Introducing 1Password for Teams - <AUTHOR> https://blog.agilebits.com/2015/11/03/introducing-1password-for-teams/ <comment><USER3> Maybe I'll be the only 1Password fanboy in here. I use 1pw personally and LastPass for work (shared between team of a dozen or so technicians).

To compare the two - 1pw is basically one of my favorite programs. LastPass is um... adequate? We have a lot of items in our LastPass vault and anytime we search it, add or change an item there is a 5-10 second lag. This according to LastPass support is unavoidable. Something to do with each item being individually encrypted/decrypted each time.

In anycase if 1Password for Teams is half as good 1Password I assume it will blow LastPass out of the water. And my experience with the Agilebits team gives me confidence that they'll work on actually improving the product instead of just looking for an exit.

<comment><USER4> Unfortunately 1pw is absolutely terrible on Android. So I was forced to switch to Lastpass even though 1pw is generally superior because I need something that works on all my devices.

<comment><USER5> Hi!

What were the issues you had with the Android application?

Feedback is most certainly welcome here so we can try to focus our attention on the areas that are seeing the most sad faces from our users.

Thanks!

Kyle

AgileBits

<comment><USER6> Specific Android issues: \- The Android keyboard doesn't autofill fields - <USER2> ios I could use the share extension and it would attempt to autofill \- the search is hidden behind a menu and isn't present at all in the opening screen - have to go into a category \- search is broken - doesn't return a list of searched for items as the ios one does, it displays suggestions instead \- if I click on a search result and go back to select a search result I have to search again \- design is dated. The ios app looks great the Android one looks really old and dated even compared against last years apps

Overall seems to be a low effort app. Not worth the money I paid for it. Considering switching to an alternative which is more Android friendly despite having laid almost a hundred bucks for ios and Mac apps.

<comment><USER5> Sorry to hear that you're unhappy with it. I think you'll be happy with the progress when you see the next updates. There's some work being done to modernize the interface and some of your list will be tackled by that. I would encourage you to take a look at my other comment in this particular tree of comments about Android. It might offer some perspective, not that it's an excuse but it explains things a bit more and might just help in understanding.

We really do want everyone to love our Android application. Personally, I feel they've made great strides given the time they've had. It's just a matter of time and our Android application will be right up there with our iOS application. We have some super smart people working on it and they're very passionate about what they do. I can't help but be inspired by a group of people who fight tooth and nail to catch up to a product that's much older (our iOS application).

I showed your comment to our Android developers so they've seen what you're requesting :)

Thanks!

Kyle

AgileBits

<comment><USER6> Thanks for the detailed reply. I do like 1Pw - it is so very well thought out on mac and ios that I expected something similar on the android side too. Good to see it is being worked on and will hopefully become a first class app alongside your other apps.

<comment><USER5> My Pleasure. I certainly hope it gets there sooner rather than later but it will get there :)

Kyle

AgileBits

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Interesting - lack of active directory integration, and lack of on-prem solution is disappointing though.

Edit: since someone is apparently upset over my comment - those two features are absolutely mandatory in almost all corporate environments. If you have a comment to the contrary, feel free to share it. Don't just downvote my comment because you don't personally need the features.

<comment><USER5> Really don't want to see anyone get down voted here for having an opinion. Different opinions are what drive conversation, so, I won't ignore your concerns here.

I'm not super big on the terminology, but I assume on-prem is on-premise, meaning you'd like to self-host. If I have that correct then unfortunately I can't promise anything here. I will most definitely pass this along to our team though so that they know there are some requests for it.

As for active directory integration. I'll be completely honest here and say I'm not totally sure how we can support this one. We use both an email, an Account Key, and a Master Password to access and decrypt your data. There isn't just a password to decrypt, we also use your Account Key combined with the Master Password. This could potentially provide some roadblocks to providing single sign on support. If you're looking at it for group integration (i.e. User X is in Group Y in AD/LDAP then they are in Group Y on 1Password for Teams), that might be a different story. I'll also pass your concerns and feedback for this one along.

I hope those are at least something, though I can certainly understand that it might not be to your liking. But if you have feedback or can help me understand things more I would certainly appreciate it. I'm just a developer and have never been a system admin, nor have I worked in a corporate environment. That leaves me a little green on those topics :)

Kyle

AgileBits

<comment><USER7> Correct - on-prem = on-premise.

AD integration meaning yes, ability to tie users/groups between 1password and existing AD infrastructure. The idea there being that if a user is terminated, and their AD account is deleted/locked out, everywhere else is locked at the same time. Having to go to 20 different systems to try to clean them out is a great way to miss accounts :)

<comment><USER5> Hey, thanks so much for that. Seriously, means a lot to come in here and know full well you're not really the right person to answer the question but give it a shot anyway and the other party is gracious enough to explain it.

I will definitely be passing this along so we have some proper request information on hand. My bosses are reading this, one has even interacted in this discussion already so they're seeing this already but I'll make it a bit more official tonight when I write up a summary of what I seen requested.

Thank you again for taking the time to make sure I was on the right track.

Kyle

AgileBits

<comment><USER8> Recommend including LDAP integration in addition to Active Directory. With such a large Mac userbase, you're likely to have more customers using LDAP than AD.

<comment><USER9> Keeper Enterprise has AD / LDAP integration! Check us out [https://keepersecurity.com/enterprise.html](https://keepersecurity.com/enterprise.html)

</comment></comment></comment></comment></comment></comment><comment><USER10> 1) Finally 2) Awesome!

Thank you for doing this. Super into analyzing this for security. 1Password is my preferred single-client solution, but not having a good Team solution has been a serious drawback.

<comment><USER5> You'll definitely want to start by reading the white paper:

[https://teams.1password.com/white- paper/1Password%20for%20Te...](https://teams.1password.com/white- paper/1Password%20for%20Teams%20White%20Paper.pdf)

Let us know if you have any questions after giving that a read.

Kyle

AgileBits

<comment><USER11> Is there a reason why you're using RSA over Curve25519? RSA is old and rusty at this point and there's no good reason that I know of to be using it in new cryptosystems. To a much lesser extent I also have the same question about using AES-GCM over Poly1305/ChaCha20.

<comment><USER12> Yep. There is very definitely a reason. You might not like it, but there is. For the moment we need a client that runs reasonable well in web browsers.

As libraries become more available or the nature of our clients change, we can switch. We certainly look forward to having the smaller keys that ECC will give us.

We are aware of tweet-nacl, but we are trying to avoid the number of external JS libraries we would need. This is why the Teams web app is limited to browsers that most fully support WebCrypto.(Of course our own browser extension for Desktop 1Password runs in more browsers as it does not rely on any crypto itself.)

I admit it is kind of weird using GCM where a stream cipher would be faster, lighter, cheaper. And so we definitely are looking forward to moving to something like that for our transport layer encryption. There aren't any security problems with our current ciphersuites, but we should be able to improve performance by using things like what you recommend.

<comment><USER11> Thanks for the answer! WebCrypto is obviously a disaster, it is very unfortunate that new systems are being stuck with legacy crypto if they use it instead of non-native libraries.

<comment><USER12> I think that there are three issues with WebCrypto that people often conflate. But they need to be looked at separately when judging the security of any particular things.

1\. Limited algorithms. This is what has use using GCM instead of a stream cipher for our transport layer. 2\. It allows developers to shoot themselves in the foot by not enforcing best practices. 3\. It encourages crypto delivered over the web.

If (3) is your concern, then it doesn't matter how good, modern, up to date, the methods are. This objection applies to tweet-nacl just as well.

If (1) is your concern, keep in mind that there is nothing wrong with the algorithms and modes we are using. Sure we had to forego some slicker alternatives, but this is a performance hit.

If (2) is your concern then what is true about WebCrypto is true of almost every crypto library out there. Whether we use libcrypto, CommonCrypto, MS CAPI, etc, we have just as great a chance of "using it wrong" as we do with WebCrypto. WebCrypto isn't worse than most of the alternatives, it is just new enough that we all hoped it would be better than the alternatives in this regard.

So given these three general concerns with WebCrypto, you need to make a judgement about how these play out when evaluating 1Password for Teams.

<comment><USER13> (2) is not true of misuse-resistant crypto primitives and libraries, which is kind of the point of Nacl.

<comment><USER12> Notice I said " _almost_ every other crypto library". I had NaCl specifically in mind with that qualification.

It's no secret how you feel about crypto delivered over the web and run in the browser, but one of the the factors in our choice involved speed and stability of WebCrypto versus <strike>tweet-nacl</strike>NaCl in JavaScript.

NaCl might be a good choice for our transport layer, but we do a lot of encrypting of keys and not just of non-key data. So we needed to make use of .subtle methods every now and then. So if we needed things that NaCl didn't offer, it was simpler to use a single other API/Library than to mix and match.

I am a huge supporter of efforts like NaCl. I'd obviously prefer to be denied the opportunity to shoot myself (and our customers) in the foot than to use tools that are prone to misuse. It would have also been really cool to show off using NaCl. It is the direction we'd like to see the world move. But we couldn't quite swing it this time around.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> I had hoped AgileBits would step up their Windows offerings.

I've recently bought the "real Windows application", since the Universal App doesn't allow to enter new logins (really?), only view existing ones.

Unfortunately, KeePass was much more useful with its Alt-A shortcut. In 1Password I need to manually copy login data from the application, since I'm using Edge and there's obviously no plugin, yet (Edge's fault).

Oh, and syncing must be a bad joke. Lots and lots of sync options, but the only one working across all platforms (iOS, Windows Phone and Windows are the ones relevant to me) is Dropbox. No OneDrive, no WLAN sync.

And don't get me started on vault management. I was using a non-synced vault without realizing it for weeks, and then I was pulling my hair out trying to sync the correct one. I finally only managed to do that by completely removing the Windows Phone app and starting from scratch.

At least they are moving everything to opvault. It was fun trying to get everything to sync, only to find out that the default vault format "agilekeychain" cannot be synced to Windows phone (or was it Windows desktop? I'm not sure).

<comment><USER5> Hi there!

We are working on adding Teams to 1Password for Windows. Hopefully we'll have more to show for that in the not too distant future.

I also hear you on the Edge front, we're excited to see what we'll be able to do with Edge once a plugin framework is available.

As for syncing, the Windows application does support Wifi sync to iOS and Android applications, in addition to Dropbox. Between computers, you could use any sync service that syncs like Dropbox, i.e. to a folder locally and then the sync service copies the data back and forth while the data rests locally. Keep in mind though that we've only tested and can support Dropbox for this so you might run into unforeseen problems, but we do have users doing this and it seems to work for them.

That said, I am sorry for the trouble you've had. If you have any questions getting things setup you're welcome to ask questions on our support forum at [https://discussions.agilebits.com](https://discussions.agilebits.com). We're always happy to help users get setup and running.

I'll certainly pass your feedback along to the proper people as well.

Kyle

AgileBits

</comment></comment><comment><USER15> With the sale of Lastpass to LogMeIn, more excited than ever for 1Password to add team features

<comment><USER16> Why is it an issue that LastPass was sold to LogMeIn? Does that company have a bad reputation, or...? This is a serious question. I am not familiar with LogMeIn.

<comment><USER17> LogMeIn has a history of buying useful products and then raising prices on them without much warning. I was a faithful customer of Hamachi until LogMeIn purchased them, upped the price, and then tried to lock me in to a subscription.

<comment><USER18> If anyone doesn't know enough to put comments like this in context,

Hamachi was a free VPN service most commonly used by gamers. LogMeIn bought Hamachi, and turned it into a paid service, earning the eternal hate of the gaming community.

None of these aspersions are worth considering if you're thinking about enterprise software.

<comment><USER19> Out of curiosity--have they been successful with this strategy?

I'm guessing there's some short term revenue gains, and maybe some initial fallout. But the question still stands of whether this works long term. A lot of companies underprice their offering, so this could very well work and an acquisition seems like an ideal time to raise prices while promising more down the line.

</comment></comment></comment></comment></comment><comment><USER20> Apart from the pricing plans --makes it difficult to invest in uploading all our company secrets if I don't get a clear return--, what about Linux based desktops? Will this be only Mac/Windows centric?

Are there single-sign-on options for Google Apps for Work?

<comment><USER12> There is absolutely no "lock in" if you try out the beta.

Our sign-on process uses a modified form of SRP. (See the draft white paper). It is not a traditional "authentication" process and so can't use other SSOs.

<comment><USER21> I won't recommend this to my company since I run 4 Linux boxes and there is no native Linux support (Means DEB, RPM and a TAR)

<comment><USER22> Not really a threat -- if they don't provide Linux support, then they know and accept already that people running Linux won't buy or recommend it.

<comment><USER12> It's more of a threat to us than you describe. If a potential team of N people have k members who need a Linux client, then that might cost us N customers, not just k.

<comment><USER23> Yes. We are a team of 3 and one of us uses Linux. What is missing when using the web app? Is there a feature comparison I can look at?

<comment><USER5> There's a fair bit missing. For now, the web client is read-only but we have full intention to make it able to edit, it just wasn't something we had time to do before the public beta.

The app also includes filling directly into webpages (via a browser extension) so you don't need to copy and paste. This also includes the ability to save new logins as you create accounts. Filling Credit Card and Address information as well.

Those are the two big features I think. The editing will show up on the web side but the filling part won't since it relies heavily on the client applications to do a great deal of the grunt work.

We're well aware of the demand for a Linux client though. I think all of us on the team would love to see a Linux client, but "love to see" isn't enough to make it happen right now.

I have most certainly written about this in my report I hope to send up the chain today so your voices aren't going unheard.

Kyle

AgileBits

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Our teams would be all over this if they had real linux support.

<comment><USER12> The 1Password For Teams web app runs in Chrome, Firefox, and Opera.

<comment><USER25> Read only and no browser integration. :/ at least they publish a python module to speak to the agilekeychain

<comment><USER26> Currently read-only, yes, but it will eventually offer read and write ability.

Rob

AgileBits

<comment><USER25> "eventually" doesn't allow me to use it now though, unfortunately.

I don't mean to sound petulant but I do own 1password on two devices and it's really frustrating to have no reasonable ability to use it on my main workstations at home or at work.

<comment><USER27> I know this isn't a complete solution, but 1Password for Windows runs OK under Wine, and with some registry tweaks as the browser plugins work OK too. The exact details are documented here: [https://discussions.agilebits.com/discussion/42126/making-1p...](https://discussions.agilebits.com/discussion/42126/making-1password- work-in-ubuntu-14-04)

I verified this afternoon that this works with Ubuntu 15.10.

</comment></comment></comment></comment></comment></comment><comment><USER28> Really exited for this - was literally just looking to put a vault on a shared drive (yuck)...

The pricing does seem a bit high (the same price as google apps!). We're a startup with an engineering team of ~12 and only two or three of us pay for 1password right now. If we had 1password teams, I'm sure I could convince management to include pro versions of 1password for Mac & iPhone with every new employee as part of the "initial software package" that employees are allowed to expense. But another $100+/mo is a bit harder for them to digest. Regardless, looking forward to being invited into the beta/trial! :)

<comment><USER26> Hi there!

Note that pricing is not completely finalized just yet, and we will be offering different pricing tiers. In addition, a subscription to 1Password for Teams would replace the price of the individual apps, not add to it. So, you would be getting free upgrades for the client apps while you are subscribed to 1Password for Teams.

I hope that helps!

Rob

AgileBits

<comment><USER29> 1password has always been pricy and I've been a happy user. But please please entertain having realistic enterprise pricing. If so, I can get an org of several hundred people on it.

Heck, if you offer a good enough deal, I might be able to get a whole bunch of sister companies on it too.

</comment></comment></comment><comment><USER30> This is pretty awesome. Super excited to try it out.

What's not awesome though is how long they've been working on the refresh of the Android app with fingerprint support. Demoed in May, it's now November and they aren't even ready to launch it on their beta channel.

<comment><USER5> Hi Mike,

Really sorry about that. Our Android team is working as hard as they can to bring out updates. It's a tough balance because we've been hard at work on trying to bring 1Password for Teams to Android as well, which until today has been a secret project. This also means adding a lot of new features that are part of Teams, like multiple vault support.

For the fingerprint support it's important to note that this relies on Android Marshmallow so we couldn't ship that until then. It sounds like that has started rolling out though so that's no longer blocking us but a few other things are. I just thought that knowing it depended upon Android Marshmallow would help in seeing why that particular feature hasn't arrived yet :)

We're doing our best to get the Android application improved though.

Kyle

AgileBits

</comment></comment><comment><USER31> A nice addition, we are currently using LassPass Enterprise, and the UI is absolutely terrible, but being the only game in town kind of forced our hands... now there's options!

</comment><comment><USER32> Congrats on the launch. We've been using the beta for this and it has been quite excellent.

</comment><comment><USER33> I used the beta for this, it was pretty slick.

<comment><USER34> Thank you for your help with the 1Password for Teams infrastructure!

<comment><USER33> Glad we could help!

</comment></comment></comment><comment><USER35> Hi! I can tell you our experience at company I work. We were looking for any tool to make simple share "but not deliver control of password" because we wanted to show customers that "we take care" about their passwords.

Finally started use ZOHO Vault. It gave us why to create/manage/share to our developers "secrets" (passwords, PIN/PUK, Visa pin, etc) in webapp and mobile app. Now it is part of our "wellcome kit" to new worker. If you are alone you can use for free, and use to your personal or professional secrets.(Example code that was created to my profile by ZOHO Vault is like "x3Aq-JTyKg" -is not this! of course!)

Usually with any customer that see how we work... they copy "work method": if any other recommend us other better... of course we will test too to compare!! Cheers!

</comment><comment><USER36> Very excited about this! We definitely have been waiting for it.

</comment><comment><USER37> Cool, product.

I'm not super excited about the use of WebCrypto, but it isn't any worse than storing passwords in the clear in a database.

My biggest question is does it support having an audit log of who accessed what credentials when? If that is supported I could see some our our teams switching over to this.

<comment><USER38> 1Password for Teams does have auditing for changes. We will be adjusting and expanding how that is exposed in the admin console over time.

<comment><USER37> Auditing who accesses credentials is just as important as auditing changes for us.

<comment><USER39> Auditing who accesses credentials is pointless, IMO. So you know that Tom, Jane and John have all accessed the domain admin credentials since they were changed last week, what good does that do you? They all have reason to do it, and any one of them could have written them down so it's not like you can audit who pulled them up 15 minutes before some huge security incident and know who was responsible.

<comment><USER37> Not necessarily. If you have an organization with 100 users and most systems are accessed rarely, an audit log can show you things like "Steve accessed ALL the credentials."

</comment></comment></comment></comment></comment><comment><USER40> 1Password is great. Love it.

I have been getting excited about Universal Two-Factor auth tokens. Sure, yet another standard, but U2F seems dead-simple from user perspective, and easy for developers to add to web apps.

If we rely more upon web-browser front-ends for 1Password UX, I'd feel way more comfortable with some kind of two-factor auth for the password vaults themselves.

I have inadvertently submitted my 1pw vault password to web sites, usually because keyboard focus changed and I didn't notice. Real people will inevitably do this from time to time, even in the absence of malicious phishing.

Good luck!

<comment><USER41> Thanks for your kind words! See my earlier reply to digitalchoas ([https://news.ycombinator.com/item?id=10504006](https://news.ycombinator.com/item?id=10504006)). :)

1Password for Teams has what we call Better Than Two-Factor™ through the use of an Account Key: [https://support.1password.com/account- key/](https://support.1password.com/account-key/)

</comment></comment><comment><USER42> ... provided your team doesn't include anyone using Linux. I asked them whether they had any plans to support Linux recently and got a disappointing "no comment" type of reply. Not impressed.

<comment><USER26> Sorry you were less than impressed. We can't really discuss future plans, but we are working to mature the 1Password for Teams web client into a fully functional client that can add, edit, and delete items. The whole thing is still in beta right now, but it's definitely on our must-do list.

The web client runs in Chrome, Firefox, and Opera, so Linux users will definitely be able to access it there. That's our immediate focus for now.

Rob

AgileBits

<comment><USER42> Actually, now that I think about it, why on earth _can 't_ you discuss future plans?

<comment><USER5> Duncan, the reason we try not to discuss future plans is because until something ships we can't 100% for sure it'll make it into the wild. We've had instances in the past where we discussed future plans and due to unforeseen issues couldn't follow through with them.

The mantra is more "under promise and over deliver" when it comes to these types of things. One of the sayings that has lived long in AgileBits (at least since I've joined nearly 4 years ago) is that no decision is ever final. So we might tell someone "nope, sorry won't happen" but then it could later, or vice versa.

So, future plans are something we try very hard not to discuss, and if they're ever discussed it's often by our CEO or founders :)

It's because we respect our customers that we do this. We don't want to lead someone on or misrepresent our intentions. Though, I can certainly understand how it might feel like we are avoiding the issue, we're not, we'd love nothing more than to tell everyone "yup, that's coming!" but reality is much different so we want to make sure we do our best by coming in level headed about things.

Hope that helps explain things a little at least.

Kyle

AgileBits

</comment></comment></comment></comment><comment><USER43> We really could've used this at the startup where I worked a few years ago. We were using the, uh, analog equivalent: a manila folder full of handwritten passwords locked in the founder's filing cabinet.

<comment><USER12> I remember doing that in the 90s. There was the "password book" locked away in a location I won't disclose in case they still do it that way.

We all used SSH public keys (this was kind of new back then), so really only needed to consult the password book on certain reboots.

</comment></comment><comment><USER44> I work for a password manager that has had teams for a while. We have an encryption key per record with fast search. An open source command line SDK and Java desktop client which is great for linux. A great Android app with autofill, material design UI (more to come), which has been in the Google Play store since day 1, etc.

I'm obviously biased especially about the Android client :) but IMHO great iOS (and SDK), Android, Web Vault, browser plugins, Windows Phone, Surface, etc.

</comment><comment><USER45> Wow, this is gonna be big! Congrats to the agile bits team!

</comment><comment><USER46> At last full NSA support, I've been waiting for this for ages. Really getting tired of having to open my firewall and give them an SSH login.

<comment><USER5> You're getting down voted and unfortunately that's a bit disappointing. That said I am happy to discuss with you how Teams is setup so that you can fully understand how it works and realize that we (AgileBits) can provide zero access to your data to anyone, including yourself, without the proper credentials (Email, Account Key, and Master Password).

You would probably find our white paper on security and privacy very informative. If you'd like to give it a read you can find it here:

[https://teams.1password.com/white- paper/1Password%20for%20Te...](https://teams.1password.com/white- paper/1Password%20for%20Teams%20White%20Paper.pdf)

If you have questions I'd be more than happy to make sure you get those answers. But this was a very important topic for us and that's why the white paper exists and I believe it should answer all of your concerns about security and privacy, if it does not then we will get those answered for you.

Kyle

AgileBits

Edit: I changed wording to "credentials (Email, Account Key, and Master Password)" from generic "data" which was sort of redundant and not clear.

<comment><USER46> I'm actually a huge 1Password fan - my comment was joking but accurate to the point that no-one can guarantee data security in the current climate. How are we to know that any provider has not been coerced by their nation's security services into weakening their own security protocols - and then been slapped with an order forbidding them to discuss said changes (all within known current NSA practices).

None of this is directed at you guys, as I said, big fan. But at a climate that has left consumers concerned, cynical and distrustful of the safety of any of their data.

Remember my credit cards, alarm codes and personal data is within 1Password - the most precious of my data.

I have read the link and the other I have been sent and I will definitely continue using 1Password and I trust you guys as much as I anyone can be trusted at the moment. Certainly it's more safe than writing it down on a pieces of paper right now :-)

Of course one way to being even more transparent (but not necessarily more secure) is to open source your means of securing, transmitting and remote storage; not the whole product of course.

But with a highly funded secretive agency weakening protocols and strong arming companies, what are we to do :-)

Again great product!

</comment></comment></comment><comment><USER47> And yet another app that would rather become an OS on its own rather than stick to one thing but 'do it well'. 1Password.app has already been taking ages to load since the shiny/pointless redesign a year ago, and now we're getting even more features…

<comment><USER48> However this is a pretty significant feature - I really wouldn't tag it as bloat, but as the next logical step for 1Password and judging by the comments here I'm not the only one who has been waiting for this.

</comment></comment><comment><USER49> I'm curious if anyone's ever tried using Password Safe [0] in a group context with the master file stored on a shared repo.

0 - [http://passwordsafe.sourceforge.net/](http://passwordsafe.sourceforge.net/)

</comment><comment><USER50> I'd be all over this if they supported yubikey's U2F. I love 1pass, but it always makes me uneasy using Dropbox (or anything similar) for syncing.

<comment><USER41> You will be pleased to know that 1Password for Teams does not use Dropbox for syncing and has what we call Better Than Two-Factor™ through the use of an Account Key. From our "Understanding the Account Key" article ([https://support.1password.com/account- key/](https://support.1password.com/account-key/)):

With traditional two-factor authentication, an existing device is used to authorize a new one. But the existing device is only used for authorization. The one-time passwords are not used to harden the encryption.

Your Account Key works in much the same way. It is required to authorize a new device. However, your Account Key is actually used to improve the encryption of your data. Both your Master Password and your Account Key are required to decrypt your data.

More in that article. :)

</comment></comment><comment><USER51> How does revocation happens? What happens if I remove a user from the team?

<comment><USER5> When you remove a user from a team (or even a vault) the vault or team is effectively removed from the user's computer. The account will still "exist" in the preferences but it'll be suspended and their only option is to delete the account or have the admin restore the account.

Given the nature of passwords, if you've removed someone from the team you'll still want to change passwords for any items they have had access to if that's a concern.

Does that help answer your question? I'm happy to give you more information if you have more questions or if I somehow misunderstood your question. Just let me know!

Kyle

AgileBits

<comment><USER51> Thanks for the explanation!

While in theory the passwords should be changed, but shouldn't a new vault key also get generated/encrypted and the existing passwords get re-encrypted with the new vault key?

The case I was thinking about is: If for whatever reason that revoked user got access to an encrypted password that got added after he was revoked, he can still use the same vault key to decrypt it.

On a different note, I was trying to understand the granting access part and so far (correct me of I am wrong :)) I think it has to be done in a 3-stage process. 1. invite user, 2. user accepts and generates priv/pub and pushes encrypted priv + pub to 1password, 3. admin confirms the grant by encrypting the vault key with the new user's public key. Did I get it right?

Lastly, would it be more secure if instead of using a master vault key just rely on priv/pub key of each user. When one member adds a new password, they encrypt it with each user's public key and provide it to them (can be considered as a big disadvantage to this approach). I think it makes revocation easier and denies access to future passwords since the user will be out of the team and won't receive new passwords created. But I am not a security expert, so I won't claim anything. :)

<comment><USER12> Well spotted about the revocation and password change issue.

At the moment, the way we address this is through server policy to prevent the user with rescinded access from getting any new vault data from the server. But as you correctly note, this isn't enforced by the cryptography.

There is a technique, called "lazy encryption" by some, to manage this sort of thing. What would happen is that any time there is a password change or someone is kicked out of a vault, a new key is created for the vault and all changes and new items are encrypted with the new key. The new key will also encrypt the previous key.

With this, someone who still has an "old key" can cryptographically decrypt things that they could have before (but they could have saved those things before), but would not be able to get at new or modified data.

I spoke about this problem (as it applies to things like a password change) in my talk at PasswordsCon 2014 in Las Vegas, which should give you some idea of how long we've been thinking about this problem.

We've got some of the underlying infrastructure in place for this, but as you can obviously see we didn't get this all working by the time of the release of our beta.

But I cannot make any promises whatsoever about when it will actually be implemented.

<comment><USER51> Ah got it. I think implementing it as a server policy is fine for now.

What would be nice is to have 1password regenerate and assign new passwords for certain supported services when a user leaves a vault. Not sure about its feasibility but if implemented correctly it can be a big feature win.

<comment><USER12> Oh that would be nice. The difficulty is in keeping track of "supported services" and making sure that they haven't changed their password change forms yesterday.

Standardized password change forms would make our lives (and our customers' lives) so much easier.

It's not impossible, but it it takes a lot of maintenance, to make sure that it behaves as expected. And when you are automating password changes you really want to make sure that it does work as expected.

<comment><USER51> Agreed. The lack of standards around this makes it very challenging and the implementation will be against a constantly moving target. We all know how this ends. :)

But it can also open the door further(not that it cannot now) to have 1password team become central password store for your production environment. I can envision a 1password agent (with hsm support maybe) running on a machine to provide processes with required passwords/keys as a way to eliminate the need to store passwords on disk. If the box gets compromised, changing the password in one central location so that others pick it up can be convenient.

food for thought. :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER52> Is this the same idea as the YC company Meldium?

</comment><comment><USER53> They can't seem to fix a simple bug that prevents the mini 1password menu from not being behind the menubar. Really pathetic or maybe its fixed now hopefully. Please FIX OMG

<comment><USER26> Hey, thanks for the feedback. I'm not sure I know which issue you're referring to. I've not seen the menu show up behind the menu bar. Could you follow up with us on our forum? [https://discussions.agilebits.com](https://discussions.agilebits.com)

Rob

AgileBits</comment></comment>


The Psychology of Prediction - <AUTHOR> https://www.collaborativefund.com/blog/the-psychology-of-prediction/ <comment><AUTHOR> Daniel Kahneman was once asked how we should respond when we make an analysis mistake. He said:

Whenever we are surprised by something, even if we admit that we made a mistake, we say, 'Oh I'll never make that mistake again.' But, in fact, what you should learn when you make a mistake because you did not anticipate something is that the world is difficult to anticipate. That's the correct lesson to learn from surprises: that the world is surprising.

That last line should be written on forecasters' walls: The correct lesson to learn from surprises is that the world is surprising.

<comment><USER2> Isn't this why we run simulations and calculate odds? The world is surprising. Still, if you stick to the odds and something breaks, maybe your model really needs tweaking. We have, wisely, gone back and changed thousands of formal models in fields from physics to economics to social science for this reason: We don't want to make that mistake again. And in many of those cases we didn't make that particular mistake again.

So it seems like while it's worth understanding that the world is surprising, this doesn't diminish the value of fixing a broken model or preparing better next time.

<comment><USER3> I think this shows the difference between a regime like physics where we expect models to generally work, versus another kind of regime like the stock market where it's unclear whether they work.

The point of the above quote is that in some regimes, models [that we can currently build] don't work. So the lesson to take away from a bad prediction isn't "this model is bad", it's "any model I build will be bad". There might not be enough signal in the data you have (or even is possible to have). It's exacerbated in cases where it's hard to assess the model's performance, e.g. the stock market mostly goes up so any model that predicts that will look pretty good most of the time.

</comment></comment></comment><comment><USER4> I only take predictions seriously if you have some stake in the outcome. Otherwise, it's easy to just casually predict something outrageous like "Trump will probably quit before his term is over", and turn around and say you were kidding if it's not right, but take all the credit if it comes true. Go put $10,000 on some prediction market contract, or make a side bet with someone.. anything.

One of my favorite quotes about predicting comes from Taleb: "Don't tell me what you think, tell me what you have in your portfolio."

<comment><USER5> Predictions can be a tool to test your understanding, I guess maybe like a fantasy investing site to see how well you would do if you were investing real money.

I've been playing a bunch of Metaculus[1] recently for this reason.

I do agree that there are too many folks (pundits and the like) who make predictions all the time with no consequences, and I wish there was a way to hold bad predictors to account. I've thought about making tools that automatically or with crowd sourcing track the predictions of public personas.

1: [https://www.metaculus.com/questions/](https://www.metaculus.com/questions/)

<comment><USER6> That's a useful website, thanks.

Recently, I had a similar question about websites or repositories that keep a track record of predictions/promises. If interested [0], one individual pointed to Long Bets.

[0]: [https://news.ycombinator.com/item?id=20500998](https://news.ycombinator.com/item?id=20500998)

<comment><USER7> Long Bets has the famous Buffet/hedge fund wager, as well as the Ted Danson Red Sox World Series/USMT World Cup wager. Both now settled! But otherwise, it's looked a bit moribund lately to me.

Here's a more active prediction site in this vein associated with Philip Tetlock of Superforecasting fame:

[https://www.gjopen.com/](https://www.gjopen.com/)

<comment><USER6> Excellent, thank you.

</comment></comment></comment></comment></comment><comment><USER8> Title should be "The Psychology of Guessing".

<comment><USER9> "Predictions are hard, especially about the future." —Yogi Berra, MLB HoF & American Philosopher :-P</comment></comment>


Show HN: Sniffgit – A Python lib to find sensitive files and information in a repo - <AUTHOR> https://github.com/Liandy213/sniffgit <comment><USER2> Nice start. I notice this only scans the HEAD of the repository. Have you considered implementing functionality to go back through previous commits and check for secrets in files there? After all, once something is committed to git, even if you change the file, the old version is still there (by design, obviously).

For a more complex implementation of a solution to this problem, checkout trufflehog [0], which "searches through git repositories for high entropy strings and secrets, digging deep into commit history."

[0] [https://github.com/dxa4481/truffleHog](https://github.com/dxa4481/truffleHog)

<comment><AUTHOR> Hi there, a feature to scan previous commits sounds awesome and I'll start working on it soon!

truffleHog also provides a sophisticated approach in detecting potential secret strings.

Thank you for the feedback! :)

</comment></comment><comment><AUTHOR> Hi there, I built this library after reading up some InfoSec SE posts about what sensitive files (and information) that should be gitignored or not included at all in a git repo.

The following article was also a motivation for me to start the project, "Dev put AWS keys on Github. Then BAD THINGS happened": [https://www.theregister.co.uk/2015/01/06/dev_blunder_shows_g...](https://www.theregister.co.uk/2015/01/06/dev_blunder_shows_github_crawling_with_keyslurping_bots/)

How this library works: sniffgit starts from the root of your git working directory, and check if there are any sensitive files (id_rsa, *.cert, etc) that are exposed, i.e. files that haven't been gitignored or files that shouldn't be in a repo at all.

This library also checks textfiles for sensitive information, such as AWS_SECRET_ACCESS_KEY, email, password, etc. Some files and directories are not going to be read at all, though (e.g. binary file, .git, yarn.lock).

Currently, the "sensitive info / line analysis" will have a lot of false positive result for larger projects. The reason is that it only checks for keyword such as "password, API_KEY, email, etc" for each line in a text file.

This is my first ever open-source project. Feedbacks are truly appreciated, particularly about OSS best practices :).

<comment><USER3> Interesting project! Perhaps you could add a return value depending on whether results were found (using sys.exit or something like that) so it can be integrated in CI-pipelines.

<comment><AUTHOR> Thank you for the suggestion! I will add that feature today. I believe that the project will be more useful if it can be easily integrated into CI pipelines!</comment></comment></comment>


Asia-Europe Container Freight Rates Plummet 70% in 3 Weeks - <AUTHOR> http://gcaptain.com/asia-europe-container-freight-rates-drops-28-percent/ <comment><USER2> Why?

<comment><USER3> There was another gcaptain article here recently where they noted the fall in the shipping index.

The Economist attributed it more to an excess in supply (freight ships) rather than a fall in demand.

So a China slowdown in coal shipments would mean the ships built to supply the expected growth are now sitting idle.

<comment><AUTHOR> One can simply blame it on supply but it's looking more like global trade just snapped.

November is actually a time for typical seasonal strength for freight and thus global trade around the world. This divergence from seasonality has only occurred at this scale once before, in 2008.

Supply has indeed surged, but only due to mal-investment in building ships for the renaissance of global trade, which never happened, as growth in global trade has been slowing down for some time: [http://www.acting- man.com/?p=41518](http://www.acting-man.com/?p=41518)</comment></comment></comment>


Areas near Sacramento evacuated as Oroville spillway collapse feared - <AUTHOR> http://www.sacbee.com/news/state/california/water-and-drought/article132332499.html <comment><USER2> I looked for more information about this situation. LAT has a live blog that seems to have some really good info about the dam, the spillways, and the damage in the early posts to the live blog [http://www.latimes.com/local/california/la-live-updates- orov...](http://www.latimes.com/local/california/la-live-updates-oroville-dam- how-the-oroville-dam-situation-became-a-1486958195-htmlstory.html)

<comment><USER3> The main spillway is out of action due to major erosion damage in its concrete flume. The power plant is shut down because the water level at the low end, in the diversion pool, is too high. So the two normal ways of releasing water are out of service. The emergency spillway is just a dirt hill near the dam with a concrete lip at the top.

There's a data feed from sensors at the dam.[1] "Level" is probably good data. "Out" flow rate may not be meaningful; the emergency spillway probably lacks a flow meter. Here's a plot of "Level".[2] When it's below 900, the auxiliary spillway should stop flowing. As of 2330, it's at 900 feet almost exactly.

[1] [http://rdcfeeds.redding.com/lakelevels/oro.cfm](http://rdcfeeds.redding.com/lakelevels/oro.cfm) [2] [http://cdec.water.ca.gov/jspplot/jspPlotServlet.jsp?sensor_n...](http://cdec.water.ca.gov/jspplot/jspPlotServlet.jsp?sensor_no=1148&end=02/12/2017+23:31&geom=small&interval=2&cookies=cdec01)

<comment><USER4> The main spillway was open last night, carrying 100,000 cu ft/s of water (comparable to Niagara Falls). I guess it is still open, but I only spent a minute trying to find a current source.

They had reduced the main spillway flow prior to water starting to flow out the emergency spillway, but they increased it after that happened.

edit: it seems that the water level is below the emergency spillway now, but the main spillway is still open, probably at least partly out of concern about coming rain.

</comment></comment></comment><comment><USER5> Current Storage vs Capacity Levels:

[https://apps.axibase.com/chartlab/dee79515](https://apps.axibase.com/chartlab/dee79515)

The overflow lasted for 45 hours.

The water level appears to be dropping quickly at the moment:

[https://apps.axibase.com/chartlab/dee79515/2/](https://apps.axibase.com/chartlab/dee79515/2/)

<comment><USER6> Overflow means the actual spilling over the top (the emergency spillway) on to hill and street below? So we still have the broken main spillway in action or not?

<comment><USER7> It's not just flowing over the top of the dam; the water is channeled through an area designed to handle overflow; but the channel is damaged.

See pic: [http://s4.reutersmedia.net/resources/r/?m=02&d=20170213&t=2&...](http://s4.reutersmedia.net/resources/r/?m=02&d=20170213&t=2&i=1172421238&w=&fh=&fw=&ll=780&pl=468&sq=&r=LYNXMPED1C0CT)

I believe they're worried about the erosion tearing apart the hillside and thus destabilizing the entire hill; at which point the whole hill would just collapse.

<comment><USER8> What I've been wondering is: What, if anything, did they do during all of these years of drought in order to ensure dams and all required mechanism remained sound and ready for when rains returned?

The lake near my house was down 120 feet. You could see land and structures never seen in decades. Prime opportunity to get in there to inspect and maintain said infrastructure. Not sure anything was done at all.

I am no expert in concrete but I would like to think the break in the Oroville spillway could have been detected and dealt with with cursory inspections over the last several years, when access was easy due to the drought.

I don't like it when folks are put in danger because other folks who are supposed to be working for us don't do their jobs. Not saying this is what's happening here, I don't know, but the question needs to be asked.

<comment><USER4> The spillway can be completely shut during normal operation of the dam. So the drought didn't provide any increased opportunity to do inspections.

<comment><USER8> It did in the sense that you could undertake projects that would be impossible had the lake been full. In other words, you had certainty of not needing the spillway for months/years.

<comment><USER4> It's pretty impossible to predict that the spillway won't be needed in a given wet season.

They share the data about the level of the reservoir:

[http://cdec.water.ca.gov/histPlot/DataPlotter.jsp?staid=ORO&...](http://cdec.water.ca.gov/histPlot/DataPlotter.jsp?staid=ORO&sensor_no=6&duration=D&start=02%2F03%2F2008+06%3A11&end=02%2F13%2F2017+06%3A13&geom=Small)

The wet season last year basically filled the reservoir up from its lowest levels. So a project started in the middle of 2014 would need to leave the system operable by December, and they have that same ~6 month period in pretty much every year.

<comment><USER8> The point is they had 6 to 10 years (however long the drought lasted) to get ready for this moment in time, even if a little bit at a time.

Nobody ever seems to do this. We always wait for disasters before fixing or maintaining anything. This, despite the fact that we pay taxes, plenty of taxes, to fully staff, train and employ departments with thousands of people who are supposed to actively be looking after these things.

It's the infrastructure equivalent of a sysadmin who never looks after security and then, when all hell breaks loose, proclaims we need to do something about security.

<comment><USER4> Sure, but my point is that they have the same opportunity to do inspection whether there is a drought or not. So they've had the lifetime of the dam to do inspections and maintenance, not just a few years.

There's lots of possibilities. Maybe they didn't do inspections last year. Maybe they did inspections and noted damage that did not yet warrant repair. Maybe they did inspections and missed damage. Maybe they were unable to secure funds to repair the damage. Maybe the damage was noted too late to do repairs last fall. Etc.

The thing to do is wait and see if they come forward with a reasonable explanation of what went wrong and then feed that information into the maintenance plans at this dam and others.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> This is reminisce of the spillway problem at the Glen Canyon Dam [https://www.youtube.com/watch?v=dHpKvQ9XHV4](https://www.youtube.com/watch?v=dHpKvQ9XHV4)

[http://www.hcn.org/external_files/40years/blog/NearBreachGle...](http://www.hcn.org/external_files/40years/blog/NearBreachGlenCanyonDamArticle.pdf)

It's a fascinating read.

I'm sure the California folks right now are studying up notes from the Glen Canyon incident.

<comment><USER10> Glen Canyon was slightly different because there was no "emergency spillway" in the same way that Oroville has. Glen Canyon simply had 2 giant spillways that both needed to be in use but were both getting torn apart by cavitation. They ended up adding plywood along the top of the spillway gates to give themselves a little more reservoir capacity to wait out the flooding upstream but honestly they just got lucky. The only option they had at Glen Canyon if they exceeded the plywood barrier would have been to let water flow down the main spillways and possibly damage the dam.

</comment></comment><comment><USER11> This is horrendous. I read this piece about the Mosul Dam ([http://www.newyorker.com/magazine/2017/01/02/a-bigger- proble...](http://www.newyorker.com/magazine/2017/01/02/a-bigger-problem-than- isis)) a month or so back and found it very alarming, but wasn't sure how seriously to take it. I'm taking it more seriously now.

<comment><USER12> I thought about the same article when I read this.. It's a fascinating and terrifying read..

</comment></comment><comment><USER13> The erosion on the primary spillway is looking pretty nasty. Even if / after they manage to keep the emergency spillway from collapsing, they will probably need to continue running the primary spillway at a high flow rate to get the reservoir down to safe levels to ready for future storm systems and the coming snow melt, and this will continue to eat away at the hillside (they're currently dropping lake levels by 4" (!!) an hour). That's a significant outflow. It's a good thing that the spillways are decently far away from the actual dam structure. But it sure is going to be one expensive cleanup operation in the dry season..

Fingers crossed that things stay drier and cooler for the sake of all these people

</comment><comment><USER14> First, and importantly, my hopes go out to everyone that they are able to evacuate safely, and that nothing bad happens.

I wonder, how do you test for something like this? I mean, you can certainly plan, and I imagine that the emergency spillway was examined at the time it was planned, but no plan survives contact with the enemy, and the best thing to do is to test.

But, to test the emergency spillway you need to fill the dam to the point where it's overflowing, and I believe it's been a few years since we've gotten close to that. Certainly not any time in the last year.

Besides, if it was tested in the past, it may be that the drought conditions-- followed by all the rain--changed the soil in such a way as to enable this.

I need to make a note to read the report when it comes out; I'm sure it'll be interesting.

<comment><USER15> The emergency spillway has never been needed before, so it's never had a chance to be tested by the looks of it

<comment><USER16> The rule for backups is that if you haven't successfully performed a complete restoration from backup, then you have no backup.

Same principle seems to apply to spillways.

</comment></comment></comment><comment><USER17> _> "Anytime you take on a situation like this where you seek to evacuate thousands of people on very short notice, it can be a chaotic situation," Honea said. "We understand that."_

 _> Sunday night gridlock as Marysville residents evacuate_

 _> After having to evacuate several times before, Agrifoglio said, she was used it._

 _> She's confident her husband will be able to evacuate if he needs to, but Tommy would have to wait out a flood._

 _> Erin English of Linda said she got a robo-call a few minutes ago telling her to evacuate and get to higher ground._

"The Wire: to evacuate":

[https://www.youtube.com/watch?v=h5d82ndui_s](https://www.youtube.com/watch?v=h5d82ndui_s)

</comment><comment><USER18> Having grown up in a town that I saw flooded when the Teton Dam failed ([http://www.history.com/topics/us- states/idaho/videos/enginee...](http://www.history.com/topics/us- states/idaho/videos/engineering-disasters-teton-dam)), I've been watching this closely.

Thankfully, it appears the actual body of the dam is unlikely to fail, so hopefully even if the emergency spillway fails, it won't be a catastrophic, immediate draining of the whole lake.

</comment><comment><USER19> 4 months of record snowpack still to melt. It will be summer before any repairs can be seriously made.

<comment><USER20> Why? Can't they patch cement under water?

<comment><USER18> Underwater, yes.

Under a stream of water moving 65,000 CFS, ripping out chunks of solid cement, probably not so much.

</comment></comment></comment><comment><USER21> Couldn't you just bring in a few oil / gas pipes (or whatever you happen to have) and siphon it in a more controlled manner? The country doesn't seem to have a problem in creating oil and gas piping networks quickly...

40 million cubic meters in 24 hours means just 15 2m diameter pipes running at 10 m/s.

I would imagine the same amount of water flowing over a longer period time would cause less erosion even if the pipes wouldn't reach all the way down...

Edit: You could even do it with 6000 20 cm diameter pipes, probably plastic would do.

<comment><USER22> Gravityloss says> "Couldn't you just bring in a few oil / gas pipes (or whatever you happen to have) and siphon it in a more controlled manner? The country doesn't seem to have a problem in creating oil and gas piping networks quickly..."

Good idea, but this is happening in CA, where pipelines don't sprout so quickly.

</comment></comment><comment><USER23> Following local news, it appears the greater Sacramento area should be OK even with a catastrophic failure to the emergency spillway.

Between 130,000 and 180,000 people are being evacuated upstream.

</comment><comment><USER24> Is hydro more dangerous than nuclear? The Banqiao and Shimantan Dams killed 171k people, whereas Chernobyl killed 30 people directly plus an increase in cancer risk. No one died directly at Fukushima, though zero to hundreds could from radiation exposure depending on the estimates. About 18k died in the tsunami.

(I just realized the Oroville Dam is for a reservoir rather than power generation, but the risks are similar.)

</comment><comment> blubb-fish What was going on May 2016? Reservoir elevation at 891 feet.

[http://cdec.water.ca.gov/jspplot/jspPlotServlet.jsp?sensor_n...](http://cdec.water.ca.gov/jspplot/jspPlotServlet.jsp?sensor_no=1148&end=02%2F12%2F2017+23%3A31&geom=huge&interval=720&cookies=cdec01)

<comment><USER25> Snowmelt. If you look even further back[1] you'll see that it's cyclical. Peak runoff these days is usually March-April[2], so by May reservoirs should be maxed out. The past few years have seen a major drought, so the curve can be pretty dramatic.

1: [http://cdec.water.ca.gov/jspplot/jspPlotServlet.jsp?sensor_n...](http://cdec.water.ca.gov/jspplot/jspPlotServlet.jsp?sensor_no=1148&end=02%2F12%2F2016+23%3A31&geom=huge&interval=720&cookies=cdec01)

2: [http://www.abc10.com/weather/sierra-snowmelt-peaking- earlier...](http://www.abc10.com/weather/sierra-snowmelt-peaking- earlier/187931002)

</comment></comment><comment><USER26> I wonder about the idea of running some large hoses /pipes temporarily to help drain the water? Even a 3ft diameter would move a lot of water.

Or I also wonder if they could drill into the bottom of the Resavoir and let the water drain into the ground?

<comment><USER4> You are thinking on the wrong scale.

The main spillway has been running at 100000 cubic feet per second. To carry that in 3 foot pipes (7 square foot cross section), you'd need hundreds or thousands of them (so a few just wouldn't do much of anything).

Same with trying to bypass the water to somewhere else. To make a difference the bypass needs to be at a similar scale to the spillway, carrying tens of thousands of cubic feet per second.

<comment><USER27> The worlds largest pump, located in New Orleans, cost $500 million, cannot move enough to match the spillway. You would need 5 of those to match the flow. But realistically, a pump that can move 10.000 feet^3/s would greatly reduce the stress on the rest of the pathways. Problem is, we cannot just rig up a temporary pump with that capacity.

<comment><USER4> It's even a pumping station, with 11 pumps.

[http://www.mvn.usace.army.mil/Portals/56/docs/PAO/FactSheets...](http://www.mvn.usace.army.mil/Portals/56/docs/PAO/FactSheets/WCC.pdf)

Each can do 1740 cubic feet/second. And they are permanently installed and basically don't have anything resembling pipes.

</comment></comment></comment></comment><comment> guard-of-terra [https://www.youtube.com/watch?v=yhzKVdSnPmg](https://www.youtube.com/watch?v=yhzKVdSnPmg)

Live coverage.

They say situation is better now that drain is sufficient.

<comment><USER28> That stream has now ended, but you can still see the live webcam feed:

[https://www.youtube.com/watch?v=hSaAE6MbKE0](https://www.youtube.com/watch?v=hSaAE6MbKE0)

Not that you can see much as it's dark...

</comment></comment><comment><USER29> TIL the Oroville dam is the highest in the USA, 44 feet higher than the Hoover dam. It's kinda mind boggling that it could actually fail tonight (though the latest reports indicate that the situation is improving).

<comment><USER30> to clarify: it's not the dam itself that's at risk of failure, but the emergency spillway. while this scenario would be catastrophic, it's far less catastrophic than the entire dam failing

<comment><USER31> Think about that statement, what does is mean to you that the "emergency spillway failed" ? The ES is the portion of the dam that is slightly lower than the overall height of the dam so that in the event the main spillway was unable to release water fast enough, the water would start spilling here rather than across the dam. If it "fails" then a portion of the dam ceases to exist. That releases water through that hole uncontrollably. At which point losing containment is generally a matter of when not if.

If it fails, it will be a double disaster, many people will lose property, and California will lose some or all of the water in its largest reservoir. The challenge is going to be keeping ahead of it through to the next storm.

<comment><USER32> The emergency spillway is around 30 feet high, the dam itself is 770 feet high. The amount of water released from a failure of the emergency spillway will be enormous, but still much smaller than the amount of water released by a complete dam failure.

<comment><USER31> [http://www.sacbee.com/news/local/article132356269.html](http://www.sacbee.com/news/local/article132356269.html) provides an excellent description of the challenge. The hillside where the emergency spillway is would be at risk.

<comment><USER33> Excellent link, thanks. I found the following comment sobering:

"Countryman: It's not going to be the (main) embankment failure, but it's a failure. If it does happen, there's nothing saying that the ground is going to stay where it is. That force of water will start tearing that hill apart, and it could eat back into the reservoir and drain the reservoir."

</comment></comment></comment></comment></comment></comment><comment><USER34> How difficult would this really be to fix?

I imagine the most straightforward way to patch a hole, at least for a short period, is to use the water pressure to your advantage and inject objects to plug the hole from the dam side. Perhaps a thick metal plate lowered onto the main breach, and then malleable plastics/rubbers to slow seepage around the plate. Could probably push a hotfix out to master in a few days, for far less than 100 million dollars.

Disclaimer: I haven't found any details on the design of the emergency spillway and the suspected damage, so this is speculation.

<comment><USER35> Are you fixing it or are you making the inevitable failure even more dangerous? The answer is not easily determined.

The current solution is to drain the reservoir of water as fast as possible-- this removes pressure on the hillside, and reduces the scope for damage should the thing actually go.

As for actually patching it, the solution is dumping lots of grout. But that only helps if the slope is actually stable and capable of supporting the embankment and dam. If the slope is washing away, all of your patching is just adding more weight to a structure that can't support its own weight anymore.

While looking at old examples of dam failures, I came across [https://en.wikipedia.org/wiki/Sweetwater_Dam#1916_failure](https://en.wikipedia.org/wiki/Sweetwater_Dam#1916_failure) ... this seems awfully similar to what's happening at Oroville right now.

<comment><USER34> Of course it wouldn't be a permanent solution, but allowing the hole to exist only makes it bigger in the short term.

Anyway, the Sweetwater Dam article led me to an entertaining read about Charles Hatfield, the professional rainmaker: [https://en.wikipedia.org/wiki/Charles_Hatfield](https://en.wikipedia.org/wiki/Charles_Hatfield)

Now this guy was a great salesman. It leads you to wonder if his apparently high success ratio was a result of pure luck, if there's some truth to his "evaporative mix," or as suggested in the article, he had great meteorological prediction skills.

If weather patterns are not independent one year to the next, then just the fact that only statistically significant drought-ridden cities call for his help probably suggests that all of these cities are "due" for rain regardless.</comment></comment></comment>


Hunting with eagles - <AUTHOR> http://www.abc.net.au/news/2015-10-30/palani-mohan-captures-photos-of-kazakh-eagle-hunters/6890392 <comment><USER2> Anyone who is interested in this and other stories, I'd recommend BBC Human Planet. I'm a big fan of BBC nature series and Human Planet really tops expectations. They have a segment that focuses on people living in mountainous regions that documents a Kazakh hunter acquiring an eagle, training him and using him for hunting.

Here is a clip:

[http://www.youtube.com/watch?v=ewr- vzw4ZWo](http://www.youtube.com/watch?v=ewr-vzw4ZWo)

</comment><comment><USER3> I recommend _Eagle Dreams_ by Stephen Bodio. Bodio, an American author of books on hunting, fishing, and falconry, documented his fulfillment of a lifelong dream to visit Mongolia, live with the eagle hunters, and hunt with them.

[http://www.amazon.com/Eagle-Dreams-Searching-Legends- Mongoli...](http://www.amazon.com/Eagle-Dreams-Searching-Legends- Mongolia/dp/1629144797)

Steve's blog: [http://stephenbodio.blogspot.com/](http://stephenbodio.blogspot.com/)

Full disclosure, he's a friend of mine.

</comment><comment><USER4> Should be a band name.</comment>


Show HN: Computer Space Simulator for the Early 1960s DEC PDP-1 - <AUTHOR> http://www.masswerk.at/icss/ <comment><AUTHOR> The page shows the game running in an in-browser emulation of the DEC PDP-1 (in html5/JavaScript). The project was an entry to RetroChallenge 2016/10 [1]. A writeup/blog is available at [http://www.masswerk.at/rc2016/10/](http://www.masswerk.at/rc2016/10/)

In a nutshell, the program brings Computer Space, the very first coin-op. arcade video game (by Nolan Bushnell and Ted Dabney, Syzygy Engineering / Nutting Associates, 1971) to the machine, which's showcase application "Spacewar!" (1961/62) had inspired it in the first place. Notably, Computer Space was not a program, but an electronic device in 74xx TTL logic.

[1] RetroChallenge is "a loosely disorganised gathering of RetroComputing enthusiasts who collectively do stuff with old computers for a month." [http://retrochallenge.net](http://retrochallenge.net)</comment>


A noise two percent of people can hear - <AUTHOR> https://www.theatlantic.com/video/index/593992/doom-vibrations/ <comment><USER2> Here is a less 'conspiracy theory' styled set of articles about "The Windsor Hum".

[https://www.nytimes.com/2018/02/19/world/canada/windsor- hum....](https://www.nytimes.com/2018/02/19/world/canada/windsor-hum.html)

[https://www.theguardian.com/business/shortcuts/2018/feb/21/w...](https://www.theguardian.com/business/shortcuts/2018/feb/21/windsor- hum-us-steel-fault)

[https://en.wikipedia.org/wiki/The_Hum](https://en.wikipedia.org/wiki/The_Hum)

[https://arstechnica.com/science/2018/02/a-mysterious-and- mad...](https://arstechnica.com/science/2018/02/a-mysterious-and-maddening- hum-is-tormenting-residents-of-this-canadian-city/)

[https://www.international.gc.ca/department- ministere/windsor...](https://www.international.gc.ca/department- ministere/windsor_hum_results-bourdonnement_windsor_resultats.aspx?lang=eng)

</comment><comment><AUTHOR> There's an article where he linked the hum to possible behavioural changes and mentioned such an effect with respect to Adam Lanza (the Sandy Hook shooter) [0]. That alone should have prompted The Atlantic to have done a little more fact checking.

[0] [https://www.newtownbee.com/brookfield-man-implored-police- to...](https://www.newtownbee.com/brookfield-man-implored-police-to-consider- gas-pipeline-syndrome-in-lanza-investigation)

<comment><USER3> Did you watch the whole thing? This article is mentioned in the video.

<comment><AUTHOR> I must confess I only read the article and got through the first five minutes of the documentary.

</comment></comment></comment><comment><USER3> This is really interesting and I'm glad The Atlantic is covering it. I've heard about this before.

This guy is an a actual engineer and he seems to be going about this in a scientific manor. Still, I find it interesting he couldn't trace back or triangulate the vibrations to their source. Their obviously real, as seen by the bodies of water moving like pools and such.

Is the difficulty in triangulating frequencies this low is because it's difficult to get an emission direction?

The gas pipeline is a good theory, but then he goes on about all kinds of symptoms, mental health, schizophrenia, school shootings ... that's where it turns to the entire "mercury teeth filling" issue. The guy who was convinced mercury fillings lead to all kinds of issues said he had links to MS, neurological disorders, etc. etc. ... basically every possible ill .. You might as well say The Devil + Snake Oil at that point.

It's sad he spent so many years of his life researching this. I would have just moved. He lived way out and probably had a commute anyway (or maybe he worked from home or was retired)? Sure it's work and you might loose some money selling/buying, but moving costs for a house that size wouldn't be more than $2k~$5k and you could just move to a new area.

<comment><USER4> Yeah, that's his biggest problem. I was with him as he presented evidence, but then he just dives into all kinds of conclusions and wanders straight into conspiracy theory territory and loses credibility fast. I do think the gas pipeline theory as some real merit and, it appears, to have some strong circumstantial evidence to support it, but to draw conclusions from the data? Sorry, but you just can't. There isn't enough, and to try linking it multiple mental health issues? That's not how that's done.

</comment></comment><comment><USER5> I sleep close to an electricity box and it emits a low frequency hum that can be maddening if exposed to it for long periods of time. It can even wake me up at night. I don't think it's the same hum as described in the article though. In general, EMF is something to avoid, although it's very hard to dodge it in urban areas where electricity boxes and wires are always within short distance.

<comment><USER6> The hun you are hearing from that box isn't from EMFs. It could be a lot of things though. A common one is a high pitch hum from transistors. That can actually indicate that they're wearing down (kids can hear this the best. So ask them about a high pitch noise from an old TV. They'll think it's normal). A low hum could be something mechanical inside. Or is could be some kind of resonance. Hard to say what they are, but they aren't EMFs.

<comment><USER7> Magnetostriction is what makes transformers hum. The magnetic field changes the shape of the material turning it into a sort of loudspeaker.

[https://eng.libretexts.org/Bookshelves/Materials_Science/Sup...](https://eng.libretexts.org/Bookshelves/Materials_Science/Supplemental_Modules_\(Materials_Science\)/Magnetic_Properties/Magnetostriction)

</comment></comment></comment><comment><USER8> Five years ago there were reports of "the Surbiton hum", precisely where I live – that is, I reside in exactly the part of Surbiton where the hum is most audible, to those who can discern it. Reports started in a local forum and made their way up to an article in The Times[0] which was itself reported in Fortean Times[1]. I was kinda disappointed not to be able to hear it myself.

[0] [https://www.thetimes.co.uk/article/weather-eye-a-resident- hu...](https://www.thetimes.co.uk/article/weather-eye-a-resident- hum-7blgbcqmpw6) [1] [https://www.flickr.com/photos/dsf/14958914130/](https://www.flickr.com/photos/dsf/14958914130/)

<comment><USER3> Could it be registered with equipment that was designed to pick up low frequency sound? Is the trouble with tracking down this stuff is because it's hard to get directional readings and triangulate low frequency sound? (The reason it doesn't matter where you position a subwoofer in a surround sound setup).

</comment></comment><comment><USER9> This sounds like exactly the sort of thing that noise-cancelling headphones are good at counteracting.

I too suffer from a "hum", but in my case it has a clear explanation: a noisy ventilation fan on the roof of my building, right above my bedroom.

Admittedly, headphones can be a bit uncomfortable when you wake up with them still on your head, but the feeling of silence and being able to get to sleep easily is priceless by comparison.

Perhaps someday, someone will develop noise cancelling _earbuds_ that can be comfortably worn while sleeping, even if you roll over?

<comment><USER10> The wiki description of the phenomenon [1] covers that using earplugs doesn't reduce the sensation. Hence I don't see how cancelling headphones would be different — if the sensation isn't direct audio then it wouldn't be caught.

[1] [https://en.wikipedia.org/wiki/The_Hum#Description](https://en.wikipedia.org/wiki/The_Hum#Description)

<comment><USER9> Active noise cancelling headphones are, in my experience, much more effective at cancelling continuous low-frequency sounds than earplugs which only attempt to block them.

On the other hand, if "the hum" is at frequencies that are normally too low to be heard by most of us, then they may be also too low to be recognised by noise cancellation hardware.

A range of frequencies are given in the Wikipedia link for the phenomenon, in various different cities, and some of them should certainly be within the normal, cancellable range.

</comment></comment></comment><comment><USER4> It's clear this is a phenomenon...too much subjective evidence to rule it out. He appears to have approached this from a fairly scientific approach and appears to have gathered some quantitative evidence. Where it breaks down is in the drawing of conclusions.

The real problem with this issue appears to be in the lack of interest from others in the scientific community to properly investigate it. If his theory about gas pipelines has merit, then it seems like there would be some simple ways to investigate and test that.

</comment><comment><USER11> TLDR: Get your ears checked, rule out medical causes.

Recently, my sweetie was going mad because she was hearing annoying sounds. From her description, it was a high pitched whine with a periodic click. Worse at night (when things were more quiet).

Long story short, she now has an age related form of tinnitus. From memory, a small section of the tissue under the follicles in her inner ear has weakened. So that frequency range is impaired (the ringing) and the hairs flop around (the click, probably in sync with breathing or heartbeat, or whatever).

TIL: There are many forms of tinnitus and other hearing diseases. I have Drum & Bass induced tinnitus -- always wear ear protection while clubbing -- and had no awareness of other forms.

TIL: Anxiety and hearing problems can be a vicious cycle. Once she got a diagnosis, and some mitigations, her anxiety subsided. Which is supposedly typical.

<comment><USER12> Hello, I have found your comment to my prev. comment, posted some months ago "Hey alexibm. Since neither of us included contact info in our profiles, commenting here instead of a PM. I stumbled across one of your prior comments. All I want to say is I hope you're now doing well. Or least better. I'll delete this reply in a few days, or after you acknowledge, which ever comes first."

Thank you for looking out for me. I'm pretty sure, I know the comment you are referring to. At this point, it is been over 2 years. I would not say, I'm completely healed over, but I'm in a lot better place than I was before. To this day, I have bad days.

Person in question, who caused a lot of needless harm to me, recently popped- out on my FB (haven't spoken to her in 2 years). She was not apologetic, instead, she told me how fun it is skiing in Alps. When I question, if she understands that she caused a lot of harm to me, she went silent. From what I understood, she wanted to see if I have forgiven her since then ... I didn't. Asked her to never come back to my life.

<comment><USER11> Hi. Glad you're doing better.

Some people disappear, with out so much as a goodbye. The lack of closure leaves a huge wound.

Other people just won't go away. I also have my zombie tormenters. One just defeated my best efforts to block. Just when you think they're gone for good, they pop up again. FFS.

Jeffrey from the BBC comedy 'Coupling' calls those people 'unflushables'.

Someone someday will make a mint with a proactive "ghosting" app (or service). Short of restraining orders, of course. :)

Best wishes.

</comment></comment></comment><comment><USER13> The obvious question that no one seems to have asked nor answered: can a _microphone_ detect this sound?

<comment><USER14> The linked-to documentary ("Doom Vibrations") shows Kohlhase armed with a microphone and a spectrograph.

My personal belief is that these kinds of news articles happens when you mix together (1) some legitimate phenomenon for which it's difficult to measure (or not obvious what physical dimensions to measure) with (2) nutcases who love mysteries/conspiracies. Maybe they or people they know are really suffering as a result of some external stimulus and we don't have a good way to diagnose or treat them (or identify the stimulus). That's a tragedy and it would be great if someone could pursue it and identify it. But they're clearly nuts and we shouldn't entertain their speculation until/unless they can show objective evidence.

<comment><USER15> He's clearly trying to quantify it with many different measurements in the video. Shoes his dog reacting to something, vibrations in water, etc.

<comment><USER14> His dog's "reaction" is all based on his conjecture that its behavior is due to the same phenomenon that he describes hearing. Same with the water.

There's no evidence presented that links the waves with the sound he claims to hear or his claims that the dog's behavior is abnormal. But part of the problem there is that the filmmaker is choosing to strike (IMO) a very mysterious tone with the editing and score. If we wanted to be non-nutcases, we'd cut to the MD PhD human audiology expert or the physicist or someone who would be able to substantiate or refute the claims.

"Yes, I've sampled all kinds of places and this low frequency band is not normally so powerful."

"Yes, some humans can hear this band. We did a controlled test with the subject and he had abnormally good response at the low frequency range."

We didn't see anything of the sort. So either the filmmaker decided not to consult experts, decided to put that towards the end ( _), or consulted them and they refuted the claims.

(_) I'm not patient enough to get past the video where the nutcases debate the priorities while exploring the wilderness.

</comment></comment></comment></comment><comment><USER16> It could even be the wind interacting with some structure nearby.

<comment><USER9> In that case, it would presumably be moderated or eliminated on calm nights?

</comment></comment><comment><USER17> Noise cancelling umbrella above your whole head?

</comment><comment><USER18> I used to live in Windsor. The Windsor hum is complete bullshit.

<comment><USER10> If the title holds true (two percent of population is affected) then it isn't too likely you'd fall within that.

<comment><USER18> You know what doesnt happen in Detroit? The Windsor hum is just for Windsor. How come Detroit folks never hear it?

You know what else Windsor has?

Cancer clusters all over the city. [https://www.wechu.org/reports/remington- park-cancer-cluster-...](https://www.wechu.org/reports/remington-park-cancer- cluster-investigation-report)

If you go somewhere in Windsor, anywhere, people will tell you they are in a cancer cluster.

Maybe it's because of the Radon? [https://www.wechu.org/healthy- homes/radon](https://www.wechu.org/healthy-homes/radon)

[https://www.cbc.ca/news/canada/windsor/radon-gas-could- affec...](https://www.cbc.ca/news/canada/windsor/radon-gas-could-affect-nine- locations-in-windsor-1.2665850)

Oh right, government came in, discovered Windsor is unusually clear of radon. We had LESS radon than the average. Due primarily to the salt mine and impenetrable deposits. Oh and that "Radon Measurement Professional" He's a truck driver. He knows nothing about nothing. I've talked to him, I wouldn't trust him working at mcdonalds. His scam he told me about

Did you also know Windsor gets thousands of cases of west nile every year? Pretty much all of them it turns out didn't actually have west nile...

Oh how about the thousand people who blamed the Ohio nuclear plant for radiation poisoning. [https://windsor.ctvnews.ca/amherstburg-residents-near- nuclea...](https://windsor.ctvnews.ca/amherstburg-residents-near-nuclear- plant-to-get-anti-radiation-pills-1.3903204) Oh good we have radiation pills now.

Windsor is a dying city. What's far more common in Windsor is people running scams. You name the scam, I bet I know someone who is doing it.</comment></comment></comment>


SoftBank warns of historic loss due to big Vision Fund hit - <AUTHOR> https://www.ft.com/content/83e2213d-d28d-4305-913d-a17518a61589 <comment><USER2> Coronavirus accelerated the negative influence of bad investments:

[https://www.profgalloway.com/oyomfg](https://www.profgalloway.com/oyomfg)

[https://www.profgalloway.com/unicorn- feces](https://www.profgalloway.com/unicorn-feces)

[https://www.profgalloway.com/when-reality-becomes- fiction](https://www.profgalloway.com/when-reality-becomes-fiction)</comment>


Now Artificial intelligence fools fingerprint security systems - <AUTHOR> http://fortune.com/2018/11/28/artificial-intelligence-fingerprints-security/ <comment><USER2> Its a good news.</comment>


Modernizing Transport Security - <AUTHOR> https://security.googleblog.com/2018/10/modernizing-transport-security.html <comment><USER2> > Today only 0.5% of HTTPS connections made by Chrome use TLS 1.0 or 1.1.

It's nice to have this stat from Google. A lot of people make wild claims about how widely used TLS 1.0 is based on a glance at their webserver logs. But if you look more closely you'll see that a large percentage of 1.0 traffic is actually just hacked machines scanning for vulnerabilities, filling your logs and using your resources. It's not real traffic, and TLS 1.1 is microscopic in comparison to 1.0. As a percentage, very few sites would be harmed by disabling 1.0/1.1. Most sites can simplify their TLS stack and lose more bad than good by going TLS 1.2-only.

So I'm very glad to see Google deprecating and planning to disable 1.0/1.1.

To see the disabling of 1.0/1.1 over time check out SSL Pulse from SSL Labs (in the chart "Protocol Support"):

[https://www.ssllabs.com/ssl-pulse/](https://www.ssllabs.com/ssl-pulse/)

TLS 1.0 has been dropping like a rock. Maybe it's too late to be an "early adopter" of 1.2-only but regardless I think tech sites/people should lead the way there.

<comment><USER3> Note that "connections made _by_ some particular web browser" (in this case Chrome) and "connections made _to_ some web site" (and seen in your logs) are not the same kind of thing.

Both client and server will try to negotiate the best version they and their peer can manage, but the populations of those peers are different so the statistics are not necessarily well correlated.

One problem Chrome doesn't have to worry about, but your site might (especially if its demographics skew towards people with older and possibly out-of-support systems) is out-dated web browsers.

Also I'm going to link the diediedie draft, which is now superseded by a version with a more corporate name but I was amused because the IETF's script crashed when trying to render it, so rather than link the current one that doesn't do that here's the original with the funnier name and the crash:

[https://tools.ietf.org/html/draft-moriarty-tls- oldversions-d...](https://tools.ietf.org/html/draft-moriarty-tls-oldversions- diediedie-00)

<comment><USER4> This is important, from a client perspective (e.g. from Chrome) this makes sense.

But from a server perspective, you still have trouble with old clients, particularly Windows XP.

Slowly disappearing but not gone yet.

Fortunately SNI (i.e. not requiring a dedicated IP per SSL customer) is becoming so commonplace that a lot of those browsers are getting broken anyway, which will probably speed up that deprecation.

</comment></comment></comment><comment> B-Con > Today only 0.5% of HTTPS connections made by Chrome use TLS 1.0 or 1.1.

Curious who the 0.5% are. Presumably Chrome is doing it's best to avoid falling back to TLS 1.0 or 1.1 unless necessary, so presumably these are sites that just don't support 1.2.

Apache added TLS 1.2 support 6.75 years ago: [http://svn.apache.org/viewvc?view=revision&revision=1222922](http://svn.apache.org/viewvc?view=revision&revision=1222922)

I'm curious how many of those sites just haven't upgraded their server in ~7 years.

<comment><USER3> One thing that really stings here is that only the past few years have OS vendors, library vendors and so on started paying attention to how people use their crap to build things, and so software written / custom sites developed before that awakening are often flawed because the developers tried their best but weren't experts and weren't given the opportunity to ask for "You know, good security, whatever that is at the moment?" but had to pick specific values for things they didn't understand, including protocol versions, ciper suites, key lengths, trusted roots...

For example, in Python you can ask for a specific TLS version ("Oooh, TLS 1.1 just came out, let's use that") or you can ask for what it calls "SSLv23" which means any protocol in the SSL/ TLS family whatsoever. But only in very recent 3.x Python releases can you easily specify "Um, anything above TLS 1.0 is OK?" even though that is clearly both more useful AND more likely to result in the software working as intended in future.

In fact, software developers reading this: You probably didn't implement TLS yourself (OK, the six smug people thinking "Yes I did", this isn't for you, you've already read and perhaps written similar rants before). TLS 1.3 was finished earlier this year. How many programs that you wrote more than six months ago are you sure will "just work" with TLS 1.3 if the relevant libraries or OS features are upgraded to support it? How many do you think will tell the library/ OS/ framework/ whatever "Oh, no, I definitely want TLS 1.2" even though actually it wants security, and TLS 1.3 would improve that?

<comment><USER5> > For example, in Python you can ask for a specific TLS version

libcurl has the same thing. A really common problem in PHP ecommerce libraries and applications is the misuse of CURLOPT_SSLVERSION to pin a specific protocol version. Then their payments stop working every few years ...

</comment></comment></comment><comment><USER6> Maybe somebody more familiar with TLS can set me straight here, but I find it surprising that SNI still exists and there isn't much effort to replace it. To me it seems like an odd hole to punch into the encryption layer. Back when I was doing security research I wrote a TLS MITM and I distinctly remember thinking "wow thanks SNI this makes it so much easier".

<comment><USER7> There are efforts to encrypt it: [https://tools.ietf.org/html/draft-ietf-tls- esni-01](https://tools.ietf.org/html/draft-ietf-tls-esni-01)

<comment><USER8> This is a step in the right direction but it's not perfect. The name of _at least one_ domain that the responding server must host is still leaked. This can be a non issue if the same ip is hosting hundreds of domains (e.g. CloudFlare) or pointless if it's just hosting one site.

I just had an idea that might be able to work around this though:

1\. Create a new TLD: .ip. All *.ip domains are valid ip addresses (in some encoding, e.g. 740-125-138-139.ip, or anything else) and they always resolve to the ip address specified. 2\. Automatically issue certificates for each host for each of the ips that they serve on. (Thank you Lets Encrypt) 3\. Every new connection made can just use the ip-domain as the esni originating host, because you can know that every host is serving [https://ownip.ip](https://ownip.ip).

This doesn't solve the fact that server ips are still fairly unique, and so a reverse dns might be enough to find the host, but it doesn't leak any more information than what the IP header already leaks, and it doesn't require leaning even more on increasingly centralized proxies like CloudFlare.

<comment><USER9> Certificates already support IP addresses. They just need to be public (i.e. not RFC1918 space) and for legacy browser compatibility the IP needs to be in the commonName and subjectAltName.

<comment><USER10> > (i.e. not RFC1918 space)

Is this just a restriction on current CAs? I have a self-signed certificate on my router (more out of curiosity than any practical benefit), and it comes up fine on [https://192.168.1.1/](https://192.168.1.1/)

<comment><USER11> Yes, this restriction applies only to public CAs. The purpose is to prevent someone from getting, for example, a 192.168.1.1 cert and then using it on another network in a mitm attack.

</comment></comment></comment></comment></comment></comment><comment><USER12> Similar announcement for Edge / IE 11: [https://news.ycombinator.com/item?id=18219528](https://news.ycombinator.com/item?id=18219528)

It would seem these announcements (Chrome/Safari/Edge TLS 1.0/1.1 deprecation) were coordinated.

Edit: The Microsoft announcement says as much.

</comment><comment><USER13> [Also posted on the related Firefox thread here: [https://news.ycombinator.com/item?id=18223672](https://news.ycombinator.com/item?id=18223672) ]

If you want Nginx to use TLS v1.2, this is what you need:

      ssl_protocols TLSv1.2;

…and if you compile a recent Nginx from source and bake in OpenSSL 1.1.1 while you do that, you can have TLS v1.3 with a TLS v1.2 fallback, too:

      ssl_protocols TLSv1.3 TLSv1.2;

See also:

[https://caniuse.com/#feat=tls1-2](https://caniuse.com/#feat=tls1-2)

[https://caniuse.com/#feat=tls1-3](https://caniuse.com/#feat=tls1-3)

</comment><comment><USER14> A related move by WebKit/Safari: [https://news.ycombinator.com/item?id=18221606](https://news.ycombinator.com/item?id=18221606)

<comment><USER15> Mozilla: [https://blog.mozilla.org/security/2018/10/15/removing-old- ve...](https://blog.mozilla.org/security/2018/10/15/removing-old-versions-of- tls/)

</comment></comment><comment><USER16> The real issue with deprecating TLS 1.0 and CBC ciphers is that you need a minimum of Android 4.4 for TLS 1.2.

Might not be reflected in browsing stats, but according to this: [https://developer.android.com/about/dashboards/](https://developer.android.com/about/dashboards/) it's 3.8% of Android users. And that number undercounts non-Google Play Services using Android devices.

<comment><USER17> This particular blog post and plan is regarding removing support of old TLS versions and options on the client. Which means that all server administrators need to do is enable TLS 1.2 and modern options.

Old clients (such as Android) will still be fine, if the servers don't also turn off older versions/options.

</comment></comment><comment><USER18> I feel like Google and Mozilla are acting too lenient here. In my opinion it doesn't matter if you wait 1 month or 2 years to remove support for old TLS versions, affected parties probably won't notice or act until it happens. On the other hand I understand that Google and Mozilla are very careful about user's experiences and their market share.

</comment><comment><USER19> Meanwhile in the finance industry... Excel 2010 only supports TLS 1.0

</comment><comment><USER20> Until some random IoT device from 2016 without updated firmware requires some weird old configuration to access it ...

</comment><comment><USER21> Shameless plug: I've been trying to tackle this front via removal of dependencies[1]. We have been relying on more and more complex and heavy protocols to secure any kind of transport security, just because the browsers do it this way. I don't think TLS is the right approach to all transport security nowadays.

[2] is a comparison of OpenSSL with the various experimental implementations of Disco (tl;dr: 700k LOC vs 1k LOC)

The thing is at [https://www.discocrypto.com](https://www.discocrypto.com)

(disclaimer: it's quite experimental at the moment)

[1]: [https://pbs.twimg.com/media/DpfV2wEWwAADIze.jpg:large](https://pbs.twimg.com/media/DpfV2wEWwAADIze.jpg:large)

[2]: [https://pbs.twimg.com/media/DpfD_43XoAANcHe.jpg:large](https://pbs.twimg.com/media/DpfD_43XoAANcHe.jpg:large)</comment>


Will you be interested in beta testing a new podcast app on android? - <AUTHOR> Hi Guys, I have created a new podcasting application called Funcastic Podcast.
"Funcastic is a mobile podcasting application where you can listen to your favourite podcasts on the go "on demand". Are you pressed for time? Do you generally not get time to relax because your only "Me time" is on the metro or bus ride home? Do you find yourself stuck in traffic switching channels for the most part of your ride home because every single radio channel is having similar content and you can't pick and choose the content that YOU want.
Then FUNCASTIC is the APP FOR YOU!
Slow 2g, patchy internet or no network at all?
Access Funcastic offline and listen to your previously downloaded articles. Funcastic also allows you to download and store the articles you want and listen to them even at Bermuda triangle .
Get notified for your favourite podcasts store them and listen at your leisure.
Now enjoy high quality articulate audio whenever you want even on 2G.
All this and much more…Just for you! Happy Listening!
If it interests you then kindly check it out at
https://play.google.com/store/apps/details?id=com.funcastic.news
Thanks! <comment><AUTHOR> We release new build everyday.

</comment><comment><USER2> I have downloaded the app. Is this buzzee your firm? What is the turnaround time for releasing a newly build?

</comment><comment><USER2> I have downloaded the app.

Is this buzzee your firm ? What is the turn around time for releasing a new build ?

</comment><comment><AUTHOR> Yes buzzee is my firm</comment>


Fossil SCM 2.1 released with SHA3-256 support and graceful upgrading - <AUTHOR> https://www.fossil-scm.org/index.html/doc/trunk/www/changes.wiki#v2_1 <comment><AUTHOR> Fossil now comes with a configurable hash use policy, and by default uses SHA3 once peers start:

> Beginning with Fossil 2.1, the default hash policy for legacy repositories > changed to "auto". That means Fossil 2.1 will continue to generate only SHA1 > hashes until it encounters one artifact with a SHA3 hash. Once a single SHA3 > hash is seen, Fossil automatically switches to "sha3" mode and thereafter > generates only SHA3 hashes.</comment>