Ed25519 for DNSSEC - <AUTHOR> https://ed25519.nl/ <comment><USER2> This sounds interesting but really isn't.

Think about it for a second and you'll realize that _specifying_ a modern signature scheme for DNSSEC is trivial. The best modern signature schemes are designed to be easy to adopt!

The problem is that none of the installed DNSSEC base groks ed25519. It took years to get P-curve DNSSEC --- which virtually nobody uses --- to the point where its mere presence didn't break resolvers. It would probably take something on the order of 10 years of concerted effort to get 95%+ of active resolvers to grok ed25519, and during that time everyone who wanted secure signatures would need to sign both with RSA and with ed25519, and for 10 years _after that_ we'd be dealing with people keeping insecure RSA signatures around out of compat concerns, and then comes the Usenix papers about downgrade attacks, and at night the ice weasels come, just like anyone who's dealt seriously with TLS will tell you.

What's especially irritating about this situation is that we _know_ the signature scheme used in "mainstream" DNSSEC is inferior to modern curve signatures, and we know virtually none of the DNSSEC software being deployed can grok modern curve signatures, and we know this is an upgrade that needs to happen lest we get a whole crapload of new 1990s crypto deployed across the Internet, and still DNSSEC advocates are pushing for more deployment of this stuff.

Nobody uses DNSSEC right now. If the root private keys were dumped to Pastebin right now, to a pretty good first approximation not one commercial operator on the Internet would need to send out a breach warning to customers. We should all be taking a breath and reconsidering the protocol and its implementation details.

This, of course, isn't all that's wrong with DNSSEC. Google [against dnssec].

<comment><USER3> Those are like hipster reasons to not like DNSSEC! DNSSEC is just dumb and doesn't work.

      [ User ] <-----> [ Resolver ] <-----> [ Auth DNS ]
                  ^                    ^
      Most attacks work here     DNSSEC protects here

<comment><USER4> Presumably advanced users can pick a resolver with DNSSEC support?

<comment><USER5> You mean the resolver does the verifying? That doesn't solve anything; anyone doing an MITM attack between the user and their resolver can flip the 'ad' (Authenticated Data) bit to '1' even if the verification failed, and if the user isn't verifying the signatures too, they will blindly trust the value of this bit.

Users need to run their own local /verifying/ resolvers for this to be secure (or have a trusted path between them and their remote resolver, e.g. IPsec-AH or DNScrypt).

</comment></comment></comment></comment><comment><USER6> A little Self promotion: TRust-DNS Resolver and Client support ED25519. Currently working through some issues on the signing logic in the Authority.

[https://github.com/bluejekyll/trust-dns](https://github.com/bluejekyll/trust- dns)

<comment><USER7> Any interest in implementing DNSCrypt? I feel DNSSEC alone is useless since one can't guarantee integrity to the DNS resolver.

<comment><USER6> I looked at DNSCurve, I wasn't really happy with the complexity of implementing it. I got so far as understanding the protocol, even found a bug in the docs. If someone else wanted to look at this, I'd gladly work with them to implement it.

Personally, I'm much more interested in DNS over TLS, b/c I can leverage existing (already have!) TLS implementations.

Edit: I'd also debate the usefulness of DNSSec without curve. Curve and and DNS over TLS provide privacy with the Resolver/Authority, while DNSSec still independently can verify the authenticity of the RRSET. It still provides a good service in that context.

<comment><USER7> Sorry, I meant DNSCrypt (I thought I edited it soon enough). DNSCrypt is meant to be more about the last leg encryption/integrity/authenticity guarantee (compared to DNSCurve atleast) between a client and (caching) server.

I agree with you on the DNS over TLS part. It is definitely a great idea. With TLS, secure transport implementations are already done to death so I guess we don't have to worry about another. I do have a question though. How are you handling the DNS request for the initial TLS connection? I'm talking about this:

1\. Want to make DNS query for X.com

2\. Connect to personal-dns-server.com over TLS connection for DNS request.

3\. Want to make DNS query for personal-dns-server.com.

4\. ?

I'm asking this because your TLS implementation seems to be about the whole works - including the CA system. Which needs a CN. Which needs to be resolved (I initially thought it was just about the key neg + transport part of TLS with a hardcoded IP address in the config file)

About DNSSEC + DNSCurve/TLS. I just wasn't talking about privacy. Integrity was my primary concern. DNSSEC isn't widely deployed, so we don't really know which domain implements DNSSEC and which doesn't. So in the last leg of DNS reply, one can just remove the RRSIGs and make it look like DNSSEC was never implemented. Pretty much a downgrade (to nothing) attack.

Also, we don't have any way of warning the user if a RRSIG doesn't validate the A rec properly, so what's your plan on this? A while ago I had a similar idea you did, but more geared towards being an on-disk cache (check out pdnsd - sad it is unmaintained though) where I thought eventually it has to step into user alerts using the notification daemon.

<comment><USER6> Let me unpack this starting from here:

>I'm asking this because your TLS implementation seems to be about the whole works - including the CA system. Which needs a CN.

Yes, I am leveraging the standard TLS design, it includes the defaults as specified by the underlying TLS implementation; currently this is openssl, native-tls, or rustls. Like DNSCrypt (Curve), the server must be registered out-of-band if it is not signed by one of the CA's registered in the system. I thought about this for a while, and decided it was best for ease of use to rely on the system CAs and allow additionals to be registered.

> Which needs to be resolved (I initially thought it was just about the key > neg + transport part of TLS with a hardcoded IP address in the config file)

This isn't accurate. The CN is only used by the underlying TLS library to validate the Subjects in the X509 cert returned by the server. There is no additional lookup required for that name. Honestly, since that name isn't being used for resolution (i.e. your using IPs in DNS config), this doesn't provide as much value in DNS as it does in standard TLS connections where a name was resolved to an IP, but at least it would validate that the NS servers are named what you expect.

> How are you handling the DNS request for the initial TLS connection? I'm > talking about this:

>

> 1\. Want to make DNS query for X.com

> 2\. Connect to personal-dns-server.com over TLS connection for DNS request.

> 3\. Want to make DNS query for personal-dns-server.com.

> 4\. ?

Again, there is no "DNS" request for the TLS connection, this is the order:

1\. A direct IP connection to the remote TLS server based on configuration,

2\. The TLS handshake is performed with that server, using the associated CN on the connection, and validating against the associated CA list

3\. Standard TCP DNS request is performed from this point.

Does that help clarify this impl?

<comment><USER7> Apologies. Your implementation was a little tricky to understand. Excellently commented though.

Can you give me an example config file for the client? (I could only see one for the server)

PS: In a couple places, 'Ellyptic' was written so you might want to correct that.

<comment><USER6> The Client/Resolver doesn't actually have a config for enabling TLS ATM, this should be added as a backlog issue. At the moment you'd have to build this into a custom Rust impl. I've been considering whether it can be an addition to the resolv.conf, or should just have a separate TOML.

If you don't mind, would you want to file an issue and describe how you want to use this?

Edit: I have been planning on a system daemon caching resolver that can be run on any OS. This work is only just getting started.

> In a couple places, 'Ellyptic' was written

Yeah, me and spelling have had a issue going all the way back to 1st grade ;)

Edit: btw, you're comment about CN got me thinking again about the correct usage of that, and I wonder if "name" is even correct. It might be better to have the certs be validated against IP's listed in the Subject of the Cert... I need to revisit this.

btw, here's a good example from one of the tests that shows how to set this up: [https://github.com/bluejekyll/trust- dns/blob/master/rustls/s...](https://github.com/bluejekyll/trust- dns/blob/master/rustls/src/tests.rs#L193-L207)

<comment><USER7> Thanks. I'll check it out. What you are saying can work if the client has a an IP/port and the CN that is in the Server's Cert in a config file. If you are targeting linux I would say have a new config file in /etc . Messing with resolv.conf isn't recommended since it is re-generated frequently.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Interesting. From the web page:

"This domainname, is DNSSEC signed with this algorithm."

Yet:

dana@araman:~$ whois ed25519.nl

Domain name: ed25519.nl

Status: active

Registrar: TransIP BV Schipholweg 9b 2316XB LEIDEN Netherlands

Abuse Contact:

DNSSEC: no

Domain nameservers: mango.plexis.eu pdns-public-ns1.powerdns.com pdns-public- ns2.powerdns.com

Record maintained by: NL Domain Registry

...

I'm inclined to believe the claims of the web site without checking. It's just interesting that:

1\. The whois data for .nl is taking some interest in DNSSEC

2\. That they are wrong about it being DNSSEC signed.

My (weak) guess is that whatever they are using to get the DNSSEC information doesn't understand Ed25519.

<comment><USER9> I've checked, it's definitely signed:

      ; <<>> DiG 9.11.0-P1 <<>> ed25519.nl +dnssec
      ;; global options: +cmd
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 594
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

      ;; OPT PSEUDOSECTION:
      ; EDNS: version: 0, flags: do; udp: 512
      ;; QUESTION SECTION:
      ;ed25519.nl.			IN	A

      ;; ANSWER SECTION:
      ed25519.nl.		1341	IN	RRSIG	A 15 2 3600 20171012000000 20170921000000 27662 ed25519.nl. Z62ywpWQ4ahOs0DZxIs3OAY67qc226z6rs8k8q2i/hdwQAjz5EL5ZJke t25LD88wx5kGY5ru6Dvfrd7KvODCAg==
      ed25519.nl.		1341	IN	A	18.104.22.168

      ;; Query time: 55 msec
      ;; SERVER: 22.214.171.124#53(188.8.131.52)
      ;; WHEN: Wed Sep 27 20:44:46 EDT 2017

<comment><USER10> The zone may be signed locally, but the DS records for ed25519.nl haven't (when I checked myself just now) yet been exported into the TLD zone. It's basically equivalent to a self-signed certificate. The lack of DS records in the TLD zone is the reason why WHOIS says "DNSSEC: no".

<comment><USER11> The .nl registry does not support algo 15 (and 16) for DS records yet. Support is expected soon.

</comment></comment></comment></comment><comment><USER12> I had to turn off DNSSEC support for my Bind9 at home, from time to time pages wouldn't resolve or it would take up to 10 seconds (ages!). When I checked the logs it was something about EDNS packet sizes that tripped it up. Turned EDNS off (and DNSSEC with it) and had no issues what so ever. It's a pretty standard installation with a few master zones and it's resolving queries directly - without forwarding to ISP or GoogleDNS or anything.</comment>


Why Can't Error Messages Be Fun? - <AUTHOR> http://www.codinghorror.com/blog/archives/001238.html

<comment><USER2> "Chrome is a joy to use, and in my opinion at least, it's the first true advance in web browser technology since the heady days of Internet Explorer 4.0."

Um... add-ons? XMLHttpRequest? User scripting/Greasemonkey? User stylesheets? Built-in search bar? AwesomeBar? Ubiquity? Adblock? Popup blockers? True zoom? Session saver? Tabs?

<comment><USER3> Well, it's not the _first_ true advance, but it's got tab processes and the Javascript engine (JIT compiler, I think it was) and some other new ideas.

<comment><USER2> Yeah, sure. I didn't mean to imply that Chrome didn't have some cool stuff.

I really hope this tab-as-process thing catches on, or at least become something you can enable (right-click -> fork or something similar).

<comment><USER4> It's the way the main browsers are going. Firefox is still wrestling with it, as I understand it, because it adds more overhead for memory which is obviously something they were already fighting with.

</comment></comment></comment></comment><comment><AUTHOR> Following on from yesterday's debate on the suggested banning "coding horror" from HN here is a fun post that could get us all thinking about the very thorny issue of communicating application problems to the user.

</comment><comment><USER5> NetPositive, the default web browser on the BeOS, had great error messages. Here: <http://www.8325.org/haiku/>

</comment><comment><USER6> I really dislike these cutesy google-style error messages à la _"oops something went wrong"_ and _"Aw, snap ..."_ \- Often, their information value is zero: they don't explain to you how to solve the problem or what went wrong (maybe with the exception of the frozen error message). When you are frustrated because something isn't working these messages can get on your nerves fast.

It's great if you can package the information in a funny way, but if you can't I'd take function over form any time.

<comment><USER7> If they could "explain to you how to solve the problem or what went wrong" then they wouldn't need to show a vague error message. They'd just fix the problem.

<comment><USER8> Typically, though, if the browser could display some kind of information on the nature of the error, this could give a savvy user something they could type into a search engine or ask an intelligent question about on a forum, which might help them fix whatever is causing their problem.

This might not apply as much to the web, where the problem is likely a malfunctioning network connection, or a problem with the web server (or server side code). But it could help where the user is having a problem trying to accomplish something with an application which they will never be able to do until they change something on their end, or attempt it a different way.

</comment></comment></comment><comment><USER9> Cute/Fun error messages will IMO get annoying really fast once the novelty wears off. Just like that clippy thing in MS Office.

<comment><USER10> No really I've seen the errors probably twice using Chrome full time since its release. And each time they disarm any anger I have and make me smile.

Write your software with so few bugs that its a joy to see them every time they pop up and your doing something right.

</comment></comment><comment><USER11> One computer I owned did make them fun, although it still didn't lighten the blow of having to reboot:

<http://en.wikipedia.org/wiki/Guru_Meditation>

</comment><comment><USER12> Spending time to make your error messages interesting or fun or silly or whatever is time spent doing something that shouldn't be shown. Oversized pixelated graphics of freezing browser tabs says "our programmer created this in three minutes", which is most likely the right amount of time, considering the important thing about that kind of error reporting is the ability to let the user recover and try again.

</comment><comment><USER13> That only really works if your application crashes _very rarely_ to begin with. Unfortunately, that excludes the stuff I'm working on.

I really like the "dead tab" icon, but if it showed up 5 times per day, I'd grow to loathe it in a week.</comment>


Microsoft's browsers return to losing habits, fall to 25% share - <AUTHOR> http://www.computerworld.com/article/3164424/internet/microsofts-browsers-return-to-losing-habits-fall-to-25-share.html <comment><USER2> Google and chrome are the biggest threat we have to the open internet at the moment.

<comment><USER3> Agreed. I don't understand why there are still memes against Internet Explorer floating around. Edge is not the problem.

<comment><USER4> As a web developer I'd rather develop for Chrome than IE/Edge. It's pretty much just that simple.

<comment><USER5> That is exactly the attitude web developers had toward the IE/Netscape situation around the year 2000.

I think that as web developers we have the responsibility to consider the health of the entire ecosystem, as well as long term consequences. If not us, then who?

<comment><USER6> I understand your point and I actually make sure that my websites target IE10 and up, but it usually happens after I'm done in Chrome.

Have you worked with Edge/IE? The pain starts with, as a Mac user, having to boot up a VM and ends with the, in my opinion, horrible development tools compared to Chrome or even Firefox. In this state Edge will never be more than an afterthought.

<comment><USER7> "as a Mac user, having to boot up a VM"

So are you a developer, or a Mac user? Do you develop for Mac users, or users?

<comment><USER6> For users. Yet I happen to be a developer on a Mac like many others. As mentioned before I'll make sure that it works in IE/Edge, but having to jump through hoops to do so will never make me treat the process as more than a checklist item close to finishing the project. Of course I don't expect Windows developers to see it any other way with Safari.

This is a non-issue for cross-platform browsers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> won't be really hard to improve the market share: \- make edge cross platform. \- make the extensions system on par with chromes and as easy to launch an extension \- fix its UI lag on Windows 10 \- maybe open source it

<comment><USER9> I don't think adding OSX or Linux users will fix the problem. Nor will open or closed source.

<comment><USER8> having a consistent browser experience over multiple platforms is an added feature for many users. e.g. I install chrome in all platforms I use.

<comment><USER9> My point is OSX + Linux is like 5% of the desktop OS. No matter how awesome Edge team made it, 1-2% more users will do VERY VERY little compared to the 50% of users they have lost on desktop machines in the past 5 years. They would be absolutely insane to even spend 1 money on adding new OSX users when Windows users (who get their app for FREE and with NO WORK) are leaving left and right. Gotta fix the bleeding before you worry about the lipstick.

<comment><USER8> You're forgetting Mobile. Using Chrome on android and Windows gives you the benefit of shared accounts, shared passwords, bookmarks and history.

</comment></comment></comment></comment></comment><comment><USER10> I tried using Edge, but just get a "This app can't open" message. I'm sure I could fix it if I wanted to but it's easier to just run Chrome.

</comment><comment><USER11> I just dont like the browser, the things I dont like are:

\- the search / address box are not obviously that until you click on it

\- the window bar area to click on and drag the window around is small and not obvious

Not major things but it makes it less intuitive to use than chrome in my opinion.

</comment><comment><USER12> Does this mean we'll get even more notifications on Windows 10?

</comment><comment><USER13> Its right about time for a disrupt effort, Chrome is outrageously slow.

<comment><USER14> Slow how to me it still loads any website the fastest. The biggest complain about chrome is that it is bloated specially if you use more than few tabs. But I don't see google working on fixing or improving that much simply because using more than a few tabs is an edge case which probably less than 1% of the users use.

<comment><USER15> > using more than a few tabs is an edge case which probably less than 1% of > the users use

Using basic functionality of a browser (opening multiple tabs at a time) is an edge case? Every person I know that uses Chrome has at least 5-10 tabs open at a time. I wouldn't call it an edge case, but I would guess that the minority uses less than 3-4 tabs at a time.</comment></comment></comment>


'Intuitive' prosthetic hand sees what it's touching - <AUTHOR> https://www.engadget.com/2017/05/03/intuitive-prosthetic-hand-sees-what-its-touching/ <comment><USER2> This is really some researcher's response to their parents admonishing them with "You see with your eyes, not your hands!"

<comment><USER3> With the prosthetic hand having vision you can do a Romberg's test on it :)

[https://en.m.wikipedia.org/wiki/Romberg's_test](https://en.m.wikipedia.org/wiki/Romberg's_test)</comment></comment>


Savaged by Systemd: An Erotic Unix Encounter - <AUTHOR> https://www.amazon.com/gp/product/B075DYXZW1 <comment><AUTHOR> please don't miss out on the glorious reviews:

 _> When I discovered this book, it unlocked the full erotic potential of what an init system could could be. Since buying this book, I'm filled with desire to migrate and unify everything in Systemd. I want my console in systemd. I want my mount in systemd. I want my syslogs in systemd, saved as binary data because I love my troubleshooting rough. Even my bootmanger should be in systemd (so very, very soon).

If there weren't laws against it, I would even dare say: I want Emacs in Systemd._

...

<comment><USER2> Emacs in systemd: [https://emacsredux.com/blog/2020/07/16/running-emacs-with- sy...](https://emacsredux.com/blog/2020/07/16/running-emacs-with-systemd/)

<comment><USER3> Can't decide which Jurassic Park wisdom applies to this: "they were so worried about whether they could that they didn't consider whether they should" or "Life, uh finds a way"

</comment></comment></comment><comment><USER4> See also his book _git commit murder_ ("If Agatha Christie ran Unix cons"):

* [https://mwl.io/fiction/crime](https://mwl.io/fiction/crime)

</comment><comment><USER5> I have a copy of this, it was surreal. Would suggest as a gag gift for someone that isn't easily offended.

</comment><comment><USER6> If you enjoy fantastical humorous erotica, you may enjoy the works of the incredibly prolific Chuck Tingle - or at any rate, their titles:

[https://en.wikipedia.org/wiki/Chuck_Tingle](https://en.wikipedia.org/wiki/Chuck_Tingle)

</comment><comment><USER7> Just reading the reviews was oddly satisfying.

</comment><comment><USER8> This made my day. Thank you so much</comment>


Why Google's Go is a Bore - <AUTHOR> http://monoc.mo.funpic.de/go-rant/

<comment><USER2> I'm not sure the negative comments about UNIX, C braces and C++ templates help.

They are unrelated to the case and make me feel the author isn't interested in being constructive.

The debate between terse and ugly is a non-sense. Had the author a more open mind, he'd realize that the comfort zone where we place things we call "beautiful" is flexible and what one may find ugly the other may find beautiful.

<comment><USER3> _Well, I'm out of steam on this rant. Why the vituperative venom if Go is so uninspired and boring? It's the noise around it, really. It's yet another celebration of technical mediocrity that has caused computing to never really live up to its potential. This offends me at a profound level._

Complaints only add to the noise. Building things is the best way to add to the signal instead.

<comment><AUTHOR> I'm a friend of the writer and we are actually looking at building something. "Wequi", or the original word for the game Go.

</comment></comment></comment><comment><USER4> Popover ads?! Nearly made me close the tab without reading a word of the article.

funpic.de is obviously an old-fashioned sort of hosting company.

</comment><comment><USER5> Stopped reading when I got to the first use of "UNIX virus" (actually I didn't but I should have). Unnecessary for the article, which itself is fairly lack- luster.

</comment><comment><USER6> >...you don't put in language features assuming a good programmer.

Interesting design goal.

<comment><USER7> Way to miss the point.

Another way of putting it would be that languages should be designed so that there aren't gaping holes waiting for people to fall in. They should rather tend towards a "pit of success" - the easiest way to do things should be the correct way.

Error code results make it really easy to ignore errors. That's not a good thing.

<comment><USER8> No, it doesn't in this case. The multiple return values make it impossible to accidentally ignore an error.

<comment><USER9> It requires at least 3 lines for every function call unless you ignore errors. Exceptions allow you to catch them without boiler-plate for each function.

      if result, ok := func(arg); !ok {
          // handle error
      }
      // process result ..other stuff

On the other hand channels & goroutines allow in principle less verbose mode at the cost of additional parameter to every function in a stack.

      errors := make(chan Error)
      go handle_errors(errors) // read from errors
      // ...
      result := func(arg, errors) // write to errors in case of an error
      // process result ..other stuff

</comment></comment></comment></comment><comment><USER10> Boredom is a problem of depth and duration.

TFA is putting expectations on GO that seem out of line with "Systems Implementation Language". The article expects that each new language will be an "advance", whereas in the school of Arthur Sale or C.A.R. Hoare often advocate removing stuff from a language to make it better.

</comment><comment><USER11> _yawn_

Yet one more rant completely missing the point and whining about the lack of exceptions (which at least as implemented on most languages most sensible and experienced people agree foment bad error handling practices, so the current Go approach is superior) and generics (still unclear if they make any sense given Go's interface system, which the author _completely_ ignores.)

And reading the rest of the gripes, the author clearly had zero interest in learning the language.

> (Yes, that is a statement you see between "if" and the test. No, it serves > no real purpose beyond obfuscation.)

Way to show you have not learned anything about the language or even tried to write even a program a dozen lines long!

<comment><USER7> Fundamentally disagree with you on exceptions. Exceptions as implemented in e.g. Delphi or .NET work very well. In C++ the complexity of exception handling is deeply exacerbated by things like copy constructors - the bias in the language towards (what I call) value-oriented programming, rather than object orientation - and in Java exceptions are hobbled by the misguided notion that exceptions should be handled nearer the point of the throw rather than far away, in the relevant main loop of the app; hence the requirement to trace through annotations throughout the call graph from low-level throwing code to high-level catching loops, or basically avoid the bad design with RuntimeException.

<comment><USER12> I agree with the person you are disagreeing with, in this case. Go is being touted as a systems programming language.

My experience of very low level programming is that you want to know exactly what's happening, and especially when things go wrong. And you want to know what's gone wrong right at the point of it going wrong.

Exceptions are the wrong technique for this form of programming. When doing systems work you are spending a lot of time dealing with error situations and hence the handle the error and pass up an error code form is appropriate.

<comment><USER13> Even in Kernel programming, exceptions are useful. If you read <http://www.kernel.org/pub/linux/docs/lkml/#s15-5>, you'll see that goto's are used to reduce code duplication for error handling, which is essentially just a poor man's exception. More sophisticated exception handling in C can and has been done with longjmp as well.

<comment><USER11> Go has goto.

Unlike goto as used in the linux kernel, exceptions will jump up the call stack god knows where.

And in essence exceptions are not goto, but _camefrom_.

<comment><USER7> Exceptions jump to the declared handler - i.e. the _right place_.

I remain convinced that far too many people have gotten wrong ideas about exceptions from the bastardized implementations in C++ and Java.

</comment></comment></comment></comment></comment></comment><comment><USER14> And what about that mascot character? Geez, that is the ugliest thing ever.</comment>


Apple's new Catalina operating system won't run old versions of Word - <AUTHOR> https://slate.com/technology/2019/10/apples-new-catalina-operating-system-wont-run-old-versions-of-word.html <comment><AUTHOR> I find it revealing that this is appearing in such a mainstream, non-techie venue. It would also be nice if in the installer did a sweep of the applications folder and listed which applications are incompatible, then gave users the option to update, rather than updating, then leaving a shit surprise. To my knowledge that's not how the installer works right now.

<comment><USER2> Agreed. The opposite triggers are in place - if you try to install something from a dmg and it won't run on your older version of OSX, it puts a "No Smoking" style circle and slash across the install icon and won't let you run it. Included is a little warning that the install is meant for a minimum OS version that isn't met on the particular system.

Funny that they wouldn't do that the other way around for updates of the OS itself, to ensure the stability of all you have built up on it. It doesn't always "just work" in that sense.

I haven't updated OSX major version in so many years it isn't funny, because I got fed up with Logic constantly breaking every time. Unless there is a pressing need to update either, my Mac Pro is staying exactly at the _stable_ versions it has been for what Apple clearly thinks is much too long.

EDIT: Small bit of history most people probably didn't notice: When Apple bought Logic, they killed the Windows version. That was okay, since the file formats were compatible. But then the first upgrade after that completely killed the Windows compatibility, and they (for whatever reason) never thought it important enough to provide a converter.

So many musicians were left with tracks that they had to completely re-arrange from the raw tracks, or re-record in order to continue working with older projects. And either way, you lost everything relating to MIDI in that process. It was seriously pathetic and unprofessional of them.

That's the crux that stopped me from doing major updates unless I KNOW everything will keep working, and there is something in it that is of interest to me (I don't care about interface "art" like whether the buttons are 3D or flat, etc... that's not enough to risk losing all my work.)</comment></comment>


CSS Mini Reset - <AUTHOR> http://www.vcarrer.com/2010/05/css-mini-reset.html

<comment><USER2> Interesting. I never knew I was doing CSS Reset all this time. I add this to the top of most of my CSS files:

        body, html, form {
          margin:0;
          padding:0;
        }
        table {
          border-collapse:collapse;
        }
        a {
          text-decoration:none;
        }

There are a few more rules I add but they depend on each site of course.

<comment><USER3> I don't use border-collapse (I don't even know what it is)

but i have those also :

      body{
        font-family:verdana;
        font-size:0.8em;
      }

      p,h1,h2,h3,h4{
        margin:0;
        padding:0;
        font-weight:normal;
      }

      ul{
        list-style:none;
        margin:0;
      }

<comment><USER4> > I don't use border-collapse (I don't even know what it is)

When two borders are stacked together, they will be collapsed into a single border. Only works with tables though.

</comment></comment></comment><comment><USER5> I have seen this now several times, why don't those CSS resets use the universal selector?

      * {margin:0;padding:0;}

works fine. You want to reset not only html and body but also your hn and p elements, right? Isn't that sort of the idea?

That one line is pretty much the only thing I do in the way of CSS reset and it's tremendously helpful. There will only be margin and padding if I explicitly declare that I want it which in turn helps remove a lot of margin:0; and padding:0; (which before, because of laziness, I often put in just to be safe).

<comment><USER2> My understanding is that * { anything } is a huge performance hit, especially for rich UI apps.

<comment><USER5> Ah! That's why. (Doesn't matter for what I'm doing, though :)

</comment></comment></comment><comment><USER6> I prefer to completely reset all default CSS rules and specify them manually. Works great for me, I haven't noticed any drawbacks.

        * {
            background-color: transparent;
            border: none;
            border-spacing: 0;
            font-size: inherit;
            font-weight: inherit;
            font-family: inherit;
            line-height: 1.5em;
            list-style: none inside;
            margin: 0;
            padding: 0;
            text-align: inherit;
            text-decoration: none;
        }

<comment><USER7> Apart from form inputs getting really messed up, there's a 'massive' speed penalty you incur by using the * selector to reset everything. Where massive probably isn't large enough for most websites, so if it works, carry on :)

</comment></comment><comment><USER7> What this basically does is what you would do when starting without a CSS reset: Just reset the elements while you're styling them. Elements that you don't use don't get reset.

That's fine of course, but if you make a lot of websites then you really just want a common stylesheet that does everything you might need, and go from there. (I made sencss with that in mind: <http://sencss.kilianvalkhof.com> )

</comment><comment><USER8> I use:

       <link rel="stylesheet" type="text/css" href="http://yui.yahooapis.com/2.8.1/build/reset/reset-min.css>

</comment><comment><USER9> This is the CSS reset I normally use:

        /* reset block elements */
        blockquote, dir, div, dl, form, h1, h2, h3, h4, h5, h6, hr, ol, p, pre, table, ul  {
    	    margin: 0;
    	    padding: 0;
    	    font-size: 1em;
        }

</comment><comment><USER3> weird, I was expecting Eric Meyer to have a very beautiful CSS website since I learned CSS with his books. I was disapoint.

<comment><USER10> <http://meyerweb.com/eric/css/edge/complexspiral/demo.html>

I remember when that was the height of internet awesomeness!</comment></comment>


An unusual highschool graduation speech. - <AUTHOR> http://americaviaerica.blogspot.com/2010/07/coxsackie-athens-valedictorian-speech.html

<comment><USER2> This appears to be the blog of the girl who gave the speech, but here is the previous discussion.

<http://news.ycombinator.com/item?id=1573636> <\- Over 200 comments

Additionally video:

<http://news.ycombinator.com/item?id=1592436>

<http://news.ycombinator.com/item?id=1592481>

<http://news.ycombinator.com/item?id=1600567>

<comment><USER3> You deserve more credit for this.</comment></comment>


Dynamic Code Injection for Good - <AUTHOR> http://stanfy.com/blog/dynamic-code-injection-for-good/

<comment><USER2> The biggest problem that forces you to run through all the pre-setup UI views and other stuff is that often time you need those to recreate states, and when you have a bug, more often that not, you have a corrupt state, which will stay corrupted with or without code injection. dyci is definitely a very neat method but of limited use.

</comment><comment><USER3> I have a secret "eval" page on sites that's enabled during development (protected by a huge password, just in case, though). It evaluates code & shows the results as I'm typing it in real time. Better than a console.

Take this page away from me, and I'll develop at least twice slower.

<comment><USER4> I'm interested in what ways it is better than a console? Do you add any specific features that help productivity?

<comment><USER5> I just discovered that my answer only shows when I'm _logged in_ to my "mantrax" account. Did HN mark me as a spammer or something, WTF?

Anyway, here goes my original answer:

 _\- Code and results side by side._

The screen is split in two, both have independent scrollbars. 1) Left column, a roomy text editor (the minor annoyances like tabbing, or CTRL+S bringing the save page dialog are easily fixed in JS, heck there are full blown editors I could use if I care, with syntax highlighting etc.). 2) Right column - results. Often when the result of your code is a large data structure in a CLI, you lose sight of your code - not here.

 _\- Entering larger structures (functions, classes)_

Often you need to copy a block of code and tinker with it and see what it produces. In CLI this can be either impossible, or awkward - you can't normally enter a class line by line, it should be entered at once. But in a roomy textarea, you can just paste it, and it just works.

 _\- Entering (and not losing) initialization code_

Likewise for any initialization code. On the command line it's very easy to test one-liners, but code that requires setup, loading your current project environment, and instancing a few objects and configuring them, the CLI comes short. If I do something wrong the CLI process might also die (fatal errors, exceptions, endless loops etc.), and lose my carefully set up test. With an eval page, every time I type something, the entire block of code gets re- evaluated from scratch, including the state set-up, nothing is lost.

 _\- Copying code blocks back into my project_

Just like it's easy to copy code form my project into the eval box, sometimes I produce a useful bit of code I want to paste back into my project. When you have code and results mixed in CLI that process becomes quite tedious. With the eval page textarea it's quick and natural.

 _\- I don 't have to finish a line to see my results (or mistakes): real time evaluation_

In a CLI you need to finish typing the line and hit Return to see what happens. Then to correct it, you hit up, the line is copied and you get the chance to correct it, but in the process littering your CLI history with useless entries that are confusingly similar (but most of them are wrong). In an eval box, you can get live feedback as you type (I've made it so if you pause for 200ms, it re-executes the code and shows results), and you don't have to "copy" a line to fix it - the line is there, editable, so you just edit it. Let's say you're not quite sure about an argument format in some API call - tweak it, pause for a split moment, you see the result. Very easy to find the right code intuitively, by experimentation. Heck, sometimes it's faster than reading the documentation! Hehe.

 _\- The power of HTML, JS widgets and the browser 's developer console all come out of the box_

Last, but not least: if it's in the browser, it means you have access to HTML and JS widgets. If your result is HTML, you can see the HTML DOM rendered, not just the code. And you have access to the browser's own debugging console. I can dump an object tree to the console as a dynamic expandable tree with a set of little [+] and [-] buttons. It's a different world entirely. A better world.</comment></comment></comment>


Recommendations about coding in C++ - c-plus-plus https://software.intel.com/en-us/articles/the-ultimate-question-of-programming-refactoring-and-everything <comment><AUTHOR> A quick question item 13 (table-style formatting): the author proposes something like this:

      static bool IsInterestingError(int errno) { ... }
      ...
      if (!IsInterestingError(errno)) { ... }

Can you do that in a single file – assuming the latter errno is the one defined in errno.h (or cerrno). I was of the impression that errno may also be a macro, so could you say it's a good recommendation to have it as an argument's name – or in general even to reuse the name anywhere?

I agree that the option (of passing the helper function no arguments at all) is not perfect either, but... (I also don't like that you need to call your stored errno's errnums or the like, but that's what we have.)

<comment><USER2> If errno can be a macro, as at least one man page claims, the argument in the function could expand and even not compile or produce something unwanted. I'd prefer:

       static bool IsInterestingError(int e) { ... }

[http://man7.org/linux/man-pages/man3/errno.3.html](http://man7.org/linux/man- pages/man3/errno.3.html)

<comment><USER3> errno is a macro on most (maybe every) platform supporting pthreads.

Furthermore, C11 literally defines errno as a macro in 7.5p1:

      The macros are

             EDOM
             EILSEQ
             ERANGE

      which expand to integer constant expressions with type int, distinct positive values, and
      which are suitable for use in #if preprocessing directives; and

             errno

      which expands to a modifiable lvalue that has type int and thread local storage
      duration, the value of which is set to a positive error number by several library functions.
      If a macro definition is suppressed in order to access an actual object, or a program
      defines an identifier with the name errno, the behavior is undefined.

Notably, C11 introduced an optional threading API, effectively derived from the common functionality between Window's threading API and POSIX pthreads. While I can imagine ways to have a unique errno symbol that doesn't rely on macros, the obvious solution does and there's little reason not to use it.

While C11 is most definitely not the same thing as C++11, I think, similar to atomics, the committees cooperated on the threading API. I don't have a recent C++ standard handy at the moment, but I wouldn't be surprised if C++11 at least allowed defining errno as a macro.

</comment></comment></comment><comment><USER4> > Never dereference null pointers

Something's wrong with us if this has to be mentioned in a list like this.

<comment><USER5> You'd think. But there was a long argument here[1] not even a week ago with multiple people passionately asserting that they were entitled to be able to rely on completely predictable and non-fatal semantics when derefrencing a null pointer.

[1]: [https://news.ycombinator.com/item?id=13640505](https://news.ycombinator.com/item?id=13640505)

<comment><USER6> The problem with C and C++ isn't so much that undefined behavior exists, but the fact that the rules that determine when a program has defined behavior aren't formalized rigorously enough. The C and C++ specifications are written in natural language, which always leaves room for ambiguity, no matter how pedantically one tries to write.

If you want to convince a single other person that a C program you have written has no undefined behavior, then you and that person have to hopefully interpret English the same way. It would be completely hopeless to try to convince a hundred people that a nontrivial C program has no undefined behavior. And successful programs typically have way more than a hundred users.

</comment></comment></comment><comment><USER7> Is it an advertisement of PVS-Studio?

<comment><USER8> Yes, it _is_ an ad for PVS-Studio but I don't think that should tarnish the _content_ of code discussion in the article.

Although I'm extreme anti-advertisement (with dedicated firewall to block web ads), I find this article having 3 qualities that's valuable:

1) instead of showing contrived bad code nobody writes, it shows _real bugs_ from _real projects_ such as MySQL, PostgreSQL, ReactOS, Apache server, Audacity, LibreOffice, Notepad++, CoreCLR, etc

2) full explanations of the bug and further advice for correcting the code

3) learning is free: you don't have to buy PVS-Studio to apply the solutions learned from the article or gain the ability to spot similar bugs later

That all adds up to a quality article which is better than the old PC-Lint ads[1] from Gimpel Software. For those too young to be aware of them, in the 1990s, GS ran ads in a magazine called C/C++ Users Journal. For the others that enjoyed the "puzzles" in those ads, Andrey Karpov's article is a fine continuation of that.

[1] example: [http://www.polyweb.com/blog/index.php/archives/9](http://www.polyweb.com/blog/index.php/archives/9)

<comment><USER7> Thanks for replying...I didn't realize the real life example.

</comment></comment></comment><comment><USER9> Funny how the "proper" first example still has a lot of things to be addressed, like the fact that it has a magic number (7) coming from nowhere, which is duplicated a few times as well.

It would be way less error-prone to calculate the number of elements using sizeof, for instance. This would also make the function independent of the type (a template could be used), thus reusable in another contexts.

</comment><comment><USER10> > As a rule, simple code is usually correct code.

This is a strong statement I'm a bit wary of. I get the intent in context but it seems overly general.

<comment><USER11> He does say "usually" so it doesn't seem like that strong of a statement.

</comment></comment><comment><USER12> Item 5 is interesting, but I think it might be worthwhile to include the entire function here (including the comments):

      BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved )
      {
          (void)hinstDLL; /* avoid warning */
          (void)lpvReserved; /* avoid warning */
          switch (fdwReason)
          {
              case DLL_PROCESS_ATTACH:
              {
                  TCHAR   szBuffer[64];

                  // This code will attach the process to its parent process
                  // if the parent process had set the environment variable.
                  // The corresponding code (setting the environment variable)
                  // is desktop/win32/source/officeloader.cxx

                  DWORD   dwResult = GetEnvironmentVariable( "ATTACHED_PARENT_PROCESSID", szBuffer, sizeof(szBuffer) );

                  if ( dwResult && dwResult < sizeof(szBuffer) )
                  {
                      DWORD   dwThreadId = 0;

                      DWORD_PTR   dwParentProcessId = (DWORD_PTR)atol( szBuffer );

                      if ( dwParentProcessId && GetParentProcessId() == dwParentProcessId )
                      {
                          // No error check, it works or it does not
                          // Thread should only be started for headless mode, see desktop/win32/source/officeloader.cxx
                          CreateThread( NULL, 0, ParentMonitorThreadProc, (LPVOID)dwParentProcessId, 0, &dwThreadId );
                          // Note: calling CreateThread in DllMain is discouraged
                          // but this is only done in the headless mode and in
                          // that case no other threads should be running at startup
                          // when sal3.dll is loaded; also there is no
                          // synchronization with the spawned thread, so there
                          // does not appear to be a real risk of deadlock here
                      }
                  }

                  return TRUE;
              }

              case DLL_THREAD_ATTACH:
                  break;

              case DLL_THREAD_DETACH:
                  osl_callThreadKeyCallbackOnThreadDetach( );
                  break;
          }

          return TRUE;
      }

You can find there here: [http://opengrok.libreoffice.org/xref/core/sal/osl/w32/dllent...](http://opengrok.libreoffice.org/xref/core/sal/osl/w32/dllentry.c#DllMain)

FWIW, he says to use static analyser tools to analyze code. We do that already, and extensively. Seems a bit provocative...

<comment><USER13> I do not remember this comment. Most likely he appeared after the article: [http://www.viva64.com/en/b/0308/](http://www.viva64.com/en/b/0308/)

<comment><USER12> That's quite possible. It might be worthwhile pointing to the revision and file in git :-)

Appreciate the work you have done!

<comment><USER13> sal: add comment re: V718 'CreateThread' should not be called from 'DllMain'

[http://opengrok.libreoffice.org/diff/core/sal/osl/w32/dllent...](http://opengrok.libreoffice.org/diff/core/sal/osl/w32/dllentry.c?r2=%2Fcore%2Fsal%2Fosl%2Fw32%2Fdllentry.c%40279b6e4b75e74c743ca018435c1d7644c71b9e0c&r1=%2Fcore%2Fsal%2Fosl%2Fw32%2Fdllentry.c%40da40cac540e7d735edbe9069b3c8ec6af4530208)

</comment></comment></comment></comment><comment><USER14> Fist I have a low IQ. Then flowing is my comment:

This is the 42 reasons why I give up C++.

<comment><USER15> As much as I also hate many parts of c++, to be fair, half of the examples apply to any programming language.

</comment></comment><comment><USER16> The title is very misleading. I was expecting a discussion about the future of programming, why there will probably never be a "best" language or why we're not all using functional languages yet. Was disappointed after reading the first sentence:

> Yes, you've guessed correctly - the answer is "42". In this article you will > find 42 recommendations about coding in C++ that can help a programmer avoid > a lot of errors, save time and effort.

The article states that these tips are 'usually universal', but I hardly found that to be true, only having counted about 10 points not being about C++.

The title should probably be something like the obvious "42 tips for C++ programmers" as the current one really doesn't justify the content.

<comment><USER17> OK, we changed the title to be less misleading, as the HN guidelines request ([https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)).

</comment></comment><comment><USER18> Meh, these recommendations basically boil down to: "pay attention"

<comment><USER19> Indeed, however every programmer no matter how good will make mistakes sometimes. It can be in 1%, 0.1%, 0.01% of LoC. Loosing attention can be so easy, it can be a co-worker walking by, an important email/meeting happening while you were focused on a 'copy-pasting' step.

Having a tool that is trained to spot this kind of human errors is good. It can be useful in any language, not only C++. Avoiding them in the first place and giving you advices on how to not do it again would be a nice thing compiler could provide. i.e:

        a[0] = b[0];
        a[1] = b[1];
        a[2] = b[0];
                 ^ warning: Are you sure you want to assign b[0] to a[2]. If not, consider rewriting your code with a for loop
        a[3] = b[3];

<comment><USER2> The author of the article actually develops the tool that can help the programmers detect such errors. The compilers don't report such kind of errors because it was traditionally to expensive to detect them. The special tool, like the one mentioned in the article, doesn't have to produce the optimized code and doesn't have to be run as frequently as on each compilation but it can allow the programmer to detect potential problems.

It's surely worth using it.

</comment></comment></comment><comment><USER20> Seeing that list of error patterns made me realize that letting mediocre programmers use something like C / C++ really boils down to Luck-Driven Programming. I hope that in the not too distant future something along the lines of Rust or Swift can help avoid at least some of those traps.

<comment><USER12> There are quite a few errors in this article that could occur in Rust and Swift as well. Did you actually read this article?

<comment><USER20> There is no silver bullet. And no language can stop you from making mistakes (assuming "at least some" means the same as "all" is one example). But some languages help you avoid certain classes of mistakes with automated checks. Like Rust.

And even if you added those features to C++, you couldn't guarantee a codebase that only uses the secure subset. Nobody has the time to rewrite old code. And making sure that current code uses only the secure subset would require code reviews. Not everyone does that.

<comment><USER12> If nobody has time to rewrite old C++ code then it's not going to be rewritten in rust

<comment><USER20> That would seem to be the case, naturally. Why do you mention it?

</comment></comment></comment></comment></comment><comment><USER21> If you're an experienced C++ coder, I'd skip this article.

While it's well structured, with real-world examples, it's very basic. I'm not an excellent C++ coder by any stretch of the imagination. I make lots of mistakes. But not these. The article is fairly thorough and long, so if you're experienced you'll invest non-trivial time for little or no reward.

<comment><USER22> The mistakes mentioned include those made in mature projects maintained by good people.

We all make mistakes; and it's oftenworthwhile to review what we take for granted that we know.

</comment></comment><comment><USER23> Every one of these points is just "use a static analyzer" and while I appreciate that I definetly don't appreciate them pushing Microsoft's static analysis tooling rather then Free tooling.

I'd honestly welcome a post about different static analysis tooling that's libre and open source. Their pros and cons as well as how to deploy them would be good too.

<comment><USER24> How do those people dare to charge money and sell proprietary products!

Also this is about PVS-Studio, nothing to do with Microsoft, they don't own the _Studio_ word.

<comment><USER23> I have no problem with paying for a program with my money. I do have a problem paying for a program with my freedom.

<comment><USER25> PVS is a product that performs a service. They have made major efforts to port this product to Linux; they have multiple articles scanning Linux FSF products and the Linux Kernel.

People deserve to be paid for their work if it's useful.

</comment></comment></comment></comment><comment><USER26> Wow, the first example is simply a typo as a result of copy and pasting the same conditional block repeatedly. You would learn this would cause problems in your first week of programming: that what you type in your code determines whether or not it will perform correctly.

Shouldn't they focus on examples of unexpected or non-obvious mistakes (or at least start with those -- but then why add obvious examples at the end)?

Whether you copy and paste or simply type a single line incorrectly, of course if the wrong thing is entered the code will simply be incorrect.

<comment><USER27> You're missing the point: repeated blocks of code (whether they are copy+pasted or typed out) are simply bad, not from a computing point of view, in terms of what instructions get executed when, but from a human point of view, in terms of how we read and comprehend code. It's dealing with a different aspect of computer programming, rather than the obvious 'what works, what's efficient', but that makes it _more_ interesting, not less.

<comment><USER26> Aren't switch-case statements widely accepted in C++ and inherently repeated blocks of code? No one would tell you to not copy-paste and then edit just the different parts in a switch-case block.

And to support both our arguments -- that example first mentions copy-pasting being the likely cause of the error and then provides a rewritten example that doesn't use the same code repeatedly (your point).

But a switch-case statement is a counter-example that you would copy-paste code and isn't abstracted into variable array indexes.

Counter-counter-argument: switch-cases have more obvious differences in a (only potentially) multi-character string.

<comment><USER28> _Aren 't switch-case statements widely accepted in C++_

No. Some people say they're a sign of a poorly architected object model.

<comment><USER29> Both of those statements can be true, though. Switch-case statements are widely accepted in industry, yet some developers disagree with their use. In my opinion, it's hard to beat a jump table for some operations, which a switch block neatly performs. And there's a rational continuum between boolean conditionals, multi-state (>2) conditionals, and polymophism, such that i think "some people"'s assertion sounds like throwing out the baby with the bathwater.</comment></comment></comment></comment></comment>


Does Google Only Listen If the New York Times Calls Them Out? - <AUTHOR> http://www.marketingpilgrim.com/2011/09/does-google-only-listen-if-the-new-york-times-calls-them-out.html

<comment><USER2> The solution is obvious. Only allow Google Plus members to click the Closed button, because a) Google knows exactly who a G+ user is, and b) G+ users, being known persons to Google, only do socially acceptable things.

</comment><comment><USER3> It is natural to quickly put out a fix in response to a New York Times article that paints a picture of your big company hurting Mom & Pop Highway Diner.</comment>


Smoking and Health (1964) - <AUTHOR> https://profiles.nlm.nih.gov/ps/retrieve/ResourceMetadata/NNBBMQ <comment><USER2> The story (possibly apocryphal) in my family goes like this: My grandfather who smoked regularly was driving when he heard the first reporting on radio about these findings. He threw his pack out the window (anti-littering didn't take hold til the 80s) and never smoked again.

<comment><USER3> > anti-littering didn't take hold til the 80s

That's kind of amazing to think. Did it seriously not occur to people that litter just doesn't look nice? Did people not think about cleaning up their rooms either?

<comment><USER4> It's hard to explain.

I guess we thought that the world was infinite.

You just had the idea that, well, it'd blow away in the wind, and that would be that.

It's obvious now that this isn't the case.

Much like, I imagine, smoking was obviously fine, until it wasn't.

</comment></comment></comment><comment><USER5> I wonder -- if this report had come out today, would as many people have believed it? Would huge numbers of people question it much like people question global warming?

<comment><USER6> Even at the time there were articles in Nature protesting this just like people do global warming today:

>THE curious associations with lung cancer found in relation to smoking habits do not, in the minds of some of us, lend themselves easily to the simple conclusion that the products of combustion reaching the surface of the bronchus induce, though after a long interval, the development of a cancer.

This is the first sentence of the abstract "Cancer and Smoking" published in Nature in 1958, by the father of modern frequentist statistics: Ronald A. Fisher.

Fisher published a fair bit on why claims that smoking caused cancer were preposterous arguing that "correlation does not equal causation". Fisher was already a very well respected figure in the statistics community and, despite being a paid researcher for tobacco companies, biographers suggest that his motives were person, he loved smoking and disliked puritanical views on how people should live.

So despite being one of the greatest statisticians of all time, Fisher still failed to properly assess the risks of cigarette smoking and cancer.

<comment><USER7> Fisher's later work on smoking was funded by the tobacco industry.

He was paid not to properly assess anything. (Not to mention, Mr. Fisher enjoyed tobacco himself.)

</comment></comment></comment><comment><USER8> _During the decade 1950-1960, at various dates, statements based upon the accumulated evidence were issued by a number of organizations.... The consensus, publicly declared, was that smoking is an important health hazard, particularly with respect to lung cancer and cardiovascular disease._ page 6

</comment><comment><USER9> > In comparison with non-smokers, average male smokers of cigarettes have > approximately a 9- to 10-fold risk of developing lung cancer and heavy > smokers at least a 2O-fold risk.

I'm waiting for similar conclusions to surface for added sugar.

<comment><USER10> > I'm waiting for similar conclusions to surface for added sugar.

Haven't they? I saw "sugar coated" several years ago ( [http://sugarcoateddoc.com/](http://sugarcoateddoc.com/) ). Not on Netflix any longer, but can still be found on Kanopy I believe. Also, one of the main doctors has videos on Youtube about added sugar and fructose ( [https://www.youtube.com/watch?v=dBnniua6-oM](https://www.youtube.com/watch?v=dBnniua6-oM) ).

</comment></comment><comment><USER11> The weird thing about smoking rates in the U.S. is that it topped out in 1960. [https://www.nap.edu/read/11795/chapter/4#42](https://www.nap.edu/read/11795/chapter/4#42)

Why then? People were saying that smoking was bad for you ever since it was brought to Europe. From 1900 to 1959 everyone went - Eh, who cares what they say I want a drag and then in 1960 there was some class of people who it seems reasonable to say would have but for something bought a pack of smokes decided not to.</comment>


Ask HN: Anyone want to help clone election.twitter.com for a local election? - <AUTHOR>

I run a local news site in Chicago.  There's an election happening in our area to replace Rahm Emmanuel in Congress (he left to join Obama's team).  Twitter's Election.Twitter.com page was terrific for letting you see what people were saying about the candidates during the presidential election.
I'd like to more or less clone it for this local election, i.e. create a web app that lets you see what people on twitter are saying about the candidates using a tabbed interface.
I can take care of the design/CSS, hosting and can promote the heck out of it to the local and national media, which will lap this up like maple syrup.
The person helping would get glory, a prominent backlink and bio at the top of the app and the rush of helping make a contentious election easier to stay on top of.
I can cludge something together on my own no problem, but if there's anyone out there looking for a fun, quick project that will get press coverage, I'd love to work with that person. <comment><USER2> Hey, this sounds interesting.

send me an email: email@example.com if you want to talk about this.

<comment><AUTHOR> E-mail sent. Thanks.</comment></comment>


Set up NGINX and IPFS to support secure connections with browser ĐApps - <AUTHOR> https://medium.com/textileio/tutorial-setting-up-an-ipfs-peer-part-ii-67a99cd2c5 <comment><AUTHOR> This is actually part 2 in a series I started earlier in the week: [https://medium.com/textileio/tutorial-setting-up-an-ipfs- pee...](https://medium.com/textileio/tutorial-setting-up-an-ipfs-peer-part-i- de48239d82e0)

<comment><AUTHOR> These are 'works in progress' so open to comments and suggestions!</comment></comment>


SongRaptor launches interesting music site - <AUTHOR> http://songraptor.com

<comment><USER2> Where does the music come from? Are they pulling from other music services, hosting it themselves without permission of the rights holder or do they have deals with these bands/labels?

</comment><comment><USER3> why is this interesting? It is a complete rip-off of Songza! Right down to the stolen UI! Very Poor!</comment>


Two reasons why the most successful people are often very nice - <AUTHOR>

It's been about a year since I've been in business and because I'm building my company in Japan, I've had to pay particularly close attention to the intricacies of building relationships. As I've had the opportunity to come into contact with many amazing people, one thing has struck me about the most successful among the people I have met.
The most successful and well-connected people I have met over the last year are, more often than not, the most humble and accessible people I've met. I think this is because of two reasons:
The first is that you never really know who someone is based on simple first impressions. And, perhaps more importantly, you never know who someone will become. So, aside from the natural human decency that should accompany all of our relationships,  it's just smart from a business perspective to treat everyone with respect and not write off those who don't necessarily make a strong impression in person. I've met quite a few people here personally responsible for earning  tens or hundreds of millions of dollars and it's not rare for these people to be decidedly non-flashy and almost a little awkward. It would, of course, be a mistake to misjudge these individuals merely on the basis of the first impression they make because they are truly heavy hitters.
The other reason is one that is probably more common and it's simply part of the natural humility that comes from building up a business out of nothing. Many of the successful people I know come from modest, decidedly non-elite backgrounds and this gives them the right combination of empathy and ambition that enables them to succeed.
Just wanted to share that here in the hopes that it will be useful to the other startup founders here. <comment><USER2> I wonder to what extent it comes from confidence, and engagement.

Not braggadocio nor naivete, but a self-assurance that one is capable of tackling problems that arise. And of handling the outcomes, whatever they are. I think this may lessen the need for defensiveness.

Engagement -- interest in other things and people -- might be separate, or it might be complimented by a lack of defensiveness.</comment>


Gmail isn't ready to replace Google Inbox, and neither is anything else - <AUTHOR> https://www.dantilden.com/2019/03/20/google-inbox/ <comment><USER2> So very true. I loved, _loved_ Google Inbox. Knowing that it was on the way out, I chose not to install it on my latest phone. Gmail is a pale imitation: busy, full of ads (granted, this is how Google makes its money), just no good anymore.

Honestly, it's given me yet another reason to use K9 as my primary Android email client. If I can't have Inbox, I might as well have something open source.

<comment><AUTHOR> I really want to like K9 since I admire their ideals, but I wish they'd refresh the UI; It's still got the ICS-era "Holo" visual style.

There have been discussions to redo it with Material Design, but no one could agree on what it should look like and it languished.</comment></comment>


Cookie Bomb or Let's Break the Internet - <AUTHOR> http://homakov.blogspot.com/2014/01/cookie-bomb-or-lets-break-internet.html

<comment><USER2> The DoS won't work on most of the specific example services mentioned in the post (Blogspot, GitHub, etc.), at least not if the user is using a modern browser, because most of the big names have such cookies blacklisted by browsers.

The mechanism is the Public Suffix List, which was originally created because there needed to be a list to keep track of which TLDs used public second-level domains and only allowed registrations in the third level. For example, while foo.example.com and bar.example.com are both owned by example.com, foo.co.uk and bar.co.uk are two different domains, since co.uk is part of the UK domain hierarchy (along with ac.uk and so on) and registrations happen at the third level. Therefore it would be undesirable if foo.co.uk could set cookies for the entire .co.uk, as in the UK ccTLD world that's equivalent to setting a cookie for all of .com.

So there's a big list (initiated by Mozilla) specifying that .com is a public suffix, .co.uk is a public suffix, etc., and wildcard cookies on public suffixes are refused. This has been adapted, as a huge hack, to big sites that have user-registerable subdomains. So now .blogspot.com is also treated as a public suffix, since anyone can "register" a foo.blogspot.com under it.

However new entries are added on a fairly ad-hoc basis, so a site that allows user subdomains that can run JS is vulnerable by default unless they explicitly get themselves added. I notice Dropbox isn't there, for one.

The list: [http://publicsuffix.org/](http://publicsuffix.org/)

<comment><USER3> Works in Chrome. Actual "bombing" works in FF too, but doesn't affect top- level domain.

That's semi-solution. How is it going to help mysite.cdn.com/file1 to bomb mysite.cdn.com/other-files...

Also look at translate.googleusercontent.com, if you bomb it, Google Translate will stop working.

I think public suffix is great and useful idea but it should be solved by browsers too & length should be limited

<comment><USER4> > Works in Chrome.

Hmm, looks like Chrome isn't respecting the Public suffix list for setting cookies ATM, even though the site for the list claims that it does.[0]

For an example, view [1] and [2] in Chrome, and note that cookies set by [1] are viewable by [2] even though this shouldn't be allowed given blogspot's entry in the public suffix list. Firefox doesn't exhibit this behaviour, and I'm thinking this is a recent regression in Chrome, but who knows.

> Also look at translate.googleusercontent.com, if you bomb it, Google > Translate will stop working.

I haven't taken a look at it, but would it make sense to add dynamic <original>.translate.googleusercontent.com subdomains for translated sites and add the base domain to the public suffix list?

> it should be solved by browsers too & length should be limited

IMO this is only going to be solved by a revision to the spec that resolves the ambiguity. The core issue is that browsers and servers disagree as to what a "reasonable" cookie jar size is, and servers are rejecting request with "unreasonably" large cookie jars.

Until those limits are actually part of a spec that people follow, someone's going to be sending too much or allowing too little and legitimate requests will get rejected.

I don't know if you've read Michal's "The Tangled Web" or the Browser Security Handbook but they both go into it a little.[3]

[0]: [http://publicsuffix.org/learn/](http://publicsuffix.org/learn/) (under Chromium)

[1]: [http://cookietestblog1.blogspot.com/2014/01/cookie- test.html](http://cookietestblog1.blogspot.com/2014/01/cookie-test.html)

[2]: [http://cookietestblog2.blogspot.com/2014/01/cookie- test.html](http://cookietestblog2.blogspot.com/2014/01/cookie-test.html)

[3]: [http://code.google.com/p/browsersec/wiki/Part2#Same- origin_p...](http://code.google.com/p/browsersec/wiki/Part2#Same- origin_policy_for_cookies) (under cookie jar size)

<comment><USER3> >I haven't taken a look at it, but would it make sense to add dynamic <original>.translate.googleusercontent.com subdomains for translated sites and add the base domain to the public suffix list?

random hash as a sandbox.<hash>.guc.com will work.

</comment></comment></comment></comment><comment><USER5> This is something Zalewski has written about: [http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how- not-...](http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-to- design.html) \--- if this kind of thing is interesting to you, his latest book, _The Tangled Web_, is excellent.

<comment><USER6> That page, and the linked browsersec pages on Google Code, are terrifying. Time to burn it all down and start from scratch.

I was particularly stunned to learn HTTP Cookie headers can clobber 'secure' cookies set over HTTPS. Eye-popping.

<comment><USER7> And to increase your terror, check out [http://lcamtuf.coredump.cx/postxss/](http://lcamtuf.coredump.cx/postxss/)

</comment></comment></comment><comment><USER8> The impact on CDN providers is kinda scary.

To take an example we all know and love, a malicious *.cloudfront.net distribution could be setting cookies against cloudfront, breaking all your fancy static asset serving from cloudfront.

Is there a mitigation other than _always_ having to use a myappname-static.com domain name?

Thinking about this at a higher level -- there are some interesting similarities to "shared hosting" resource contention, but this time with domain names on CDNs. If somebody executes a forkbomb on your shared host, you're hosed. If somebody executes a cookiebomb on your CDN provider SLD, you're hosed.

Browser vendors could prevent this with good second level domain support. Register cloudfront, akamai, etc domain names as only hosting user-created content on third level domains. Pin large examples to the browser distribution, and allow TXT records in DNS specifying this at the top level.

<comment><USER9> Web browsers could also mitigate against it by limiting the size of their requests. If too many cookies have been set, throw away the older ones until the request is small enough to likely be accepted by most web servers.

It's not a perfect fix, nor does it solve the wider issue of letting one domain set a cookie for a domain that it has no authority over, but it would stop people being blocked from a site with a bizarre 500 error. Worst case, a login/ID cookie gets flushed and the user has to log in again.

</comment></comment><comment><USER10> Interesting. Just this week I had to investigate the exact same issue at my job. One user (of course it was the CEO...) had accumulated so many cookies that on some pages of our website he ran into the HTTP request header limit and would only get a 500 error page.

One risk factor is using JavaScript based third party services that use cookies with your host name. In our case, it was Optimizely that was storing pretty significant amounts of data in cookies. Not really sure how to tackle this issue.

<comment><USER11> Bump up the limit in the web server config ;)

<comment><USER10> Forgot to mention that we're using Akamai, and it's actually Akamai's servers that are hitting the limit. We'll see if we'll be able to convince them to bump up the limit. I have a hunch that there might be some resistance because of performance implications (I'm not an operations guy, my knowledge of how web servers work internally is limited). On the other hand, it seemed to intermittently work, so there may be some servers in their farm that are configured differently. Or it could have been due to fluctuations in the header length because of different query string lengths and cookie changes.

</comment></comment></comment><comment><USER12> Pretty clever. This appears to be in the same vein as that trick where you could use popups to spawn more popups, and by the time the user realized what was going on their computer was completely unresponsive. (fixed with popup blocking in any browser in the last decade.)

Also, Fill my Disk: [http://www.filldisk.com/](http://www.filldisk.com/) (local storage bomb)

Implementing limits on the number of cookies would seem to be the natural solution to the problem in the OP, although I doubt this problem is "worth" solving in practice since most people seem to be using cookies to do what they were meant to do.

<comment><USER13> > This appears to be in the same vein as that trick where you could use popups > to spawn more popups, and by the time the user realized what was going on > their computer was completely unresponsive. (fixed with popup blocking in > any browser in the last decade.)

I recently visited a site that did something similar but was still effective. It opened up mailto: URI's in a loop and since I had Thunderbird set up to handle the links, it practically killed my X session.

<comment><USER14> It shouldn't be possible to launch mailto links without an interactive prompt; if it is, please file a bug on the browser.

<comment><USER15> I've never seen a prompt to open a mailto: link. Where is it specified there should be one?

<comment><USER16> I think by "interactive prompt" he means "user interaction".

<comment><USER15> I suppose I can see an argument for popping something up before firing the schema handler when something sets location.href to a mailto: URL, but that seems like the sort of thing where you'd really want to wait for evidence that it's a problem for anyone before you implement it; it both annoys the user and complicates your code, neither of which is desirable in the absence of real provocation.

</comment></comment></comment></comment></comment></comment><comment><USER8> There's a similar self-denial of service you can run into when you're injecting javascript and cookies into third-party pages.

Optimizely (YC W10) had this problem when they were setting cookies on a single domain across all of their customer sites. If you happened to be the kind of user that visited websites that had a high chance of using Optimizely, you quickly accumulated enough cookie to make their fronting proxy reject your request for their JS.

</comment><comment><USER17> Why isn't the obvious fix discussed: Change browsers to not let subdomains set cookies for parent domains.

Probably this feature is of critical use. If so, would be grateful if someone explains it to me.

<comment><USER2> One common use is to pass session data between subsections of a site. For example, the user logs into www.example.com, and is still logged in when they head over to store.example.com.

<comment><USER17> That could be also implemented in my proposed fix by example.com setting the auth cookies. They will continue to be readable by store.example.com.

Sure, it will require a change on the server side, which is a pain. But I can't think of a practical scenario which will be impossible to implement with the proposed fix.

<comment><USER18> Your idea would likely break any site on the internet that uses authentication and subdomins, isn't it clear why this isn't being considered?

<comment><USER19> Or sites could opt-in to this with a header?

EDIT: homakov says the same thing down thread.

</comment></comment></comment></comment></comment><comment><USER20> How do you set a cookie on a domain you do not control? Won't the browser only send cookies to a server on the domain you are trying to browse to?

EDIT: found it - not any, arbitrary site can be DOS

"Who can be cookie-bombed? Blogging/hosting/website/homepage platforms: Wordpress, Blogspot, Tumblr, Heroku, etc."

<comment><USER21> \- "If you're able to execute your own JS on SUB1.example.com it can cookie- bomb not only your SUB1 but the entire *.example.com network, including example.com"

So you've got to be able to execute JS in a subdomain to plant a cookie bomb that will affect the entire domain.

</comment></comment><comment><USER22> I didn't like the web protocols

Now I like them even less.

</comment><comment><USER23> Terry Davis scares me.

</comment><comment><USER24> It's really interesting. The problem is that i don't see any fix for it. The only way would be to update the browsers, or maybe use a plugin to block such attacks.

<comment><USER25> Or serve the untrusted content from a sub-subdomain, e.g. "foo.bar.CDN_HOST.com", so that you could only bomb bar.CND_HOST.com and not the entire domain

<comment><USER26> You'd think a higher level domain should be able to specify whether a subdomain can set cookies for it or not.

<comment><USER25> That would be nice, but it would have a lot of ramifications. Before setting the cookie, the browser would need to know if it's allowed, so presumably it would have to load some file. Perhaps this could be done in a manner similar to CORS requests

<comment><USER3> Content-Security-Policy: can-set-cookies: no!

BTW if JS is of we can use <meta http-equiv Set Cookie>

<comment><USER27> It might be better to allow:

Content-Security-Policy: can-set-cookies-for-parent-domain: no!

There's no harm in letting haxx0r.blogspot.com set cookies for haxx0r.blogspot.com. It's only cookies for blogspot.com that should be restricted.

</comment></comment></comment></comment></comment></comment><comment><USER28> Seems the way to do this would be to create accounts on all the services you want to bomb and set up JavaScript redirects so that hitting one will set the cookies and redirect to the next host. Have it be in a loop so that any entry into the redirect loop is possible. By definition, once you hit the first host in the chain again, your request will be denied.

The question is how to get people to visit a site that loads one of those URLs...

</comment><comment><USER29> Possible detection method (server side)? If the request is too long due to cookie length, then look at the last URL the client IP hit. That _should_ be the URL creating the long cookies. Remove the offending URL / resource.

<comment><USER9> That won't work, and could be easily abused by crafting your own requests to blame any arbitrary URL of your choosing.

Plus, servers drop huge requests because they are most likely malformed or DOS attempts. Attempting to do extra work (like tracking down previous visits by the client) will only make matters worse for the server.

<comment><USER29> Hmmm. Yes,I see the potential for abuse. Why do you say it would not work though?

</comment></comment></comment><comment><USER30> This was happening on my Gmail account a few weeks ago. It was a little disconcerting. I never figured out what was wrong but it seemed to fix itself after I deleted cookies a few times.

</comment><comment><USER31> Is this the reason I can't access any *.github.io right now?

Is there an equivalent to status.github.com for github.io?

<comment><USER32> Have... you tried clearing your cookies? :-)

<comment><USER31> ! I should actually read the content of articles. That's enough internet for today.

</comment></comment></comment><comment><USER33> Surely if you were able to do this, you would use it for cookie tossing rather than this simple mischief?

<comment><USER3> Cookie tossing are not always helpful. If session is properly tied with csrf token there's not much you can do with it.

</comment></comment><comment><USER34> pointsIterator++;

Works on Iceweasel 17.0.10.

</comment><comment><USER35> homakov, you have a fun job.</comment>


Startup Accelerators Are The New MBA - <AUTHOR> http://birch.co/post/60844253074/startup-accelerators-are-the-new-mba

<comment><AUTHOR> "Just about anything else you might want can be had by joining a startup, where you get paid to learn."</comment>


Google Images quietly removes 'exact size' and 'larger than' search filters - <AUTHOR> https://9to5google.com/2019/08/29/google-images-exact-size-filter-removed/ <comment><USER2> solved[https://gogl.app/](https://gogl.app/)</comment>


Fireworks complaints are way up in U.S. cities - <AUTHOR> https://slate.com/business/2020/06/fireworks-complaints-are-way-up-in-boston-nyc-cities.html <comment><USER2> I've been hearing them on random weekdays here in suburban Connecticut.

It's ultimately just a nuisance to me, nothing I'd complain about formally (everyone is trying to have some fun these days, I get that). But I doubt those people have a nervous dog.</comment>


Baidu now accepts Bitcoin - <AUTHOR> https://bitcointalk.org/index.php?topic=310962.0 <comment><USER2> A quick translation of the Baidu Jiasule press release:

"As a cutting-edge IT guy and a professional webmaster, what else can showcase our difference? The answer is that we have Bitcoin!

Bitcoin, as a new electronic and digital currency, is being accepted internationally. It's also used in daily lives. You can use Bitcoin buy a cup of coffee, or easily convert it to cash. But in China, Bitcoin is still a fairly new thing. Today, we have a good news: from today, we are starting to officially accept Bitcoin as a payment method. You can use Bitcoin to buy all Baidu Jiasule services. Baidu Jiasule as an innovator in the Internet industry, is now the first cloud service provider to accept Bitcoin and give everyone a better payment method and experience."

</comment><comment><USER3> Jiasule is just a little company (service) Baidu acquired August. This decision is probably made by this independent company, not by the main company Baidu. And other services Baidu provide doesn't accept Bitcoin.

I couldn't imagine any big company in China will officially accept Bitcoin in the future at all.

<comment><USER4> "I couldn't imagine any big company in China will officially accept Bitcoin in the future at all."

What do you base this belief on?

<comment><USER3> This country is tightly controlled by the government.

The Internet is an example. The GFW ([http://en.wikipedia.org/wiki/Golden_Shield_Project](http://en.wikipedia.org/wiki/Golden_Shield_Project)) surveillance all connections in China like NSA but since 10 years ago and people are used to it.

Even large payment companies in China (like Alipay) could do litter about economic innovation, they have to obey the rules set by the government and bank.

Any big company in China could challenge these rules by using a method which independent of any central authority in the future? I don't think so.

<comment><USER5> >This country is tightly controlled by the government.

Strange, I always hear quite the opposite. That everything is simply too big at this point and although there is the appearance of a big controlling force, there really isn't one anymore.

<comment><USER6> Above-the-counter currency-exchanges are still pretty heavily regulated by the Chinese government. See, the ongoing China scam works like this:

* traditional Chinese culture would have the children care for their parents and grandparents in their old age

* one-child policy means that each child has two parents and four grandparents to care for exclusively, so that's not going to work out so well, therefore:

* everyone saves like crazy

* the state-run banks pay negative real interest rates (less than inflation)

* the state-run banks loan to big state-owned firms at negative real interest rates (and you can do amazing things when paying for capital at negative interest rates)

* the people in charge of the state-owned firms live lavish lifestyles off the profits and provide political support for the regime

* from time to time the government has to work to suppress riots over high food prices and other consequences of inflation

This breaks down if the ordinary people can get hold of a currency that isn't full of inflation. So, capital controls limit how many dollars people can get a hold of.

Of course, Bitcoin in the mix could be interesting. Or rendered illegal. Or both.

<comment><USER7> Except people in China don't have to save money by putting it into a bank account. They find other ways to invest that beat inflation like people all over the world have to do. And currently in China, that's real estate.

Also, there is no practical limit to how much dollar you can get with yuan, it's called the grey market.

It's pretty astounding to me how Americans can still have such simplistic and misplaced views of how things works in other countries.

<comment><USER8> Entirely curious: has he posted that he is American before? Where are you getting that from, are are you generalizing about all Americans and not talking about the poster above?

<comment><USER6> Yes, I'm American. I'm also generalizing and simplifying because an in-depth analysis of the China scam is the proper subject of a Ph.D. thesis and not a HN comment. As lionspaw has noted, there are complicating factors like the property boom (/bubble) and the grey market for inflation-resistant currencies. These hamper the current capital controls but do not render them entirely useless.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Looking at the bitcoin address [1] Baidu posted in the press release, it looks like a whopping 0.00326169 BTC has been deposited into their wallet. I know they just set it up, but I guess I would have expected slightly more activity by now. This makes me wonder if it's more of a PR stunt than anything.

I know that Reddit, after months of enabling Bitcoin as a payment option, still only got 3% of their entire revenue in Bitcoin [2]. I like the concept of bitcoin but as of now, it seems like many of these initiatives are launched by businesses to get "tech people" interested and to make news about their business. That's not a terribly bad thing though for bitcoin because businesses are still adopting it. It just would be nice to see Bitcoin used more than 2.5% of the time.

[1]: [http://blockchain.info/address/1NtbQKVFxAPc8mmBoWwRzhg7o3EMC...](http://blockchain.info/address/1NtbQKVFxAPc8mmBoWwRzhg7o3EMCBsxNg)

[2]: [http://www.reddit.com/r/Bitcoin/comments/1dkbix/bitcoin_usag...](http://www.reddit.com/r/Bitcoin/comments/1dkbix/bitcoin_usage_stats_for_reddit_gold_payments_in/)

<comment><USER10> How do you know that they keep the bitcoins in the same place after they receive them? They could as well transfer them to other wallets.

<comment><USER11> At his link, you can see it distinguishes between total received and total balance.

</comment></comment></comment><comment><USER12> You're supposed to pay to a bitcoin address included in their press release, and then notify them about this. For a major NASDAQ-listed company, this approach seems startlingly half hearted.

<comment><USER13> Ridiculous really. You use a new address every time, a single one for a company is not the way you're supposed to do it for many reasons, not the least being that you can't tell who paid for what.

<comment><USER14> Can you please explain why one should use a new address each time? I keep hearing it but am not clear on why this is recommended.

<comment><USER15> The alternative is providing the _sender_ address so that their system can identify who paid and for how much, which results in you having to identify yourself before each and every transaction (probably through a user account setting or some other form you have to fill out). This is an extra and cumbersome step so it creates an incentive to maintain a singular and constant BTC address of your own.

The rationale behind creating a new BTC recipient address for every transaction is that it doesn't matter who the _sender_ is.

</comment></comment></comment></comment><comment><USER16> Could it be related to yesterday's announcement, and a confirmation that they were talking about Bitcoin?

[https://news.ycombinator.com/item?id=6550068](https://news.ycombinator.com/item?id=6550068)

</comment><comment><USER17> Given that there was a bitcoin rally led by the Chinese bitcoin exchanges _before_ this news[1] and now this amateurish announcement, it seems like somebody at Baidu Jiasule is doing a pump and dump.

[1] [http://imgur.com/jgwRMJo](http://imgur.com/jgwRMJo)

<comment><USER18> An increase in transaction volume, which is what your link shows, is not a 'rally', which is a price increase.

<comment><USER17> That link was meant to show a suspiciously large jump in the volume of Chinese bitcoin exchanges relative to other exchanges. It wasn't intended to show the price increase.

To see the price increase, you can look at any of the charts at [http://bitcoincharts.com](http://bitcoincharts.com). But since the exchanges strongly influence each other because of arbitrage, price charts won't tell you anything about the role of Chinese exchanges in the increase.

<comment><USER18> > That link was meant to show a suspiciously large jump in the volume of > Chinese bitcoin exchanges relative to other exchanges. It wasn't intended to > show the price increase.

It certainly sounded like that was what you intended. A transaction volume increase is interesting, but on Reddit I have read comments stating that the exchanges in some cases have started charging no fees - which sounds like it's possible that the increases are entirely spurious and due to, say, bots going nuts.

</comment></comment></comment></comment><comment><USER19> Someone testing automated trading systems with that title? Or, why would anyone enter the Nasdaq-ticker so prominently?

<comment><USER20> Baidu[1] is a giant search engine like Google, with a market cap of 50bn, so it's not like this is a pump and dump. I suspect the poster is just a bit 'like that'. They probably put citations in their comments.

Take a look at the services list in that article - they are like Google, Wikipedia, and Yahoo all rolled into one, and dominate the Chinese market.

[1][http://en.wikipedia.org/wiki/Baidu](http://en.wikipedia.org/wiki/Baidu)

</comment></comment><comment><USER21> I wonder how this will end up playing with the fact that exchanging CNY is heavily restricted. Exchange services all require proof of identity to allow you to trade, and there's quite a few limits on exchange.

Some details here: [http://en.wikipedia.org/wiki/Renminbi#Managed_float](http://en.wikipedia.org/wiki/Renminbi#Managed_float)

</comment><comment><USER22> Don't Baidu deliver more packages than __Amazon __? This is an interesting development…

<comment><USER23> I think you are referring to alibaba. Baidu might have shipping service, but as far as I can recall, it's China's Google.

</comment></comment><comment><USER24> Not a surprise, China already has the leading exchange in terms of volume, BTCChina.

<comment><USER25> There are some concerns the numbers are inflated i.e. they have have no conversion fee, so they could be trading with themselves to pump up the numbers.

<comment><USER26> There are other indicators that this might be legit trade volume. Things like state-sponsored media exposure, the large number of Chinese bitcoin miners, and also that Chinese are already familiar with another very popular digital currency (QQ).

<comment><USER25> >state-sponsored media exposure

The CCTV spot wasn't state sponsored per se, but I know what you mean.

>the large number of Chinese bitcoin miners

Oh?

Here's to hoping. I'd love it to be real.

</comment></comment></comment></comment><comment><USER27> Now Chinese cyber-criminals can setup load balancing with full anonymity?

</comment><comment><USER23> But Bitcoin has three major problems. One is if you lose your key you won't be able to access your coins, right? And two, how is tax going work? Third, bitcoin price goes up and down so rapidly. Say the service costs 20BC today but if tomorrow's bitcoin price is $100USD instead of previous $50USD, the consumer will pay more (and vice versa Badiu might lose some money).

Correct me please.

<comment><USER16> 1) I think with future authentication technologies, this will get easier (logging in to the wallet based on a fingerprint token?). Perhaps the new FIDO standard will help here: [http://www.fidoalliance.org/faqs.html](http://www.fidoalliance.org/faqs.html)

2) Taxes would work just like how you make money today from other sources, you have to declare them. Plus, wouldn't it be better if people _wanted_ to pay taxes based on the marvelous "services" they get from the government, rather than having part of the money being taken away from them by force, and then the government spending it however it wishes, with little benefit for the tax payer? Seems to me that if the government had to _convince_ people to pay up, instead of forcing them, they'd be a lot more efficient with that money spending, and a lot of waste would be reduced.

3) I think the more used Bitcoin gets, the volatility decreases. Right now if someone buys $1 million worth of Bitcoin, that could still have a pretty significant impact on the Bitcoin market. In the future, if the transactions are worth trillions of dollars, someone trading $1 million of them won't mean much.

<comment><USER28> Making taxation optional or voluntary doesn't seem like a viable system. Everyone would just pass the buck to someone else.

</comment></comment></comment><comment><USER29> A step towards a de-Americanized world.</comment>


Shared password URLs that expire - <AUTHOR> http://tmpkey.com

<comment><USER2> I guess there are use cases where this is a useful service. Some such use cases should be described to make thing easier to understand.

I think that is it actually the URL that expires, not the password. Once you know the password, nothing prevent you to use it long after the link has expired. Unles s I missed something really big...

<comment><USER3> No, you put your finger on the elephant in the room.

The "temporary password" is more like a yellow sticky note: it curls up and fall off your terminal after 3 days, but you can still find it on your desk(top) if you look around.

The scheme only works if the user did not write the password down and did not save a copy of the unencrypted document / web site.

</comment></comment><comment><AUTHOR> I agree that the passwords themselves don't expire. The meaning I'm trying to convey is that if you shared the URL in an email, for example, the password associated with that URL would no longer be accessible. It's quite likely the password itself has been written down. Perhaps a better marketing message is as you suggest, 'Password URLs that expire'

</comment><comment><AUTHOR> There's also an API:

<https://tmpkey.com/API.html></comment>


Everyone Knows America Lost Afghanistan Long Ago - <AUTHOR> https://foreignpolicy.com/2019/12/16/everyone-knows-america-lost-afghanistan-long-ago/ <comment><USER2> [https://www.moonofalabama.org/2017/11/turning-the-corner- in-...](https://www.moonofalabama.org/2017/11/turning-the-corner-in- afghanistan.html)

-

The Friedman Unit, or simply Friedman,[1] is a tongue-in-cheek neologism. One Friedman Unit is equal to six months,[2] specifically the "next six months", a period repeatedly declared by New York Times columnist Thomas Friedman to be the most critical of the then-ongoing Iraq War[3] even though such pronouncements extended back over two and a half years.

[https://en.wikipedia.org/wiki/Friedman_Unit](https://en.wikipedia.org/wiki/Friedman_Unit)

</comment><comment><USER3> "There's light at the end of the tunnel!"

Oops, sorry. That was the story from the Vietnam War. (And we all remember how that one finished up. Don't we, children?)

Same shit, different war.

</comment><comment><USER4> What did we get for our $X TRILLIONS of dollars?</comment>


Modern Mobility: Palm WebOS Dev accounts Now FREE :) Get it - <AUTHOR> http://modernmobility.blogspot.com/2010/04/palm-webos-dev-accounts-now-free-get-it.html <comment><USER2> Considering Palm is looking for a buyer and their chief developer just resigned, does it really matter that a dev account is now free ?

I looks to me more like a sign that the whole thing might be discontinued shortly so why would anyone invest their time in something that looks like a dying platform ?

The $99 wasn't a problem, except for people that just wanted to make some free apps.

</comment><comment><USER3> Blogspam, but here is the registration link if you're interested: [https://developer.palm.com/index.php?option=com_content&...](https://developer.palm.com/index.php?option=com_content&view=article&layout=page&id=1875)

</comment><comment><USER4> Flagging this because the story itself has no link to the free registration and the Palm dev site makes no mention of this. There is no proof and other sites I've found mentioning this are link bait (with irrelevant links in the story).

</comment><comment><USER5> Seems a bit late now. They should have been encouraging people to write apps for their struggling platform and made it free from day one.</comment>