Ask HN: Experiences with cloud-based dev platforms? - <AUTHOR> Are you using, or have you used, a cloud-based IDE or development environment like Koding, Cloud9, CodeAnywhere, etc? What do you like about it? Dislike about it? <comment><USER2> Disclaimer: I'm just a product/biz guy that codes on the side.

I started using CodeAnywhere earlier this year to manage a small PHP+mysql geospatial email system for an aviation charity I do the tech for...so wanted something cheap (its $120 a year?) and able to teach a non-tech how to go in and make a change (as I don't want them making edits in the github UI). I was also using my Chromebook a lot while traveling and using shared space, so I needed a decent dev environment without Chrome plugins/jankiness/slowness from a 4gb system.

They have Android and iOS apps that make changes when on the go a touch easier, though code on a Nexus is pretty rough on a plane :-)

So far, pretty good - initially they were making changes to how containers were created and destroyed, causing some changes in the syntax of how a container is defined thus causing mine to be troublesome. However, their support was pretty responsive and got it sorted out.

gomix.com as mentioned here already is pretty new but has been reliable for me so far. It is a fogcreek venture so I imagine it will mature pretty quickly.

<comment><USER3> Hi, I am the founder of Codeanywhere. Thanks for the kind words and let me know if I can help with anything :)

<comment><USER4> I took a stab at this domain (online dev environment) with a service recently, and it's really hard! So congrats on codeanywhere, it's really nice. My qustion is; how does code anywhere handle mobile users? Every syntax highlighting text component I tried utterly failed on mobile slash touch devices.

<comment><USER3> Well we have native mobile apps :) Although be warned the ones on the store are a bit out of date with new ones coming out in a matter of weeks!

</comment></comment></comment></comment><comment><USER5> I started with them. First Cloud9, then Nitrous and eventually, I ended with...

\- A cheap VM on Digital Ocean close to my location

\- tmux

\- vim

I have never been so productive before and they give me more flexibility than any cloud dev service at a much cheaper price point. And now after two or three years, I am a tmux, vim, console pro. Everything else compared feels slow and limited.

<comment><USER6> What size droplet do you use and what kind of apps do you develop on it?

I see the cheapest one has only 512MB RAM.

<comment><USER7> It is VIM, not Eclipse. A few megabytes of memory is really all you need.

<comment><USER8> Depends if you also want to run tests, like one often does in their local machines.

</comment></comment></comment></comment><comment><USER9> Gomix ([https://gomix.com](https://gomix.com)) is my current favorite. It might not have as many bells and whistles as the others you listed, but it "just works" more of the time than any other platform I've tried.

</comment><comment><USER10> I'm a big fan of Cloud9. Since you can use Cloud9 on your own hardware pretty easily you're not forced to treat it as a part-time-IDE-for-X you can just use it for everything (it supports dozens of languages) and being online or locally hosted becomes just an irrelevant detail. I've used it for web and android projects.

I dislike the proprietary ones, I don't think proprietary developer tools should be supported anymore tbh, but they force you to use them only-for-x and that means you're looking at alternatives every other time too!

<comment><AUTHOR> Part of my thinking here is to get a dev environment that is 100% independent of my laptop - I don't need local files, or local configuration. Currently, I'm using Vagrant on a Mac, and that works well, but it's also wedded to a computer I'd like to put into semi-retirement, and I don't want to spend a fortune on a new one. The idea of just using cheap Chromebooks for dev sounds very appealing.

<comment><USER11> Cloud9 has been a delight so far. It doesn't require local files — parent was just saying that you can use it as an IDE on your own arbitrary box (e.g. a DigitalOcean droplet), but that doesn't stop you from using the default option of a Cloud9-provided Ubuntu container. Another big win with C9 is "collaborative mode", which lets you pair with someone remotely, each with their own cursor in the same file. I've been using that a lot to integrate closely with a front-end developer who is taking care of the views while I simultaneously write the backend logic.

</comment></comment></comment><comment><USER3> Thanks for this great question! As the Founder of COdeanywhere I am also really keen on hearing the answers. Also feel free to ask me anything you guys like.

Best

<comment><AUTHOR> Well, question for my platform... I'm building client apps in Go to run on linux boxes. The core client is a scheduler that runs as a daemon, schedules execution of other apps, and sends results to a remote API. Is this something that can be done from within the CodeAnywhere platform?

<comment><USER3> Sure, you can either connect Codeanywhere to your Linux boxes via SSH or you can use the Boxes Codeanywhere provisions for you.

</comment></comment></comment><comment><USER12> I've used [https://cloud.sagemath.com/](https://cloud.sagemath.com/) with great success. Especially with writing Sage code, LaTeX, Python, Go, Javascript, and a bunch of others. It's especially nice since I can work on any of these collaboratively with others. Right now I'm using it with a small team writing a bunch of markdown files with math, which smc (sage math cloud) handles great.

<comment><USER13> I started using SageMathCloud a couple years ago while taking courses from edX and Coursera in physics and data science. I liked it enough that I joined the project as volunteer contributor. At 60+ MOOCs completed, I still use SMC for online learning. Most valuable features to me: 1) not having to install tons of software locally; 2) consolidation of work from different courses & schools; 3) Sage units of measurement and symbolic expressions (good for physics); 4) Jupyter notebooks and sage worksheets, so work from a study session reads like a lab notebook rather than a jumble of scratch paper notes.

</comment></comment><comment><USER14> I'm a vim+screen+mosh(+Jupyter) guy, so my environment is "cloud-based" as-is (in that I'm mosh-ing to a dev server). I can see why some people might want more fully featured IDEs, but this works for me. As I get better and better at Vim it gets harder and harder to go away from the keybindings, as well.

I guess it depends on what you're looking for - i.e. some new kind of collaboration workflow or a nice GUI or some other IDE features.

<comment><USER15> Are you using a VPS or what sort of dev machine are you using?

<comment><USER14> I've gone through the process of port forwarding my router and setting up dynamic DNS (who does that anymore? :) ) so I can hit my home desktop with an Ubuntu VM on it and I usually have a few AWS instances up at any given time for different projects. Then most of the active code gets synchronized between machines via Github.

<comment><USER16> > dynamic DNS (who does that anymore? :) )

I do! I used afraid.org at first, but since my company blocks DynDNS domains (don't ask), I switched to gandi-dyndns [1] using my own domain.

[1] [https://github.com/jasontbradshaw/gandi- dyndns](https://github.com/jasontbradshaw/gandi-dyndns)

</comment></comment></comment></comment><comment><USER17> Of them all the one i used the most was Codio.

It used to have a minimal set of things you could install but moved to a clean Ubuntu box that you can pretty much muck about with and install what you like.

For Rails, it is perfectly suited and very easy to spin up an Ubuntu VM and play.

I used Cloud9 before hand and though this was a while ago, I had a demo of an Express thing with MongoDB and about 15 mins before said demo it started falling apart.

I believe the uptime is pretty great, just a lasting impression of failing just at the wrong time.

Codio seems to have pivoted however to be more about offering educational institutions the ability to create courses etc. so though powerful, that is what the developers are focused on now

Occasionally the version number of things lag behind in Codio and that is my biggest gripe. That and PHP boxes not having mod_rewrite enabled out the box, but that is just me

</comment><comment><USER18> Great question. I'm curious about what others do as well.

By day I am a .NET developer who typically uses Visual Studio. I do all of my development on an Azure VM with all of my dev tools on it. This is very useful because I can access it from anywhere and don't muck up a physical machine doing it. I use a standard F4 instance and stay under my free MSDN credits most months as long as I remember to turn it off (automation has fixed this recently ;). Not exactly what you mean, but lots of the same benefits.

But, I do like to tinker and see what all the cool kids are using, so have tried most of the ones you mention as well. I do think this model will become way more common, but none have stuck so far for me. Most of that is that I have customers that use VS and have a hard time imagining them using anything else. But I also felt the "free SKU" on some of these to be a little limiting. One or two projects or public-only projects means I have to commit to use in my day job. I don't fault them for making money, but there is a barrier there that limits me from using or recommending it. Also, if I'm learning something new - especially tooling like webpack/grunt/gulp/yo/etc.- it can be difficult to translate "getting started" style documentation to the specific environment. If something goes wrong, I'm unsure if it's the environment or me (though I assume the later ;)

As many have suggested, gomix is changing this some for me. I've used it to learn node a bit more, and as a place for one-off tests of JS/HTML/CSS issues. As with the others, I feel like I'd have a hard time recommending it for production use at the moment, but really like it for things I don't necessarily want in my or my customers' source control. It's zero-friction and "just works" for a certain class of problem.

My _hope_ is that these mature so that 1) there is less vendor lock-in and barrier-to-entry and 2) get more popular so that certain types of applications don't need a full on dev environment to code for.

</comment><comment><AUTHOR> For my personal interest, I'm developing an app on a Rails/Postgresql stack, and client software that talks to the app in Go. I'm interested in finding a cloud-based solution that supports both without a lot of DIY hand-rolling.

<comment><AUTHOR> If I could do the Rails stack gracefully, I could probably offload the Go development to a regular VM on DigitalOcean. I may need to anyway, for reasons. So from that perspective, I want a cloud-based system where I could also ssh from it into a VM of my own.

</comment></comment><comment><USER19> I've been using Cloud 9 a bit to give my girlfriend coding lessons. Once she acquired a base set of knowledge, I started giving her "assignments" where I'd describe the program she had to build in comments.

When she has an issue, I hope onto the collaborative workspace, and we either chat using the in-app function, or do a Skype voice call.

For collaboration, it is great. The environment is pretty slick as well. I haven't used it for a "real" project yet, though. I'm not quite sure how the collaborative functions would work with a VCS, for example.

</comment><comment><USER20> (As long as you have fast internet) Codepen is so useful for making ui's... it massively smooths out the fiddling process and also convenient to share a ui with the debug / display mode or whatever it's called. I'm sure one could come up with a similar offline software for the creation aspect, but since it's hosted, it takes only two clicks to share a website demo, which seems like it would be hard to duplicate without cloud.

</comment><comment><USER21> I'm loving Cloud9 for JavaScript and Python dev. I love having a separate VM per project and _nothing_ installed on my laptop.</comment>


Nisechūgokugo (Pseudo-Chinese) – internet language blurring Japanese and Chinese - <AUTHOR> https://old.reddit.com/r/LearnJapanese/comments/f5204l/%E5%81%BD%E4%B8%AD%E5%9B%BD%E8%AA%9E_nisech%C5%ABgokugo_pseudochinese_the_japanese/ <comment><USER2> anyone more fluent can explain 林 role on "我林檎食"? (example for 我吃苹果。)

<comment><USER3> 林檎 is one way to write "apple" in Japanese using kanji, although it's usually written in kana as リンゴ instead. [https://jisho.org/search/%E6%9E%97%E6%AA%8E](https://jisho.org/search/%E6%9E%97%E6%AA%8E)

It's called 偽中国語 for a reason: Japanese speakers may know some obscure kanji for a word, but that doesn't mean they're the same as the hanzi a Mandarin speaker would use.</comment></comment>


iOS 11.4 to Disable USB Port After 7 Days: What It Means for Mobile Forensics - louis-paul https://blog.elcomsoft.com/2018/05/ios-11-4-to-disable-usb-port-after-7-days-what-it-means-for-mobile-forensics/ <comment><USER3> I'm so unused to seeing a corporation act in the interests of their customers explicitly counter to the wishes of law enforcement and the intelligence community that I'm racking my brain trying to think of ulterior motives that explain why Apple might have this.

Either way, on the surface, I'm quite pleased by this development.

<comment><USER4> I think it's as simple as: Apple's business is determined much more by end users than by government regulation. Unlike telecoms or increasingly, Google/Facebook. And this is amplified by Apple deciding that, as the others can't follow it, it's a good differentiator to invest in.

<comment><USER5> Don't they use Google Cloud for ICloud storage?

<comment><USER6> They use multiple types of cloud storage; the data is encrypted and Google isn't processing it, just storing it.

<comment><USER7> A common misconception - parts of iCloud data are encrypted at rest, but a good chunk of it is not. They've indicated they want to get there at various points in the past, but unless I've missed an update it's not there currently.

<comment><USER8> The files are still encrypted at rest (using convergent encryption) to obscure their contents from the underlying storage service, but Apple holds the keys:

> Each file is broken into chunks and encrypted by iCloud using AES-128 and a > key derived from each chunk's contents that utilizes SHA-256. The keys and > the file's metadata are stored by Apple in the user's iCloud account. The > encrypted chunks of the file are stored, without any user-identifying > information, using third-party storage services, such as S3 and Google Cloud > Platform.

[https://www.apple.com/business/docs/iOS_Security_Guide.pdf](https://www.apple.com/business/docs/iOS_Security_Guide.pdf) (page 56)

<comment><USER9> >Apple holds the keys

Unless you live in China, in which case Apple _and_ the Chinese government hold the keys.

<comment><USER10> We don't know this to be the case.

Unless you some evidence to the contrary ?

<comment><USER11> The Chinese government made Apple hand over control ofiCloud infrastructure in China to a Chinese company. So those encryption keys stored in iCloud are now in the hands of aChinese company subject to Chinese government control.

Not exactly an ideal arrangement, but it was likely that or switch off iCloud in China, or pull out of China completely. Which to be fair Google actually did.

<comment><USER10> Again. There is no evidence that has been presented to date that indicates that hardware keys were given to the Chinese government.

We suspect it may have happened. But nobody actually knows.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> This seems like it'll just make police departments go to a judge more often alleging probable cause immediately, and judges might be more inclined to grant given the time pressure, thus paradoxically it might end up with more phones being opportunistically subject to warrants by the police as the justice system would be given less time for duebl consideration. A "ticking bomb" tends to produce anti civil liberty behavior on the authorities.

they should have a setting to disable it almost immediately.

I almost never us the data connection on my iPhone usb except for headphones, yet another downside of losing the audio jack :)

<comment><USER13> If you're really concerned about people exfiltrating data off your phone via usb, fill the lightning port with epoxy and just use wireless charging and bluetooth headphones.

<comment><USER14> A determined individual can remove epoxy without damaging the electronics.

<comment><USER15> Apple should allow to do this in Software. Make the lockdown mentioned in the link happen immediately when USB is disconnected, forcing you to retype the PIN every time.

Could be a cool feature for the privacy concerned crowd.

<comment><USER16> Unless I'm mistaken, this is the way that Android already works. If you plug in a locked phone, you must unlock it to get any USB data connection to the phone. When a phone with a data connection is unplugged, the permissions immediately reset and you have to unlock the phone again to restart a data connection.

Not only that, on my Nexus 5x, I have to manually switch from charging mode to data transfer mode every time (the setting doesn't stick).

Unless I've misunderstood the significance of this change, Android actually provides much more security since you can't download files off a locked phone, not even within 7 days.

<comment><USER17> Yes, the iPhone is the same. You get a 'Trust this computer?' prompt which forces you to unlock the phone first.

The trouble is, this is still a data path that has been opened via USB. This new change disables the data path altogether and just allows charging via the USB power pins only - like its a USB battery or USB fan, simply power and nothing else. Which is pretty neat.

<comment><USER18> Why doesn't the iPhone disable the data transfer pins until unlocked?

<comment><USER19> Probably because for any decent charging speed (beyond 500mA) you need to talk to the other side. Atleast per standard.

<comment><USER18> How does Android work around this?

<comment><USER19> It communicates power needs but nothing else until the user unlocks the phone and enables data transfer.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Google's Cached version if you're having issues accessing it:

[http://webcache.googleusercontent.com/search?q=cache:https:/...](http://webcache.googleusercontent.com/search?q=cache:https://blog.elcomsoft.com/2018/05/ios-11-4-to- disable-usb-port-after-7-days-what-it-means-for-mobile-forensics/)

<comment><USER20> Is it just me or is the google cache link timing out as well?

<comment><USER21> Click "text-only version" in the Google cache header.

</comment></comment></comment><comment><USER22> One test I would carry out and well within the remit of geeks and enforcement - would be a femtocell/base station with a time update (which mobiles accept blindly if you let them). Forever keep connected devices in a Groundhog day.

That would certainly be the go to test for many I suspect, a tried and tested hack from days of old, brought into modern times.

<comment><USER23> They could just as easily use time since boot, which is usually a separate counter.

<comment><USER6> They could do a lot of things. The question is if they do.

</comment></comment></comment><comment><USER24> A step in the right direction, but I'd like to see this interval reduced (12 hours? 1 hour?) or brought down completely (I should have the option to require an unlock before any connection is established). There's no reasonable use case where I would want to make a connection while not wanting to unlock the phone.

<comment><USER25> the quote from apple specifically mentions USB _accessories_. i would guess they have things like headphones in mind, and it's reasonable to expect that if i have music playing with the screen locked and i connect a pair of headphones, the playback would switch to the headphones.

7 days still seems much higher than necessary.

<comment><USER26> As someone who only uses wireless accessories (including a wireless charger), I'd love to be able to configure this interval or require it immediately.

</comment></comment></comment><comment><USER27> How is this different from how Android works, where you have to unlock your phone and explicitly tell it to connect every time you want to use a USB connection for anything other than charging?

<comment><USER28> The Apple driver creates some sort of cryptographic keypair between the device and the computer to "remember" that you accepted the connection and not prompt you to connect in the future.

If this file was recovered from a victim's computer, forensic software can sue it to bypass the prompt. According to the article, however there is now also a 7-day expiration on these cryptographic keypairs.

<comment><USER29> > If this file was recovered from a victim's computer, forensic software can > sue it to bypass the prompt.

That typo gave me a good laugh

</comment></comment></comment><comment><USER30> Blog seems to be hugged to death, so I might be uninformed.

What exactly happens after the 7 days? My girlfriend's iPad got blocked on vacation (bluetooth keyboard in a bag causing random inputs). To get it fixed, we needed to connect to a computer. Would this mean that if you don't get to a computer within 7 days it would be essentially be bricked?

<comment><USER31> If the device is not unlocked for 7 days, the USB port stops working (for anything but charging.) It won't brick the device, which can still be unlocked any time, it just prevents someone from taking more than 7 days to hack open your phone, via the USB.

edit: so in your case, perhaps yes, you would have been hooped.

<comment><USER32> I would assume DFU mode would still work to reinstall the OS.

</comment></comment></comment><comment><USER33> Maybe I missed this in the article, but does anyone know if this feature can be turned off? Or if it's enabled by default?

What happens in the scenario of a consumer having an old iOS device sitting around, they forget the passcode, but now can't reset it using iTunes?

<comment><USER34> As far as I understand, there's still the hardware key combination to put the device into DFU mode. In that mode it can still be connected to and a new firmware can be written, but no access to the data is possible.

So in order to un-brick an old device sitting around, you put it into DFU mode (the key combination varies from device to device) and restore it that way.

Of course you don't ever get your data back, but that's totally the expected behaviour.

<comment><USER35> Do you have any source for that information? I am very interested in that as well but couldn't find any information regarding that so far.

I have always thought (though without any source) that they re-flashed the iPhone by putting it into the DFU mode (and tricking the iPhone bootloader into accepting their key) and then just brute force the key.

<comment><USER36> There is no scenario which allows re-flashing a device from DFU while retaining user data. This only appears to work in typical user scenarios because iCloud or iTunes creates a backup from the unencrypted device as a first step before flashing it.

</comment></comment></comment></comment><comment><USER37> Glad to see Apple is at least trying to protect their users.

<comment><USER38> Sounds like they just patched a glaring security hole, late in the game? I'm not even sure how useful the "7 days" thing is - it's certainly better than leaving "permanent" keys on various "once trusted" computers.

But still leaves the window wide open to sneak-and-peek to mirror the drive of a matchbook left in a hotel room, and then later acquire the phone.

So better than keeping the old behaviour which was obviously broken, I guess?

<comment><USER39> > But still leaves the window wide open to sneak-and-peek to mirror the drive > of a matchbook left in a hotel room, and then later acquire the phone.

MacBooks have full disk encryption so you'd have to break that, too, but since we're talking movie plots rather than real-world risks for most people take a moment to think about what else they could do with physical access: install a camera to record passwords, drug your water glass, or simply have someone demand you unlock it or else. If you're Jason Bourne you need more than a consumer OS gives you out of the box.

<comment><USER38> A disgruntled spouse swiping your phone and running up to a awarded hotel room to hook it up to a trusted macbook protected by your secret "1234" password isn't exactly Jason Bourne territory. I suppose they might know your phone passcode as well - all I'm saying is that a phone in general use will have been unlocked the passed few days, and is likely in proximity to a trusted device.

Now, we don't know how the greylock stuff works (afaik) - so maybe this will harden phones against imaging with such tools. And maybe not.

I actually have a hard time seeing how this is: "aimed squarely at police". If you're picket up at a demonstration or traffic stop - is it really that common that they won't get to your phone in 7 days? They're only allowed to hold you for 48 hours or so anyway?

Don't get me wrong 7 is better than forever - but I'd like to see it made available as a user setting; eg never / 30 seconds etc.

As for this not being available on Android; my impression was that given an encrypted, locked, Android phone with pin/pw lock and debugging disabled - you'd need to unlock before being able to access phone data via USB?

Now if debugging is activated, I believe a "trusted computer" (anyone who holds the keys) can gain access even if the screen is locked?

<comment><USER39> > A disgruntled spouse swiping your phone and running up to a awarded hotel > room to hook it up to a trusted macbook protected by your secret "1234" > password isn't exactly Jason Bourne territory.

Think about that from the perspective of a security threat model: what are the odds that your disgruntled spouse has access to your computer and knows your laptop password, but doesn't know your phone password? This is an extremely hard problem to solve since they have all kinds of sensitive information and access.

> I actually have a hard time seeing how this is: "aimed squarely at police". > If you're picket up at a demonstration or traffic stop - is it really that > common that they won't get to your phone in 7 days? They're only allowed to > hold you for 48 hours or so anyway?

What they're allowed to do and what they actually do are not necessarily the same. This prevents the case where, say, they've seized phones but haven't legally compelled the users to unlock them since it means that if an exploit is discovered in the future it won't be usable against any devices which were stolen/seized more than a week earlier.

It would also make it hard to do something like seize a bunch of protesters phones and then attempt to obtain the keys from each person's trusted home computer which would take more time to do at any significant scale.

It's not a huge game changer but it adds a layer of hardening against certain attacks. Given the limited downside, that seems like a good thing.

<comment><USER38> > Think about that from the perspective of a security threat model: what are > the odds that your disgruntled spouse has access to your computer and knows > your laptop password, but doesn't know your phone password?

Well, you might not have a password for your desktop - but might have a pin for your phone.

Or maybe it isn't your spouse, but your kid; they might share the computer - but not access to the phone?

<ed: i don't really disagree, but I also struggle with the 7 days (and not quite in the "perfect is the enemy of good"-sense: >

Either way, I'm not sure I understand how 7 days make sense (seems too long, still).

Seems like either it should be ~14 hours to a day (sync at home every evening) - or it should be: phone has to be unlocked.

</comment></comment></comment></comment></comment></comment><comment><USER40> The obvious flaw in a time-based lockout is that it needs a trusted measurement of the current time.

If law enforcement wants to bypass this, the obvious approach would be to just remove the battery (to remove power from any internal RTC chip) and put the device in a Faraday cage (to block external time signals like GPS and the cell network). Then the shutdown clock would literally stop ticking until they turn it on again.

<comment><USER41> Security isn't all or nothing. If something isn't "perfect", that doesn't mean it's useless. What you just described is a shit-ton of work, which most attackers will not be willing to do (how many police departments have Faraday cages lying around?).

<comment><USER42> >how many police departments have Faraday cages lying around?

Police departments use Faraday bags to isolate the communications of a device once they take it into custody. I assume they do this to prevent RemoteWipe() commands from running from external entities to preserve evidence.

</comment></comment></comment><comment><USER43> Why 7 days? I'd like a feature to never allow any USB communication until I've unlocked my phone, and then to allow it only for as long as they remain continuously connected.

Or to activate this feature with 'Emergency Mode' (5 power button presses).

<comment><USER44> They can't because they deleted the headphone jack. Your earbuds would not function if Lightning was defaulted to off.

<comment><USER45> Not really. They could allow accessory protocols while disabling everything else. The only sensitive thing we care about is "usbmuxd" or whatever the protocol for iOS sync & backup is.

<comment><USER46> That's not true, there's the large attack surface of those other protocols to worry about too.

</comment></comment></comment></comment><comment><USER47> Can someone explain how it is better than android? When I plug in my android, only charging works. I need to unlock the phone and enable data to make the data connection work. There is never trust this computer prompt. I have to do this always, even when due to bad wire the connection is lost for a split second.

Some people mentioned that android never shipped this feature and that Apple is first, but it seems to me that android never had this problem in the first place.

</comment><comment><USER48> There are Kiosk uses of iPads where this could be an issue. Often those devices are mounted 24/7 inside a secure housing and left on but communicate with external devices. Now someone will have to reset them once a week.

Edit: thanks for the clarification below. I had the implementation wrong in my head. And yes, I realize this is a fairly edge use case, just one that affects my industry.

<comment><USER49> If they're left on, they should be fine - it's when the device is locked and idle for 7 days that the port is shut down. Also, I'm not familiar with any Kiosk type implementations that use lightning for data xfer except POS devices, and thos would obviously be unlocked whenever they are in use - <AUTHOR> again, no issue.

</comment></comment><comment><USER50> The time deadline might have some unintended consequences. Maybe law enforcement will proactively image people's phones early knowing it will be harder later. eg you are stopped at the airport. A judge may give give quick search warrants since its "now or never".

</comment><comment><USER51> I'm really not a fan of the hardware design choices of apple devices recently, but the focus on security/privacy might pull me back in.

</comment><comment><USER52> I wish I could just disable the data connection permanently

> Restricted USB Mode requires an iPhone running 11.3 to be unlocked at least > once every 7 days. Otherwise, the Lightning port will lock down to charge > only mode. The iPhone or iPad will still charge, but it will no longer > attempt to establish a data connection. Even the "Trust this computer?" > prompt will not be displayed once the device is connected to the computer

</comment><comment><USER53> I wonder how iOS keeps track of the 7 days in question.

For an iOS device still connected to the internet or to a mobile phone network, I presume it will periodically make an NTP request or get the date/time from the mobile phone carrier, to adjust its clock. What if those requests are MITM'ed?

<comment><USER54> Though that's kind of a good question, GENERALLY speaking you should use "monotonic" timers for this sort of thing which don't have that problem. They're based on a system time which doesn't change.

Of course, that's no guarantee.. this is done wrong in a lot of places all the time. But I would expect Apple to get this sort of basic thing right in their security code. Hopefully :)

</comment></comment><comment><USER55> Is it known how those greykey devices even work? AFAIK iOS blocks many consecutive attempts to enter pin, so brute force would take too much time. It seems that greykey device can bypass this restriction using USB. Why Apple didn't just patch this vulnerability instead of disabling USB?

<comment><USER56> To patch the vulnerability, they need to be aware of the vulnerability. An individual who possessed such a vulnerability would likely be more inclined to go into business for themselves (such as the hackers that helped the FBI crack the San Bernardino iPhone, or the Israeli firm Celebrate) than hand it over to Apple for a one time fee. Although I imagine that Apple would probably pay pretty well for it.

IIRC these sort of vulnerabilities don't totally bypass the phone's lock mechanism, but rather disable the pin code attempt delay and allow bruteforcing of the pin code via software.

<comment><USER57> One time fee? Apple don't pay for such things. Possibly why there is a black market for iOS exploits.

<comment><USER58> The bounty security program (announced at BlackHat 2016) was created to deal with these kinds of scenarios. They will pay depending on the severity of the bug and the affected subsystem.

Of course, now that this mechanism exists, I'm just waiting for Apple to sue GreyKey and Cellebrite out of existence, confiscate all the devices, and charge the founders with aiding industrial espionage or overreach related to pursuing terrorism.

(I'd also like to see the same thing happen with the NRA, but alas that doesn't seem to be in the cards for the current circus in Washington)

The difference between more legit researchers and these guys is that they will work with anybody as long as they cut a check. Real R&D has more scruples than to do that.

<comment><USER59> As much as I dislike this Israeli firm how have they done anything illegal? Hacking a device in your physical possession should not be illegal. Your comment about the NRA makes me think you're just being hyperbolic here?

<comment><USER60> Celebrite is actually the better of those out there, while they do sell their data acquisition terminals to LEO in bulk their "unlock services" are done in person by their staff with a court order for each case (including multiple court orders in some jurisdiction when different datasets on the phone are protected separately by law).

<comment><USER58> It makes me extremely nervous to see that a third party can even create this capability. If I had a say, I would just tell these guys this level of access to low level code just isn't possible for third parties.

As odd as it might be, I trust Apple more because they don't want my data and aren't enabling methods for other people to acquire it.

On aome level, this back and forth on encryption is an endless cat and mouse charade, but the fundamental assumption behind cryptographic security is absolute.

"You can't outlaw math"

<comment><USER59> What are you talking about? You want to make it so that a company like Apple can just draw arbitrary bounds and say "no messing around beyond this point" and have that be internationally, legally, enforced?

We got that with the DMCA and DRM modules, phone unlocking, and console rooting.

<comment><USER58> Companies can write nigh-any clause into their EULA or T&C and people generally have little recourse. There still seems to be enough wiggle room legally because they control the platform. Some places (think EU) fight this, but I don't think it's in any way settled at this point.

They've done this in the past in subtle ways - cautioning developers about using private API, which they reserve the right to change at any time, thus breaking applications. For a practical example, Google "Apple kext signing certificate". It's not simply a matter of paying $99 and off you go, the barrier to entry is higher.

There have also been no-so-subtle warnings - see Charlie Miller's blacklisting - that even a proof of concept for a bug is not allowed because it could get out in the open and cause widespread damage.

> We got that with the DMCA and DRM modules, phone unlocking, and console > rooting.

Record labels had little choice and needed to ditch these restrictions in order to have a viable business. TV studios, cellular providers, and console makers fight to this day to preserve these limits as a means of competitive differentiation.

I'm not saying I agree with it, but that is still largely the reality we have to deal with.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER61> I fear this is really only going to have the reverse effect, instead of carefully examining whether or not 4th Amndment protections apply, "Out of an abundance of caution", courts will immediately seize and decrypt your phone.

Not to nitpick, but I wish these things were opt-in. For instance, I don't really care if I've restarted my mac and have to use my password again to log in, I'd rather use my fingerprint. I just need to prevent casual attackers, there is _literally nothing_ on here that needs to be protected with fort-knox level security.

</comment><comment><USER62> Two ideas:

What about paired hardware? Imagine buying an iPhone and pairing it with your charger and they share keys. Any other charger used would immediately wipe the phone. There could be settings to tweak this.

what about wiping the phone if it has not been logged into a certain amount of time with a certain password (not normal PIN)?

The current crop of phone busters completely bypasses the 10 wrong pin and wipe option. The idea is to immediately wipe the phone without using Find my iPhone (defeated with airplane mode).

<comment><USER63> _What about paired hardware? Imagine buying an iPhone and pairing it with your charger and they share keys. Any other charger used would immediately wipe the phone. There could be settings to tweak this._

Open the phone, plug charger directly to battery.

<comment><USER62> Disable that function.

<comment><USER63> What function? I'm talking about physically opening the hardware and sticking two cables to the battery connections.

</comment></comment></comment></comment><comment><USER64> Can I still kick the device into recovery mode with a cable after 7 days with this mode? Or would I have to unlock the device to re-enable recovery mode?

<comment><USER23> DFU mode is a key combo on the device, so yes, you'd be fine.

</comment></comment><comment><USER65> Say a user drops their phone in a desk drawer and goes on an 8 day hiking trip.

He/she comes back and can't remember their passcode. Is the phone now a brick?

<comment><USER66> I would imagine that "disable USB port" doesn't mean it completely disables the power lanes, only stops responding on the data lanes. So when you come back from your 8 day trip you charge your phone, log in, and theoretically ios would re-enable the USB port once successfully logged in.

<comment><USER67> Not sure why you're being downvoted, you're correct and it's stated in the article that if you unlock with a passcode after 7 days the USB port begins to respond again.

Apple isn't going to design a feature that bricks a device after 7 days. It really simple:

1) No unlock for 7 days = USB turned off.

2) Unlock phone any time after 7 days (lets imagine unlocking at 12 days) and USB turns on.

3) Charging remains active at all times.

Simple.

<comment><USER68> >He/she comes back and can't remember their passcode.

>2) Unlock phone any time after 7 days

?!?

</comment></comment></comment></comment><comment><USER69> To me, it feels like Apple is trying to figure out how GreyKey and Cellebrite are getting in - and patching every vector they can think of in the meantime. I suspect that if law enforcement agencies are suddenly told they have to unlock new Apple devices within 7 days of acquisition, Apple will find out and can infer that the exploits have (e.g.) something to do with USB accessory access.

</comment><comment><USER70> Can a device still be wiped when this happens? I'm wondering how to recycle or recover locked devices if the USB port is disabled...

<comment><USER71> The assumption is that the correct passcode will remove the usb shutoff. If you fail to enter the passcode in the required amount of times, you get a wipe. Many of the law enforcement ways to access these devices rely on the USB port being active to root the phone or reset it in a way that allows faster/more passcode attempts (or by simply letting it sit on a shelf for months or years until a known exploit allows access via usb.

</comment></comment><comment><USER72> Will this cause warrants to be rushed through and much more often? Just to get the phone unlocked in case something is in there, even if there may be no burden of proof. Better to overnight it to a facility with a tool to unlock it and sign off on a quick warrant.

</comment><comment><USER73> Why seven days? How about 24 hours? Or even better if the device is locked I have to unlock it to use the port for anything besides charging (and it can then lock on its usual schedule)

</comment><comment><USER74> This doesn't quite sound as amazing as a first look, because this is not a full "data connectivity" kill. Data connectivity is always required whenever people use headphones due to headphone jack removal.

<comment><USER20> How do we know this feature doesn't also disable the headphones-over-usb if the phone hasn't been unlocked in a week? I don't think that would be a problem for most users either.

<comment><USER75> You can install iOS 11.4 beta and find out one way or the other; it doesn't seem like anyone has done so yet, and since no one thought to do so before today's post, no one will know for 7 days assuming they start today.

</comment></comment></comment><comment><USER76> 403 Forbidden in Germany.

<comment><USER44> [https://webcache.googleusercontent.com/search?q=cache:NNgpuV...](https://webcache.googleusercontent.com/search?q=cache:NNgpuVhqeM8J:https://blog.elcomsoft.com/2018/05/ios-11-4-to- disable-usb-port-after-7-days-what-it-means-for-mobile- forensics/+&cd=1&hl=en&ct=clnk&gl=us)

</comment></comment><comment><USER77> i suspect this will be a net negative. now that law enforcement has a time limit, graybox sales will flourish, and law enforcement will access your phone ASAP before collecting other evidence. then the phone evidence itself will give them the clues they want and they'll get the warrant after the fact. or the court may even be complicit and issue a warrant without enough supporting evidence due to the risk of evidence destruction.

</comment><comment><USER78> Why 7 days though. It's should disable within 2 hours at most, and users should have the option to disable USB when ever the phone is locked.

</comment><comment><USER79> Why 7 days? 24 hours should be enough - who connects devices but doesn't unlock in that time? Can't think of a scenario for that.

</comment><comment><USER80> Like everyone else, I'm curious how you recover your forgotten pass code after 7 days.

Also, what happens if you don't use a passcode?

<comment><USER81> > I'm curious how you recover your forgotten pass code after 7 days

You don't. If you've lost your passcode, you can't get it back.

</comment></comment><comment><USER82> Is there any security reason someone would purchase a security-focused Android phone (Blackphone, Blackberry) over an iPhone?

<comment><USER83> Hardened kernel (e.g Coppherhead OS), custom open-source ROM to disable all telemetry and audit the code (among others), FOSS APK provider (f-droid), disabling online tracking (AdAway, AFWall), full filesystem access. iPhone hardly has any of this.

Note that this is true of any bootloader-unlocked Android phone, not just security-focused ones.

<comment><USER84> Very telling that this is downvoted.

<comment><USER85> In general HN has a strong bias toward Apple over Android RE: security. Many of the points are entirely valid, but it's also true that some important advantages on the Android side (such as those listed above) as often understated or overlooked here.

For me, a closed-source OS is a dealbreaker on its own, regardless of any other major HW or SW advantages.

</comment></comment></comment></comment><comment><USER86> Why not 7 hours or 7 minutes or immediately?

<comment><USER87> Well, why not 7 days?

<comment><USER86> The advantage of a smaller time period is obvious: if 7 days is secure, then 7 hours is more secure.

But presumably there's a good reason they chose that number, I'm just wondering why that might be.

<comment><USER88> It seems a reasonable default, but would be nice if there was a custom setting for a shorter time frame.

</comment></comment></comment></comment><comment><USER89> I'm pretty sure they can just remove the chip and dump the contents.

</comment><comment><USER90> Kind of amazing seeing this story right next to the Google Duplex story.

</comment><comment><USER91> Why should it even be enabled if you're not logged on?

</comment><comment><USER92> this is why I will never use google pixel tho I will still be forced to use gmail, search, and Youtube because of its conveniences, hopefully in the future something new that comes out that has mathematical open source decentralized form of censorship-proof algorithms will come out

</comment><comment><USER93> if the device time is synced from elsewhere maybe one could spoof a ntpd server and provide a time in the past?

<comment><USER94> And/or spoof a cell tower.

If they are careful with their implementation, they could protect against it. The naive way is to store the time of last unlock and simply compare that against the current time, but there are other ways:

(1) Once 7 days elapses, set a flag that can only be cleared by unlocking the device, and check that flag in addition to the time.

(2) If there is an internal hardware clock that isn't synced to real time, just count relative to that clock. You don't need to know absolute time to check how long it has been since last unlock.

<comment><USER39> > (2) If there is an internal hardware clock that isn't synced to real time, > just count relative to that clock.

This is known as a montonic clock and it's been built in to most hardware for exactly this reason. Mach, Linux, etc. have encouraged use for anything where things like leap seconds or time changes aren't desirable.

<comment><USER94> Minor point of clarification, but I meant something slightly different than a monotonic clock, hence why I said hardware clock.

For the approach I described, a clock would need to keep ticking while the system is powered off or in various power-saving modes. And it shouldn't get reset at boot time. Not all monotonic clocks have both these properties. (Obviously iPhone isn't Linux, but one example is that Linux's CLOCK_MONOTONIC seems to lack both properties, and its CLOCK_BOOTTIME seems to lack the second one.)

Though if you have a clock that resets at boot, you can work around that by disabling USB data on bootup and not enabling it until first unlock.

<comment><USER39> On Linux, I believe what you're looking for is CLOCK_MONOTONIC_RAW but that'll also depend on your particular hardware and its security.

On iOS, I'm not sure it matters for the reason you mentioned: at least on my devices I don't see hotplug events until the device has been unlocked once.

</comment></comment></comment></comment></comment><comment><USER95> How is this relevant when law enforcement can buy a $15k device that unlocks the phone?

<comment><USER96> Because "GrayKey" is using USB which won't work if USB is ... turned off.

</comment></comment><comment><USER97> Does this mean that companies will now try to exploit the USB/Lightning driver to gain access?

The cat and mouse game continues.

<comment><USER28> I don't thin there would really be anything to exploit because it sounds like the data lines in the actual usb connection are turned off and only the power lines remain enabled to allow for charging.

<comment><USER97> But they're still disabled at a software level.

<comment><USER98> But how will you influence that said software if there's no way for you to talk to the device? This closes one exploitable avenue after 7 days - <USER2> attackers need to find something else.

</comment></comment></comment></comment><comment><USER99> You could just pull the flash chip and image it. You would need to figure out how to get the key, but pulling the flash chip and reading it doesn't look too hard if you can use a heat gun. If you lived in Shenzhen you could go the market and buy a flash reader.

Strange Parts is youtube channel where the guy does this.

[https://www.youtube.com/watch?v=rHP- OPXK2ig](https://www.youtube.com/watch?v=rHP-OPXK2ig)

<comment><USER100> The PIN or any other user secret can't decrypt the contents of the flash chip. So turning the device off and removing the flash just makes it infinitely more difficult.

<comment><USER99> Why would make it any more difficult? You can just put the chip in place after you are done.

<comment><USER98> I guess because now you have no way of exploiting any bugs that might've been exploitable. Within 7 days the phone will still try to talk to others connected to its port, after 7 days it'll just charge. I assume that "power off" will also disable data over the port until the phone gets unlocked?

</comment></comment></comment></comment><comment><USER71> ...

Every 6 days from point of collection: Place phone in caged room. Turn on your cell phone network interceptor device. Set interceptor's network time to device collection time. boot phone, await for it to update network time from cell interceptor.

...

So many edge cases/ways to defeat this that need to be handled.

<comment><USER101> Type "uptime" in your computer. Change the date. Run "uptime" again and note that it is the appropriate amount of time longer than the first report, even though the date is different.

It's not always useful to assume that engineers will miss even the most obvious workarounds.

</comment></comment><comment><USER102> I would like to read this article but, the website doesn't load. I guess it's not optimized to front page HN.

May I suggest to loadtest your website or article before posting it?

[https://ddostest.me/load-test/](https://ddostest.me/load-test/)</comment>


Show HN: Navalia – Queue and manage headless chrome - <AUTHOR> https://github.com/joelgriffith/navalia <comment><USER3> This is great, starred! I like how you went beyond the usual "render page to png/pdf with CDP" stuff and made evaluate/exists/set screen size methods - <USER2> can see it's made for real use.

This could become a cool replacement for PhantomJS that people would actually use! I answer questions about PhantomJS on SO now and then - there are lots of questions on how to login to a site and download something while in a session, so - here's another idea for real world use: download to local fs method.

Other features people use often:

      * waiting for (an element/set amount of time),
      * event for when a page has (re)loaded, to check if login/submit was successful
      * aborting select network requests - useful for scraping/testing

So, good luck on this project!

</comment><comment><USER4> This looks awesome. I may look better at it later, but would love to see examples of use-cases.

<comment><AUTHOR> Right, so my particular use-case is scraping SPA's for meta since they don't initially have it on load. Because this can be slow (thanks a lot JavaScript), I needed a way to parallelize multiple instances so my app remains snappy. This eventually drove me to write Navalia.

Other ones I can think of: \- Testing (run a series of acceptance tests against a website) \- Screenshots \- Rendering of PDFs \- Web crawling (especially for SPA's)</comment></comment>


Top Node.js Debugging Tips to Debug Like a Pro - <AUTHOR> https://stackify.com/node-js-debugging-tips/ <comment><USER2> I'll just add my favourite debug flag for NodeJS, which I argue should be the default behavior.

        node --trace-warnings main.js

This will show error traces for uncaught exceptions that happened inside promises.

Life saving for me.</comment>


The Facebook Platform Is A Trainwreck - <AUTHOR> http://blorn.com/post/14840036960/the-facebook-platform-is-a-trainwreck-example-871

<comment><USER2> Sometime last fall, Facebook blew away their entire developer wiki. A month or two afterwards was my first experience seriously engaging their platform since early 2008, and many of the tutorials and search results out there on the web still pointed to the smoking remains of the wiki -- which hadn't actually been 404'd, they just lead to Bing searches roughly topically related to what had been there before.

As best I could discover, the rationale was apparently concern over two sets of docs -- their own official docs and a community maintained one.

It's less clear what made them decide a half-assed official effort would be a better plan than combining whatever clearly limited internal resources they were throwing at the problem with a world of developers that is, despite persistent stories of abuse, apparently still interested in working with them.

If nothing else, curating and augmenting a community-led effort would have radiated a considerably smaller degree of contempt for the effort already put into it.

I kindof suspected at the time that decision tells you most of what you need to know about how much FB cares about the experience developers are generally having with their platform, and I have to say, I haven't seen much to convince me otherwise.

<comment><USER3> Which is not just incompetent and unprofessional, but obviously very bad for business.

Does anybody doubt at this point that Facebook is crumbling under its own weight? For all their money and hiring they still have a stagnant application and a trainwreck of a developer platform. Predictable I suppose when you grow too much, too fast. Well, hope they enjoy the ride until the next market disruption at which point, tell MySpace I said hello.

</comment></comment><comment><USER4> Sigh. I feel your pain. They've deleted the Python SDK unanounced from Github two weeks ago. Not really responsible if you consider there were dozens of watchers and possibly at least as many other sites / projects depending on it. (Also that's ignoring the fact that their docs state 90 days warning period :()

 _edit_ Typos, writing on the phone and it's late.

</comment><comment><USER5> Beware building _your_ business on someone else's API. They control it and they likely don't care about you. The API exists to boost _their_ business.

<comment><USER6> Unfortunately, that isn't entirely true. There is a huge amount of value in allowing someone to log into your site with FB credentials. You get their name, age, sex, _validated_ email and a list of their friends all without having to ask a single question and more importantly, not write any code to manage or synchronize that information.

What is incomprehensible is that by offering this authentication system feature on our sites, we are actually _helping_ FB gain more users and thus boost their business. You'd think that it would be treated more as a mutually beneficial ecosystem, but instead is treated like a third party integration that nobody cares about. Especially when there are bugs.

It really is too bad that FB refuses to take advantage of developers and business people out there who are willing to actually help their company grow and are asking nothing in return except for a bit of acknowledgement when things go wrong.

<comment><USER7> Stop imagining you're entitled to any of that information from any user, especially for free.

<comment><USER8> Couldn't agree more. And to the GP, you may think that having Facebook authentication on your site is a benefit to both you and Facebook, but it can also work against you. I for one will NOT use any web services that require Facebook authn.

<comment><USER9> On the other side, I could just say the exact opposite: I find it infinitely easier when a site supports Facebook authentication. You can't just say "it can also work against you" unless you can show evidence that the target audience of the site, on the balance, will be turned away.

I mean, if we come up with more of these, eventually everyone will find at least one ludicrous. "I for one will NOT use any web site that requires"... "a credit card", "watching advertisements", "authentication of any form", or (probably the only reasonable one ;P) "seeing comic sans".

<comment><USER10> Actually he only needs one example to say "it can also work against you", and he _is_ that example.

He didn't say "will", or "probably will" even, just "can".

But using FB to login to other sites seems less handy and more like a way to lose all your accounts when one of them gets hacked, and by concentrating so much value in a single account you increase the likelihood of it being targeted.

<comment><USER9> That is like saying chemotherapy "can work against you" by showing a single skin cell died during the treatment; it isn't "working against you" unless you lose so many skin cells that the chance of killing the cancerous tumor is no longer "worth" the risk.

If you accept "single user got angry" then every single thing you can "can work against you", and the phrase is meaningless: some people hate the color blue, while some other people hate everything /but/ the color blue. Decisions need to be made "on the balance", not because there's one angry user.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I work at Facebook.

We absolutely do care about our API.

We are working as hard as we can to make our API less buggy and more stable.

Over the course of the past year, we have added more tests, more resources and more tools to this problem than we have throughout the lifetime of Facebook Platform.

In addition, we are in the process of reducing the surface area of our platform to a level that allows us to provide a good level of support. Specifically, we are removing FBML (<https://developers.facebook.com/blog/post/568/>), deprecating the REST API (<https://developers.facebook.com/blog/post/616/>), moving to support OAuth 2.0/HTTPs (<https://developers.facebook.com/docs/oauth2-https-migration/>) across the board and deciding what SDKs we are really going to support. These changes are painful for us and developers, but necessary to provide the level of support developers expect.

Ironically, it is the OAuth migration that is responsible for the JavaScript SDK bug reported in the post. We introduced this bug went we added the OAuth code path. This bug is on deck to be fixed soon, however (there is a straightforward workaround in the meantime).

In terms of the source of JavaScript SDK, we are working through the right approach to ensure that developers get access to the non-minified source (which I agree we need to do for debugging). It is unlikely that we will do this via GitHub, but we are looking at just having it off our CDN with the minified version as an option.

As for the bug process, I'll say two things. First, we now have a dedicated team of engineers devoted to supporting developers. If you have been developing on Facebook Platform for a while, the fact that bugs are getting daily responses is a vast improvement. We have a _long_ way to go, but we are listening and fixing. I will note that we are still working through the process on how we respond to various issues and how the bug tool (something we launched this year) works -- this seems to be evidenced from the post and something I am following up on. Second, just because the reporter can repro it, it doesn't mean we can, even with the steps that you provide. Our team of support engineers tries to repro every single issue that gets reported. Often, they simply can't and need more information.

I'll close by saying the following:

1\. We care about our developers and the API.

2\. We have done more this year than we have ever done to help developers and keep the platform stable.

3\. That said, we still have a long way to go and these things do not change overnight.

4\. If anyone has issue with how a bug is getting handled or any other issue with Facebook Platform, you can always ping me on Facebook (www.facebook.com/dmp) or email@example.com.

<comment><USER12> One other option to look at, if you aren't already, is to freeze new feature development and allocate most resources to making the platform solid. You didn't state that in your list above.

You may be correct that you've done a lot to stabilize it during the last year, but how does that compare with the amount of new features you've added over the last year? Maybe Facebook just isn't good at producing bug-free code, and it's time to improve things you do before actually shipping a feature? Continuing to "ship fast, break fast" clearly hasn't worked when it comes to Platform - are you doing anything to fix that?

As an anecdote, Microsoft had a similar problems with Security of their OS - it was a much more severe problem. They took a similar approach to the one you've outlined, for many years - furiously developing new features while scrambling to patch security. However, in the early 2000s (2002?), after a particular severe worm hit computers all over the world, they completely froze all new development on the OS. They did their famous 'security push' where almost every engineer focused on security for many months. They revamped tools and invented technologies to make sure products are more secure out the gate, and the result was a resounding success.

Developer frustration with the Facebook Platform is very real - a competitor with a stable API might actually receive a lot of support from the community. Maybe Facebook needs its own version of Microsoft's 'security push'.

</comment></comment><comment><USER13> The Javascript SDK is atrocious. I was writing a small score submitter for an HTML5 game I made (for testing, mostly), and they clearly don't care about their developers at all as the documentation is completely unorganized. I end up having to _Google_ "site:developers.facebook.com x" just to find a function that fits what I want my app to do. Also, they refuse to update broken links to older pages and like you said, refuse to fix certain bugs that are _clearly_ bugs.

</comment><comment><USER14> Similar issues in dealing with the IOS SDK, ended up removing support for single sign on in my app due to it simply not working part of the time.

<comment><USER15> Having used it in several apps, the iOS SDK is an absolute mess.

Part of this is the absurd complexity of it: there are sign-on flows for going to the Facebook app if installed, or to Safari, or to an in-app web view.

<comment><USER16> Part of this has to do with the complexity of storing cookies in WebKit. The SDK wants to redirect to the FB app if it's installed since that is pretty much guaranteed to have the user's credentials. Safari is next most likely, since it will have the user's session cookie stored. Finally, the in-app web view is the fallback of last resort.

This complexity seems to be an attempt to save the user from entering text in a tiny form to sign in. I don't know that it makes an actual user's life easier, but it certainly doesn't help the developer.

</comment></comment></comment><comment><USER6> It is simply amazing that something that is clearly a bug would be marked as WontFix without so much as a explanation of why.

</comment><comment><USER17> Everyone complains about the poor documentation, but my biggest problem in the last six months has been the drunkenly uneven performance of <https://graph.facebook.com/>.

Our users want their avatars / profile pics, but they don't want 20 second page load times. Band-aiding the resulting UX into something tolerable is a large problem for us.

<comment><USER18> Asynchronous loading is beyond mandatory for anything requiring Facebook avatars. We would use lazy loading, like we do for everything else, except that Facebook is lazy enough for all of us.

</comment></comment><comment><USER19> I am currently working on an app which uses Three20 and I have to say the way it integrates into ios projects is kinda crappy. You have to jump through a lot of hoops to get it to work. They should have made it a simple drag and drop lib/framework like the majority of iOS frameworks or even just have a project template.

</comment><comment><USER20> Perhaps someone feeling either charitable or entrepreneurial could maintain a web service that just wraps the Facebook API, as well as providing bindings for python and whatnot.

<comment><USER21> They'd have to maintain it in perpetuity... this wouldn't be anything a sane person would do out of charity.

<comment><USER20> True. But surely they could charge a minimal subscription fee (say $2,000 a year) that kicks in above a certain usage threshold . Hopefully many companies that use the Facebook platform would find it worth $2,000/yr to save their developers' time and morale.

</comment></comment></comment><comment><USER22> Twitter?

I'm working on Facebook and Twitter and the latter just seems generally nastier (ill documented, ambiguous, not based on a simple graph...). A lot of Facebook the Facebook API is pretty good - well documented, clear and simple. And however bad Oauth 2.0 might be, Oauth 1.1 is worse. Oauth 1.1 is pathologically irrational.

And Facebook is only, ONLY directly responsible for THE API ITSELF. If they've maintained some Java or Python stuff, that's right nice of them but it's not their main job. If you are complaining about particular SDKs offered by Facebook, you aren't complaining about "The Facebook Platform", you're just complaining. When they change the interface (as they've done several times), then complain.

I think the site's motto probably explains things better "Of course it sucks, it's made of software".

<comment><USER13> > If they've maintained some Java or Python stuff, that's right nice of them > but it's not their main job.

Because, you know, nobody programs in languages like Java or Python anymore, am I right? /sarcasm

> If you are complaining about particular SDKs offered by Facebook, you aren't > complaining about "The Facebook Platform", you're just complaining.

Wait, what? Those SDKs _are_ a part of the Facebook platform... we kinda need them to integrate FB into our apps.</comment></comment>


London Startup Events – One Agenda - <AUTHOR> http://beerandpizza.co/ <comment><USER2> I'd be a little cautious about the domain name and the singling out of presence of beer and pizza (over other characteristics of the event). This just reinforces biases within our industry, without mentioning all other perks.

What about people who do not care about beer and pizza but care about London startup events?

What about the actual content of the meetup?

<comment><USER3> I dearly hope they aren't "cautious" about enjoying beer and pizza. It's a perfectly normal thing to have at an event for adults.

</comment></comment><comment><USER4> The RSS feed does not seem to be active, it only shows the hello world post: [http://beerandpizza.co/feed/](http://beerandpizza.co/feed/)

</comment><comment><USER5> These kinds of things are cool but they usually last maybe 4-6 months then fall fallow as no one bothers to update them. The feeds are the worst since there's no UI interaction point - the feed just becomes quieter until people forget about it.

</comment><comment><USER6> Cool! One thing though - pleeeease don't scroll hijack :-(</comment>


Adobe will drop desktop apps to become web only - <AUTHOR> http://today.reuters.com/news/articlenews.aspx?type=technologyNews&storyid=2007-10-18T130541Z_01_N17292526_RTRUKOC_0_US-ADOBE-SERVICES.xml

<comment><USER2> Wow. This is a very bold double-down on Flash and Flex.

This is why Adobe bought Macromedia- They see the future as web-based applications, and they want control the API. Microsoft got to where it was by controlling the API people code in, and the environment applications run. Adobe's showing that they're in a position to control the API for what's next.

This is a _very_ clever move. They're signaling to developers who might be tempted by Silverlight that they are eating their own dogfood on Flex, and betting the farm on their tech.

Given the huge investment that Adobe has in existing desktop applications, the implications of this are huge. Flash/Flex is already a Cross Platform development environment that's installed on 99% of machines.

They're looking to make it a par with Cocoa or .Net in developers minds... And it has a good chance of working.

<comment><USER3> That's great, cuz I'm looking forward to AIR; a single platform that covers all the bases, plus NBL.

</comment></comment><comment><USER4> That's a big task. Photoshop? What about Premiere the video editing software? Do those really make sense as web apps?

Of course it would be neat if they could sell you bursts of processing power from huge servers somewhere. That would be an improvement over desktop versions.

<comment><USER5> Yeah, and what about upload speeds? Are people really going to upload gigs of DV's and .raw's to edit them? My upload speeds on a consumer broadband connection have not dramatically increased in the last 5 years.

To me web app replacements of desktop apps sometimes feel like a camping trip. You can survive just fine, but not comfortably. Esp if your app needs to talk to the GPU, iPhone or other devices...

That said invisible updates and implicit backups are great.

<comment><USER6> You don't get it. AIR solves all of that. It's offline web-based app. You don't have a connection, fine. Do what you need to do but the second you're online, we validate your application and send you live updates.

Imagine a world 10 years from now where everyone bought a fully enclosed computer like you would buy an iPhone now, but you have to pay a monthly subscription service to get updates or to use it. That's why all these companies are making web-os, thinking that's the way of the future. It's going to be horrible.

<comment><USER7> There's always going to be free services, don't worry. I'm sure the open source crowd won't stay far behind, they're able to innovate far faster.

<comment><USER8> Except the open source model doesn't support SaaS very well, so if all software becomes SaaS then open source becomes much less relevant.

<comment><USER9> I'm sure RMS is thinking of yet another software license to take care of this.

</comment></comment></comment></comment></comment></comment><comment><USER10> I believe this will be a new way to force upgrade consumers, instead of buying software and running it for years now you will be forced to pay monthly and over the long run pay more and if you unsubscribe it won't work at all.

</comment><comment><USER11> I think a lot of future apps will not be web-only nor desktop-only but an hybrid: Desktop apps using the Internet for collaboration and as a source of information.

Like Google Earth but developed with portability in mind.

<comment><AUTHOR> This is where Adobe AIR and MSFT Siverlight come in

</comment></comment><comment><USER12> I think there are two different questions. One is how we're going to pay for software and the other is how software is going to be made available and kept up to date technically. Regarding the latter, it doesn't look like there will be that binary choice between web and desktop for 10 more years so I'm not sure what exactly Adobe is going to drop. Local storage? Access to USB devices? I don't think so. It will become a matter of interpretation by marketing folks whether a particular application is called a web app or a desktop app. I mean that's what AIR is all about, isn't it?

</comment><comment><USER13> Great, so my TCP/IP drops while I'm editing my wedding video and I have to wait for it to go back up.

"Broadband, as quick as it gets, is still going to have some limitations in the short term,"

Which indicates they're gambling (heavily) on broadband speeds going through the roof, so those gigs take a minute to upload.

Further, it says people aren't paying $400 for an application anymore.

In other words, they're going to see a heavy revenue hit soon, a revenue timebomb, and I see their stock price halving.

I don't own any stock, etc, etc disclaimers.

<comment><USER6> Let's see... $19.99 a month indefinitely or $400 a pop. SAAS is going to be everyone's new wet dream.

<comment><USER13> My point is basically the same - that the people who don't pay $400 won't want to pay $19.99 a month either.

</comment></comment></comment><comment><USER14> What about people who don't have (never have had, and never will have) their computer hooked up to the net? They are screwed...

Some people keep their computers off the net for security reasons. My father keeps one of his off the net so that he doesn't have to worry so much about viruses.

And no, he doesn't want to use Linux... And even if he did, ProTools isn't available for Linux.

Note: to be fair, he doesn't (to my knowledge) use Adobe programs on his studio computer.

</comment><comment><USER15> Bruce Chizen is the CEO so I was curious to see if they have the technology to do this. Then I remembered AIR ~ [http://computerworld.co.nz/news.nsf/devt/FE2043E499460693CC2...](http://computerworld.co.nz/news.nsf/devt/FE2043E499460693CC257367007C9285)

 _"... AIR is a runtime program that allows developers to create cross- platform desktop applications with the same technologies they use for building web-based applications, such as HTML, AJAX and Flash. At the Adobe MAX 2007 user conference in Chicago on Monday, executives confirmed AIR's importance to the company's long-term strategy ..."_

So it is technically possible, How will it effect the bottom line? Who knows. Many companies have stumbled when changing programming paradigms ~ <http://en.wikipedia.org/wiki/Programming_paradigm>

</comment><comment><USER16> Should help with piracy problems also.

</comment><comment><USER6> Another company made similar comments some time ago. Some also-ran called Sun with something called Java VM. But I guess it's different this time. Obviously AIR is soooo much better.

<comment><USER17> AIR is for the desktop. Why would you expect Adobe to use it to deploy their web applications? It is no where near powerful enough to take on the tasks of the Creative Suite either.

"Adobe AIR lets developers use their existing web development skills in HTML, AJAX, Flash and Flex to build and deploy rich Internet applications to the desktop."

<http://labs.adobe.com/technologies/air/>

</comment></comment><comment><USER18> Validation.

<http://www.paulgraham.com/road.html>

<http://www.paulgraham.com/microsoft.html>

<comment><USER19> Never saw that "The Other Road Ahead" essay before, thanks for the link. He proposed a web service quasi-operating system for people uncomfortable with normal computers in that essay and I applied to YC with that idea.

</comment></comment><comment><USER20> This kind of thing will never happen -- successfully(!) -- the general trust level in the web is declining continuously...</comment>


Julia vs. Python: Which programming language will rule machine learning in 2019? - <AUTHOR> https://www.techrepublic.com/article/julia-vs-python-which-programming-language-will-rule-machine-learning-in-2019/ <comment><USER2> Does it have be these two languages only?

I'm from dotnet background and would love to learn ML? Is there any thing apart from azure services?

</comment><comment><USER3> You can peel my zero-based arrays from my cold, dead hands.</comment>


Beginners' Guide to Solidity Development [video] - <AUTHOR> https://www.youtube.com/watch?v=gt3pJIqT4gM <comment><USER2> Kindof misleading title. This is about writing etherium contracts.

<comment><USER3> What else would you use solidity for?</comment></comment>


What does HN think of the show Shark Tank? - <AUTHOR> http://beta.abc.go.com/shows/shark-tank/

<comment><USER2> I like seeing what projects on which people are working, but the investors are ridiculous. There's no amount of diligence presented, they never justify the valuations they pull out of the air, they always seem to want to own 51%, and they act like they are the only way that one of the entrepreneurs is going to make it. It feels almost predatory on the poor entrepreneurs they bring in front of the panel.

Of course, I have it on my DVR and can't not watch it. Someone said it was like a car wreck - more like a blimp accident.

</comment><comment><USER3> It's a ridiculous caricature of what investor-entrepreneur relations are like.

I find the show vaguely nauseating. But even if you enjoy watching, realize that it's an entertainment gimmick, nothing more. I doubt many of the "deals" are ever transacted.

<comment><USER4> Yeah, I get it's injected with lots of drama. It's a TV show, so that should be expected really. I doubt an hour of real-world entrepreneur/VC pitching/negotiations would appeal to the masses, other than us, of course.

However, I really do like the show. I'm a fan of the British version - Dragon's Den. Yeah, the stacks of money on the tables are a bit much, but I actually find a lot of the ideas being pitched quite interesting, as well as the questions the VCs do ask. They seem to be pretty quick to shoot down stupid ideas, and do try to find flaws, so although it is a dramatization, I don't think it's a gross misrepresentation of how any VC would view a particular idea.

<comment><USER5> I agree. I'm glad they don't hesitate to let people know they're on the wrong track. On one episode, they mentioned that these people have probably never had anyone among their friends and family tell them its a bad idea. For a lot of these ideas, these people really needed a reality check.

</comment></comment></comment><comment><USER6> Dragon's Den is a much better show. You can watch the Canadian version online (which also features Kevin O'Leary and Robert Herjavec):

<http://www.cbc.ca/dragonsden/>

<comment><USER7> I'm glad to see others have seen Dragon's Den. There's also the BBC version. There are lots of clips and episodes on Google Video: [http://video.google.com/videosearch?q=dragons+den+series+1&#...
Shark's Tank falls short because it doesn't have the same kind of dialog as either the BBC or CBC dragon's den. The depth of analysis the dragons go into is great and can really help entrepreneurs understand how to get into a good business.
There was a CBC episode or two where some software products were shown and one of the dragons had a background in software and he loved the idea just for being software. I don't remember anything special about the particular product, but 100% margins were the topic of conversation.

</comment></comment><comment><USER8> I think "Dragon's Den" is a better name. (the Canadian version)

I think it can be a great deal because you get to broadcast your pitch on primetime TV for free - I probably wouldn't go on it for the money, though.

<comment><USER5> It's not free. ABC has an option to take 2% of your company, even if you don't strike an investment deal.

<comment><USER9> By pg's equity equation, airing your pitch on national television would have to increase your valuation by marginally over 2% (2.04% or so) to make that deal worth it. I'd take it.

</comment></comment></comment><comment><USER10> Its a good show. Its funny to see people with really odd ideas like the "Ionic Ear".

It also made me realize how good a deal YC is.

</comment><comment><USER11> Well I guess abc does not care what I think because they have decided not to allow Linux users to download episodes.

<comment><USER12> It's also on Hulu. Linux flash support is pretty bad, but at least it's available.

</comment></comment><comment><USER13> Complete and utter shit. Entertaining, but it smears both entrepreneurs and VCs/angels, with insulting offers and dramatized acting.

Dragon's Den isn't much better, either. It just has worse startups.

</comment><comment><USER14> Based on the one-ish episode I've seen... there are some interesting bits, but also a lot of absurdity. Both the valuations proposed by the business owners and the ownership-percentages proposed by the "sharks" seem surprisingly high.

I suspect a lot of these deals could go quite a bit better on an order of magnitude lower scale.

</comment><comment><USER15> It's on Hulu, [http://www.hulu.com/watch/88498/shark-tank-series- premiere#s...](http://www.hulu.com/watch/88498/shark-tank-series- premiere#s-p1-so-i0)

</comment><comment><USER16> I get a kick out of refreshing ideas but it feels like a horse kicked me when I see these people who have no idea of what their underlying expenses and scale are like.

</comment><comment><USER15> Seems like all of the offers that are made are for greater than 50% of the business. Doesn't that mean they are basically buying controlling interests?

</comment><comment><AUTHOR> I'm completely sucked into this show, but I have an uneasy feeling about putting young entrepreneur in front of extremely experienced VC's.</comment>


Ask HN: Interbrowser Communication without going through Server - <AUTHOR>

Is there a library that does communication in javascript between browsers without having to go through a central server?  All I could find was this: http://www.w3.org/TR/webrtc/ <comment><AUTHOR> So far, I've found these links:

[http://stackoverflow.com/questions/15529106/webrtc-howto- pee...](http://stackoverflow.com/questions/15529106/webrtc-howto- peerconnection-via-lan-with-2-browsers)

<http://www.leggetter.co.uk/real-time-web-technologies-guide>

But nothing without going through a central server.</comment>


Haskell : polymorphism at value level, not method parameter level - <AUTHOR> http://chrisdone.com/posts/2011-10-16-value-polymorphism.html

<comment><USER2> I haven't done much Haskell programming, but this feels a little dirty to me. Can other Haskell coders chime in and tell me if this is good practice? It does seem cool to have functions return different values depending on what you ask for, but especially as a parser it seems like it would be fragile.

<comment><USER3> There's not really a line between parameters and values in Haskell. Static values can just be thought of as constant, zero-arity functions. The heart of this is, to me, more generally thought of as polymorphism on the return type.

Read is a great example of this working very well. It's, as you say, not really robust enough to work at the API or program level, but Show/Read provides a pretty quick, everywhere available serialization for many values. It's vital for debugging at the REPL.

Probably the most notorious example is the newbie-killer Regex library which uses polymorphic return types to dispatch what kind of result you want from your match, such as the match index or a list of group matches. It seems really clever since you just call the match function and affect whatever kind of pattern matching you want in order to pull values out, but it has always smelled to me since it's very hard to discover the functionality — the polymorphic return types aren't opaque, but are burdensome — and seems quite a bit too magical.

So I wouldn't personally go wild with return type polymorphism. It's obviously necessary in order to write things like filter, but unless the return type is simple and easily inferred by both compilers and people it can get hairy fast.

<comment><USER4> Thinking of values as functions is more misleading than it is illuminating. There are values that are functions, and there are values that are not, and the type system is extremely clear about which are which. It's just that all values can be polymorphic, including functions.

Conal Elliott has a good blog post about it. [http://conal.net/blog/posts/everything-is-a-function-in- hask...](http://conal.net/blog/posts/everything-is-a-function-in-haskell)

<comment><USER3> True. It's most accurate to think of functions as values which are of the type (a -> b) "mappings".

But really it's all confusion deriving from the fact that functions in Haskell mean something completely different from other languages.</comment></comment></comment></comment>


Still exist universities that there are even machine coding lessons? - <AUTHOR> [quote=http://archive-org.com/page/3491382/2014-01-08/http://forums.freebsd.org/viewtopic.php?f=34&t=42856]<p>"In my university there are still assembly lessons. I love assembly. In some other universities there are even binary coding lessons."[/quote]<p>Still exist universities that there are even machine coding lessons? <comment><USER2> My university included it (3 years ago), but only a little. It is part of understanding how a computer works, so it should be included, but the skill is not in demand enough to spend a lot of time on it.

<comment><USER3> One nice thing about the re-rise of mainstream embedded systems is that they're a great way to introduce low-level programming.

(I call it "re-rise" because small boards were all over the place when I was in school 25-30 yr ago.)

</comment></comment><comment><USER3> Yes, but they're in the minority.

<comment><AUTHOR> What are they?</comment></comment>


Auto X Prize throws water on GM's 230 mpg claim, offers mpge calculator - <AUTHOR> http://green.autoblog.com/2009/08/21/auto-x-prize-throws-water-on-gms-230-mpg-claim-offers-mpge-cal/

<comment><USER2> While I'll bet this calculation is intuitive to most of the HN readership, I'll also bet that it's completely inscrutable to the general public.

The driving public is attuned to MPG, and there's clearly a lot at stake in manipulating any new standard to reflect the proprietary interests of car companies, oil companies, environmentalists, battery makers, and everyone else out there seeking to cash in on the hybrid gold rush.

I'm hoping that the government will step in and create a neutral, science- based standard like this one. Hoping.

</comment><comment><USER3> Finally.. miles per GGE isn't a new concept, especially for those of us who've had alternative fuel vehicles for years.</comment>


Life is All About Supply and Demand - <AUTHOR> http://jamesaltucher.com/2010/11/life-is-all-about-supply-and-demand/ <comment><USER2> Very true. Most people need social proof before they do a lot of things, except, of course, those with deep understanding and experience in the particular arena. I like the number 30 of prospects needed to make one deal. Its not astronomical but communicates that you've got to be building a pipeline to your front door.</comment>


Ask HN: Best project management app geared towards developers - <AUTHOR> My startup is looking to integrate what we're building with a project management app geared towards developers. In particular we'd like to know which ones are popular among startups.
What project management app does your team use?
As always, your feedback is very much appreciated! <comment><USER2> We use Asana. I prefer it over other things I've used such as Pivotal Tracker and Jira.

From my experience, Jira is geared at large silo-ed companies, where you need to spend time defining processes. It's very inorganic.

I liked Pivotal Tracker, but the whole agile thing proved to be a bit too inflexible at the startup I founded with some friends. It did work well at a larger startup of about 30-40 people, where a bit of process rigidity was kind of useful. It would be interesting if I had Asana available to have tried at that company.

Jira was used at the first tech company I worked at. Waaaaay too process focused. Detracted from those who actually do work. That being said, I can see how it would be an asset at a large company with A people to C people and high turnover.

These days I'm mulling a "pull request" based approach for certain types of programming tasks and everything else in Asana.

<comment><USER3> We used ASANA for several months and it turned out that it god better by the time, it's still not efficient collaboration and the emails send out, kill a lot of useful time.

-1 for ASANA from an early adopter.

<comment><USER2> You can turn off the emails if they don't work for you. I find that the emails make sure stuff gets checked and handled in a timely manner. Most other tools require self-discipline from the rest of the team. They need to check whatever tool to keep on top of things. Most tools that don't have a "pull" approach have a higher chance of failing to be adopted.

</comment></comment></comment><comment><USER4> Trello.com is good to track "todo -> in progress -> to test -> to deploy" kind of workflows.

<comment><USER5> "Works on all devices

Trello works on everything! It's web based and made to go mobile if you need to. Nothing to install. Nothing to update."

Not true, iPad safari looks like sh*t.

<comment><USER3> I agree, it's not an optimal experience on all devices and having a standalone solution instead of an SaaS hosted one is a lot better, but FogCreek Software builds awesome products admittedly. That's why I also recommend trying it.

<comment><USER5> SaaS can be awesome. Unfortunately this isn't a matter of optimal, it's just unusable. I hope they take notice.

</comment></comment></comment></comment><comment><USER3> Hi dlf!

Please take a look at software developed by <http://www.fogcreek.com/>

Kiln, Trello and FogBugz are a good trio. Checkout <http://www.fogcreek.com/kiln/> for example.

<comment><AUTHOR> Yeah, I've seen it. It looks like a nice suite. Are you part of Fog Creek?

</comment></comment><comment><USER6> While I am not part of a company/startup, I have started to use Asana.com for personal projects. So far I really enjoy using it.

<comment><USER4> I see Asana's name popping up more and more often. What do you specifically like about Asana?

<comment><USER6> The first time I logged in, I felt like I have been using it for a while since I had no problems using it.

It also helps that the team at Asana keeps improving it. They recently launched a calendar feature which I now have connected to my Google calendar.

</comment></comment></comment><comment><USER7> I found Podio to be pretty good. You can manage several projects. you can download templates or roll your own.

</comment><comment><USER8> Jira. Hands down.</comment>


Feds go overboard in prosecuting information activist (2012) - <AUTHOR> http://arstechnica.com/tech-policy/2012/09/feds-go-overboard-in-prosecuting-information-activist/

<comment><USER2> It's nice that we're all upset and making a fuss about the conditions leading to Aaron Schwartz's demise (both the mental health one, and the US Gov. Judiciary one). But the truth of the matter is that most of us have followed these issues in the news, and failed to even attempt to do anything (even trivial action) with respect to situations like this one; which are obviously absurd, especially including Aaron Schwartz's. We're all far too complacent, and cowardly; and if we can't manage to sort this kind of crap out, we probably don't deserve the company of people like him.

</comment><comment><USER3> People go overboard punishing other people. Nobody wants to fix things. The copyright system is broken. Nobody in power wants to fix it. Lincoln had civil rights, Mr. Obama, please help fix this mess.

<comment><USER4> "Obama" aka Barry Soetoro aka Harrison J Bounel will not fix things. And he probably won't read your comment.. the best way to get things fixed is by trying to fix them yourself.

Talk to people, call your local congressman. Dicsuss these things with other intellectuals and let's all come to a solution which we can implement. Why are we waiting for the president to do something? He is not our Great Leader Führer.

I really wish people would stop acting like Obama is going to do anything different. He had 4 years, going into 5, still nothing has changed. If anything copyright infringement attacks are higher than ever. Unfortunately it's up to us if we want these problems fixed.

<comment><USER5> Perpetuating right-wing conspiracy-nut theories ("aka Barry Soetoro...") is unbecoming. If it was a joke, it was in poor taste.

Other than that, I agree with your comment.

I'll leave this link here for anybody else who was wondering, as I was, what the hell this "aka" nonsense is. [http://www.bnd.com/2012/09/22/2334245/was- barack-obama-ever-...](http://www.bnd.com/2012/09/22/2334245/was-barack-obama- ever-barry-soetoro.html)

<comment><USER4> Nice right-left divide mentality, and your use of the conspiracy-lunatic- fringe-nutjob-retard slang is very annoying. I am not right or left wing.

Fact is Barack Obama is using a fraudulent Social Security Number(042-68-4425) which belongs to a dead man named Jean Paul Ludwig. 042 is the Connecticut SSN prefix - Barack Obama never lived in CT and did not register for a number in CT.

This has nothing to do with democrats or republicans. Conspiracy to commit fraud is a REAL OFFENSE. People go to federal prison for offenses like these. I do not appreciate being scoffed and laughed away based on the "conspiracy nutter" mentality.

I guess you can do the research yourself:

Illegal SSN 042-68-4425 registered to a man Harrison J Bounel is tied into Obama's old house in Chicago. Here are some links:

[http://www.examiner.com/article/supreme-court-to-hear- case-o...](http://www.examiner.com/article/supreme-court-to-hear-case-on- obama-s-alleged-forged-documents)

<http://www.freerepublic.com/focus/f-news/2766707/posts>

<comment><USER6> So you're saying that 042-68-4425 belongs to Jean Paul Ludwig, and Harrison J Bounel, and Obama.

And despite how trivial it would be to verify all of this, he's been elected president twice?

I have to call bullshit.

He's obviously a reptilian.

<comment><USER4> I'm saying 042-68-4425 belonged to Jean Paul Ludwig, but when he died it was illegally forged under Obama's alias "Harrison J Bounel".

Harrison J Bounel and Obama are the same person. He has been elected twice because the current power structure supports this sort of criminal behavior. All these elected officials have skeletons in the closet so nobody is going to go against one of their own.

Believe whatever you want, I am not really interested in debating with hacker news readers. The truth will come out anyways. And Barry Obama has committed plenty of other felonies such as ordering the murder of a 16 year old American citizen overseas through drone strike [http://www.businessinsider.com/alwaki- son-yemen-16-drone-201...](http://www.businessinsider.com/alwaki-son- yemen-16-drone-2012-10)

<comment><USER7> You're a right-wing nut and/or a racist. Period. You're getting called out because you're following the same lineage that all conspiracy nuts do. Conspiracy is just another religion. You talk of how everyone doesn't "get it", get information from the likes of Alex Jones or Glenn Beck (sites literally drowning in banner ads), but deny so many counter points. And yet, Bush, who ACTUALLY violated the law and should have been impeached? Meh, who cares about him! He's on our side! Please.

<comment><USER4> No I do not watch AJ or Beck. I get information from websites and do my own research. I am not a racist, have I brought up race at all? You are a fucking racist. Race has nothing to do with this.

And Bush, Cheney, Rumsfeld, every one of these fuckers should be indicted for treason. Unfortunately they are not in command anymore - Obama is. So he needs to be held accountable.

Thanks for the right-left and nutter comments again. You say people who believe in conspiracies are like religious fanatics? How about people who adamantly shun every single conspiracy without giving any research at all.

<comment><USER7> Which sites do you get this information from? So far, you've done nothing to illustrate your point with anything other than 1 untrusted source. That's why it remains a conspiracy theory and not accepted fact.

Conspiracy nuts like to frame the media/government as corrupt yet you provide "proof" in the way I would expect a corrupted government would diseminate propaganda.

When you can get your shit together and provide some actual proof, not embarrass yourself by calling the president "Barry", then you'll get some respect. I'm not against the idea of conspiracy, but we'll never know when it's time to pay attention when your ilk goes around calling the president a crypto Muslim named Barry.

<comment><USER8> Alex Jones followers denying following Alex Jones while in public is a fairly common phenomenon in my experience. My money is on Alex Jones even if he claims otherwise.

<comment><USER7> It's Alex Jones. He'll say no because then we'll be able to confirm he's a loon. Long before Piers Morgan and the Illuminati, Alex Jones was reporting on religion being a form of mind control, Christians as the NWO and ritual child sacrifices. I actually remember reading something on his site circa 2001, where he made claim that the 2nd amendment was created for advancement of a new world order...today? Opposite story.

None of the loons that follow him like to hear about how divergent he is from what they hold true today.

Godlike Productions is about as close to fact as Alex Jones. Just a bunch of nuts beaking off fear-based nonsense. None of these references are based on reporting. :(</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>