.

</comment><comment><USER51> This is not a good thing. The expense of SSL certificates is not negligible, and it is not justified. The protocol is easily compromised.

Much like email, https needs to go away in favor of a solution that incorporates a modern mindset.

</comment><comment><USER52> Legalize insider trading; It'll fix/solve HFT;

</comment><comment><USER53> Verb in Sentence, Please.</comment>


Seven Signs Your Startup is Doomed - <AUTHOR> http://www.markevans.ca/2014/02/12/signs-startup-doomed/ <comment><USER2> Pro-tip....please stop popping up dialogue boxes asking me to sign up for newsletters. This one is worse than most because it waits a few seconds before appearing thus interrupting me when I'm settling into the first paragraph.</comment>


Unit Testing JavaScript Without Node or a Browser - <AUTHOR> I am working on a project that contains some scripts to automate Adobe After Effects and I'd like to do some Unit Testing on those scripts. Ideally, the unit tests would be able to run in After Effects and be able to manipulate things in an After Effects project file. All of the Javascript unit testing tools I can find (mocha, jasmine, qunit, etc) seem to require node or a browser, both of which aren't applicable for my use-case. Any ideas on a framework that I could use? <comment><USER2> Isn't the js vm you're running code in kinda like a browser? Anyway, searching the web for "adobe after efects javascript" yielded this result: [https://www.npmjs.com/package/after- effects](https://www.npmjs.com/package/after-effects) maybe it could be of use.

EDIT: it seems this package acts like a connector so you could (in theory at least) npm require this package, then plug in your code, dev require a js testing framework and run some tests.</comment>


Sperm Whales Clicking You Inside Out – James Nestor at the Interval (2017) - <AUTHOR> https://www.youtube.com/watch?v=zsDwFGz0Okg <comment><USER2> Tl;DW: Whales clicks create enough pressure to do damage to other living things. Don't go swimming near them while they're making a long-distance phonecall.</comment>


IPv6 Support for AWS Extended to 15 Regions - <AUTHOR> https://aws.amazon.com/blogs/aws/aws-ipv6-update-global-support-spanning-15-regions-multiple-aws-services/ <comment><USER2> Unless something has changed since I just happened to have checked earlier today, VPC ELBs are still IPv4-only. They return AAAA records on the ipv6 and dualstack subdomains like their classic/non-VPC counterparts (which do fully support IPv6), but the ports aren't open on the returned addresses, so it's not very useful. Maybe someone from Amazon can chime in?

<comment><USER3> Apparently ELB has supported IPv6 in VPC for a while, you just have to ask support to enable it for yours.

Source: [https://m.youtube.com/watch?v=qy7zNaDTYGQ](https://m.youtube.com/watch?v=qy7zNaDTYGQ)

<comment><USER4> Can you point out where specifically in the video they say this?

Edit: 24:30 is around the point he mentions it.

</comment></comment></comment><comment><USER5> This is great news. The reason we support IPv6 lookups but only over IPv4 connections on [https://ipinfo.io](https://ipinfo.io) is because we use AWS with VPC, which hasn't historically supported IPv6. Except many sites/services to add IPv6 now that were previously limited by this.

<comment><USER6> I just came across [https://ipinfo.io](https://ipinfo.io), great service. I actually use it when hyperlinking IP addresses for a quick way to view GeoIP information. Thanks!

</comment></comment><comment><USER7> I really wish there were support for an IPv6-only VPC. Terminate inbound IPv4 at ELBs/CloudFront, use 464xlat or similar for outbound IPv4.

<comment><USER6> I am also curious what your use-case is for every instance inside of your VPC having a publically routable IPv6 address. Usually you only need public addresses for your load balancers and ssh jump/bastion host. All other instances inside the VPC are private networking only.

<comment><USER8> An instance might want to reach anything on the internet that's using an IPv6 address is a use case.

Also, having instances connect to IPv6 parts of the internet while you can see which subnet of your vpc the traffic originates from, and maybe filter on that fact.

Having routable addresses is a different thing than them being public or private, which is determined by the fact if you accept traffic to them or not when it arrives at the last hop before entering your vpc.

</comment></comment></comment><comment><USER9> Fun fact: Ubuntu 16.04 image offered on Amazon does not support IPv6 out of the box.

Even when you log in via ipv4, and make relevant networking changes (basically enabled DHCP for v6), it will still fail to apt-get update, because eu- central-1.ec2.archive.ubuntu.com is ipv4-only.

Sad.

<comment><USER10> After a complex set of steps to setup ipv6 in my [VPC, Router, Gateway, Security Groups, and others that I'm forgetting], I was able to launch 2 instances and get both ipv4 and ipv6 addresses. As OddBloke notes, I did have to 'sudo dhclient -6' to grab that ipv6 address in the instance. Once I did, I was able to ssh back and forth using ipv6 (yay!). Then I tried 'apt update'. In fact, the mirrors inside of AWS worked us fine. But security.ubuntu.com did not. It did resolve, but it didn't respond. Rest assured we (Canonical) are working this right now... Thanks.

<comment><USER11> I actually hit this problem, and I fixed it by modifying the routing table associated with my VPC to route ::/0 to an Egress Only Internet Gateway. (Just _adding_ the EIGW to a VPC is not sufficient, because routes aren't configured automatically.)

So I'm guessing that was the issue here.

</comment></comment></comment><comment><USER12> Silly question, but doesn't ipv6 make mitigating DoS attacks all that more harder? i.e. you can't easily blacklist IP addresses...

<comment><USER13> Well, you can ban whole /64 subnets :D

<comment><USER12> That's a bit heavy handed, no? :)

<comment><USER14> Not really, considering any single subscriber could be assigned a whole /56, and that machines with privacy addressing would be periodically changing the last 64 bits of their address.

</comment></comment></comment></comment><comment><USER15> Half the internet shall be available on IPv6 soon now. ;)

<comment><USER16> well, no. now the excuse will shift from AWS doesn't support IPv6 to Kubernetes doesn't support IPv6 :p

</comment></comment><comment><USER17> Hypothetically speaking, does anyone know if enabling IPv6 on a small VPC using 100% of its IPv4 addresses would allow you to spin up additional EC2 instances assigned IPv6 addresses?

<comment><USER7> Doubtful. All instances get an IPv4 address, which unlike IPv6 in AWS, is optional.

</comment></comment><comment><USER18> IPv4 is great, but nat makes things _so hard_. This sounds wonderful.

<comment><USER19> NAT sucks, but so does a lack of affordable L3 switches that can handle IPv6 routing (not that I'll use that against IPv6, but it's a personal pain point of mine).

If I wanted to deploy v6 in my home network I'd literally have to configure my EdgeRouter X on every VLAN in my home network (and as such stuff all IPv6 traffic on my network that crosses subnets into a single 1Gbe connection), since my TP-Link managed switch has no facility to put out a IPv6 RA (even though it supports IPv6 routing, go figure).

I'm really digging the age of vendor silicon where most switches just support whatever Broadcom/etc. put into their chips, but man I hope they catch up with IPv6 soon because right now only the big boys (Cisco/Juniper/HP/Dell/etc.) seem to have any hardware with full IPv6 support, and then you're paying a hefty price for the hardware + support contract (assuming you want software updates).

</comment></comment><comment><USER20> Curious what practical benefits will an average site running on AWS get from IPv6?

<comment><USER21> Being able to segment each of your services (mysql, web, etc) to a different IP as each machine should be getting a /56 or /64 at the very least.

<comment><USER22> But can't you do that with ports?

<comment><USER21> you can. but this can open up way more flexibility on how you run those services.

think about something like docker where each app may be running web/db/queues/mail/etc. with v6 each docker app/service could have its own ip so you can run on the default ports. you could even create a subnet per app to segment them off easily.

</comment></comment></comment></comment><comment><USER6> Can I enable IPv6 on all instances in a VPC that is already deployed in us- west-1? Does this require stopping and starting all instances?

<comment><USER23> Here's an outline of the steps you need to take to get things working:

[http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc- mi...](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-migrate- ipv6.html)

<comment><USER6> Thanks for linking. It looks a little involved.

      1.) Allocate and associate an IPv6 block to the VPC.
      2.) Configure internet gateway and routes in the VPC.
      3.) Update security groups to include IPv6 in the VPC.
      4.) Confirm current instance types support IPv6.
      5.) Assign IPv6 address to instances.
      6.) May require manual network setup on each instance if not using DHCPv6.

This complexity (lack of abstraction) is why I prefer Google Cloud Platform. While GCP currently does not support IPv6, when they do support it, I am willing to bet they will roll it out as a turn-key button click.

<comment><USER24> I certainly hope that a click of a button doesn't log into my instance, adjust network configuration files, reload the network stack, and permit all ipv6 traffic in...

<comment><USER6> Easy there.. I was not advocating any OS/instance level changes by Google. It is just that GCP seems to abstract away concepts like internet gateways and NAT instances, perhaps making the switch to IPv6 on GCP easier than AWS.

<comment><USER24> AWS used to as well. However, that doesn't work if you're an enterprise moving legacy systems up to the cloud that expect certain network addressing schemes.

Amazon.com itself didn't move to AWS until VPC supported the bring your own address primitives. Not everyone can clean slate rewrite systems to bring them to the cloud, Amazon recognizing this is going to keep them dominating the market.

</comment></comment></comment></comment></comment></comment><comment><USER25> It's sad that Google Cloud Platform is behind on this.

<comment><USER26> Well most ISP don't support IPv6 so it's really not an issue atm.

<comment><USER24> You might be surprised. Almost every cable company in the US does, so most Internet users in the US could have ipv6.

The problem is usually the $50 wireless access point most people bought 5 years ago doesn't pass ipv6 through.

<comment><USER27> Spectrum (formerly TWC) in Dallas does not. I still run an he.net tunnel on my router.

Last time I checked (a few months ago), UVerse in Dallas didn't either.

<comment><USER28> I had IPv6 from TWC, then for a month or so before the merger it went MIA, and then about a month after the merger it was back. For some reason I get a more reliable path to my IPv6 gateway than IPv4, so I missed it quite a bit.</comment></comment></comment></comment></comment>


Rant: On the C++ std::experimental::variant to come - <AUTHOR> http://talesofcpp.fusionfenix.com/post-21/rant-on-the-stdexperimentalvariant-to-come <comment><USER2> This is one area where I think Rust has a clear advantage of no baggage. They get to represent Some(T) as a null pointer in the None case.

I will say that having being exposed to Rust's Enums(sum types) I don't think I can ever go back. Combined with pattern matching it's a hell of a combo.

<comment><USER3> This isn't true in general, it's only true when T is a pointer type, in which case C++ would just use a pointer.

<comment><USER4> Or if T is NonZero.

More importantly, dereferencing a None is not undefined behavior in Rust.

<comment><USER5> Or if T _contains_ a NonZero (Vec, VecDeque, HashMap) ;)

</comment></comment></comment></comment><comment><USER6> boost::variant is really interesting and useful in my opinion but it seems to increase compile times exponentially (to say nothing of compiler error messages) ... If a language based variant in C++ could solve those issues then I think that would be really great.</comment>


Amazon is going to kill more American jobs than China did - happy-go-lucky http://www.marketwatch.com/story/amazon-is-going-to-kill-more-american-jobs-than-china-did-2017-01-19 <comment><AUTHOR> Is there an estimate as to how much of Amazon is owned by the Chinese?</comment>


Facebook's Libra losing support from early investors amid regulatory scrutiny - <AUTHOR> https://www.cnbc.com/2019/08/23/facebooks-libra-reportedly-losing-support-from-early-investors.html <comment><USER2> >Treasury Secretary Steven Mnuchin, who said he has worries about potential illicit use of Libra.

And how is the illicit use of the US dollar working out? Backed by nothing, printed when they need more, and regulated by a private entity (Federal Reserve) that has not had an audit in how many years??</comment>


It's not 'meat' in Missouri unless comes from an animal - <AUTHOR> https://www.usatoday.com/story/money/2018/08/28/animal-meat-missouri-law/1114285002/ <comment><USER2> This is not about protecting consumers, it's about protecting big agriculture from potential competition.

Can you be fined in Missouri for calling a limited internet connection "unlimited"?

If the actions in the article about misleading claims were taken more seriously in more areas of advertising I'd be less sceptical but, as with many things that are legislated, this is targeted protectionist lobying.</comment>


Mobile phone is not causing any cancer - <AUTHOR> http://www.jasedi.com/2011/10/mobile-phone-use-is-not-causing-cancer.html

<comment><USER2> That was a poorly-written summary, and you'd be better off linking <http://www.bmj.com/content/343/bmj.d6387> directly. Which may still not go anywhere but at least stands a chance.</comment>


How much money should a startup have in the bank? - <AUTHOR> http://launch.is/blog/how-much-money-should-a-startup-have-in-the-bank.html

<comment><USER2> At first you want a small hard core team of dedicated people. They all have meaningful equity and are "the founding team". Maybe 2 co-founders and 2-5 employees that work really well together. They're like a special ops team that can quickly maneuver around a problem.

They can probably do just fine with 12 months runway and a low burn rate. If they do figure out a repeatable/scalable business, they can raise a lot more money and grow it. If they don't, they can shut the company down.

The problem with Mahalo is that they skipped the first stage completely. Calacanis was "hot" and (like everyone) he thought his idea was a sure thing. He raised $20M because he could.

Even so, if he had created a small team and spent a year or two iterating it might have worked very well. With no pressure of running out of money it might have been harder to keep the the team focused, but it would have probably been fine. Hell, the company could have been breakeven off the _interest_ of $20M.

Instead, they started scaling the business from day one and never really had that hard core team to perfect the processes, product, and business model. Even if he had wanted to, the VCs would have never let him keep the company to 5-10 people for the year or two it might have taken.

Due to the perverse incentives of raising that much money so early he's actually "forced" to make a bluff bet of the whole company rather than build it methodically.

The first bet was made by scaling the company before they figured out the business. The second is an even more extreme version of the first. After it fails there will not be a third.

tl;dr: Mahalo will fail because it raised too much money too early.

<comment><AUTHOR> Actually, we can't fail now.... we have a lot a revenue and 30M+ users a month.

I don't thin it was a lack of focus that caused problems for us. The main problem for us was that building a search results that is--sometimes--20% better than Google's does not incentivize people to switch.

This is a problem Wikia Search, Blekko, Bing, DuckDuckGo and countless others have faced or are facing.

Although it's easy to change your search engine technically, it's not necessary unless your search engine is failing. The problem is that innovators look at the times when Google fails (i.e. when you see 2-3 horrible results in a SERP), but not when it succeeds (the other 7-8 search results).

We took a really hard run at making better results and we proved we could make something incrementally better. In our business making something slightly better is, essentially, failure because it will not cause folks to switch.

Now, in terms of educating folks, that's a wide open space. Right now there is no wikipedia, google or facebook of learning. There's Lynda for software, Rossetta Stone for language, Khan Academy for math and bunch of individuals teaching one-off things on YouTube.

We are making a brand that runs from how to do your hair, to how to solve angry bird, to how to make a movie poster in photoshop to how to make a vegan shake.... and on and on and on.

We have 40k+ videos now and make over 1k a week (with 90 people). We'll get to 3k a week in the next year (with 150-200 people). Then 5-6k videos (with 300-500 people).

We're already, we think, the largest providers of orignal (non-UGC) content to YouTube. And we only pivoted a year ago to do learning videos.

our ipad apps/courses should really drive traffic too... and forget about it when every TV is internet connected (which really starts this christmas and goes forward for the next 7 years).

best j

<comment><USER2> The truth is that you pivoted Mahalo years ago to being a "How To" site. It wasn't a real search engine for very long at all. You saw what Demand Media was doing and did exactly the same thing. You denied it the whole time and then finally admitted it only recently when Panda broke the model for you.

During those denials you would always point to a couple decent pages on Mahalo that were well done. Now you can point to a few _videos_ that are well done.

The problem is that your product was, and is, 95% mass produced crap and 5% good stuff.

Look at the recently uploaded content on Mahalo's YouTube accounts. It's almost nothing but 1-5 minute clips of crap like

"How to say 'Knife' in Spanish"

"How to say 'Door' in Spanish"

"How to say 'Chocolate' in Spanish"

And the music/computer/gaming equivalents.

This isn't the kind of product that people are going to come to rely on or love. They'll only find this stuff when they SEO-stumble across it.

If YouTube decides to slap down video content farms you'll have the same problem all over again.

If you look at some of the best SEO-driven sites like StackOverflow, TripAdvisor, or Yelp you'll notice something entirely different from Mahalo. Those sites have massive followings of people that actually _love_ them. They are reliant on SEO, but in a very different way from Mahalo.

People search Google for a programming question and _scan the page_ for the stackoverflow.com link. They search Google for a restaurant and _scan the page_ for the yelp.com link. Same with TripAdvisor.

No one is searching Google or YouTube then scanning the page for the Mahalo videos.

You have a head start on video content farming and Google seems to be pretty slow. Eventually the focus on quantity over quality will catch up to you and you'll suffer the same way you did with Panda.

The product just isn't good enough to stand the test of time.

<comment><AUTHOR> You're taking the simplest piece of what we're doing and taking it out of context.

Yes, we are doing the top 1,000 words in _every_ language and they are short (2-3 minutes) by design. This is because people search for this kind of information CONSTANTLY. And they want to consume it in a video and hear someone say it.

We are adding to these grammar and situational videos that will be longer (i.e. how to order coffee in French).

These will be put together into a course and will be free and available on iPad and Android in apps, as well as on the web and YouTube.

I think these are very, very valuable.

<comment><USER2> Well, I'll stay tuned Jason. It looks like more of the same content farming right now. Hopefully one day it will become something I can recommend to people.

Good luck.

</comment></comment></comment></comment></comment><comment><USER3> 12 months of cash, if it gets less - cut burn or increase revenue

</comment><comment><USER4> Jason seems bitter about Google's Panda update.

<comment><AUTHOR> Yes, I am. :-)

<comment><USER4> 1) Your opinion about quality of Mahalo content is obviously biased, so we cannot really rely on that.

2) Isn't it too expensive "burning $500K a month" just to find out what idea works?

Discovery phase should be lean, right?

<comment><AUTHOR> I'll start with your second question:

In some categories lean can be a big number: search, making chips and (today) building a social network. Can you start with 10 people and 150k a month burn in these categories? Sure. However, if you're going to take a real stab at this type of problems in a massively competitive market with HUGE incumbents you need 30, 40 or 50 people.

Also, "too expensive" is relative. Spending $500k a month might seem too expensive to someone starting out as an entrepreneur, but to VCs and founder who have been in the game for a long time they would rather risk blowing out 10m and figuring out a lot of problems quickly, than sit around and slowing figuring stuff out.

The whole industry is biased toward big success. Just the nature of the beast. If you want to do something more modest--and i did on my last two companies-- you raise small amounts of money and shoot for a small target.

Neither model is wrong.

In terms of #1, you can go check out youtube channels yourself. We basically stopped writing pages with great writers (but not experts) to creating videos with experts in them. This costs 10x as much, but the result is stunning.

Not sure if you're into styling your hair, but we have one of the best stylysts in Los Angeles doing a series--think of it as a Khan academy course-- on styling your hair.

[http://www.mahalo.com/how-to-style-your-hair/how-to-do-a- per...](http://www.mahalo.com/how-to-style-your-hair/how-to-do-a-perfect- salon-blowout-at-home/)

or photoshop tutorials like Lynda--except free:

<http://www.mahalo.com/learn-adobe-photoshop-introduction/>

[http://www.mahalo.com/photoshop-video-tutorial-how-to- make-a...](http://www.mahalo.com/photoshop-video-tutorial-how-to-make-a-movie- poster/)

Now imagine those not only as courses on mahalo, but also iPad apps. And imagine 1M videos with that level of instruction.

That's what we're doing.

... and that all came from my vision of search results + content. Now, I still believe in that vision, but the truth is Google went from ten blue links in 2007 to what it is today: content + answers + some search links. we knew that was possible--that they would wake up--and they did. c'est la vie!

<comment><USER4> When I'm thinking about lean discovery, $150K/month seems too expensive too. Initial version of Google Search was developed by team of two or three people. That's less than $30K/month burn.

"Neither model is wrong." -- I agree. However "lean model" is much more common and relevant to majority of founders than "$150K+/month burn during discovery phase".

Another consideration: you made your previous company profitable with lean approach. But you did not make Mahalo profitable with "$500K monthly burn" approach.

That should teach us something.

"The whole industry is biased toward big success." - I assume under "whole industry" you imply "Venture Capital industry", not "Information Technology industry", right?

<comment><AUTHOR> 1\. The Google example is only relevant in 1999, when the market was nascent. Now that you have a big, established product there is--in all likelihood--no way to create a google killer at $30k a month. If there was one at that level, it probably would have been found by now. Established markets take bigger checks... nascent markets take smaller checks.

2\. I actually did get Mahalo to profitability last December. :-) Of course, the Panda Update endend that brief, beautiful moment.

3\. Actually, I do mean the entire industry. Now that the internet is global, fast and ubiquitous (mobile) everything good tends to get really big, really fast. Heck, bad things get big fast (Rebecca Black's Friday comes to mind), and so do super simple things (i.e. Angry Birds).

the internet is biased toward big...

<comment><USER4> 1) While Google is efficient, there is no market need to create Google killer.

Even if there is such a need, the goal of startup would be to create a model that at scale would overperform Google. Such model is likely to be created at less than $30K monthly burn.

For example, team of two developers in couple of years may implement and fine tune some efficient social way of ranking search results. $30K/month * 24 month = $720K.

2) Jason Calacanis empirical rule: "if startup is overfunded then as soon as profitability is achieved it would be crushed by Google." :-)

3) "The internet is biased toward big..." -- I agree. But it's "big product scale", not "big organization".

<comment><AUTHOR> 1\. The problem with this assumption is that Google is standing still--they are not. When Mahalo started doing comprehensive search in 2007 google was just 10 blue links. As we added more content to our results they did the same. We were a year ahead of them... in fact we still would be. It just wasn't enough against a scale player.

2\. ha

3\. agreed</comment></comment></comment></comment></comment></comment></comment></comment>


The Smart Gun Doesn't Exist Due to Shooter Backlash - <AUTHOR> https://www.bloomberg.com/news/features/2019-04-15/the-smart-gun-doesn-t-exist-because-of-new-jersey-and-the-nra <comment><USER2> Wrong! Authors reasons fail many times based on their opinions, or bad poll that does not speak for the majority.

>This is the story of why the multibillion-dollar American gun industry hasn't yet managed to make guns any smarter.

No, this is a rant from those that lack proper education for guns and why we have them and why we have no need for a "smart gun".

Why do we need a smart gun, where the ones we have today are just fine? We dont need to have another point of failure. Authors dont see this perspective.

This smart gun tech wont be used or implemented on any of the existing guns. How does this solve anything but make more complications and would only just make the more expensive?

Instead if vilifying guns and passing laws that clearly dont work has not helped. Pushing education about them would be far superior and save more life's imho. High Schools back in the day had hunters safety class for example.</comment>


Linux 5.3-Rc6 - <AUTHOR> https://email@example.com/ <comment><AUTHOR> Yep, it is /just/ an rc release note. However, it is interesting for Linus' comment on it being 28 years since the first Linux announcement.</comment>


Are You Okay With Comcast Sharing Your Home Wi-Fi With Everyone? - <AUTHOR> http://consumerist.com/2013/06/18/are-you-okay-with-comcast-sharing-your-home-wi-fi-with-everyone/

<comment><USER2> Yes.</comment>


Ask HN: Where to find public business information? - <AUTHOR>

I need information about all types of establishments in the US (restaurants, rock climbing, stores, etc), but I really just need the stuff that is officially registered (the address, the name, perhaps if possible the type of establishment).
Does anyone know of a government (or public) location to get this information digitally? Or is this sort of information copyrighted by services like yellow pages so you need to ask them to give it to you?
Basically has anyone done this sort of data mining before and is willing to share some details? <comment><USER2> Try one of these libraries:

<http://www.uspto.gov/go/ptdl/ptdlib_1.html>

<comment><AUTHOR> Its a start :) Thanks.

</comment></comment><comment><USER3> come on!</comment>


I got tired of PHP and Perl, so I tried bash - <AUTHOR> https://github.com/nerdgeneration/www.sh <comment><USER2> Shell scripting gets a lot of hate, but after spending time to grok the language (and copious use of shellcheck), I've grown quite fond of it. This also has the nice side effect of emphasizing use of old unix tools.

I think the "big realization" for me was shifting to think in pipelines instead of passing state around in variables. That completely removed the pain of no arrays in POSIX shell for me. Stdin/stdout are your friend.

Certainly, shell scripting isn't the answer for everything, but with shellcheck (and bats!), I feel like it's a really reasonable default for systemy things. Heck, the status bar I use in my window manager is essentially just a 700 line bash script, with asyncronous update and everything. It's even quite readable and orthogonally organized, if I might boast. Have been pleasantly surprised over the years every time I go back and read it.

<comment><USER3> I think one of the biggest problems is the inconsistent runtime environment. I mean, yes, you can just say fuck POSIX and code for Bash only, but then again, not even Bash is consistent across its versions. Just to give an example: The infamous `set -e` behaves quite differently across different shells

[https://www.in-ulm.de/~mascheck/various/set-e/](https://www.in- ulm.de/~mascheck/various/set-e/)

And those are just POSIX compliant shells. I mean this doesn't matter if you just want to write a script for yourself but becomes frustrating when you want to level up you shell skills and write cross-platform scripts ;-)

That said, I have to add that I love shell scripting... I am not exactly sure why, but I guess it is because it lets you build powerful things with very few lines of code.

<comment><USER4> When isn't this true, though? JavaScript behaves differently based on your browser and version. C runs differently based on your compiler version and system libs. This is just the nature of software.

<comment><USER5> You do realize standardization exists to avoid just that?

<comment><USER6> What's your point? Shell is also standardized by POSIX.

</comment></comment></comment></comment></comment><comment><AUTHOR> So anyway, I've been writing websites for 20 years, and this seemed fun. Some friend suggested I post it here, so I'm doing that just to shut him up.

<comment><USER7> What will you do once you get tired of bash?

<comment><USER8> Port it to Javascript, naturally.

bash.js has a nice ring to it

<comment><USER9> WebAssembly would be pretty cool too. I hear there is now something called _WebAssembly "usermode"_ which can run directly in ring-0.

WebAssembly + Ring-0 = Security /s

[https://github.com/cervus-v/cervus](https://github.com/cervus-v/cervus)

</comment></comment></comment></comment><comment><USER10> Many years ago I learned myself Bash by writing this: [https://github.com/louwrentius/PPSS](https://github.com/louwrentius/PPSS)

It's a huge bash script for parallel processing of work. It was great fun and I'm proud of it as I don't see myself as a programmer of any sort.

But gosh since I learned Powershell and Python, I would never ever ever ever ever use Bash for anything substantial.

If you ever feel like you grow 'fond' of Bash or Shell scripting, it's time to seek a doctor. Please learn Python or some equivalent instead.

\</comment><comment></comment><comment>-----

Edit: reading the code of this web server project:

Let's be absolutely clear: this is a joke project. DO NOT USE THIS FOR # ANYTHING, ESPECIALLY ON A PUBLIC FACING SERVER.

<comment><USER11> Ive found it harder than expected to simply port over a bash script to python. Mostly because the syntax for 'run command c with arguments x y is much worse than bash. And that is before you want to handle output from the command.

<comment> semi-extrinsic It would be super nice if there was a package offering "native" shell experience in python. Say

      from pyshell import sh, ShellError

      def func(a,b)
          output, retcode = sh("df -k | awk '{print $5}'")
          if retcode == 0:
              return output
          else:
              raise ShellError(output,retcode)

<comment><USER12> The sh module is really excellent, and it lets you take the best parts of bash (the external commands, pipes) and ditch the bad parts (string handling, general programming). I think it's what you're looking for.

[https://amoffat.github.io/sh/](https://amoffat.github.io/sh/)

<comment><USER13> I wrote [https://github.com/tarruda/python- ush](https://github.com/tarruda/python-ush) for my own scripts. It was inspired by "sh", but my version supports native "lazy" pipelines (using python operator overloading) and other nice features not provided by sh. Also it works seamless between Unix/windows

I was also planning to extend it to support python3 asyncio, but never got around it

</comment></comment></comment></comment></comment><comment><USER14> I hated Perl until I had to do Bash scripting.

I must apologize to Perl. I see now where it was coming from [1], and what it saved us from.

May god have pity on your soul for inflicting us with this.

[1] There are lots of quirks in Perl that I now recognize come from shell scripting. Most obviously, $VAR notation and string quoting.

</comment><comment><USER15> Really you should be starting with bash, thats how you know why these other languages exist. My rule of thumb used to be if I have more than one "if" in a shell script then its going to python... But now its any ifs or variables

Edit: now that I read the readme I think the title should have been "show hn: I made a web framework in bash" this is pretty neat, I still wouldnt use it, but its cool as hell.

<comment><USER16> > My rule of thumb used to be if I have more than one "if" in a shell script > then its going to python... But now its any ifs or variables

Hmm. I have a slightly different view. If logic is _complex_ , then it should be moved to a different language. But if there are a lot of flat if statements then shell is fine.

<comment><USER17> Yeah it's almost inevitable for a bash script to have lots of ifs but they're almost always simple, checking some variable is empty or something.

</comment></comment></comment><comment><USER18> Suggestion: You use "set -e". The problem with this is that it's silent about which line the script died at, so if your script doesn't print a lot, you may have to do detective work. This is an automatic way of giving you a bit of a hint:

      $ cat meh.bash
      #!/bin/bash
      set -e
      die() {
        echo "Failed at line $1: $2"
      }
      trap 'die $LINENO "$BASH_COMMAND"' ERR
      echo a
      test 1 = 3
      echo b

      $ ./meh.bash
      a
      Failed at line 8: test 1 = 3

Adapted from: [https://unix.stackexchange.com/a/462157](https://unix.stackexchange.com/a/462157)

<comment><USER3> If your script dies because of `set -e` the detective work is just the punishment to condition yourself to write more stable code in the future ;-)

By the way, if you are just using Bash (instead of POSIX /bin/sh) you can do even better. Some time ago I found a stacktrace function somewhere:

      set -Eeuo pipefail
      trap stacktrace EXIT
      function stacktrace {
          if [ $? != 0 ]; then
              echo -e "\nThe command '$BASH_COMMAND' triggerd a stacktrace:"
              for i in $(seq 1 $((${#FUNCNAME[@]} - 2))); do j=$(($i+1)); echo -e "\t${BASH_SOURCE[$i]}: ${FUNCNAME[$i]}() called in ${BASH_SOURCE[$j]}:${BASH_LINENO[$i]}"; done
          fi
      }

</comment></comment><comment><USER19> See also: [https://github.com/avleen/bashttpd](https://github.com/avleen/bashttpd)

<comment><USER20> Another way to skin the cat: [https://github.com/cemeyer/httpd.sh](https://github.com/cemeyer/httpd.sh)

Based on ctypes: [https://github.com/taviso/ctypes.sh/](https://github.com/taviso/ctypes.sh/)

<comment><USER21> On the topic of "why would you write that with that", this is worth a mention: [https://github.com/azac/cobol-on-wheelchair](https://github.com/azac/cobol- on-wheelchair)

</comment></comment></comment><comment><USER22> I think "One does not write a web server in Bash" is like "One does not simply walk into Mordor." You're practically daring short people with hairy feet to attempt it.

(Quote: seebs on slashdot)

</comment><comment><USER23> I wrote a CMS in Standard ML. My only excuse was that I did not know better. The only other language I knew was Prolog. Should have done it in bash instead, would have been easier.

</comment><comment><USER24> I got tired of crack and meth, so I tried heroin.

</comment><comment><USER25> Everything being a string _does_ solve potential type issues...

<comment><USER26> It also creates in-band signalling security hell, even worse than the web already inherently has.

</comment></comment><comment><USER27> Has this been run through ShellCheck? Once scripts are run through ShellCheck, I'd almost consider them safe.

No disrespect to ShellCheck, though. It's a fantastic tool.

<comment><USER28> Shellcheck is indeed great. I needed to make a BASH script to give to my girlfriend that would install on her OS X a snake game I made. Using shellcheck made that a lot easier. For example, I didn't know that the [[ ]] syntax wasn't POSIX compliant. Really great for learning and remembering little things like that for portability.

</comment></comment><comment><USER29> I can't tell you which one, but I know that a very popular website you will have heard of with a surprisingly high Alexa ranking is almost entirely powered by a bash script via CGI.

I'm constantly surprised it hasn't exploded yet.

<comment><USER30> Craigslist?

<comment><USER31> Perl and MySQL.

</comment></comment></comment><comment><USER32> Bash is the love of my life. However, it has serious weaknesses. Its array/table concept is flawed. You cannot do tables containing tables. Secondly, out of the box it cannot load or invoke functions in libraries. Fortunately, ctypes.sh solves this problem, and to some extent, indirectly, also the table of tables problem.

</comment><comment><USER33> Whenever I write websites in bash, I start off fine, but tend to regret it, and end up refactoring into Perl.

<comment><AUTHOR> Whenever I write anything in bash, I start off fine, but tend to dig my heels in as it gets harder and refuse to switch languages.

</comment></comment><comment><USER34> I write shell scriots all the time for a myriad of tasks, but will tore my arm off before writing a server in it.

It is very well suited for imperative scripts, but the language breaks down pretty quickly once complexity and the level of abstraction go up; you start relying on obscure syntax, behaviour, and piling up more and more patterns that require full week-long immersion to grasp. Perl is harmless in comparison.

</comment><comment><USER35> Bash is a misunderstood language. A lot of developers don't take time to learn it enough and discard it because of that. So I started a twitter handle that posts semi-regular tips and tricks about it:

[https://twitter.com/thewayofbash](https://twitter.com/thewayofbash)

</comment><comment><USER36> The best thing about projects like this is how well they illustrate the MVP web framework. A lot of people think things like Django or Rails are magical massive beasts, and to some extent they are, but vast portions of it can get boiled down to something like this.

tl;dr if you're not sure how to roll your own very simple web request/response framework, this is a great intro.

<comment><USER37> Bocker is similar for better understanding Linux containers.

[https://github.com/p8952/bocker](https://github.com/p8952/bocker)

</comment></comment><comment><USER38> I wrote something similar, including a CGI webserver written in shell: [https://github.com/tlrobinson/martin.sh](https://github.com/tlrobinson/martin.sh)

<comment><USER39> If you used `<<-EOT` you could tab-indent the HTML so it reads better. The tabs will be automatically removed and the source code will be much more readable.[1] Of course, it would require tab-indenting all your shell code (but not the HTML itself), which may be a hard pill to swallow if you're a spacer. But the fact is that tab indenting was once upon a time the norm in the land of Unix programming and the tools reflect this.

Windows converts and Python programmers are the ones who turned the tide. I suspect that when most read older source code from the Unix universe they don't realize it's almost entirely tab indented because 90% of the source code will still look clean no matter the tab stop (which is of course the very point of hard tabs =)

[1] I never understood why Perl's heredoc construct didn't also adopt this behavior. I always cringe when people use heredoc (even in shell) without indenting the entire body properly. I mean, that's kinda the point of the heredoc--so the data becomes part of the code.

</comment></comment><comment><USER40> This is of course just personal preference, and I have to admit that it might be heavily influenced by the shift in responsibilities (i.e. my job involves less and less scripting at the CLI level nowadays) but I was always partial to DCL: [https://en.wikipedia.org/wiki/DIGITAL_Command_Language](https://en.wikipedia.org/wiki/DIGITAL_Command_Language)

</comment><comment><USER28> If I'm doing any scripting, I always use BASH. However, I'm trying to actively push myself to learn another more portable scripting language. I still haven't been able to decide which out of Python, Perl and Ruby that I really want to throw myself into -- although recently I have started to become more and more attracted to Ruby.

<comment><USER41> If you are thinking about Perl, then take a look at Mojolicious. An amazing framework to work with that covers so many common use cases with async and functional programming style. I find that the code becomes very precise and readable.

</comment></comment><comment><USER42> Knock bash if you will, but in my experience, it has the best and most helpful community on SO of any language.

<comment><USER5> Probably because more grown ups know it well.

</comment></comment><comment><USER43> Ganesh is a fun option as a sinatra-inspired bash web framework for internal services:

[https://github.com/tropicloud/ganesh](https://github.com/tropicloud/ganesh)

</comment><comment><USER44> also: there is a AWS Lambda Bash runtime.

[https://github.com/gkrizek/bash-lambda- layer](https://github.com/gkrizek/bash-lambda-layer)

</comment><comment><USER45> Does anyone know what the theoretical limitations of trying to use Bash as a Web Server are?

How many requests per second could it serve? What about HTTP/2 support?

<comment><USER46> It would share all the same limitations as any other forking server, plus extra overhead for any spawned child processes. Basically the same as using CGI scripts, and probably not much worse any Apached hosted PHP based website, tbh. Probably wouldn't be worth implementing HTTP/2 since it would increase the complexity with no real benefit.

</comment></comment><comment><USER47> It's a neat experiment, totally impractical, but neat. What this has to do with PHP or Perl I have no idea.

<comment><AUTHOR> It's just personal. I did Perl in 1997/98 and 2017 to now. I did PHP from 1998 to 2017.

</comment></comment><comment><USER48> Not the smartest idea putting "www.sh" in the title, which redirects to a Chinese site.

<comment><USER49> China is .cn, .sh is for a British Overseas Territory and the domain is not registered.

<comment><USER50> It could be the ISP's nameserver snarfing NXDOMAINs.

</comment></comment></comment><comment><USER51> Why not OCaml or Rust?

<comment><AUTHOR> Maybe when I finish the assembler version...

</comment></comment><comment><USER52> I got tired of bash. Still waiting for `typed bash`.

</comment><comment><USER53> Cool Idea, and very easy to migrate between VMs.

</comment><comment><USER42> When you're tired of PHPing and Perling yourself in the head.

</comment><comment><USER54> lol living life in reverse :)

</comment><comment><USER55> You monster

<comment><AUTHOR> Thank you! ;)

</comment></comment><comment><USER56> That title reads like "I got tired of punching myself in the face and kidney, so I tried punching myself in the crotch".

I love it.

<comment><USER57> That's exactly how I read it. Php and Perl are really from a time gone by. neither have REPL. php doesn't even have to a proper print command, you have to add your own newline. Granted they are both quite fast, but with perls "write only" syntax I would only use either of them for the most basic of scripts.

<comment><USER58> Except that PHP does have a REPL, and using PHP_EOL is hardly a big deal. PHP induces an undeserved gag-reflex for most Ruby / Python / JS devs because they read some "why php sucks" post on someone's blog ten years ago, but really the language is quite modern now (not to mention faster).

<comment><USER59> I honestly tried to come back to PHP after most of a decade in ruby. I couldn't find a decent ORM! And after trying to write one, I think I see why.

We ended up rewriting the entire product in Python.

<comment><USER31> Why not Ruby if you'd just spent a decade with it?

<comment><USER5> Sometimes preference doesn't match project choice?

</comment></comment></comment></comment></comment></comment><comment><USER60> If you are writing more than 10 lines of bash, write python instead.

Awful language. Waste of time.

<comment><USER61> You're using it wrong. The things that bash is good for are not the same things that Python should be used for. For what bash is good for, it is the simplest and fastest language one could use.

<comment><USER62> What is bash good for?

<comment><USER5> For a task like taking backups on servers that involves invoking bunch of commands, I'd rather not use a scripting language that asks you to open a process, bind variables on its stdin/stdout and all the boilerplate handling.

How do you do this in a scripting language without complication?

$ ssh remote.server 'mysqldump db | gzip -c' | gunzip -c | mysql db

It's the power of individual commands though I admit bash sucks as a language but it got invented forever ago, so can't blame it. But we need something better than bash. Fish is close but not too good.

</comment></comment></comment></comment><comment><USER63> Look thru the code though... Thought this would do more than serve a static html file. Not impressed

<comment><AUTHOR> It doesn't. The route defines the controller. The controller displays the content, ideally using the view function (there are examples with and without a view, but always with a controller). The view function takes an associative array for template replacements.</comment></comment>


Tories switch to messaging app Signal after WhatsApp leaks - <AUTHOR> https://www.theguardian.com/politics/2019/dec/17/tories-switch-to-messaging-app-signal-to-curb-whatsapp-leaks <comment><USER2> > Killock said: ... "I guess Priti Patel must be quite confused and alarmed as > her party votes with its feet for secure messaging platforms, while she's > campaigning to stop them from protecting these very same users."

I'm sure Killock's tongue was firmly in his cheek when he said this, but of course Patel is unlikely to experience either emotion. A lot of the UK political establishment have an attitude of "one rule for us, another for the hoi polloi". Patel is certainly not an exception.

</comment><comment><USER3> How does "option to make messages automatically disappear after a set period of time" and "open source" fit together?

<comment> noman-land This is a confusing question. The two seem to have nothing to do with each other.

Open source means the source code is available to read.

Disappearing messages means you can delete things from your device and ask the other side to delete them as well.

<comment><USER4> A user who is in control of their client software can just comment out the self destruct part.

<comment><USER5> Not necessarily - Signal can show a warning icon to people they're having conversations with / only enable the feature if everyone in the group is on an official client. Nothing about it being open source prevents this, and conversely, making Signal closed source wouldn't prevent people exfiltrating content via jailbroken phones etc. (Or via screenshots, as others have mentioned.)

<comment><USER3> A modified client could simply claim to be official.

<comment><USER5> Do the mobile platforms give you a way to authenticate an app as the official app of a certain ID? I thought they did but now that I think harder I'm not actually sure how to implement it.

If they do, it's "just" that plus jailbreak detection.</comment></comment></comment></comment></comment></comment>


Not-o-matic Differentiation - <AUTHOR> https://ajknapp.github.io/2018/08/14/notomatic-differentiation.html <comment><USER2> I'm trying to figure why the person making the post failed. There are existing Haskell libraries for automatic differentiation [1].

As opposed to ordinary symbolic differentiation or numerical differentiation, automatic differentiation is a method that takes the code of a function and a value and returns the derivative of the function at run time.

Of course, the author is working with a vector library and so his version will take N-dimension vectors/tensors and a functions of these and return N+something dimension vectors/tensors. That part is kind of head spinning and I assume that's where things fell apart.

[1] [http://hackage.haskell.org/package/ad](http://hackage.haskell.org/package/ad)

<comment><USER3> Because this was intended to support `accelerate` and uses the variable-mode ad approach presented in 'the simple essence of automatic differentiation' which afaik has not been implemented in conjunction with `accelerate` .

(Your comment reads quite uncharitable/mean btw, hard to tell if it was intentional)

<comment><USER4> > (Your comment reads quite uncharitable/mean btw, hard to tell if it was > intentional)

Really? I didn't get that at all. Was it edited?

</comment></comment></comment><comment><USER5> There's a fairly large body of work on the differential lambda calculus that you seem to have missed...

<comment><USER6> My HP 48G(X) from the 1990's did automatic symbolic differentiation and integration. And, IIRC, there's probably a textbook in either Fortran or C for symbolic mathematical evaluation (partial evaluation, simplification and Monte Carlo fallback) and transformations. We had to deal a lot with this in the code used by a nuclear reactor simulator (in Fortran) that effectively did glorified finite element analysis with some actual direct calculations here and there.

<comment><USER5> Huh?

</comment></comment></comment><comment><USER7> this might be the right place to ask: can you differentiate a recursively defined function?

<comment><USER8> Let's try

        pow x 0 = 1
        pow x n = x * pow x (n-1)
          ergo
        pow' x 0 = 0
        pow' x n = pow x (n-1) + x * pow' x (n-1)
          ergo
        pow' x 1 = pow x 0 + x * pow' x 0
                 = 1 + x * 0
                 = 1
        pow' x 2 = pow x 1 + x * pow' x 1
                 = x + x
                 = 2 * x
        pow' x 3 = pow x 2 + x * pow' x 2
                 = x * x + 2 * x * x
                 = 3 * x * x</comment></comment>


Turing test beaten for first time by virtual 13-year-old boy - <AUTHOR> http://www.theguardian.com/technology/2014/jun/08/super-computer-simulates-13-year-old-boy-passes-turing-test

<comment><USER2> I only hope they didn't "downgrade" the expectations of the testers by insisting he was a 13-year-old boy, thus some of his answers might not make sense!

Although the Turing Test is a theoretical challenge with no clear technical and objective benchmarks to achieve, it should not be downplayed. Although this is a remarkable achievement, I will wait until they beat a virtual adult of postgraduate level!

<comment><AUTHOR> I just posted this elsewhere, but thought it applies here too:

I've often wondered if the Turing Test has been decoupled from signifying its original goal due to an instance of Goodhart's Law; namely, "When a measure becomes a target, it ceases to be a good measure."

Surely the ability to trick a human into believing an AI is a human is a milestone, but it was with an AI specifically optimized for this task. The deeper question is if the passing of the Turing Test in this case means we should ascribe consciousness to the bot, and I think none of us are willing to affirm it yet. I would suggest that this discrepancy is caused by the "measure becoming a target" and losing its ability to be a "good measure." I guess this is why there is such a critical distinction between Artificial Intelligence and Artificial General Intelligence, which is where the Turing Test would have more weight.</comment></comment>


City-scale energy consumption - data visualization - <AUTHOR> http://infosthetics.com/archives/2008/04/nuage_vert_energy_power_plant_visualization.html <comment><AUTHOR> It's a great idea. They are using a laser to project a display into the sky that shows the real-time energy consumption of the city. Often time the key to solving a problem is to simply measure it and display the data where everyone can see it (people often subconsciously adjust their behavior, I think Joel wrote something about using this for software development)</comment>


Cocos2D for HTML5 - <AUTHOR> http://cocos2d-javascript.org

<comment><AUTHOR> And there are Javascript native bindings for Cocos2D, so you can run the same source code in different platforms (desktop, mobile, html5) taking advantage of each one (like GPU performance on iPhone). Link: <https://github.com/zynga/jsbindings#readme>

Another HTML5 demo: <http://www.cocos2d-iphone.org/t/js-tests/tests/>

<comment><USER2> You can also use a native framework like Ejecta[1] or CocoonJS[2] to run any HTML5/Canvas game with good performance. (Disclaimer: I'm the author of Ejecta)

[1] <http://impactjs.com/ejecta/> [2] <http://www.ludei.com/tech/cocoonjs>

<comment><AUTHOR> But we are talking about something different for the case of Cocos2D:Ricardo Quesada (Cocos2D owner) has made specific GPU optimizations for the framework himself on iOS.

</comment></comment></comment><comment><USER3> The Cocos2d-x (Cocos2d api in C++ with a bunch of supported platforms[1]) has had Cocos2d-HTML5[2] for a while. It uses the same api as their JavaScript bindings and there are some demos of complete games running on both from the same platform.

(Disclaimer I am one of the founders of Game Closure) Game Closure provides a complete HTML5/Web/Native game development SDK with a larger focus on tooling than these projects[3]. The website is a little light on details - send me mail if you're interested!

[1] <http://www.cocos2d-x.org/projects/cocos2d-x/wiki/Download> [2] <http://www.cocos2d-x.org/projects/cocos2d-x/wiki/Html5> [3] <http://gameclosure.com/>

</comment><comment><USER4> Great work! Cocos2D has the best API for gamedev I've ever seen.

<comment><USER5> Just to point out other options, Lime[0] is a JS game engine that's almost an exact clone of Cocos2D. So it's also a good JS choice if you like the Cocos2D way of doing things.

[0] <http://www.limejs.com/>

<comment><USER6> except that doesn't make sense use limejs when you can use cocos2d with javascript running your code natively on multiple platforms

<comment><USER5> Perhaps, but it's nice that there are other options out there. Cocos2D is a juggernaut, for sure, and a very safe choice. But LimeJS+CocoonJS/Ejecta or Impact+CocoonJS/Ejecta, etc can get you mostly the same features as Cocos2D+JSB does. I'm glad there is some diversity out there.

<comment><USER7> Haha there is a game engine called Impact <http://impactjs.com> ! I find it quite funny for very obscure reasons.

</comment></comment></comment></comment></comment><comment><USER8> Last update was 4 months ago..is this still an active project?

</comment><comment><USER9> Is there anything like this for Kobold2d?

<comment><USER6> kobold2d is not a framework, is just cocos2d + an installer + few libraries.</comment></comment>


A linux distribution based on Hannah Montana - <AUTHOR> http://hannahmontana.sourceforge.net/ <comment><USER2> I'm just dreading when the Twerk version comes out, and the upgrade is just messy, with people wanting to go back 3-4 versions.</comment>


Yahoo Announces Public Disclosure of National Security Letters - <AUTHOR> https://yahoopolicy.tumblr.com/post/145258843473/yahoo-announces-public-disclosure-of-national <comment><USER2> """You are directed to provide records responsive to this letter electronically to the FBI within 21 business day(s) of receipt of this letter"""

I wonder how the exchange takes place? There's no mention of encrypted mail or anything just an additional note that regular mail and non-secure fax are not secure enough.

They also seem to have a template of sorts as indicated by the day(s) and the phrasing when it comes to accounting periods vs. 1st to 1st.

I wonder if you can forge (or possibly man in the middle) such a request (there's no digital signature of the letter I suppose). You'd need to set up a fake agent persona with phone number and fake signature. For a criminal organization that doesn't seem to be an unreasonable afford.

<comment><USER3> >I wonder if you can forge (or possibly man in the middle) such a request (there's no digital signature of the letter I suppose). You'd need to set up a fake agent persona with phone number and fake signature. For a criminal organization that doesn't seem to be an unreasonable afford.

Using fake subpoenas to dox people on IRC seems to be a regular thing, I don't see why not NSLs. (Besides the fact that NSLs might actually receive some scrutiny, so they're probably the inferior choice there)

Most people will just comply straight away.

<comment><USER4> Still amazed to this day that a guy created fake FBI Google listings, proxied the calls to the FBI, recorded the calls, told the FBI, and nothing happened.

<comment><USER5> Whoa, what? Link to this story?

<comment><USER6> DDG dug up these:

[http://www.techtimes.com/articles/3930/20140303/heres- how-a-...](http://www.techtimes.com/articles/3930/20140303/heres-how-a-hacker- used-fake-google-maps-listings-to-record-calls-of-fbi-and-secret-services.htm)

[http://www.theverge.com/2014/2/28/5458610/fake-google- maps-l...](http://www.theverge.com/2014/2/28/5458610/fake-google-maps- listings-recorded-calls-to-the-fbi-secret-service)

</comment></comment></comment></comment></comment><comment><USER7> The Internet Archive (helped by EFF) got one disclosed in 2008:

[https://www.eff.org/cases/archive-v- mukasey](https://www.eff.org/cases/archive-v-mukasey)

[https://www.eff.org/document/national-security-letter- intern...](https://www.eff.org/document/national-security-letter-internet- archive)

Yahoo's claiming "This marks the first time any company has been able to publicly acknowledge receiving an NSL as a result of the reforms of the USA Freedom Act." \-- which is kind of true, in that IA got one released _before_ the reforms!

<comment><USER8> For an even more technical truth, IA is not a company.

<comment><USER9> Actually, IA is both a company and a corporation. Its legally a charitable non-profit corporation, but that's a specific kinds of company, not a not-a- company. So, your "technical truth" isn't.

<comment><USER8> Well, I agree that IA is a corporation as that is a legal structure. Technically a "company" has to be commercial in nature, at least if you go by the dictionary definition.

This is entirely too pedantic though, and it rather upsets me that people feel the need to down vote this.

</comment></comment></comment></comment><comment><USER10> This makes zero difference.

So apparently the same people, who gag you, sometimes at their discretion may remove the gag. The only thing the law requires is for them to _consider_ doing that.

<comment><USER11> That's actually important. If maintaining the letters requires some nonzero effort, they'll want to weigh maintaining letters with other things they could be doing with their budget.

I'm not sure if they have to be reapproved by a judge each time. If that's the case, then on average it seems like you'd have greater churn on the letters. And even if there's a near-100% approval rate while investigating, it seems harder to argue to a judge as the years go on.

It won't help if Edward Snowden was the target of your letters, of course.

</comment></comment><comment><USER12> I had to do a double take on the third letter after reading the return address of Microsoft Way. At first I thought Microsoft was issuing NSLs. Turns out the FBI and Microsoft happen to be next door neighbors in Charlotte. I feel like Microsoft ought to consider giving up the street name.

<comment><USER13> Amazon and DHL in Germany occupy 2 halves of the same huge warehouse, obviously because Amazon uses them for delivery.

Maybe there's some sort of cooperation with the two in Charlotte as well.

<comment><USER14> The worlds most popular operating system and a government's investigation organization.

Yes.

</comment></comment></comment><comment><USER15> Direct link to the NSLs: [https://s.yimg.com/ge/tyc/Redacted_NSLs.pdf](https://s.yimg.com/ge/tyc/Redacted_NSLs.pdf)

<comment><USER16> that includes the persons DOB. I wonder what would happen if the individual had used the wrong DOB when creating the request. Could (should?) yahoo say 'That doesn't match our records' and require a new request?

<comment><USER3> There is no connection made between the name/DOB/address combo and the email address. If Yahoo only found records matching the email address, then they'd still have to provide those.

</comment></comment></comment><comment><USER17> Fun fact: these documents was properly redacted by Yahoo. Unlike some PDFs we've seen previously released by NSA (IIRC), which had just black rectangles drawn over the content.

<comment><USER18> Would you mind explaining the significance of this to me? What does properly redacted mean as opposed to drawing black rectangles over the content?

Am I correct in assuming that if done improperly the content underneath can be reconstructed?

<comment><USER19> In the past there have been instances where e.g. the Microsoft Word highlight tool has been used to... highlight the paragraph in black, which obviously visibly hides the text but not removing it (unless only published as an image). Drawing a box directly onto a PDF without re-rasterizing it (or explicitly removing the text from the pdf data) achieves the same effect.

<comment><USER18> Thanks for the explanation.

</comment></comment></comment></comment><comment><USER20> Are they actually written with a typewriter? I thought maybe a daisy wheel, but some of the pages are crooked which wouldn't happen like that in a daisy wheel printer.

<comment><USER21> They were most likely FAXed in, and the paper was misaligned when it was sent from the FBI office to Yahoo!.

</comment></comment><comment><USER22> It seems that the redacted text at the top left of every non-letterheaded page is probably "File No.NSL-XX-XXXXXX" (where the Xs stand for the actual numbers). The file/ref number is at the first page, under the FBI logo and is also mentioned at the end of the letter, for use instead of the letter's details. So, why redact it?

</comment><comment><USER23> Semi-unrelated. I don't understand how the FBI can require companies to say "0-499" when companies could previously have said "0". It's already obvious that it means that they have received 1-499 (otherwise it wouldn't be an NSL- limited range in the first place), but what happens if you were to do something like the following?

All you have to do in your initial transparency report (before receiving any NSLs) is to just straight-up say "We have received zero NSLs. If in the future we only indicate that we have received a possible range of NSLs, that means we have recieved at least one NSL".

It's already obvious to most people, but would explicitly stating that to your users (before actually receiving any NSLs) be "pre-contempt"?

<comment><USER24> This is called a warrant canary.

[https://en.m.wikipedia.org/wiki/Warrant_canary](https://en.m.wikipedia.org/wiki/Warrant_canary)

<comment><USER23> This is a little more explicit than that, since they would be specifically informing their users that they received an NSL.

</comment></comment></comment><comment><USER25> The fact that this is called the "USA Freedom Act" tells you everything you need to know.

</comment><comment><USER26> Do the targets of the NSLs now have standing to file suits?

<comment><USER27> This is a funny joke.

<comment><USER28> Is it? Have there been any suits/appeals dismissed based on a lack of standing due to an NSL being inadmissible? Or has there been any dismissal for other reasons (e.g. national security reasons) that might now be able to be revisited now that some NSLs are becoming public record?

<comment><USER29> It would be impossible to prove that you are the subject of an NSL, because that information is never released publicly or acknowledged in court.

</comment></comment></comment></comment><comment><USER30> Are real agents signing these? "Mr. Freese" and "John Strong" read like character names. Are these aliases?

<comment><USER31> A quick LinkedIn search shows a Donald Freese who seems to be fairly high- ranking in the FBI.

<comment><USER30> But he is still only a piece of paper away from being Doctor Freeze working alongside Captain Strong out to foil terrorists on behalf of SHIELD.

</comment></comment></comment><comment><USER32> Am I mistaken or does it look as though these letters were typed on typewriters? Please tell me I'm wrong...

<comment><USER33> Looks more like low quality / highly compressed scan but I might be wrong.

Anyway, typewriter is not a bad idea, probably more secure than any computer with internet connection or USB port ;)

<comment><USER34> Don't be so sure! There was an amazing Soviet hack of the US embassy typewriters back in the day. There's a great writeup here: [http://www.cryptomuseum.com/covert/bugs/selectric/](http://www.cryptomuseum.com/covert/bugs/selectric/)

<comment><USER33> Awesome link, thanks!

</comment></comment></comment></comment><comment><USER35> I love how their demands are just repaste verbatim of the parts of the law that grants them authority.

<comment><USER36> No need to give the judge a reason to throw it out on grounds its demands exceeded the requirements of the law.

<comment><USER35> My point was the opposite - that they always exercise their authority to the maximum. Not a single thought spared on restraint or precision.

</comment></comment></comment><comment><USER37> "John A. Strong" \- Special Agent in Charge.

reminds me of Special Agent Force. :P

</comment><comment><USER38> Announces disclosure, reads to me, 'giving government bit more time for another gag order or lawsuit'

Just disclose it already.

</comment><comment><USER39> >FBI is now required to periodically assess whether an NSL's >nondisclosure requirement is still appropriate, and to lift >it when not

This is not an act of civil disobedience, FBI let them release this information.

<comment><USER40> Nobody said it was.

</comment></comment><comment><USER41> It looks like they immediately removed them? From the bottom:

> Note: The letters we released have been redacted to protect the identities > of the FBI agents involved in the investigations, our own personnel, and the > Yahoo users affected by the NSLs. The affected users received notice of the > NSLs directly from us under our User Notice Policy.

<comment><USER42> 'redacted' implies only a segment of the content has been removed, not the entire docs.</comment></comment>