GoDaddy to suspend domain name Gab.com tomorrow - <AUTHOR> https://twitter.com/getongab/status/1056708683130781696 <comment><USER3> Ignoring the offending content in question: What does a registrar have to do with the content of the website the domain points to? They are not hosting the content themselves, nor are they even pointing to it (assuming private nameservers are used).

I don't see any grounds on which godaddy could reasonably claim policy jurisdiction over objectionable content they do not actively host themselves. To me, this seems like a conservative phone company bricking users phones because they've been used to watch porn. If the hosted content is illegal, they should be reported to authorities. If it is not, godaddy should act like the transparent utility service that it is and not intervene.

Am I wrong in my line of thinking?

<comment><USER4> It's freedom of association. Except for groups who faced historical discrimination and so are protected by law, businesses are not obliged to provide services to anybody the don't want to. Anti-Semites are not a protected class.

The analogy you make, a phone company, doesn't really work. Because of their natural monopoly status, phone companies are obliged to provide common carrier status: they can't arbitrarily interfere between two network users. The ISP equivalent is of course net neutrality, which also doesn't apply here, because domain registration is not a natural monopoly.

<comment><USER5> > Anti-Semites are not a protected class.

Even if they were, would that matter?

Civil Rights Act of 1964:

> All persons shall be entitled to the full and equal enjoyment of the goods, > services, facilities, and privileges, advantages, and accommodations of any > _place of public accommodation, as defined in this section,_ without > discrimination or segregation on the ground of race, color, religion, or > national origin.

GoDaddy is not a restaurant, hotel, or any other "public accommodation" business as defined by law.

AFAIK, GoDaddy could also discriminate against Jewish customers (which _is_ a protected class) all day long and not be in violation of federal U.S. law

<comment><USER6> There is a fair amount of case law establishing online businesses as place of public accommodation.

<comment><USER5> If that were true -- and it's not -- online businesses would also be subject to the ADA (Americans with Disabilities Act).

Such lawsuits have been attempted, but AFAIK without success.

<comment><USER6> Generally they settle those cases but judges think it's likely enough for them to be places of accommodation to proceed. A website acts as if the ADA doesn't apply at their peril.

[https://en.wikipedia.org/wiki/National_Federation_of_the_Bli...](https://en.wikipedia.org/wiki/National_Federation_of_the_Blind_v._Target_Corp).

[https://www.adatitleiii.com/2012/10/netflix-settles- massachu...](https://www.adatitleiii.com/2012/10/netflix-settles- massachusetts-web-video-captioning-action/)

<comment><USER7> I wonder how far this will eventually extend. For example, what about websites that have games on them (flash, html5, etc.)? What about websites that host game clients to be downloaded? MUDs could be decently accessible, but most games aren't at all accessible.

<comment><USER6> Reasonableness is generally a part of determining accommodations for disabilities. For many games, there are no reasonable steps to make them accessible to someone with a sensory or mobility impairment. But there are also reasonable steps that _can_ be taken, like captions for recorded dialog for the hearing impaired or color/pattern alternatives for people with color vision deficiencies (I don't think color vision deficiency meets the legal definition of a disability but it's still something to keep in mind).

A site that offers games to download can be very accessible but the games themselves might not be and don't have to be; not every product a store sells has to be usable by every potential customer. That's not a reason to not make the site accessible; e.g. a disabled parent should be able to download a game for their non-disabled child.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> This might be an unpopular opinion, but I think it's time for the US government to step up and provide its citizens with minimal tax-funded government-managed hosting and domain services, for people to say whatever lawful speech that they want, without being censored. It's becoming clearer that the public sphere for speech is now online, and that space is managed only by private companies. If we want principles like free speech to continue, we need to segment some of that sphere to be funded and protected by the government.

I say all this, because I believe both that a) yes, these private companies should be able to do what they want WRT who they associate with and b) online is the new "public space" for voices to be heard, which is currently only occupied by private companies. If you believe private companies shouldn't be able to buy up all the public land, then I think you would support something like this. The internet is the new public land, but it is theoretically infinite, and for some reason it's only occupied and controlled by private companies.

<comment><USER8> > _If we want principles like free speech to continue, we need to segment some > of that sphere to be funded and protected by the government_

This is diametrically opposed to the First Amendment's intent. Nobody is entitled to spout garbage. Or associate with those who do. What we are entitled to is protection _from the government_ in respect of the garbage we spout. (And, protection from the government for assembling, or choosing not to assemble, with those who spout what we believe to be garbage.)

<comment><AUTHOR> >What we are entitled to is protection from the government in respect of the garbage we spout.

With the implication being that only the government can legally stop you while you're in a _public space._ If there are no public spaces, what does it matter if the government can't legally touch you, if a private entity legally can? We have to ensure publicly-owned spaces exist for free speech to exist.

<comment><USER8> > _only the government can legally stop you while you 're in a public space_

Its meaning is closer to the opposite than to this.

> _If there are no public spaces_

The public space is deeper and more easily-accessible than ever before. Nazis aren't having trouble distributing their message—Gab will find another registrar. Society, on the other hand, is having difficulty responding. The threat from the latter eclipses the former.

<comment><AUTHOR> >The public space is deeper and more easily-accessible than ever before.

The internet is not a public space. But the argument I'm making is that part if it _should_ be. The Nazis have only been online with hosting and registrars through the blind eyes of the private company gatekeepers. Actions like what is happening to Gab, while morally and logically defensible ("they're nazis and its private companies"), are proving that these spaces are not public, and owned entirely by private entities with their own rules. Rules that may be in your favor today, but not tomorrow.

The internet is a vast resource, and we can all see it's where public discussion actually takes place. Companies can and should run their parts of it. But there should also be a part delegated to citizens and protected by the principles we claim to want to uphold.

</comment></comment></comment></comment></comment><comment><USER9> Well, so it finally happened. The Rubicon has been breached.

One of the great things about the Internet, up until recent times, has been the relative neutrality of the infrastructure. No matter who you were, it was fairly easy to set up shop as long as your content was not super illegal. In general, you could count on having your host back you up unless you were incredibly controversial, and it was out of the question that a mainstream US provider would drop your .com name! A US-hosted .com was a "gold standard" you could count on.

The first indication that things were changing was the DMCA. But for all its faults, at least it has a _process_. This new political "anything goes" trend is going to be awful for anyone not already in the Fortune 500. But I guess that's the point, isn't it?

The useful idiots standing by these actions are going to be shocked, SHOCKED when the political winds shift and their favorite site is suddenly forced off the net by tech oligarchs. Do you really think this won't get turned against left-leaning/anti-war sites the moment we get into a large-scale conflict again? But I guess that's the point, too, isn't it!!

I'm appalled that anyone on the left who remembers the GWB "with us or against us" era of politics would support this kind of politicization of our infrastructure. The left would NEVER have been able to elect Obama without being able to organize on a free and open Internet!

This kind of action is killing what little remains of the open Internet! And all for a petty, temporary victory over a fringe political group! What are you throwing away???

<comment><USER10> Except the actual left has been complaining about centralised capitalist control of the media for decades. Indeed, it's precisely because of that control that you've apparently never heard anything other than liberal centrists talking about access to speech.

>This new political "anything goes" trend is going to be awful for anyone not already in the Fortune 500. But I guess that's the point, isn't it?

Yes of course. Welcome to Capitalism.

When the system starts to break down from the inevitable inequality it causes, capitalists turn to fascism to maintain control. It happened in the Weimar Republic, and it's happening again now. We're seeing business news outlets openly talking about the "investment opportunities" in Brazil as a result of the election of an overt fascist.

>And all for a petty, temporary victory over a fringe political group!

The left celebrates this, not because the control is good, but because the threat of fascism has become so overt that this is the best we can hope for right now.

<comment><USER9> Access to speech has indeed been a problem; there were plenty of court cases about it in the 2000s. What is new, at least in my awareness, is a breakdown in access to infrastructure. Many (though not all) hosts/registrars/etc were built by ideological libertarians who had an absolutist free speech bent. Sites seemed more likely to encounter resistance from the government and big corporations than from their providers. Now the providers _are_ big corporations, and they have close ties with the government!

A prime example is rotten.com. They faced plenty of C&Ds and government lawsuits, but it looks like they weren't forced into self-hosting until 2014 based on some quick research. Rotten was 1000x worse than Infowars, Gab, or even 4chan, but it was a protest site of sorts and an important free speech canary. (It's dead now, obviously.)

Can you give some examples of leftist sites being booted from their hosts in the 2000s? Maybe I'm not aware of them. WSWS, for instance, seems to be hosted by Godaddy currently, and that's about as left as you can get. Wikileaks is an example of an (IMHO) non-partisan site that has faced troubles, but that's because they actively leaked classified intel about ongoing conflicts. Cyptome faced some government pushback in the 2000s for leaking less controversial material, but they were hosted with Network Solutions in 2012, and now with Web.com.

<comment><USER11> The sad truth is lefties are mostly irrelevant these days, shifting the overton window far to the right. When have you last heard significant people someone talking nationalizing industries?

A few hippies or blue-haired university students are no threat to any ones lives. (Near-)fascists taking over countries is. As usual, people take action not because of some principle, but because a problem got so bad it cannot be ignored anymore. And as usual, it might already be too late...

</comment></comment></comment></comment><comment> dr-rachet I'm an observant Jew. I've never considered posting a comment on here before.

Despite disliking the anti-Semitic speech hosted on sites like gab, silencing them this way puts a bad taste in my mouth.

Yes, their speech is hateful. Yes, these are private entities that are well within their rights to refuse service.

But that's not the point.

At the moment, a majority agrees this type of speech is unacceptable. But what's next? Maybe next time it's speaking against google or anything, for that matter.

The famous saying "first they came for the X..., then the Y..., who was left to speak for me?" Is appropriate here. I don't condone hate speech, but just words aren't hurting others. Until that speech becomes action or highly encourages action, it is just words.

Additionally, if the majority destroys the gathering place of the minority, they'll just go to ground. Burying themselves deeper, re-enforcing their conspiracy theories, and polarizing them more. Our actions will be the catalyst to their radicalization.

We need to think, long and hard, before jumping on this bandwagon.

<comment><USER12> I see your point, but there is also the issue of helping to make this kind of content available. If the content is hard to find or hidden then maybe less people are exposed to it? Is that the answer? I have no idea, but to me there's a big difference between arguing the merits of single-payor healthcare and whether or not certain people should be allowed to exist.

There are loads of racist and bigoted opinions on Facebook and Twitter, but Gab takes that to another level. The people being banned from Twitter aren't saying things like black people have lower IQs, they're saying they're animals that shouldn't exist in this country, etc. That's not the same.

<comment> dr-rachet My main point is that this is a tricky subject. One that we should be very careful in regards to our actions.

If the content was so terrible on this site, why only remove it now? Why was it tolerated for so long?

Acting against gab now, seems to be more of a show than reality. All these companies are attempting to show their disdain for this behavior. But they allowed it before. And I'm sure they allow many other sources of hate to persist on their services.

<comment><USER12> Gab is a relatively new site and you might be surprised to learn that it wasn't that well known before. But you can bet that after an event like this most companies are wanting as much distance as possible with the content of the site being in press worldwide.

Twitter allows David Duke on their platform, but he's careful not to post the kind of things you'll find on Gab. Twitter allows everyday racism and white supremacist speech. They do not allow you to talk about culling millions from this country violently. The difference is that Gab does and won't remove it.

I think we should be equally careful in how we combat ideologies that lead people to and even encourage violence. Where were all of the free-speech slippery slope people when YouTube and other groups were banding together to combat ISIS recruitment on their platforms?

</comment></comment></comment></comment><comment><USER13> Massive eye roll at the linked tweet. Acting like a company severing their service is an attack on their freedom of speech is completely crying wolf. I'm sure there are many domain registrars who will take their money. This is not a case where any speech is being chilled. Gab is making money off a platform where people are saying horrible things. Godaddy is distancing themselves because they don't want to be associated with those things. That's the cost of doing horrible business.

<comment><USER14> > That's the cost of doing horrible business.

But doesn't Twitter have many people saying horrible things? If gab is letting people talk about murdering people and not taking action, I'm fine with it - but is that the case?

<comment><USER15> Twitter is bad at removing abusive or threatening content from their site. That's not the same as refusing to remove it.

<comment><USER16> Right, it's worse. Twitter has selectively been enforcing its ToS for years. How is removing hate speech conductive to anything but hiding the issue. Let people moderate their own feeds, and don't make people rely on archiving services to see politically significant information like a terrorist's social media history.

<comment><USER15> >How is removing hate speech conductive to anything but hiding the issue.

well for one, it makes it a slightly nicer place for the victims of that hate speech.

<comment><USER16> That is so much better handled by just letting your users control their own feed.

</comment></comment></comment></comment></comment></comment><comment><USER17> Wonderful news. There is no such thing as absolute freedom of speech. People are threatening and inciting violence against some target demographic, and you are only being obtuse by trying to be apathetic to that in the name of free speech.

Besides, godaddy is a private company. It is not obligated to give rights of freedom of speech to anyone.

<comment><USER18> There was a facebook livestream where a disabled man was tortured. Twitter contains horrible racism. Why is Gab measured different? It's simply free speech. Not even that by the way, since certain types of porn were recently banned.

</comment></comment><comment><USER19> GoDaddy is US based and in the US, you can discriminate against customers except for very specific things (race, sex, etc.)

The Colorado cake case is a weird and bad example, because it came down to people wanting him to commission art (most of that Supreme Court case was about whether or not the cake was an artistic expression, protected by the first 1st amendment). Interestingly that cake shop no longer does custom cakes, so technically they do have to sell to everyone now.

There is another Supreme Court case coming up which will address speech and platforms. This is going to be big. I wrote about this last year and I think it's really relevant today:

[https://fightthefuture.org/article/the-new-era-of- corporate-...](https://fightthefuture.org/article/the-new-era-of-corporate- censorship/)

You might not say anything now, because you might hate Gab and think it's hate speech, but just wait for them to come to a platform you don't think is wrong, but goes against the current mindset of what people think is right.

There are too few providers and they are way too big. If AWS, DigitalOcean, Vultr, Dreamhost, etc. all deny you a platform, where are you going to go? Are you now going to pay out the ass for platforms that cater to Adult Website hosting?

So few people even visit websites anymore either, unless they're linked via Facebook/Twitter, which are both deleting things they don't agree with enmass!

Furthermore, this just pushes people more into these outlying platforms, further polarizing them to deal exclusively with ostracised people and opinions. It literally gives them more validity by censoring them (versus ignoring them)!

If the shooter had posted on Facebook instead of Gab, we wouldn't demand Facebook go down would we?

I think there are really serious implications to all of this, and many of them are not good.

<comment><USER20> I'm not sure people understand the extent to which domain names (and thus registrars & registries) are the linch pins of freedom of speech and identity right now. This, and the ongoing breakdown in the reputational barrier between consumer and service provider do not bode well at all for online freedom:

[https://beforetheban.com/BeforeTheBanWhitepaper2018_10_01.pd...](https://beforetheban.com/BeforeTheBanWhitepaper2018_10_01.pdf)

</comment></comment><comment><USER21> "We may terminate your access to and use of the Services, at our sole discretion, at any time and without notice to you." \- Gab Terms of Service

<comment><USER22> this clause was added this week

</comment></comment><comment><USER23> We're in a weird place where the presence of multiple competing intermediaries (in this case DNS registrars, but you see the same thing with banks and such) leads to them not being regulated as utilities. So when every single intermediary exercises their right to refuse service to someone they end up locked out of the system but nobody's responsible.

<comment><USER24> 1) Not every intermediary has exercised their right so it's a strawman argument.

2) Not sure why you bring up the utility argument. It's basically equivalent to traditional newspapers where if I write some incendiary letter to the editor I am not guaranteed that any of them will post it.

</comment></comment><comment><USER25> PayPal and GoDaddy terminating business with them? I must be living under a rock because I don't think I've heard of gab.com before these tweets started appearing on HN.

What exactly did they do to piss everyone off?

<comment><USER26> Basically they created a platform for freedom of speech. The problem is that every crack pot on the internet basically flocked to the site to say very mean thing about other people. I think we all agree that hate speech is not good but outright silencing people is not the correct solution. If you want to eliminate hate speech then you need to confront the people doing the hate speech and argue with them about why they're wrong.

Many other social media sites also suffer from massive amounts of hate speech as well.

<comment><USER27> > and argue with them about why they're wrong.

Does that actually work?

<comment><USER11> It can work.

It doesn't help that simple imaginary solutions that probably blame some scape goat are easy to sell compared to complicated trade-offs that marginally reduce systemic issues our society has.

The US political system practically allowing only two parties doesn't help, since it makes it easy to disregard everyone not with your team instead of having to engage with a large set of different opinions.

But you quite often see people post something like "thanks for saving me from being an alt-righter" in the community of for example twitch-streamer Destiny. He did engage alt right youtubers in discussions, but recently scaled that back somewhat... apparently having a right wing mob hate you is a real thread to your livelihood as well. He says he has still no idea why he got his permanent twitter ban... so yeah, I'd love someone to look into that...

Anyway, we are talking about the marketplace of ideas. As with any marketplace, you need marketing to sell the good (idea). Guess what kind of ideas are worth paying for? Probably the kind that will benefit those with lots of capital. And for that reason do real lefties think capitalism will eventually always end in fascism once disillusioned people demand change and only a communist revolution can save us.

I always disregarded that as stupid, but the last few years make it more and more difficult...

</comment></comment></comment></comment><comment><USER28> So I guess Gab is a Twitter clone like Voat was supposed to be for Reddit. As an aside, how does Mastodon deals/will deal with the issue? Because it is almost guaranteed that the most extremist elements will flock to it (I'm sold on its long term usefulness).

<comment><USER29> Mastodon deals with it my not being popular enough even for trolls ;)

In seriousness, isn't it federated like PeerTube? In that case, you'd likely only allow people to link to your network if you trust them, and each network would be responsible for vetting its users. If a particular network becomes a cesspool, you just remove them from your network instead of having to completely overhaul the entire system.

</comment></comment><comment><USER30> Why stop with Gab? The CIA has a fucking verified account on Twitter. Why should a platform which not only tolerates but tacitly endorses organizations which perform extrajudicial torture and murder be allowed to keep their domain?

<comment><USER31> Lots of noble and admirable people use Twitter, in addition to shitbags. I challenge you to find a decent person who is an active user of Gab.

</comment></comment><comment><USER32> Does anybody else see the irony of a self-proclaimed 'social networking service' turning to Twitter because nobody would notice if they posted something on their own service?

<comment><USER33> They can't post on their own service because their hosting was pulled by joyent.

<comment><USER12> True, but it's also how they posted about other businesses refusing to do business with them.

</comment></comment></comment><comment><USER22> It's probably not related, but I cannot be quiet about management access outage GoDaddy is experiencing right now - nobody can login to their accounts and multiple authoritative dns servers dont work [https://puck.nether.net/pipermail/outages/2018-October/01177...](https://puck.nether.net/pipermail/outages/2018-October/011779.html)

</comment><comment><USER34> What can be used to silence your opposition will be used to silence you.

</comment><comment><USER35> The _only reason_ I can imagine their domain is registered with GoDaddy is so that they could gain attention from its inevitable suspension. Everyone knows GoDaddy does things like this.

</comment><comment><USER36> I feel almost too defeated to share this. I'm somewhat ignorant on the issue, which might come across as having a politicial leaning. I don't.

This is a proxy battle for "Big Tech is Liberal and Liberals are trying to shut down Conservative speech", is it? Or am I wrong? If it is, why don't Conservatives just create their own tech stuff? Like what is fundamentally stopping people from being heard if the government isn't the one stopping them? Is it currently too hard to create another registrar so we're stuck with the ones we have?

<comment><USER5> > If it is, why don't Conservative just create their own tech stuff?

That's literally what Gab is.

> Is it currently too hard to create another registrar so we're stuck with the > ones we have?

Sort of. In theory it's possible [1], but it's hard enough almost no one does it.

Not even Twitter has their own registrar (which it why they went down during the DynDNS attack).

[1] [https://www.icann.org/resources/pages/accreditation-2012-02-...](https://www.icann.org/resources/pages/accreditation-2012-02-25-en)

<comment><USER36> Interesting.

So right or wrong, hate or not, illegal or not, there's ultimately a corporation somewhere deciding if you get a domain name to point at your content.

I guess there's also an ISP and all of that also involved.

I wonder how much this changes or should change if the Internet was to be considered a fundamental right. Mentally rambling now. Anyway, thanks for the link.

<comment><USER37> It's turtles all the way down.

You can host your own services, but better hope your colo doesn't decide you're more trouble than you're worth. Build out your own datacenter, but hope your ISP(s) don't decide you're more trouble than you're worth. Build out your own ISP, but hope anyone wants to peer with you.

And that's just on the transit side. We've a growing history of piracy sites having their access to the DNS infrastructure curtailed, and porn sites finding the only payment processors who'll touch them charge above and beyond for the 'privilege'.

It becomes difficult to ignore that members of society do depend on the rest of society.

<comment><USER9> Wait until the banking and credit systems step into the censorship game. (The banks already shut out porn sites, adult performers, and legal cannabis businesses.)

Payment processors are just the tip of the iceberg. Imagine not being able to take out your rent money because the banks have "deplatformed" you! That's where we're headed.

It's going to turn really nasty when the political enemy du jour shifts away from Literal Nazis and back to anti-government critics, environmentalists, and the like.

<comment><USER38> This is how fascism and several forms of communism have come to power. If those in power can silence whom they choose, then they play to the people only as long as they have to. When they have enough power, they play no one's game and silence whoever they want.

[edit] It is worth noting that GoDaddy does not equate to "those in power". A business has every right to deny service on whatever grounds they choose (even for no reason). [/edit]

</comment></comment></comment></comment></comment></comment><comment><USER39> Aside from the "this chills speech/does not" discussion, I just want to point out that hate speech laws or deplatforming don't actually accomplish any of their stated goals. Timothy McVeigh did not need any online echo chambers to perpetrate the Oklahoma City Bombing. In the Weimar Republic, there were hate speech laws ([https://www.newyorker.com/news/news-desk/copenhagen- speech-v...](https://www.newyorker.com/news/news-desk/copenhagen-speech- violence)). Relevant quote:

"Researching my book, I looked into what actually happened in the Weimar Republic. I found that, contrary to what most people think, Weimar Germany did have hate-speech laws, and they were applied quite frequently. The assertion that Nazi propaganda played a significant role in mobilizing anti-Jewish sentiment is, of course, irrefutable. But to claim that the Holocaust could have been prevented if only anti-Semitic speech and Nazi propaganda had been banned has little basis in reality. Leading Nazis such as Joseph Goebbels, Theodor Fritsch, and Julius Streicher were all prosecuted for anti-Semitic speech. Streicher served two prison sentences. Rather than deterring the Nazis and countering anti-Semitism, the many court cases served as effective public- relations machinery, affording Streicher the kind of attention he would never have found in a climate of a free and open debate. In the years from 1923 to 1933, Der Stürmer [Streicher's newspaper] was either confiscated or editors taken to court on no fewer than thirty-six occasions. The more charges Streicher faced, the greater became the admiration of his supporters. The courts became an important platform for Streicher's campaign against the Jews. In the words of a present-day civil-rights campaigner, pre-Hitler Germany had laws very much like the anti-hate laws of today, and they were enforced with some vigor. As history so painfully testifies, this type of legislation proved ineffectual on the one occasion when there was a real argument for it."

Hell, Hitler himself was convicted of high treason, but only got a slap on the wrist because the judge and jury were basically on his side.

The only thing strong or soft speech policing contributes to is the further erosion of our civil liberties.

</comment><comment><USER40> > The moral of the story is: if you're against witch-hunts, and you promise to > found your own little utopian community where witch-hunts will never happen, > your new society will end up consisting of approximately three principled > civil libertarians and seven zillion witches. It will be a terrible place to > live even if witch-hunts are genuinely wrong.

[http://slatestarcodex.com/2017/05/01/neutral-vs- conservative...](http://slatestarcodex.com/2017/05/01/neutral-vs-conservative- the-eternal-struggle/)

</comment><comment><USER41> Suspending domain name registration is truly disturbing. I'm literally speechless and I feel like a line has been crossed. This is domain registration, an abstract service that routes requests based on a name. How did the policing of speech get to this level? I don't have words for the things I'm feeling right now. The actions of a mentally ill person has triggered full on censorship. This is entire situation is fucked up beyond words. We just need to man up and legally ban hate speech instead of beating around the bush and before we start quietly, effectively banning other forms of speech.

<comment><USER42> It started when the domain for The Pirate Bay was seized. And the precedent that linking or providing a way for someone to search for illegal content is the same as hosting the illegal content. Internet companies have to now take an aggressively proactive approach to avoiding hosting, linking, or being associated with a domain or content provider that may become the target of a lawsuit.

<comment><USER43> Started there, and that's far worse too. It was government action _and_ none of the objectionable content was actually on the site.

</comment></comment></comment><comment><USER44> Using horrific and tragic deaths as a cudgel to beat your political enemies discredits any moral claims in my opinion.

<comment><USER24> 1) Please stop with the hyperbole. This isn't war.

2) Godaddy is apolitical. They are merely trying to distance themselves from the actions of the Gab site like everyone else is.

<comment><USER44> 1.) It's not hyperbole. Innocent people on gab.ai are now cut-off from discussion with each other because some loon happened to post on their site. 2.) "distancing yourself" is the same as taking a political stance.

</comment></comment></comment><comment><USER45> There's nothing more liberal in 2018 than worshipping at the altar of billion dollar banking institutions and web hosters for colluding to suppress the speech of people they disagree with.

<comment><USER46> As a private (non-govermental) organization, GoDaddy isn't bound to providing free speech to anyone. Gab.com is welcome to keep gabbing on someone else's platform.

</comment></comment><comment><USER47> That is ridiculous. We really have to address the bias/extremism in the tech hierarchy and their shortsighted foolishness. Gab did nothing illegal. All this does is opens up godaddy to pressure to start suspending other "offensive" domains.

These groups of large tech companies are acting as puritans and social engineers in concert are worrying. The same companies complaining about other countries forcing them to censor and going above and beyond censoring at home.

Edit: 10 years ago, nobody with any sense would have supported this. People valued free speech. The anti-free speech brigading is rather shocking, especially on a site like hacker news.

<comment><USER48> I actually agreed with you, except with the edit. GoDaddy did nothing illegal, either. GoDaddy is executing their free speech. Per Citizens United (pushed by the right, of course)

"The United States Supreme Court held (5–4) on January 21, 2010, that the free speech clause of the First Amendment to the Constitution prohibits the government from restricting independent expenditures for communications by nonprofit corporations, for-profit corporations, labor unions, and other associations".

We should just admit that businesses censor one way or another - <USER2> suppressing speech (removal of tweets), or extreme bias in information dissemination (looking at you, Fox News).

<comment><USER49> (looking at you, NYT)</comment></comment></comment>


What should a technical co-founder look for in a business co-founder? - <AUTHOR> http://answers.onstartups.com/questions/33898/what-should-a-technical-co-founder-look-for-in-a-business-co-founder

<comment><AUTHOR> The question:

If I have technical skills and can build a prototype myself, what sort of skills or experience should I look for in a business co-founder?

Is it marketing experience? Salesmanship? A large network? What are the most important things I will need in order to turn my app into a business?

</comment><comment><USER2> Interesting question. I know what I'm looking for in the hypothetical "business co-founder" for Fogbeam Labs:

Some or all of the following (not _necessarily_ in this order)

1\. Sales experience in our domain (enterprise software in our case), and experience actually closing deals.

2\. Enough technical knowledge, and/or willingness to learn, to contribute to the product vision / roadmap in a meaningful way.

3\. Experience with marketing activities and strategy related to our field. IOW, somebody who understands demand creation and positioning.

4\. A large Rolodex of contacts who might turn into customers / investors / partners for us.

5\. At least a passing familiarity with the ideas behind Customer Development and the Lean Startup Approach.

6\. Any previous experience with raising funds from investors, or previous startup experience, would be a great bonus as well. Having gone through a few iterations of Customer Development activities would be especially nice.

7\. An open mind, and a desire to learn and do / try new things.</comment>


Ask HN: why is MS vs Google war so important to us hackers? - <AUTHOR>

I am truly surprised to see 10 out of 30 stories on top page belonging to Microsoft vs Google topic.
Just couple of small questions: is it that important? how does it affect in our lives except for some tabloid-ish sensesionalist fun? <comment><USER2> Competition between these two is important for everyone wants high quality search services. If you have more players they will compete each other by improving their services. A single huge search engine is unhealthy for everyone and on the long term you will notice a decline in quality and this will affect the quality of your online life.

So it is a good thing that today Google has a serious competition.

<comment><USER3> I don't think Google or anyone here is arguing about competition. The key issue is that MSFT seems to be stealing search results off from Google. That's like Gartner publishing and selling material with sections taken from research from Juniper, etc.

</comment></comment><comment><USER4> I find it interesting that Google and Facebook got their start by getting data from other sites and then presenting it in a new way. Search engines and social networks don't start from nothing. Now that other people are grabbing their data to present it in new ways (like they once did or still do) what will be their response?

<comment><USER5> Is this true? I never heard of Facebook being seeded with other site's data.

I also don't see how Google could have even made use of a raw dump of any other site's data at the time. They would need to crawl the sites anyway to fill out their PageRank data. Do you have a citation that says differently?

<comment><USER4> As far as facebook: No one would have heard of facebook if not for facemash

As far as Google: One person's raw dump of data is someone else's valueable copyrighted material.

I could argue grabbing Google "raw dump" of bytes and presenting it my way is unique and original. It's not black and white as you seem to think.

</comment></comment></comment><comment><USER6> They have a huge influence in the world of tech and it's the hot topic of the day.

</comment><comment><USER5> Google Search is the bulk of Google's revenue and power. The idea that Microsoft may be "stealing" it IS a Big Deal.</comment>


Circle Launches with Largest Ever Bitcoin Funding from Accel, General Catalyst - <AUTHOR> http://www.coindesk.com/circle-9m-jim-breyer-accel-general-catalyst-biggest-bitcoin-funding/

<comment><USER2> Hopefully they make a product to make exchanging currencies through bitcoin easier.

International bank transfers are both slow and expensive. I'd like to transfer my money into bitcoins in one country, then exchange those bitcoins for another currency in another. The current challenge being that the amounts it seems I'm able to trade for in Australia are quite small, a few hundred dollars here and there.</comment>


Pope Francis declares evolution and Big Bang theory are right - <AUTHOR> http://www.independent.co.uk/news/world/europe/pope-francis-declares-evolution-and-big-bang-theory-are-right-and-god-isnt-a-magician-with-a-magic-wand-9822514.html

<comment> k-mcgrady This isn't anything new. It's long been accepted in the Catholic church. The problem is that catholics get lumped in with american fundamentalists. There's a good video on YouTube with Richard Dawkins debating/interviewing a bishop/scientist which gives a good overview of what catholics actually believe.

<comment><USER2> As noted in the article, it is new in that it us seen as a return to the position of John Paul II from which Benedict XVI was seen to retreat.

<comment> k-mcgrady The only evidence given in the article that the previous pope refuted evolution wasn't even from him - it was from something written by one of his advisors as the article states. Seems like it was more of a 'we can make it sound like the previous guy backtracked so lets write a headline to make it sound like something we thought would never happen has happened even though the original thing never happened".

NB: Sorry if I sound a bit aggressive but this article has nothing to do with HN and is click bait. No idea why it was submitted.

<comment><USER2> > The only evidence given in the article that the previous pope refuted > evolution wasn't even from him - it was from something written by one of his > advisors as the article states.

Its important to understand that, in general, fairly major shifts in the approach of the heirarchy on issues in the Catholic Church are often signaled by very subtle differences in wording from the Pope and/or his inner circle.

> Sorry if I sound a bit aggressive but this article has nothing to do with HN > and is click bait.

If that's your opinion (rather than that it is relevant to HN but merely has points that are worthy of debate), you probably should have flagged instead of commenting.

</comment></comment></comment></comment><comment><USER3> Besides the fact that no scientific theory is "right":

[http://en.wikipedia.org/wiki/Georges_Lema%C3%AEtre](http://en.wikipedia.org/wiki/Georges_Lema%C3%AEtre)

The big bang theory itself was first formulated by an ordained "chanoine" from the catholic church...

</comment><comment><USER4> This is almost as misunderstood as Copernicus being wrongfully thought to have been persecuted for believing that the world circled the sun, which he the opposite is true. The vast majority of Christian and Jewish beliefs are varied on creation. A very small subset of whom believe only in a literal 6 day creation.

FACT: Genesis has TWO creation stories (Very much inline with Ancient near East writing)</comment>


A (different) introduction to elliptic curve cryptography - <AUTHOR> http://www.embedded.com/design/safety-and-security/4396040/An-Introduction-to-Elliptic-Curve-Cryptography <comment><AUTHOR> Print version - no ads: [http://www.embedded.com/print/4396040](http://www.embedded.com/print/4396040)</comment>


New Free Android App – Path Finder - <AUTHOR> https://play.google.com/store/apps/details?id=com.Paxcel.PathFinderApp&hl=en

<comment><AUTHOR> Path Finder is a useful, easy to use free Android app to help you track and record your Routes making it easy to remember your way and trace your car parking location easily.</comment>


Pure CSS GUI icons (experimental) - <AUTHOR> http://nicolasgallagher.com/pure-css-gui-icons/ <comment><USER3> I don't get why this is "awesome".

CSS for icons is like HTML tables for markup. You have a path, split it to pieces you can represent with CSS using the methods you consider acceptable and draw a shape using ::before and ::after pseudo-elements.

Sure, those icons were carefully hand-crafted. This requires a lot of patient work, and this is admirable.

Yet, we have SVG for vector graphics. Embed it with data: URIs (I believe browsers who support CSS3 transforms can display SVG backgrounds) and that's it.

<comment><USER4> I think it's an interesting experiment to explore CSS3 stuff. Some experiments end up impractical, but they're still good to know about.

That said, for anyone wondering why they're not practical...

        Spritesheet image - 9kb [http://imgur.com/Mcr9N](png)
            CSS needed to write the positions - ~1-3kb

        Pure CSS - <USER2>

<comment><USER5> gzip -9 takes the CSS down to 6757 bytes. That's not why it's impractical.

<comment><USER4> You're right about gzip/deflate! And of course you don't have to use all the icons.

So now my argument is probably that of browser compatibility and separation of jobs :)

<comment><USER6> Gzipped SVG would be a fraction of that. That should be your new argument :)

</comment></comment></comment></comment></comment><comment><USER7> Loving this. Unicode has some awesome symbol dingbats (not just arrows, even weather symbols, coffee cups and the likes) for UI icons too but this goes a step further and is more stylish (plus Android fonts don't have most dingbats, not even the arrows -- not sure about iOS).

</comment><comment><USER8> If you're looking for resizable icons that work in non-canvas non-SVG settings, putting those vectors in a webfont is a pretty good idea too.

Check out: <http://pictos.drewwilson.com/>

<comment><USER9> In principle it's a good idea. There is a problem with this particular set, though. The icons are represented by ordinary characters like "A", which is confusing for users without webfonts, or on screenreaders. Some of this can be fixed by remapping the font to more appropriate characters, but you may not want to go to that much trouble.

<comment><USER10> i agree.

any reasonably complete unicode font should already include many of those glyphs. for the glyphs that aren't in the unicode standard, there are private use areas that could accommodate them.

</comment></comment></comment><comment><USER11> Yeah, as the opening paragraph of the article says, I did this just as 'an exercise in creative problem solving and working within constraints. This is not a "production ready" CSS icon set.'

Hopefully it's clear that it's not being presented as something to be used in production or instead of SVG/other more appropriate technologies.

<comment><USER12> I use slightly modified versions[1] of the heart and feed icons on <http://mediaqueri.es>.

[1]: <http://mediaqueri.es/static/icon.css>

</comment></comment><comment><USER13> Really hate to be, _that guy_ but this was posted almost a year ago and got ~200pts.

<http://news.ycombinator.com/item?id=1921197>

</comment><comment><USER14> I see no reason why you couldn't use canvas to generate icons as data URI's. Each icon could then be represented as a set of canvas drawing instructions, that could be pre-rendered, scaled for different devices/uses, cached, etc. I think that would be a better long-term solution.

Has anyone built something like this yet?

<comment><USER15> SVG?

<comment><USER14> That would be nice if you could embed SVG as background images.

<comment><USER3> <http://www.caniuse.com/#feat=svg-css>

IE5.0+ can use VML instead of SVG. Android 2.3 problems could be worked around with Raphaël.js or some other polyfill.

<comment><USER14> A frankensolution like that would in no way be superior to using canvas.

<comment><USER3> IE8 does not support canvas. Raphaël.js is there for a reason, and one of them is to abstract developers from implementation details and let them just say "I want this graphics here".

</comment></comment></comment></comment></comment></comment><comment><USER16> Weight is a non issue if you working on intranet sites. Or os applications.

And as others have pointed out, you can compress this file down to under 1k.

I like what I see. I'd love to have an icon set that didn't rely on images or "font-face" statements.

<comment><USER17> Hardly. Having worked on intranet applications I know first-hand how critical performance is. One on end of the scale you have very small companies, sharing your apps infrastructure with their timesheeting, invoicing and other app servers. On the other end you have companies like Shell, with a user base of over 110,000 employees. All their servers are hosted in the Hague.

</comment></comment><comment><USER18> Just use Pictos.</comment>


Jeff Hawkins talk on modeling neocortex and its impact on machine intelligence - <AUTHOR> http://www.numenta.com/htm-overview/education/jeff-2010-smithgroup-lecture.php <comment><USER2> I watched the whole thing and like the philosophy of the approach. Unfortunately there isn't a single demonstration of the software, nor a direct comparison between the software and other machine learning algorithms.

At one point Hawkins even says he's not going to waste time by talking about specific data sets they've applied the software to because there are too many! Then pick one! Pick the best!

<comment><USER3> Vitamin D's software is built atop Numenta's platform: <http://vitamindinc.com/demo.php>

<comment><USER4> AFAIK this is not based on the new architecture introduced in this talk.

</comment></comment></comment><comment><USER5> Hawkins has also given some great talks on starting a company. He has an interesting take on entrepreneurship in that he views it as a tool of last resort to be used when you can't get something made within an existing organization:

<http://ecorner.stanford.edu/author/jeff_hawkins>

</comment><comment><USER6> This was really fun to watch. I read On Intelligence, by Jeff Hawkins several years ago and wondered when or if Numenta was ever going to get off the ground. It looks like they're getting close to their goal. Yeah, there were no real demonstrations, but this looks a lot more promising than previous AI/Neural Network stuff.

</comment><comment><USER7> Have they compared their algorithm against standard well-known algorithms for the tasks they claim to solve? Last time I checked they still hadn't done that, or at least hadn't reported any such results. Without that, they're not worth anyone's time.

</comment><comment><USER8> Very interesting video, these concepts seemed to have progressed a lot since last I checked in on them.

That being said, I'm finding it very difficult to find any objective comparisons of these algorithms to other, more mainstream machine learning techniques. In the talk, he gave the impression that there was a tremendous amount of data to back up these claims, and that he just didn't have time to present it all. I went through many of the white papers available on the Numenta website. Many were just overall outlines of the approach. A few of them demonstrate tasks for which some form of learning is occurring, however, it was hard for me to know, in the absence of objective comparisons to other techniques, just how good the results really are.

So far, the only objective comparison I could find involved handwritten character recognition, and that was against what appeared to be a standard feed forward neural network with only a single hidden layer. Not exactly state of the art.. why not compare to SVMs, convolutional NNs, deep belief nets, etc..?

So I am at this point hopeful, but fairly skeptical. If nothing else these are some inspiring ideas.

</comment><comment><USER9> Coincidentally, I just finished On Intelligence, and I found it pretty mind- blowing. If you're interested in learning and the brain, read it! You can also read about the HTM algorithm they are working on here: <http://www.numenta.com/htm-overview/education.php> According to the first paper, there's enough detail there for you to implement the algorithm yourself. Cool!

<comment><USER10> Don't be fooled by approaches like this. HTM is an oversimplification that doesn't bring us any closer to real machine intelligence. I read the book a few years back when I was taking courses in machine learning and metaheuristics, and I recall being impressed. After picking up a molecular biology background, however, I've become skeptical of any claims to model "algorithms" after the brain or neuron or neocortex. Regardless of the level of abstraction chosen by the investigator, it isn't enough.

To put it simply, I strongly feel that achieving any kind of biologically- inspired intelligent agent will require a systems biologic approach where we model every minute molecular detail in silico. This isn't an undertaking that we even have the technology for at present. We don't have the raw speed, level of parallelism, or even the molecular/cell physiologic details necessary to model even parts of the brain. (Even of Drosophila!)

The Blue Brain project is nice and is worth following for nothing other than learning best engineering practices for developing the architecture behind something of this scale and complexity--but every simplification we make introduces error. (Imagine patching it! Imagine the "oops" moment, when some molecular mechanism doesn't work as we expected--and that's a regularly occurring event.) I'm not even sure how much simplification we can make before the emergent properties of the brain no longer function. Some of my colleagues say membrane potentials and the cytoskeletal system have key quantum interactions that encode state information--something we don't even understand yet. (I can't comment much on that, since I haven't studied quantum physics.)

I'm actually learning to develop algorithms that will focus on the interplay of the genomic machinery (promoters/enhancers, tx, translation, chaperones/folding, etc), biochemical pathways and kinetics, concentration levels, receptors, etc. in the hopes that one day we will be able to model systems like the brain. But from my limited knowledge, a project on the brain scale will only succeed after we solve the "much less complicated" problems: cancer, alzheimers, and aging, all of which are all cell-level problems. That's where we have to focus at present--and you can see how much more remains to be done.

<comment><USER11> I completely agree with you. I asked one of my professors at my Machine Learning masters course about this, and he said "if I've never heard of it, how good can it be?"

Algorithms that replicate biological processes are popular because people can easily grasp them. Anyone can understand why evolutionary systems work, or why neural networks work (because it's in nature, dummy!), but they don't work as well as other, purely mathematical methods.

In the end, these sorts of things tend to be toys or marginally useful, where other, more mathematically sound algorithms dominate the landscape. I got very excited about HTMs too, when I didn't know as much about ML as I do now, but I've realised that it hasn't made even a dent in academic circles (you know, the ones with the thousands of people who study these things for a living).

<comment><USER12> I also agree but while neural networks are a sort of black box they are also entirely mathematical. Also some of the most impressive current research is in the area of deep learners, an example of which is a type of neural network: RBMs and Deep Belief Nets. In particular Deep Belief Nets have the added advantaged of being able to display their interal abstractions and state and so are not so boxed up.

<comment><USER11> I will concede that, but they're a very roundabout way to building a classifier. An SVM, for example, is really much simpler and works much, much better than a neural network. I'm not familiar with RBMs and DBNs, so I can't comment on that, sadly...

<comment><USER13> SVMs may make a lot of intuitive sense due to the intuitive nature of the max- margin method of building a classifier, but that doesn't make them "much, much better" than a neural network.

Neural networks are "universal" function approximators in the sense that given sufficient number of hidden layer units and training data, they can approximate any Borel measurable function. This makes them theoretically powerful. (There are issues with this "universalness" claim though when doing cognitive modelling. See "Cognition and the computational power of connectionist networks", Hadley at [http://www.informaworld.com/smpp/content~db=all?content=10.1...](http://www.informaworld.com/smpp/content~db=all?content=10.1080/09540090050129745))

In practice, the best handwritten digits classifier is still neural networks. Lecun keeps scores at <http://yann.lecun.com/exdb/mnist/>.

Are there challenges with training neural networks? Certainly. But for many applications, there are good reasons to use a neural network. For instance, inference in a neural network is fast, and the learnt model is small in size (in feedforward networks, just a few large matrices).

SVMs on the other hand are "easier" to train, but care has to be taken to use the "right" kernel, and the learnt model in practice has to, in many cases, carry around with it up to half or more of the training data set (ie, the support vectors), making the model bigger in size, and inference slower (although there is work in making a sparser set of support vectors. See "An Effective Method of Pruning Support Vector Machine Classifiers", Liang, at [http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=5342...](http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=5342443)).

I know neural network research is kinda old school these days, has been overhyped in the past, and SVM research is kinda "in" nowadays, but that's no reason to think SVM is "much, much better" than ANN.

<comment><USER11> Hmm, I didn't know that about handwritten digits, thanks. I agree that you have to carry around the SVMs, but I've gotten better results with an SVM. That said, it might have just been a suitable problem.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Or a YouTube video of a presentation from earlier this year: <http://www.youtube.com/watch?v=TDzr0_fbnVk#>.

Flash video is sadly unfriendly to my iPad (where I am now)

<comment><USER15> So, "Flash video is sadly unfriendly" to your welcoming little iPad? And the Mac needed its own proprietary browser, because others were so unfriendly. Talk about a reality distortion field....

</comment></comment><comment><USER16> Jeff Hawkins began a few decades ago by criticizing all those neural-net researchers who were all promises and no results and (surprise!) he's become one of them now.

<comment><USER14> Apparently false. See the above comment: <http://news.ycombinator.com/item?id=1945885>

<comment><USER16> Oh-come-on. With the same logic, neural-nets were applied in a thousand and one domains. The problem of object tracking has been solved a thousand times in the past. Even if Numenta's algorithm is better at it than every other solution, you still can't call this a _major result_!

Even Hawkins himself has admitted that his hierarchical network design hasn't caused the huge bang that he expected it to cause.</comment></comment></comment>


Show HN: Pastor generates and stores passwords without storing any passwords - <AUTHOR> https://github.com/appnician/pastor <comment><USER2>
      key_data = hashlib.sha256()
      key_data.update( base_phrase + ' - ' + door_id )

Congratulations, your program is vulnerable to length-extension attack [0].

What you want is something secret determining the output of something public... so instead of reinventing the wheel (the number 1 source of issues in crypto), use the standard, ie HMAC [1].

Now for the rest of the algorithm, IANAC, but truncating sounds like a bad idea.

[0] [https://en.wikipedia.org/wiki/Length_extension_attack](https://en.wikipedia.org/wiki/Length_extension_attack)

[1] [https://en.wikipedia.org/wiki/HMAC](https://en.wikipedia.org/wiki/HMAC)

<comment><USER3> > The password quality is just adequate, but I think the idea has potential to > be very secure.

The op makes no broad claims. I think your insights are helpful, but I would change your wording from "Congratulations" to "unfortunately" and then politely point out how to resolve the issue.

<comment><USER4> There is no issue. Length extension requires the full (or as close to full as to make no difference) output of the hash function.

The problem with hash functions like SHA1,2 and MD5 is that their output represents their entire internal state.

In this case let's say an attacker recovered the password for door 1. They can then compute what the passwords associated with Door's whose number starts with 1.

As the password is substantially truncated, this does not represent the final state of the hash, and the attack is not useful.

That aside, this still suffers from weak key derivation, allowing a more direct bruteforce attack, as others have mentioned.

</comment></comment></comment><comment><USER5> Quite neat, although I foresee a few problems:

1\. Various services have differing ideas about what characters can be used in a password and how long it can be. My default settings are to generate 20-character passwords with all kinds of characters and I frequently have to adjust those settings if the service in question only allows me to use letters. Or just 8 characters. Granted, if MaxLength for input fields is set consistently then generating a too-long password will do no harm, but character set might remain problematic (or insecure).

2\. Changing a password (e.g. after a leak) requires one to us a different door id. Which then leads to remembering the appropriate ID for the currently- valid password. To properly mitigate this I guess the only option is to sort- of go back to traditional password managers by having a lookup table door id to enter → door id that is used to generate the password.

<comment><USER6> (unfortunately) The more I think about this, the more flaws I find... I looked through pastor.py and essentially you're just creating a different password. There's no difference between using this generated password and another password (you could argue that the generated password is harder to brute force, but that's it really).

<comment><USER5> That's the usual purpose of a password manager. Freeing you from having to remember long and/or complex passwords so you can effortlessly have stronger passwords and more convenience (also different passwords for different services without having to remember them all).

Keep in mind that this is something for personal use to retrieve passwords used somewhere, not for storing passwords for users within a service (at least your confusion sounds like you might be confusing those two things).

<comment><USER7> The problem is that the 'door' is your password now - you have to remember all the different doors, or use a password manager to store them for you... But then why not just keep the actual passwords in the manager?

<comment><USER5> The door is just the identifier you use for retrieving a certain password. You can just use your username, or the e-mail address you used to sign up. Said identifier is not a password in that it's not secret. You can even write them down.

</comment></comment></comment></comment></comment><comment><AUTHOR> Many commenters claim that pastor is not watertight, and that is of course 100% true. I completely agree! There is much room for improvement and I appreciate these comments very much.

However we all have an Achilles heel in our online security management strategies. I'm guessing that master email addresses, used to reset passwords and authenticate and also smartphones are a much much weaker link then a system like pastor, even when it is only used to generate parts of passwords and everything else is written down. Would you continue reading this comment if you suddenly became aware that you had no clue where you phone was and vaguely remembered putting on some counter in some store somewhere? I even had to checked the presence of my phone when writing that. Twice.

Also there are alot of integrated systems for managing passwords. Centralized payed services can of course sport far higher quality assurance, but pastor is a completely self contained script that can be remembered and kept anywhere. By using a simple solution one removes a lot of the pitfalls that are present in more complex solutions. The weaknesses, which are always there in any system, can be more easily understood and managed.

<comment><USER8> Disregarding security of this particular implementation and trade offs, the problem is that while it's a simple solution, it's not convenient: password managers are more usable. I'm saying this as a guy who wrote similar password generator once, and used it for some time, then switched to a password manager.

When you need to change a password for some website, you'll have to add something to your "door id", e.g. a counter. Then you'll have to remember such counters for every website where you decide to change password. Due to this I was a bit reluctant to change passwords, which is dangerous.

If you want simplicity, the simpler and more convenient solution is to keep an encrypted text file.

\--

As for security, the best approach to deterministic password generators I've seen is this:

[http://www.cs.utexas.edu/~bwaters/publications/papers/www200...](http://www.cs.utexas.edu/~bwaters/publications/papers/www2005.pdf)

(Today you'll want to use scrypt as the hash, though).

<comment><AUTHOR> This is true. I have door ids that with version numbers in them, but then again I store a list of door ids in clear text.

I used to have an encrypted list of passwords, but I was reliant on more complicated software to encrypt and decrypt the password file. Also there was more bookkeeping involved. Whenever I added a password I had to remember to save and encrypt the file and then decrypt it again to verify that I had use the right master password.

</comment></comment></comment><comment><USER9> I used to use something like this, then you realize, it won't work for 50% of the sites out there as you can't customize how the passwords are generated.

Can't use special characters? Must use a special character? Can use $%^& but not * ?

Amex has a limit of 8 characters, how many does this generate? I want to use more than 8 for most sites, how do I do that? etc.

The Javascript bookmarklet let me change these settings, but then I had to remember them for each site that had custom settings.

I just switched to KeePass, fixed all of that.

<comment><AUTHOR> You can add a standard string to all passwords, for example "Ab1#", so that it satisfies like 99% of sites. You do get in situations where you have to know remember some more information, but this can mostly be written down.

<comment><USER10> "You do get in situations where you have to know remember some more information, but this can mostly be written down."

That boils down to "this idea won't work"; "writing down my passwords" is the exact failure case we're trying to get away from. And I don't have that problem with LastPass.

The name of the game isn't to try to make this idea work at all costs. The name of the game is to find the best way to manage passwords. It's important not to lose sight of that in the argument. (If you look around, you'll see this particular cognitive problem come up a _lot_ in engineering... never lose sight of the overall goal no matter how far into the trees you go.)

Unfortunately, at least a dozen iterations of this idea have come to my attention, to say nothing of who-knows how many hundreds or thousands of implementations of this basic idea there are, and they haven't succeeded because they really don't work in the real world.

</comment></comment></comment><comment><USER11> If your pass phrase is compromised you've compromised all your passwords, even future passwords you've not yet used if you're unaware of the compromised phrase.

<comment><USER12> You could easily increase security by adding another rule that only you know to the seed.

For example, if I am generating a password for firstname.lastname@example.com, I could have a rule that I always append the first four letters of the domain name to my seed.

In this case, I would actually generate a password for email@example.com+exam.

In this scenario, my master password may be compromised, but the hacker would still have a lot of difficulty using the master passphrase to access any of my accounts.

This, of course, only works if no one else knows your rule, and you could get far more clever with the seeding rule than I was just now before my first cup of coffee.

</comment></comment><comment><USER8> Here's some analysis of password generators like this vs password managers (by me) [http://crypto.stackexchange.com/a/5691/291](http://crypto.stackexchange.com/a/5691/291)

<comment><USER13> Thanks, I came here to make pretty much those same points. From the link:

Normal Encrypted DB: _To steal your passwords, the attacker has to steal the database. Then she has two options: steal the master password or guess /bruteforce it._

Password Generation Method: _To steal your password, the attacker has to steal your master password, or steal one of the derived passwords and guess /bruteforce the master password. Once she has it, she can generate any current and future passwords, until you stop using the generator with the same master password._

</comment></comment><comment><USER14> > None of these passwords are ever stored. The pass-phrase is not a master > password to some stored list of passwords.

True... but what makes this method superior to simply having a master password to an (encrypted) stored list of passwords? What makes it more secure than that ordinary way of doing things?

It seems to be less convenient in some ways (there are more things you have to remember), although perhaps more convenient in others (there is no password database to keep sync'd accross multiple computers or to lose).

But I don't think it's actually any more secure?

<comment><USER12> This strategy deftly sidesteps three potential problems:

* Oh great, I forgot to sync my password list on my MacBook before I left the house with only my iPhone

* Oh great, my MacBook got stolen and my backups are all corrupted

* Oh great, my MacBook got stolen and I don't know the password to my backup service that has all my passwords because the password was stored on the machine that just got stolen

Yes, all solvable problems. But, essentially, if you can commit this algorithm to memory, you can always retrieve your passwords, no matter what hardware, backups, or 3rd-party systems go missing.

</comment></comment><comment><USER15> Hi, building on what a lot of other commenters have said, there are some major improvements you should consider:

      * Do not use plain SHA-256. Use a KDF, like PBKDF, bcrypt or scrypt.
      * There must be some efficient method by which I can re-issue compromised passwords.
      * For convenience, allow me to have different character sets for different sites, and different lengths.
      * Make the default to be going directly into my clipboard.
      * A way to recover from the compromise of the master passphrase

The way I would do this is to have a small file, detailing, for each door_id:

      * Random seed. The is effectively a version number. Change this, and get a new password for only that door_id.
      * Character set
      * Length

This file, although not advisable, is not enough to break the other passwords generated. Given a strong enough passphrase (I'd say... a 5 or 6 word diceware password), it can be synced to all sorts of places, kept on a USB stick, etc.

I cannot, off the top of my head see any way to re-issue the master passphrase effectively.

As it stands, I could not, in good conscience recommend anyone use pastor as it stands. Although a few, relatively minor, modifications, could make it quite an interesting tool.

Using a file on disk to keep track of version numbers, lengths, and character sets seems quite extreme, given the aim is to remove the need for files on disk!

Perhaps some other way of keeping track of these, without the user needing to remember them could be devised?

</comment><comment><USER16> [https://www.pwdhash.com/](https://www.pwdhash.com/)

<comment><USER17> I'm wondering why this isn't the top rated comment.

</comment></comment><comment><USER18> If you use anything other than a very strong master password, this scheme leaves you unprotected. When you sign up to a site, you are effectively giving that site, and anybody intercepting that communication SHA256(base_phrase + " \- " \+ door_id). This enables anybody with one of the generated passwords to crack the hash and obtain the master password. This should use a very slow hash function instead.

</comment><comment><USER6> I'm not sure if I quite understand this - so you're hashing the pass- phrase+doorID, and then storing that? Doesn't that mean that the hashed, well, generated password is always the same, regardless which website you are on?

I like the idea of supergenpass, as it's creating unique passwords on a website basis as it hashing a password+URL to create unique website passwords.

Maybe I've misunderstood this though.

<comment><USER5> The password is essentially hash(passphrase + door id). Which means, nothing is stored, because both of those are inputs to the program. At least that's how I understood it.

<comment><USER6> But what I don't understand is, if the password is never stored, how can you allow for logins, etc.? I mean, there must be a way of comparison, or something? I think perhaps I'm having a brain melt, or I'm misunderstanding this completely. To me, this looks like it's creating a password from hashing the pass-phrase and doorID, but that just then generates another password...

<comment><USER19> He will count the same hash(passphrase + door id) again.

</comment></comment></comment></comment><comment><USER20> There are scores of these sites out there, like [http://oplop.appspot.com/](http://oplop.appspot.com/). The nice thing about having a small application do it is that you don't have to run it on a browser, which I inherently trust less... all the same, it's pretty convenient to have it on a web page (e.g., when you're trying to enter something in on your mobile phone, or on a device that isn't yours).

My favorite password manager, pass, is fantastic, but unfortunately I can't use it if I ever leave my laptop.

</comment><comment><USER21> I built this 8 years ago based on a comment on Slashdot:

[http://passwordchart.com/](http://passwordchart.com/)

It still gets a few hundred hits per day. I haven't used it in years myself.

<comment><USER22> You should update the copyright date at the bottom.

</comment></comment><comment><USER23> I made this FWIW [http://jsfiddle.net/nXth5/](http://jsfiddle.net/nXth5/)

It gets the domain of the website you need a password for, he login you want to use, a pin that can be website dependent. It outputs a deterministic password that's 12 character long and contains at least one uppercase, one lowercase, one number, and one symbol (since some websites require you to have that)

(And no, there are no benefits in using a KDF if you think for a second about the constraints and the threat model)

</comment><comment><USER24> I've built a similar tool called Password Wallet for Android two years ago, but there was little interest. I made the generation process customizable so that you could choose to have special characters, numbers etc.

You can see it for yourself here:

[https://play.google.com/store/apps/details?id=com.alitas.pas...](https://play.google.com/store/apps/details?id=com.alitas.passwallet)

</comment><comment><USER25> I don't get how this is a good idea.

First, it's inconvenient because the same door/user id and password on multiple sites will just result in the same hash, so getting different hashes means having different user id's, something not everyone does or can do.

Second, it seems insecure. All you have to do is know the door id (username) and you can brute force the password just like any other salted password hash.

<comment><AUTHOR> The door id is not just the user id it also contains the site name. For example "firstname.lastname@example.com".

<comment><USER25> ok, so email@example.com@site.com would be my unique door id, so each site would have a unique hash. that solves the first problem, basically.

if someone compromises that site, they get the unique hash. presumably they're not using an expensive hashing algorithm (most sites don't). since they know my username and the site name, they can start brute forcing my unique hash to determine the password. sure, the program could be using an expensive hash algo that would make this take some time, but the whole point (i thought) was to prevent passwords at rest. with this you still have passwords at rest... they're just distributed out across the internet.

there is benefit here, in that you have to compromise each site to get each unique set of credentials. but the downside is a much bigger single point of failure. you trade off the inherent security of memorized complex passwords for one complex master password and the hope that nobody will ever discover or brute force it.

at the end of the day, passwords are still vulnerable to the same flaw: you only need _one_ attack vector to succeed in compromising accounts. with 2-factor auth you need _two_ attack vectors to succeed, which isn't impossible, but is harder, which is really what security is all about.

<comment><USER26> If you looked at a random cryptographically secure hash on the internet, would you be able to determine what hashing algorithm was used? Would you know how many rounds it was sent through, or whether any other hashing techniques were used prior to the final hash?

<comment><USER25> Yes, yes, yes. Password hashes that use salts or rounds are prefixed with said information, either so you know how to decrypt it, or know how to strip away the salt, or know what number of rounds to decrypt to.

<comment><USER26> So if I did a salted sha256 followed by 8 rounds of bcrypt each with their own unique salt (probably a bad idea and I know it) you would know that I started with sha256? Wouldn't the final round of hashing obscure all previous rounds? And how would you strip away a salt without having the original, unhashed information? The whole point of a salt is to be factored in prior to the hashing process.

Also, you don't decrypt hashes.

</comment></comment></comment></comment></comment></comment><comment><USER27> And where is the advantage over a password wallet ?

I need your script and type many chars until i got my password.

With a password wallet i enter my access password and the wallet did anything automatically.

And it is not an argument "but when you not have your wallet, you can not access" -> "yes and when i not have your script, i can not access too"

</comment><comment><USER28> e.g. see www.supergenpass.com (who use an identicon as a visual hash of your passphrase for verification, rather than a 4-digit code, so might be easier to recognise)

I'm personally a big fan, at least for low-importance logins. As other commenters have mentioned, there are definitely security trade-offs that need to be considered.

</comment><comment><USER29> No one mentioned [http://masterpasswordapp.com/](http://masterpasswordapp.com/) ?!?!?!

They are using scrypt correctly: [https://twitter.com/cperciva/status/475682400576339968](https://twitter.com/cperciva/status/475682400576339968)

</comment><comment><USER30> Nice. Did you see the iMobileSitter app yet? [http://www.imobilesitter.com/index_en.php](http://www.imobilesitter.com/index_en.php)

It's very equal but working in the cloud.

</comment><comment><USER31> So....Shamir's Secret Sharing algorithm[1]?

[1] [http://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing](http://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing)

<comment><USER8> Nope.

</comment></comment><comment><USER32> Thought of this a while ago and it probably already exists... but I hadn't seen the one with a pin code yet to verify that your passphrase is correct. That's a nice addition!

<comment><USER8> My Chrome extension (which I don't use anymore, but here it is: [https://chrome.google.com/webstore/detail/cryptopass/hegbhhp...](https://chrome.google.com/webstore/detail/cryptopass/hegbhhpocfhlnjmemkibgibljklhlfco)) uses similar technique, but instead of displaying this "PIN code" it uses different colors for master password input box text: the color changes as you type.

<comment><USER32> Saw the colors thing before. Interesting but I think I prefer the PIN because it's easier to check (you can't compare color shades on different screens), though I must say I haven't used the PIN method before (I have used the color method and found that it didn't really add much).

</comment></comment></comment><comment><USER33> This is like: [http://userscripts- mirror.org/scripts/review/1341.html](http://userscripts- mirror.org/scripts/review/1341.html)

</comment><comment><USER34> Reminds me of vault by James Coglan : [https://getvau.lt/](https://getvau.lt/) except you can customize the size and characters.

</comment><comment><USER35> Same principle, minimalist and efficient: [https://www.vpass.info](https://www.vpass.info).

Doesn't have the password checksum though.

</comment><comment><USER36> I have used a similar aproach, but I don't hash them. Here's a example:

Supose I have the master password "t3st1ng" and "!@#" as separator. When I want to register on site www.reddit.com, I just use the password "reddit.com!@#t3st1ng".

This way I always have a strong password and I can use different passwords in every site, and I just have to remember the master password.

<comment><USER37> This is dangerously insecure.

Let's say badsite.com stores your password in plaintext and their database is compromised (or they're malicious actors in the first place who created the site with the purpose of gathering login credentials).

Now, an attacker who sees this will try go to gmail.com and enter the password gmail.com!@#t3st1ng (with your email address), or bankofamerica.com and try bankofamerica.com!@#t3st1ng.

<comment><USER36> Yeah, you're right. Maybe a more secure way would be make reddit.com unreadable. For example:

mctddr (backwards without dot and vowels)

r5d9t (change vowel with the position number in the alphabet and without repeated letters)

There are several ways to do it.

<comment><USER26> However clever you get with your mental encoding, it can be decoded by anyone at least equally clever.

</comment></comment></comment></comment><comment><USER38> or, you know, you could use what has been around for 10 years instead of reinventing the wheel [http://www.passwordmaker.org/PasswordMaker:About](http://www.passwordmaker.org/PasswordMaker:About)</comment>


Ask PG: No (visible)Karma HN? - <AUTHOR>

I was wondering what would be HN, when no karma is visible. I know it was tried once for comments, but how about stories and users. If you look at profile, you cannot see one's karma. Though stories come to front page based on upvotes, the number of upvotes should not be visible. Is it the karma that motivates the people to make comments and submit stories, or there is more to it? Can we try it as a experiment? <comment><USER2> I like things pretty much the way they are. If a story has a high point value, I'll take a look, even if the title might not grab me. I also dont mind someone contributing a good story to get karma. I havent noticed a lot of story spamming, so I think the present system works pretty well.

That said, improvement will always be necessary to keep the site fresh.

<comment><AUTHOR> I thought about it because of lot of Apple/ipad/iphone/andriod stories, which were far from gratifying one's intellectual curiosity, also there are lot of comments about front page of HN being far from what it was about 2 years ago.</comment></comment>


RIABench - Benchmarks for Rich Internet Applications - <AUTHOR> http://www.timo-ernst.net/riabench-start/

<comment><AUTHOR> A thesis of this guy [http://www.timo-ernst.net/2010/09/a-scientific- performance-c...](http://www.timo-ernst.net/2010/09/a-scientific-performance- comparison-flexflash-vs-javafx-vs-silverlight-vs-javascript/) comperehensive testing of performance of various RIA</comment>