Facebook's 'oversight board' is proof that it wants to be regulated by itself - <AUTHOR> https://www.theguardian.com/commentisfree/2020/may/16/facebooks-oversight-board-is-proof-that-it-wants-to-be-regulated-by-itself <comment><USER2> I work in a completely different industry, but it is a well-known principle that if you can show the regulator that you're regulating yourself effectively they'll leave you the fuck alone. As soon as a fuckup becomes public, the regulator will start delving into every detail of your fuckups (of which you have many). It costs money and ties up valuable resources to respond to the regulator when they start getting stuck into details, so it always pays dividends to maintain an outward display of effective self-regulation.

It's in every large company's interests to maintain a steady stream of propaganda to show just how splendid they are at regulating themselves.

<comment><USER3> Unfortunately NDA's and raw intimidation suppress a lot of horrific abuses. I'm sure these abound at Facebook, which has had at least one workplace suicide this year. Some families don't have the resources to investigate, the way this victim's did [1].

I don't mean to dump on Facebook, this is just one of those rare cases where it came out into the sunlight.

[1] [https://www.cnbc.com/2019/09/30/facebook-employee-suicide- be...](https://www.cnbc.com/2019/09/30/facebook-employee-suicide-being- investigated-by-law-firm-for-family.html)

</comment></comment><comment><USER4> I am curious, given the international nature of Facebook which makes it hard to rely on country authorities to settle content moderation disputes: what would be a better alternative? (Disclaimer: I work at FB)

<comment><USER5> > what would be a better alternative?

None. I see too often the argument 'it's difficult for company X to follow the law, so how should countries change the law to fit the company needs?'.

I have worked for decades in regulated markets. It sucks to have a dozen implementations to fit each regulation and a thousand similar but slightly different reports. But, we always follow the law, we do what local regulators ask us to do, we filter, or change the content to fit the local government decisions.

Facebook argument is 'we do not want to follow local laws because that increases cost and makes some business practices illegal in parts of the world. That mindset is destructive and fights agains society needs just to get higher profit.

If you work for Facebook, ask the company to look for experienced companies in regulated markets. And I do not mean just to hire lobbyists but to create a technical infrastructure that allows to follow the rule of law in all countries where it operates. To just lobby for more political power only makes Facebook mindset worse.

<comment><USER6> > Facebook argument is 'we do not want to follow local laws because that > increases cost and makes some business practices illegal in parts of the > world. That mindset is destructive and fights agains society needs just to > get higher profit.

I don't think this is their argument at all.

Facebook regulates and removes far more content than required by law.

Under the US 1st Amendment almost everything offensive, racist, bad, pornographic, etc is legal. Facebook still removes quite a lot of legal content from their posts and their content moderators get PTSD from having to look at content which may be legal.

I think Facebook's real issue is that they know they and their user base want them to be stricter than the law requires, but where should those standards fall?

<comment><USER7> The standards should fall wherever society wants them. If Facebook is upset about that, they can exit the markets.

<comment><USER8> That means going for the lowest denominator.

<comment><USER9> If they want to profit from the whole of society then they'll have to strike a balance that minimizes offences which will drive away too many users or attract too many regulators.

</comment></comment></comment></comment></comment></comment><comment><USER10> Covered by Wired in more detail last week: [https://www.wired.com/story/facebook-and-the-folly-of- self-r...](https://www.wired.com/story/facebook-and-the-folly-of-self- regulation)

designed to "move slowly and keep things intact."

</comment><comment><USER11> "Facebook is not a public body: it's a powerful and rich global corporation with no democratic legitimacy"

Facebook is a website. That is all. It does not even produce content, let alone run a business in the real world (e.g., Amazon).

It is a remarkable phenomenon, no doubt, but it is just a website, with billions of template pages each filled in with data from users.

They do not do anything else at Facebook except maintain a website and conduct surveillance. That's it.

If someone tomorrow started a website and offered to give out free web pages (i.e., not a paid blogging patform, not Wix, etc.) without any surveillance or ads/promotions, would you sign up?

There will always be naysayers whenever we share thoughts of the possibilities.

Surely, if someone told you in 2003 that he/she was going to start a website that would sign up billions of users who would submit photos of themselves and personal information to be published, most of you would dismiss the idea as impossible. There was no such thing as a single public website with _billions_ of pages of personal information voluntarily submitted.

The same goes for Wikipedia. What if someone told you in 2001 they were going to start a website and grow it to 53 million pages? No doubt, naysaysers would have asked "How do you make money?"

It is a website. Anyone can start one. Of course, Facebook is not fond of this reality hence the notion of "platform". It is still a website.

The fact that anyone can start a website is the only democratic aspect of the www.

<comment><USER12> You are very dismissive of Facebook, yet I'm not sure what insight should be gleaned from this simplification. I'm open to understanding your point, but it sounds like your point is that Facebook is a website. And I'm not sure what insight that simplification allows me to unlock.

Beyond being a website, it's also a mobile app, marketplace, communication platform, hardware manufacturer, and cultural driver. (Not to mention that it's a research organization, crisis response tool, ally to law enforcement, etc.)

Would you similarly describe the US Constitution as a piece of paper? Such a simplistic reduction doesn't seem all that useful to me.

<comment><USER11> You write: "Beyond being a website, ..." This is what the author is upset about. He thinks Facebook believes it is something other than what it is, e.g., it behaves as if it were a nation state.

When you continue: "it's also ...", you are simply referring to properties of computers, software, the internet and the www. This has been debated on HN before. Facebook is a website.

If Facebook were implemented in distributed Rolodexes and analog photo albums I doubt you would be making such statements.

As for the implication that a website, e.g., Facebook, can be compared to the US Consitution, this is the sort of thinking that sets off journalists and yields rants like the OP. Whereas you refer to my comment as "simplistic reduction", the author of the OP might refer to yours as "delusional thinking".

The properties of the US Consitution that make it important do not come from the fact it is a piece of paper or the conveniences that paper allows. They come from what is written on the paper and the authors of the document. Facebook does not produce content. It manages a website full of content submitted by the public, then surveils and spams them to service advertisers and promoters, for a fee.

The topic of the article is in fact how they purport to manage filtering that content. Much of the content on Facebook is very low quality. A website with billions of pages that takes submissions from the public, which has heaps of low quality content. Surprising. This is precisely what the web was designed for.

</comment></comment></comment><comment><USER13> It reminds me of Bernie Madoff's brother being the Head of Compliance, although even HE was allegedly kept in the dark about the Ponzi scheme.

</comment><comment><USER14> Most people want to self regulate. Some people want to get enough political power to regulate other people.

</comment><comment><USER15> Governments are forcing companies like Facebook to act as a judge and decide what content is acceptable. Yes, I think that's stupid, but that's the reality.

If you want some sort of democratic method for deciding this stuff, you need to get governments to stop dumping the problems on companies.

</comment><comment><USER16> I think the linked article at the bottom is more interesting ("Naomi Klein: How big tech plans to profit from the pandemic" [https://www.theguardian.com/news/2020/may/13/naomi-klein- how...](https://www.theguardian.com/news/2020/may/13/naomi-klein-how-big-tech- plans-to-profit-from-coronavirus-pandemic) )

I think FB is creepy af personally, but this article doesn't do a good job of reviewing the oversight board.

</comment><comment><USER17> There are a bunch of problems with facebook. The biggest first one is moral cowardice.

The issue is this: the top brass genuinely believe that freedom of speech is the best thing since sliced bread. However its not true freedom of speech, its "freedom of expression" This means no murder pics, no nakedness or any combo of the like. (Fair enough.)

They do not believe that they are able to adequately draw the line on political ads. They do not think its right for facebook as a private company to say that "lying" is not allowed.However if a political campaign was a facebook group, they'd be shut down for violating the community standards. So, instead of drawing up a set of principles, publishing them and then posting every and all decisions. They want a law maker to set the rules.

The second problem is that they can't PR for shit.

Most of this stems from the inability for the business side (and quite a lot of the engineering side) to communicate ideas in a simple short sentences using a frame of reference that a normal person can understand.

Any kind of "here is my idea" in less than 140 chars is utterly beyond them. an example is that they did some internal PR for "rooms" feature (aka zoom killer). They had a TL;DR: that was something like 8 paragraphs. I still didn't know what it was after reading about it. I knew they had to work with a lot of other people though. It wasn't until someone outside of FB talked to me about it that I realised what it was.

The Covid updates, which you'd hope would be really high signal to noise are 20 paragraphs of waffle. in the middle they have the actual important stuff (when offices will close/open, procedural change for things). You have to sift through mountains of mindfulness crap.

In conclusion, the only thing "evil" about facebook are the M&A lawyers. The rest is just standard naivety, lack of moral leadership or just incompetence.

</comment><comment><USER18> Facebook needs to be regulated. They dont allow dissent or opinions that oppose their own. While controlling the vast majority of social media.

</comment><comment><USER19> Another breathless, gasping story about the evils of FB / technology / capitalism / <insert boogeyman here> from the Guardian, which has established itself as the nexus for alarmist 'journalism'. The footer: "in the coming year, and the results will define the country for a generation. These are perilous times..." Doesn't sound much like a news outlet to me.

...then you read the piece and find out there's really very little content, just links to other articles (some by the Guardian!). A lot of words on the page that give the impression of something important, whereas in reality they're just building on the narrative they've been selling.

<comment><USER20> It's not like they have any context or history of gross, concerted efforts at manipulating public opinion through Facebook and/or a lack of social responsibility to draw upon. /s

<comment><USER21> But, like, here's The Guardian having a go at a gross, concerted effort at manipulating public opinion. Should we have a problem with that?

<comment><USER20> Yeah a newspaper article is not the same as a covert social media influence campaign :/. It's not an apples-to-apples comparison.

<comment><USER21> What gives the newspapers special status here that changes it from being apples to apples? Why do newspapers get to use broadcast media to influence the public but others aren't allowed or at least should be looked at negatively?

<comment><USER20> A combination of law, culture, and the financial incentives of the respective institutions.

</comment></comment></comment></comment></comment></comment><comment><USER22> "Toxic business model" \- oh yeah?

Like the same one that pays the bills for theguardian.com?

(I just disabled my ad-block and saw scammy+nasty "feet" ads of some sort, pretty sure those would not be allowed on FB.com)

(edit: fixed The Guardian link)

<comment><USER23> Love their self-righteous call to action in the footer.

"just when we need it the most. The Guardian's honest, authoritative, fact- based reporting has never mattered more. As we face the biggest challenge of our lifetimes, we'll remain with you, so we can all better understand and combat the crisis. But at this crucial moment, news organisations are facing an existential threat. With advertising revenues plummeting, we risk losing a major source of our funding. More than ever before, we need your support to help fill the gap."

According to The Guardian, The Guardian is honest, authoritative and fact- based.

Easy enough to not use the site if I don't like it. The same applies for FB. Apparently non-violent opt-out isn't enough for The Guardian though. The Guardian (honest, authoritative) proposes that the state should guard us all from FB and their "supreme leader" Zuckerberg.

At what point do the principles of private property and free speech no longer apply to the websites we create?

<comment><USER24> Speaking of companies that want to regulate themselves, The Guardian is pretty much the only UK publication that's refused to join the industry-wide, nominally independent press regulator IPSO, which means that they're effectively the only one who are not held to any external standards regarding the honesty and factual accuracy of their reporting. Which is more than a little ironic in this context. They've also been using their opinion section to undermine IPSO for such offences as not being aggressive enough in helping their preferred political party send different messages to its members and its voters by forcing other publications to take down articles revealing to the everyone else what they've been telling their members. (Remember how we were told Facebook ads were a danger to democracy because they'd allow politicians to promote different, contradictory messages to different audiences?)

<comment><USER25> That's a slightly odd reading of the situation. The Guardian is a member of the other regulatory body IMPRESS. The history of both organisations is a bit complex, but the short version is that press self-regulation in the UK has been something of a joke for the last hundred years or so, and IPSO is the latest incarnation of that. The Leveson enquiry tried to set up regulators with more teeth, which was faced by a heavy rearguard action by the established press. This was either a principled attempt to head off censorship, or a shameless attempt to protect profits, depending on which side you were on.

IMPRESS is the Leveson-compliant regulator, IPSO the continuation of the old PCC by another name. Most newspapers went with IPSO, The Guardian didn't.

<comment><USER24> As far as I can tell The Guardian isn't a member of IMPRESS either - at least, they're not on their list of members, and in fact none of the other major newspapers are either. Their complaints page also doesn't mention membership of any independent regulatory body - it suggests complaints are handled entirely in house with no avenue of external appeal or complaint, which is my understanding as well.

<comment><USER25> I apologise - you're quite right, I've misremembered. It looks like the Financial Times hasn't joined IPSO or IMPRESS either.

</comment></comment></comment></comment></comment></comment><comment><USER26> Their toilet systems also prove water is wet.

In all seriousness though, Facebook get a lot of shit but they are at least trying to clean up their act. Legacy media has been vastly more corrupt and treacherous for decades and shows no sign of any reform.

<comment><USER27> I'd love to see any evidence at all that Facebook is trying to clean up their act.

<comment><USER26> Lol, you're commenting on an article criticising one such attempt!?

</comment></comment></comment><comment><USER28> In other news: water wet, sky blue.

Jokes aside, not only Facebook but a lot of companies do that so it seems they are proactive while they pretty much do nothing valuable and hope they don't get regulated.</comment>


What if Valve brought Steam to mobile? - <AUTHOR> http://ammaar.me/what-if-steam-had-mobile-integration <comment><USER2> What an awkward thing to say in this space but Steam is for curating quality products whereas mobile gaming on google play/app store is mostly about selling absolute garbage to punters. When Steam eventually does mobile their own way they'll blow them charlatans out of the water.

<comment><USER3> Gaben has made it pretty clear that Steam's role as a curator is not something he wanted, and not something that will continue in Steam's future.

> "One of the worst characteristics of the current Steam system is that we've > become a bottleneck. There's so much content coming at us that we just don't > have enough time to turn the crank on the production process of getting > something up on Steam. So whether we want to or not, we're creating > artificial shelf space scarcity.

> "So the right way to do that is to make Steam essentially a network API that > anyone can call. Now, this is separate from issues about viruses and > malware. But essentially, it's like, anyone can use Steam as a sort of a > distribution and replication mechanism.

> "It's the consumers who will draw it through. It's not us making a decision > about what should or shouldn't be available. It's just, you want to use this > distribution facility? It's there. And customers decide which things > actually end up being pulled through. So Steam should stop being a curated > process and start becoming a networking API."

[http://www.gamasutra.com/view/news/186168/Gabe_Newells_visio...](http://www.gamasutra.com/view/news/186168/Gabe_Newells_vision_for_Steam_More_choice_more_democracy_less_Greenlight.php)

<comment><USER4> _It 's not us making a decision about what should or shouldn't be available_

We have that, and it's called "installing from the developer's website".

Allowing everyone on Steam would be a mistake; driving down the minimum quality of games makes it harder to discover and reward the best games. Steam's success so far has been in quality _and_ discounts.

<comment><USER5> Quality hasn't been a selling point for Steam for a couple of years, they pretty much allow anything on there.

Gaming critic Jim Stirling has a youtube channel dedicated to this, e.g. Air Control ([https://www.youtube.com/watch?v=VYArgbWVtGc](https://www.youtube.com/watch?v=VYArgbWVtGc)) was a famous example. Day One: Garry's incident ([https://www.youtube.com/watch?v=KjTa_x3rbJE](https://www.youtube.com/watch?v=KjTa_x3rbJE)) was another trainwreck which got famous because the dev filed false DMCA claims to take down negative Youtube videos.

Both of these and many more were on steam for $30 or so

</comment></comment></comment></comment><comment><USER6> I firmly believe that Valve is in a great position to be a hardware company. All they have to do is realize that hardware is the only thing that matters, and get their properties on as much hardware as possible.

Imagine, if indeed Valve brought Steam to nothing but the OpenPandora/Pyra game consoles:

[http://openpandora.org/](http://openpandora.org/)

In fact it could be a momentous thing for Valve to get behind this effort and add Steam to the open repo. It'd blow open the doors on Android and iOS and move Linux - as an embedded operating system platform - into the stratosphere.

Valve+Pyra (or something similar) = new masters to follow.

Just my opinion. Before all the 'hardware nay-sayers' get started, think about this: the Pandora happened, without Valve. Irrespective of commercial success (yet), the Pandora/Pyra community is positively _thriving_ as an emergent platform. Linux, and a very open atmosphere, is at the core of why this works, at small scales; and also why it can scale, too.

What would the Pyra be like if gaben gave, like, a million bucks to people like EvilDragon and notaz and the rest of the Pyra team, and said: "kids, gimme 100,000 Pyra devices, and we'll put Steam on them for our customers" ..

Frankly, it could happen. I wish it would! Frankly it'd be the kind of bold move that would make sense to me, were I in a position to direct a few bucks. The thing is, whether Valve arrives on Steam or not, things like the culture which produced [http://repo.openpandora.org/](http://repo.openpandora.org/) are going to happen, regardless. May as well be a player, homie ..

<comment><USER7> Could happen, but I don't see it. They have cold feet when it comes to making their own Steambox hardware (they retracted on their initial intentions to do so) and in that sense I don't see them actually moving towards making their own hardware anytime soon. Even if I agree it would be a great idea.

</comment></comment><comment><USER8> Don't Apple and Google have clauses in the developer contracts that prevent distributing a store from within their stores? It'd have to be Humble-Bundle style side-loading on Android, which is not ideal, or simply "unpossible" on iOS.

<comment><USER9> This is what's keeping them from doing the same. They could always fork Android, but then you end up with Amazon Kindle Fire. Although... If the Ubuntu phones get anywhere it could be part of that ecosystem if Ubuntu makes it so, but who really knows at this point, it's too early to tell. It's much too complicated when Steam is it's own App market, and it would not provide much revenue for other companies, or incentives if you will?

<comment><USER8> There's the steam box I suppose. A steam handheld would be pretty cool. I love the 3DS, but it is underpowered and the games are hella expensive. A good alternative with a controller and lots of reasonably-priced indie games would be great.

<comment><USER7> The upcoming Dragonbox Pyra could be a great Linux portable machine running Steam (provided they provide ARM runtimes + ARM recompiled versions of games).

<comment><USER9> This is probably another issue. They definitely haven't started to deploy ARM version of games yet, even though there's numerous games that are 'ARM' compatible. Although, any game coded in Java and similar frameworks could in theory already run on top of arm versions of said frameworks I suppose.

</comment></comment></comment></comment></comment><comment><USER10> Well, this is obvious for Valve. They created the first successful online store and they want it everywhere, but Apple and Google do not.

You are competing against Apple and Google Play online Stores.

If they support Steam they would be making the platform a commodity(as Steam does not care about the platform), this is something Apple can't let happen, or just replace Google Play as the gatekeeper for Android(as steam already knows how to sell commercial titles).

Steam's response to online stores have been to create the Steam machine, that probably will extend over mobile devices in the future(using wifi playing first, creating devices on their own later).

Remember that real Linux needs to get to tablet-phone space, with efforts like Ubuntu's Unity it will soon. Valve will be the first to benefit from it(as steam machine is very similar to ubuntu).

<comment><USER7> > Ubuntu's Unity it will soon

Is there any device that will be released anytime soon ?

<comment><USER10> [http://www.omgubuntu.co.uk/2014/02/image-bq-aquaris- ubuntu-p...](http://www.omgubuntu.co.uk/2014/02/image-bq-aquaris-ubuntu-phone)

There are companies working on tablets too. I probably know a couple of companies working on this but I can't talk about it. :-D

It is almost a prototype now. In a couple of years I will consider using them.

The most important thing right now is improving and stabilizing the graphic system with Wayland and Mir.

</comment></comment></comment><comment><USER11> It's very apparent that XCOM (the game referenced in the article), even in the Steam version was very much designed for touch screen use. The game requires no continuous input or precise input that a keyboard + mouse would provide, and as such is ideal for tablet devices.

The same can't be said for most games. It's not really a case of steam directly making their library available to mobile audiences, it's the lack of appropriately designed content.

IMO most virtual joypad style games on mobile devices offer a terrible user experience, and the majority of touch input focussed games wouldn't be as successful for a PC gamer audience.

</comment><comment><USER12> The problem is the controls. There is a big difference between a touch screen and a keyboard/mouse. Unfortunately few mobile developers get this.

<comment><USER13> I think a lot of mobile developers "get it", it's just a very challenging problem to solve.

</comment></comment><comment><USER14> What could really knock this one out of the park is In-Home Streaming. Why buy an nVidia Shield and a high-end GTX graphics card when you can stream to the iPad you already have?

<comment><AUTHOR> Oh for sure, similar to the way OnLive were doing it. I'd call this feature a game changer.

Edit: added this to my blog post quoting you.

<comment><USER15> OnLive are still around. I fired it up to play Mafia II the other day.

</comment></comment></comment><comment><USER16> Apple would never allow this, it competes against their App Store, their Game Center, and would probably also fall under the rule against "app curation / collections" apps.

<comment><AUTHOR> So, I don't think Apple has a policy against social platforms within games. EA, for example, has Origin in FIFA. However, a custom Steam game store would only be possible on Android.

<comment><USER16> Ah okay. They used to have wording about not allowing functionality that "duplicates" built-in features...

</comment></comment></comment><comment><USER17> maybe this article should be: what if apple and google weren't draconian dicks with their app stores?

maybe valve and apple could reach some kind of agreement anyway, but the real blocker there i see is that steam fundamentally violates the app store requirements because apple don't want anyone to sell anything unless its through their app store.

google i'm less sure about, i'm not up to date with the latest dev requirements, but i suspect they have introduced similar things recently.

however... cross platform integration is something that developers can do anyway i don't see any reason why savegames can't be shared if the api is based on normal current network technology and is platform agnostic. an obvious example would be a rest api interface to a server for save games - such an api can be used identically across all platforms, although gamedevs might want something lower level and less filled with cruft than a TCP/IP connection with HTTP over the top, even those constraints aren't very prohibitive... UDP communications work fine across everything, and the good ol' BSD sockets/Winsock are easy to work with cross platform so long as you respect things like using network byte ordering and don't rely on exotic socket options.

</comment><comment><USER18> I think this has always been part of the plan. When encouraging people to port to Linux/Mac OS X they made reference to the fact that the work would translate to mobile too.

</comment><comment><USER19> What should be?

Humble Bundle is on mobile and it's not much different.

I can buy games, install and update them.

</comment><comment><USER20> Humble Bundle already have a head start on them in mobile.

</comment><comment><USER21> So would that let Steam compete against Game Center only or the whole App Store? Not that we couldn't use competition there, but Apple won't let that happen voluntarily.

<comment><AUTHOR> I definitely think they can compete against Game Center with this. I know I'd pick Steam over Game Center any day given that I game on my PC a lot. However, the App Store is a tricky one on iOS because of the restrictions Apple imposes. It's possible on Android. But on iOS maybe you'd have offers like get the promo code for the mobile version of the game via Humble Bundle or something? Not so sure.

</comment></comment><comment><USER22> What if folks developed better Game Center apps?

</comment><comment><USER23> A more plausible scenario has Google buying Valve/Steam and making a play for the Windows App market (and perhaps the Mac market as well).

<comment><USER24> That is not a plausible scenario at all. Gaben made it clear he's never going to sell out, and generally makes fun of people for suggesting it.

<comment><USER23> It's not like we haven't ever seen people swearing they won't sell out and then selling out later because of changing circumstances. When push comes to shove will he really lay off half of his employees?

Fundamentally Valve is two companies and Steam's chances of conquering the world and remaining independent don't seem great to me. Business today is great and they have many users who love them.

They are however, ultimately an extra middleman on an increasingly irrelevant platform that they don't control. They're also about to enter another market with fading relevance against established players with much deeper pockets. That's not a bet-the-company move but, if it's a mild initial success, it may spiral into something like it. That could be worse than if it flopped out of the gate as Valve may end up issuing lots of stock to support growth in the cutthroat console world, where the competition spends billions on subsidizing hardware, marketing and gaining exclusives and is also facing growing pressure from Android and iOS. Yes Steam has millions of avid fans today. Ask Sega, Nokia, RIM and others how long that lasts in the hardware world.</comment></comment></comment>


Consistent use of double or single quotes in HTML - <AUTHOR> https://labs.kollegorna.se/blog/2015/01/double-single-quotes-html/

<comment><USER2> It's nice to see pedantry validated, occasionally.

Still, this will invariably lead to a few arguments behind closed doors:

\- "We should obviously standardize on single quotes, since they're shorter than double quotes and save more space!"

\- "Our site serves up dozens of pageviews a day – let's spend the next week scrubbing our markup for consistency!"

\- "If you're using mixed quotes in your markup, you're Doing It Wrong!"

</comment><comment><USER3> So basically it comes down to insignificant performance and size boost. The reason for being able to mix them is so you don't need to escape quotes by using the alternative type.

I think consistency makes code look nicer and perhaps a bit more readable, but lets not kid ourselves that this leads to any meaningful improvements.

</comment><comment><USER4> Most of my HTML is generated by Perl so I am the opposite. Alls string vars at the Perl level are wrapped in double quotes in case interpolation is necessary. Attributes are wrapped in single quotes so my Perl code doesn't contain a bunch of \" patterns scattered throughout.

I totally agree about consistency though; I even take the minor performance hit when interpolation is unnecessary by using double quotes anyway so that all uses of double and single quotes are consistent

</comment><comment><USER5> I would view it as a "code smell" \- if you aren't concerned about mixed single/double quote usage, then what ELSE aren't you concerned about?

<comment><AUTHOR> [http://media0.giphy.com/media/WKhKazqZxORq0/200.gif](http://media0.giphy.com/media/WKhKazqZxORq0/200.gif)

</comment></comment><comment><USER6> The first thing that came to mind when reading the title of this post was Google Fonts. Maybe this is validation that I need to write that Chrome extension that comes to mind every time I'm copying that snippet.

<comment><AUTHOR> We've reached out to the Google Fonts team… [https://twitter.com/kollegorna/status/559728201514373120](https://twitter.com/kollegorna/status/559728201514373120)</comment></comment>


Why Static Websites Need HTTPS - <AUTHOR> https://www.troyhunt.com/heres-why-your-static-website-needs-https/ <comment><USER2> Let's Encrypt is one of the best things that happened to the web recently. I wish we had more choices though. Relying so much on a single party is unnerving.

<comment><USER3> Do we have conclusive evidence yet that LE is not a honey pot? I mean, if _I_ were the NSA...

<comment><USER4> It's a valid question, with two possible threat models:

1) the honeypot uses your private keys to MITM connections

Let's Encrypt doesn't handle your private keys. You generate them yourself, and submit a CRL to LE to get a cert issued. They have no knowledge of your private key.

2) the honeypot issues fake certs

Let's Encrypt submits a log of every cert issued, see [https://crt.sh/](https://crt.sh/) . To verify, it'd be pretty trivial to create a browser extension (if one doesn't exist already) that checks whether certs you encounter appear in the certificate log.

<comment><USER5> For CT the finished system involves browsers checking that the server can prove its certificates were logged (the ones you get from Let's Encrypt have such proof embedded) and periodically talking to Log Monitors (e.g. owned by your browser vendor) about proofs it has seen.

If somebody has seen a proof that is contradicted by the published log state this means the Logs involved are corrupt. If an otherwise authentic cert is shown without proofs or those proofs are bogus the cert may have been unlogged for nefarious reasons, it shouldn't be accepted and needs reporting

Chrome has the start of this, it checks for the proofs. Firefox is getting roughly the same feature "soon". But the finished system with all bells and whistles is probably a year or five away.

Good news is that even unfinished CT has been very effective.

</comment></comment></comment></comment><comment><USER6> When I read things like that, I always think of the paper "The Rational Rejection of Security Advice by Users". [1]

Yes, content injection is bad, but the chance of it happening multiplied by the damage it could cause to your users is probably less than the the effort required to shift a static blog site to HTTPS. (Do not underestimate the leap in difficulty from copy-pasting from an Nginx tutorial to understanding how Let's Encrypt works).

[1] [https://www.nspw.org/2009/proceedings/2009/nspw2009-herley.p...](https://www.nspw.org/2009/proceedings/2009/nspw2009-herley.pdf)

<comment><USER7> The other side I would pose is: do you want anyone to alter your responses? I'm currently trying to find the RFC, but I recall an ISP defining an RFC for tampering with HTTP responses in-transit. In addition, I also recall seeing Comcast (I believe) injecting JS to users that they are approaching their plan limits.

Obviously, not the end of the world. But do you want any third party to easily alter the response from your server to the client(s)?

<comment><USER8> I believe you're think RFC 6018: [https://tools.ietf.org/html/rfc6108](https://tools.ietf.org/html/rfc6108)

Related HN discussion: [https://news.ycombinator.com/item?id=15890551](https://news.ycombinator.com/item?id=15890551)

</comment></comment></comment><comment><USER9> Two stories.

Firstly, I had a fair amount of websites with a now EIG owned company for about 10 years. It was just a shared host, but they're all low traffic, and I could easily add a domain name and spin up a blog/project. A few years back I needed https for an API I was working with - the cost was something like $40 a year for the domain, for a project that wasn't a money spinner. So I found another (read: free) way to access the API.

Earlier this year I asked again. It was something like $20-$100 per domain to put an https cert in place, even if I got it myself from LetsEncrypt. As the entire package was about about $100 a year (up 30%, with worse customer service since EIG took over) I finally took the step and moved all my sites elsewhere. The new host isn't much more expensive, but provides free LetsEncrypt with a click from the controlpanel. I now use https on most things.

Secondly, I have a few sites with a decent number of FB likes that have counted up as the result of some viral/social campaigns in the past. None have forms on, all are links to elsewhere. Currently those likes work as (not insignificant) social proofing. Move the site from http to https and I lose the count on the Like button.

The cost in the first point (or the effort/time/cost in moving everything) just hadn't been worth it for the smaller stuff. Facebook not sorting the counts hasn't made it worth it in the second. I suspect my reasons are 2 of many that stop people from upgrading - I guess I'm just saying that even with the best intentions, there are other factors at play that prevent John Everyman from making the move. Make it easy/default for him, more https everywhere.

<comment><USER10> You can set up your apache/nginx or whatever webserver to redirect http requests to https. That way you can still link to your website with an [http://](http://) URL.

<comment><USER9> Appreciated, but this is a hacky solution. If you use the graph explorer, both the http and https addresses have different counts. It's very frustrating - shouldn't be that way.

<comment><USER11> Add your site to the HSTS Preload List, then it'll be very unlikely to have any HTTP hits.

<comment><USER9> Didn't realise that existed. Very useful thanks!

But again, it's not exactly up there for John Everyman - and it doesn't sort Facebook having different share counts for the https and http domain.

<comment><USER11> True. And you have to be extra careful with HSTS Preloading; if one of your subdomains breaks because of HTTPS, it'll be a pain to get your domain taken off the list.

</comment></comment></comment></comment></comment></comment><comment><USER12> And one reason it doesn't: [https://meyerweb.com/eric/thoughts/2018/08/07/securing- sites...](https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites-made- them-less-accessible/)

Secure websites make the web _less accessible_ for those who rely on metered satellite internet (and I'm sure plenty of other cases).

Know who your demographic is and make sure you don't make things more difficult for them. Maybe provide an option for users to access your static site on a separate insecure domain, clearly labeled as such.

<comment><USER5> Having very high packet loss means something is badly wrong. A good wire-level (yes I know, there are no wires, nevertheless) protocol aims to hit lower packet loss rates by fiddling with other parameters. Example: Let's say you have 40MHz of assigned frequencies, but when both ends measure they find 4MHz of that is full of noisy crap, the rest is fairly quiet. Well, rather than lose bits in those 4MHz and toss away many packets, why not keep 36MHz with a much lower error? If only 6000 packets per second get through of 10 000 sent, then an option to send 9000 and receive 8000 of them is already a win.

Now, upgrading satellites is trickier and more expensive than upgrading your home cable box, at the extreme obviously sending a bloke up to "swap out this board for a newer one" is either tremendously difficult or outright impossible depending on the orbital characteristics. But we shouldn't act as though high packet loss rates at the IP layer are to be expected, they are avoidable. And fixing them will do a lot more than just enable HTTPS to work better.

<comment><USER13> >But we shouldn't act as though high packet loss rates at the IP layer are to be expected, they are avoidable. And fixing them will do a lot more than just enable HTTPS to work better.

At that distance the very physical latency limit is almost a second. You can literally not go below. The high latency will have a lot of protocols simply time out or consider the packet lost.

At that distance you need some well engineered ground equipment to handle the signal losses. A dish and a high powered transmitter that need to be within a degree of the target. If you're off by a degree you're likely going to hit very bad packet loss. A degree is not much and you could be cause by the ground below stretching and twisting over the day due to temperature changes. TV doesn't have to deal with sending data up the link other than using the massively more powerful and expensive dishes from TV networks.

Lastly, from ground to geostationary orbit you may find that your 40MHz band is full of crap. Not because someone else is sending but because you're sending through a solid belt of radiation and magnetic flux. You'll find that for a wide range of bands they either suck at penetrating the atmosphere, penetrating the magnetic field or get sucked up by interference from half the universe.

The layers above IP have ways to handle packet loss for a reason (although the reason was bad copper cables and bad MAC). Also, the MAC is another problem; you're not the only one who wants to use the very limited resources of the sat. One of the most common and effective forms of bandwidth limiting is dropping packets and it's normal. Packets drop all the time, every TCP connection drops packets. It happens and almost all protocols deal with it on one level or another.

</comment></comment></comment><comment><USER14> If browsers supported a method to provide content securely without the need to encrypt everything, lots of uses of the web would not be hampered by the TLS- everything-that-moves movement. The limitations we have accepted in our browsers are what causes these conflicts. But we don't have to accept them. We could do with less propaganda and more compromise and innovation.

<comment><USER15> I'm unsure on how you could do what you've said without encryption. Any ideas?

<comment><USER16> Cryptographic verification?

<comment><USER15> Sure, but that would still leave the data open to the world. Not an alternative to TLS.

<comment><USER14> Most of the content on the web is intentionally open to the world.

<comment><USER15> But our personal data is not. So much data is potentially made available from an unencrypted HTTP request.

<comment><USER14> Nobody is saying that personal data should be unencrypted.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> the post is good.. but also: confidentiality matters.

Think about a library. There are no secrets in the stacks that need to be kept from public disclosure. What is secret is the act of using the library - i.e. what they choose to read.

</comment><comment><USER18> A big reason is that Chrome (and others?) specifically show 'Not Secure' for all sites not using https.

<comment><USER19> This is a massive reason, imo. The average user views that url annotation as a bad thing. They don't know it's static, or even what "static" refers to.

<comment><USER20> Even if they knew the site was static, "not secure" would still be valid. An ISP or malicious wifi network may be recording their browsing history, downsampling images, injecting or replacing ads, replacing executables with backdoored versions, adding fake login forms or popups to get the user to give a password of theirs, etc.

</comment></comment></comment><comment><USER21> Actually one service that DNS providers should offer is generating and renewing let's encrypt wildcard certificates automatically, and offering their clients to download them through some API. That would make life a lot easier for less technical devs who are intimidated by the complexity of pki.

</comment><comment><USER22> Github pages supports TLS even for custom domains now, via Let's Encrypt. At this point, I don't think there's any excuse anymore for having a static website without TLS. Either use Github pages, or just use your favorite hosting provider and put a CDN in front of it.

Note: I'm not affiliated to Github, but I've used them multiple times, and just recently discovered they now support TLS. If you want to see an example: [https://solokeys.com](https://solokeys.com) is hosted on Github pages.

<comment><USER23> As far as I know Github is the _only_ static site provider that will do this for you.

I'm scratching my head trying to figure out the best way to do automated certificate renewal for othe providers. It's not like you can run certbot on a static page.

<comment><USER24> > _As far as I know Github is the _only_ static site provider that will do > this for you._

Netlify automatically does this [1], and Zeit's Now too, I think [2].

[1] [https://www.netlify.com/docs/ssl/](https://www.netlify.com/docs/ssl/)

[2] [https://zeit.co/docs/examples/static](https://zeit.co/docs/examples/static)

</comment></comment></comment><comment><USER25> What if your website is only accessible for you from within your LAN? Such as your router, LAN, or your settopbox? If you have DHCP as well and don't control the DNS or don't have root (such as on IoT devices) then you cannot use Lets Encrypt. Or am I missing something?

<comment><USER26> I used to have a $75 netgear router at my house. I changed the local DHCP settings to give out a raspberry pi's internal as DNS. I run dnsmasq on the pi and resolve local hosts that way. Ever internal service in my house uses HTTPS and I have about a dozen.

<comment><USER27> Sorry this is a day late, but how do you get certificates for internal services? Do you manually trust them on each client? Or do you have a wildcard cert from a public server? Is there some cleaner way to manage internal HTTPS?

<comment><USER26> I resolve internal services as subdomains of a domain I own. I use a wildcard I get assigned on an EC2. I script an sftp upload of the a new cert every renewal to my main internal machine where it is shared via nfs. This is the simplest way I've found.

</comment></comment></comment></comment><comment><USER28> I feel like this article has been posted a dozen times already, but the "past" link is showing this as the only submission.

EDIT: Nevermind, I'm confusing it with similar discussions:

[https://news.ycombinator.com/item?id=17651652](https://news.ycombinator.com/item?id=17651652)

[https://news.ycombinator.com/item?id=17599022](https://news.ycombinator.com/item?id=17599022)

[https://news.ycombinator.com/item?id=17605973](https://news.ycombinator.com/item?id=17605973)

</comment><comment><USER13> There is one static webpage that I won't put HTTPS on; the dashboard of my pi.hole.

Though it's more of an architectural decision as it enables the DNS server to blackhole HTTPS more effectively (since it just gets a CONNREFUSED back).

Really, it's an exception to the rule and only because I can't ask my guests to install my pihole CA on their devices (many of which don't support that stuff anyway).

Well and there is that other website but the prime directive forbids that I mention it...

<comment><USER29> You can buy a domain name and do DNS auth. Requires no open ports and you'll get a trusted cert for that one Pi. I did it for mine (but with SNI verification).

<comment><USER13> Pi.hole, it's only local and there is a reason it doesn't open port 443 and only works on 80. On a local non-wireless LAN this is not a concern in my threatmodel.

</comment></comment></comment><comment><USER30> The drawback to use https everywhere is that a big company can't cache locally things that gets downloaded again and again from the network like OS and application updates, videos on the web, and so on

I think that we need an alternative to https, a protocol that guarantees only authentication (sing the packets, basically) and doesn:t encrypt content, you can verify that what you get is what the website owner intended (no mitm) and you can have a cache.

</comment><comment><USER31> I went there to see why and the only subhead I understood without searching was "HTTPS is easy". I gather, only HTTPS is easy nowadays :)

</comment><comment><USER32> Not security related, but for SEO having HTTPS will treat your website with more mercy in the storm of google searches

</comment><comment><USER33> How can I go about securing a server without a domain? Just a static IP? Let's Encrypt doesn't allow IPs and the owner doesn't care for a domain.

Context: small business with a web based application in a local server, all they need is to be able to access reports from their phone.

<comment><USER34> Self-signed certificate (or own CA and certificate signed by that). Buying a certificate for an IP is more expensive than a domain.

<comment><USER33> I've tried self-signed certificate somewhere else but it seems Chrome doesn't add the certificate permanently so every few days they get the "scary" not secure window again.

I'll try with my own CA.

<comment><USER35> Can I suggest registering a domain for $1, pointing that at the IP and using LetsEncrypt? Probably less effort in the long run.

</comment></comment></comment></comment><comment><USER36> I think that the argument that you can't trust ISPs is weak.. With HTTPS, you still need to trust certificate authorities. It is somewhat suspicious that Google suddenly decided to create their own Certificate Authority in 2017. Forcing every website to use HTTPS just reduces the pool of entities who are able to track and manipulate us and it gives a false sense of security.

There is no doubt that this change is designed to take power away from some entities and to put it in the hands of a few key players which Google trusts.

Also, the video created by the author is highly deceptive; the author makes it look like he has hacked the website itself; in reality, he has only intercepted the traffic to his own machine so in reality he has only modified his own view of the website; he hasn't actually hacked anything. I'm sure that the author is being intentionally deceptive; he knows exactly who the target audience for that video is and he knows exactly what it looks like.

<comment><USER20> Certificate authorities that participate in Certificate Transparency are forced to publish all certificates they issue, so site owners can tell if a fraudulent certificate for their own domain is ever generated. I think browsers are pushing for all CAs to adopt Certificate Transparency. This greatly reduces the power of malicious CAs.

</comment></comment><comment><USER37> All websites need onion/i2p addresses, not HTTPS.

</comment><comment><USER38> chrome://flags

Mark non-secure origins as non-secure

Disabled

</comment><comment><USER39> People here are bringing up the difficulty for a regular user to set up HTTPS.

I want to go one further: WHY does a regular user need to buy a human-readable domain name, maintain it, and pay for a hosting company to host on that domain?

It used to be worse - you had to have your own machine or use some crappy shared hosting service. Amazon figured out that letting people share managed virtual machine instances was good savings. That's now called "the cloud" but it's still under the control of some landlord - Amazon, DigitalOcean, etc.

Let's face it, the easiest thing we have today is some web based control panel by CPanel running on some host that charges $5/month or something.

It's 2018. Why don't we have something like MaidSAFE and Dat working yet? We should have:

      1) End to end encryption

      2) One giant, actually decentralized cloud composed of all nodes running the software

      3) Storing chunks of encrypted data using Kademlia DHT or similar

      4) Maybe even periodic churn on the back-end so you can'd find and collude with the servers hosting the chunks

      5) All underlying URLs would be non-human-readable and clients would display (possibly outdated) metadata like an icon and title (this metadata may change on the Web anyway). Storing and sharing could occur using QR codes, NFC bluetooth, Javascript variables, or anything else. For static files, the links could be content-addressable.

      6) All apps and data would be stored encrypted in the cloud and only decrypted at the edges. They would run on the clients only. Apps could also be distributed outside the cloud, but usually just via a link to a cloud URL.

      7) Communities would likewise be just regular users, rather than private enterprises running on privileged servers running some software like github is now. No more server side SaaS selling your data or epic hacks and breaches.

      8) Users would have private/public key pairs to auth with each community or friend. They would verify those relationships on side channels for extra security if needed (eg meet in person or deliver a code over SMS or phone). Identity and friend discovery across domains would be totally up to the user.

      9) Private keys would never leave devices and encryption keys would be rotated if a device is reported stolen by M of N of other devices.

      10) Push notifications would be done by shifting nodes at the edges, rather than by a centralized service like Apple or Google. In exchange for convenience, they can expose a user to surveillance and timing attacks.

No more waiting endlessly to be "online" in order to work in a SaaS document. The default for most apps is to work offline and sync with others later.

No central authorities, CAs or any crap like that. Everything is peer to peer. The only "downside" is the inability to type in a URL. Instead, you can use one or more indexes (read: search engines) some of which will let you type existing URLs, or something far more user friendly than that, to get to resources.

Domains and encryption key generation would be so cheap that anyone can have a domain for a community of any kind, or even just for collaborating on a document.

There won't any longer be a NEED for coupling domains to specific hardware somewhere, and third party private ownership/stewardship of user-submitted content would be far less of a foregone conclusion, fixing the power imbalance we have with the feudal lords on the Internet today.

Once built, this can easily support any applications from cryptocurrency to any group activities, media, resources etc.

If you are intrigued by this architecture, and want to learn more or possibly get involved, contact greg+qbix followed by @ qbix.com - we are BUILDING IT!

<comment><USER29> > I want to go one further: WHY does a regular user need to buy a human- > readable domain name, maintain it, and pay for a hosting company to host on > that domain?

Because there's no interest in that. Getting a domain name is already cheap and easy.

> Storing chunks of encrypted data using Kademlia DHT or similar [...]

I've yet to see any P2P system have low latency, high speed and high reliability.

> All underlying URLs would be non-human-readable and clients would display > (possibly outdated) metadata like an icon and title (this metadata may > change on the Web anyway). Storing and sharing could occur using QR codes, > NFC bluetooth, Javascript variables, or anything else. For static files, the > links could be content-addressable.

Why?

> The only "downside" is the inability to type in a URL.

Good luck saying to your friend the nice webstore you got your hoodie from is [insert non-readable non-pronounceable url].

> and third party private ownership/stewardship of user-submitted content > would be far less of a foregone conclusion

This is unacceptable for law enforcement

> If you are intrigued by this architecture, and want to learn more or > possibly get involved, contact greg+qbix followed by @ qbix.com - we are > BUILDING IT!

Oh this is an ad...

<comment><USER40> I'm not trying to advertise, but Beaker browser does a real good job of making p2p delivery transparent to the end user. It's probably slower than most sites in normal usage, but certainly acceptable speeds for static sites, and it performs better under the hug-of-death a site gets when posted on Hacker News. :)

Plus, it already has existing methods to map DNS records or servers to the p2p records, so I can access dat://beakerbrowser.com/ or dat://epa.hashbase.io/ and get it served across the p2p network or pull it up offline if I've viewed it before.

</comment></comment></comment><comment><USER41> I admin a number of different websites. The majority of them are static. I have forced https redirect on some of them. On others I do not.

The only benefit of https I perceive in the case of static public content is that ISPs cannot easily monitor which specific pages on my domains are being visited. With plain http they could.

I don't particularly care if people get MITM'ed when visiting my static sites. If they did so it generally is because they chose to use unsafe public access points ( wifi ). This extends to some degree to all forms of wifi since so many security forms in use on them can be easily broken.

My current understanding is that enterprise encryption using certs with wifi is still secure and cannot currently be broken.

The only other party would could do MITM against normal customers on their own home internet, while using wired connections, is, I believe, the ISP themselves. Random third parties cannot generally do so. If there is some plausible way they can do so I would like to hear it.

If your ISP is MITMing you, I think you have bigger problems then whether they change the content of my static site when you visit it. If they were, they could potentially target your initial download of your browser and downgrade to http to infect your browser so that you never realize after that that https is faked out...

I think there are caching benefits to using plain http. The primary one is so that your ISP can cache your static content and save internet bandwidth globally.

<comment><USER42> > generally is because they chose to use unsafe public access points

It sounds like you are penalizing users for not using a vpn or some other method when out of their homes. Yes, people can do that, but in 2018 having https on the sites you manage is a lot easier than asking every possible visitor to use a vpn. I hope you would reconsider and enable https on all the sites you are an admin.

> If your ISP is MITMing you, I think you have bigger problems then whether > they change the content of my static site when you visit it. If they were, > they could potentially target your initial download of your browser and > downgrade to http to infect your browser so that you never realize after > that that https is faked out...

They could, and maybe in countries other than the US you have plenty of ISP choices, but in many places in the US, you are stuck with just one ISP.

And so far, we know that ISPs are manipulating http traffic but so far they haven't gone all the way to give you an infected browser. Again, it is possible, but I think that a better approach is if we all do as much as we can to help each other, the internet could be a better place.

<comment><USER43> It's all good to point this out, but it's a social argument, not a technical one. If the technical arguments have been eliminated (e.g. you have no technical use for encrypting the connection) then you're left with "Join us in giving the finger to ISPs/cafe routers that inject foreign JS!" Don't be upset when people say "Meh. Take it up with those ISPs directly, or with web browser vendors, I don't care and don't want to join your crusade." At some point web browsers will stop serving content over HTTP unless perhaps with a custom flag turned on, and even then, some people will still not use HTTPS.

</comment></comment></comment><comment><USER44> Here's the truth about security: people are clueless about it and so corporations and governments abuse that by pushing their own agendas, not related to security.

Same corporations that tell you to "secure" your unimportant static website with https also want to force you to run random javascript in your browser from unknown parties, identify you at all times, link everything to your phone number, etc. In the end we are all going to be worse off with this let's encrypted web, with more control than ever in the hands of those few US corporations.

<comment> yjftsjthsd-h How are those related? Letsencrypt doesn't try to identify anyone, and certainly doesn't run JavaScript on your site.

<comment><USER36> I wonder what would happen if Let's Encrypt started charging for their service AFTER HTTPS became compulsory. Seems like a great (but evil) business strategy. All these CAs could just start increasing their prices and we'd all be forced to pay.

If you understand human behavior, then you know that this WILL happen eventually.

<comment><USER5> This might even make sense as "a great (but evil) business strategy" except Let's Encrypt isn't a business, it's provided by a charity, ISRG, the Internet Security Research Group, set up for exactly this purpose by people from Mozilla (a charity) and the EFF (another charity)

I suspect that the people behind ISRG weren't as paranoid as the Free Software Foundation about being corrupted by some hypothetical evildoers (the FSF has a whole mechanism to try to ensure that if you somehow take over the Foundation you can't use its resources to counter its original purpose) but you're going to need a bit more than a vague idea that people are capable of evil as an explanation for why good things are actually not good.

<comment><USER45> I don't know who has what legal remedies when a nonprofit acts inappropriately, but another observation is that most of Let's Encrypt's technology is developed in public.

[https://github.com/letsencrypt](https://github.com/letsencrypt)

If you needed to set up another ACME-compatible CA on the same model (which could then be a drop-in replacement compatible with the existing client base), it would be a lot less expensive (although it would require datacenter build- out, hiring an operations team, and a variety of PKI-specific stuff like key ceremonies, HSMs, cross-signing, CPS, and audits).

</comment></comment></comment></comment></comment><comment><USER46> Why wouldn't you? It took me 30 mins to read and set up a cert from let's encrypt.

<comment><USER18> Don't underestimate the weight of decisions, let alone the knowledge of a choice, and the care.

Also, see how often humans don't change from default settings -- ringtones, bootstrap themes, etc..

</comment></comment><comment><USER47> I have recently adopted HTTPS on my own site, because there are substantial performance benefits with HTTP/2 that are only available over HTTPS.

There are many arguments in the article, and more that he links to, arguing for the security benefits of HTTPS. HTTPS is good for protecting content.

One very serious argument that HTTPS evangelists avoid is when there is no content to protect the security benefits of HTTPS evaporate. My site is a web application that stores all user data in their browser. Their data does not come back to the server. The only thing that crosses the wire is a request for the application code and a response with that code.

I would argue this model of application is substantially more secure that sending data across the wire regardless of whether that transmission is encrypted. There is nothing individually identifiable or preferential about the application code. The content, identifiable information, and personal/private details remain with the user where they reside anyways.

\---

EDIT

Before everybody jumps on the MITM attack bandwagon be aware of [https://en.wikipedia.org/wiki/Same- origin_policy](https://en.wikipedia.org/wiki/Same-origin_policy)

A man in the middle attack can void the integrity of data crossing the wire, but it cannot trivially break privacy with simple modifications to code. This is by design in the architecture of the web.

The only violation in question is code integrity (availability portion of the security CIA triad). Fortunately, this is a solved problem so long as the application is open source. If an integrity violation occurs that renders the application defective simply compare the transmitted application code against the stored publicly available application code. This is made easier when the application in question is a diff tool that can fetch code from across the wire.

<comment><USER48> > One very serious argument that HTTPS evangelists avoid is when there is no > content to protect the security benefits of HTTPS evaporate. My site is a > web application that stores all user data in their browser. Their data does > not come back to the server. The only thing that crosses the wire is a > request for the application code and a response with that code. I would > argue this model of application is substantially more secure that sending > data across the wire regardless of whether that transmission is encrypted.

That's a case where HTTPS really is essential! If you serve your application code over HTTP, then I can MiTM that connection and replace your application code with something that reads all the user data from the user's browser and then sends it to evil.com.

<comment><USER47> No. [https://en.wikipedia.org/wiki/Same- origin_policy](https://en.wikipedia.org/wiki/Same-origin_policy)

<comment><USER20> If evil.com serves the proper CORS headers, then any site is allowed to make AJAX calls to it.

Also, the attacker could inject <img> tags with a src attribute pointing to "[https://evil.com?userdata=..."](https://evil.com?userdata=...").

Also, if the attacker is already man-in-the-middle attacking yoursite.com, they could make the site's code make ajax calls to "yoursite.com/nothing-to- see-here". Users looking at the network requests may not notice anything is going on.

<comment><USER47> CORS requires an HTTP header white listing allowed domains. If the attacker can modify the HTTP headers they don't need to modify the HTTP body in order to perform an attack.

> Also, the attacker could inject <img> tags

First, the image needs to be requested using the same protocol that requested the page or it will notify the user of insecure assets. Second, but they would have to write a custom script to gather the data to append as the URI query string. Third, the image would need to be injected after the user has manually entered information to the site, which eliminates static images in the HTML source. Fourth, actually test this. When I test it I get a CORS error in the browser. Strangely, Chrome reports this as a warning instead of as an error, but the request is blocked and it never leaves the browser.

> Also, if the attacker is already man-in-the-middle attacking yoursite.com, > they could make the site's code make ajax calls to

No, that is not allowed by the browser and will throw an error. It violates same origin policy. If you can figure out how to break same origin policy Google will pay you $5000 for reporting a significant issue to their bug bounty.

<comment><USER20> >CORS requires an HTTP header white listing allowed domains. If the attacker can modify the HTTP headers they don't need to modify the HTTP body in order to perform an attack.

The attacker owns evil.com. They can make it have any headers they want, and then javascript on yoursite.com or any other site is allowed to make ajax requests to it. (Of course, they'd still need to do a man-in-the-middle attack on yoursite.com to modify yoursite.com's javascript. They technically don't need to involve evil.com if they're MITMing yoursite.com as I mentioned at the end of my post above, but it is a technically possible thing for them to do.)

> First, the image needs to be requested using the same protocol that > requested the page or it will notify the user of insecure assets.

The attacker can make evil.com use HTTPS if they need to. There's no restrictions stopping attackers from getting certificates for their own domains. HTTPS doesn't signify that the owner of the domain is trustworthy; it just signifies that the contents you receive from a URL weren't MITMed.

> Fourth, actually test this. When I test it I get a CORS error in the > browser. Strangely, Chrome reports this as a warning instead of as an error, > but the request is blocked and it never leaves the browser.

Did you test this on HN? HN uses an unusually restrictive Content-Security- Policy header to restrict where assets can be loaded from. It is a protection against this sort of attack, but only a weak one against a determined attacker who can manipulate page javascript or html: An attacker could make every element on the page be a link to evil.com?userdata=..., which a lot of users will probably click. The user might realize something is up, but the attacker has already gotten their data so it's a bad consolation prize. Also, in the specific case of MITM attacks, CSP is no help since an attacker can just strip the header off.

>No, that is not allowed by the browser and will throw an error. It violates same origin policy. If you can figure out how to break same origin policy Google will pay you $5000 for reporting a significant issue to their bug bounty.

(I don't mean to brag, but just to point out a possibly relevant credential: I have gotten a 4-digit bug bounty payment from Google before.)

If an attacker MITMs yoursite.com and modifies the javascript served by yoursite.com, then when a user navigates to yoursite.com, that javascript is allowed to connect to yoursite.com (or any domain that is served with CORS headers). The same origin policy is about preventing a domain from accessing domains that don't want to be accessed; it is not about preventing a domain from talking to anyone at all including itself. (Content-Security-Policy does focus on that, but it can be difficult to make bulletproof and should be treated as a defense-in-depth, and it's not relevant to MITM attacks at all since a MITM can just strip it.)

<comment><USER47> > The attacker owns evil.com. They can make it have any headers they want, and > then javascript on yoursite.com or any other site is allowed to make ajax > requests to it.

Only if the page is originally requested from evil.com or if evil.com is listed in the CORS http header from the legitimate domain.

In order for this attack to work evil.com needs to be added to the CORS list in the http header and JavaScript needs to be inserted into the page body to make XHR calls to the evil.com domain.

> Did you test this on HN?

I tested it on a couple of sites both with http and https. It is not a valid vector of attack. Don't take my word for it. Try it.

\---

All these technical conversations are really a red herring based upon the untested assumption that modification of page traffic is trivial if the page is served over HTTP. While this is possible it isn't trivial and requires multiple stages of compromise.

Typically man in the middle attacks refer to encrypted traffic, such as HTTPS, instead of plain text traffic. The benefit of a man in the middle attack is that the attacker is in the encrypted tunnel between the two end points reading data that is otherwise encrypted and thereby voiding any benefit of encryption.

Modifying traffic is less trivial than reading traffic. It is certainly less valuable when there are security conventions in place to ensure end point authenticity, as in limited to only locations that are available by address and policy.

> I don't mean to brag, but just to point out a possibly relevant credential:

Don't care. I myself have found and reported a critical flaw in V8 that broke recursive function access under certain conditions. I don't remember when the resolution was released to V8, but it was first available to Node with 4.2.4 on 2015-12-23. All prior versions of V8 were impacted.

> If an attacker MITMs yoursite.com and modifies the javascript

And how would you do that? I have not seen anybody prove they can both MiTM a production site and modify the data in a way that breaks same origin policy yet everybody says its trivial. If you really want to brag and get another 4 digit bug bounty then prove that.

<comment><USER49> _if evil.com is listed in the CORS http header from the legitimate domain._

That's not how CORS works; the header is read from the domain being called from JavaScript, not from the domain where the JavaScript came from. So in this case, the injected JS will call evil.com, and so the CORS headers will be read from evil.com.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER50> I'm going to sorta break the prime directive and link the n-gate rebuttal to these articles: [http://archive.fo/xcQ5j](http://archive.fo/xcQ5j)

Its a bit heavy-handed, but it does bring up a good point: A lot of this argument for HTTPS-by-default is all on top of assumptions about who is responsible for data security. We're doing a lot and things are improving, but the general public still are all yelling at websites for misusing data that we willingly gave over in the first place [0].

[0]:[https://xkcd.com/743/](https://xkcd.com/743/)

<comment><USER51> > assumptions about who is responsible for data security.

The chief assumption appears to be "anyone but the browser vendors". Let us consult the article:

      BeEF
      This, to me, was the most impactful demo

Quite the endorsement. So what's BeEF's angle?

"...examines exploitability within the context of the one open door: the web browser."

There could hardly be a clearer expression of contempt for the browser vendors' offerings. But remember, the "open door" is nothing to do with them, it's all your fault for not serving via HTTPS.

Welcome to Clown World.

<comment><USER52> Eh, there are two execution contexts here.

1\. The web browser executing the injected data stream it receives from the remote computer.

2\. Your brain interpreting 'non-executable' instructions as received from your browser.

Browser security has nothing to do with me going to 'xyz.com', which is the trusted website for xyz company, and being fed a MiTM telling me to go to a bad phone number for support.</comment></comment></comment>


Show HN: Automated payroll service for Indian startups - <AUTHOR> https://www.opfin.com <comment><AUTHOR> I am Anuj, the founder of Opfin. Here is the gist of Opfin -

There is plenty of software available in the Indian market to calculate payroll. Such software will typically output how much employees need to be paid, and other deductions like income tax, provident fund, professional tax, ESI etc. The execution is left up to the business owner.

Opfin's USP is that we _execute_ the entire payroll as well. So we pay all the employee's directly though bank transfers, and pay TDS, PF, PT, ESI on behalf of the company so that the company is entirely covered from all legal and compliance aspects.

Apart from basic payroll, we also take care of contractor and vendor payments, reimbursements, employee documents and leave & attendance.

<comment><USER2> Can you make it easy to get payments from other companies (the other end of vendor payments) ?

<comment><AUTHOR> Sorry, our focus is completely on payroll.

</comment></comment></comment><comment><USER3> Congrats on the launch!

A nitpick, you could say we charge 100 Rupees per employee for firms with less than XX employees and for other small, large business contact us for enterprise pricing.

Good Luck :)

</comment><comment><USER4> Congratulations on Launch. My recommendation will be to make it free for companies less than 5 employees

</comment><comment><USER5> Congratulations on the launch. Do you need a relationship with a specific bank?

</comment><comment><USER6> Maybe, You should use another shade of blue.

<comment><USER7> Why? It's gorgeous.</comment></comment>


Exercise suppresses appetite by affecting appetite hormones - <AUTHOR> http://esciencenews.com/articles/2008/12/11/exercise.suppresses.appetite.affecting.appetite.hormones

<comment><USER3> This is definitely true for me. The only times I've been able to control my appetite are when I regularly do aerobic exercise. When I'm not regularly exercising I have no power whatsoever over my appetite. When I am, I lose my taste for unhealthy food and naturally get portion control.

</comment><comment><USER4> I've know this for a while (but I obviously did not know the mechanisms).

When I have an intense Brazilian Jiu-Jitsu practice, it takes an hour or more for me to get my appetite back - despite my knowledge that I need calories. But after lifting I am famished, and I have a protein shake immediately after getting home just so that I can cool down and shower before eating.

</comment><comment><USER5> I don't believe this. An hour after running a half-marathon or greater I am basically inhaling food. Every other running I know is the same.

Plus I don't know what kinds of weights they were lifting for 90 minutes. 20-30 minutes is more like it for a real workout (see Mike Mentzer, Stuart McRobert, Dorian Yates etc for references).

<comment><AUTHOR> > An hour after running a half-marathon or greater I am basically inhaling > food.

I don't think the article disagrees with you:

> The [appetite suppression] the researchers observed were short term for both > types of exercise, lasting about two hours, including the time spent > exercising, Stensel reported.

<comment><USER5> Ah, including exercise time, missed that bit! :-)

</comment></comment></comment><comment><USER6> What is the reason the body does this? Is it just a side effect, or has it evolved that way?

<comment><USER4> My guess is that strength training sends the message "we need more muscle mass" to the body. More muscle mass requires more calories.

On the other hand, aerobic activities are inhibited by excess mass - <USER2> muscle mass. So the other side is, my guess, aerobic activity sends the message "we need less mass, fat and muscle." Decreasing appetite will result in a smaller person.

</comment></comment><comment> old-gregg Is this yc.news or a general American phenomena? How come stories about food and fat routinely get voted up? Hey, there are plenty of other, more interesting organs in your bodies, stop being obsessed with your digestive tracts - that's disgusting. BTW is that true that in California they're starting to do butt-hole bleaching? I am tired of waiting for a yc.news article confirming this...

<comment><USER7> Because diet and exercise are two of the most obvious ways you can control or "hack" your body. Therefore, they are interesting and voted up.

Though I don't think this particular article has anything to do with diet. It's just an interesting, counterintuitive discovery. I would have thought that exercise in general made you hungrier, but apparently it doesn't. See? That's interesting.

To your last point. I'm from California. We don't.</comment></comment>


Tell HN: Saved links now keeps going and going (1000+) - <AUTHOR>

I've always wanted to have a database of all the links that I've saved (upvoted) on News.YC. Frequently, I've remembered a story that was relevant to some real-world discussion and sometimes have had trouble finding the elusive story even using search.
I clicked back to around my 1000th saved link before getting tired (no script - saving all the links using Safari save as - web archive) and it looks like it keeps on going (for the time being).
Thanks PG for implementing my most-requested but never requested feature! <comment><USER2> Folders/categories/tags would be a helpful addition.</comment>


Ask HN: Where can I find a kick ass coffee mug. - <AUTHOR>

Like many people, I use and rely on my coffee mug everyday. It sits on my desk all day long and provides essential liquid goodness. But the mug is bland. For such an essential piece of equipment it would be nice to have something to be proud of. Where can I find a really kick ass coffee mug? <comment><USER2> The two coolest are:

[http://www.veer.com/products/merchdetail.aspx?image=VPR00054...](http://www.veer.com/products/merchdetail.aspx?image=VPR0005470) \- which is for the font-a-holics and shows Helvetica on the side in Light, Regular, Bold and Black (get it?)

[http://www.coroflot.com/public/individual_file.asp?sort_by=1...](http://www.coroflot.com/public/individual_file.asp?sort_by=1&portfolio_id=201846&individual_id=56170) \- which includes a shaped key and hole to make sure nobody can steal your cup unless they enjoy a lap full of coffee (and who doesn't?)

</comment><comment><USER3> Try poking around Etsy a bit. A quick search for "coffee mug" gets over 1400 hits, many of those being handmade, one-of-a-kind pieces. Quality and style varies a lot, but you're likely to find a few that pique your interest if you spend some time paging through the results.

[http://www.etsy.com/search_results.php?search_query=coffee+m...](http://www.etsy.com/search_results.php?search_query=coffee+mug)

</comment><comment><USER4> I'm stoked on my Klean Kanteen Wide Insulated [http://www.kleankanteen.com/products/insulated/klean- kanteen...](http://www.kleankanteen.com/products/insulated/klean-kanteen- insulated.html)

I brew at home or stop by a coffee shop on the ride into the office and fill it up. It's completely spill-proof so I can confidently stuff it in my bag with my laptop.

</comment><comment><USER5> I'm a proud owner of an "I like my coffee like I like my coffee... recursive" mug from Toothpaste for Dinner: $9

<http://www.sharingmachine.com/booksmisc.php?item=31>

</comment><comment><USER6> I picked up a plain white mug from a Le Creuset outlet store a couple years ago. It may not look like much, but you could tie a rope to the handle and use it as a handy melee weapon, it's so solid.

</comment><comment><USER7> I'm making my own typeface mugs, via a national photo company. They allow printing "photos" on cups, so I'm making simple typeface mugs in different typefaces.

</comment><comment><USER8> <http://www.thinkgeek.com/homeoffice/mugs/>

</comment><comment><USER9> If you're feeling DIY, any classic xkcd comic could be printed and etched onto yer mug :-)

</comment><comment><AUTHOR> "I Am Not a Paper Cup" by Decor Craft is great.

</comment><comment><USER10> computer history museum has a mug w/ an image of the babbage difference engine on it!</comment>


Show HN: Hacker News Clone Built with Aurelia - <AUTHOR> https://github.com/MikeBull94/aurelia-hacker-news#readme <comment><USER2> Nice work, Mike.

How do you like working in Aurelia?

I've been doing a lot of work in React, and while I like it a lot, there's a lot of churn in the ecosystem, and I sometimes get a bit worn down by having to cobble applications together from lots of small pieces. I'm starting to lean a bit more toward things like Angular 2 and Ember that are a bit more opinionated.

I haven't tried Aurelia yet, but it looks like it is somewhat opinionated and relies on convention over configuration to a certain extent. Is that a fair assessment?

<comment><AUTHOR> Thanks a lot!

Aurelia is a really great framework, I just hope it gets more traction as others have recently. My first experience with frontend frameworks was Angular 1.x, but transitioning to Angular 2 just didn't feel right. I've also tried projects in React & Vue, but neither seem as well-rounded and feature-rich as Aurelia.

You're right in your assumptions of Aurelia, Angular 2, Ember all being opinionated, however I think the "opinions" are often different in Aurelia's approach. They are putting a strong emphasis on adopting existing and emerging web standards (their custom element/attribute stuff is all following the web components standard), which I can see helping to fight against the fatigue that lots of people face with the 'flavour of the month' framework, as it'll no longer be what a team of developers thought was best at the time and will be the opinions of a standardisation team that has no vested interest in the framework itself.

<comment><USER2> Thanks for the insight!

It sounds like I'll have to give Aurelia a try.

</comment></comment></comment><comment><USER3> This is awesome. Very interested in Aurelia at the moment. How long have you been using Aurelia and how comfortable do you feel with it? I'm coming from an Angular and Vue background. Anything that might give me a hard time picking it up?

<comment><AUTHOR> Thanks very much. I've been using it for a few months now, various closed source projects and finally found a good idea to open-source and demonstrate what I've learned.

Coming from Angular 1.x is a very natural progression (and TypeScript makes you wonder how you survived with ES5...). I briefly tried Vue and was not at all keen on shoving logic & presentation markup all in one file.

The only thing I've found troublesome is how spread the modules are. The router, the templating, etc is all separate from the framework - which is obviously good design but leaves you to piece together the bits you actually need yourself. Other than that the standard things like DI, Routing, Custom elements, are all implemented to an amazing standard by the Aurelia team.

</comment></comment><comment><USER4> This is great. I like it a lot. This is a great sample app to learn Aurelia.</comment>


Introducing Trello Business Class - <AUTHOR> http://blog.trello.com/introducing-business-class/ <comment><USER3> I developed a similar product over the last few years (<http://www.thetaboard.com>) and have been waiting to see how the FogCreek guys were going to monetize Trello. I had resigned to leaving my product as free in the face of such a free, strong market leader. Now that Trello has established a price/feature point, I'm tempted to to crank out some features and see if I can't monetize it.

Trello have been pretty transparent that they would eventually offer some sort of _premium_ package in the future but they kept adding so many _free_ features that it was getting harder to imagine what kind of features they could actually charge for. The features they are charging here are nice but they aren't real game changers and I thought they had already offered some of them (data export, Google integration).

All that being said, I think Trello is a great product and I'm sure they'll pay for more than a few nights at the pub with this new revenue stream!

<comment><USER4> Regardless of Trello's pricing plan, I think you should and have the opportunity to charge.

1) even though everyone on HN seems to, not everyone in the world knows about Trello.

2) Trello isn't your only competitor. The most popular online project management tool in the traditional, offline world is probably Basecamp. They charge (and make a killing).

3) many people who do know about Trello don't want to use it for one reason or another. Before today the biggest reason I saw was their lack of a monetization strategy, but there are still likely a good number of folks on HN who want something similar but aren't satisfied with Trello.

One potential route for you to take, that I've noticed any time Trello comes up here, is to offer customers installation of ThetaBoard on their own servers.

<comment><USER5> Perhaps make it more specific? Trello for ___ ?

<comment><USER6> This is the route I'm taking at ClinchPad (<http://www.clinchpad.com>) which is basically Trello for Sales. It was originally inspired by Trello. :)

<comment><USER7> looks neat. is it doing well?

<comment><USER6> Yes, I'm pretty happy with the progress so far! :)

</comment></comment></comment></comment></comment></comment><comment><USER8> Mmm, Trello. It's the ONLY software Kanban implementation I've used that's worth a crap. All the rest either feel like broken toys, or suffer from feeping creaturitis, or both.

Note to other Kanban software developers... features suck. "Features" are the antithesis of Kanban.

That said, though, even Trello isn't as good as a board with Post-It notes attached. Its only real advantage is that Trello is portable.

<comment><USER9> A big part of Kanban is Work-In-Progress (WIP) limits on columns - <USER2> that most tools leave out.

It is a pain in the butt when a column is at the WIP limit - but that is kind of the point. It forces you to help move blockages before overloading a column.

<comment><USER10> Blossom.io does this and is similar in functionality to trello. I was using it for a few weeks on their early adopter $9/mo plan but got tired of having to reload the app a dozen times a day when they pushed new versions.

<comment><USER11> Thanks a lot for the mention (Blossom co-founder here). We care a lot about keeping things simple while encouraging a great Kanban experience (including WIP limits, cycle time, …). I think of Blossom as the minimum viable Kanban experience with emphasis on the philosophy, not the 'features'.

Too many people building project management tools don't realize that features often just support anti-patterns and having more of them doesn't help.

I believe people building software _tools_ should internalize that a huge part of providing a good solution is helping people get better at their craft & day to day on top of providing the software itself :)

</comment></comment></comment></comment><comment><USER12> If they included some kind of offline support, I would pay $200 in a heartbeat.

I often have work that I do offline, and I disconnect the internet so as to avoid having to use willpower to stay away from the internet.

I'm sure they're aware it would be useful, but concluded the number of users it would apply to doesn't justify the effort. But, in case they're considering offline support, wanted to add my anecdote.

I don't necessarily need to access all my boards and cards while offline, I'd like like to be able to add cards or modify cards I had open without losing those changes.

<comment><USER13> Trello works in offline mode. Just create cards or edit existing ones and it gets uploaded when you have an Internet connection. Tried it today and it just works.

<comment><USER12> Oh, is this a recent change? The last time I tried, it had a message along the lines of 'connection down, changes you make now may not be saved'

And then some of the changes were not saved, I tested.

<comment><USER14> Trello does not support offline operation. It may work sometimes but offline sync is not a feature of any of the official clients.

</comment></comment></comment></comment><comment><USER15> I'm curious why they priced the ceiling at just $200/year for organizations, no matter how large.

Are they targeting smaller businesses?

<comment><USER16> Can be put on someone's corporate card w/o budget approval. Dramatically cuts down red tape, so dramatically increases the number of corps that will readily sign up.

<comment><USER17> Not to mention different teams _within_ a corporation will probably have their own accounts due to communication issues.

</comment></comment></comment><comment><USER18> Love using Trello at work, and this makes it even better.

My one gripe (that many people have) is the lack of built-in metrics/analytics on progress. You can hack it together with a combination of the Trello Scrum extension and their API, but it would be great to have it built-in (and something I would pay for).

<comment><USER19> There is a full-featured API... it shouldn't be too hard to code up some open- source (or even paid) apps that pull stats out of Trello...

<comment><USER18> Totally agree. It wouldn't be too hard for someone to build a lightweight frontend to their API with a d3/raphael charting capability.

<comment><USER20> I would happily build this, but I'm not currently a heavy Trello user. Are you envisioning a browser plug-in or a separate site? What sort of stats would you want to see?

</comment></comment></comment></comment><comment><USER21> I was hoping this would be an announcement about self-hosting, but alas... That's still the barrier-to-entry for the company I work for; can't use any "cloud" products. JIRA is just so painfully bloated.

<comment><USER22> Knowing what I do about Fog Creek (which includes no specific information on this particular question) I would very much doubt they would ever do that. The support costs for self hosting are just too high to justify the expense. Often these costs come in more than a support tech's time, as certain problems require code base changes to fix.

Do you have some sort of governmental regulation that keeps you from using hosted products?

<comment><USER23> Even secrecy-minded orgs like the CIA are moving apps to these platforms. Typically a regulation won't say "no cloud", but e.g. FISMA would require an online infrastructure to pass certain third-party assessments.

</comment></comment></comment><comment><USER24> This is a great move by Fog Creek! $20/month is so cheap that I can consider getting Trello Business Class without much thinking.

As opposed to Asana, where I try to stay within the limits of the free offering, because their cheapest paid offering is still expensive at $100/month ( <http://asana.com/product#pricing> ).

<comment><USER25> We (Asana) just introduced a cheaper tier today: <http://asana.com/pricing> for $50

<comment><USER24> Wait, did you just reduce the max number of free members from 30 to 15, and start charging $50/month for 15-30 members. Something that was free till now. That's definitely not the right way to respond to the Trello announcement.

</comment></comment></comment><comment><USER26> We've been working on www.kanbanpad.com for a while (before Trello). If you're looking for an alternative check us out. We are free.

</comment><comment><USER27> Perfect timing. I was looking to make a recommendation to move away from a current method of maintaining a Google Docs spreadsheet as a project tracker (not good). I really wanted to suggest something simple like Trello (which I use a ton internally at my own business).

</comment><comment><USER28> My congratulations to the Trello team. They are doing a great job there.

I am surprised they decided to monetize Trello that way rather than selling Power-ups (add module like time tracking to your boards), they would be able to reach a broader market.

Because I run a product that takes some inspiration from the Trello UI (<http://weekplan.net>), I find it interesting to follow how they monetize Trello. I went with the freemium model with a paid plan (like Evernote) because I want to enjoy the free marketing I get from my free users and it is working ok for me at the moment. I am itching to go the "X weeks trial then have to pay" route as an experiment though as everyone is doing that these days.

<comment><USER29> That's what they are doing. This is the first power-up.

</comment></comment><comment><USER30> Is there currently a way to get bulk data out of Trello using the API?

<comment><USER3> If you append .json to the URL of a Board you can download it as json. Not really an answer to your question but...

<comment><USER30> I did not know that, and it definitely helps! Thank you.

</comment></comment></comment><comment><USER31> Hoping that they publish some registration numbers after the Business plan has been around for a little bit, interested to see how many people will opt to pay.

Now, the really interesting question will be how much time do they spend adding free versus business features in the coming months? Does free start to get no new features? What makes a feature a business feature over a free feature?

EDIT - Removed my surprise about no backlash since I am geting negative points for it.

<comment><USER32> Joel wrote a blog post* today about the introduction of Business Class. He says:

"In the future we'll continue to add free features to Trello (there is a lot of exciting stuff in the hopper)—anything that is a common feature, useful to anyone, will be free. We'll also continue to develop new Business Class features that help large organizations manage Trello, and we may come up with other things to sell to people who are getting a lot of value out of Trello. "

* <http://www.joelonsoftware.com/items/2013/04/30.html>

<comment><USER31> I read the post and it doesn't mention the split. It's great that they have more features to dev and I am sure FogCreek will do right by its customers. The point I am interested in though is how they will now balance their time between the feature sets.</comment></comment></comment>