Just launched! Asking for news.yc feedback. - <AUTHOR> http://pikluk.com This is what we've been working on nights and weekends since February, and we hope the site explains itself.
We have applied for YC program for this winter and still are waiting for a response, but since the coding is done for a modest ver 1.0, we see no reason to keep it in the basement any longer. Therefore we're going with a "slow launch" strategy to get <100 very happy users with kids spending hours in our system. Hopefully this will allow us to figure out potential bugs/usability issues before big PR push.
Technically we are a mixture of online/desktop software with our own local persistence layer written in C++.
Please take a look and let us know how we are doing. Directness and critical thinking are very much welcome! <comment><AUTHOR> This is what we've been working on nights and weekends since February, and we hope the site explains itself.

We have applied for YC program for this winter and still are waiting for a response, but since the coding is done for a modest ver 1.0, we see no reason to keep it in the basement any longer. Therefore we're going with a "slow launch" strategy to get less than 100 _very happy_ users with kids spending hours in our system. Hopefully this will allow us to figure out potential bugs/usability issues before big PR push.

Technically we are a mixture of online/desktop software with our own local persistence layer written in C++.

Please take a look and let us know how we are doing. Directness and critical thinking are very much welcome!

<comment><USER2> You cite wikipedia on the front page. If I were being picky, I might bring up the fact that there are definitely things there that some people would find objectionable for kids.

<comment><USER3> My first thought also. I'd like to be able to block pages by keyword also... or just have a 'community driven' approach - have adults install a toolbar say, and have them mark pages that are suitable for kids.

</comment></comment></comment><comment><USER4> You should consider a social network of parents who use the system that could add sites to the white list. Friends of parents could go in the white list of emails as well.

That would actually make a good default home page for the kids: the pages that people recently recommended for kids and a feed from parents friends and kids.

</comment><comment><USER5> Good job. I think it is a great idea, and useful too. Much better than most of the useless crap we see in here.

Refine it, and go for it. Remember, execution, execution, execution.

</comment><comment><USER6> This is flippin' awesome, you guys. I don't know if it's totally there yet, but I'm loving it thus far.

One thought: as a parent, I'd be _very_ interested in seeing your privacy polic(ies) spelled out in detail. I would freak out, hunt you down and drink your blood if I found out you were tracking my kids' web history, logging unencrypted form submissions containing names, etc., etc.

<comment><AUTHOR> Would you be interested talking to us a bit more about the subject? If you are interested, please take a look at my profile.

</comment></comment><comment><USER7> This is an excellent idea. I know of at least one family member who will find this very useful!

Some suggestions I have are:

I like the web site design, I think it conveys the simple "child-friendly" look. However, the colors are stark and a bit bold, slightly desaturating/lightening them might be a more pleasing to the eye.

A family member of mine is having a hard time keeping their young daughter from accessing stuff she shouldn't be seeing on the internet. The problem is this little girl is quite a hacker, and has found very clever ways of circumventing the protections, even going to the extent to sneak onto her moms computer to get the passwords to disable the controls. I'm not familiar with the details of your protection schemes, but I guess my advice is dont assume kids, just because they are young, cant crack your stuff! Kids are much more computer-savvy these days so make sure all of your bases are covered.

Good luck on your YC appliation. This idea is refreshingly new and I like it.

<comment><USER8> If this takes off, every kid will know about the Ctrl-Alt-Home failsafe/loophole.

<comment><USER9> It's up to the parent again, if they tell their kids. And, remember this program is really for young children, with the manual dexterity to move the mouse around and click on things, not necessarily the kids who blog, have myspace pages, or join multiplayer online games and such. We will be refining our target audience as we get more user feedback. We could have removed that failsafe altogether if we found another mechanism that would insure parents could break out of the Kiosk Mode if they forgot their password. We are open to suggestions.

</comment></comment></comment><comment><USER10> I think this is a good idea. Have you considered tracking which sites are most commonly allowed and then providing that list as a default for new users? I can imagine it being quite a pain to allow access one site at a time. If there were a "community accepted" list of sites, that might be a cool feature.

Our of curiosity, how many downloads so far?

</comment><comment><USER11> Congratulations!, I haven't downloaded it but it sounds like a great idea.

It would be great to see some screen shots of the browser on the web.

Does it run in any OS?

<comment><AUTHOR> 80% of browser functionality is written in JavaScript, very similarly to how Mozilla's XUL is done, greatly reducing our dependency on any client platform.

But we are Windows-only at the moment with Mac OS X in the very near future. We are also debating either we should move to Mozilla platform, but it potentially will make a fairly fat download... Currently our browser is 400kb binary with zero dependencies.

<comment><USER12> Good stuff!!!

I'd move over to FF base and you have all OS' covered. If you have to install a binary, people don't care if it's 400kb or 2Mb. Size, under 10Mb is irrelevant to most of the people. Usability and compatibility is what's important.

</comment></comment></comment><comment><USER13> Screenshots would be nice.

<comment><AUTHOR> We just added screenshots to "Learn More" page. Please hit refresh in your browser.

Thank you for the feedback!

<comment><USER13> Nice. I find those more compelling than slugging through all the explanatory text (though I don't have kids, so I'm not in the target audience). You might try and figure out a way to get them on the homepage.

</comment></comment></comment><comment><USER9> Give it a try if you have kids. We have been working long hours getting this site and client software working and are anxious to see how kids will actually use it.

As far as children's online privacy, this application gives parents a good balance of manual configuration and automatic protection that they can use. We hope it will be a good solution to the common complaint from people with children that they hate sitting behind their kids playing "yard monitor", while they surf on regular browsers.

If you don't have kids, try it anyway. And if possible forward it on to anyone that does. Thanks.

</comment><comment><USER14> AWESOME concept... really unique, and I think it's going to sell AND do a lot of good for kids.

One thing I would say is don't mention the word "entertainment" for kids. If parents are going to get this for their kids, it's going to be for them to help study for school tests, gain knowledge at large, etc. etc... _productive_ things. Maybe you also provide some access to appropriate entertainment content, but don't stress this.

A lot of the other words on the site need to be retooled and fine-tuned, but overall your concept/idea is great.

</comment><comment><USER15> being able to serve kid-targeted ads to kids on the web would be awesome. massive click-throughs i bet....and somewhat slimy. even better would be parental control on what ads were served to their kids. give the parents a cut on CPC if they let their kids see ads? spitballin...

<comment><USER7> rwebb is right, serving "limited" ads to kids could be a huge... You are directly reaching an audience that companies spend millions of dollars just trying to.

Rather than seal yourself off from this potential revenue source you might want to re-phrase the wording on your site to say that you do not allow unnapproved/offensive ads to reach their kids. I honestly wouldnt feel bad if you offered limited ads since your service is free. I dont think parents will mind as long as the ads are carefully filtered for offensive content.

Wow, you are in essence the gate keeper to the ads kids can see. If ad agencies dont go through you then they cant reach your highly desirable user base, even if they are already advertising on the web page that the child is viewing (b/c you block them). That is just _huge_.

Sorry if I'm thinking "evil" here, but I'm just offering suggestions with purely business interests in mind.

<comment><USER3> Being evil would be replacing adsense advert blocks with your own publisher code :D I'm sure if not illegal that would be highly evil.

Children click on adverts, but do they 'convert' - leads or sales. If they do not, that click revenue is going to diminish quickly as advertisers start to realize.

<comment><USER16> Well, an advertiser is pretty dumb if they are trying to sell something to an 8 year old without a credit card. I imagine that a more likely target is a corporation trying to brand a child, like with General Mills's <http://www.millsberry.com/>.

<comment><USER3> Sure - I agree. But as far as I see it's harder to get 'branding advertising deals', than results based advertising.

</comment></comment></comment></comment></comment><comment><USER16> I'm very intrigued, but I couldn't find a screenshot anywhere on your page! You've gotta fix this.

<comment><USER16> Alright, I downloaded it, it is great, and I couldn't break out of the walled garden. I was going to try and play the age-old game of "how many clicks does it take to get to a nipple from yahooligans" and hit the friendly stop sign animation. A whitelist is the only way to keep a browser locked down, because otherwise there are always web proxies and online translators. As others have said, you are going to want some kind of shared bookmarks for kid-safe sites.

</comment></comment><comment><USER17> I have an almost 4 year old who I've already been playing around with on google to find out information on animals like wombats, etc. Your service looks very interesting with nice graphics, but I wonder about its ability to really control web usage. What would stop children from simply opening up Firefox or IE and circumventing your browser? Do you have a way to handle this?

<comment><AUTHOR> Pikluk is not just a browser, it can serve as a locked-down Windows shell with disabled Ctrl+Alt+Delete and Alt-Tab, taking over 100% of real estate on all monitors, etc.

<comment><USER8> Couldn't a clever kid just hit the hardware reset button? I guess you'd have to have a windows password too.

I think it's a great idea. And for kids trying to get around it, I welcome all those little hackers learning tons about computers.

</comment></comment></comment><comment><USER18> The appearance of you site is very appealing. The layout, color combination is refreshing. The idea of site is compelling. Cool!

</comment><comment><USER19> Looks awesome guys, great job. You make those of us that are also applying for the cycle a little worried...

Only comment from me...if it's going to be marketed/involving children, I probably would have chosen a name with a real word instead of the web 2.0 naming convention. But, since kids have their own languages anyway, you're probably good!

</comment><comment><USER20> I'm really trying to contain myself because I'm going to get silly bubbly effusive. I can't help it, this product is a dream come true. For dramatic effect I'm going to post the greasemonkey script I adapted to try to do this for my kids in firefox, seriously I am going to get on the horn and let everyone with school age kids I know about the browser.

Some things that I think would be really useful: You've got that toolbar on the left side that's always there. For poorly designed sites (disney.go.com is the one I tried) they force a side scroll bar so you can't see the whole page left to right at once. I understand there's a big trade-off here; if that toolbar hides they may not know how to bring it back, but they may not know how to use the left to right scroll bar either. It would be nice to have a appear if moused over option, or perhaps check if the website is not resizing appropriately and shrink the toolbar for those sites.

Another thing I would think would be nice is to be able to filter content within sites. So perhaps pushing CTRL + f12 creates a ban on that particular directory within a white-listed site. In our family that means kongregate.com is okay but kongregate.com/zombie_rampage not so much. That would address the wikipedia concern as well. Perhaps you might even trace sub-directories other users have banned and apply them to your child's browsing if you enable it.

In any case the firefox icons are getting deleted from the desktop and start menu right now and pikluk is now the new default browser for at least three people in this family.

Oh, and as promised:

     // Invisibility Cloak
     // version 0.1
     // Gina Trapani
     // 2006-01-03
     // Released to the public domain.
     //
     // ==UserScript==
     // @name          Invisibility Cloak
     // @description   Turns time-wasting web pages invisible until a specified time of day.
     // @include       http://flickr.com/*
     // @include       http://*.flickr.com/*
     // @include       http://metafilter.com/*
     // @include       http://*.metafilter.com/*
     // @include       http://www.kongregate.com/games/SeanCooper/boxhead-2play-rooms/*
     // ==/UserScript==
     //
     // ==RevisionHistory==
     // Version 0.1:
     // Released: 2006-01-03.
     // Initial release.
     // ==/RevisionHistory==

     (function () {
     	// EDIT THE NEXT LINE TO SET THE HOUR AFTER WHICH SITES SHOULD APPEAR
     	// HOURS IN MILITARY TIME, SO 15 = 3PM
     	var surf_time_after = 23;
     	// END EDIT

     	var readable_time = '';
     	if (surf_time_after > 12 )
     	{
     		readable_time = surf_time_after - 12;
     		readable_time = readable_time + 'PM';
     	} else {
     		readable_time = surf_time_after + 'AM';
     	}

     	var tstamp = new Date();

     	if (1<2 | tstamp.getHours() < surf_time_after )
     	{
     		var b = (document.getElementsByTagName("body")[0]);
     		b.setAttribute('style', 'display:none!important');
     		alert("This game or site has been deemed shady by the parents!");
     	}

     })();

<comment><USER21> I think this might be the one good use for the OS X dock UI: have the icons be small, translucent _overlays_ off to the side (thus obviating the scrollbars), which grow to large, opaque buttons when moused near.

</comment></comment><comment><AUTHOR> A quick update: we added some screen shots to "Learn More" page and provided a link to it from the front page. Just make sure you hit 'Refresh' in your browser.

This seems to be the most common (and very useful) feedback topic.

Thank you guys very much. <http://pikluk.com/more>

</comment><comment><USER22> i think you should promote the fact that it's free on the front page

</comment><comment><USER23> I think that this is the most intelligent project I have seen of the "Just Launched!" news.yc stories. Well done. I think you could be very successful.

</comment><comment><USER17> Who is doing your icons - are they on the team? (Very nice work) Have you already had funding or are you guys bootstrapping?

</comment><comment><USER24> It's great! Pay no attention to the dousche that said "This, for example, means kids growing up who don't use Google -- who don't have basic proficiency with the Internet. That's awful." Jerkoff comments like that reek of someone who is a salaried desk jockey. I mentioned it to one parent and they really like it.

<comment><USER21> Pay no attention to the purely ad hominem argument against that person's comment, either.

It's a valid point: to learn to use the Internet, you actually _have to use the Internet_. Using this program will only teach you how to use this program, much as a video game console won't quite teach you to use a computer.

However, the target market is too young to really need to learn _any_ sort of skills. Save it for when they can flash the BIOS to boot from a Live CD...

</comment></comment><comment><USER25> Since I don't have kids, I've never paid any attention to this market... Are the only solutions available today things like NetNanny, which are (as far as I know) basically just preconfigured firewalls? Basically, what's the competition like?

If that's the case, then it seems you guys have a solid idea :)

</comment><comment><USER26> Great idea! A refreshing change from "Yet another social networking tool". Best of luck.

</comment><comment><USER27> I'd rather talk to my kids and explain to them how the internet can be used safely.

<comment><USER28> What you gonna tell them? "Okay kids, if you see boobs somewhere in the internet close your eyes..." Kids are curious, it is their nature. What would you do if you were a kid?

<comment><USER27> I would tell them about particular dangers like 50 year old strangers posing as 13 year olds... I remember very well what I felt about boobs when I was a kid and that's exactly why I have no worries whatsoever. There's an age where you're not interested and when you become interested, you'll be able to cope, and cope very very well :-)

</comment></comment></comment><comment><USER29> It's a web browser -- why do I have to sign up for something to download it?

<comment><AUTHOR> It is a web-based service, the browser integrates into your dashboard which is web-based. You need to have an account to use it.

<comment><USER30> Why not make it possible to be able to sign up _after_ you download the browser?

Like if you don't sign in/connect-the-browser-to-an-account, it'll only let you go to a few sample pages and let you mess around with a few settings. As soon as you try to do anything else, a "Please sign up" form appears.

<comment><USER9> We aren't ruling that out. However, we have made it very easy for people to try it free, without commitments of any kind.

</comment></comment></comment></comment><comment><USER31> looks great. seems like you understand your customers well. good luck!

</comment><comment><USER32> I hate to be old fashioned, but where's the revenue stream?

<comment><USER33> If it's something people truly want, they'll be willing to pay for it.

I could see parents shelling out $5-$10/month so their kids have virgin eyes and ears for an extra half-decade...

</comment></comment><comment><USER34> looks great, guys. i would bet that your chances are very good.

</comment><comment><USER35> woooooooooooww. Thats all i can say. woooooooooooowww

</comment><comment><USER36> KOL?

</comment><comment><USER37> Ewww. Just because parents want to control their kids forcibly doesn't mean you should help.

 _You choose a list of web sites appropriate for each child in your family. PikLuk will restrict their online exploration to these sites._

This, for example, means kids growing up who don't use Google -- who don't have basic proficiency with the Internet. That's awful.

<comment><USER38> _means kids growing up who don't use Google_

[Rolls eyes]

 _who don't have basic proficiency with the Internet_

[Rolls eyes]

 _That's awful._

[Rolls eyes]

There are 60 billion (or more) hard core porn images on the internets. No need to expose 8 year olds to them.

I think the search box in wikipedia would be sufficient to acclimate them to the whole "Type word, press search" paradigm. They'll be prepared...if only for google. I mean, Bill Gates had a teletype into a mainframe, so maybe they're doomed anyway.

EDIT: By the way, I've seen first hand how kids go straight for the very worst stuff on the web, and it's pretty depressing. So, there's definitely a valid market for this kind of thing...

<comment><USER37> What? No point using Google when you have a whitelist of sites you can visit. Actually finding useful things with Google is a skill -- sometimes the right search terms are obvious, sometimes not. Old non-technical people have trouble with it, ask them.

Regarding porn: the more you make it a big important taboo, the more people get obsessed with it and work to beat your censorship.

<comment><USER9> You are misunderstanding the target audience for this application. It isn't a matter of whether or not kids are proficient with Google or whether we are blocking sites that for us proficient users are a dream, but instead we are giving complete control to the parents. I wouldn't even contemplate someone who is so comfortable with their 3 or 4 year old that they'd allow them to simply jump onto FF and go at it. They can accidentally click on links that take them to places their parents don't want them to see. We are removing that possibility. Again, the parent has the ultimate say as to where they are allowed. Now, if you are so inclined and trusting of your young child that you'd add something like Google to their allowed sites, then that's completely your decision.

As far as wikipedia, we will be removing that as a suggested site, for some of the reasons mentioned here.</comment></comment></comment></comment>


Unenlightened thinking: Steven Pinker's embarrassing new book is a feeble sermon - <AUTHOR> https://www.newstatesman.com/culture/books/2018/02/unenlightened-thinking-steven-pinker-s-embarrassing-new-book-feeble-sermon <comment><USER2> "The purpose of Pinker's laborious work is to reassure liberals that they are on "the right side of history"."</comment>


Show HN: goodbre.ws, a fully open source recommendation engine for beer - <AUTHOR> https://goodbre.ws/

<comment><AUTHOR> Thanks for looking guys. This site has been a side-project/hobby of mine for a while now. The past few days for me have been spent rewriting it from the ground up to be a much better site. I know that there are other beer sites out there, but I think that there is something special about making a service like this freely available and open source, and I'm really proud of what I've created.

You can check out the code here: <https://github.com/davidcelis/goodbre.ws/>

The code that powers the recommendations themselves is here: <https://github.com/davidcelis/recommendable/>

Any feedback would be nice. This new design is in its infancy but, as far as I can tell, it's been very stable. If you find a bug, please, please let me know here or post on the issues tracker.

<comment><USER2> This sites page loads are really fast. Well done in that respect.

<comment><AUTHOR> PJAX, man. Loving it.

<comment><USER3> Whoa. Ok yeah that is seriously fast. This is the first I've heard of it -- if anyone cares to comment, I'd be really interested to hear what the limitations of pjax are. As used in this application anyway it's pretty impressive.

<comment><USER4> If I recall correctly, it was written by github co-founder (defunkt) and powers github. It's pretty solid.

</comment></comment></comment></comment></comment><comment><USER5> Maybe have some filtering by country visible on the home page. It took me a while to figure out you actually had British beers in your database.

Also, I realise you're a ruby programmer but you should really consider including Python IPA <http://littlevalleybrewery.co.uk/our-beers/python-ipa> :)

</comment><comment><USER6> I'm getting a DNS lookup failure (I'm in the Netherlands).

<comment><USER7> DNS failure, getting it here in the US

<comment><USER8> +1

</comment></comment></comment><comment><USER9> Some of the letters that have diacritics are stripped:

"Ležák" should be "Ležák" "M욻anský" should be "Měšťanský" "Velckopopovicky" should be "Velkopopovický"

</comment><comment><USER10> I have problem risolving the site, dont know why, we have an internal DNS server (but i see that google's 22.214.171.124 can resolve it..)

</comment><comment><USER11> I rated a few beers, but my recommendation screen is empty. I get that it's a new site, so I can accept that it might be tough to get recommendations right away, but it would be really helpful to explain _why_ there aren't any results. Is it because I haven't rated enough beers? Is it because there aren't enough other users that have similar tastes? Is it because there's a delay before results show up?

Also, I had to try searching for some beers multiple times because my search didn't quite match how it's entered in your database. For example, I didn't realize that "redhook" is one word instead of two. I know that search is tricky and it's perfectly understandable, but I just thought I'd let you know.

Other than that, it looks great. I'll definitely be checking back for recommendations in the future.

<comment><AUTHOR> I had been monitoring that my background workers were, indeed, working... But it seems as there's something else going on here. For some reason people aren't getting recommendations. I'll try to see what's going on.

EDIT: looks like the process had actually silently died at some point, but was still reporting as running. I think I've fixed the issue now.

</comment></comment><comment><USER12> Good site. Some comments:

\- After a search or going to my profile, getting back to my dashboard should be more obvious.

\- "Fridge" is an odd term and icon for the want-to-try mark.

\- Can I submit beers?

Looking forward to updates.

<comment><AUTHOR> Yeah, I'll be adding an additional and more obvious link back to the dashboard soon. As far as submitting beers, that's also coming soon. I need to also make it more easily to accept said beers into the database, as I'm the only person working on the site. Managing this database (which has some 60,000 beers currently) is really tough to do alone. Thank you for looking!

</comment></comment><comment><USER13> I like the design, it's quite clean. Your blogs make for interesting reading too.

The concept reminds me of Untappd (<http://untappd.com/>) though theirs is a mobile app.

I was also impressed that this didn't just limit down to American beers, but it had some of my native Aussie beers also. Nice work!

Ideas:

\- Maybe load the beer names via AJAX for the search box so that I can get suggestions of what I'm typing for.

\- Have a mouseover tooltip on the thumbs up/down, bookmark etc. buttons so that I know what they do. It's not immediately obvious what the eye button does.

<comment><AUTHOR> That last idea is definitely something on my TODO. I give a brief rundown on the /about page, but the tooltips would be useful. The first idea is a good one as well, I'll be looking into how to cleanly implement that. Thank you!

</comment></comment><comment><USER14> Not sure if you're managing your own DB or not but it might be worth looking into <http://www.brewerydb.com/>

<comment><AUTHOR> I actually thought long and hard about Brewery DB. Their API is just fantastic, IMO. Really clean. Unfortunately, I wrote Recommendable (the Ruby gem that I wrote to power the recommendations) in a way that it really relies on ActiveRecord currently. My database also has considerably more beers than BreweryDB does right now, but yeah. Managing it by myself slowly gets more difficult as more and more suggestions on beers I need to add come my way. I'm working on an admin section for me to manage that more easily.

<comment><USER14> Cheers! I've been wanting to make a beer app for a while and always had BreweryDB in the back of my head. Maybe you should open up your database via an API too:)

</comment></comment></comment><comment><USER15> My comment is that UX wise, I don't really know what I'm supposed to be doing on the site. It took me a few minutes to realize there was a search bar in the upper right that really is the focus for finding the beer you like and seeding the database to get recommendations. I'd add some sort of initial training session, and generally feature the search bar as a sort of "improve your recommendations, rate some beers!" feature.

<comment><AUTHOR> Thanks, this is exactly the kind of thing I need to hear. As the person who made the site, I already know how to use it. I'll look into ways to make this all more obvious.

<comment><USER16> Also in the UX department, some search suggestions as you type could be nice, if that wouldn't add too much cost. Not a deal-breaker by any means but I found myself expecting it.

<comment><USER17> Minor recommendation on the search bar: the search button is a bit too small of a target. I know that most sophisticated web users hit enter when searching, but a sizable proportion are still click-happy.

</comment></comment></comment></comment><comment><USER18> Nice site. I found all the beers I was searching for easily. I think I'd use this more on my mobile phone while at the bar vs on my desktop.

<comment><AUTHOR> Yeah if I knew Objective-C I'd code up an iOS app for the site. Once I know for sure the desktop version is stable, I'll at the least be looking into making a more mobile-friendly site.

<comment><USER19> You can go with something like Titanium <http://www.appcelerator.com/>

</comment></comment></comment><comment><USER20> Down for me...

<http://downorme.com/goodbre.ws>

</comment><comment><USER21> Cool site! I would suggest trying to scrape taphunter.com to find beers to add to your system. Doing that weekly for some of the bigger beer towns in the country would add a bunch of brews to your list.

</comment><comment><USER22> For the non nerd two things: \- login via FB/Twitter would be nice \- user voice (or similar) feedback instead of GitHub issues page: no non-coder is gonna leave you feedback there!

</comment><comment><USER23> You got a great start here. <http://www.brewgene.com/> exists, but I don't think its recommendations are very good.

</comment><comment><USER24> How long until I can get recommendations? I rated a few beers but it would be nice to have at least some kinda estimation on how many I would have to rate.

<comment><AUTHOR> Recommendations start getting generated immediately after you rate a beer. The site is in its infancy, of course, so recommendations may start out rocky but they'll get better as more people (and you) rate more beers. The sad state of the cold start!

How long it takes for the recommendations to refresh is tougher to say, but it shouldn't be more than a few minutes. I can see that the workers that process them are active, so I'm fairly sure it's working.

<comment><USER25> I've contemplated doing a similar thing but in a different domain (may take advantage of your library). I had an idea for seeding the recommendations by scraping reviews from review sites and mapping their ratings onto likes/dislikes. Not sure how easy that would be though.

</comment></comment></comment><comment><USER26> Great! And also, this website is a great example how Twitter Bootstrap theme should look like.

</comment><comment><USER27> DNS Lookup Failure in Argentina.

</comment><comment><USER28> See also: <http://brewtoad.com/>

</comment><comment><USER29> I dont trust code to suggest me beer.... my tastebuds own any script ;)

</comment><comment><USER30> Hmm, site seems to be down?</comment>


The Most Important Feature In KitKat No One is Talking About - <AUTHOR> http://tomtunguz.com/kitkats-best-feature/ <comment><USER2> Very interesting, I only took time to skim the developer page and I missed this.

But if Google opens up for even more premium advertisements like the web banners, and what the author muses, I also hope I get a way to avoid these kind of things as well.

I am just not ever interested in a service that caters to the money if I can help it, and I'll gladly pay for relevance over product placement.</comment>


Why some computer viruses refuse to die - <AUTHOR> https://www.bbc.com/news/technology-44564709 <comment><USER2> One past incident I had: I was working as intern in a tech support company.

We had there some 1.44mb discs with the game "Lotus III", so whenever we were bored we would play a little.

One day I arrived at work... And they were scrambling all over the place using ancient antivirus from same era as Lotus III... Found out we played that game on tons of random computers and it was infected with a DOS vírus that could actually copy itself to USB drives too... Whooops.

We caused outbreak of what was then an already obsolete virus. (Most of the machines had windows 98 in them at best... The virus worked on then surprisingly fine despite being intended for DOS, and in those machines specifically it would infect USB)

<comment><USER3> >We caused outbreak of what was then an already obsolete virus. (Most of the machines had windows 98 in them at best... The virus worked on then surprisingly fine despite being intended for DOS, and in those machines specifically it would infect USB)

Well, windows 98 was essentially a GUI over DOS, so that is not at all "strange", what is more strange is the effect on USB, most probably the virus would affect any mounted volume (at filesystem/mount level as opposed to disk/mass storage).

As a side note, in _my time_ (only slightly earlier) Lotus (more properly Lotus 1-2-3) was not at all a game but rather the "only" spreadsheet program available, what a number of people would now call "an Excel spreadsheet" was at the time a "Lotus spreadsheet".

<comment><USER2> Lotus series was some cool racing games that actually were intended for Amiga, the DOS version not being just as good, but to me were still mind blowing.

Later when they were making a sequel it ended in Super Nintendo, with cars changed (Lotus in the title referred to the car company) due to license issues, spawning Top Gear series.

Lotus and Top Gear were wildly popular in Brazil, and thus recently a Brazilian studio made a spiritual sucessor (including hiring the otigibaly musician to make more of his very iconic music) that is named "Horizon Chase", so if you curious about what is so fun in "Lotus" to spread a virus, play Horizon Chase, gameplay is almost identical actually.

</comment></comment></comment><comment><USER4> It has always seemed like an unending battle to me. The only way this ends is to make an AI antivirus that can decide whether a particular software is malicious or not.

<comment><USER5> > an AI antivirus

That already exists, and has existed for many years, it's called 'heuristics'. Not quite as buzzwordy without hanging 'AI' on it though.</comment></comment>


Waymo Isn't Going to Slow Down - <AUTHOR> https://www.bloomberg.com/news/features/2018-04-02/waymo-isn-t-slowing-down-pact-with-honda-could-include-delivery <comment><USER2> There is a huge difference in how I accept the way and reasons people are killed.

Thats also why I truly think that a statement of "never trust humans in a car" is super arrogant.

I dont trust humans who belive they can build machines that does a better job than humans. Then again, I dont trust a lot of people at all.

</comment><comment><USER3> Just a couple years ago we were talking about the implications of a death at the hands of a self driving car. Today we're seeing those conversations unfold. Whether you like it or not, this is the future we're building.

The auto industry with the self driving car will change and create new businesses. There's a huge opportunity to get involved or create a startup in this space. It's the next big wave of opportunity and there's plenty of room.</comment>


A look at C++14 and beyond: Part 3 - <AUTHOR> http://www.meetingcpp.com/index.php/br/items/a-look-at-c14-and-beyond-papers-part-3.html

<comment><USER2> There are just too many ways to implement a same thing in C++. It's becoming more and more complicated.

So I have a strange idea: pick only a small set of features of C++, and disable all others. Maybe call it C+. Ship it in a compiler that will give error if any disabled features are used, maybe call it g+-4.8.

<comment> alok-g I have been dreaming of such a thing for long. The issue that comes is which features to keep; I have heard that everyone has their subset of C++ that they use.

The above system must be able to allow handling legacy code, which seems doable.

<comment><USER2> `g+-4.8 --legacy` -- how about that? :-)

</comment></comment></comment><comment><AUTHOR> Most interesting (to me at least) is "Proposing the Rule of Five"[1], so that no copy function, move function, or destructor will be compiler-generated if any of these functions is user-provided.

[1] - [http://www.open- std.org/JTC1/SC22/WG21/docs/papers/2013/n357...](http://www.open- std.org/JTC1/SC22/WG21/docs/papers/2013/n3578.pdf)</comment>


Show HN: CloudBrowser – Free 30 Minute Internet Cafe for Secure Browsing - <AUTHOR> https://free.cloudbrowser.xyz <comment><USER2> How does performing all my browsing on someone else's computer whom I don't know make me more secure?

<comment><USER3> Exactly. For the slow on the uptake, this takes the entire security problem, and puts it on some strangers 'safe' computer.

Totally-Not-A-Surveillance-Organization: "Hey, um. We have this super safe place where you can do all your top secret need-to-be safe web browsing. Away from all those prying eyes. Yep, super safe, here. Right here."

<comment><AUTHOR> These are excellent points thank you for bringing them to everybody's attention.

I'm a little shocked that people haven't brought this up until now. This is one of the main security issues that the BrowserGap on premise solution is built to address.

With on-premise self-hosting you can transfer the trust issue from our cloud- based system to your own private cloud or data center.

I'm not sure if all browser isolation vendors offer hybrid or on-premise solutions but I think most do. Menlo, Symantec, WEBGAP, LightPoint, Authentic8.

<comment><USER3> Ah, an on premise solution is something entirely different. Moving a group of users security problem to a controlled machine could be useful. Setting phasers to laser pointer mode.

</comment></comment></comment></comment><comment><USER4> I don't get the use-case for this. In other replies, you claim it's protection against "Ransomware, malware, virii, browser exploits, zero days", but all people are really doing are trusting you instead of other sites.

Plus, in my experience, ransomware and malware are more often spread through email attachments and other downloads, not browser exploits or other zero-day bugs. I'm guessing users can't download through your service, so they're just going to switch out when they think they need to download something. --Otherwise you have to take responsibility for scanning the download first and I doubt you're able to guarantee that you're better at scanning content than any other anti-virus and malware vendor.

So the only people I can see who might benefit from this tool are those have the skills to spin up a VM and perform their risky browsing from there.

<comment><AUTHOR> This is really great criticism of the business, thank you for this.

I have not given much thought to downloads yet. This will indeed be a challenge. As you insightfully identify, many businesses are concerned with remotely rendered email integration, and making downloads safe again.

Positioning as a vertically-integrated supplier is challenging. For instance, how to compete with Symantec who have their own high quality scanners?

I don't plan to get into the threat detection business. It might be possible to sell or license to one in the space however. Or to integrate 3rd-party scanning tech as a first-class part of the product, or offer to build integrations with a customer's existing SWG solution.

There's no simple answers to these challenges. I look forward to making something that works to address these concerns.

Edit: This has also given me an idea. If the challenges you pinpoint make it too hard to compete with the existing RBI suppliers, it might work for BrowserGap to become a browsing tool for advanced users. Or I could be overfitting such a model based on the feedback of HN which skews toward technical specialization.

In any case, please make more feedback if you have it. I appreciate your look at this.

</comment></comment><comment><USER5> This seems silly to me. Who cares that the browser data is scrubbed every 30 minutes. I can scrub my own browser data. Heck, I scan securely scrub my own browser data if I want to or run a everything in icognito. I can even run everything through a VPN where at least I have some sense of privacy, or just use Tor. The last thing I'd think to want or need is to run a browser remotely just because I can.

<comment><AUTHOR> I totally understand it looks silly. You can scrub your own data. You can run everything through a VPN where at least you have some sense of privacy, or just use Tor. I get that the last thing you think you'd need is a remote browser just because you can.

Maybe you don't need one. Also, how much time do you want to invest in your security?

The main advantage of an isolated remote browser is isolation of the threats from the public internet away from your own network and device. Ransomware, malware, virii, browser exploits, zero days; by running your local browser, you directly expose yourself to that. When you connect to the public internet through an isolated remote browser, your device is "air gapped" from this. There's still channels of attack, at the same time, the surface area is greatly reduced. I think that's a reason remote browser isolation is becoming more popular as a security practice.

TL;DR - isolation and containment is an effective complement to detection and neutralization of threats.

At least one part is unclear in the page copy, that the session is only 30 minutes long. A sort of "free public internet cafe" or "library computer" limit. It reads like the browser you use is reset every 30 minutes. Actually the browser session only exists for 30 minutes, after that all data is scrubbed. If you want to keep going, you open a new one browser by clicking on the icon.

<comment><USER6> But if "Ransomware, malware, virii, browser exploits, zero days" is what you are worried about, isn't it easier/faster to use local VM instead?

A short script which runs "kvm -readonly ..." (and a second one which does browser upgrades), and you have exactly the same functionality in the comfort of your own computer, but much faster, with video support, and not relying on the security of some remote service you know nothing about.

That said, I can see many reasons to run remote browser for other reasons -- zero-setup aspect is pretty useful, and the privacy is better than local VM as IP addresses are not shared. It is also a pretty great free proxy, handy when you are on those annoying networks which block some sites.

<comment><AUTHOR> I appreciate this argument. I had not thought much about self-hosting with a couple of shell scripts. If I think back to when I built this, I think I did it because I wanted that, but I could not find a way to do it. In your solution, how would you stream the browser view to the client? Could you support mobile clients? Would they need to download special software?

Also, it might be easier and faster, but that sometimes comes as a trade-off with security. It's far easier and faster to just use a regular consumer browser on your device, but you get those risks.

Personally, I would feel a large amount of risk running a local VM versus a cloud hosted one. A local VM (sans Tor, sans proxy) would expose my IP, which could still be targeted. The VM could be escaped, I think more readily than a cloud machine. At the same time, I do think that a local isolated server would be a great option if you want to self-host, rather than doing that in the cloud. This is definitely something BrowserGap does.

<comment><USER6> "kvm" is just a command-line virtualization tool (think Parallels or VMWare Player or Virtualbox). So:

\- I would not "stream the browser view to client", I'd use default display driver for the virtual machine (I think kvm uses SDL by default). kvm also provides VNC interface, if you want to run it remotely, but running it remotely will increase the latency.

\- It does not support _any_ clients, including mobile ones. You are not running a client/server setup, you are running virtual machine directly on your desktop/laptop.

\- Yes, you need to download special software. This is a local-only solution.

IP exposure is a real risk, but I'd say it is a privacy risk, not a security one. There are scanners scanning IP address space non-stop; if your computer is vulnerable to IP-only attacks, it would be hacked even if you do not go to any websites at all.

VM escaping is a thing, but the cloud machine runs a VM as well, and it can be escaped too -- and then user's computer will be attacked via remote screen connection. So:

If one has 2 exploits: browser escape zero-day + VM-escape zero day, they can attack either via Cloud machine or via local VM.

But Cloud machine has an additional attack vector: if the infrastructure itself is compromised, then you instantly lose all secrecy, and open client computers to remote exploits. And while you can ensure that _your_ laptop is safe and updated on time, you don't really know much about cloud.

That said, I think both of those are pretty unlikely, so the final decision should be based on other factors.

</comment></comment></comment></comment></comment><comment><AUTHOR> Full disclosure:

I tried to get some chrome experiments ([https://experiments.withgoogle.com/collection/chrome](https://experiments.withgoogle.com/collection/chrome)) to work in this and failed. With the exception of spin-dragging a 3D globe, everything didn't work.

The most far-out thing I've made work on the cloud browser is Quake 3. In fact, unless input on the remote page is focused, I do not transmit all key events (only things like Space, Enter and Tab). But you can look around with the pointer.

Proof: [https://imgur.com/gallery/SNSoWnW](https://imgur.com/gallery/SNSoWnW)

Or see for yourself. Visit [http://quakejs.com](http://quakejs.com) in the CloudBrowser and select your options and start. It really does work.

Also, the failure to use WASD motivates me to transmit all key events regardless of remote page form control focus.

</comment><comment><USER7> I couldn't pass google captcha, and all urls open a google search.

<comment><AUTHOR> What makes you say all URLs?

If you put

[https://news.ycombinator.com/](https://news.ycombinator.com/)

in the OmniBox are you getting a Google CAPTCHA?

The server is very busy right now and I don't want to reset it while there are so many people trying it out. When things quiet down I'll replace the default search provider in an attempt to avoid these prove-you're-not-a-robot- challenges.

For now if you want to get started with a URL in the address bar you could try another search provider such as DuckDuckGo:

[https://duckduckgo.com/](https://duckduckgo.com/)

<comment><USER8> same here - getting captchas, and ... I got put through 7 before I gave up.

<comment><AUTHOR> This needs to be fixed asap. Right now I have no idea how to do it.

FWIW I consistently get 1 CAPTCHA (usually traffic lights) and pass every time.

I cannot explain the discrepancy you experience.

Edit: Thinking about this, I think it is related to the User-Agent and platform pass through. When the load dies down I will test providing the same UA and navigator platform for all clients.

I have a hunch that one signal CAPTCHA uses is if the UA/platform is different to the browser.

</comment></comment></comment></comment><comment><USER9> This makes me think of the web performance power tool WebPageTest^1 (scriptable browsers that run in the cloud, and admin interface to manage their config, test parameters and reports / results).

^1. [https://webpagetest.org](https://webpagetest.org)

<comment><AUTHOR> Thanks for the connection.

</comment></comment><comment><USER10> There's also Browsh's demo services for purely text-based browsing:

[https://html.brow.sh/https://news.ycombinator.com/item?id=21...](https://html.brow.sh/https://news.ycombinator.com/item?id=21373756)

`ssh brow.sh -t [https://news.ycombinator.com/item?id=21373756`](https://news.ycombinator.com/item?id=21373756`)

They've never really become very popular. No doubt being merely demos and unpolished doesn't help. Running cloud browsers is expensive though and I've never made the commitment to scale them without having some way to make money.

</comment><comment><USER11> Dude! I don't care about cookie scrubbing but great idea. Heard of any.run? I use that a lot but their sessions are a minute long. Will definetly try your service but I hope you clean up the UI if you want to charge for the service. I hope you can take in high demand because it's there.

Also: I specifically need a long(30min+) remote browsing session where I can interact with untrusted content in a specific browser and OS setting (most but not all of that is offered by any.run),your site is deploying VMs so I can't check it out now.

<comment><AUTHOR> Hey Dude! Have not heard of any.run, I appreciate you pointing that out to me!

If you need longer sessions, I'm happy to talk about possibilities with you, even though it sounds like your use-case is very malware specific and I don't think we'll support that specifically. Please check out [https://browsergap.xyz](https://browsergap.xyz) and you can email me from the link there if interested.

Why do you say clean up the UI? The UI for the browser is OK, and you might not have seen that yet because it's quite busy. I'm happy to hear feedback about the browser UI so please go ahead. Here's a video if you can't wait right now:

[https://www.youtube.com/watch?v=SD0Fhl9v87k](https://www.youtube.com/watch?v=SD0Fhl9v87k)

The UI for the linked site is meant to be a throwback to the 90s when "browsers" were something new. I like it. I get you don't want to pay for a service with this UI, that does make sense! You don't have to pay for these 30 minute sessions tho. They are totally free.

It's busy right now so you might have to wait to use it. If it's not too much trouble to you, you may leave your email at this form I'll write you later to let you know you can try:

[https://forms.gle/cibEBFcDeUH9jB5M9](https://forms.gle/cibEBFcDeUH9jB5M9)

Any run looks awesome. That (advanced malware investigative capabilities) is definitely not something this will support tho. Regarding setting the OS/browser as parameters is also not something that will be supported. I can set you a User Agent and a navigator platform, yet I think you're saying you need an actual OS/Browser since it sounds like your requirement is hunting bad code.

<comment><USER11> Thank you for the response and best of lucj. Regarding the UI I like it and all but it simply isn't something I can present to others who are not as technophile as we are. Perhaps making it a CSS theme is better? And yes,I didn't mean the malware analysis part,I meant similar to urlscan.io -- not for analysis but to visit possibly harmful sites safely as with a normal browser.

Also, proofpoint isolation is another competition in this are but for their own customers.

<comment><AUTHOR> Hey badrabbit, you mean the UI for the landing page, right? I agree that it will be likely appreciated by a limited target audience. I'll do a re-over of the UI and make alternate landing pages, and I want to ask your advice on them.

Also, you said, present to others. That sounds good to me. Do you have an email address I can reach you at? If it's no trouble for you, please reach me at the address on the landing page or you can add your email to this form:

[https://forms.gle/3JjphZdDSrHDJoxJA](https://forms.gle/3JjphZdDSrHDJoxJA)

</comment></comment></comment></comment><comment><USER12> Curious, is the 80Mbps shared among all browser instances? [https://imgur.com/a/gEIN2Ih](https://imgur.com/a/gEIN2Ih)

<comment><AUTHOR> Thank you for the cool screenshot! No. Also, the way that network ingress is allocated here is not something I'm tweaking now. The total ingress on this service is a lot bigger.

Can I ask how you feel the connection speed is? Laggy, fast or what's your impression? Also, is it too rude of me to ask what approximate location you are in?

This service is located in the US.

<comment><USER13> Not OP, but here's my impression:

Loaded up google.com, got hit with a captcaha. Ok, shared IP, fair enough. However the low resolution made solving the captcha more of a pain than usual. Also, the recaptcha fade-out thing took significantly longer than normal, like 20-30 seconds waiting watching the fade out animation.

It also "feels" laggy, but mostly because on hover doesn't work because it's an image and not HTML being rendered in my browser. Page loading is decent, it's definitely noticeably slower than loading a normal page for me but within what I'd expect for a web proxy.

Not being able to double/triple click on text boxes or drag to select text was kinda annoying. Suggestion: maybe add the ability for the browser to have some popular extensions activated, like uBlock Origin?

Browser: Latest FF (70) / Location: Southern US

<comment><AUTHOR> That's some great feedback, I really appreciate your time doing that!

I've also found that the captcha is harder with the high image compression.

A tip to avoid the 20 to 30 second fading out, is continuing to move the mouse or tap the screen. This is because, normally, an increasing delay (exponential back-off) is used to fetch the next frame in the absence of user events. User events reset that and fetch the current frame immediately.

It seems like the lack of selection is annoying. And it looks as if this also breaks common editing interaction affordances in some annoying ways. Including and not limited to double and triple clicking text controls.

Ad blocks are included. And they do not succeed in blocking everything. I've hesitated to add ublock origin because of some well-publicized issues with regards to their relationship with the changing API.

Thank you for the compliment about decent page loading.

</comment></comment></comment></comment><comment><AUTHOR> Edit 2: Server back up.

Edit: I just reset the server at 6:30 PM UTC. It will be down for a few minutes and back up very soon.

Just a bit of fun: I managed to do an inception. 3 layers deep, and brought back a screenshot:

[https://imgur.com/a/zyL0eam](https://imgur.com/a/zyL0eam)

I took the shot using the outer most BrowserGap's screenshot context menu item.

</comment><comment><USER14> Keyboard input handling glitched out for me (from firefox 70, linux, connecting from an academic network with a gigabit link so stuff like input latency isn't usually a big deal for us). Random key presses were dropped, some were repeated, it seemed to get stuck on the letter 's' regardless of what key I pressed after a while

<comment><AUTHOR> That sounds very annoying!

I'll have a fix for that in future. I've found a work around is to clear the input field, click outside it, click back inside the empty field, and begin typing again.

Regarding the lag it might be because the service is located in the US. I believe you might be in EU/UK.

This small location difference seems insignificant and yet most content is served over geographically distributed servers, and BrowserGap paid version uses servers closest to you.

I'm thinking of touring this "free internet cafe" version to other regions, because the lag caused to people outside the US is actually significant.

If it's no trouble to you, you can add your email and approximate location to this form

[https://forms.gle/GHDCbDPUrTzB2pyV8](https://forms.gle/GHDCbDPUrTzB2pyV8)

and I can let you know when the service is near you.

</comment></comment><comment><USER15> Reminds me to mightyapp.com... although neither this or that words at the moment :).

<comment><AUTHOR> Why do you say doesn't work?

<comment><USER15> Getting a

"We're kind of packed and just creating some new browsers now, check back in a bit."

Error at 8:24 PM PDT.

<comment><AUTHOR> Ah, okay. That's normal, it just means there are more users than queue of waiting browsers. More browsers will open soon, you can try again.

Btw, thanks for the nod to Mightyapp. To be compared to their work is flattering. What makes you say Mighty doesn't work?

<comment><USER15> Didn't get an invite yet :).

</comment></comment></comment></comment></comment><comment><AUTHOR> This is now down (temporarily) to patch an exploit that was responsibly disclosed. More to follow. I'm sorry for this!

<comment><AUTHOR> Hey, so it was an interesting couple of hours.

I got a responsible disclosure from a security researcher that metadata about the application, including an access_token could be accessed from the browser.

This was because the machines were misconfigured (my responsibility) to be authorized to access different cloud services, as is the default.

This access token authorizes various operations on the cloud infrastructure provisioned by my account.

It could have been disastrous, because an attacker would have been able to use the token to spin up many instances and potentially even gain shell access.

According to the activity audit, the token was never used. And there is no indication of anyone using this to attempt to gain unauthorized access to any data in the service.

In response to the report I suspended the service immediately, altered the default configurations for this project to prevent such authorization tokens being issued. And I deleted the token that was possibly exposed.

The service is now back up.

Also, as the researcher pointed out, the same misconfiguration was identified as affecting Shopify[0], 18 months ago, tho the effects and exploit path were different.

[0]: [https://hackerone.com/reports/341876](https://hackerone.com/reports/341876)

</comment></comment><comment><USER16> Head over to Google, be greeted with ~10 captchas before being able to do anything.. yikes.

<comment><AUTHOR> I'm so sorry this happened to you!

I'm afraid I do not know how to solve the CAPTCHA issue.

<comment><USER17> You'd need to have a way to change your outgoing IP address.

VPN providers probably deal with this all the time, so try reaching out to them asking for guidance.

<comment><AUTHOR> That's a great idea, thank you much!

</comment></comment></comment></comment><comment><USER18> This is really cool, thank you for bring us this tool!

<comment><AUTHOR> :)

Thanks a lot for your compliment and I'm happy to hear you think it's cool!

</comment></comment><comment><USER19> getting an SSL cert error here..

<comment><AUTHOR> I'm using Letsencrypt. Perhaps I need to include fullchain.pem. Would it be trouble for you to share the error you're getting?

In any case, if it's no trouble for you to do so, you can leave your email at this wait list form and once I update the server later I can let you know!

[https://forms.gle/cibEBFcDeUH9jB5M9](https://forms.gle/cibEBFcDeUH9jB5M9)

<comment><USER20> I would recommend SSL Lab's tests: [https://www.ssllabs.com/ssltest/analyze.html?d=free.cloudbro...](https://www.ssllabs.com/ssltest/analyze.html?d=free.cloudbrowser.xyz&latest)

> This server's certificate chain is incomplete. Grade capped to B.

<comment><AUTHOR> I grateful you pointed this out to me! I'll upgrade the server when the load lightens a bit later.

</comment></comment></comment></comment><comment><USER21> If "Show HN" is any indication we should all just be running dumb terminals to connect to someone elses oh-so-generous cloud box.

The 80s called, they want their mainframes back...

<comment><USER22> Yes. What exactly is the intended purpose of this?</comment></comment>


Per capita cheese consumption correlates with deaths by bedsheets - <AUTHOR> http://www.tylervigen.com/view_correlation.php?id=7 <comment><USER2> Not sure what´s the point here, but some notes to open the discussion:

\- All these correlations are based on the same population (namely, US population); so it´s kind of "normal" to get them.

\- If this to disqualify the scientists that fall into the "correlation does not mean causation" thing, then you would need to prove it the other way around. That is, prove that there is not causal relation between cheese consumption and death by bedsheets. Fair, isn´t it ?

\- Science is much more complex than these funny correlations. The hard thing is not to imply causation from correlation, but to identify that there is indeed a correlation between data series.

</comment><comment><USER3> This seems to be a joke that is poking fun at _scientific_ studies that find correlations in large surveys, and then make fantastic claims. If you look at enough different variables then some of them will show a high degree of correlation.

</comment><comment><USER4> I think this site has many nonsense correlations because they using yearly or quarterly datapoints. I guess most of them will not correlate at more detailed timeframes.</comment>


The Art of Color Coordination - <AUTHOR> http://blog.kissmetrics.com/art-of-color-coordination/

<comment><USER2> Interactive version: [http://www.sessions.edu/for-students/career- center/tools-qui...](http://www.sessions.edu/for-students/career-center/tools- quizzes/color-calculator)</comment>


Elon Musk Teases Mysterious Tesla Box - <AUTHOR> https://twitter.com/elonmusk/status/593296401196388352 <comment><USER2> I thought there was already news that he's reported a battery pack was coming to analysts?

Oh yeah: [http://www.theguardian.com/technology/2015/apr/25/tesla- batt...](http://www.theguardian.com/technology/2015/apr/25/tesla-battery-home- elon-musk)

</comment><comment><USER3> I'm going to go out on a limb and assume this is the battery system that Tesla has been working on. Just from the picture I certainly hope that the system is fully modular. A major factor for me is that the storage system is easily expandable.

</comment><comment><USER4> "Dear Elon, please take all our money. Sincerely, The World."

Thanks for the shiny new things that also help the environment and are awesome engineering feats! Keep fighting the good fight!</comment>


Knights of the Lambda Calculus - <AUTHOR> http://en.wikipedia.org/wiki/Knights_of_the_Lambda_Calculus

<comment><USER2> "No matter where you are everyone is always connected" -- Lain</comment>


Clueless in Seattle (Ray Ozzie on open source) - <AUTHOR> http://patricklogan.blogspot.com/2008/04/clueless-in-seattle.html <comment><USER2> I don't see what exactly Ozzie doesn't "get". He made a fairly straightforward point, i thought. "People want interoperability, we're giving them interoperability". You can debate good faith all day, but MS of 10 years ago would never have released those documents to the EU.

There is that rift, sure, but I'm fairly sure they see it very clearly as a feature. Selling proprietary software is their raison d'être. Check back when openoffice starts eating at ms office's market share.

</comment><comment><USER3> What a superb post. The follow-up by James Robertson (link at bottom) is also good and addresses one of the reasons the Smalltalk vendors originally screwed themselves.</comment>


Ask HN: How to set up two salespeople in the same area? - <AUTHOR> Let's suppose there's a company is closing medium size enterprise deals. This company knows exactly what it's doing, how to sell, who they need to target, how to target them etc. This company has more leads than the capacity to handle them by the in-field salespeople.
I saw that there's a big aversion from the sales side on to setting up more than one person with the same area. They are afraid that the other one will take good leads. They are scared that they will close all the leads, and lose their jobs.
From the company point of view, it's making no sense. It's obvious that it's better to close all the deals fast. Or is there something that I don't see?
How good/big/fast companies are handling this issue? <comment><USER2> Split the territory. Take a look at the history of lead gen, opportunties, and closed/won rates & $$, and figure out how to divide the area into two equal- value segments.

Or, create a round-robin lead assignment mechanism, so each rep gets half the inbound leads.

<comment><AUTHOR> I thought about the round-robin. But how to avoid the leads stock market with the SDRs. Fighting for leads and bribing SDRs to get leads?

I was thinking about joining their commission, so they could work together and help each other.</comment></comment>


Why has the Russian economy plunged so suddenly? - <AUTHOR> http://www.theregister.co.uk/2014/12/28/just_how_badly_has_uncle_volodya_messed_up_the_russian_economy/

<comment><USER2> How Hitler defied the bankers [http://open.salon.com/blog/gordon_wagner/2010/05/11/how_hitl...](http://open.salon.com/blog/gordon_wagner/2010/05/11/how_hitler_defied_the_bankers)</comment>


Out of Band Access at rsync.net - <AUTHOR> http://www.rsync.net/products/oobaccess.html <comment><AUTHOR> In anticipation of the biggest FAQ: they are ubiquiti UAP-LR access points.

As always, email to ask about the "HN readers discount".</comment>


Tell HN: Ajax-Gist - A web-service that makes GitHub Gists accessible via Ajax - <AUTHOR>

http://ajax-gist.com/
I built this on Saturday night as part of the infrastructure that will be used in the new version of ReadMyCode.org
I warmly welcome any feedback or bug reports, either in comments here or via email: email@example.com
The code for the service is open-source and is designed to be run with zero setup on Heroku. So if you need access to a service that can support a higher load level simply launch your own version in less than 5 minutes! http://github.com/aarongough/ajax-gist <comment><AUTHOR> Clickable link: <http://ajax-gist.com/></comment>


Essential tracks to listen to with new headphones (2017) - <AUTHOR> https://www.theverge.com/2017/10/12/16463884/vlad-savov-headphone-test-playlist <comment><USER2> sorry but i cannot respect any list that fails to include at least one track by The Cure (preferably The Lovecats) its one of my goto tester tracks for new audio gear

if youre stretching into the realms of somewhat obscure japanese tracks then Uyama Hiroto's Waltz For Life is an absolute wonder id also even consider throwing some Fox Capture Plan in the mix, possibly Butterfly Effect and of course you cant go wrong with a bit of Nujabes</comment>


HDR+: Low Light and High Dynamic Range Photography in the Google Camera App - <AUTHOR> http://googleresearch.blogspot.com/2014/10/hdr-low-light-and-high-dynamic-range.html

<comment><USER2> Somehow the newer submission is getting all the upvotes and comments: [https://news.ycombinator.com/item?id=8516244](https://news.ycombinator.com/item?id=8516244)</comment>


Working overtime increases heart risk, a study finds - <AUTHOR> http://news.bbc.co.uk/2/hi/health/8674372.stm

<comment><USER2> This study is broken in multiple ways, so you should not take it seriously. Why can't people (= medical "researchers") learn their statistics?

</comment><comment><USER3> my heart disease risk would also sky rocket if I were a civil servant.</comment>


Defer, Panic, and Recover - Go blog - <AUTHOR> http://blog.golang.org/2010/08/defer-panic-and-recover.html

<comment><USER2> That's odd. It's clearly a system _like_ exception-throwing, but without the ability to distinguish from different kinds of errors (say, one might be able to recover from "received malformed input" but not from "array index out of bounds"), and still requiring that programmers check the error return value of most functions they call.

I wonder why they preferred that approach over the Java/Python approach to exceptions.

<comment><USER3> The reasons for not using exceptions are covered here: <http://golang.org/doc/go_lang_faq.html#exceptions>

<comment><USER2> "We believe that coupling exceptions to a control structure, as in the try- catch-finally idiom, results in convoluted code. It also tends to encourage programmers to label too many ordinary errors, such as failing to open a file, as exceptional."

To me, that comes across as "We don't like traditional exception handling because languages that use exceptions for error-handling encourage programmers to use exceptions for error-handling." Well, yes, that's what they're _for_.

Python's exception system is far from perfect - it would be nice if there were a standard way to annotate exceptions, and if exceptions weren't quite so inefficient - but it's much easier to design or learn an API when there's one error-handling system consistently applied, instead of two independent ones.</comment></comment></comment>


Cname cloaking, a disguise of third-party trackers - <AUTHOR> https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a <comment><USER2> The easiest way for site-owners to delegate control has been to include third- party javascript. With new browser restrictions, we're starting to see companies switching to loading JS via CNAMEd subdomains, because that's nearly as easy. The next step is probably reverse proxies, though, where the third- party JS comes from the same server that gives you the rest of the site's JS.

(Disclosure: I work in ads; speaking only for myself)

<comment><USER3> Or we could make all of that illegal and have an ad ecosystem that works for publishers and consumers as it does in every field except for the web (print, broadcast, podcasts, billboards—all work without JS and are great for consumers). Web is the one weirdo market with tracking. Make that illegal and it will be good like all the other markets.

<comment><USER4> The GDPR does that. It doesn't matter if you have the data in your own DB, you can't utilize it for purposes you haven't secured informed consent for.

<comment><USER3> GDPR is a good first step.

<comment><USER5> California's version, CCPA, should take effect starting January.

</comment></comment></comment></comment></comment><comment><USER6> Use a Pihole + your adblocker of choice - defense in depth. It's easy to set up, brainless to keep updated, and helps to protect all devices on your network, not just the things that can run uBlock. I've got mine running in a Docker container, which upstreams to a stubby container, which gets DNS-over- TLS, so I get adblocking _and_ DNS query encryption out to Cloudflare for the whole network, and it's really not all that hard to set up. (Edit: Here's the bash script I used. docker-compose would probably be better, but whatever. [https://gist.github.com/cheald/23da384908404b0757eadda74124a...](https://gist.github.com/cheald/23da384908404b0757eadda74124a602))

If you're unwilling to do that, just set your DNS servers to the Adguard servers ([https://adguard.com/en/adguard- dns/overview.html](https://adguard.com/en/adguard-dns/overview.html)) and you get most of the same benefit, though obviously without the control that the Pihole offers you. On Android devices, you can go to Settings - > Wifi & Internet - > Private DNS and set "Private DNS provider hostname" to dns.adguard.com (or your own exposed Pihole server, if you're so inclined) and get the same benefit when you're on LTE.

<comment><USER7> That will only work for so long, as more and more browsers are forcing DoH for "privacy" on users, making them bypass traditional DNS in-favor of DNS over HTTPS to a provider selected by the Browser removing user control

Mozilla for example is going to force everyone to use CloudFlare as a Resolver

<comment><USER8> You can change your DoH resolver, so you could setup a raspberry pi as a DoH server theoretically, and still keep the benefits of a PiHole. Mozilla is making CloudFlare the default but they aren't forcing it, you can use another server.

<comment><USER9> You can change it on web browsers, for now, but not on IoT devices.

<comment><USER10> I'm not aware of any IoT devices with non-configurable DoH.

<comment><USER11> It's coming in the future, likely soon we'll see it in Google hardware since they all auto-update.

</comment></comment></comment></comment></comment></comment><comment><USER12> I knew something like this would come up. I always wondered why ad/tracking companies never proxied through the first-party domain (or in a more extreme case, the first-party server itself) to skirt adblock.

Suppose you load example.com/article. Ad Agency serves ad/tracking assets from example.com/article/Zqj7MOm.js. When you reload, it serves from example.com/article/llc9h76.js. How do you block it? You can't. Getting this to work in a pluggable fashion is an implementation detail (maybe some on-the- fly statistical generation of URLs + passing nonces to and from Ad Agency as a mitigation for spoofing by example.com). Another way to implement it is a custom URL router that dynamically reverse proxies to Ad Agency on the generated ad trojan horse URL. The only reason this hasn't happened yet is because still very few people use adblock, esp. on mobile.

P.S. please don't do this.

<comment> brian-armstrong As I understand it, ad companies and the people who sell their websites to ad companies have some base level of distrust of one another, which has kept them from integrating like this. Ad companies want to serve the code to be sure that no click fraud is occurring, and people who run websites don't want to completely hand over their domain. But it's easy to see them forging this alliance if ad delivery depended on it.

<comment><USER13> This may be tremendously ignorant but...

What is to stop ad tech companies creating a cryptographically secured reverse proxy device[1] that clients can install in their network between the web server and requests from the internet?

The ad tech company only has to trust that their device is secure and the company that sells their website doesn't have to give up control of their domain or anything else.

They would have to isolate the ad tech device from the rest of the network and only allow it to communicate to the web server inside the network and the ad tech server outside their network. If something goes wrong with the device then it is trivial for the web serving company to bypass it.

\</comment></comment></comment><comment>-

As is mentioned in the grandparent comment, this allows anything to be done to the content being served from the website and not only domains cannot be trusted, individual URLS cannot either. Ad blockers will have to rely on examining the content directly even more than they already do. This would make it much less scalable for the ad blockers to deal with, they have to identify ad content individually, by their signatures or page structure in the best case, or examining arbitrary code behaviour in a worse case. Ad blockers may then have to deal with identifying ad content which changes as fast or faster than new ads appear, which is a lot worse than the relatively few(and relatively static) domains, URLS, bits of HTML and Javascript that are there now. Ad blockers may lose eventually due to incomputability, but who knows.

\</comment><comment>-

[1] Using a TPM is one possibility

<comment><USER11> This would have to be a reverse proxy on the AdTech's infrastructure itself to make sure no rewriting is being done after-the-fact, as you can't trust your AdTech customer (the person that owns example.com) to not run a reverse proxy _in front of that_.

<comment><USER13> Thanks for making me realise the most obvious thing, that it doesn't stop click fraud if it is on the ADTech customers network as they can connect to the device and pretend to be any device on the internet.

</comment></comment></comment><comment><USER14> Adguard is also starting to tackle this[0].

Found on [1]

(not affiliated with any of those in any way, I'm just a user of Adguard home)

[0] [https://adguard.com/en/blog/disguised- trackers.html](https://adguard.com/en/blog/disguised-trackers.html) [1] [https://www.reddit.com/r/pfBlockerNG/comments/e0bsto/defence...](https://www.reddit.com/r/pfBlockerNG/comments/e0bsto/defence_against_cname_cloaking_pfblockerng_or/)

<comment><USER15> Add this[1] host list for first-party trackers for those who don't want to use these dns solutions or/and they use a Chromium based browser.

[1] [https://git.frogeye.fr/geoffrey/eulaurarien](https://git.frogeye.fr/geoffrey/eulaurarien)

With third-party trackers: [https://hostfiles.frogeye.fr/firstparty-trackers- hosts.txt](https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt)

First-party trackers only: [https://hostfiles.frogeye.fr/firstparty-only- trackers-hosts....](https://hostfiles.frogeye.fr/firstparty-only-trackers- hosts.txt)

</comment></comment><comment><USER16> The way to counter this is to know the IP a given CNAME resolves to, and to block "rogue" (read: tracking) IPs.

As an open-source DNS implementer, I know this has already been done, since my DNS server (MaraDNS's Deadwood recursive resolver) has the ability to refuse to resolve DNS names with bad IPs via ip_blacklist.

The reason I implemented this is to block NXDOMAIN redirects (when using an ISP's DNS server and mistyping a domain name, instead of getting "nothing there", it goes to an ad-filled "search" page provided by the ISP), but the implementation scales and it should work for blocking a large number of rogue CNAME redirects like this one.

I'm sure others have implemented something similar out there (I will let someone who knows the pihole ad-blocking DNS server, not to mention NextDNS, better than me tell us how they do this), and I'm sure Firefox, if they do not do so already, will allow ad/privacy blockers to know the IP of a given name to allow blocking at the browser level.

<comment><USER17> > block "rogue" (read: tracking) IPs.

With IPv6 that's as impractical as blocking "rogue" FQDNs.

<comment><USER18> Why? Just block ranges.

<comment><USER16> Exactly. If I were to update this code, for IPv4 blocking, I would allow it to block /32 (single IP) and /24 networks. For IPv6 blocking, I would allow blocking a single IPv6 address, a /64 range, and (for extreme offenders) a /48 range.

One way to do this is to have multiple hash tables: One for single IPv4 addresses, one for IPv4 /24 ranges, one for single IPv6 addresses, one for /64 IPv6 ranges, and one for /48 IPv6 ranges. Note that while the hashes have (generally speaking) a "big O" of 1, we need to perform one additional operation per range size. IPv4 /32 and /24 blocking requires two lookups, and IPv6 /128, /64, and /48 blocking requires three lookups.

</comment></comment></comment></comment><comment><USER19> Online advertisement are constantly using the same exploits that malware and can be seen as part of the progression ladder when walking from being zero-day to universally patched.

A while back ago malware started to use a scheme similar to fast flux, but rather than changing the IP address they used a chain of cnames to hide the malware network. In order to combat this researchers developed detection tools to find algorithmic generated domain names and flag them as suspicious at the resolver layer. I would expect to see the same mitigation method to travel into ad-blocking.

</comment><comment><USER20> uBlock Origin issues:

[https://github.com/uBlockOrigin/uBlock- issues/issues/780](https://github.com/uBlockOrigin/uBlock-issues/issues/780)

[https://github.com/NanoAdblocker/NanoCore/issues/296](https://github.com/NanoAdblocker/NanoCore/issues/296)

<comment><USER21> Discussed on HN 3 days ago:

[https://news.ycombinator.com/item?id=21582698](https://news.ycombinator.com/item?id=21582698)

</comment></comment><comment><USER22> I can't believe Ars Technica would do this. Do they not realize who their audience is?

<comment><USER23> That also means most of their audience blocks ads. What are they to do?

<comment><USER24> The answer I keep returning to: if shady ads is what keeps your business running, stop running your business. Switch off the lights and the servers and go home.

<comment><USER25> That's too simplistic a take: they aren't running shady ads and unlike many sites they allow you to you subscribe and not see ads at all. Unfortunately, large chunks of the public — especially tech site visitors — have been conditioned to think of content as free, and the adtech bubble hasn't pooped yet so we can't reverse that trend.

<comment><USER24> What people are willing to pay for content _is_ I think almost zero.

If we get rid of these privacy invading ads and micropayments/subscriptions don't take off in a big way (I don't think they will) then one or two things must happen

1) advertising money remains even though ads are dumber (less narrowly targeted, more fraud etc)

2) there is a lot less money to go around so there must simply be less content.

I think the answer is somewhere in between. I don't think it's a pessimistic view that maybe 75% of sites not only risks disappearing but perhaps should. The abundance of "free" content is what makes people unwilling to pay for quality.

<comment><USER25> I definitely think you're right on the conclusion: a lot of content sites are going to need to dramatically scale back their size or simply fold. It feels a lot like when VCs pile money into an area and it takes longer for viable business models to win out, only with a much longer run time since the advertising market is so much larger.

</comment></comment></comment></comment></comment></comment><comment><USER26> In particular case of liberation.fr, anyone who has access to the value of 'djazsession' cookie can log in to the users' account. This is one of the cookies being sent to Eulerian.

Here is a demo video:

[https://twitter.com/konarkmodi/status/1198412297842184192?s=...](https://twitter.com/konarkmodi/status/1198412297842184192?s=21)

</comment><comment><USER27> I worked in ad space 7 years ago. Companies that provide content need to get paid for the content one way or another, either paying a fee or ads, nobody can argue with this.

There needs to be an organization that imposes ad guidelines(like only specific formats, not being intrusive, etc) for both websites and ad companies. They should verify the ads/websites based on user reports and if they find something, to kick the company out.

All companies that follow those guidelines should be whitelisted by ad blockers, probably something implemented at browser level.

Otherwise is just a useless chase.

<comment><USER28> There are other alternatives. Alternative monetization schemes, such as those offered by Patreon or Twitch or Kickstarter can be found.

Also, ads can be placed teh same way they were in newspapers - the ad company would submit ads to the content creator, who would manually chose which ads to include, and where.

<comment><USER27> It's not that easy as you may think. Also, small companies won't benefit from that, nobody will submit an ad to websites with lower traffic. Besides this, there's the issue with the tracking server and so on.

<comment><USER28> I didn't say it was easy. But perhaps it is important enough that it should even be regulated.

</comment></comment></comment></comment><comment><USER29> Sooooo

I suppose we are going back to the roots

White lists in hosts file with ips and good sites

<comment><USER30> You can also use uMatrix or NoScript to disable all JS/XHR (or even CSS and images) from third-party domains by default; and whitelist those you need.

<comment><USER29> Hmm

How can I block cookies with uMatrix for sub domains like *.domain.com for any site?

PS: I assume that just temporary solution. Because nextsstep is just hosting some js from "analytics" on main domain and/or solutions like cloudflare for e-commerce / google news / etc.

And for filtering that bs we need deep filtering and api inside JS VM

</comment></comment></comment><comment><USER31> The article explains that trackers traditionally loaded some external JS which then phoned home and tracked users via third-party cookies.

I would like to point out that it has never been the case for Google Analytics and possibly other trackers. The developers of a website are supposed to copy/paste the Google Analytics snippet directly into their own JS, such that GA has access to first-party cookies. And then GA phones home some tracking data leveraged by this first-party cookie.

Blocking third-party cookies never blocked this kind of tracking. You needed to block the domains that the script requested via AJAX. But it is indeed made difficult with CNAME Cloaking, because the domains requested are subdomains of the current domain, and can be changed regularly as explained by the article.

There is no end-game solution against tracking. It will all come down to tracking companies ordering websites to install some library directly in their back-end and pass it user data as well as behavioral data captured from some other library installed in the front-end. Tracking data will pass through applicative pipes and it will be impossible to block reliably.

<comment><USER32> How does the centralized ad server track the user as they move from site A to site B, since no cross-domain cookies can be used? Without resorting to fingerprinting which could be circumvented by the client. Absent behavioral profiles and persistent tracking, most ad formats are worth very little. Isn't limiting all communication to the first party domain a form of sandboxing?

</comment></comment><comment><USER33> > It also only takes 2 minutes to change dg3fkn.website.com to > 3j4vdl.website.com (Hell, you can probably automate this). We mentioned > above how much work it takes to gather all subdomains being used as a front > for CNAME Cloaking. Now imagine they change every week, every day, or every > hour. It's just impossible to keep track.

That's fear mongering. The ad company can't pester their clients to make changes to the DNS on a regular basis. I'd say that anything beyond initial setup would be unaccepted to most clients. And clients won't give control of their DNS to ad company, so automation is also not really possible.

Also, because this setup is substantially more friction than a simple 3rd party tracking "just copy-paste this code", I'd guess it will only be used by high profile clients.

This all means that while annoying, it shouldn't be too hard to find and add these subdomains to the ever-updating ad url blacklists.

<comment><USER34> >The ad company can't pester their clients to make changes to the DNS on a regular basis.

Many DNS providers have APIs.

>And clients won't give control of their DNS to ad company, so automation is also not really possible.

Sure they will. Or they'll use another party that does it. They already add JS from the ad provider that does god knows what to all their pages, and give full control over their content to Cloudflare. So why wouldn't they give an ad provider API access to their DNS?

</comment></comment><comment><USER35> Pihole has an "audit" feature that can be used here: [https://pi- hole.net/2017/12/06/pi-hole-v3-2-introduces-long-...](https://pi- hole.net/2017/12/06/pi-hole-v3-2-introduces-long-term-statistics-an-audit-log- colours-and-more/)

</comment><comment><USER33> Something is missing here: HTTPS links and SSL. Either website.com hands over its certificate to dnsdelegation.io (which is unlikely and definitely not a 2 min trust-less process) or dnsdelegation.io has the ability to generate any certificate like a certificate authority which is really terrible (and also unlikely).

<comment><USER36> DV certificate (cheapest, most common one) does require only proof of control over the domain.

So dnsdelegation.io can just request certificate for the domain you've delegated via cname from any CA.

</comment></comment><comment><USER37> More info on NextDNS solution to this problem here: [https://medium.com/nextdns/nextdns-added-cname-uncloaking- su...](https://medium.com/nextdns/nextdns-added-cname-uncloaking-support- becomes-the-first-cross-platform-solution-to-the-problem-e3f437f84342)

</comment><comment><USER38> I don't get one thing. Isn't CNAME also bad for "them". I mean with CNAME, they can serve adds, cookies ... from site subdomain, bypassing blockers. But how will they track users on different sites, like user vising website1 and then website2? Since their tracking cookies are now part of website1, they won't be sent to website2.

I mean is there any replacement for them, not using cookies? Because cookies seems to be the only global storage for user identification data. Since tracking script was hosted on their domains (and included into websites with script tag), cookies were shared across all site, that included that tracking script. IMO when they switch to CNAME trick, they will loose this capability.

<comment><USER37> With fingerprinting.

</comment></comment><comment><USER39> What's the difference between this and what Instart Logic has been doing for years now? [https://github.com/gorhill/uBO- Extra#purpose](https://github.com/gorhill/uBO-Extra#purpose)

<comment><USER40> Wow it goes even further: [https://github.com/gorhill/uBO-Extra/wiki/Sites-on- which-uBO...](https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO- Extra-is-useful)

> Instart Logic will detect when the developer console opens, and cleanup > everything then to hide what it does. I had to trick IL's script into > thinking the dev console was not open to take the pic above.

<comment><USER41> How does it do this?

<comment><USER42> Page resize events in one dimension by the size range commonly used by devtools, measure reduction in JS perf are two ways that come to mind

</comment></comment></comment></comment><comment><USER43> Shouldn't neglect to discuss the proposed Signed HTTP Exchanges by google who will make this kind of thing far worse. Not just for the tracking implications, but how easy it will become for some countries to outright fake the news.

</comment><comment><USER44> So block content, as always? That's not possible for NextDNS, which I guess is their concern, but then DNS blocking was always going to be a very very blunt instrument.

<comment><USER45> At home I'm using it in addition to ad blocking in the browser, for apps and other things that might slip through.

Currently it's just dnsmasq with a huge blacklist, and I guess it doesn't support checking the whole CNAME chain against that list, which would be really cool.

<comment><USER46> It doesn't need to have every cname in it. The cname resolves to the actual "bad" domain, which should be in your list already. That's why DNS blocking can still combat this method easily, while it's much harder at the browser level. uBlock Origin for Firefox beta has a "run all non-local domains back through and check for cname redirection" feature, which can also block the cname trick, but it will increase DNS latency because it has to check each external domain again for the "true" domain.

<comment><USER47> > [uBO] will increase DNS latency because it has to check each external domain > again for the "true" domain.

The browser API used by uBO returns the last CNAME in the chain. I consider the DNS lookup itself to be an non-issue overhead-wise in uBO because:

\- The browser would need to do it anyways

\- DNS lookup results are cached at both the browser and uBO level

</comment></comment></comment></comment><comment><USER48> Please correct me if I am wrong, but would not such a tracking be circumvented by enabling first party isolation in the browser? As far as I know, Firefox has such feature implemented: [https://www.ghacks.net/2017/11/22/how-to- enable-first-party-...](https://www.ghacks.net/2017/11/22/how-to-enable-first- party-isolation-in-firefox/)

<comment><USER49> I was also wondering about the that. Sadly, it is still not enabled by default in the latest Firefox release (version 70).

Furthermore would the Firefox Multi-Account Containers [https://addons.mozilla.org/en-US/firefox/addon/multi- account...](https://addons.mozilla.org/en-US/firefox/addon/multi-account- containers/) with container per site prevent such tracking (has to be done manually ATM) ?

</comment></comment><comment><USER50> I wonder if it would be possible to make a whitelist blocker instead of just blacklist? I mean, if a certain domain is in the whitelisted list, you show only responses from whitelisted subdomains. If not, you fall back to blacklist.

By possible I do not mean technically possible, but feasible in the resources required maintaining the list as well as good enough user experience.

</comment><comment><USER33> How does this work with SSL certification? The 3rd party server needs to be in possession of a certificate for eir63gd.mywebsite.com

<comment><USER51> Let's Encrypt makes this trivial and automatic if foobar.example.com has been CNAMEed to the tracking provider.

</comment></comment><comment><USER52> I have done something similar as an experiment. I wanted mixpanel analytics on a site for element interaction. I proxied mixpanel through a URL endpoint (maybe it was a subdomain). I had it not load analytics if DNT was set. It was a fun hack but more work than it was worth for my low traffic site.

</comment><comment><USER53> I don't get it, why ad-blockers can't request a DNSBL managed by them to know if that CNAME is authorized or not? Granted, it requires a bit more network request, but completely breaks the CNAME cloacking method.

</comment><comment><USER54> What if there were restrictions on these with regards to ttl, it would put the burden back on the trackers, they wouldn't be able to swap and change them as quick and very quickly run out of options.

</comment><comment><USER55> Cute, but now they can't use their cookies to track you around the web because on every site their page has a different domain name. So this is actually an improvement.

</comment><comment><USER56> I don't want to name any companies here, but CNAME cloaking is also commonly used in ad-tech for conversion tracking pixel urls.

</comment><comment><USER57> At what point does adblocking need to start taking IP address reputation and/or originating AS number into account?

<comment><USER58> Now.

Seriously.

</comment></comment><comment><USER59> We can use that to add the domains to 'spam' lists as they host a lot of ads/spy subdomain.

</comment><comment><USER60> I'm back on the Noscript train & just white-listing stuff on the sites I frequent

</comment><comment><USER61> Ok, so how to we kill the ad industry? This is ridiculous.

</comment><comment><USER62> At some point why shouldn't the (US) government step in?

<comment><USER63> Then we'll just get more pointless legislation that led to the cookie banner and ads/trackers will be trivially cloaked/proxied to the point where any publisher has full deniability.

We'll look back at the good old days when ads were mostly just banner ads.

Idea: Start paying for content and support the sites that offer this option. The entire concept of adblocking lives on borrowed time: hoping your content creators are making enough money off the suckers that don't use adblockers.

It's hard for me to envision legislation that wouldn't just be a clusterfuck as the government encroaches further onto our internet.

</comment></comment><comment><USER64> Abusing cname is an old trick.

You used to have domain.com and declare ns1.domain.com pointing to your host so it would show domain.com instead of host.com

</comment><comment><USER65> There are many banks to choose from. Put your money elsewhere. Then explain to the bank why you did.

<comment><USER66> Every bank I've used has had a pretty absurd amount of trackers that I've blocked, often 5-10+ third party javascript domains. I don't know of any that don't have any, but I'm sure some small ones exist somewhere.

There doesn't appear to be a huge market for services that do little/no tracking, as users are all unaware of the tracking that services do to begin with, so they would not even notice the difference.

<comment><USER67> Contact the regulators, perhaps? To me, allowing untrustworthy third-party scripts on a bank website sounds like a huge security risk.

<comment><USER66> As a US citizen I don't see much that can be done. Although I don't trust the third-party scripts, the bank obviously does, given they're all large analytics platforms.

</comment></comment></comment></comment><comment><USER68> At some point, having a cloud instance acceessed by VPN and proxing all traffic through that could be good.

Until your proxy is hacked, I suppose.

Resistance is feudal.</comment>