Ask HN:  Lisp, Haskell, and the Blub Paradox - <AUTHOR>

Lisp is the classic "top of the power curve" language for the Blub Paradox.  Lisp people look down on basically every other language, and ask "How can you get anything done in those languages?  They don't even have macros."  (That's Lisp macros, not C-style macros, which are a much different thing.)
But Haskell programmers look down on Lisp (and everything else), and ask "How can you get anything done in those languages?  They don't even have a decent type system."  (And no, C/C++/Java types are not what a Haskell programmer calls "decent".)
It seems, then, that we have two different languages, each looking down on the other, and sure that it knows why it is looking down, that is, sure that it knows why the other is less powerful.
My question:  Is the Blub Paradox wrong?
The Blub Paradox assumes that all languages can be ranked on a one-dimensional axis labeled "power".  But power is the power to do something.  What if the "something" determines (at least to some degree) what "power" looks like?  Maybe a better view is that programming languages look like a tree, and your problem looks like a vector.  Pick the language that gets you the furthest in the direction of your problem vector.  (This view means that you cannot meaningfully compare the power of different languages without specifying the problem domain, unless the languages are on the same branch of the tree.)
Here's an even stranger question:  Is it possible that Haskell's type system and Lisp macros are doing somewhat equivalent things?
Responsible, thoughtful answers are welcome.  Flames are firmly discouraged. <comment><USER2> IIRC "Beating The Averages" made allowances for domain specific languages. However, the core of almost any language can be applied to almost any other, and domain-specific tools layered on top. Lisp's syntax is especially good for this because it is so extendable and simple, I'm not sure about Haskell having not used it myself.

As for Haskell types vs. Lisp macros, my impression is that macros are, at least semantically, more correct for the common process of "apply this action with some changes to multiple situations" that I believe you're referring to when you talk about these properties being equivalent. However, I'm not completely familiar with how a "proper" type system actually works and what the capabilities of languages designed around such a system are, so maybe somebody more experienced could shed some light.

</comment><comment><USER3> The Blub concept is completely misguided and arrogant. It assumes that those who use more powerful tools are clever and superiour and those who use simpler tools are idiots too stupid to understand their betters programming away in Lisp.

It ignores the fact that an enlightened software engineer can make the decision NOT to use the most powerful language and find value in simplicity, ubiquity or community.</comment>


Facebook Roulette pits you against three friends, the loser's account is deleted - <AUTHOR> http://mashable.com/2011/05/11/facebook-russian-roulette/ <comment><USER2> So you give your username and password to some Russians.

And you trust them to:

\- not spam your friends

\- not mine your details/friends details for data for phishing and other scams.

\- not attempt to use your password (or variations of) on other websites.

Sounds like a smart thing to do.

<comment><USER3> What's up with russians? I wouldn't give a username and password to americans either.

<comment><USER2> Yes, I should have said 'strangers' rather than Russians.

It's just that much of this sort of internet crime comes from Russia and other former soviet countries, most likely due to more lax laws, law enforcement and an inability for westerners to touch them.

</comment></comment></comment><comment><USER4> Cute. But Facebook would never allow it. You think they have a delete_user_account() method in their developer API? ;)

<comment><USER5> You can't delete a facebook account, as far as I can tell, but you can change the data, the email, and randomize the password, which is pretty similar.

Seems to me like that's what they were talking about with the 'last words'

<comment><USER6> You have been able to _actually_ delete an account for a while. It's described underneath deactivating on this page: <https://www.facebook.com/help/?faq=13016>

<comment><USER5> "There was a problem reaching the FAQ you requested" I think you actually want <http://www.facebook.com/help/?page=842>

and thanks, I didn't know about that. I'm going to go do that now; I 'deactivated' my account some time ago and facebook is still spamming me, and people are still trying to message me on facebook.

</comment></comment></comment></comment><comment><USER7> I'm loving the author's repeated statements in the comments, "To be clear, this is a concept, not a real game."

</comment><comment><USER8> This sounds like a similar yet not as well executed idea as Crispin Porter and Burger King's Whopper Sacrifice ([http://news.cnet.com/delete-10-facebook- friends-get-a-free-w...](http://news.cnet.com/delete-10-facebook-friends-get- a-free-whopper/)) from a few years ago.

</comment><comment><USER9> For a "chance" to win a trip? No way. They'd have to offer something with real value, like an iPod.

<comment><USER10> My sarcasm-o-meter is failing, is this for real?

</comment></comment><comment><USER11> ...Except it takes 30 days of no account activity to take effect.

</comment><comment><USER12> This is self limiting.

</comment><comment><USER13> Marketing! FTW!

</comment><comment><USER14> Why does the loser get the reward?</comment>


Tesla Shareholders Will Vote on Booting Elon Musk as Chairman - <AUTHOR> https://gizmodo.com/tesla-shareholders-will-vote-on-booting-elon-musk-as-ch-1825598148 <comment><USER2> Sorry guys, there is no Tesla without Elon.</comment>


Adblock Plus is probably the reason Firefox and Chrome are such memory hogs - <AUTHOR> http://www.extremetech.com/computing/182428-ironic-iframes-adblock-plus-is-probably-the-reason-firefox-and-chrome-are-such-memory-hogs <comment><USER4> People are using µBlock now for precisely this reason.

[https://github.com/gorhill/uBlock/wiki/%C2%B5Block- vs.-ABP:-...](https://github.com/gorhill/uBlock/wiki/%C2%B5Block- vs.-ABP:-efficiency-compared)

[https://chrome.google.com/webstore/detail/%C2%B5block/cjpalh...](https://chrome.google.com/webstore/detail/%C2%B5block/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en) [https://github.com/gorhill/uBlock](https://github.com/gorhill/uBlock)

<comment><USER5> Together with umatrix ([https://github.com/gorhill/uMatrix/](https://github.com/gorhill/uMatrix/)) are the best chrome extensions

Since I went back to firefox those are the only extensions I really miss, there is policeman ([https://github.com/futpib/policeman/](https://github.com/futpib/policeman/)) but it's not as good as them yet

To whoever develop extensions, please don't focus only on chrome, firefox during the last months has become must better that it was before, if developers only consider chrome, people will eventually migrate to it and firefox will die. Even though chromium is open it won't be good for the ecosystem

<comment><USER6> As my paranoia ramps up year on year, I now use Opera with µBlock. For me, it has the polish of Chrome with some nice extras, but without the increasingly creepy Googality. It works fine, although I've not tried µMatrix. (I have my defaults changed to DuckDuckGo. Usually connecting via a VPN.)

I've whitelisted a few sites I like to support (a couple of webcomics, HaD etc).

I have a lot of filters: "62,501 network filters + 40,728 cosmetic filters".

Opera's task manager says the extension is taking up a mere 32MB. Probably not accurate, but a lot better AdBlock (my previous favourite).

Off-topic but I wish people would stop using Mu for project names. Where is the Mu key on the keyboard? I have to copy and paste or alt-code it. Call the project microBlock or something! They use "u" instead of "µ" on Github, so why not just use something else entirely?

µTorrent was the one that really irritated me because I couldn't type "utorr" to search for it on my start menu.

I'd say something to gorhill (albeit far more politely), but it seems childish and ungrateful. He's clearly poured so much time and effort into making such useful software. "Great software but the name is fucking annoying, mate!"

<comment><USER7> [http://www.howtotype.net/symbol/Micro/](http://www.howtotype.net/symbol/Micro/)

Sadly, the US-International keyboard on Windows does not implement a shortcut for the "micro" character ([http://support.microsoft.com/kb/306560](http://support.microsoft.com/kb/306560)).

<comment><USER8> There's always character map which has this and like _all_ others you can ever think of. A bit cumbersome, but at least one doesn't have to remember character codes and can search for characters by name.

<comment><USER9> "Let me google that" _pulls out character map_ pretty poor UX if you ask me. Almost as bad for search ability as calling your product "go" or "cloud" or "driver" or any other one-word generic, hard to find even with contextual terms around it.

<comment><USER8> _pretty poor UX if you ask me_

yup. Has been around since NT or maybe even longer..

<comment><USER10> the poor UX is not the Character Map

It is having to open it every time you want to type the name of µSomething

<comment><USER11> The poor UX is the keyboard layout throwing away altgr.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I use AdBlock Plus not because I don't want to see ads...I actually don't mind ads. I use it because I don't want auto-starting audio, _ever_. I have 30-60 tabs up at any given time. When an ad starts playing audio, it disrupts my entire workflow, possibly disturbs my partner sleeping next to me, etc.

In short, auto-start audio in ads is quite simply so far outside of what I consider acceptable behavior, that I'm willing to burn the whole goddamned business model to the ground to stop it. I disable AdBlock Plus for sites that I know to behave responsibly with regard to their ads (reddit, probably a couple of others). If there were a list of Advertising Good Citizens who never use auto-starting audio ads (such a list would probably need to demand a few other things, like a good privacy policy, no popups/popunders, etc., but audio is the single reason I installed AdBlock Plus), that could be dropped into AdBlock Plus, I would happily use it. I don't mind ads, but the second somebody disrupts my work, my conversation on Skype, my partner's sleep, my music listening, etc. is the second I grow to hate the site and the advertiser.

<comment><USER13> Just enable click-to-play in chrome, on media plugins. Sound only ever really auto-plays from flash ads and such (though these days its possible with HTML5 and this likely won't stop such audio/video). Its an extra click and can make some sites a bit more difficult (e.g. beatport, tries to hide its flash so you cant click it to enable it), but it works for me.

<comment><USER14> Click-to-play on plugins often breaks sites that use Flash ads as overlays. The ads often have the "close this ad" in the Flash code itself, making it impossible to kill the ad layer without activating the plugin. (In my more cynical moments, I wonder whether this behavior is by design.)

<comment><USER15> > making it impossible to kill the ad layer

Use the context menu. There is an option to "hide" (delete) the ad there.

Another option is this bookmarklet (only works if the element that should be deleted isn't in an iframe):

        javascript:(function(){var e=document.body.style.cursor;document.body.style.cursor="crosshair";var t=document.createElement("div");var n="border:1px solid #3280FF;background-color:rgba(50,128,255,0.5);position:absolute;z-index:2147483647;display:none;";var r="pointer-events:none;";var i="transition:width 60ms,height 60ms,left 60ms,top 60ms;";n+=r+"-webkit-"+r+"-moz-"+r;n+=i+"-webkit-"+i+"-moz-"+i;t.setAttribute("style",n);document.body.appendChild(t);var s=null;var o=function(e){var n=e.target;if(n!==s&&n.parentNode){var r=n.getBoundingClientRect();var i=document.documentElement;var o=document.body;var u=i.clientTop||o.clientTop||0;var a=i.clientLeft||o.clientLeft||0;var f=window.pageYOffset||i.scrollTop||o.scrollTop;var l=window.pageXOffset||i.scrollLeft||o.scrollLeft;var c=l-a+r.left-1;var h=f-u+r.top-1;t.style.display="block";t.style.left=c+"px";t.style.top=h+"px";t.style.width=r.width+"px";t.style.height=r.height+"px";s=n}};var u=function(n){document.body.style.cursor=e;if(n.target.parentNode)n.target.parentNode.removeChild(n.target);if(t.parentNode)t.parentNode.removeChild(t);window.removeEventListener("click",u,false);window.removeEventListener("mouseover",o,false);n.stopPropagation();n.preventDefault()};window.addEventListener("mouseover",o,false);window.addEventListener("click",u,false)})();void(0)

</comment></comment></comment></comment><comment><USER16> People aren't using Adblock to conserve resources. They're using it to block ads and most are willing to take a performance hit to do so.

<comment><USER17> That's not why I started using Adblock. I started because the web became unusable on an older machine (5 years). The content wasn't any more sophisticated but it soaked up all the resources (CPU, RAM etc.) available. Imagine if you had a PDF reader that ran at 100% CPU and swapped all the time!

<comment><USER18> I have an atom dual core small PC connected to my TV (it runs windows 7, yeah I know) and it's 'ok-ish' with performance, but starting a browser is a tad slow (chrome) and adblock makes it even slower as it's a plugin which is particularly slow to start. So I don't think blocking ads for performance reasons on slow machines is still cutting it if you take into account the performance penalty of abp.

All things considered however, it's IMHO a small price to pay for having the freedom to decide which content is fetched during page rendering and thus which services won't know whether you're visiting a certain webpage.

</comment></comment></comment><comment><USER19> I used to not do Adblock, because you know, ads make the internet go round and all that.

But with the "download here"-button ads, there is no way to know what button to press anymore. Now installing Adblock is a requirement.

<comment><USER20> Honestly, I've only seen the "tricky" Download Now buttons on shady video websites (read: those that have all the episodes of Seinfeld on them).

Though I've had more and more invasive ads in newspaper sites (the fact that I get so many ads on NYT's site despite being a subscriber is frustrating to say the least), I do like keeping free websites running. I find using ABP to be somew immoral , violating the contract with which you're looking at someone's content. I have less sympathy for people who are basically showing stolen content (not technically stolen , but still), though...

<comment><USER21> > the fact that I get so many ads on NYT's site despite being a subscriber is > frustrating to say the least

Have you never seen the print edition of the NYT (or any other newspaper)? Since they just use news to fill in the otherwise blank areas between ads the motto really should be _all the news that fits, we print_.

<comment><USER22> "they just use news to fill in the otherwise blank areas between ads"

That is pretty much literally true. When I worked on a student newspaper, it was pretty common for the advertising manager to rush in to the editorial offices and say things like "I've just sold another full-page ad, so we're going to be printing extra pages - do you have any copy to fill them?"

<comment><USER23> > When I worked on a student newspaper, it was pretty common for the > advertising manager to rush in to the editorial offices and say things like > "I've just sold another full-page ad, so we're going to be printing extra > pages - do you have any copy to fill them?"

Perhaps at a student paper, though that's considered a pretty huge ethical breach. I can attest that the New York Times definitely does not do that; they take this separation very seriously. Even at their headquarters, as of relatively recently, business and editorial enter through separate elevators, as they are on opposite sides of the building.

There definitely are publications without such strong and heavily enforced senses of editorial ethics, but the New York Times is not one of them.

<comment><USER24> That's bollocks - it's not in the slightest an ethical breach to do that. It's just advertising working with production to make the product. We're not talking about running advertorial or anything.

The papers I've worked on usually had a little flexibility in terms of extra copy or advertising to populate pages as required.

<comment><USER23> > it's not in the slightest an ethical breach to do that. It's just > advertising working with production to make the product.

Well, that by definition would be considered an ethical violation at a paper like the Times. Not at a student paper, no, but at the New York Times, definitely.

<comment><USER25> They're not asking for any adjustment to the content, but for extra content, eg a feature piece that isn't tied to a particular date. Bear in mind that a full-page ad only covers one side of the paper so you need something for the reverse side, and newspapers are generally printed on folding sheets (ie 4 pages to a sheet), so that means 3 extra pages to be filled. It's not like the advertising department content is suggesting which content to use. Every newspaper has a variable pile of feature material whose exact publication date depends on the size of the print run, which is highly variable.

I'm curious about what you think the ethical breach here is. Advertising and editorial departments _have_ to coordinate on practical matters like page layout.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> I'd rather pay a few dozen bucks to buy more RAM than running the risk of been infected by malware served from compromised ad servers. Not to mention the significant decrease in aesthetics/usability when pages include a dozen different ad areas.

<comment><USER27> I don't know about aesthetics. I've found that AdBlock actually destroys a lot of the symmetry since the page was designed with ad elements in place.

<comment><USER28> That could actually be a novel technique against ad blocking. Make the website dysfunctional if the ads can't be displayed.

<comment><USER29> Yeah, having an option to pay for the site instead would just be crazy.

<comment><USER30> Having to pay to visit all of the sites out there which are currently using ads would pretty much ruin the internet for most people. Having a big banner at the top asking for donations seems to work rather well, though. See gnu.org and wikipedia.org for examples (though Wikipedia's donation campaign this year is a bit excessive IMO).

<comment><USER31> FYI, you can hide the Wikipedia donation campaign banners by putting this in a userscript that @matches [http://*.wikipedia.org/*](http://*.wikipedia.org/*):

        setTimeout(function() {
            fundraisingBanner.hide();
        }, 1000);

<comment><USER32> This ublock custom rule worked for me:

      ||https://meta.wikimedia.org/wiki/special:bannerloader

</comment></comment></comment></comment></comment></comment></comment><comment><USER33> > _In Nethercote's testing, he found that TechCrunch used around 194MB of RAM > without ABP enabled_

194MB for a single webpage that should mainly be text communicating a message. Does anyone else than me find this crazy?

<comment><USER34> > a single webpage that should mainly be text communicating a message

That was more or less true of the web in, say, 1995.

Today, a web browser is an advanced programming environment with broad multimedia capabilities (including audio, video, and 2D and 3D graphics) that also happens to have some excellent document presentation features relating to text and images.

(Edit: I previously said this much better here: [https://news.ycombinator.com/item?id=7743284](https://news.ycombinator.com/item?id=7743284))

You may think this is a bad thing, and that's a reasonable opinion to have. But if you think it's not true you'll only mislead yourself.

<comment><USER35> > Today, a web browser is an advanced programming environment with broad > multimedia capabilities

It doesn't matter what the tool is to you. When we're visiting something like techcrunch, we're there for the text and then maybe a few pictures.

</comment></comment></comment><comment><USER36> A bit off topic, but could someone explain to me why it's so difficult for a browser (or extension) to effectively block 100% of all pop-ups/pop-unders? I realize that these account for only a fraction of ads, but they are really annoying and it seems that these should be the easiest to detect; doesn't this essentially boil down to a few specific API calls? For the few cases that a pop-up/pop-under is legitimate (really, are there any?), I'd be fine whitelisting these on a case-by-case basis.

<comment><USER37> Effectively you're asking for all document.createElement calls to be blocked. Those are used for all sorts of things that aren't ads or popups. Blocking that would probably cause a very large percent of pages to be completely broken.

<comment><USER36> So there's no explicit way to distinguish between "new window" calls from other types of calls? I'm kind of shocked that, with all the effort that's been put into browsers in recent years, that the ability to "create a new window" hasn't been removed entirely from the API without explicit user consent. Again, I can't think of a single site that uses this feature legitimately.

<comment><USER37> If you're talking about actual new windows that are a separate process, those have been blocked by popup blockers for years. As far as popovers that block the screen/annoy you, those are just HTML elements that are positioned on top of normal content - its not a "special" thing backed into the DOM API. There's really no effective way to stop a page from being able to do that unless you disable javascript entirely.

<comment><USER38> There have been tricks that get popups through, possibly by exploiting browser bugs or opening the popup in one of the few on* handlers where browsers allow them.

</comment></comment></comment></comment></comment><comment><USER39> Sounds like if Mozilla wants to improve Firefox memory usage, they should work on blocking ads natively so people don't need Adblock Plus.

<:D

<comment><USER34> You're going to love Tracking Protection: [http://monica-at- mozilla.blogspot.com.au/2014/11/tracking-pr...](http://monica-at- mozilla.blogspot.com.au/2014/11/tracking-protection-in-firefox.html)

It's an in-development feature to block parts of websites that track you. In practice, it mostly blocks ads, and it blocks most ads. And it doesn't have the performance/memory hit of AdBlock Plus for two reasons:

* The domain matching is simpler (no regexps) and thus much faster.

* It doesn't use CSS to fix up the layout of pages that have had ads removed; it just leaves blank white rectangles. (AdBlock Plus has lots of complex and even site-specific CSS code to do this.)

(I've been told this by one of the Tracking Protection developers, though I may have got the details slightly wrong.)

In testing done by its developers, it speeds up the load time of the median page by 20%! So overall it gives more privacy, less page clutter, and faster browsing. Fantastic stuff.

<comment><USER40> What's funny is when you take the time to ensure than your layout will reflow nicely with ad blockers.. actually having the empty spaces is a bit worse imho.

Wondering about catching on-error events for iframes.. or load errors, etc... that may help in detection, and reflow. I'm more concerned about things continuing to look nice with adblockers than circumventing them.

</comment></comment></comment><comment><USER41> What kind of fucked up site has 10+ iframes per page, let alone hundreds? And the example site he uses takes 530megs to load even without addons. I'm sensing the issue is somewhere other than Adblock Plus.

<comment><USER42> Actually, that's not crazy. Ads, social widgets (the Facebook Like button), third party comment boxes, etc. all render in iframes.

<comment><USER43> No, they _may_ render in iframes; iframes are certainly not a requirement for any of those features, and some (the original commenter included, I suspect) might consider them a heavy-handed approach to the problem.

<comment><USER44> iframes are the only unit of isolation on the web. Unless you want the like button you're hosting to have complete unrestricted access to your application's private data, then yeah, the like button needs to be in an iframe.

<comment><USER43> What's wrong with a simple link? I know _facebook_ doesn't want you going down that route, but there's nothing to stop you.

<comment><USER45> The Facebook like button tells you when you've already liked a page. It can also show you how many likes a page has, which a simple link cannot do.

The like button is just one of many of Facebook's components which can be embedded into pages; another being the comment box which shows your name and display picture but cannot allow the hosting page to get at that information unauthorized.

<comment><USER43> Well there _are_ ways of presenting a personalised link, and a link containing a total number, without resorting to iframes, or even client-side code. I'm not seriously suggesting they be used, merely pointing out that the multiple- iframes functionality is not a default requirement of every page on the web, as the article suggests. Some studies have shown that articles with facebook like buttons receive fewer likes than those without.

FWIW, on a site I work for, we use a plain facebook like link without any personalisation because that's all we require, and we recognise that it respects our visitors' privacy more than the full-on iframe variant.

</comment></comment></comment></comment></comment></comment></comment><comment><USER46> My current favorite solution for blocking the more annoying ads and increasing security while preserving a low-latency browsing experience: Click-to-play for Flash Player (and all the other plug-ins).

There are lots of gray boxes now all over the web, but I prefer them over resource-hungry attention-grabbing Flash ads.

<comment><USER47> It's amazing how well this improves the experience of using the internet with such a small change.

Rarely there are sites that hide their flash elements if they aren't loaded properly, which can make it difficult to click them, but then you just whitelist the website if it's really important.

</comment></comment><comment><USER48> Previous discussion (and a related one):

[https://news.ycombinator.com/item?id=7743064](https://news.ycombinator.com/item?id=7743064)

[https://news.ycombinator.com/item?id=7765758](https://news.ycombinator.com/item?id=7765758)

</comment><comment><USER49> I use a modified hosts file instead which is much better. See [http://someonewhocares.org/hosts/](http://someonewhocares.org/hosts/) Remember the web is pull not push.

<comment><USER50> Hosts files only work when the ads and other trash are not served from the same domain, and of course the bigger operators do everything they can to make you lose some critical functionality if you block their ad serving IPs.

So you'll need to go to the URL level at a minimum if you don't want to use some important functionality.

<comment><USER51> Actually this very rarely happens.

I a DNS server on my router which has zone that routes all ad hosting & other wanted stuff to an IP which is then rejected by the firewall.

I also have a transparent proxy rewriting all web pages removing IFRAMEs - this does ocassionally break things, but it's extremely rare to find a site that actually has a use for them other than serving ads.

<comment><USER52> Both the DNS and the transparent proxy sound like an interesting way to improve the web at home (I'm thinking specifically of an iPhone on my WiFi) -- do you have more information about how you did these things?

<comment><USER51> I use a chrooted instance of Bind as it's a LAN only dns server, /etc/bind/named.conf includes:

        include "/etc/bind/adblock.conf";

That file is generated by a script that uses a hosts file maintained on [http://someonewhocares.org/hosts/](http://someonewhocares.org/hosts/) the script is something like:

        #!/bin/bash
        cat /etc/bind/adblock.conf | xz -z - > /etc/bind/adblock.conf-$(date "+%Y%m%d-%H%M%S").xz
        echo "" > /etc/bind/adblock.conf
        curl -o - http://someonewhocares.org/hosts/ | sed -rn 's:^127\.0\.0\.1 ([^ #\t]+).*$:\1:p' > /tmp/addrs.txt
        cat /tmp/addrs.txt | while read line; do
          ! egrep -i $line /etc/bind/whitelist.txt >/dev/null \
            && echo 'zone "'${line}'" IN { type master;notify no; file "/etc/bind/pri/adblock.zone";};' >> /etc/bind/adblock.conf
        done

which can be called from cron or similar (if you do you need to reload/SIGHUP bind to reload its condiguration) you can whitelist stuff by adding a FQDN to /etc/bind/whitelist.txt

The file /etc/bind/pri/adblock.zone contains something like:

        @  1        IN      SOA  localhost.   root.localhost. (1000 7200 120 1209600 3600)
        @  259200   IN      NS   localhost.
        *  259200   IN      A    X.X.X.X
        @  2        IN      A    X.X.X.X

where X.X.X.X is an IP on different (but private and not internet routable) subnet, and iptables rules something like:

        iptables -N DNSBLACKHOLE
        iptables -A DNSBLACKHOLE -j LOG --log-prefix "DNSBLACKHOLE ::"
        iptables -A DNSBLACKHOLE -j REJECT
        iptables -A OUTPUT -p all -d X.X.X.X -j DNSBLACKHOLE
        iptables -A FORWARD -p all -d X.X.X.X -j DNSBLACKHOLE

Transparent proxying is accomplished by iptables rules redirecting port 80 and 443 through SQUID which essentially performs a MITM, you can find out how to do this here:

[http://blog.davidvassallo.me/2011/03/22/squid-transparent- ss...](http://blog.davidvassallo.me/2011/03/22/squid-transparent-ssl- interception/)

Edit: it's also worth mentioning I transparently redirect all DNS traffic the router sees to my own bind instance, so untrusted devices are unable to use an alternative dns server.

<comment><USER52> Thank you very very much for taking the time to write this up!

</comment></comment></comment></comment></comment></comment><comment><USER53> Isn't using 200MB for a webpage(techcrunch) actually bad in the first place ?

Do all designers work on their iExpensiveMachine and don't care about other peoples lower-end machines/phones/tables/whatever?

<comment><USER20> this is mainly due to having many images on your website (memory can store uncompressed images to save CPU cycles when rendering)

Also, last I checked, most phones have 1 to 2 gigs of RAM, and they're not keeping many tabs in memory. If the RAM is there, using it is not really an issue (until you start getting into the whole virtual memory stuff I guess)

<comment><USER54> > this is mainly due to having many images on your website (memory can store > uncompressed images to save CPU cycles when rendering)

If your webpage has that many images, you need to redesign your webpage. An uncompressed image at my screen resolution is 21MB - your webpage needs ten times that in memory? For maybe 500 words of prose and some meme/cat picture?

Modern web design is just so bad that they can't help themselves from this madness. A modern webpage needs 10+ iframes? Absolutely bullshit.

<comment><USER40> Well, considering I work at a car classifieds site, and there are usually about 20 photos that may be on any given page, and in the new search boxes will be even bigger, and with retina screens wanting 2x images, I'd say yes.. there are sites that really need that much space for images.

Not that all or most do.. but there are a lot of really nice sites that use a lot of large images for full content display. Other techniques can be used to reserve space and load when a section comes into view, but that's not always prudent.

Images are crucial, and optimizing your rendering is also becoming more crucial.. just the same, not everything on the web is text.. and I'd say people spend more time on the web looking at pictures than text, not to mention video.

<comment><USER54> Well considering you're an outlier, I probably shouldn't waste my time replying, but because you felt the need, I will reciprocate.

The average web page is what we're talking about here. Even your page which is demonstrably unaverage should not be hundreds and hundreds of megabytes of raw images.

Images are crucial, but running a car classified site, you should know how to properly demand load images and not just have the page load every image unscaled as soon as you hit the page. Thumbnailing was properly figured out in the 1990s, we've only added fanciness to it over the intervening decades. And even at "retina" sizes, thumbnails are a pittance in the memory budget for a webpage - if you went nuts and had 640x480 "retina thumbnails" for 20 cars, that's still only 24.6MB uncompressed. Feel free to rerun the math with your own numbers on your own time.

Since it needs repeating, we're talking about the _average_ webpage coming in at 200MB. Give yourself some logos and a few other UI images and you're still talking nowhere near 50MB of decompressed images on the page. Yet, that's only a quarter of the page's size in memory. Somehow the DOM, Javascript engine, iframes and UI element layout are costing the other 150MB. And that's where I call _bullshit._ That's how nasty and tangled and batshit insane modern web design has become.

And we're not discussing video here at all, since video is probably one of most insane things about the modern web: either you're forced to use Flash which is basically like running an entire second browser rendering engine inside of your browser, just to download, decode, and play some video, or you're lucky and can use HTML5 at which point the overhead beyond audio/video decompression buffers (which people will be doing in Javascript soon enough, yay!), the setup for the OS's multimedia engine, and a small bit of DOM is inconsequential in comparison to the video stream itself. This makes the amount of space video takes on the client at best unpredictable and at worst, terrible to think about.

</comment></comment></comment></comment></comment><comment><USER55> There's a couple inaccurate things in that article that stood out at me. It should be pretty easy to measure the CPU hit when running ABP. It looks like the author is running windows so he should be able to use perfmon. He also mentions that "As with all proxy servers, though, the one caveat is that it doesn't work with HTTPS connections" which is very much wrong.

<comment><USER43> Also, the article's claim that most pages on the web make use of several iframes is laughable conjecture. Using their own site's poorly put-together home page as an example does not prove their point. And claiming that all free content on the web only exists because of advertising is disingenuous, to say the least.

<comment><USER40> True enough.. most iframes these days are ads.. which ABP blocks.. and the majority of the rest seem to be social widgets which are nearly as bad... I hate them all myself.. though I get why they may be wanted.

</comment></comment></comment><comment><USER50> He's definitely on to something here, FF with a hundred or so tabs open:

With ABP:

       12961 XXXXXX    20   0 2615960 1.483g  58692 S  45.2  9.5   2:13.00 firefox

Without:

       13098 XXXXXX     20   0 2157212 1.109g  57476 R 142.6  7.1   1:26.25 firefox

Both after a complete stop and start of the browser, restoring every tab by activating it.

<comment><USER56> This provides an engineering anecdote that adblocking is worth more than half a gig to a large fraction of the population. Looking at prices on tigerdirect you're dropping about $10 per gig (I'm sure apple charges $200 per gig for laptops, but they're price insensitive so don't matter). Anyway that provides a data point that ad blocking is worth at least $5 to the average user.

Also from a scaling perspective I wonder if its linear with tabs. There are various tribes of tab users and if its linear, a "normal user" who uses about 3 or so would scale down to approximately nil.

<comment><USER57> "This provides an engineering anecdote that adblocking is worth more than half a gig to a large fraction of the population"

That's a reasonable conclusion only if people are aware that they're making the trade, which I suspect most users are not (otherwise this article would be rather boring)

<comment><USER58> I would suspect that most people don't come close to using all the ram in their computer in normal use. Whether they use adblock or not will not have any noticeable affect on the computer performance apart from the blocking of ads.

<comment><USER57> Not sure I agree with this. I tend to use way too many tabs, and therefore use up my memory. I was visiting my parents recently, and on their Mac they were leaving a lot of programs running (having closed the window but not exiting the program).

I think low-memory situations are the most likely explanation for slowdowns experienced by typical home or office users.

</comment></comment></comment></comment></comment><comment><USER59> I uninstalled right after hearing from Mozilla [1] about the effects of AdBlock Plus on Firefox. Since, then I'm blocking things manually.

First I was using this [2] hosts file by Dan Pallock. But now I've switched to this Neocities [3] hosted site. I don't know who manages this site, but the entries are uniquely sorted from various sources, which includes entries from Dan Pallock's hosts file.

Apart from this, I use Privacy Badger [4], Self-Destructing Cookies [5], HTTPS-Everywhere [6] and Disconnect [7].

[1] [https://blog.mozilla.org/nnethercote/2014/05/14/adblock- plus...](https://blog.mozilla.org/nnethercote/2014/05/14/adblock-pluss-effect- on-firefoxs-memory-usage/)

[2] [http://someonewhocares.org/hosts/](http://someonewhocares.org/hosts/)

[3] [https://hosts.neocities.org/](https://hosts.neocities.org/)

[4] [https://www.eff.org/privacybadger](https://www.eff.org/privacybadger)

[5] [https://addons.mozilla.org/en-US/firefox/addon/self- destruct...](https://addons.mozilla.org/en-US/firefox/addon/self-destructing- cookies/)

[6] [https://www.eff.org/https-everywhere](https://www.eff.org/https- everywhere)

[7] [https://disconnect.me/](https://disconnect.me/)

<comment><USER60> There's also a Policeman [1] that works using fast and powerful domain-and- request-type matching. No thousands of injected CSS rules or anything like this, that persist and consume memory. Think of hosts file on steroids, that's able to differentiate between image, script and flash requests.

[1] [https://addons.mozilla.org/en- US/firefox/addon/policeman/](https://addons.mozilla.org/en- US/firefox/addon/policeman/)

</comment></comment><comment><USER61> Didn't ABP+ developers plan to address this? How is that effort going?

UPDATE: Here is the bug to track: [https://bugzilla.mozilla.org/show_bug.cgi?id=988266](https://bugzilla.mozilla.org/show_bug.cgi?id=988266)

</comment><comment><USER62> I've been using [http://someonewhocares.org/hosts/](http://someonewhocares.org/hosts/) for almost a year now and it works very well. No need for adblock.

</comment><comment><USER63> I wish the internet was usable without it.

<comment><USER64> This. The ongoing arms race between advertisers and adblockers damage content delivery, which is why I'm hoping for a solution which can replace ads in the near future. Maybe Google Contributor is onto something.

I would recommend trying the Reader view in Safari (I'm sure there's similar functionality in other browsers) to read articles without clutter. Works like a charm.

<comment><USER65> Reader is especially killer in mobile. A huge percentage of sites are incredible horrible on mobile-- and it isn't even the ads as much as all of the sharing, pull quotes and modals. Why the heck do people have modals for mobile? The insanity of it.

</comment></comment></comment><comment><USER66> I don't even use an adblocker. I simply use ghostery to block trackers and almost no ads being there anymore is a nice side-effect.

<comment><USER67> Ghostery is proprietary software, and it's reporting your usage back to trackers if you enable Ghostrank. You would be better protected running Privacy Badger by the EFF. It's Free Software, and it doesn't track you.

[https://www.eff.org/privacybadger](https://www.eff.org/privacybadger)

<comment><USER68> > Although we like Disconnect, Adblock Plus, Ghostery and similar products (in > fact Privacy Badger is based on the ABP code!)

Privacy Badger most likely has the same issue that this article is talking about.

<comment><USER48> The problem is not Adblock Plus engine, it's ABP injecting 4 MB CSS to every single page, while Privacy Badger doesn't, so it is not a problem.

<comment><USER67> Indeed. After tracking my tasks in Chromium, I have found that Privacy Badger regularly and consistently sits at about 1/2 the RAM usage of uBlock.

</comment></comment></comment></comment></comment><comment><USER69> Maybe I should write one.

I wrote AdLimiter, (adlimiter.com) which eliminates certain ads from Google search result pages. It's really a demo for our site rating service, SiteTruth,but it has the internal machinery to find and remove ads. The basic idea is that it finds links to sites in the DOM, and works outward in the DOM to find the ad boundary. Then, if analysis of the link indicates the ad should be deleted, the offending section is deleted from the DOM. It takes one linear pass through the DOM to find ads. If the page changes, five seconds after the changes quiet down, another pass is made. This approach is reasonably general and requires little maintenance.

I once looked at AdBlock's code. Internally, AdBlock makes heavy use of regular expressions and does a lot of searching. It seems to be doing more work per page than should be necessary.

In some ways, Ghostery is more useful than AdBlock. It blocks most trackers, which reduces network I/O. Some ads disappear once their tracker is disabled. (CBS TV shows play without commercials if Ghostery is running.)

I've been toying with the idea of an ad blocker that uses simple machine learning. All content coming from off-site links gets a light grey overlay. If you click on the grey overlay, it disappears so you can view the content, and the off-site link is rated as less spammy. If you ignore the overlay, the off- site link is viewed as more spammy. The grey overlays gradually get more opaque over areas where you never remove them, and when they go fully opaque, the covered content is deleted completely.

<comment><USER70> Loading all content and placing overlays are precisely the reasons Addblock plus hogs so much RAM, as opposed to simply not loading the content.

<comment><USER71> There are two kind of filters: cosmetic ("element hiding") and network filters.

Network filters = to prevent the fetching of remote resources.

Cosmetic filters = to prevent portion of the DOM to be visible.

Adblock won't load any content when filtered through network filters, the requests to the remote server won't even be made.

The problem the article refers to is related to how cosmetic filters are implemented in Adblock. And that problem has nothing to do with "placing overlays", whatever that means.

</comment></comment></comment><comment><USER72> For Firefox, there's Bluhell Firewall

[https://addons.mozilla.org/en-us/firefox/addon/bluhell- firew...](https://addons.mozilla.org/en-us/firefox/addon/bluhell-firewall/)

</comment><comment><USER73> From the article:

>"* The main problem, though, is the process by which ABP actually blocks ads. Basically, ABP inserts a massive CSS stylesheet — occupying around 4MB of RAM — into every single webpage that you visit, stripping out the ads.*"

Isn't then the actual problem the way that Adblock+ removes the ads? Why not simply allow an API for a plugin to easily strip content from a site. If there is one already, then ABP should switch to it to reduce memory usage. If not, well then we should look at the actual culprits of this problem which is the browsers.

<comment><USER74> In chrome at least it's not in Google's interest to block their customers ads, or make it any easier to do so.

</comment></comment><comment><USER75> I use my Raspberry Pi as ad blocking proxy and I don't have to worry about performance usage on my machine at all! Some routers allow have this option built in and also you can block IPs of common ad publishers.

[0] - [https://learn.adafruit.com/raspberry-pi-as-an-ad-blocking- ac...](https://learn.adafruit.com/raspberry-pi-as-an-ad-blocking-access- point?view=all#)

</comment><comment><USER76> The Proxomitron (local filtering proxy) + HOSTS file + Javascript whitelisting is all I need.

Turning off JS instantly removes a ton of annoyances, effectively removes a _huge_ attack area for browser exploits (I've accidentally infected others by sending them links to sites that had no effect on me...), and while there are certainly sites that require it (often not even of the "application" type, but just to do something that could've been done without), the majority of the ones I come across in e.g. searching for info don't need it. If a site I find when searching refuses to show anything, then I'll just go back and continue with the next search result or use Google's text-only cache which often _does_ have the content I'm looking for in a more readable format. The whitelist is reserved for sites that are both _highly_ trusted and absolutely necessary to enable JS on.

</comment><comment><USER77> I have switched to HTTP Switchboard, works pretty well. [https://chrome.google.com/webstore/detail/http- switchboard/m...](https://chrome.google.com/webstore/detail/http- switchboard/mghdpehejfekicfjcdbfofhcmnjhgaag?hl=en)

<comment><USER5> You should migrate to umatrix ([https://chrome.google.com/webstore/detail/%C2%B5matrix/ogfcm...](https://chrome.google.com/webstore/detail/%C2%B5matrix/ogfcmafjalglgifnmanfmnieipoejdcf)), http switchboard is not maintained anymore

<comment><USER78> uMatrix is new and improved, and I use it sometimes, but it is still rough around the edges. Some websites don't work and there's no work-around.

Edit: To clarify, the above is in comparison to HTTPSB.

<comment><USER71> From the doc: "µMatrix does not guarantee that sites will work fine: it is for advanced users who can figure how to un-break sites, because essentially µMatrix is a firewall which works in block-all/allow-exceptionally mode out of the box: it is not unexpected that sites will break"

Workaround is to un-block whatever net requests which are causing a site to break. I can't make sense of "no work-around": unblock everything?

Edit: There is a scope-based switch to completely turn off matrix filtering.

<comment><USER78> Hi, I am well aware of the matrix and a fan (have been a HTTPSB user and now test uMatrix sometimes). I am also a contributor to [https://gngr.info](https://gngr.info) which has a Request Manager inspired by the matrix.

I was referring to a few issues I encounter in uMatrix which are not present in HTTPSB. I probably should log them; was not sure if uMatrix is ready for full-time use yet.

</comment></comment></comment></comment></comment><comment><USER79> It's unfortunate and maybe it can be engineered in a better way but still I'm happy to trade CPU and RAM for uncluttered web pages. Whenever I watch somebody navigate without AdBlock, I always wonder how they could get used to make sense of all that mixed mess of ads and content.

Furthermore if sites are paid per click my pre AdBlock contribute to all the ads sustained web sites was probably way less than $1. They are losing little by my use of AdBlock. One reason I didn't click ads was precisely that they are so intrusive and ugly. Thanks to AdBlock I'm spared with that and they don't lose bandwidth and CPU to serve ads that won't be clicked. Win-win.

</comment><comment><USER80> Increases the SNR of the internet so high, it's actually worth it. I'd rather spend more on memory and have a less annoying internet :).

Consider the technical solution alternatives, and getting people to use them. Now look at how easy it is to install ABP.

</comment><comment><USER81> Why does the topic say Firefox when µBlock isn't even for Firefox? Chrome is the problem, not Firefox.

All browsers became huge memory hogs lately, but I'd rather have 100MB+ of RAM just for Adblock than blinded by ads (of which a lot are malicious).

</comment><comment><USER82> Behold the power of the Time Machine - the text straight from the 90th-00th. Everyone was like "Oh, this new Windoze uses 500 megs when idle! Then 1000 megs! Then 2000 megs! etc. etc.". Come on people, we are buying our hardware precisely for this - to be used.

Now this ET site with 28 spyware modules from random advertisers is telling me - "Don't use your CPU it will make it slower, also don't use too much RAM. Instead make your brain slower and use more brain memory for useless stuff. Because you know - think about children, and because we are entitled for our business model by birth right.".

<comment><USER71> > we are buying our hardware precisely for this - to be used

I have a counterargument page dedicated to apologists of inefficient software: [https://github.com/gorhill/uBlock/wiki/Who-cares-about- effic...](https://github.com/gorhill/uBlock/wiki/Who-cares-about- efficiency,-I-have-8-GB-and%7Cor-a-quad-core-CPU)

<comment><USER82> Good argument but I still don't agree with it completely. First of all lets separate devices into three categories - desktops, laptops and touchscreen.

For desktops CPU and RAM are largely irrelevant in such amount (temporary up to 25-50% CPU usage increase for one core, and up to 500-1000Mb of memory usage increase in worst case - for instance my FF never exceeds 1Gb overall with ABP and other stuff). I sometimes "fix" old PCs for relatives and even in worst cases ABP usage isn't a noticeable hit on performance.

For laptops resources are more relevant as well as battery life. I'll even agree with your point for this category, but still for now ABP hit is not that big as compared to ad noise.

For touchscreens resources are very important BUT! This is a very big "BUT". But the websites are almost unusable without adblock. I use iphone and ipad where there are no adblockers afaik. When I browse the web it is horrible (with a big H - Horrible) - everything is jumping, jiggling and wobbling for a long time during page load. One moment there is a text in some point and I try to scroll - and instantly there appears stupid facebook crap which I of course click. Same with multiple frames, banners, popups (I hope these devs will burn in hell). And additionally there weird motion gestures in-built into page, transparent overlays which are part of a nearest ad. The list goes on...

Basically on touchscreens web browsing experience is so horrible that I'm willing to trade adblocker for x2 increase in battery consumption (note that web browsing is not the only thing to do on a phone or tablet, so this is not a total x2 lifetime decrease).

</comment></comment></comment><comment><USER83> Use AdBlock. Not AdBlock Plus.

Remember: ABP = Shit. AB = Good.

<comment><USER84> Or use Adblock Edge [https://addons.mozilla.org/en-us/firefox/addon/adblock- edge/](https://addons.mozilla.org/en-us/firefox/addon/adblock-edge/) which is a Adblock Plus fork minus the "acceptable ads" feature.

<comment><USER48> ...which is based on outdated code base.

</comment></comment></comment><comment><USER85> I realized that Adblock plus was a performance hog a long time ago and it is good to see that information being shared widely. The issue especially impacts those who have many many tabs open all at once.

Interestingly, there is a uBlock alternative which I had not heard about[1]. If the more efficient claims are true, it would definitely be worthwhile to switch over to that instead.

[1] [https://github.com/gorhill/uBlock/wiki/%C2%B5Block- vs.-ABP:-...](https://github.com/gorhill/uBlock/wiki/%C2%B5Block- vs.-ABP:-efficiency-compared)

</comment><comment><USER15> > click-to-play add-ons like Flashblock

You don't need an add-on for that. Firefox and Chrome both have this as an optional built-in feature. I think it should be on by default (which it sadly isn't).

</comment><comment><USER86> Here's what I do for Firefox and AdBlock Plus:

Under "Filter Preferences", uncheck everything marked EasyList. Under "Custom Filters" add _EasyList without element hiding rules_ and make sure it's checked. Restart. This speeds things up considerably.

On Chromium I don't use AdBlock Plus, it's too much of a memory hog. Instead, I use the much leaner and faster µBlock for dynamic filtering:

[https://github.com/gorhill/uBlock/](https://github.com/gorhill/uBlock/)

</comment><comment><USER87> I have been running Firefox without any blocker for a long time. Didn't mind the ADS, and I thought it an easy way to fund various things.

No worries, until those video and audio ads got out of control.

Some pages would bury my machine! And it's a good machine too. 2012 Mac Book Pro.

The memory profile of Firefox itself is kind of a pig, but not something I would worry too much about. Firefox with those ads? Out of control. Firefox with simple Adblock is back to no worries again.

I'll have to give uBlock a try.

</comment><comment><USER88> what about forking chromium and integrating adblock directly in the browser? +removing all the google nonsense (like disabled cross domain security for some google domains)

<comment><USER89> Check out Iron

[http://www.srware.net/en/software_srware_iron.php](http://www.srware.net/en/software_srware_iron.php)

</comment></comment><comment><USER90> Honorable mention, privoxy: [https://news.ycombinator.com/item?id=7743261](https://news.ycombinator.com/item?id=7743261)

</comment><comment><USER91> Related

[http://someonewhocares.org/hosts/](http://someonewhocares.org/hosts/) HN Thread: [https://news.ycombinator.com/item?id=6002544](https://news.ycombinator.com/item?id=6002544)

Make sure localhost / 127.0.0.1 resolves to something though. A blank `index.html` in the root is lightweight enough. For the perfnerds, you can resolve it using lighthttpd

</comment><comment><USER92> My computer is a Windows Vista-era relic with 2 GB of RAM and I rarely have any trouble browsing unless I've got loads of tabs open (which would undoubtedly gobble all of my memory regardless).

I'm using RequestPolicyContinued. Using a whitelist for third-party requests seems to do a lot of the heavy lifting so that my Adblock Plus filters are limited to a handful of specific things I don't want to see.

</comment><comment><USER93> I'm using Ghostery as a privacy and ad-blocking extension. Does anyone have data on the impact Ghostery might have on the browser memory usage?

<comment><USER71> Ghostery/Disconnect are leaner memory-wise than uBlock [1]. That is for their own memory footprint. I do not know how much they contribute memory overhead to web pages though, but I suspect not much. I have never benchmarked Ghostery/Disconnect CPU-wise.

[1] [https://github.com/gorhill/uBlock/wiki/Own-memory- usage:-ben...](https://github.com/gorhill/uBlock/wiki/Own-memory- usage:-benchmarks-over-time#18-september-2014)

<comment><USER94> I've dropped ghostery about 3 years ago because, even though it was low on memory, it was extremely CPU hungry, making my (then a little old, but by no mean underpowered) laptop take 3-4 seconds of 100% CPU for almost every page.

I haven't tried it again since.

</comment></comment></comment><comment><USER95> I can completely agree with this. I have a shitty machine with 2GB RAM and it's more often than not that it freezes almost completely when I compile bigg(ish) projects because it hits swap. I keep my Firefox open all the time (who doesn't?) and since I disabled AdBlock Plus this wasn't an issue anymore, and from 1.2GB Firefox's resident set size has plummeted to 500MB for me.

</comment><comment><USER96> There was a very good discussion [1] about this 8 months ago when I realized the same [2].

I suggest try HTTP Switchboard instead (see the previous thread).

[1]: [https://news.ycombinator.com/item?id=7765758](https://news.ycombinator.com/item?id=7765758)

[2]: [https://news.ycombinator.com/item?id=7765904](https://news.ycombinator.com/item?id=7765904)

<comment><USER71> I am not maintaining HTTPSB anymore. I refactored HTTPSB into uBlock/uMatrix. Many cringing usability issues[1] have been fixed with uMatrix, which is different enough from HTTPSB that I could not publish it as a newer version of HTTPSB.

[1] [https://github.com/gorhill/uMatrix/wiki/Changes-from-HTTP- Sw...](https://github.com/gorhill/uMatrix/wiki/Changes-from-HTTP-Switchboard)

<comment><USER96> Thanks! I did not know about this, I will definitely use them.

</comment></comment></comment><comment><USER97> I do not use and Ad Blocker and Firefox and Chrome always devour my RAM. I can't imagine how worse would be with a Adblocker

</comment><comment><USER98> I don't mind ads most of the time. I have a script that rips out iframes, flash and other junk, and does a few other "cleansing" operations. It works fairly well and it's satisfying to push the "zap" button when a certain page is getting particularly annoying, and see all those rectangles become suddenly blank.

</comment><comment><USER99> Noscript is not an option anymore. Too many sites rely on javascript. I'll take the memory hit every time to use adblock.

<comment><USER100> I would counter and say NoScript is still an option.

I want to control what sites I allow to execute scripts in my browser rather than give global authority to any random site I may happen to land on.

I see no value in allowing scripts from Facebook or Twitter, for example, to run on any of the sites I visit.

<comment><USER101> I would agree with the op that noscript is not an option any more but only because I think the widespread use of javascript makes it mandatory for sane web use.

</comment></comment></comment><comment><USER102> I made a host filtering proxy with node a while ago to solve exactly this problem. [https://github.com/thibauts/node-host-filtering- proxy](https://github.com/thibauts/node-host-filtering-proxy)

Edge cases are not completely ironed out but if people want to help perfect it I'll very happily accept PRs !

</comment><comment><USER103> I use DNS to block ads when control over the HOSTS file is not available to the user.

Works across all applications, e.g. browsers, apps, and requires no installation of third party software e.g. extensions.

I'm curious: do these ad blocking "solutions" operate as businesses? Do ad servers pay to be removed from blacklists? Pardon my ignorance.

</comment><comment><USER104> [http://i.imgur.com/UPW4iFD.jpg](http://i.imgur.com/UPW4iFD.jpg)

Now that's real irony.

</comment><comment><USER105> They are memory hogs with or without particular extensions. I leave Chrome with 10 basic tabs open and in 4 hours, it's already "using" 2GB of RAM. The new Firefox Developer Edition with "process per tab" is similar. The best resource-friendly browser on OS X is Safari.

<comment><USER106> > The best resource-friendly browser on OS X is Safari.

You may find others having an opposite experience:

[http://i.imgur.com/qfwwXhw.png](http://i.imgur.com/qfwwXhw.png) :)

<comment><USER107> I can beat that a skosh. Here is adblock safari (granted this was with adblock on and safari running a while).

[http://imgur.com/J1rP6V0](http://imgur.com/J1rP6V0)

Safari+adblock+ any amount of tabs+history = I want 64g of ram on my laptop stat.

</comment></comment></comment><comment><USER108> I was recently having a ton of memory issues with Chrome without Adblock installed -- turns out a lot of Chrome extensions are memory hogs.

A quick `ps aux` will let you see what extensions are the worst offenders; clearing out a bunch of unused extensions helped restore my computer back to normal.

</comment><comment><USER109> Isn't there a way for adblock+ to insert just the right set of css rules based on the page it is inserted to? It's not like every site displays ads from every possible ad network. I don't know the internals of AB+ so correct me if this is impossible for some reason.

</comment><comment><USER110> Totally worth any memory issues it causes. I jumped on Safari the other day without it and it was awful.

</comment><comment><USER111> You can remove the 'probably'. It is pretty well known that Adblock is a mayor memory hog.

</comment><comment><USER112> Some ad blocking should definitely be built in for performance reason then ...

</comment><comment><USER113> I often send URL to printfriendly, most of the time it's light, readable and ads-free. Works with Firefox keyword tags (added manually) and with Chrom* urlbar (added automatically after a few visits).

</comment><comment><USER114> I just realized that getting something like AdBlock as a transparent default in major browsers is something that could actually kill Google as we know it.

A lot hinges on modern auto-update pipelines.

</comment><comment><USER115> For blocking hosts you can also use [https://opensource.conformal.com/wiki/Adsuck](https://opensource.conformal.com/wiki/Adsuck)

</comment><comment><USER116> I just maintain my own small custom list, all automatic lists are disabled. Ads are OK unless they are animated, IMHO. Flash is totally out of course. In fact I think I am doing these advertisers a favor since I do keep a mental list of who _not_ to buy from, that list includes folks who have animated and flash ads (and those who advertise on Fox News, but that is a different story).

So I usually just block ads that are really obnoxious. Every few months I review the list and remove any entry that was filtered less than 10 times or so.

That has two advantages. First _I_ get to control what is filtered, and second it prevents that list from growing so much.

</comment><comment><USER67> It's nice, but it seems to be a bit overly aggressive. As an example, it's removing the "Share to Twitter" button on my TT-RSS install.

</comment><comment><USER117> I once did some profiling on a heavy single page app and found that the overhead of AdBlock+'s extreme amount of CSS selectors was a major culprit.

</comment><comment><USER118> If we can curate a list of ad domains, then adding them to the hosts file and null-routing the DNS would both remove ads and be super quick

<comment><USER119> Like this? [https://news.ycombinator.com/item?id=8802746](https://news.ycombinator.com/item?id=8802746)

</comment></comment><comment><USER120> if you want to get rid of intrusive ads and tracking, you should use hosts file from someonewhocares.org

because ad block won't work on mobiles, and devices owned more by Google/apple than yourself.

if you want to block malicious scripts and plugins you should use noscript.

both will actually improve memory use and performance, not to mention getting closer to solving the problem in the first place

</comment><comment><USER121> Why would this even matter with the type of machines we have today? I'm sure your 8gigs can handle a little Ad Block.

</comment><comment><USER122> Has anyone seen analysis that covers Adblock in addition to Adblock Plus? Do the same findings still obtain?

</comment><comment><USER123> a mobile readable version: [https://getscroll.com/r/mdqbs](https://getscroll.com/r/mdqbs)

I'm using [https://github.com/gorhill/uBlock](https://github.com/gorhill/uBlock) to replace Adblock plus since last week.

</comment><comment><USER124> being a.. "tech" person, i always get grief from people when i tell them i don't use adblock. "you should know better" or words to that effect.

this would explain why i've never considered chrome to be a memory hog.. (although, all my machines have a _lot_ of memory, too)

</comment><comment><USER125> I seems an overstatement to me. I would say it's misuse of iframes and only then adblock.

</comment><comment><USER126> I use Ghost and Adblock+ with Chromium, and I've never had an issue with memory.

</comment><comment><USER127> I've been using GlimmerBlock for quite sometime without running into issues

</comment><comment><USER128> This is already shown to be the case with FF, ABP uses a lot of memory per tab

</comment><comment><USER129> yeah iframes on every modern webpage... a problem is the adblock injection and it cost of curse. but please don't blame iframes for this...no one use iframes anymore accept for ads

<comment><USER130> Er, Google? Payment providers who need a secure frame?

</comment></comment><comment><USER131> This doesn't explain how Chrome, on a PC which is just serving a simple billboard page with some dynamic Jquery to update it, ends up using 4gb of RAM after a few hours despite no Javascript memory leaks.

</comment><comment><USER132> I find its a hog and I don't run those.

</comment><comment><USER133> handy trick: install "incognito this tab" [https://chrome.google.com/webstore/detail/incognito-this- tab...](https://chrome.google.com/webstore/detail/incognito-this- tab/nhockicmnnjibbhgcpphjicilgcfehdi?hl=en) if adblocker is interfering with page, right mouse click and bring up tab in incognito mode (which doesn't load extensions unless specified).

<comment><USER134> Or you just whitelist the site through the adblock menu and enable adblock for incognito as well. Most sites I tend to visit through incognito are somewhat ad-heavy, and I'd rather still block them there.

</comment></comment><comment><USER135> tl;dr "Please do not use ad blockers" – Ad industry

</comment><comment><USER136> I see nobody has posted it, so here is a very lightweight alternative - <USER2> redirects all known ad-hosting sites to 127.0.0.1

[http://someonewhocares.org/hosts](http://someonewhocares.org/hosts)

<comment><USER137> Isn't it better to use something invalid (like 0.0.0.0) instead of 127.0.0.1? If you have a development server on your machine, rerouting ads to 127.0.0.1 means lots of useless requests...

<comment><USER138> The author briefly discusses this and has made a 0.0.0.0 version available here: [http://someonewhocares.org/hosts/zero/](http://someonewhocares.org/hosts/zero/)

</comment></comment></comment><comment><USER139> It's a chicken egg problem.

1) _Website owners_ use ads to earn money (server and employee costs, revenue).

2) Several _Ad networks_ create ads that influence and annoy users and track their browser habits. e.g. blinking buggy video ads with sound that sometimes even crash the flash plugin

3) _Visitors_ install Adblock+ because they dislike intrusive ads that don't adhere to the browser privacy settings. Some websites are unusable without an ad-blocker. Many websites even crash the mobile browser.

4) _Companies buy ads_ cheaper as ads are clicked in reality by clicking-bots and are worth less than years ago.

4) _Website owner_ places more ads because the earn less for the same amount of served ads as last year and because more and more block all ads altogether.

5) Even more _visitors_ install adblockers and turn them on for all websites.

6) _Website owners_ introduce a paywall so that parts of their content or everything is behind closed doors for paying customers only.

7) The _visitors_ switch to alternative website that offer comparable content for free, monetized by ads or maintained as hobby.

8) and so on...

 _Paywalls_ are not the solution. Another website will appear that offers comparable content for free. Example: _The Microsoft Network_ (MSN 1) that was meant to replace the WWW in 1995 and shipped with Win95. Bill Gates had to rewrite his vision of the information highway, micro payments and Microsoft Network in his famous book "The Road Ahead", half a year later as MSN failed and WWW succeeded he released a second book edition that removed all references and now acknowledges the WWW. Pictures of MSN 1: [http://winsupersite.com/windows-live/msn-inside- story](http://winsupersite.com/windows-live/msn-inside-story)

Everyone has to change a bit, to improve the current status:

* The _ad-networks_ that still code flash-based ads should move to HTML5.

* The _companies that buy ad-space_ from such ad-networks should care more about the ad-quality.

* The _website owners_ should care more about which ad-network they select.

* The _visitors_ should use less adblock-plugins.

* The _WHATWG /W3C/browser developer_ should improve some situations with HTML 5.x so that there is no single reason for flash based ads.

<comment><USER140> More of a vicious cycle.

The ad networks bare most of the blame because they face a moral hazard. They can either deny annoying ads and lose revenue, or accept them and push the risk of adverse events to the publisher. The publisher will respond as you describe above. Ultimately the publisher fizzles out and their ad network drops them for non-performance.

Most ad networks appear to be willing to accept trashy ads in lieu of instituting quality controls.

This is my experience in working at a publishing network that did not have its own ad server.

</comment></comment><comment><USER141> I prefer the hosts file way of redirecting ad/tracking domains to localhost. There are some nice hosts lists already compiled, which you can download to make your own. The resources problem simply went away when I started doing it this way.

</comment><comment><USER142> To be clear, Adblock Plus is a memory hog that causes issues for Firefox and Chrome users. The added memory is not a problem of either browser and they do not cause that themselves.

</comment><comment><USER143> So, with all the people here doing Adblock. Should I feel bad when startups go bust because of the lack of advertising dollars?

<comment><USER144> No because web advertizements are not cost effective for selling products and while being a poor source of money.

Noted in [http://www.drdobbs.com/architecture-and-design/farewell- dr-d...](http://www.drdobbs.com/architecture-and-design/farewell-dr- dobbs/240169421)

>> They've come to realize that website ads tend to be less effective than they once were. Given that I've never bought a single item by clicking on an ad on a website, this conclusion seems correct in the small

<comment><USER145> Web advertisements work great for advertisers familiar with buying advertising space in magazines where the goal isn't about generating an immediate purchase.

On my website, office furniture manufacturers use the advertising space to display their new products to our readers - the majority of whom design office environments for a living and purchase 0% of the products they use in their projects on the internet.

</comment></comment></comment><comment> tek-cyb-org 32gb says not.

</comment><comment><USER146> > On a modern website, there can be dozens of iframes.

Let me fix that for you:

> On a shit website, there can be dozens of iframes.

</comment><comment><USER147> > Here's a lovely bit of irony for you: Adblock Plus... is actually increasing > the amount of memory used by your web browser, rather than decreasing it

It's like ten thousand spoons when all you need is a knife.

</comment><comment><USER70> Firefox gets slower with every update - and it's certainly not Addblock plus that's at fault (although yes, addblock plus has a very inefficient implementation.)

If you use Chromium I recommend HTTPSwitchboard.

<comment><USER148> "Firefox gets slower with every update", I don't believe this is still the case. There have been significant performance improvements in recent versions of Firefox. If you haven't tried Firefox in a while, I'd recommend giving it another shot. By what I've seen lately, Firefox might be edging Chrome out in performance.

<comment><USER70> I still use Firefox for anything where I need to be logged in since I'm rather uncomfortable about using Google services combined with a Google browser - <USER3> it's definitely a significant performance downgrade.

<comment><USER149> Don't agree. My perception is that Firefox is faster now than it was two years ago, and today it's generally as fast as or faster than Chrome.

BTW, I'm another that won't log into Google services with a Google-owned browser: I usually use IE11 for that. But I use Firefox for Microsoft services ...

</comment></comment></comment></comment><comment><USER150> This in your JS should hide site content from adblock users (adsense only):

      window.hasOwnProperty('google_ad_block') || (document.body.innerHTML = 'Please disable adblock to use this page')</comment>


A "GET" request can land you in Jail - <AUTHOR>

After reading through the judgment of Andrew Auernheimer case, I feel really taken aback and scared! How could calling 'public' GET API be unauthorized action? How could the judgment be passed so fast and carelessly?
And why aren't the AT&T 'subscribers' suing them for keeping their private information insecure?<p>Frankly, now as a developer every time I make a "GET" request, I have this fear of getting jailed! <comment><USER2> It's a bit absurd. A chilling effect, even; now, instead of responsible disclosure (which weev seemed to think meant scraping 100K examples of the data and giving it to a Gawker reporter), we'll be left with irresponsible disclosure (anonymously reporting it or selling it on the black market).

That said, I don't think AT&T would necessarily have reacted well to an attempt at real responsible disclosure.

For an example of the ideal scenario for how this should be handled, there's the Steam data leak that Ars Technica found: <http://www.gibsonindex.org/blog/2013/02/06/steam-leak/> \- I rated it as a Level Zero event on my cyber attack ranking blog, because of the proper resolution.

I agree that the blame in this case lies mostly with AT&T. It's their responsibility to protect the data. They build the program so that if anyone asked it for anyone else's info, it went "OK, sounds good, here you go."

Weev was the one who asked. AT&T should be on the hook for answering.

<comment><AUTHOR> But from a pure legal standpoint, any API developer can face jail term if they suddenly change their terms/conditions.

<comment><USER3> I'm not a lawyer, but violating terms, conditions, or other contacts in non malicious ways generally aren't going to be criminal offenses. They are civil offenses for which the main recourse is only for the company to sue.

</comment></comment></comment><comment><USER4> It's concerning. But I honestly think this had everything to do with his image and little with his actions. He's well known for trolling with offensive messages and being affiliated with grey hat hacking. Neither of these are necessarily wrong/illegal/immoral, and I'm not saying this is karma at all, but he's the type of person the FBI wants to see in jail one way or another.

But yeah I've spent many years in web scraping and this type of reaction is always in the back of my mind. If you're really that worried, keep good company.

Anyhow, we should do what we can to inform non-technical people about these issues so they're not so mysterious and scary. How do you think gay rights are so mainstream? Years of people being vocal about what's right.</comment>


The ACLU Retreats from Free Expression - <AUTHOR> https://www.wsj.com/articles/the-aclu-retreats-from-free-expression-1529533065 <comment><USER2> I, personally hate white nationalists, as they devalue everything good and decent. I also fully support the first amendment. I want to see them shut up but I'll be damned if a law is passed that forces it. Bias needs to be stamped out because we feel it's wrong, not because we're told to do so. External motivation is far less compelling than internal. Laws are external

<comment><USER3> This particular item has nothing to do with laws about free speech. The ACLU provides legal support to fight government silencing of free speech. But there are always more cases than it can fight. The ACLU has, in the past, supported lots of truly hateful speech on principle. However, as others have pointed out, there's a presumption of good faith. ie, that the hateful speakers really are being silenced, and need legal help. These days, the "pro-free-speech" crowd that gets publicized in the WSJ opinion page and Fox News are completely bad faith actors, seeking to incite hatred and violence, making irresponsible claims, backed by tons of money, and then crying "free speech" when their bad faith is pointed out. The ACLU is, reasonably, calling that crap out as not worth providing legal support to, since those actors are not sincere, they are just troublemakers, sowing discord because it works to their advantage. The ACLU ultimately must stand up for its core principles, and not be sucked into minute parsing of legalistic technicalities, because the bad guys are playing that game to destroy the ACLU and what it stands for, not because they believe in "free speech".

</comment></comment><comment><USER4> I'd say white nationalists and the like have more than enough representation these days. They don't need the ACLU wasting limited resources when they've already got the support of the Whitehouse.

<comment><USER5> Slippery slopes are real.

[https://en.wikipedia.org/wiki/First_they_came_..](https://en.wikipedia.org/wiki/First_they_came_..).

<comment><USER6> [https://en.m.wikipedia.org/wiki/Paradox_of_tolerance](https://en.m.wikipedia.org/wiki/Paradox_of_tolerance)

<comment><USER5> I had already read it and didn't see anything compelling. Basically it says its hard to maintain a tolerant cohesive society with intolerant nincompoops running around.

We have intolerant groups on both sides of many issues. Are we going to censor all of them?

<comment><USER7>
        > We have intolerant groups on both sides of many issues. Are we going to censor all of them?

Who did you have in mind?

<comment><USER5> Abortion, Gun Rights and Religious Freedom are low hanging fruit. To my mind, as a nation we are becoming less tolerant rather than more tolerant across the board. One of the reasons I have largely disconnected from Social Media.

</comment></comment></comment></comment></comment></comment><comment><USER6> There's a lot of research out there that the reality is more subtle than just "free speech is free speech".

[https://en.m.wikipedia.org/wiki/Paradox_of_tolerance](https://en.m.wikipedia.org/wiki/Paradox_of_tolerance)

</comment><comment><USER8> That's disturbing.

Step one on the SPLC trail.

</comment><comment><USER9> Anyone got a source that isn't behind a paywall? I can't find any of those quotes from the blurb on the web, not even from the ACLU themselves.

<comment><USER10> [https://outline.com/MtGgKs](https://outline.com/MtGgKs)

<comment><USER9> Thanks. I don't see anything in there that says they're "retreating from free expression" as the title here claims. Instead, it actually says that they will still defend free speech for those they disagree with, including white supremacists, when the cases make sense.

In fact, the only thing I really see here is them saying that a lot of factors go into deciding which cases they can take, including the fact that they can't take all the cases they want to.

Without something more than this, I think the title is clickbait, if not outright wrong.

</comment></comment></comment><comment><USER11> Reminder: The WSJ is owned by NewsCorp, who owns FoxNews and NYPost

<comment><USER12> Reminder: never believe anything said by members of your out-group. Only what's written by your own tribe can be true.

</comment></comment><comment><USER13> Oh how the mighty have fallen.</comment>


GuardDrone - <AUTHOR> https://www.kickstarter.com/projects/1516799460/guarddrone/ <comment><USER2> I'd like to see a bit more demonstrating progress this project has accomplished already. I see an animated video describing the technology they intend to create, but I'm not seeing anything explaining what's been accomplished here that's novel, makes this possible, and demonstrates the likelihood that the GuardDrone will actually become a reality if funded.</comment>


Communicating a Vision - <AUTHOR> http://www.metamorphblog.com/2010/10/vision-the-job-of-a-ceo.html

<comment><USER2> In one of my favorite startup books, _Made to Stick_ (<http://amzn.to/ccF7X7>), the authors describe the genius of Southwest airlines, which has been, by a long shot, the most successful airline company ever (with something like 37 consecutive years of profit).

The Founder and CEO had an incredibly clear and actionable vision: "we are THE low-cost airline."

This worked like magic both internally and externally. At the company, answers to even the most complex questions could be rendered relatively obvious through the lens of this mantra. _Does it increase costs or not?_ (e.g. Halloween costumes for employees? Sure. Lunch on the Houston to Florida flight? Nope - would raise costs).

And externally, customers know why to fly Southwest: it's cheaper.

If your vision isn't as succinct and actionable as Southwest's, then it's not clear enough: both for employees and for potential customers.

<comment><USER3> yeah, but companies that compete on price have an unfair advantage when it comes to differentiating. Price is something immediately obvious internally and externally.

As far as marketing price, the key, really, is to make it clear you aren't skimping on the really important things (like, say, flight safety) and the best way, I think, to do that is to be open about what you _are_ skimping on. we all want something for nothing, but most of us don't believe we can actually get it.

But, my point is that any idiot (even me) can provide a "vision" for a company that just wants to be the cheapest. Really, the only hard part is deciding what to skimp on.

It gets a lot more complex if you have other goals, like say, Virgin, who I would call the "apple of the sky" - I mean, for both companies, the mission is to be comfortable and to appeal to "cool" people even if they might cost a few more dollars than the competition.

(note, I actually fly Virgin sometimes, even though I don't buy Apple products. For me, the in-flight wi-fi is worth around $50, so if the difference between Virgin and the next carrier is less than that, the decision is made. But, I think Virgin thinks of itself as more than just "the company with WiFi" as more and more other airlines are adopting that perk.)

</comment></comment><comment><AUTHOR> When Carol Bartz couldn't even communicate a clear vision for Yahoo!, i knew she had to go.</comment>


NYU Accidentally Exposed Military Code-Breaking Computer - <AUTHOR> https://theintercept.com/2017/05/11/nyu-accidentally-exposed-military-code-breaking-computer-project-to-entire-internet/ <comment><USER2> The greatest brute-force attack successes that we know of are generally reversing password hashes, because the input spaces and/or effective input spaces under some model of a password's structure are so small. People have achieved very effective results with that, often using special hardware.

The most common attack model for this is "get ahold of a hashed password list, try to reverse as many as possible, then try to see if any has re-used those passwords on other systems". Spy agencies might be doing that too. By contrast, as Bunnie says, modern algorithms have a very large safety margin so brute-force against a random key is very implausible without some significant new algorithmic insight.

So one question is, are there significant security-sensitive deployments that are still out there of obsolete stuff with too short a keylength? 1024-bit RSA, 1024-bit DH, DES, export ciphers?

If, on the other hand, it's really mostly about password hashes, where brute force has been known to be so effective, are there any _other_ attack contexts where the ability to reverse a password hash would be useful?

<comment><USER3> This is off the top of my head and I'd welcome correction:

Large scale password cracking has a much clearer payoff than attacks on 1024 bit DH, which have to be targeted to individual (probably TLS) connections. The RSA that most of the Internet depends on is brokered by CAs --- so, problem 1, the USG already owns CAs and doesn't need supercomputers to get valid certificates, problem 2, the most valuable "authentic" CA signatures are 2048 bit and far outside the capabilities of an IBM supercomputer, and problem 3, even after breaking that certificate you still have to target individual TLS connections to use it.

On the other hand, you don't need the world's most powerful supercomputer to effectively crack passwords.

It's not unlikely that the simplest explanation here is just "the NSA will do whatever thing secures it the largest budget". That doesn't mean they won't use those budget-enhancing projects in ways that will shock our conscience!

<comment><USER2> I suppose I'm also wondering if there's an authentication protocol where the challenger actually tells the prover what hash it has to match. Does a challenger ever effectively say "Please tell me the secret whose SHA256 is equal to fcdf324499312efa027b5033513b0c0968f74ae7ba81a271ae62b3dda2cd4143 in order to proceed"?

Maybe protocols where the attacker has access to a signature over some data, but doesn't get access to the signed data in plaintext? Then the attacker could try to brute-force values of the signed data using the hash that forms the basis of the signature?

<comment><USER4> Think about any software updates you do (Windows Update, apt, yum, etc). All these systems rely on distributing a cryptographic ally signed manifest of what each files hash should be.

If you can forge the hash of a file, or the signature on that manifest, there are hundreds of different ways you can easily replace one file for another in transit over the internet.

<comment><USER3> We're also not a supercomputer advance away from breaking SHA2. There are hash-designing cryptographers who believe we may never break SHA2 with conventional computers.

</comment></comment></comment></comment></comment><comment><USER3> This is malpractice:

 _Widespread modern encryption methods like RSA, named for the initials of the cryptographers who developed it, rely on the use of hugely complex numbers derived from prime numbers. Speaking very roughly, so long as those original prime numbers remain secret, the integrity of the encoded data will remain safe. But were someone able to factor the hugely complex number — a process identical to the sort of math exercise children are taught to do on a chalkboard, but on a massive scale — they would be able to decode the data on their own. Luckily for those using encryption, the numbers in question are so long that they can only be factored down to their prime numbers with an extremely large amount of computing power. Unluckily for those using encryption, government agencies in the U.S., Norway, and around the globe are keenly interested in computers designed to excel at exactly this purpose._

The point of modern RSA is that we use a modulus that _can 't be factored by any conceivable computer_, with limits derived from _the physics of computation_ and projected far out into the future. We aren't a supercomputer advance away from factoring 2048 bit moduli. The government's "keen interest" in that problem is irrelevant.

We've known for coming up on 2 decades, at least (from Eran Tromer in 2001-2003) that 1024 bit moduli aren't safe. There's been speculation for years that the NSA is standing up giant compute clusters in Utah to target 1024 bit discrete logs (it's speculation because it's hard to see how those attacks make economic sense, even with advances in batch attacks). If we want to suppose that IBM and NSA are mounting a supercomputing attack on weak crypto, fine. The presumption that these attacks will get more viable is why, for instance, the WebPKI is urgently scrubbing itself of 1024 bit keys and has been for years.

But that's not what this article says. Instead, it puts forward a narrative that the USG is collaborating with IBM to build supercomputers that would break all of RSA. Not only is that not what's happening, but if it was, IBM and the USG would be doing us a great service, because _we can 't rely on cryptography that is a supercomputing advance away from being broken._

Needless to say, they're not really doing us a service, and they're not really about to break RSA, and breaking RSA isn't a really big IBM purchase order away from happening.

<comment><USER5> Sorry to see you conclude the piece, or that portion, is malpractice :-\

The paragraph you quote was intended to give an overview of one type of work a machine like WindsorGreen might do, in broad terms. While it's true we mention RSA as a very basic example of the sort of thing a government would be /interested/ in breaking, we also specifically quote a security researcher saying WindsorGreen "might also have applications for things like … breaking older/weaker (1024 bit) RSA keys" and then quote another (bunnie) saying ""Even if [WindsorGreen] gave a 100x advantage in cracking strength, it's a pittance compared to the additional strength conferred by going from say, 1024-bit RSA to 4096-bit RSA or going from SHA-1 to SHA-256."

It's really not clear to me how the piece "puts forward a narrative that the USG is collaborating with IBM to build supercomputers that would break all of RSA" \-- indeed, it specifically says this would be of use primarily against 1024-bit RSA.

That said, I'm definitely curious how you think the piece could have framed this more obviously for the lay reader.

(If it's not clear, I work at The Intercept.)

<comment><USER6> "supercomputers" are archaic in a day when one can rent a 40,000 core GPU system with 732GB of RAM for $14/hour, on demand, via Amazon Web Services. Available whether you need one or a hundred (4 million cores crunching on a problem with 20Gb/second throughput is still only $1400 per hour). edit: more thorough response.

<comment><USER7> Where are you getting the 40000 core number from?

<comment><USER6> [https://aws.amazon.com/blogs/aws/new-p2-instance-type-for- am...](https://aws.amazon.com/blogs/aws/new-p2-instance-type-for-amazon- ec2-up-to-16-gpus/)

</comment></comment></comment></comment></comment><comment><USER8> The title here on HN misses a really important word: "Project"

The title at the Intercept is: "NYU ACCIDENTALLY EXPOSED MILITARY CODE- BREAKING COMPUTER PROJECT TO ENTIRE INTERNET" (their caps)

The computer itself wasn't connected to the Internet, a backup drive was.

edit: title was updated

<comment><USER9> The title was likely shortened by the submitter due to the 80-char length limit on HN. If you believe the submitted title is inappropriate for HN, please contact the mods via the Contact link in the footer.

The _Intercept_ uses uppercase for all titles. This isn't emphasis, it's style. No need to carry that forward here.

<comment><USER8> Many people comment here without reading the article, based solely on the title, so discussing the fact that it's inaccurate seems to be pretty pertinent.

> The Intercept uses uppercase for all titles. This isn't emphasis, it's > style. No need to carry that forward here.

I didn't say it should be. I was explaining why the text I had posted was in all caps.

<comment><USER10> Next time, just paste in an editor and lowercase it yourself instead of putting this disclaimer...

</comment></comment></comment></comment><comment><USER11> This is interesting and remarkably incoherent at the same time. The article seems to conflate the existence of a dedicated ASIC based cracking machine with another more general purpose one (apparently a BlueGene relative).

</comment><comment><USER12> Is this really about a "code-breaking computer", or just some big data collection and analysis cluster? A code-breaking machine would look like a Bitcoin mining farm - all ASICs, very little storage, not much I/O, no disks. An collection and analysis machine looks like an ordinary data center.

Is this maybe the Cyrogenic Computer Complexity Program? [1] That's an attempt to build a 10GHz machine running in liquid helium.

[1] [https://www.fbo.gov/index?s=opportunity&mode=form&tab=core&i...](https://www.fbo.gov/index?s=opportunity&mode=form&tab=core&id=6d3f7e438bfa93586b21e87ca90009c5&_cview=1)

<comment><USER13> Breaking an RSA public key consists of two phases. The first phase is massively parallel and indeed doesn't require much storage.

However, the second phase requires solving a massive set of linear equations and requires a more conventional big computer.

</comment></comment><comment><USER14> The very fact that the government invests substantially in brute-forcing encryption means that there are enough weak implementations to make it worthwhile.

Food for thought.

</comment><comment><USER15> Looks like someone needed more sticky notes. "This drive is a backup of a secret government supercomputer. Do not mount as a share."

A la CERN: [https://upload.wikimedia.org/wikipedia/commons/3/37/CERN- fir...](https://upload.wikimedia.org/wikipedia/commons/3/37/CERN-first- server-p1030757.jpg)

</comment><comment><USER16> Nothing in this article remotely qualifies as news. IBM builds computers, fast ones, to crack passwords for the US DOD. They engage with academia to apply research in building and programming them. Is that surprising? Even if it were, there's not even a source document in the article. Snoozefest.

<comment><USER17> I think this is newsworthy:

Andrew "Bunnie" Huang: "My guess is this thing, compared to the TOP500 supercomputers at the time (and probably even today) pretty much wipes the floor with them for anything crypto-related."

We've always guessed the NSA has some incredible resources, but to get a peek like this into what they had _3 years ago_ is definitely newsworthy. It makes the whole supercomputing race kind of a joke if governments have massively more powerful machines hidden from public view.

<comment><USER2> Apparently the context suggests this particular machine had not been built and delivered at the time the documents were written, so it doesn't show that NSA had this exact machine at that time (though maybe they had other computers that were this fancy or fancier).

<comment><USER18> Well. WinsorGreen is the successor design of WinsorBlur so I am assuming Blue exists and it's just a matter of time to finish building Green.

<comment><USER2> I also guess the machine will be built in some form, just that the documents probably don't reflect three-year-old computational capabilities, but might reflect something more like present-day capabilities.

</comment></comment></comment></comment></comment><comment><USER19> So where are the documents? Not much of a story without them....

<comment><USER20> They're classified...if the guy who discovered they were publicly revealed on accident had actually provided them to the Intercept, he would certainly have lost his job, and likely ended up in prison.

<comment><USER2> The Intercept article says that they gave the documents to at least three (named) experts to review in their entirety, suggested that the Intercept does possess them but decided to publish only a small excerpt.

<comment><USER5> In terms of the prior commenters assertion about source protection, that was not a factor as the source alerted various of the original parties directly that their material was in public view (as we mention in the story).

In terms of the (admittedly) small volume of original documents we published, all I feel comfortable saying at this point is that we were interested in publishing more, but there were significant legal concerns.

</comment></comment></comment></comment><comment><USER21> It's really too bad the specifics of the machine weren't shared. I'm not speaking from a national security perspective, where it should be mentioned that other nations most likely already obtained this information, but rather from an academic perspective. It seems that there are a lot of questions regarding the machine, its purpose for instance, and such questions could best be answered by public study.

<comment><USER21> Ps I loved the part where NYU mailed Adam a poster in recognition of not sharing this.

</comment></comment><comment><USER22> So no one else had to open that Gif to find out the password?

NSACHDU0VSKYEP!CTHNDR

I guess Chudnovsky can't spell his own name (or is tricky with his passwords,) and calls himself EPIC THUNDER

</comment><comment><USER23> It is also slightly nauseating that a US company finds it perfectly acceptable to undermine US citizen's privacy for profit. I suppose money is attractive.

</comment><comment><USER24> I'm sure NYU will find someone without tenure to take the fall for this.</comment>


12 Slack Bots to Superpower Your Team - <AUTHOR> https://medium.com/stats-and-bots/12-slack-bots-to-superpower-your-team-e022a9692174?source=latest--- <comment><USER2> Bots taking over everything! SO excited about this.</comment>