Ask HN: What is going on? - <AUTHOR> Bad day and ranting a bit, sorry. Just reached a very strange WTF moment. I'll be submitting my notice at work on Tuesday (it's a holiday on Monday). I'm no rock star programmer, I just hit my tolerance limits for ignoring problems on the purely professional front.
Then, later today I went for a drink with a colleague,  only to find he's a holocaust denier, Hitler was only trying to do the right thing etc. I found I couldn't mount any argument against his views - I had been indoctrinated etc, etc.
And then I come home and have a chat with my normally right-on room-mate, and somehow we get onto vaccinations,  and she's considering not vaccinations her (future) kids on the basis her cousin hasn't vaccinated here and they're ok. And she is deeply suspicious of vaccinations in the face of decades of evidence supporting them. She left the room. I had tried to explain the basis of vaccinations, herd effect etc but just upset her (though calling her potentially negligent really did not help).
It's a day where no amount of attempts at explanations are sticking.  On the professional front, oddly enough,  I'm more accepting of that.  But facts and history that I hold more dear are just getting eroded.  Is there a way to convince and persuade without alienating people? <comment><USER3> Once you start lying, you lose your credibility -- even when you are telling the truth.

More and more people are coming to believe society -- "the state", doctors, bankers, etc. -- has lied to them.

The thing is, they're not wrong. Just look at the "outsourcing/off-shoring's good; we'll all become managers/bankers/lawyers/professionals" statements from the '90's. (Here in the U.S.) Rescinding Glass-Steagall. (And don't forget the Clinton administration's part in that) "Iraq has weapons of mass destruction." Eat margarine (trans-fats), not butter. Bullies only hurt themselves... Oh, and lately, "We'll only use these surveillance powers under extra-ordinary circumstances. For terrorism. On foreigners. Well, unless they're talking to someone from the U.S. Or we make a "mistake". Or we buy it from a third party. Or we use a Stingray, that we definitely don't want to tell you about. Parallel construction...

Authority is shifting its base, in many places, from credibility to power.

Making the incredible credible. Fostering a more base human nature.

The conspiracy theorists may be wrong about some things. But the authority figures telling them this, have lost a lot of their credibility.

This is the real cost of the lies we're facing, from our "leadership" \-- political, economic, even scientific. (How many discredited studies, advisories, medications, herbicides, pesticides, commercial processes...? And not just discredited, but these results hidden as much and as long as possible, for personal profit.)

How do I deal with this, in my personal life? I try to be as truthful as possible.

Of course, my life experience with this puts me in mind of that song from Depeche Mode:

[https://www.azlyrics.com/lyrics/depechemode/policyoftruth.ht...](https://www.azlyrics.com/lyrics/depechemode/policyoftruth.html)

But, the people I end up valuing, seem to value the truth I have -- warts and all.

<comment><USER4> The Holocaust deniers and antivaxers are, in fact, wrong. There's no "may" about it.

</comment></comment><comment><USER5> Majority of people attach themselves to a viewpoint based on either emotions or because someone they trust and respect told them so. And once they do, they can't separate themselves from their views. If you try to attack their beliefs, they take it as affront to themselves. When that happens, no amounts of facts will change their mind. Instead they will just shut you out and their beliefs will now be more firm.

I would love to tell you an alternative approach, but I don't know of any.

I have just given up. I just nod and say ok or change the topic. It's not my job to change people's minds.

<comment><USER6> My only technique is to calmly ask them questions based on their beliefs. I also don't really set out to change minds, but occasionally it can be amusing to watch people walk you through the goofy logic of their fringe beliefs.

</comment></comment><comment><USER7> Once a friend went on a moon landing denial rant. I immediately started an ironic spherical earth denial rant, copying every argument he was using. Problem solved.

<comment><USER8> I had a really bright student in one of my classes past year who was a moon landing denialist. She said her best friend, who was a student at Berkeley, had convinced her and was also a flat earther. I was shocked, until I learned that they'd been indoctrinated via r/conspiracy and YouTube. Now I see that stuff as a subset of the problems with social media in general - <USER2> distrust of the media and expert knowledge combined with the creation of insular online communities that can lead into a new kind of groupthink.

<comment><USER7> Deep in my heart I still believe that the flat earth society is a massive joke on conspiracies, and one day they will come out and say "ha!!! you thought we were serious? super-gotcha!!!".

<comment><USER9> I think they already did when they stated that there were flat Earth believers all around the globe.

</comment></comment></comment></comment><comment><USER10> Yes, sometimes explanations and reasonable arguments can just derail conversations completely. For preventing that, I find David Burns' disarming technique[0] really useful. It is about "finding truth in what the other person is saying, even if it seems blatantly wrong, or illogical, or exaggerated." His podcast is amazing.

Perhaps part of what your room mate is saying is that she is concerned about the well-being of her (future) children? Surely that's truly good. She's also interested in avoiding certain medical treatments that are excessive or unnecessary, which is also good.

Don't know about the Holocaust-denying colleague, but sometimes xenophones have a fear of losing their job to someone else, which could leave them unable to economically support themselves or their family, and maybe they really enjoy the job they have. If your colleague talks about you being indoctrinated, then he must have a high regard of the truth (which is good), and if he's interested in how indoctrination works, he may even be interested in reading about Chomsky's propaganda model[1].

Of course, this disarming stuff is only useful if you actually want to prevent conflict with other people, and it's totally legitimate to have a conflict with anti-vaxers and Holocaust deniers. But also, you live and work together, and constant conflicts may not get you nor them anywhere but down.

Also, Last Week Tonight has quite a good episode on vaccines[2] (but showing that to your roomie might not calm things down).

WTF indeed, though.

[0]: [https://feelinggood.com/2017/12/11/066-five-secrets- training...](https://feelinggood.com/2017/12/11/066-five-secrets-training-the- disarming-technique/)

[1]: [https://www.youtube.com/watch?v=7VG_s2PCH_c](https://www.youtube.com/watch?v=7VG_s2PCH_c)

[2]: [https://chomsky.info/consent01/](https://chomsky.info/consent01/)

<comment><AUTHOR> Thank you. I'll check out those links.

Long day, so will sleep on it before doing so.

Quite saddened by the day though.

</comment></comment><comment><USER11> Billions of people truly believe in the existence of a super-natural creature up in the sky. Some devoting time, energy and tons of money.

Not something that should surprise given the scale.

<comment><USER4> This is a facile and offensive argument. Non-atheists are not the intellectual equivalent of Holocaust deniers or antivax advocates. All you're doing is inviting religious flamewar, which is not allowed on HN.

<comment><USER11> Apologies if it was perceived this way. But I don't see how my comment link non-atheists with Holocaust deniers? My point is: Some people are going to believe things which are wrong (from your perspective) and that can happen at large scales. There are extremes (like flat earth) or socially-emotionally driven (like religious believes).

I say give anyone the freedom to have any opinion as long as he doesn't incite violence or act on it.

For antivax it is really a complicated one. I don't have a problem with antivax advocates but I have a problem with parents that don't vaccinate their kids. And I think the government should act on the best interest of its minor citizens.

<comment><USER4> I'm sorry I misinterpreted you. My reaction to Holocaust deniers and, come to think of it, to antivaxxers is visceral, and I saw an equivalence argument that wasn't really being made. I'll work on being less jumpy!

</comment></comment></comment></comment><comment><USER12> You can only convince people that are open to being convinced. Usually I've seen this take some sort of harsh real-world personal experience that contradicts their existing world-view.

Personal example: I used to strongly defend Obamacare, and would dismiss any arguments against it as trolling. Until I had to sign up with Covered California, deal with the buggy website, wait on hold for hours, then deal with higher deductibles and miscellaneous bureaucracy. Then I realized the detractors had a point and basically switched sides.

Lastly, do you _have_ to persuade someone to take your point of view? Are you able to be friends with them otherwise? If so, continue to be their friend and wait until an event happens that leads them to question their beliefs. Then subtly drop hints...remember, nobody likes to be told they're "wrong".

<comment><USER5> > Then I realized the detractors had a point and basically switched sides.

Just curious: you switched sides based on buggy website and "bureaucracy"? Did the fact that ACA disallowed insurance companies from denying coverage because of pre existing conditions or gap between coverage, got rid of insane life time max limit of $1 million and brought millions of more Americans under insurance coverage mean nothing to you?

<comment><USER12> And what good is "insurance" if you can't see your new doctor due to such bureaucracy, or keep your previous doctor as promised?

Health insurance is not same as health care. Remember that.

</comment></comment></comment><comment><USER13> Something the skeptical community talks about when dealing with conspiracy theories is that it's not enough to counter arguments and correct factual claims. You need to give them an entirely different narrative. They've bought into an entire narrative, a particular view of how everything works. THey're not going to let go of that if they can't replace it with something else.

</comment><comment><USER14> Consider that you're probably just in a bad state of mind. You shouldn't quit your job or write these people off while you're in a bad place mentally.

When you're feeling better, you may find that your friend was just exploring his dangerous thoughts in private with you, and your roommate is just ignorant and/or nervous about vaccines.

You should probably just relax and focus on getting some strenuous exercise, good sleep, healthy food until you feel better.

</comment><comment><USER15> I feel your pain but unfortunately I have no answers. There are people with these insane opinions and they are spreading.

Two decades ago a school had a live debate between a teacher and a student Holocaust denier. The teacher thoroughly demolished the students arguments which made him look like a complete fool. Today the student (Björn Björkqvist) is the leader of one of the largest Nazi groups and the teacher severely regrets ever debating with him.

<comment><USER16> Sorry it's not clear but why does the teacher regret debating him?

<comment><USER17> I imagine it's because the teacher thought that destroying that person in a debate with facts would change their opinion, but came to realize some people just aren't worth the time or effort because they will never change their opinions no matter how many facts you throw at them.

</comment></comment></comment><comment><USER18> How are you? Are you okay? Do you need someone to talk to? My email is in my profile.

I used to have this neighbour. The first time I met him, I thought he was going to become a good friend. We talked for hours and I thought this cat was alright.

The next time we talked, it turned out that he was a fucking anti-vaccer. Not a word of a lie, he said "Do you notice there are more kids with problems, you know, retards now?" He even put air quotes around 'retards'. In his cute little worldview, that's all because of vaccines. Fuck! I lost another friend.

Or, there was this dude I worked with. I thought he was just about the coolest person I'd ever met. He was so smart, he had amazing taste in music, he had a great sense of humour and he even liked soccer. I thought I'd made a friend for life.

It turns out that he takes freedom of expression literally and doesn't believe in hate speech laws. In his mind, advocating for genocide against the poor or mentally ill is totally fine.

This might be the most real thing I will ever write, but people will disappoint you constantly. Some of the most amazing people will be nazis. Other people won't believe in the scientific method. And still others will do stupid fucking shit that will make your job suck.

Find people who you love and let them love you back. Be fiercely loyal to those people because there won't be many of them.

And, when you meet fuckstains who believe in stupid shit, you likely can't convince them. Or, you likely could though you don't want to. A vast part of their identity relies upon this stupid shit. If you pierce the veil, you'll have to put their shit back together. That's a fate worse than knowing anti- vaccers and nazis.

<comment><USER19> I've never expected anything from anybody. Even the people I love; parents, girlfriend, friends... all have flaws in their thoughts or opinions, just like me.

Pick the best of each people and enjoy that.

</comment></comment><comment><USER20> Why do you believe what you believe is true? Independant study? Easiest possible explanation? Herd effect? Fear of standing out?

It's rare that you can change another persons mind. But you can try to understand why they believe what they do.

You present vaccinations as an example, with "decades of evidence supporting them." That's far less time than evidence supported a flat earth.

The thing is, some vaccines work pretty well. Others don't. It's complicated by the fact that if they don't work, or if they injure or kill you, you can't get your money back or bring lawsuits against the manufacturers or providers.

And there's no laws or regulations that say vaccines must work. Vaccine makers can literally solubilize dog shit and call it a vaccine. And it will "work" for quite a lot of people. There's billions of dollars counting on the us believing they're effective. That blind faith in vaccines has been waning for quite a while now.

<comment> open-source-ux In many countries vaccines will only be licenced after rigorous safety testing and extensive clinical trials. Those clinical trials will usually include thousands of participants. After a new vaccine is introduced, it will continue to be monitored.

It's simply not true that "Vaccine makers can literally solubilize dog shit and call it a vaccine."

This information site from Oxford University provides an excellent summary of how vaccines are tested, licensed and monitored in the UK. The process is probably similar in many other countries:

[http://vk.ovg.ox.ac.uk/vaccine-development](http://vk.ovg.ox.ac.uk/vaccine- development)

</comment></comment><comment><USER21> People are a lot less individualistic than you might think. If you want to change opinions, change the messenger.

</comment><comment><USER22> You have to pick your battles. Life isn't going to get any easier.

</comment><comment><USER23> Why do you even care about other people's beliefs?

</comment><comment><USER24> Talking to people who disagreed with you made you have a bad day? Maybe it could have been an interesting day if you put your ego aside and focused on trying to understand them. What makes you so certain your beliefs are correct anyway? Have you reviewed the evidence on both sides?

</comment><comment><USER25> >Is there a way to convince and persuade without alienating people?

In my opinion? No. Shame, humiliation, and ostracizing are the way to go. If they refuse to think dynamically or critically, they need to feel rejected from functioning society. In civil society, you follow certain normative rules and laws. If you don't, you get ejected on way or another. This is good.

Insanity transfer theory: (I made it up, could be specious, buyer beware.) Every person naturally generates a certain amount of insanity. To prevent unhealthy build up, you need to transfer your insanity onto other people. Basically the deniers are doing this to you, and it's making you nutty. So do it back to them. I suggest ad hominem attacks in this case because a.) the problem isn't about facts or arguments, these are flawed individuals actively denying reality and trying to spread lies. b.) name calling in such a case is fun, even if shaming them fails to change their behavior. Just make sure you have fun doing it. And if not, dump them. If you can't make fun of their stupidity, it's unhealthy to keep them around, they'll drive you crazy.

<comment><AUTHOR> Nope. Can't take that line.

Colleague I'm not too bothered about - I wish I was better equiped to address the attempts to bring me towards "Hitler was ok" but this is a person I can walk away from. And that I'm unlikely to change.

And workwise, I need to be be assertive, but I think I'll always lose to the argument with this owner - facts be damned. And those higher up the food chain seem unwilling to say no.... This is a situation and behaviour I have little control over.

But my room-mate I upset. She's a good friend and I have no wish to reduce or demean her. The last thing on a trying day and I failed either to identify with her concerns or find a way to get her (or myself) to think about them. I just went off on one.</comment></comment>


Would anyone use a command line blog platform? - <AUTHOR>

I want to develop a blog platform for personal use that can manage your blog from the command line and I am curious if other devs would use it. <comment><USER3> Perhaps creating a command line interface for Tumblr / Posterous hosting would work. I wouldn't try to reinvent the hosting platform though, if that's what you're asking.

Hosting one's own blog is trivial, and I'm willing to bet that your target audience is more likely to use a static site generator like Jekyll or Pelican.

</comment><comment><USER4> Why not add the functionality to an existing platform? Its would be simpler and would grant you a bigger userbase.

</comment><comment><USER5> I publish my blog with chronicle, a static generator.

In the past I also reviewed several of the popular static-site generators, many of which are designed for blogging:

<https://github.com/skx/static-site-generators>

</comment><comment><USER6> I'd certainly be interested.

I thought about this awhile back but never found the time to get anything going. If you end up going through with it post the Github link as I'd like to contribute.

</comment><comment><USER7> Shameless plug for my own solution, curmudgeon: <https://github.com/lharding/Curmudgeon>

So, yes. :)

</comment><comment><USER8> definitly yes! I used vimwiki some bit but lacked some menu and time functionality, although I am sure that it could be tweak to work like a great command line blog platform.

But there are a lot of tool, that take .md files and create a static site with it. Which is a great start, where you could bind a deploy script that could be triggered from vim for example.

<comment><USER5> The hard part with these static-publishers is handling comments - <USER2> outsourcing to disqus, or similar.

</comment></comment><comment><USER9> Yes</comment>


Show HN: Weekend app to watch Dribbble designs - <AUTHOR> http://www.infinilla.com

<comment><AUTHOR> I have built a tiny web application for myself and think it can be interesting for someone else too. It's located here: <http://www.infinilla.com>. The app is for getting 3 random picks from Dribbble using its API. You can click Refresh link on the bottom of the page and get 3 randomly chosen images that you can use for inspiration as I do. If you want to get more info about the image you see, just click on it and you will get to the page of that image on Dribbble. I suppose this app can be interesting for somebody looking for inspiration. I am working on adding some new functionality so I will be glad to hear from you!</comment>


Why I started reading more once I got rid of my books - <AUTHOR> http://ryanwaggoner.com/2010/11/how-i-read-more-by-getting-rid-of-my-books/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+ryanwaggoner+%28ryanwaggoner.com%29&utm_content=Google+Reader <comment><USER2> Earlier submission with some discussion ...

<http://news.ycombinator.com/item?id=1952033></comment>


What I learned from my Uber data - <AUTHOR> https://medium.com/@nealmueller/uber-10fdd770b29a#.sftne1dh0 <comment><USER2> Great set of data! Car sharing makes sense in your market.

</comment><comment><USER3> What's surprising to me is there wasn't a way to get the ride data other than paying somebody to scrape it.

<comment><AUTHOR> Like with uberPOOL, it's a tradeoff of money and time. In this case it was a tradeoff of $20 and 5 minutes finding Nethaji on upwork vs. what I felt was going to be a bit longer to setup the scrape, debug it, scrape it, and QA it. I have friends that are good at it but I felt bad bothering them.

<comment><AUTHOR> Also, everyone seems surprised at this nugget, "Only 4% of my drivers are women ." I wish there was something we could do to make it feel safer for female drivers.</comment></comment></comment>


US probing possible airline collusion that kept fares high - <AUTHOR> http://bigstory.ap.org/article/fbe53033dd424612974b0c0f8c19910e/justice-department-investigating-potential-airline

<comment><USER2> Yet at the same time spying for Boeing on AirBus to get an edge during price negotiations, trade secrets etc.</comment>


Twitter Mentioning—Everywhere - <AUTHOR> http://arsenije.quora.com/Twitter-Mentioning%E2%80%94Everywhere

<comment><USER2> This essentially exists already with "Google Alerts".

<comment><AUTHOR> Yep, but my idea should be kinda "easier" for the end users. In my opinion Google Alerts are still a bit geeky.

Thanks for the comment.</comment></comment>


Ask YC - Feature request Ask YC questions in their own queue - <AUTHOR>

Can we have a separate page for the ASK YC stuff?
The reason is I think it will make for better discussions and keep them out of the news queue because they are not news. I still think they should have karma etc.
Maybe have a checkbox on the form to flag post as question/discussion. <comment><USER2> It'd be nice if anything that begins with the word 'ask' was treated this way. There are a lot of 'Ask PG' and 'Ask so-and-so' threads floating around.

I'd rather they were still included in the other stories, but it'd be nice if you could also view them on their own too. Usually the best discussions of some technical topic happen in these threads.

<comment><AUTHOR> maybe 3 pages Normal(as it is now) Ask YC News I think the new should just have em both.

</comment></comment><comment><USER3> Personally, I like the mix. And there's not always a solid difference between the "news" items and the AskYC, anyway. If I'd be interested in clicking on some guy's post about Ruby vs. Python, I'd be just as interested in clicking on an AskYC post on the same topic.

</comment><comment><USER4> Great idea - sometimes I'm in the mood for good discussions and feedback, sometimes I just want the news.

<comment><USER5> <http://searchyc.com/askyc> \- This will help you find some really great discussions when you're in the mood.

</comment></comment><comment><USER6> There should definitely be a page for feature requests. I'm not crazy about the current thread that aggregates the requests. That page is too big, and there is no filtering out for features that have either been built or rejected (unless I am wrong).

</comment><comment><USER7> Perhaps separate queues for items without title links. I find these much more interesting.</comment>


My Heart Bleeds for OpenSSL - <AUTHOR> http://coderinaworldofcode.blogspot.com/2014/04/my-heart-bleeds-for-openssl.html <comment><USER2> _Depending on how deep we go, we could end up throwing everything away, the CA infrastructure, the cipher suite flexibility, the vast quantities of knowledge that surround the OpenSSL ecosystem and allow thousands of developers to work in a more secure manner than would otherwise be possible._

 _I want to cover the cipher suite flexibility quickly, just to point out how much of a fantastic idea it is. The server and client tell each other what their most-prefered ciphers are, then they agree on the strongest one that they both support._

 _This has massive benefits, for instance, when BEAST et. al. came along and effectively broke block cipher based OpenSSL for a while, we could jump to RC4 for a little while. When that was broke, we all hauled ass back to AES. This gives incredibly flexibility when dealing with many attacks, by simply being able to circumvent the affected parts._

This is frustrating.

All three of the major ciphersuite problems in SSL/TLS (BEAST, RC4, Lucky13) were well-known in the literature prior to their discovery.

The BEAST vulnerability --- chaining IVs across messages instead of making them explicit and thus unpredictable --- was described years before BEAST was published, and was presaged by Phil Rogaway in discussions about IPSEC.

It is possible that RC4 was known to be vulnerable all the way from the moment it was leaked to Usenet. Certainly, the statistical biases were well-known. Not just apocryphally, but in the academic literature.

Lucky13 was a product of MAC-then-encrypt constructions, and an instance of a specific attack Vaudenay described in the early 2000s.

TLS has "ciphersuite flexibility" that has enabled the protocol to hop from one vulnerability to another. Meanwhile, fundamental fixes (either explicit encrypt-then-MAC, or AEAD modes like GCM, or secure native stream ciphers) have demanded fundamental protocol changes, not just new entries in a list of ciphersuites.

<comment><USER3> I never realized RC4 was leaked onto Usenet and a mailing list anonymously: [http://web.archive.org/web/20080404222417/http://cypherpunks...](http://web.archive.org/web/20080404222417/http://cypherpunks.venona.com/date/1994/09/msg00304.html)

It's interesting to read the very first reactions and evaluations: [http://web.archive.org/web/20070423042054/http://cypherpunks...](http://web.archive.org/web/20070423042054/http://cypherpunks.venona.com/date/1994/09/msg00386.html)

<comment><USER4> Why do you use an archive.org link to my server, btw? (I don't care, just curious; I've been meaning to reprocess the archives and make them directly searchable once I find better tools)

<comment><USER5> Oh, nice.

I even almost managed to find a copy of my old "mystery" mail (mystery because I've been unable to find in the archives, even though I know it has to be in there, as evidenced by the old print-out I have):

[http://veps.hypertekst.net/misc/anon- remail/](http://veps.hypertekst.net/misc/anon-remail/)

Did find the thread, though:

[http://cypherpunks.venona.com/date/1996/03/msg00168.html](http://cypherpunks.venona.com/date/1996/03/msg00168.html)

Any chance I could get a copy of the full archive? (Email in profile in case you don't want to make the raw archives available over http).

<comment><USER4> It's possible it was a message which didn't go to every node.

</comment></comment></comment></comment></comment><comment><USER6> This whole thing was totally mismanaged.

Cloudflare had 1 week's notice from these codenomicon guys, and they patched it and stayed silent (NDA?).

Then the codenomicon came up with a fancy name, bought a domain that I'm guessing they paid a fair sum for (for publicity?) and publicized it without notifying anyone (Amazon? Yahoo?, any Linux distro?)

I mean, openssl.org's own website was vulnerable until not too long ago.

I don't appreciate having to build custom RPMs in the middle of the night because my distribution had no prior warning.

I really don't appreciate this spectacle to advertise a security services firm.

<comment><USER2> Everybody wants prior warning, but very early in the process you hit a point where secret notices create more harm than help.

The worst situation you can be in is where everyone knows something is going on, but only a small group of people know what it is. At that point, the incentives strongly favor the attackers, who will work quickly to join the in- crowd and exploit the window of time where they know how to exploit the flaw, and site operators don't know enough about it to take it seriously.

It's especially hard to stage-manage these updates with open source software. Look at the patch; to someone who takes exploit code seriously, the vulnerability is instantly obvious. How was anyone supposed to give you a heads up without tipping off attackers?

<comment><USER7> > At that point, the incentives strongly favor the attackers, who will work > quickly to join the in-crowd and exploit the window of time where they know > how to exploit the flaw, and site operators don't know enough about it to > take it seriously.

Has this sort of behaviour been observed for other vulnerabilities in the wild that can be cited? I would think that the patch is small enough that a co- ordinated deployment to all the distros could have been managed so that they had packages ready before attackers could exploit the vulnerability. Not sure that the correct solution is to announce it with a corporate blog post and a vanity web site instead.

<comment><USER8> There's another name for the phenomenon described by tptacek above: insider trading. Plenty of examples in the wild. The more insiders know what's happening before the markets do, the more likely someone will act on it, or sell the information.

</comment></comment></comment></comment><comment><USER9> "The only way to get that level of assurance would be to build an automated verification suite, or similar."

Wait.....what? OpenSSL doesn't have an automated verification suite? What the?

Well there you go. That's step #1.

I completely disagree with others' calls for a rewrite, and I really don't like their attacks on OpenSSL developers (not that I know them or even know who they are.) How many of you have written software that has been tested as thoroughly in the real world as OpenSSL? Some, but not very many, I presume. OpenSSL has an installed base of billions and billions of machines, and it is mostly successful, and any software that sees that much use (and the corresponding scrutiny) is going to have vulnerabilities revealed. We should absolutely not, not, not rewrite the software and open ourselves up to whole new bugs, or worse, bugs that were in OpenSSL and patched years ago. It would be fine to start a _new_ piece of software, with the hope of competing for SSL, but a widespread campaign to replace OpenSSL would be foolish.

The only possible caveat to this would be if it was developed more like clean room software a la NASA's probe/shuttle software, with every change agreed upon by a large committee of people, and no change made without weeks of planning. If it was replaced by a process so rigorous that it would not admit any bugs the new software might have a chance of competing with OpenSSL. And even then, a committee can't think of everything.

Everyone is starting from the reference point of perfect security and yet perfect security is impossible. Literally the best you can do is to have software that has been subjected to attacks over and over and over again and though it may have been flawed it has also been patched.

<comment><USER10> You don't need a committee to build rock solid software. There are all sorts of formal verification and modeling tools for specifying machine checkable specifications. The overhead in many cases is high so you're not gonna use it when writing a web 2.0 application but not when you're writing software that is a fundamental part of internet infrastructure then the bar needs to be higher. 1000 eyes making all bugs shallow is not the right approach in such cases.

<comment><USER9> Well, the 1000 eyes approach has worked with other open source, mission critical software, like Linux, which also doesn't have an official testing suite. If you have enough people invested in making sure something works, there's a strong incentive to uncover bugs now matter how obscure.

Security's always going to be an arms race in software.

</comment></comment></comment><comment><USER11> I would love to know the price tags, ballpark informed guesstimates, for the following:

      * Audit of openssl
      * Audit of openssl + remediation work
      * Brand new implementation of ssl library  (100% feature parity not required)

<comment><USER12> > Brand new implementation of ssl library

Which will take some years to reach the security level of the current OpenSSL implementation (if at all).

<comment><USER11> Getting an idea of the effort/resources that have gone into openssl is a large part of why I asked the question.

</comment></comment></comment><comment><USER13> Is OP intermingling discussion of OpenSSL (a particular codebaes implementation) from SSL/TLS the protocol(s), in a confusing way? Or am I confused?

<comment><USER14> You're not confused. OP is confused.

</comment></comment><comment><USER4> If we could throw away CAs, cipher suite flexibility, ASN.1, general baroqueness, C, and the horrible cross-layer pain of SSL, I'd be fine with the hard incompatibility with legacy SSL.

<comment><USER15> What language other than C would allow code to be used from all mainstream languages/frameworks? This is a critical requirement for a lib like openssl, having N such libs for N languages would be a nightmare.

<comment><USER16> Write it in safe, modern C++, with an extern C API.

I'm sure that leaves out a few rare cases on embedded platforms where they only have a C compiler, but they could continue using existing libraries.

<comment><USER15> I can't see why C++ would be any safer than C. For example Heartbleed like bugs in C++ are still very much possible.

<comment><USER17> It's possible to define a subset of C++ that can be statically verified to not have this sort of problem. This can also be done with C, but it's more difficult. There are actually people who write in overrun-proof subsets of C++.

<comment><USER18> Wow, I wish posts like yours weren't so rare. There is way too much undeserved hate heaped on C++ due to (imo) C programmers that pretend to code C++.

</comment></comment></comment></comment></comment></comment><comment><USER19> I generally agree that rewrites are a bad idea. However:

1\. Competition is good. Business, open source... doesn't matter; some competition almost always leads to improvements.

2\. Sometimes a rewrite can be justified when there's a real difference of design behind it. For instance, using a different language with greater safety (type safety and/or memory safety) might be the only way to get this to the level of security we expect.

<comment><USER20> Also if you're able to e.g. inject a deterministic random number generator into both libraries, you should be able to cross-check the crypto primitives.

Just create a server that spends all day and night throwing random inputs at the bleeding edge and released versions of all the libraries and see if they output the same values (i.e, either they are all equally broken or they all work).

<comment><USER21> All PRNGs have a seed, so you can always make them deterministic if you want.

<comment><USER20> Hm. I'll start looking into this if this could be turned into a general crypto/SSL/TSL-cross verification service. I'd need to wrap the various components of libraries into sandboxed REST-like webservices to enable more languages to take part and then I'd need some system to just generate semi- structured junk to throw at those implementations.

</comment></comment></comment></comment><comment><USER22> The author seems to discuss OpenSSL as if it were the protocol itself, not an implementation of it. OpenSSL != SSL != TLS

</comment><comment><USER23> This particular breach is very bad.

That said, for a piece of software as widely used as this, what is the actual count of vulnerabilities found?

I've spent quite a bit of time in the openssl code base for various projects over the years. I find it generally readable, but then I've seen some pretty odd ball C code over the years.

</comment><comment><USER24> I wonder if this author is aware that OpenSSL was once born from a different project, called SSLeay, started way back in 1995. Abbreviated history lesson:

\--

People today get pissed off because RSA got paid by the NSA to make crypto weaker, but try living in a time when RSA literally controlled the entire trade of tools used to run the web securely, and could just prevent anyone in the US from using SSL if they didn't pay for it. It's funny that actually all the people who originally worked on getting SSL created or its implementation into free software eventually worked for RSA. Ironically, back in the day NSA invested millions in a campaign to destroy RSA by offering its own competing cryptosystem as the new defacto standard.

SSL was basically created by Netscape through the work of Taher Elgamal, whose name you might recognize. In the 80s he created a variety of cryptosystems, many of which we still use today in a variety of applications. SSL was created with RSA's cryptosystems and patented algorithms to provide the most security in the fastest way possible for web users. Since all of RSA's algorithms were patented, nobody could implement them (for commercial purposes) without licensing it from RSA. Strong crypto (anything over 40 bits) was also still considered 'munitions' and not allowed to be exported out of the country.

Back then there wasn't a great big free unified toolkit of crypto libraries for anyone to use. The people who were writing crypto software either worked for a university, or a corporation, or a government, and thus all had the tendency to keep their source code to themselves, and code and libraries were licensed instead of given out freely. But a mini revolution had started from the ashes of the homebrew/shareware communities. People started to create free software and give it away at no charge, there were people interested in making web servers and the like, and they could all share one standard library (for things like crypto) so they didn't all have to implement one themselves for every project.

SSLeay was created in order to have a free implementation of SSL and its cryptographic algorithms that wouldn't be subject to US export controls. This was reportedly a "clean room" implementation derived only from documentation, written from scratch by Eric Young in Australia in 1995. It was then used by Tim Hudson in America (amongst others) to add SSL support to basically every free application that could use it, like telnet, ftp, ncsa mosaic & httpd, apache, w3c httpd, lynx, mSQL, etc. Both these men later went on to create commerial versions of this library and leave the work on SSLeay behind, and from that was born the OpenSSL project to continue where they left off.

At the time it was possible to create and run free software that provided SSL access. Actually, companies like Verisign - the only CA allowed by some browsers, for a while - had to make policy changes to start allowing certs to be generated for Apache-enabled SSL sites. But it was not _legal_ to make free SSL-enabled software in the US because the right algorithms had not been licensed by RSA to use in the states. It also wasn't legal to export any strong crypto from the country. You could only use things like Apache with SSL if you purchased a licensed add-on for use in the US, or applied a mod_ssl patch for use outside of the US.

Browsers were in a much worse boat [because they all depended on RSA if they wanted strong encryption] and thus were largely commercial ventures. When Netscape released its source code for the first time under the Mozilla label, all its strong crypto was removed to comply with US laws. A new project (Cryptozilla) had to be created to link SSLeay to the sources. It was then that the rest of the world could finally download a robust, modern, open- source browser with strong crypto.

All of this changed in 2000 when the RSA patents fell into the public domain and the US relaxed its export controls on crypto software. Right after that, Mozilla bundled its own RSA implementation in its NSS crypto library, and the rest (for Mozilla) had nothing to do with SSLeay or OpenSSL. But SSLeay (now OpenSSL) continued to be used by software all over the world.

\--

There were a lot of different implementations of SSL/TLS with varying degrees of compatibility bugs. Most of the time a web server was developed in tandem with a web browser (or other similar client/server tools), and a library was created to implement the protocols they needed. This, of course, led to various problems between different implementations, even though if it was web code it was all using the same RSA toolkit for the relevant ciphers.

Even since those days in the mid-1990s, it's been obvious that a single library to handle all the weird implementations is both difficult to implement and very useful to developers. It's never been easy or bug-free. But even at the time, the library was written and re-written to get around things like export controls (the BSAFE SSL-C library was a rewritten version of SSLeay, by its original authors, so their new company could sell it as a non-US-based implementation of a US-patented algorithm).

Personally, I don't think it's offensive to the spirit of the original authors (or current developers) to suggest a fork or a rewrite. The main goals of OpenSSL are to have a free software implementation of SSL and TLS, and secondarily to provide a full-strength general-purpose cryptography library. It's not some abominable, indecipherable, impossible task to re-accomplish this. Hell, it was originally done by one ozzie by himself with just docs for reference. I think maybe the entire open source community can handle organizing a do-over.

\--

(Side note: does anyone else realize that the HTML <keygen> tag has been around since Netscape Navigator 3, and still nobody uses it?)

<comment><USER25> > HTML <keygen> tag has been around since Netscape Navigator 3, and still > nobody uses it?

StartSSL uses it for personal (email) certificates. I've tried using it in a toy VPN project but dropped the idea mostly because I was unable to easily explain how to use those certificates afterwards (i.e. export them out of the browser's keystore, import them to smartphone and use with VPN without horrendous tens-of-steps tutorials that'd bore anyone to death).

The issue is, almost nobody uses client X.509 certificates, so <keygen> is obviously unused, too. The core issue is, browser (and other software) vendors never gave a thought on improving horrendous UIs for certificate use and management. It's still hidden after 4-7 clicks away under some obscure names, and then it exposes almost raw X.509 data which asserts those casual users who found their way through the settings are scared away.

I mean, something in this direction is a must: [https://www.dropbox.com/s/xxfzf9ed4wfytkj/tls_auth_ui.png](https://www.dropbox.com/s/xxfzf9ed4wfytkj/tls_auth_ui.png)

<comment><USER24> It seems like the browser vendors (Netscape) never intended for there to be a UI for a good reason. It's intended to be used to (basically) transparently install and use a client cert. Each device can get its own key pair/client cert, and no UI is necessary to manage them.

<comment><USER25> > no UI is necessary to manage them

Not that simple, unfortunately. Even with per-device certificates (which is, I believe, the proper way - have a "master" one signed by remote party then sign your own per-device certs with those), users will still have to:

1\. Chose the certificate they want to present to a server. Current UIs are plain terrible and scare every non-techie user (and techies who don't know about X.50x) away. This is absolutely a must, unless Netscape intended for certificate auth to be completely transparent to end user (which is bad, because many of us have multiple identities).

2\. See and be notified in advance of certificate expiration times. I have multiple overlapping for half an year StartSSL client auth certificates just because I may forget about the expiration (and miss the notification email). This is not absolutely necessary, but quite important feature if we'd suddenly start to take client certificates seriously.

3\. Interoperate with system-wide keystore (if there's any) for the cases certificates're going to be used outside of the browser (say, for VPN or Email S/MIME). This is not an absolute requirement, but very useful feature to have. I understand that when Netscape Navigator was young there probably wasn't system-wide keystores, though.

4\. Securely backup the certificates if they're meant to me used as a master ones, not per-device.

</comment></comment></comment></comment><comment><USER26> Look at it this way. If it was closed source, the fix would take longer, and the realization may have never come.

Honestly, seems like we are forgetting our roots on this. Dump it? Yeah and throw out years of stability and bug fixes. No thanks!

<comment><USER27> Being widely used is a problem. Monoculture leads to exactly this kind of mass vulnerability.

<comment><USER28> "But crypto is hard! Don't roll your own", say everyone, ever.

<comment><USER29> By coincidence, I remembered someone pointing this out to the Go developers no too long ago, after he found out they did in fact roll their own:

[https://groups.google.com/forum/#!searchin/golang- nuts/opens...](https://groups.google.com/forum/#!searchin/golang- nuts/openssl/golang-nuts/0za-R3wVaeQ/dOWHSpZK7-cJ)

In light of the current issue I looks like the D guys did the right thing.

</comment></comment></comment></comment><comment><USER30> _rewriting is almost always a mistake_

I'd make an exception for rewriting in a language that prioritizes safety towards the top...

[http://www.reddit.com/r/rust/comments/22gppc/when_life_hands...](http://www.reddit.com/r/rust/comments/22gppc/when_life_hands_you_lemons_is_this_rusts_time_to/)

<comment><USER28> I thought Rust was old hat? Haven't we all moved on to Node.js? Or it was Grep ou Gulp or something.

I find it hard to keep up.

<comment><USER31> Isn't Rust a newer language with a ton of recent activity? Isn't it in a different space than Node.js? I'm not following your comment.

</comment></comment></comment><comment><USER32> Actually, this post reinforced my belief that we should dump SSL and replace it with something better and safer. It's just not worth the trouble at this point. The flexibility will arrive over the coming years, if there's an alternative with a lot more enthusiasm and resources put into it.

<comment><USER33> I do not want my customers' security to be based on "enthusiasm," and I can't see any way you could get something with more resources put into it than SSL in a near-future time frame.

</comment></comment><comment><USER34> Someone with more knowledge please correct me if this is inaccurate, but from what I have been able to understand this basically exposed 16kb of random memory each heartbeat? So the fear would be that a persistent attacker I guess could continuously run this and scan the output trying to match things like security certificates?

While I am sure this could be used on high value targets with enough resources, as a small web service outside of the tech industry I feel pretty confident that no one would invest those kind of resources to steal our SSL cert. Is that misguided?

<comment><USER27> Yes. It doesn't take a lot of resources. It's already been noted on Twitter that someone - possibly quite a lot of people - were using HTTPS Everywhere lists to find interesting targets. Mass hacking and drive-bys are trivial. And remember, it's not just certificates! It's anything that is in your sever processes memory (the process that implemented SSL), so it could be passwords or other credentials.

</comment></comment><comment><USER35> Another 'use namecoin's model' suggestion? Please, please, no. I don't want to place authority for issuing certs solely in the hands of people with mining hardware or botnets, or lots of money to buy form the aforementioned.

</comment><comment><USER36> > My Heart Bleeds for OpenSSL

Looking at their web site, they have a link right at the top to buy a support contract and another to contract a team member. This level of publicity probably equals big consulting dollars for them.

</comment><comment><USER37> Just think, Zuck could have paid $18bil for WhatsApp and used the $1bil leftover as OpenSSL or like bounty.

Better use of money and still of use to FB.

</comment><comment><USER38> I don't think "progenerator" is a word.

Did the author mean "progenitor"?

</comment><comment><USER39> Your site (blogspot's site?) breaks my back button something fierce.

<comment><USER40> That's Blogspot / Blogger. Hell, I don't even see any content with JS disabled. Enabling it, as you note, is worse.

From past experience, it's got to do with the dynamic themes Blogger offers. I can't be arsed to even investigate.

<comment><USER41> Well until Google breaks this feature you can see most blogger sites without Javascript using the RSS feed (in Firefox at least):

[http://coderinaworldofcode.blogspot.com/feeds/posts/default?...](http://coderinaworldofcode.blogspot.com/feeds/posts/default?alt=rss&path=/2014/04/my- heart-bleeds-for-openssl.html)

In other browsers it might not render the RSS XML feed as a page, Chrome just shows the raw XML. I use this bookmarklet for the process:

        javascript:window.location=window.location.protocol+"//"+window.location.host+"/feeds/posts/default?alt=rss&path="+window.location.pathname;

<comment><USER40> Thanks, though I avoid Google where possible these days.</comment></comment></comment></comment>


Show HN: Blog made with CouchDB/PouchDB - <AUTHOR> https://cherrypc.com/blog/index.html <comment><USER2> The blog app looks interesting for an idiosyncratic need of mine, but at first glance (a) selecting to "not set-up account, just get the apps" seems to go to online versions, not a download, (b) the blog isn't included as one of the apps, and (c) there's no indication which "desktop" platforms are supported. So, (a) will there be downloads Real Soon Now, and (b) will the blog be one of them, and (c) is Linux supported?

<comment><AUTHOR> Thank you for the feedback!

Here are the answers to your questions:

(a): The apps are "web apps" and all the code to run them is cached in your web browser when you load them the first time.

If you disconnect your internet and load "[https://cherrypc.com/app/index.html"](https://cherrypc.com/app/index.html") they'll work. If you're online and don't have a "Data Services" account they'll still work, but you won't be able to email documents directly from the app. You can "Save" them though, or "Print to PDF" if you're using Chrome to run them, and attach them to an email in your email app.

Right now I use "App Cache" for offline use, but I'll be implementing "Service Workers" soon.

(b): The blog isn't one of the apps included, but I am considering including it. It requires the "Data Services" we offer though, so it wouldn't be "free", but I may spin up another server just for the blog app and offer it as a stand alone service at a much lower yearly fee.

(c): Since, they are web apps any device with a modern web browser are supported, including mobile devices, so yes, Linux is supported. I test them on a Raspberry Pi and they run fine in the modern web browsers that run on it, including Chrome and Firefox.

<comment><USER2> Okay, thanks for the clarification. I guess that mentioning CouchDB in the subject was part of what confused me, as did describing the blog internals in detail when it isn't being offered. So, it actually isn't a solution to my idiosyncratic requirement, but good luck anyway.

</comment></comment></comment><comment><USER3> You should consider using the window.history APIs to make it so that navigating your blog doesn't break the back button.

<comment><AUTHOR> Thank you for the suggestion!

I'll look into that asap.

</comment></comment><comment><AUTHOR> It took me about a week to assemble this blog app using CouchDB, PouchDB, jQuery, and Bootstrap (with a template), as well as reusing some of the CherryPC app code.

I was kind of surprised how quickly it came together. It's no "Wordpress" but I think it's pretty nice, all things considered.

<comment><USER4> Is the code available on github ?

<comment><AUTHOR> Not yet. I've not used github for any of my stuff yet but if there's interest in it I'll get it up there and post a notice here when it is.</comment></comment></comment>


The Case of the Mysterious Date-Nut Bars (2007) - <AUTHOR> https://www.seriouseats.com/2007/02/mysterious-date-bars.html <comment><USER2> I moved to SF two years ago after living in NYC for 4 years. When people here ask me if I miss New York, I tell them I miss aspects of it -- the bars, restaurants, nightlife, art, fashion. But increasingly it's the little things about daily life in New York that I miss. I saw a video on Reddit of someone doing something dumb in the subway (a daily occurrence), and I almost cried. Similarly, this story choked me up. I had also seen those bars. I always figured they were meant for some other anonymous New Yorkers, not for me.

</comment><comment><USER3> Hahah I love this! Glad you were able to track it down and share.

</comment><comment><USER4> Stealth brands are the strongest brands.

<comment><USER5> Or not... it looks like Awrey was sold in 2013 at the last minute before selling off its assets. It also went through bankruptcy in 2005.

[http://www.crainsdetroit.com/article/20130220/NEWS01/1302299...](http://www.crainsdetroit.com/article/20130220/NEWS01/130229992/awrey- bakeries-sold-buyer-to-rehire-many-workers)

</comment></comment><comment><USER6> "Is the shop owner around?"

"Yes"

"Can you ask him the name of the company that provides these?"

"Sure [...] it's called XYZ"

"Thanks"

^ That's about how long this useless story needed to be. The author ran around town bothering dozens of cashiers that don't do the purchasing.

<comment><USER7> I love how he bothered cashiers for months before it occurred to him to _pick one up and look at the label._

<comment><USER8> The writer is a she.

</comment></comment></comment><comment><USER9> Needs a (2007). Dates might have gone out of fashion again in the interim.

:P

<comment><USER10> _> Dates might have gone out of fashion_

I don't believe so... have you ever heard of Larabar or RxBar?

There is also Fig Bar from Nature's Bakery.</comment></comment>


New Spectre/Meltdown Variants: MeltdownPrime and SpectrePrime - <AUTHOR> https://arxiv.org/abs/1802.03802 <comment><AUTHOR> MeltdownPrime and SpectrePrime: Automatically-Synthesized Attacks Exploiting Invalidation-Based Coherence Protocols

"The recent Meltdown [9] and Spectre [8] attacks highlight the importance of automated verification techniques for identifying hardware security vulnerabilities. We have developed a tool for automatically synthesizing microarchitecture-specific programs capable of producing any user-specified hardware execution pattern of interest."</comment>


Www.nasa.gov now redirects to notice.usa.gov due to federal government shutdown - <AUTHOR> http://www.nasa.gov/

<comment><USER2> The Spanish translation is terrible!

They translated "due" as "during"...</comment>


Boeing 737 Max Victim Fund, $100 Mil / $289,017 per person - <AUTHOR> https://www.slashgear.com/boeing-reveals-100m-737-max-victim-fund-after-2018s-record-101bn-revenue-03582726/ <comment><AUTHOR> $100 million sounds like big bucks, but really to think their one day be proven to be criminal negligence ... they think they are getting off free almost free...

$289,017 a person just doesn't cut it, or even come close to covering the lost income. Let alone cutting the passengers lives short...

<comment><USER2> Somalia features an expected lifespan of 56.3 years and a per-person GDP of about $500. Taking off some years for childhood, we get about $20,000 as lifetime earnings.

So the $289,017 is over by about a factor of 14.

<comment><USER3> Only 1 Somali national died in the Ethiopian Airlines crash. The largest group by nationality were 32 Kenyans, and Kenya has a GDP per capita of $1,800/yr. But there were many other nationalities, including many from countries with far higher GDPs. 70 (of 149) were from Canada, the US, and the EU.

The Lion Air victims were almost entirely Indonesian nationals. Indonesian GDP per capita is $3,800/yr.

I get your point, but I don't see any windfalls here. On the face of it, $100 million seems more at the very low end of what might arguably be considered reasonable compensation. The high GDP nationals from the Ethiopian Airlines crash are likely to take a large chunk of that $100 million. Plus people flying, especially those resident in those areas, likely have above average incomes. Seems like Boeing is low-balling. They basically said as much: "We hope this initial outreach can help bring them comfort."

</comment></comment></comment><comment><USER4> Would this imply Boeing acknowledge it's their fault? Would this lead to more suits from families of the passengers?</comment>


This dwarf planet may contain more freshwater than Earth - <AUTHOR> http://news.cnet.com/8301-11386_3-57617616-76/this-dwarf-planet-may-contain-more-freshwater-than-earth/ <comment><USER2> Widely suspected since at least 2005: [http://www.space.com/1526-largest- asteroid-fresh-water-earth...](http://www.space.com/1526-largest-asteroid- fresh-water-earth.html)

<comment><AUTHOR> ... and yet, 9 years later, it's still news!

</comment></comment><comment><USER3> Why is the 'dirty water' considered to be 'fresh'? Is there any estimate of the salt content available?</comment>


Let's Get Real About Startups and Mental Health - <AUTHOR> https://medium.com/thelist/let-s-get-real-about-startups-and-mental-health-2cb965e6b888

<comment><USER2> _Can we please retire the "strong, tough, male" founder stencil once and for all?_

So, there's a difference between that stereotype in a founder, and in a CEO-- though the author uses the two as though there isn't. A CEO's job is to _lead_ and to _make decisions_ and to _delegate_ , and that is something that monkeybrains are wired to assist with only with CEOs that appear strong and masculine.

It's not ideal, mind you, and there's nothing wrong with seeking help and whatnot, but ignoring thousands of years of experience is probably not wise here.</comment>


Show HN: A syntax highlighter for Git and diff output, written in Rust - <AUTHOR> https://github.com/dandavison/delta <comment><USER2> This is neat. In a similar fashion I'm a big fan of diff-highlight, [0] which post-processes the git diff and highlights with color the differing segments. It's super lightweight and part of the official git repo; I've saved it as a standalone #!/bin/perl in my $PATH and then included it in my .gitconfig:

      [pager]
       log = /Users/user/.bin/diff-highlight | less
       show = /Users/user/.bin/diff-highlight | less
       diff = /Users/user/.bin/diff-highlight | less

[0]: [https://github.com/git/git/tree/master/contrib/diff- highligh...](https://github.com/git/git/tree/master/contrib/diff-highlight)

<comment><USER3> Sort of related: as I never made diff-highlight work correctly on Windows, I wrote diffr[0] which goes a little bit behond what diff-highlight does.

[0]: [https://github.com/mookid/diffr](https://github.com/mookid/diffr)

</comment></comment><comment><AUTHOR> Delta[0] applies syntax highlighting to the code sections of git and diff output, and uses background colors (instead of +/-) to indicate added / removed content. It's written in Rust, and uses the syntect[1] highlighting library. That's the same library that bat[2] uses, so delta supports all the same color themes, and any bat configuration that you already have in place (environment variables, custom themes/language support) is automatically honored by delta. Delta also infers and highlights substrings that differ between lines (similar to Github, Gitlab and other diff viewers) and optionally cleans up the raw diff output slightly to make it more human readable.

[0] [https://github.com/dandavison/delta](https://github.com/dandavison/delta)

[1] [https://github.com/trishume/syntect](https://github.com/trishume/syntect)

[2] [http://github.com/sharkdp/bat/](http://github.com/sharkdp/bat/)

</comment><comment><USER4> Does it work properly with `git add -p`? That's a longstanding issue of diff- so-fancy: [https://github.com/so-fancy/diff-so- fancy/issues/35](https://github.com/so-fancy/diff-so-fancy/issues/35)

<comment><AUTHOR> Yes it does. Thanks for asking, I hadn't tested this out. The key is the `--color-only` argument, which guarantees that, other than ANSI color escape sequences, the original output from git is unchanged:

      [interactive]
          diffFilter = delta --color-only

</comment></comment><comment><USER5> If you to use this on Windows, you'll need to update `less.exe` with my patched version - [https://github.com/lzybkr/less/releases/tag/fix_windows_vt](https://github.com/lzybkr/less/releases/tag/fix_windows_vt)

</comment><comment><USER6> As a suggestion, I'd have the configuration step in 'Configure git to use delta' not reference a theme that doesn't come with the initial install as you've done with 'base-16.ocean.dark'. I had to investigate why, and (admittedly happily) then found out about bat and installed that and changed it to 'zenburn'. But I suppose most users would like to see it work without having to do that.

<comment><AUTHOR> Thank you! Fixed that.

<comment><USER6> I don't know if this is better per-se but my diff-so-fancy config sat in [pager] rather than [core]. I verified that git-delta works as configured this way instead:

      [pager]
              diff = delta --dark --plus-color="#012800" --minus- color="#340001" --theme="zenburn"

</comment></comment></comment><comment><USER7> This might be just me but looking at the screenshots, I clearly prefer the GitHub one as it shows the line numbers of every line in both before and after. Line numbers make jumping between the diff and the editor fast and efficient.

<comment><AUTHOR> Thanks, that's definitely a feature that could be added. My original thought was that the line numbers in the _after_ file are nearly always what one wants, since that's the version that your editor will most naturally be displaying. And I wanted to reduce visual clutter. Delta currently displays just the first line number of each diff hunk; not on every line. But that's also something that could be made configurable.

EDIT: In fact an issue was opened for this very recently: [https://github.com/dandavison/delta/issues/130](https://github.com/dandavison/delta/issues/130)

Ideally, I think that a mouse click in an appropriate location in a terminal emulator window should open the user's editor on the correct line of the correct file.

</comment></comment><comment><USER8> Just installed it, it looks great and is a big step up from diff-so-fancy. Thanks for making this!

</comment><comment><USER9> Anyone else getting this issue?

      ⟩ git diff
      error: Found argument 'Extended' which wasn't expected, or isn't valid in this context

      USAGE:
          delta --dark --minus-color <minus_color> --plus-color <plus_color> --theme <theme>

      For more information try --help

My ~/.gitconfig file has the copy pasted lines from the github example

      [core]
          pager = delta --dark --plus-color="#012800" --minus-color="#340001" --theme="Monokai Extended"

      [interactive]
          diffFilter = delta --color-only

Installed with homebrew on macos.

<comment><AUTHOR> Thanks! I made a hasty edit to the README earlier. Try

      --theme='Monokai Extended'

It seems that in ~/.gitconfig, a theme name with spaces must be quoted with single quotes. At least, that is working on MacOS.

</comment></comment><comment><USER10> Can anybody suggest a --plus-color that looks nice on a solarized-dark blue terminal?

<comment><USER11> I settled on --plus-color="#157330" \--minus-color="#731525".

</comment></comment><comment><USER12> This is fantastic. Kudos!

A tip for people who (like me) don't like that Git pages by default: With Delta, you can disable this it by adding this to your environment:

      export BAT_PAGER=cat

</comment><comment><USER13> Seems related: _diff2html_

[https://diff2html.xyz/](https://diff2html.xyz/)

npm-installed cli which shows you git diff in your browser

</comment><comment><USER14> Stuff like that makes my daily code reviews so so SO much better! I can't thank you enough!

<comment><AUTHOR> This is good to hear :)

</comment></comment><comment><USER15> Anyone know how to get this working with vim-fugitive? [https://github.com/tpope/vim-fugitive](https://github.com/tpope/vim-fugitive)

<comment><USER16> Not sure about vim-fugitive, but vim-gitgutter's hunk previews have intra-line highlighting. I mention it because people often use the two plugins together (and I'm pleased with how vgg's highlighting turned out :)

[https://github.com/airblade/vim-gitgutter](https://github.com/airblade/vim- gitgutter)

</comment></comment><comment><USER17> A comparison to [http://www.colordiff.org/](http://www.colordiff.org/) would be good in the table of the README.

</comment><comment><USER18> FYI that dark theme example has unreadable blue for me in looking at it with night shift on. I'd suggest swapping out for a better theme.

<comment><AUTHOR> I agree. If anyone has nice combinations of delta background colors and syntax highlighting theme for dark backgrounds, please send them my way! (Here, or PR/issue).

</comment></comment><comment><USER19> Is there a way to see diff output side-by-side? I personally find that much easier to parse through with a widescreen monitor.

<comment><AUTHOR> Hi, thanks, this is an interesting question and there have been requests for it. Two possibilities come to mind:

1\. Delta constructs the side-by-side diff itself (a parsed internal representation of it), and then colorizes it.

2\. Delta gains the ability to parse side-by-side diffs being emitted by another tool.

My currently feeling is that (1) is more attractive / easier.

<comment><USER20> #1 would be useful for sure.

</comment></comment></comment><comment><USER21> The light theme looks beautiful, thanks!

<comment><AUTHOR> Thanks. I like the light theme also. If anyone has suggestions of good {theme, background-highlight-colors} choices, especially for dark backgrounds, please open a PR/issue and we can add them to the README.

</comment></comment><comment><USER10> I can't tell if --dark is changing anything. That seems to be the default on my dark terminal?

<comment><AUTHOR> Yes, --dark is the default and it will choose a dark theme. To see a demo of other dark themes, you can do

      delta --list-themes --dark

and then delta --theme <chosen theme> to select it.

</comment></comment><comment><USER22> icdiff is my current favorite.

This does look nice, though I'm a little confused by the choice to highlight the section below the function declaration change even though it doesnt appear to have a change.

<comment><AUTHOR> Is it the hunk header you're referring to? That's something that git outputs, like this, before the diff hunk:

      @@ -62,17 +62,17 @@ class MyClass:

Delta makes that more prominent by surrounding it with a box (by default) and getting rid of the for-machines characters that git puts there. It doesn't apply background colors to it though: delta only applies background red and green shading to removed/added lines.

(I believe that one can customize the regular expressions that git uses to decide on the hunk header; they're sometimes appropriate and sometimes not, for the languages that I use.)

</comment></comment><comment><USER23> I think there's 'tig' as well. You can use it as 'git diff | tig'

</comment><comment><USER24> can we get one written in Ada too?</comment>


Literate: A Modern Literate Programming System - <AUTHOR> http://literate.zbyedidia.webfactional.com/

<comment><USER2> It looks like this software breaks compiler error messages.

One of the great features of Knuth and Levy's CWEB is that errors are reported in terms of locations in the literate source. This feature, which works by way of line pragmas, is essential for proper debugger support and, in my opinion, sanity while coding larger projects.

If it is missing, it is often better to skip the "tangle" step entirely and have the literate source map directly to the program source line for line. Trying to "pattern-match" the compiler errors against tags in the source file is a painful waste of time. The 1-1 mapping is quite practical for more functional languages if one writes code in a style more like SICP than the TeX sources.

<comment><AUTHOR> Thanks for the comment. Because this "Literate" software outputs nicely formatted code (including automatically included comments identifying code blocks) in the target language, it's not too big a deal, you can just see what line the compiler errors are referring to in the target source code. CWEB's approach of treating the tangled code as only intended for machine reading has the major drawback that you can't share the target source code with others and expect them to be able to read it; they need to buy into CWEB too. So there's a trade-off here.

<comment><USER3> It seems like this could be solved by making it an option? During development, generate line number pragmas to improve the error messages. Then when you have a working program, format the code nicely.

<comment><AUTHOR> That's an excellent idea. I don't think it would work for all languages, but it's still a good solution, and will be added to the TODO list.

</comment></comment></comment></comment><comment><USER4> Interesting that you tried to imitate CWEB to some extent. I wrote my own tool (literate-programming on npm) ignoring very much the syntax of these other tools. My thought is that one reason Knuth's literate-programming did not catch on is that the syntax did not look very nice.

Looking at your examples, it doesn't strike me as very markdown-ish. There are @ symbols, and dashes to delineate code blocks. For me, markdown uses # Headings and uses tabs or ``` for code fences. I prefer the tab approach, but fences allow for language syntax highlighting for those who like that kind of thing.

</comment><comment><USER5> Looking at the HTML output, I'm not sure this consitutes proper literal programming due to the amounts of 'contextual noise' that the processor generates. I think the goal is to have the program read more or less like a book, and this...

{Print "hello world" 2} ≡

printf("Hello world"); This code is used in section 1.

...is not exactly it. It feels more like program-in-program Matrixy thing than a document to be read.

<comment><AUTHOR> The output is basically designed to look like the output of Knuth and Levy's CWEB tool. Maybe a better example to look at on the "try it" page is the wc.lit example, which makes a word count program. It's based on Knuth and Levy's wc.w tutorial example, and gives a similar output.

Of course, there are advantages of Literate's output compared with CWEB's; it's more flexible in that you can embed arbitrary HTML in the output, so you can easily put images into your explanations, and you can put as many code blocks and text blocks as you like in each paragraph.

</comment></comment><comment><USER6> I think a problem with literate programming is that programs are never written from top to bottom, at least not in conventional programming languages. The same holds for books, of course, but not in such a dramatic way. Therefore, I think the best way to read a program is not from top to bottom, but rather by using some kind of search tool.

By the way, does anybody know of an automated way to "grade" the quality of code documentation? I think this is what we need on repositories such as github, as it could stimulate the production of documentation of better quality (in most cases the documentation of OSS projects is rather poor).

<comment><USER7> Yeah, it just seems to me that wonderfully written literate documentation would be poorly organized software, and wonderfully organized software would be poorly organized documentation.

I guess what I mean by that is that as software scales out, your code will be more along the lines of "do this logic whenever this function/method happens to be invoked". So it would be great for documenting the workings of a function/method, but it would be poor for actually documenting the lifecycle of a logic path, like the lifecycle of a request. I certainly wouldn't have one file where I handle a request, do some business logic, and interact with a database, even though that is how you might document a lifecycle the request.

<comment><USER8> I fully agree with this and the grandparent. I've written a handful of literate programs, and I found that it worked nicely for a parser, which read from top to bottom in a single file, and it worked quite well for some unit tests, where the extra documentation and the tests themselves - which are quite self-documenting anyway - sat together rather nicely (though it was less well-received by my colleagues, who decried it as neurotic and pointless). My other attempts - particularly a small web app with a bunch of GUI components - were much less successful.

<comment><USER4> Did you write it as a single file that breaks up into multiple files or was each separate file corresponding to a separate literate document?

My tool takes the approach of more of a literate-project approach where one file may generate multiple files (and multiple files could generate one file). The idea is that the organization is completely up to the author with no boundaries between how they want to organize it.

And referring to earlier comment, I would write the same flow of logic for a single thought in the same place. There is the flow of a single process and there are commonalities across processes. I think a good literate programming allows the uniqueness of a single flow to be put into one place and the commonalities to be extracted and applies to such a flow.

</comment></comment></comment></comment><comment><USER9> I wonder how much is lost or gained by writing a different document (.lit) than one reads (.html). E.g., how much would a LyX-style ([http://lyx.org](http://lyx.org)) editor contribute? I'm sure it's been discussed before, but where?

</comment><comment><USER10> Quick editing fix, under the section "features of this tool". I think this; "The code that is generated is indented property" should read as 'indented properly'.

<comment><AUTHOR> Thanks, it's fixed now.

</comment></comment><comment><USER11> How is it different from org/babel?

<comment><AUTHOR> One difference is that Literate isn't tied to a particular text editor like org/babel is tied to Emacs. You can edit .lit files in any text editor. That said, while there already exists a Vim plugin to handle .lit files, there isn't yet any Emacs mode, or plugins for other text editors. Such contributions would be welcomed.</comment></comment>


Steve Blank: Going to Trade Shows Like it Matters – Part 1 - <AUTHOR> http://steveblank.com/2009/05/21/trade-shows/

<comment><USER2> Hmm... perhaps trade shows and networking events are a different beast. I've been to quite a few conferences and networking events lately, but the main reason has been to meet interesting people and build connections with other entrepreneurs (or non-entrepreneurs, for that matter), rather than to get something speciifc out.

The few people I encountered who clearly had a specific agenda were not the most interesting, I found.

So far my best approach to meeting someone at a networking event is to 1) find out what they do, 2) figure out if there's any way I could help them. I like this approach in particular because it's scalable - if everyone does this, we all win. And, in fact, it seems most people do this at start-up networking events (most that I met, anyway)

</comment><comment><USER3> _My observation was that they had the "Going to Trade Shows" part down, they just needed to add the "Like it Matters."_

lol - How true for so many things.</comment>


How to get your lying printer to use up all its ink - <AUTHOR> http://slate.com/id/2198316/

<comment><USER2> It's a bit absurd that in many cases it's actually cheaper to throw your printer away and buy a new one, rather than replace a multicolour cartridge.

<comment><USER3> The practice of charging more for the media than the device is not uncommon. Example: Polaroid.

<comment><USER2> Yea thats true, but if buying a polaroid camera and getting say 10 pictures with it included was cheaper than buying 10 of the media seperately it would be a bit crazy, and thats exactly what I've seen with some printers recently.

<comment><USER4> disposable cameras.

<comment><USER5> Uh. Right. Because the _refills_ for disposable cameras are so much more expensive than the actual camera.

If they sold refills at all, then the camera wouldn't be disposable, so unless this was some sort of joke...

<comment><USER6> Disposable cameras are 'recycled' i.e. refilled. They even announce this on the box.

</comment></comment></comment></comment></comment></comment><comment><USER7> The Brother HL-2040 only costs around $83 or so (newegg). I have one, and I'm very happy with it. Fast. Tidy. Quiet. It's a great printer. For $80 bucks it's an absolute steal.

The toners aren't free, but the price per page is very very low. I think it's in the top 5 of home laser printers. We're talking a few cents per copy here (including paper). A great deal once again. I researched the different printers before I bought one, and I knew full well that Brother can't make much profit on the laser printer itself - so the toners are more expensive. This is great, because this way people who print only semi-regularly can still get affordable laser printers.

Manjoo the author agrees with me: great printer and very inexpensive. So what makes the author think he is getting cheated? Why does he think Brother owes him anything? Why does he feel so outraged? The guy would be HAPPY if the toner ran out 20% earlier, but then he'd have faded pages for a while. Brother decides to put some more ink in there (doesn't cost them much) so the quality is high all the way to the end, and then the toner shuts down.

"Fight back against the lying infuriating evil ink-and-toner cabal?". Please. Thanks to companies like Brother you can get great printers for less than $100. Your efforts to put them out of business by cheating their business model are petty.

Who is -really- the greedy and infuriating party here?

<comment><USER8> Everybody gets so mad about this because a lot of printer vendors go out of their way to force you to not use materials or resources that you purchased, and presumably the only reason is for them to make more profit.

It would be one thing if the printer had a red flashing button that you had to push to override the forced stop (i.e. an explicit, vendor-approved method of opting out of quality in favor of using up something you paid for). Some product owners are fortunate enough to have (generally accidentally) selected products that can be overridden via vendor-unapproved hacks.

While it's quite benevolent that companies like Brother choose to give us "great printers for less than $100", I don't feel that they're beyond reproach for selling me a container of liquid or powder at an exceptionally high price and telling me i can't have the last 5-10% of it for _any_ reason.

It absolutely is infuriating to have a printer that is fully capable of printing a sheet of paper, except that it has been programmed not to.

<comment><USER7> > It absolutely is infuriating to have a printer that is fully capable of > printing a sheet of paper, except that it has been programmed not to.

No, that is exactly the deal you agreed to when you bought the printer. That's the whole point of inexpensive printers. Buy high-end printers if you want lower per-page costs.

You, the customer, make the choice. There's no lying involved by anybody. The terms were perfectly clear up front.

<comment><USER5> The terms were that I get a toner cartridge that I get to use as I see fit. Nothing more, nothing less.

</comment></comment></comment></comment><comment><USER9> This is a major reason why I eBay'd an old LaserJet4 when I needed a printer. It's built like a Mack truck, and it doesn't play games with toner levels.

<comment><USER10> I've got a LaserJet 5 with a duplex unit. The thing weighs a ton, will happily break your back if you try to transport it, and will occasionally get itself into paper jam when you need something printed NOW (mine has thus earned the print queue name of 'satan'), but I still love it. Just gotta keep a parallel port around to plug it into...

<comment><USER11> What about ozone emissions? Somehow I would feel uneasy around dinosaur printers.

</comment></comment></comment><comment><USER12> I want an ink-jet printer with a very large ink canister, enough to print 20,000 pages. Then we could have competition to see who can make those 20,000 pages of ink fit in a smaller canister.

</comment><comment><USER13> This is so true. When I first bought my printer 3 years ago the guy at the store told me the ink cartridge was a small one so it was going to run out fast so I should buy an extra. my low ink light has been on for over a year now yet the print outs still look great.

</comment><comment><USER14> I love my Canon I860 mainly because it's easy to override the nag screen, and it breaks the colors down into multiple cartridges meaning I don't have to replace the whole thing just because blue ran out. That always pissed me off.

</comment><comment><USER15> I actually went to Best Buy to get some ink when I realized that instead of paying $70 for new ink I could spend $100 and get a wireless laser printer (a Brother 2170w). Sounds like this trick could come in handy.

<comment><USER16> afaik, almost all new printers come with half-full ink/toner cartridges.

</comment></comment><comment><USER17> I also wonder about that "engine maintenance" light in our cars, too. It's almost always for maintenance stuff which is, for lack of another word, "elective" (at least at the time).

</comment><comment><USER18> I have just that laser printer in the article. I'll have to bookmark this site for later and keep my black electrical tape at the ready.

</comment><comment><USER19> remember when creed from the office dyed his hair w/ the office inkjet?</comment>


I think Twitter's OAuth-only Access is a Waste of Time - <AUTHOR> http://simplechatter.com/2010/09/i-think-twitters-oauth-only-access-is-a-waste-of-time/ <comment><USER2> OAuth is also a huge pain for those "I just want to write a little Twitter API script in 5 minutes" things. To the extent that I've thought about writing a couple lately, but chose not to because I didn't want to deal with OAuth (and they were scripts I'd want to work in the future).

It seems like there should be some solution that lets me use basic auth for those little scripts. Maybe tell Twitter IP's from which I want to be able to use basic auth? It would be a bit of a pain since most people have dynamic IP's, but it would be better than nothing, and it would at least make it simple to run basic auth scripts on my VPS (which obviously has a static IP).

<comment><AUTHOR> One pain point I've had since switching from Basic Auth has the lack of debugging via a terminal and curl. That was pretty useful.

For Ruby-minded folks there's <http://github.com/marcel/twurl> which is effectively curl that uses OAuth - though it isn't the same.

John Nunemaker wrote a tutorial on how to get get up and running with OAuth pretty quickly (though it is for the Ruby/Rails audience) [http://railstips.org/blog/archives/2009/03/29/oauth- explaine...](http://railstips.org/blog/archives/2009/03/29/oauth-explained- and-what-it-is-good-for/) .

I'll admit getting started with OAuth takes some time to ramp up at first, but that ramp up time gets smaller each subsequent app.

<comment><USER3> It really couldn't be much easier with the twitter gem, and it's way easier to clean up after an "oh shit I left credentials in that public script" moment; just re-generate the secrets on the twitter site.

<https://gist.github.com/cfc477a0c5895e8bd1bd>

Wrote this when I was drunk to prove a point.

</comment></comment></comment><comment><USER4> Twitter's OAuth is a total pain to implement.

If they had just upgraded to OAuth 2.0 like Facebook recently launched, I'd be happy.

Facebook's OAuth can be done in like 10-20 lines of code. Twitter's takes like 100 (in PHP+Curl).

 _(essentially OAuth 2.0 just relies on https SSL instead of directly encrypting tokens via code before they are sent)_

<comment><USER5> Yes, the most painful part is having to copy the pin number manually for non web apps, a real pain. I read twitter is working on the oauth 2.0 spec themselves with facebook and google, so we may get some relief soon.

</comment></comment><comment><USER6> I assume xAuth was put in place for the apps that the user really only accesses directly when they need to change something - things like RSS -> Twitter reposters. In this case an app may not be able to get in touch with a user to inform them they need to authenticate using OAuth. However this could be solved by having the developer email their users to tell them they need to re-authenticate.

Is there an actual reason to use xAuth over OAuth aside from having to put users through the trouble of re-authenticating? You have to have special permission from Twitter to use xAuth but who knows how easily they hand it out.

<comment><AUTHOR> From what I've gathered, if OAuth is the only authentication mechanism and you can't easily redirect a user to a browser and back then xAuth is your best option. Though I suppose you could so something funky like emailing a user a link and have them return back with the PIN (for the Out-of-Band workflow).

Reading the API mailing list it sounds like Twitter is granting xAuth access on a 1-2 week timeline. Though that may be based on the size of the email queues.

</comment></comment><comment><USER7> This makes me quite annoyed as well. Whenever I've asked Twitter about it, they simply say "The applications still use an OAuth access token to access the API, so it's still a secure authentication option." That's not the problem. The application may have to use the access token to use the API, but there's absolutely nothing stopping them from storing the password in their databases behind the scenes.

</comment><comment><USER8> I'll grant you that xAuth is a little convoluted. With that said, Twitter deserves credit for being unprecedentedly accommodating and transparent during the transition away from basic auth. It is obviously in their best interest not to break applications, but this hasn't stopped other social networks _cough_ from yanking the rug from underneath scores of apps with little to no warning.

<comment><AUTHOR> danhak, you make a good point. And I should have probably specifically mentioned that. Twitter Support has really been going the extra mile to help developers make the migration.

</comment></comment><comment><USER9> I wrote a simple script to post an RSS feed that my university uses to twitter. (Actually, I hacked up Stammy's It currently has about 190 followers, but it used Basic Auth so it stopped working on Thursday.

Rather than switching to OAuth, I'm tempted to just write a mechanize script to make posts using the web interface. Has anybody tried this approach?

<comment><USER10> You could just use <http://twitterfeed.com>. Unless of course your script modifies the RSS data significantly before posting it.

</comment></comment><comment><USER11> Its not just password security. A big part of oath is to control the API better. Twitter can now shut down misbehaving apps/sites by revoking their key.

Sure, you might just be able to create a new user and key if you get banned but this still gives them one more tool and a better picture of who is sending what over their network.

<comment><USER12> Even easier, malicious apps can simply use another client app's key. OAuth wasn't really designed for desktop client authentication. The revocation you propose is predicated on the app key being a secret, but desktop clients can't keep secrets.

See the section in the relevant RFC:

<http://tools.ietf.org/html/rfc5849#section-4.6>

</comment></comment><comment><USER13> Could it be that Twitter is going the route of Apple? This raises the barrier to entry just enough to keep out developers who are just goofing around.

Otherwise, no, I don't see it. I know that I'm less inclined to write a little hack to work with Twitter without basic auth.

</comment><comment><USER14> Seems like this author just doesn't realize how painful migrating to OAuth is for a service provider. Of course xAuth isn't a real security improvement to HTTP Basic. But it forces everyone to support auth that isn't inherently broken. So once Twitter stops receiving many xAuth requests, they can just turn it off.

The migration to OAuth 2 will be interesting though. All the existing clients will have the right kind of structure to plug in drop in a replacement flow, but I bet there will still be a bunch of complaints. "OMG I don't want to use HTTPS! This is so hard! Who cares that I can use curl to debug now, I want programming to be drag and drop." Haters gonna hate.

<comment><AUTHOR> joseph, you have a good point about how large of a task migrating all service providers from Basic to OAuth is. And I have to give Twitter Support credit for their work helping developers along the migration.

But your argument still doesn't explain why Twitter's supported service still uses xAuth. Or Twitterrific (and they have a significant market share). What is blocking them from migrating from Basic to non-xAuth OAuth?

</comment></comment><comment><USER15> >"I just want to write a little Twitter API script in 5 minutes"

In that case you would use Out-of-band/PIN Code Authentication. See <http://dev.twitter.com/pages/auth_overview>.

For Pythonistas, my little Twitter API script uses tweepy.py. Thanks to [http://jmillerinc.com/2010/05/31/twitter-from-the-command- li...](http://jmillerinc.com/2010/05/31/twitter-from-the-command-line-in- python-using-oauth) for the steps involved. As an exercise, you could scrape the required PIN with beautifulSoup or similar code to eliminate one step.

</comment><comment><USER16> I don't see what the big deal is. It took me a few hours to update Factor's Twitter library for OAuth -- and that included writing the OAuth support library. The whole thing is only a couple of hundred lines of code.

</comment><comment><USER17> I've created 2 small web apps that made use of Twitter and authenticated via oauth. It's been pretty simple for the most part. Since I develop in rails, I've had the pleasure of using twitter-auth for authentication.

Generally speaking though, this is a great move by Twitter in my opinion. I'm always a bit concerned when a 3rd party website asks for a username and password. In some cases I no longer provide credentials when I know a certain service provides oauth.

It might not be as easy for non-web based applications, but I'm sure things will improve in the long run.

</comment><comment><USER18> I have a non-web, non-desktop based twitter app with a couple thousand users and just haven't had the time available to figure out how to get it doing newAuth.

xAuth seems like it'd work, but, as stated in the article, that involves me going through some hoops to get back to this level of security. woo.

</comment><comment><USER19> For Java or Jython I use htmlunit in Facebook to simulate a browser in the login process, the same can be applied to twitter.

</comment><comment><USER20> yep.I agree.overkill</comment>


My Privacy is none of your Business - <AUTHOR> https://noyb.eu/ <comment><USER2> Raises the paradoxical question: who is allowed to ask why one wants or values their privacy? Simply asking the question violates one's privacy or suggests that seeking privacy is shielding guilt.</comment>


Recap of HackPSU - <AUTHOR> http://innobluepsu.wordpress.com/2013/04/01/recap-of-hackpsu/

<comment><USER2> Great turnout. The enthusiasm and projects were top-notch.

</comment><comment><USER3> Let me guess - it was another engineering sweatshop with sleep deprivation, redbull, adderall, pizza, and body odour. How fun.

</comment><comment><USER3> HackMyJizz... seriously? What sort of demented mind would come up with an idea like that?</comment>