Well, These New Zuckerberg IMs Won't Help Facebook's Privacy Problems - <AUTHOR> http://www.businessinsider.com/well-these-new-zuckerberg-ims-wont-help-facebooks-privacy-problems-2010-5#comments

<comment><USER2> Take a bright guy, stick him in with a bunch of students who likely have connections (sons/daughters of CEOs, politicians, etc.), give him TONS of information about them and tell him not to use it to his advantage.

This is unsurprising.

</comment><comment><USER3> I find it suspicious that this IM conversation that took place over 6 years ago and hasn't been mentioned before, suddenly "surfaces" when Facebook is facing questions about privacy.

</comment><comment><USER4> New? A bunch of these IM conversations have been high profile discussion pieces repeatedly over the last several years. This isn't surprising in the least. The more that Zuckerberg's shit comes to light, the more he looks like a complete douchebag.</comment>


Ask HN: Aren't self-signed certificates preferable to unencrypted connections? - <AUTHOR>

I've had all kinds of issues in the past (as a sysadmin) testing systems with self-signed certificates (before we have real certificates issued). For example, testing a new mail server, a client website, etc. Most systems will show an alert, and many just refuse to work entirely (e.g. SMTP relaying) without a significant amount of configuration change (which then has to be undone later).
But isn't that better than nothing? Even if my blog has a self-signed certificate and you can't say for sure that 'this blog is run by so-and-so', isn't that better than a wholly unencrypted connection? SSL seems to be used for two purposes, namely encrypted connections and validating the remote server, but surely encrypted connections alone are a sufficient benefit? And yet, if all I want to do is have a secure channel, I have to (theoretically) pay a certificate issuer yearly to prove that I am who I am, as if encryption requires I prove my identity.
It would make a great deal more sense to me to treat self-signed certificates the same way we treat HTTP sites: give no notification to the user whatsoever, unless they go looking for it. Browsers could also have a 'strict mode' enforcing the current behaviour (require authentication) for environments or users which prefer it.
The major problem I see here is that sites where you do want to guarantee certificates (e.g. Facebook.com, google.com, bank of america, etc) would be difficult to guarantee that you were connecting to the correct site, since MITM attacks against your SSL connection would be treated like HTTP connections and the browser would let them proceed as if nothing was wrong. I'm not sure if there are tangible ways around that, but it feels worth looking into. <comment><USER2> Self-signed and no encryption are one in the same.

If an attacker is in a position to read unencrypted traffic, they MIGHT be in a position to inject DNS responses, or otherwise intercept traffic. If they can do that, they can generate a new self-signed certificate, MITM, which effectively disabled encryption (without making the user aware).

I will say, I feel like it is "unfair" that browsers give you an error page for self-signed but don't for regular HTTP. Why not just show a self-signed HTTPS page identically to how you would show a HTTP page (insecure, no padlock, etc). Also do mixed content warnings as if self-signed is insecure/HTTP.

An alternative which exists, which a lot of people ignore, is instead of doing self-signed generate your own CA and then sign your own certificate. You can install the CA in the root CA store on the OS and then you won't be using a "self-signed" certificate, you will be using a fully signed certificate with all of the security that that comes with (assuming you keep your root CA offline/safe).

PS - It took me many years to come to the realisation that self-signed encryption is effectively no encryption. You just really have to come at it from the "Starbucks insecure WiFi" perspective. Once you think of it like that, self-signed is too trivial to MITM and thus the encryption can be undetectably circumvented.

<comment><USER3> A regular HTTP connection declares itself to be insecure, and is.

A self-signed HTTPS connection declares itself to be somehow secure, but demonstrably isn't.

<comment><USER2> Neither declares themselves as anything. They're just exposed interfaces. The browser is the one making declarations about a connection's security.

So why not declare both equally insecure (which is true)?

<comment><USER3> That's just not true. Internet users are trained to look for HTTPS security indicators. Nobody is trained to distinguish between "marginally improved security" and "actually improved security". But in the former (self-signed) case, nobody, for instance, should be providing credit cards.

<comment><USER2> Your first and second sentences contradict one another.

You say it is "just not true" (that browsers declare them secure/insecure) and then go on to say "users are trained to look for HTTP security indicators" (exposed by the browsers).

So I'm quite confused about what it is you think I said which is "not true." Since you obviously do agree that browsers declare things secure or not.

Your example about credit cards is entirely non sequitur. It doesn't follow what you said before nor make sense in the context.

I can only suspect you misread something earlier in this conversation as your replies are quite confusing.

<comment><USER3> HTTPS security indicators. An indication that they are on a secure HTTP connection.

</comment></comment></comment></comment></comment></comment><comment><USER4> The problem I see is a false sense of security: Users will just see a lock in their address bar and think they're safe -- even if they're on a phishing site with a self-signed certificate.

It appears that users have been conditioned to look out for at least that little lock symbol, so devaluing it now would throw a lot of user training down the drain and give phishers fresh wind.

<comment><USER5> Why not then just treat the page like it's unencrypted? For the users trained to look for the lock icon, they could look up to the bar and see it marked like an unencrypted page.

I've just seen the false sense of security argument backfire. I remember a sysadmin performing a "security upgrade" by converting a self-signed HTTPS server into an unencrypted HTTP server. The users were quite happy that their data was far more secure than it was under the old regime with the scary warnings, despite the fact that they were now being sent completely in the clear.

<comment><USER6> What about users who aren't trained to look for the lock icon, but rather for the https?

(I'm in that group)

</comment></comment></comment><comment><USER7> They keynote at shmoocon this year actually asked browser vendor's to trust self-signed certificates more then standard HTTP connections.</comment>


iOS Games with Joy(stick) - <AUTHOR> http://www.nanaimostudio.com/blog/2012/7/26/ios-games-with-joystick.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+idevblogaday+%28iDevBlogADay%29

<comment><USER2> for the Arduino + iOS lovers out there.</comment>


Visual Studio Code version 1.3 - <AUTHOR> https://code.visualstudio.com/updates/June_2016 <comment><AUTHOR> Some previous submissions:

* [https://news.ycombinator.com/item?id=12052856](https://news.ycombinator.com/item?id=12052856)

* [https://news.ycombinator.com/item?id=12052525](https://news.ycombinator.com/item?id=12052525)

</comment><comment><USER2> Finally tabs! This is an awesome feature. Now they just need to pop out so I can drag them to another screen.

<comment><USER3> I actually liked not having tabs, I'm a little sad about this. It was nice to have something at least trying something different for once, instead of doing the exact same thing everyone else is doing.

<comment><AUTHOR> "If you prefer not to use Tabs, you can disable them through the workbench.editor.showTabs setting."

<comment><USER3> You _can_ disable them, but disabling them makes you the weird guy using the not well supported workflow. I'd much rather have it the default.</comment></comment></comment></comment>


Ask HN: How do I report a Facebook vulnerability? - <AUTHOR> Seems u can log in via a link without a password <comment><USER2> [https://www.facebook.com/security.txt](https://www.facebook.com/security.txt)

<comment><USER3> Funny thing, you have to use a FB Account to submit an issue. _facepalm_</comment></comment>


Ask HN: Is it worth competing with Google? - <AUTHOR> After Google's announcements in the last few days, it seems like they are leaving their competition in the dust.
They continue to dominate search. Bing seems to exist just to exist. There's no viable competitors.
The new Google Photos (coupled with the existing Google Drive) pretty much kills Dropbox/Box/etc at consumer level. Can Dropbox or anyone else match the search power in the new Google Photos?
Self driving cars are fast approaching. Will anyone beat Google at this?
Maps will have offline navigation soon. Why use Bing or Apple maps?
Android is everywhere. Google Now and their new Google Now features look great.
Is there any space that they are not in / won't enter?
My main point for asking is because I want to make a news website similar but not identical to Google News. If I made the site and IF it was a roaring success.. Google could just replicate it and because they have mountains and mountains of data they could probably do it better. <comment><USER2> _> ... kills Dropbox/Box/etc at consumer level ..._

It takes more than just being better when you are late to market.

 _> Self driving cars are fast approaching. Will anyone beat Google at this?_

Uber? They are the fresh blood and moving fast in everything.

 _> Maps will have offline navigation soon. Why use Bing or Apple maps?_

I use Nokia Here Maps. They have offline navigation today. On my device. Which is not Android.

 _> Android is everywhere._

Not on iPhones. Not on content-producing devices.

 _> Google Now and their new Google Now features look great._

2015s version of Clippy. Predictive analysis is not ready. Beware of the hype curve.

 _> Is there any space that they are not in / won't enter?_

Their business is still revolving around ads. They are lagging in enterprise. They cannot beat Amazon at shopping. They cannot beat Apple/Microsoft at premium device design quality. They are not perfect.

PS: It's great that Google exists, but don't put it on pedestal.

</comment><comment><USER3> >Self driving cars are fast approaching. Will anyone beat Google at this?

I never understood this one. What do self-driving cars have to do with Google's core business (search and advertising)? It sounds more like Google executives wasting money on a cool-sounding research project, than something related to their other products.

Self-driving cars are an interesting and important problem. I don't see why this would be something Google would be doing better than anyone else.

Regarding OP:

Making a news website is going to be HARD. Even if Google doesn't copy your site, why are people going to go to your website instead of Google/Yahoo/CNN/etc? It's going to be very hard to make enough money with ads to cover your expenses.

But it isn't going to be that easy for Google to steal your product if it's successful. One word: Google+.

<comment><USER4> Self driving cars is a natural off-shoot of Google Maps. By pushing this standard, Google can ensure at least revenue sharing if they don't get the entire self driving car business. It simply adds to data consumption which they benefit from. No different from Google Fiber.

</comment></comment><comment><USER5> People said thing like this 20 years ago about Microsoft and look how that turned out. The bigger Google gets the slower it will become - it is only a matter of time before the next big thing comes along.

<comment><USER6> and before Microsoft it was IBM...

</comment></comment><comment><USER7> Google tends to solve problems through engineering, rather than through user experience and design (unlike, for example, Apple).

> The new Google Photos (coupled with the existing Google Drive) pretty much > kills Dropbox/Box/etc at consumer level.

Google Drive, imo, has an abysmal user experience. Dropbox, on the other hand, is great (though it does have its own set of issues).

> Android is everywhere. Google Now and their new Google Now features look > great.

Android hasn't even managed to get scrolling working smoothly, after like 5 years. I've used Android devices before, and this is my biggest annoyance. That, plus getting lost in features. I just want stuff to work, which is the main advantage of iOS.

To answer your question: yes, it's entirely possible to make a superior product compared to Google News.

</comment><comment><USER8> Google News looks like a half-abandoned service - last blog post is dated "August 27, 2014" [1]

[1] [http://googlenewsblog.blogspot.com/](http://googlenewsblog.blogspot.com/)

<comment> andrew-lucker If it is still running, then it at least has operational staff responsible.

</comment></comment><comment> andrew-lucker Google has a lot of data but proportionally fewer people. If you pursue your venture, you can put more attention to specific areas than Google will ever care to do. Find a niche and start digging a trench.

</comment><comment><USER6> Yes, Google are still a very innovative company with some really clever people working for them. But are they invincible? Most definitely not. (Just look at history.)

Like most free web services, Google makes it's money from people's personal data. With an increasing number of people, that's a pretty unpopular business model. Especially in places like Germany, many people do actually care about their privacy - and Snowden has additionally done a lot of damage to the image of American companies in that respect. As a personal example, I have been virtually "Google-free" for over a year, and am doing great. I switched from GMail to another email provider, and started using DuckDuckGo as my search engine (which, in my opinion, is technically superior as well as more privacy- aware).

Even if every single one of their products was the most technically advanced on the market (which is not the case), there would still be a significant market share for companies who cater to people who do not want to sell their digital souls to Google.

<comment><USER9> Can you explain why you find DuckDuckGo technically superior to Google Search? I tried switching to DDG a few months back and found that the results were less relevant overall.

<comment><USER6> I really like the "bang" searches they provide. I agree that their actual search results are not quite as good as Google's, but the ability to search the site I want straight from my browser search bar is brilliant.

</comment></comment></comment><comment><USER10> Google is fair game in anything whether the ability to provide customer service matters to an audience.

News is the other end of the scale: Google arguably could and should do it better considering how close it is to their core competency, but it's a lawsuit minefield rather than a cash cow for them.

</comment><comment><USER11> Yes, I think you can compete. Google has a core group of products (search, android,chrome, new products) in which they invest most of their time, and the rest has little or no development occurring. Google news fits this category, so you probably could compete.

</comment><comment><USER12> Android is killing iOS? They're going to make self-driving cars soon? Maps has won? No other search can compete? Google photos kills all the other ones? This has to be the most rose-tinted view of Google I've seen in a long time.

Here's how I see google's typical attempt:

1\. Close but no cigar. 2\. Waiting to be killed off. 3\. Perpetual Beta (see #2). 4\. Screw yesterday, THE FUTURE is where it's at. 5\. Fall back to the search fortress!

And while Larry Page is trying to become a cyborg that drives himself to work, Sergey is off heli-skiing-board-diving to _test_ google glass.

</comment><comment><USER13> All of the products that you mentioned have huge flaws, at least for my purposes. For me, search quality is astonishingly low, so much that I Yahoo/Bing/Baidu/Yandex now, except when looking for local businesses. I won't go into the other products that you mentioned but I feel like I have legitimate criticisms of them, too.

Maybe I am just different from the masses. If you think News is defective, then maybe other people will agree with you, but not enough to cause Google to want to copy you.

</comment><comment><USER14> If it helps, I sometimes wonder whether this thought crossed the mind of Sergey Brin and Larry Page when they were starting Google:

"Is it worth competing with Microsoft? Is it worth competing with IBM? Is it worth competing with Yahoo?"

In hindsight, it obviously was! But I do wonder what they thought at that time.

</comment><comment><USER15> If you do a _really_ good job, then the first thing Google would try is to acquire you. Google cannot 'engineer away' the loyal user base that you would have by the time you hit 'roaring success'.

</comment><comment><USER16> Search and Maps seem to be a core of Google. If your doing something outside of this then sure its worth it. Look at how often Google drops something. Google Reader etc</comment>


Google's Project Zero team discovered critical CPU flaw last year - <AUTHOR> https://techcrunch.com/2018/01/03/googles-project-zero-team-discovered-critical-cpu-flaw-last-year <comment><USER2> > They also indicated their Project Zero team discovered this vulnerability > last year (although they weren't specific with the timing).

Last year was four days ago. Headline is one of those delightful sensationalist opportunities you only get for a few weeks each year.

</comment><comment><USER3> Semi-sensational headline makes it seem like they've known this for well over a year. It's been known for approx. 6 months.

<comment><USER4> Feels like companies is starting it's not a problem or known for a period of time, how are you coming up with approx. 6 months?

<comment><USER5> From [0]:

>Variants of this issue are known to affect many modern processors, including certain processors by Intel, AMD and ARM. For a few Intel and AMD CPU models, we have exploits that work against real software. We reported this issue to Intel, AMD and ARM on 2017-06-01 [1].

[0] [https://googleprojectzero.blogspot.com.es/2018/01/reading- pr...](https://googleprojectzero.blogspot.com.es/2018/01/reading-privileged- memory-with-side.html)</comment></comment></comment>


How I Was Nearly Seduced by Grouper, the Biggest Sham in Online Dating - <AUTHOR> http://gizmodo.com/5845467/how-i-was-nearly-seduced-by-grouper-the-biggest-sham-in-online-dating

<comment><USER2> from the actual CEO in the comments:

"Michael, CEO and Founder of Grouper here.

Sam - We set you up on an actual Grouper (of which we've done over 200). You, without warning, arrived with cameras and a fourth person then told the girls you were going to use their real identities in your piece. They promptly stormed out, immediately called us to complain about this (and that you were disrespectful to boot), and demanded a refund (which we of course granted them).

We never showed you our matching process or logistics engine (we gave you a single screen shot of one admin dashboard - off the record).

This is irresponsible journalism.

Also, I would kindly request an apology to the three poor girls (who were actual members who we never met) whose night you ruined.

If anyone has any more questions about Grouper I'd be more than happy to answer them.

\- Michael email@example.com"

It sounds like the guy that wrote this article is the asshole here.

</comment><comment><USER3> Be sure to read the rebuttal from the CEO in the comments section.</comment>


How to match "A B C" where A+B=C with a regex - <AUTHOR> http://www.drregex.com/2018/09/a-regex-i-submitted-to-reddit-climbed.html <comment><USER2> And here's a followup: [http://www.drregex.com/2018/11/how-to-match-b-c-where- abc-be...](http://www.drregex.com/2018/11/how-to-match-b-c-where-abc-beast- reborn.html) (with a rege101 demo that's still live)</comment>


Programmers at Work 1986: Where are they now? - <AUTHOR> http://crummy.com/2008/02/17/0

<comment><USER2> The original is a great read, I would highly recommend it.</comment>


Visualizing Git Concepts with D3.js - <AUTHOR> http://www.wei-wang.com/ExplainGitWithD3/# <comment><USER3> See also "Learn Git Branching": [http://pcottle.github.io/learnGitBranching/?demo](http://pcottle.github.io/learnGitBranching/?demo)

<comment><USER4> The Ungit[1] gui can also help you to visualize git operations like merging and rebasing commits. Here's the youtube demo: [https://www.youtube.com/watch?v=hkBVAi3oKvo](https://www.youtube.com/watch?v=hkBVAi3oKvo).

[1]: [https://github.com/FredrikNoren/ungit](https://github.com/FredrikNoren/ungit)

<comment><USER5> That's exactly what I was just thinking I wished existed!

</comment></comment></comment><comment><USER6> This is really cool - I wish I'd had this for teaching git a few weeks ago.

FYI - it looks like branch creation is broken. Creating a branch and following with `git commit` gives the error "Not a good idea to make commits while in a detached HEAD state." It's not a detached HEAD, it's a branch.

<comment><USER7> _Excuse the self promotion_ I wrote a tool aimed at teaching git at [https://github.com/Gazler/githug](https://github.com/Gazler/githug)

<comment><USER8> ok, I need to download && install just to see a demo?

Maybe you should create a demo page.

</comment></comment></comment><comment><USER9> New to git as well as programming in general. This site has helped me somewhat, but I'm still confused about some basic concepts. Aren't the arrows all facing the wrong way? What happens to a commit after 'git reset' abandons it; can the commit be accessed ever again? What's the difference between reset and revert? How can merge and rebase be trusted? What are the best practices for how many branches a project should have and how & when should they be merged? And what are remote tracking branches? Since I only program alone so far, my friends tell me not to concern myself with these questions until I am forced to do so in a practical situation... but that doesn't satisfy me.

<comment><USER10> I can attempt to answer your questions briefly

Aren't the arrows all facing the wrong way?

>> No, the arrows are in the right direction. Git maintains a Directed Acyclic Graph (DAG) of commits. Each new commit created points to 0..n parents. So let's say you were on the first commit, and then you created a new commit. The newly created commit is the "child" of the first commit, and has a "parent" pointer that is the SHA of the parent. The parent cannot have pointers to the children since they don't know that one will be created!

Now, if you were to do a merge between branch a and b, assuming it's not a fast-forward merge, a new child commit is created that will have 2 "parent" pointers - the SHA of a and b.

A commit will have 0 parents if it the first commit in a repo.

What happens to a commit after 'git reset' abandons it; can the commit be accessed ever again?

>> That commit is "lost". I put that in quotes because git dosen't immediately throw away the commit (rather there is a garbage collection process that will eventually remove that commit). For the same reason if you happen to know the SHA of the commit you just reset, then you can do a "git checkout <new_branch> <sha>" and create a branch off that commit.

One way to get to that "lost" commit is to use "git reflog" \- the reflog (that is ref-log) is a lot that updates each time the "HEAD" moves. Since when you do a "git reset" the HEAD moves from the current commit to another one, the reflog will record that.

What's the difference between reset and revert?

>> "reset" is "destructive" in that it can leave dangling commits. A dangling commit is a commit that nothing else points to. Remember the DAG? Well that means that every commit (except) the last commit has a child pointing to it. And who's pointing to the last commit? The branch, and the HEAD. If a commit has NO ONE pointing to it, it is eligible for garbage collection.

Furthermore, since a reset can "delete" commits, one usually never "reset"s public commits - that is commits that have been pushed upstream (to Github or what-have-you). The reason being - if someone else pulled that branch and started working off that commit, and you reset it, it leaves the other person in an unknown state when you do a push.

If you wish to "undo" a public commit, you should revert. If you see the visualization you will notice that "reset" blurs out the last commit, while "revert" creates an "anti-commit" \- that is a commit that undoes everything the other commit did.

How can merge and rebase be trusted?

>> I am not sure what you mean by that? Do you mean will Git screw up? Or how do you know that a git pull (which could merge or rebase) pull in commits that have been verified?

What are the best practices for how many branches a project should have and how & when should they be merged?

>> This is a "depends on" answer IMO.

ONE approach is that all "work" should happen on short topic branches off the "integration" branch (which in many cases is master). Commits are made, and things are reviewed, and tested they are merged into master.

This also means that each developer on the team merges one branch per feature into master. Every time you are ready to merge your code into master you first rebase master (which plays your commits on top of master) and then merge into master.

FWIW I am giving you the 30 second answer, but this needs a detailed explanation.

A few resources to get you started -

[http://git-scm.com/book](http://git-scm.com/book)

ftp.newartisans.com/pub/git.from.bottom.up.pdf

[http://eagain.net/articles/git-for-computer- scientists/](http://eagain.net/articles/git-for-computer-scientists/)

Good luck!

<comment><USER9> Thanks for answering so many questions. And thank you bodhi and rcxdude as well! I had an idea that best practices might still be an emerging topic. My unclear question about merging was indeed about conflicts, so I'm glad to hear that the merge philosophy is to be "stupid" as rcxdude said. I'll do some more research and check those links.

<comment><USER11> The best resources I've found for understanding git workflows are by Vincent Driessen[1] and Atlassian[2].

The Atlassian page is much more comprehensive, and in fact derives the 'GitFlow' workflow from Driessen. However, I prefer his original top-to-bottom representation (a left-to-right time axis seems less intuitive to me - <USER2> remind me of a football playbook rather than a waterfall).

[1] [http://nvie.com/posts/a-successful-git-branching- model/](http://nvie.com/posts/a-successful-git-branching-model/) [2] [https://www.atlassian.com/git/workflows](https://www.atlassian.com/git/workflows)

</comment></comment></comment></comment><comment><USER12> After having seen a few learn-git tools on HN and other programming forums, I would have to say that this is my personal favorite. What this tool does exceptionally well is teach the core git concepts from a visual point (seeing as it's git this works very naturally) instead of asking the user to memorize an incredibly small subset of the git commands. Often this leads to a lot of trouble when you get into a real-world scenario that some inappropriate learn git tutorial didn't cover. Fortunately, I think visualization tools like this should help ;) Perhaps github could incorporate this into their Try Git page?

</comment><comment><USER13> It seems cool, but I don't understand why I can't just click multiple times instead of having to type the command several times. That UI decision makes the site nearly unusable on an iPad.

<comment><USER14> I think I do understand: the author either did not think this was going to be used on a tablet (after all, it teaches git in it's bare cli form, not by the aid of an point-and-click ui) - or just didn't care about it (for pretty much the same reason, or because he thought there aren't many people using git cli on a tablet anyway).

</comment></comment><comment><USER15> This is great, kudos to the dev!

Like others who wished they had this while teaching git, I wish I had this while learning git.

However, the interaction seems a bit clunky - after doing a `git fetch` I wanted to try a `git rebase` but realized I had to click on the `git rebase` option first before typing it out. Maybe remove the need to click the option first OR clicking it will automatically type stuff for you. Basically, it's a two step process that once needs one.

<comment><USER16> Thanks, I'm glad you like it.

You do not have to click the 'git rebase' option before typing it out, actually. All of the (supported) commands can actually be used anywhere.

</comment></comment><comment><USER17> I was surprised and gratified to see that pressing 'up' in the terminal window did exactly what I was hoping it would do.

<comment><USER18> but not tab.

</comment></comment><comment><USER19> This is great for teaching git, a nice add-on to the tool would be to add command by command playback of custom scenarios and see them pan out. Also it would be interesting to grab tons of different history records from developers' shells and get common git patterns and play them back with this tool.

<comment><USER20> In addition to this, I think something that would help me a lot is being able to step back and forward through any history of commands that I'm experimenting with.

Great stuff!

</comment></comment><comment><USER21> I absolutely love D3, it's what we've been seeking for a very long time and finally a decent product was created. Prepare to see this blow up and take over the web soon.

<comment><USER22> D3 already underlies quite a few popular visualization libraries. While you can use D3 directly, it's kind of a toolkit for creating visualizations, so it's often hiding 'behind the scenes' in libraries you already know and love.

</comment></comment><comment><USER23> Very nice, thanks for making this. I tried crazy workflows and the history tree had multiple levels. If possible, could you add scrolling to the visualization viewport?

</comment><comment><USER24> Can't wait to see this working as a plug-in for Atom (github's new text editor). Since Atom plugins are written like browser extensions (in javascript)...

</comment><comment><USER11> Nice work!

This is a great complement to the codeschool tutorial [1] it would be nice similarly offer the feature that clicking on the command will auto-populate the virtual terminal. New git users might be more likely to use a client-side GUI where they are clicking buttons rather than typing in the terminal.

[1] [http://try.github.io/](http://try.github.io/)

<comment><USER8> Oh thanks, never new that one existed. :)

</comment></comment><comment><USER25> This is a great teach aid, hits the mark.

Further, if this style of material were applied to crypto (gpg), more people might be comfortable using it.

</comment><comment><USER26> This is fantastic. It's amazing how the right graphic can really clarify a somewhat tricky concept like merging.

</comment><comment><USER27> This just taught me more than any git tutorial I've read. What a great visualization!

</comment><comment><USER28> This is probably my favorite post ever on HN. Very enlightening. And, like lots of good things.... it's simple.

As others have mentioned, it would be nice to scroll down the diagram.

But, I guess if this were really wanted, git clone would be the first step:)

</comment><comment><USER29> this is pretty cool and I have been meaning to do sort of this for some time now. I even registered a domain for it: simgity.com (a simulator for git).

Happy to "donate" it if the author is reading

</comment><comment><USER30> This is a great visualization, this should definitely be taught alongside any existing Git tutorials. I just wish the canvas would allow scrolling, or resize automatically.

</comment><comment><USER31> I thought the new comments rule would ban the whiners, nitpickers and nay- sayers, but it seems all just like it was before. :O Kudos to the developer, who made this tool.

</comment><comment><USER32> I see this as a great tool for teaching the basics of git. Definitely saving this for the next time I have to explain why branching is useful and how it works. Great tool.

</comment><comment><USER33> constructive criticism: I'm a git user, but, if you need D3 graphics to explain a svc... can we at least accept that git concepts are not intuitive?

<comment><USER34> We switched over to git from svn recently at work and the amount of confusion and accidents is crazy. I've been using git (mostly solo to two coworkers) for years, but there are still issues I run into where I'm stumped. I look things up all the time.

You kind of need git training in cases like this. Unfortunately, we didn't have any.

</comment></comment><comment><USER35> I thought this was pretty awesome :) Would be great if it were fleshed out a little more with more complex examples. Kudos!

</comment><comment><USER5> Either something wasn't working for me, or the 'branch' function is completely over my head.

</comment><comment><USER36> funny how the git push one doesn't work until you git pull, but it doesn't tell you you have to do that, it just assumes you knew.

</comment><comment><USER37> Can anybody suggest good D3 books?

<comment><USER38> I'm using Interactive Data Visualization for the Web by Scott Murray

[http://shop.oreilly.com/product/0636920026938.do](http://shop.oreilly.com/product/0636920026938.do)

You can read it for free at Oreilly's Chimera labs

[http://chimera.labs.oreilly.com/books/1230000000345](http://chimera.labs.oreilly.com/books/1230000000345)

</comment></comment><comment><USER39> This is great, thanks.</comment>


Ask HN: How could you make/find a spider for JSTOR articles? - <AUTHOR>

<comment><USER2> Ask the federal prosecutors in Boston - they have a lot of information gathered already.

On a not so sad note - writing a high performance fully async spider is a trivial task so it is just a matter of guessing the urls

<http://www.jstor.org/stable/i40055831> \- this seems to be the issue format just regex for them

there the articles url are in

<http://www.jstor.org/stable/41237135> this format. So parse any page for those links and keep already crawled and html downloaded.</comment>


Sony's PlayStation 4 Will Launch "This Holiday Season" For $399 - <AUTHOR> http://techcrunch.com/2013/06/10/sony-ps4-price-launch-date/ <comment><USER2> Well it certainly seems like they learned from the PS3 launch. They also appear to have found a fairly snarky marketing team too [http://www.youtube.com/watch?v=kWSIFh8ICaA](http://www.youtube.com/watch?v=kWSIFh8ICaA)

<comment><USER3> __* The foregoing instructional video applies only to disc based games __*

PS4 multi-player online access requires PSN account & PS Plus subscription.

Kind of a buzz kill.

<comment><USER4> Eh, not everybody likes to play online, and at least you don't need the paid online account shit to use other internet requiring services like netflix.

I think I might make this the first console I've owned in a decade... Just about everything about it makes a lot of sense to me.

<comment><USER5> Indeed, and you also get a bunch of neat stuff when you subscribe to PS+ like free games and discounts. You also don't need it for all games, F2P games for example are exempted from it at the discretion of the publisher.

</comment></comment></comment></comment><comment><USER6> I was very surprised at the price, but with the ability to play online multiplayer now being a part of Playstation Plus, they can afford this. I was impressed by both conferences, but assuming Holiday season is November, I think the PS4 is looking really good.

Also, Kingdom Hearts 3. That alone kind of made my day.

<comment><USER5> KH3 will be available on both consoles.

</comment></comment><comment><USER7> Sony clearly _lost_ the last battle in the console war, so it makes sense for them to try to undercut Microsoft in the next round.

Microsoft seems to be making a bet that people want their consoles to do more. Sony seems to be focusing just on delivering a better pure gaming experience. I get the sneaking suspicion that "gamers" are going to like Sony's approach more.

Edit: Sony apparently didn't "clearly lose" the current-gen battle.

<comment><USER8> The PS3 installed based is larger than the XBox 360 installed base: [http://www.vgchartz.com/](http://www.vgchartz.com/)

And the PS3 was released a year later than the XBox 360.

<comment><USER9> According to the chart, we're talking 77.6M vs. 77.5M. That's really splitting hairs about who is 'first.'

The part that's missing here is that those stats are after ~8 years of normalization. Many people that only bought a single console at first may now have two or three from that generation (i.e. could only afford one console, but over the course of close to a decade could save up and buy one or two more, especially after price drops).

The PS3 was also one of the first BluRay players, and IIRC in Japan Sony is a more trusted brand than Microsoft (or at least _was_ ). These are all factors at play here.

</comment></comment></comment><comment><USER10> I am certain that the PS4 will do better than Microsoft simply cause of the privacy situation. I really can't stand the idea that XBOX one has to have the camera on at all times!

</comment><comment><USER11> This is VERY interesting. The console business is living proof for all entrepreneurs that past success DOES NOT dictate FUTURE success. And consumers are NOT as loyal to your brand as you think they are. It's anyone's game and you have to win over your customers each and every decade.

=== SONY ===

[Gen1] Playstation (1st place) 102 million units

[Gen2] Playstation 2 (1st place) 154 million units

[Gen3] Playstation S3 (Last place) 70 million units

Sony slipped from being 1st to nearly last. The original lack of online support & multi-media online content of the X360, The "Cell Processor" mistake, high $600 price really hit the PS3 hard, it made up for it by including a blu-ray player though and later free online multiplayer.

=== Nintendo ===

[Gen1] N64 (2nd Place) 33 million units

[Gen2] GameCube (3rd Place) 22 million units

[Gen3] Wii (1st Place) 100 million units

Things were getting bad for Nintendo until they tapped into an unknown market known to us now as "Casual Gamers". Before 2004 (much before FarmVille and other casual games) I had honestly never even heard the term at all throughout my life. Well done at discovering a new market.

=== Microsoft ===

[Gen1] n/a

[Gen2] Xbox (2nd Place) 24 million units

[Gen3] Xbox 360 (2nd Place) 77 million units

Out of no-where Microsoft (one of the most hated companies in America at the time _which inspired Google 's original "Don't be evil" moto_ ) got itself up to 2nd place consistently by catering to "Gun-Bros" and hard core gamers (the type that go to a lan party to play Halo Matches) and delivering online content near perfectly (except for the price tag of Xbox Live). It revived an old idea (playing online with strangers, something that Sega tried and failed at twice) and made it work. It also helps that internet penetration rates were much higher than the days of Sega. It also introduced the standard "achievements" and "gamertag" that we now see all over the place. And it was the 1st to launch during the Gen3 console wars.

=== Moral of the Story ===

Last year's winners are this year's losers and last year's losers are now at the top. How differently will things change in the Gen4 console wars? So far the "Wii U" is doing terribly. PS4 looks the most innovative, and Xbone looks like Microsoft's attempt of control and conquering everything in the living room without asking the consumer for input (M$ as usual).

<comment><USER5> Your current gen numbers are a bit old. PS3 is now in second place (barely, 77.6 million units vs 77.5M for Xbox 360).

</comment></comment><comment><USER12> I wonder what Microsoft's thought process is behind the "no used games" policy. Anything I'm missing?

<comment><USER2> I'm guessing they expected a similar policy from Sony. Whether or not they had one and killed it after seeing the reaction to the XBox One is impossible to know, but we do know that publishers absolutely hate the used games industry, plus Microsoft (and Sony) take a cut of every new game sold so it's in their interest to move more new copies too.

I personally am not a fan of used games (I don't see it as being much better ideologically than piracy, since the people who made the game are not getting compensated on resales which provide an identical experience to one that you get brand new), but publicity-wise it's a very smart move on Sony's part.

<comment><USER13> I personally am not a fan of used cars (I don't see it as being much better ideologically than theft, since the people who made the car are not getting compensated on resales which provide an identical experience to one that you get brand new), but publicity-wise it's a very smart move on Honda's part.

<comment><USER14> If you are trying to compare games to cars, then the analogy doesn't translate to digital products at all.

Non-digital products degrade as they are used. A car only has a certain number of kilometres in it. The older the car is, the worse it is to drive and the more it costs to run.

Digital goods either work or they don't. If you buy the same digital good used then you get the exact same experience as the person who bought it new.

Things that don't wear out are just different.

<comment><USER7> The degradation of the non-digital product isn't what's important -- it's the _value_ of that product that is important. Oftentimes (like in the case of most cars), the _value_ is closely related to that degradation, but that's just the case for cars.

The value of a digital product like a video game declines over time, as well, even though the data on the disc doesn't degrade. The _experience_ degrades. If that weren't the case, the used games store would be able to sell a used game for a lot more than they do.

If publishers and studios really want to kill the used games market, they'd acknowledge that their games lose value over time, and drop the prices over time accordingly. Which they do, just not enough, apparently.

<comment><USER14> Those are two types of value degradation, and I don't think you can compare those either.

A used game can be sold next to a new game at the same point in time and the used game will be priced cheaper. You will get an identical experience regardless of which you buy, that is to say, the real value of both is identical.

The shop only prices it cheaper to encourage you to buy it, because they have a higher profit margin on used games.

If you drive a car about for 50,000KM and put it back in the shop, now that car is has lower real value than the new one next to it.

<comment><USER7> _" A used game can be sold next to a new game at the same point in time and the used game will be priced cheaper."_

 _" The shop only prices it cheaper to encourage you to buy it, because they have a higher profit margin on used games."_

So why isn't it the publishers job to ensure that neither of these statements are true? That is, two months in, why haven't they dropped the price of the new game enough to make it attractive compared to the used copy? If they can't make any new sales because the used copies are so much cheaper, what's the point of maintaining that price?

<comment><USER14> The economics of used games just don't work that way.

Before the player has played the game, the value of the game disk is shown to be at least $60 dollars to that person. They show that by paying that price.

Once a player has completed a single player game, the value of the disk to that person is now zero. Given the opportunity, they will sell the game at any price they can get. They will happily trade the game in for $5.

To a new player coming along, they may still pay $60, but if there is a used (and effectively identical) copy sitting there for $55, why not buy that instead?

A shop will price match a used game down to below any price that a publisher could conceivably wish to charge because they only pay a tiny price for the identical product used.

> That is, two months in, why haven't they dropped the price of the new game > enough to make it attractive compared to the used copy?

The comparison is meaningless because they are identical. The cheaper price always wins, and the used game will always have the cheaper price.

Used cars are fundamentally different than digital goods due to the fact that they can be consumed infinitely without devaluing the physical asset.

<comment><USER7> _"... the value of the disk to that person is now zero. Given the opportunity, they will sell the game at any price they can get. They will happily trade the game in for $5."_

But that's not really true, at all. "Replayability" is a term that gets tossed around, _a lot_ when describing single player games. If "the value of the disk to that person is now zero" were true, it's a term that wouldn't even exist.

Additionally, I hate to resort to anecdotes, but I'm not sure if there's any unbiased research in this area -- but I don't know anyone who buys a brand new game, plays it for a month, and then "will happily trade the game in for $5." I mean, I'm sure there are people who do fit that mold, but if that were true, then all the used games shops would only give you $5 for any month-old game. But those month-old games command a much higher price than that, precisely because people aren't happily trading in the game for $5. This is really basic econ 101 stuff here. Supply and demand.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> So now MS is competing against PS4 & Apple TV with a product that costs as much as the two combined.

Microsoft can't subsidize the HW if they are aiming for the TV audience. I think their strategy is flawed.

</comment><comment><USER16> It's $399 because it doesn't include the camera [0]. You can also use other apps without paying it's $50/year to play multiplayer games / PS+. We'll have to wait a year or so though for it's exclusive to catch up with Microsoft's. In two years when tablets get more RAM and cores, and if tablet games get serious the death of consoles AND handhelds will be increased. After all, unless you have people over, personally I would rather play outside, PS Vita style remotely connected to my PC. So. There. Instant startup opportunity. The closest I've found, is what I use with my PS3 controller [1]. I'm looking for something like the Vita, but for the PC because I'm done with consoles. Unless it gets 10+ games that I'm interested in, there's no point. Who wants to be forced to buy the camera, and be monitored like that. IMO, Japan's morals and culture continues to be the best choice when it comes to gaming.

[0] [http://www.amazon.com/PlayStation-4-Camera/dp/B00BGAA3S2](http://www.amazon.com/PlayStation-4-Camera/dp/B00BGAA3S2) [1] [http://buy.thegameklip.com/](http://buy.thegameklip.com/)

<comment><USER17> Does no one consider comparing the consoles by their hardware specs? Or is a console just a console and do specs not exist? It's seriously amazing that they priced it at $399 with what they are shipping. Could've easily been at $599+. PS4's spec are far superior.

<comment><USER18> Far superior? Reference? [http://www.nowgamer.com/news/1942974/ps4_xbox_one_hardware_v...](http://www.nowgamer.com/news/1942974/ps4_xbox_one_hardware_very_closely_aligned.html)

Also, PS4's missing the Kinect entirely, so I don't think the price point is amazing.

<comment><USER16> Not sure- somewhat, but here's the best comparison I've found online: [http://www.anandtech.com/print/6972/xbox-one-hardware- compar...](http://www.anandtech.com/print/6972/xbox-one-hardware-compared-to- playstation-4)

</comment></comment></comment></comment><comment><USER19> They just murdered the xbox one.

<comment><USER20> Is price really how folks decide which to buy? Even if a couple hundred dollars separates them, it does not change my choice.

<comment><USER21> That must be nice.

<comment><USER22> That's not entirely fair, we're talking about premium entertainment devices with a minimum price of $399, the difference is only 20% of that.

</comment></comment></comment></comment><comment><USER23> The question is then why would anyone buy their just announced PS3 bundled with GTA5 for $299? Do they figure that since GTA5 comes out in September that they can get a couple months worth of sales in before the PS4 launch?

<comment><USER24> This is the best time to buy consoles. The prices are rock bottom, and there are hundreds upon hundreds of great and really inexpensive games that are pretty widely available.</comment></comment>


Why Chris Hughes And Google Are Giving Cash Directly To The Poorest - <AUTHOR> http://www.forbes.com/sites/kerryadolan/2013/05/28/why-google-and-facebook-cofounder-chris-hughes-are-giving-cash-directly-to-the-poorest/ <comment><USER2> Interesting that developed countries do not implement a similar system for their own poor. Friedman and Hayek both believed such a system was superior to merit-tested social assistance programs which require massive bureaucracy and are prone to abuse.

Hopefully, with the success of such charities in developing countries we will see increasing support for such systems here at home, allowing people to escape the vicious unemployment trap of western economies.

(Edit) Additionally, the implementation of basic income at this point would be extremely effective, as it would leverage the massive revolution in freely available online education (e.g. Khan Academy, EdX, Udacity, Coursera) and cooperative workspaces (e.g. hackerspaces). This would effectively transform the entire country into a startup incubator, giving those with the desire and talent to build new companies the resources to do so immediately, without going through the excruciatingly slow, inefficient and oftentimes counterproductive process of formal education.

<comment> a-priori I've been thinking a lot about basic income schemes lately, which do exactly that for everyone (not just the poor, though they'd benefit the most). You calculate how much it costs a person to pay their basic living expenses: food, a decent place to live, maybe a transit pass. Then you pay everyone in the population that amount of money each month, unconditionally (no means testing).

I once calculated that such a system, if applied in Canada, would require something like a 36% flat income tax if it were entirely funded that way, and it would have a break-even point at about $65k annual income (below that, you receive more than you put in). I expect the situation in the US to be similar.

Part of that cost could be offset by reducing or eliminating existing welfare and social security programs, including food stamps, employment insurance, and subsidized housing. It would also let you eliminate minimum wage, since you no longer have to be concerned about wages covering basic living expenses.

There are a lot of questions about how this would affect an economy. Would it cause massive inflation? Unemployment? Substance abuse? Or would it be the most effective social program ever? I have no idea. But I think it's worth a try. My hunch is that you will see all of those negative effects increase somewhat (inflation, unemployment, substance abuse) or in some people, but that the positive effects will greatly outweigh the negatives.

You needn't implement it all at once. You could apply it first to a random sample, say 1% of the population. Those people receive basic income and pay the tax required to fund it. They would also become ineligible for the social programs that would be removed if you rolled it out nationally (the details of that part may be tricky). Only roll it out to the whole population if the results are positive after a few years.

<comment><USER3> If wages fall, particularly if we remove minimum wage, the required tax rate to support the system will go up, as will the break-even point.

<comment> a-priori This may be true. But there are also be factors that may cause people to increase their income. Perhaps the extra money lets them invest in education (everything from skills training to a university degree), relocate to somewhere with a better market for the skills they have, or start a business using the basic income as their bootstrapping fund.

It's hard to say how things will balance out. That's why I'm in favour of some sort of systematic test of the concept.

</comment></comment></comment></comment><comment><USER4> This is a great idea. Giving directly to the poor will hopefully bypass corrupt entities, and essentially injects cash directly into the economy you're hoping to assist. In the case of a farmer or someone looking to start a business, even a small cash injection can make a big difference, and will immediately produce an impact.

The main risks of course to this plan is that the money could get spent on imported goods, which would transfer the cash back out of the local economy, or that it would get hoarded (or stolen). But cash injections are still the most effective means to stimulate an economy, especially small, local economies.

<comment><USER5> " _cash injections are still the most effective means to stimulate an economy, especially small, local economies._ "

The economist in me thinks _the effectiveness of cash stimulus is still mostly inflated away if the economic problem is structural, especially when injections are unrelated to any productive improvements in small, local economies._ To the extent this scheme works because the cash injections are occasional and unpredictable and landlords, local Big Men and monopoly local goods suppliers haven't yet found a way of creaming off most of the cash injection. I wish them all the best and hope the positive results their followup studies have shown reflect something other than weaknesses in study methodology, but unfortunately I think this is patching the symptoms and can't scale without adding in some more precisely-targeted larger-scale aid.

</comment></comment><comment><USER6> It's great to see GiveDirectly getting more attention. From my limited interactions with Paul Niehaus, he seemed quite competent and rightly focused on ensuring that the system remains free from corruption.

</comment><comment><USER7> You know how Steve Jobs said, "Your time is limited, so don't waste it living someone else's life"?

Well, I agree, and I take that idea very seriously. People should keep their money (earned by trading time from their lives), and use it to make the most of their own lives.

Moral credit ought to go to those who create the most, not to those that give up everything. Contrary to what your mother will tell you, giving money to charity does _not_ make you a better person. But creating things and otherwise making the most of your life (you only have one), does.

If you want to give money to charity, make sure you're doing it for the right reason (i.e., because you know that the specific cause you're supporting will make your own life better), and that you have enough money so that you're not sacrificing your primary values (your own goals, family, friends, for example) by doing so.

Don't give up the one life you have, or any part of it - it's yours, and it's all you've got.

<comment><USER8> Not everyone subscribes to such a dark, cynical view of the world. I realize that there are thousands of invisible advantages I have over an identical me born in Africa. Giving to charity is a small way of shrinking the gap.

<comment><USER7> There is nothing dark or cynical in what I have said. What is dark about "live the best life you can live" and "make the most of what you've got"?

Fact: to achieve your own goals, you need 100% of your time, money and effort.

<comment><USER8> Anyone who believes that charity and giving are not morally good actions clearly has a warped and extremely cynical worldview.

<comment><USER7> Straw man. Charity and giving are morally neutral actions. On its own, charity doesn't improve your life.

Remember, the purpose of morality to guide you so that you can enjoy a good life. A morality (that's good for life) should not tell you to suffer, give up what you care about and die.

<comment><USER9> > Remember, the purpose of morality to guide you so that you can enjoy a good > life.

This statement itself is a controversial _moral_ position, rather than a universally-accepted statement of the purpose of morality.

<comment><USER7> It depends. In America, most people agree with my statement. Elsewhere, sometimes, but not necessarily.

But so what? There is no universally-accepted statement of anything, anywhere. The choice each of us has when reading anything is: "well, what do _I_ think about this?" And for that, the number of people that agree or disagree is irrelevant.

<comment><USER9> > It depends

No, claims about the "purpose of morality" are non-factual statements of personal preference in any context. It doesn't depend.

> In America, most people agree with my statement.

Aside from the fact that this is irrelevant, I see no evidence that this is true.

> But so what? There is no universally-accepted statement of anything, > anywhere.

There's a categorical difference between logical claims (which are abstract and which are true or false independent of factual context), fact claims (which are, in principal at least, subject to objective validation as true or false), and value (including moral) claims (which are statements of personal preference).

The problem with your claim about the purpose of morality is that it presented a value claim as if it were a true statement of fact.

<comment><USER7> _No, claims about the "purpose of morality" are non-factual statements of personal preference in any context._

Well, you lost me there. When I choose not to lie to my family and friends, or when I deal with others justly, I am behaving that way (i.e., morally) because I want a good, long, happy life. It is _not_ a matter of "personal preference." (It is absurd to say, "It is merely my personal preference to live well by honest means. Others may choose differently, and live well by dishonest means.") If I lied to my wife, or cheated a customer out of money, _I_ would suffer, and that's an inescapable fact. (If you don't understand this point, just ask and I'll explain why.)

Show me someone, out here in _reality_ that lives a good, long and happy life by lying to his spouse, cheating his customers, and stealing to top it off at night. Or even someone that just does one of the three, occasionally.

 _There's a categorical difference between logical claims (which are abstract and which are true or false independent of factual context), fact claims (which are, in principal at least, subject to objective validation as true or false), and value (including moral) claims (which are statements of personal preference)._

Sigh. In relation to an individual person's life, for every _is_ , this is an _ought._ For example, suppose that I am driving my car down the highway. There _is_ a giant boulder in the middle of the road ahead. If I want to live, I _ought_ to slow down and turn to avoid it. So much for Hume!

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Pretty sure that almost all charities and welfare related groups see a spike in improvement of the lives of individuals on the onset of their service. The problem usually becomes dependence on the system. Could someone illustrate how this implementation solves the issue of dependence?

<comment><USER6> The payments are of a fixed amount ($1K, spread over 1-2 years), so recipients know that they won't continue to receive money indefinitely. It probably also helps that a significant fraction of the money appears to be spent on durable home improvements (e.g. tin roofs) rather than ongoing costs. See the FAQ (<http://www.givedirectly.org/faqs.php>) for more details.

</comment></comment><comment><USER11> Excellent. Having grown up in East Africa and seeing first hand how UNHCR, WHO, UNICEF etc actually worked; I've always thought this would be the best way.

Kudos to Google's top brass, you employees should be proud to work for a company like this!

</comment><comment><USER12> A recent Planet Money talked about this exact issue:

[http://www.npr.org/blogs/money/2013/05/21/185801589/episode-...](http://www.npr.org/blogs/money/2013/05/21/185801589/episode-460-its- hard-to-do-good)

</comment><comment><USER13> "Typically people who live in mud huts with thatched roofs – and uses a system called M-Pesa, run by Vodafone , to transfer money to their cell phones."

People in mud huts have cell phones?

<comment><USER14> The phrase "mud huts" evokes a primitive pastoral lifestyle, but there are a lot of places where mud brick is simply a sensible building material. I have stayed in a "mud hut" in Africa which had running water and electricity; this was common to all the houses in the neighborhood. They were nice big places, plenty of air and light, with ordinary doors and furniture and whatnot, that just happened to be built out of great big slabs of mud. They build this way not because they lack more sophisticated technology, but because mud bricks are an effective, economical technology well suited to their environment.

</comment></comment><comment><USER15> Disadvantage of charities is that only approximately 10% of donated money are making it directly to the cause.

Disadvantage of giving money directly to the poor is that half of them will end up buying pot, booze or getting robbed.

<comment><USER16> > Disadvantage of charities is that only approximately 10% of donated money > are making it directly to the cause.

93% of a donation to GiveDirect will end up in the hands of the recipient.

> Disadvantage of giving money directly to the poor is that half of them will > end up buying pot, booze or getting robbed.

Nope to the first two, I don't know about theft, but they have no reported incidents of violence (they perform follow up calls)

<http://www.givedirectly.org/pdf/litreview_2.pdf>

They've performed randomised trials to see if the money makes a difference, and find that it's making a huge difference to peoples lives.

<comment><USER17> Even in the "robbed" case, as a general rule, the wealthy aren't wandering the streets mugging people. That money is going to get spent on goods and services somewhere along the way, at least providing economic stimulus.

</comment></comment></comment><comment><USER18> If they want to "give directly" why not just hand people cash?

</comment><comment><USER19> What the actual fuck?

<comment><USER3> Well that was constructive</comment></comment>


Show HN: ML toy that tells you if you sound like Trump or Hillary on Twitter - <AUTHOR> http://thedonaldtest.com/ <comment><USER2> So apparently ML doesn't understand sarcasm either.

<comment><AUTHOR> I think it could. Our ML doesn't. Here's what a quick google search brought up...[http://cs229.stanford.edu/proj2015/044_report.pdf](http://cs229.stanford.edu/proj2015/044_report.pdf)</comment></comment>


Nobody Cares About OAuth or OpenID Connect - <AUTHOR> https://developer.okta.com/blog/2019/01/23/nobody-cares-about-oauth-or-openid-connect <comment><USER2> I'm trying to build a simple Python app that authenticates against corporate Okta right now.

It's incredibly, painfully difficult. If you search for "Python Okta" you get this: [https://developer.okta.com/code/python/](https://developer.okta.com/code/python/)

> At this time we do not support official API client libraries (SDKs) for > Python. You may fork our legacy Python SDK or join the conversation on this > thread and let us know how you'd like to use Okta from Python applications.

I have integrated both OpenID and OAuth by hand many, many times. If Okta offered a page of documentation like this one my project would already be finished: [https://developer.github.com/apps/building-oauth- apps/author...](https://developer.github.com/apps/building-oauth- apps/authorizing-oauth-apps/)

From the linked article:

> This is one of the reasons why, here at Okta, even though our entire > platform is built on top of OAuth and OIDC, we spend tons of time and effort > trying to build abstractions (in the form of client libraries) to hide those > complexities and make securing your web applications simpler.

But this is the cause of my problem! The abstractions they are offering don't work for my use-case. The fact that they have hidden the complexity from me is actively preventing me from completing my goal.

I'm not arguing against abstractions here - what I need is BOTH. I need abstractions that can help me get my job done, combined with well documented non-hidden complexity for me to fall back on if the abstractions don't yet handle my use-case.

<comment><AUTHOR> We don't have any official Okta Python library support at the moment :(

We don't have any full-time Pythonistas on staff right now, so deprecated our old stuff. We're hoping to hire and expand that role out to build proper SDKs + support in the future.

Right now, the best option is to use generic OIDC/OAuth compliant libraries (since Okta is a generic OAuth/OIDC provider). Sorry :(

<comment><USER3> The company I work for recently became an Okta Partner... and I'm a Software Engineer that primarily works in Python.

I am expecting this quarter to start building out a platform that will use Okta for authentication and authorization.

Do you think Okta would be willing to pay for some engineering hours if we were to take on the mantle of producing a modern Python SDK? If so, I'll be happy to start running that up the line here.

Failing that, are there any resources you recommend for going forward with Python and Okta, in addition to using generic OAuth libraries?

<comment><AUTHOR> That is awesome! I'm going to forward this comment to our DevEx team and see if that's something we could do. Sounds great to me =D

<comment><USER3> Excellent -- I sent you an email to the address in your profile from my work email in case anything comes of it.

</comment></comment></comment></comment></comment><comment><USER4> The article provides a very light history and technically shallow description of OAuth and OIDC so it can advertise Okta. Essentially, "these two protocols are complicated, and you probably don't care, so you should buy Okta."

Except this is Hacker News, where caring is fundamental. I'll pass on the Okta advertisement.

<comment><AUTHOR> I'm legitimately not trying to advertise for Okta here at all.

This topic is near and dear to my heart because I've been working in this industry for many years now, and it is frustrating that there is a huge focus on building more OAuth/OIDC tools and encouraging developers to get directly involved in working with things like JWTs directly.

There are so many ways to mess things up at foundational levels today, I just really want to see better tooling created in the open source communities (and in paid products) to abstract things like OAuth/OIDC so that developers don't _need_ to constantly be fiddling around with these lower level protocols where the risk for messing up is extremely high.

<comment><USER5> Advertisements with their hearts in the right place are still advertisements. If your tool were open source (it may be? not clear from TFA...) no one would complain. Since it's commercial and TFA takes such an anti-hacker stance, the complaint above is not surprising. It's not difficult to imagine that TFA might be very effective in speaking to some of your customers. With the customers who hang out here, a different essay with a different emphasis (e.g. "this is how everyone gets OAuth wrong and here's how we do it right") might be more effective.

</comment></comment></comment><comment><USER6> The redeeming feature about OAUTH, like pretty much anything security related, is that if you don't give people a standard to follow then you are probably going to end up with something that is insecure and poorly implemented.

A lot of people just don't have the background to do good security work, and when you try to explain why a short lived credential is good, or why we can't have a plain text password embedded in the git repo, their eyes glaze over and you lose them. So it's much easier to just dictate it will be a tls connection and you'll use OAUTH, and then they go download a library and everything is good.

Where I ran into problems is with using OAUTH for federated user logins. I did a proof of concept with Facebook, then after a couple hours they decided I was a robot and that was that - account closed, no recourse. Luckily that happened before I had a large user base using it - I don't know what you do if Facebook decides your a robot and suddenly 50,000 people can't authenticate to your site, guess you learn something. A week later most of the other sites decided I was a robot and terminated my accounts. Google is the only site that didn't. (Which is good because I have a decade of e-mail and photos I'd hate to lose)

<comment><USER7> > _don't know what you do if Facebook decides your a robot and suddenly 50,000 > people can't authenticate to your site_

This is exactly why I am paranoid about depending _entirely_ on social sign up/in. So if the API provides it, I believe it's a good idea to capture the email address associated with the social account and either generate a hard password for later reset if necessary or request the user set one up. The latter obviously reduces a little convenience of the social sign up, but does hint to the user that they can sign-in otherwise and gives them control.

Authentication is just too important to completely outsource without recourse.

<comment><USER8> _> Authentication is just too important to completely outsource without recourse_

I agree 100%. You need to own your users and all of their data. Along those same lines, I wouldn't want my user data going into a multi-tenant, cloud- hosted solution like Okta. I'd much prefer to store everything on my own servers or use an on-premise solution like FusionAuth or KeyCloak.

<comment><USER7> > _...use an on-premise solution like FusionAuth or..._

[https://news.ycombinator.com/user?id=brokenwren](https://news.ycombinator.com/user?id=brokenwren)

I see what you did there. :)

Good luck.

<comment><USER8> Haha. I try to be upfront that I work for FusionAuth. I mentioned it in my other comments in the thread but forgot to mention it here. Thanks for keeping me honest. ;)

</comment></comment></comment></comment></comment><comment><USER9> The author of this article cannot be trusted. He regularly writes articles that compare non-best practices of JWT to best practices of other technologies to make JWT look bad. Because of him, I would not trust Okta at all. Take any article by Okta with a grain of salt.

<comment><USER10> What practices would that be? Both good and bad is interesting to me.

I recently decided against using jwt bearer tokens due to the concerns expressed in both rfcs and owasp of being to risky when compared to session cookies.

But really I'm wondering if the risk of screwing up csrf protection isn't more of a concern than token leaks.

</comment></comment><comment><USER11> If you need to implement your own OIDC/OAuth I highly recommend Identity Server 4[1]. I've used it in production and it was fairly painless to get up going. It's .NET based & battle-tested. It has lots of samples on GitHub to show you how to get going for the various flows (which they even walk you through in their docs) and has a quickstart UI so you've got something you can brand quickly to give users a contiguous login experience. However, if you can manage not to host your own (don't want to mess with it), I recommend either Auth0[2] or the one of the AWS/Azure solutions mentioned elsewhere.

[1][https://github.com/IdentityServer/IdentityServer4](https://github.com/IdentityServer/IdentityServer4) [2][https://auth0.com/](https://auth0.com/)

</comment><comment><USER12> I implemented a minimal OpenID Connect server internally a few years back when it was difficult to find something for our specific use case in Go. I think that while the general idea is good, the spec is a mess: it's too flexible in all the wrong ways, so every large player implements it slightly differently, leaving you with no clear path to go yourself; and actually making the protocol (... concept?) less secure than it could be.

I kept thinking that for our use case, a simpler aead token or perhaps something like Maracoons (if there would be more battle-tested libraries for it...) would suffice. In the end I implemented a partial solution with one flow and one JWT signing algorithm so the other services could rely on existing client libraries for their respective programming languages.

Of course none of it ended up being used, as SAML (there's another can of worms...) support became a requirement and some large framework was brought in for that corporate software feel-good factor...

I agree with the sentiment that it would be nice if there would be new development in this area, even (or especially) if none of the big players are involved, but non-trivial crypto protocols and frameworks seem to need a lot of momentum to break out of their local ecosystems. It's not easy to design something that fits different use cases yet doesn't break at the joints.

<comment><USER13> > I think that while the general idea is good, the spec is a mess: it's too > flexible in all the wrong ways, so every large player implements it slightly > differently, leaving you with no clear path to go yourself

This was my experience doing _anything_ at all with OAuth. Now I am seeing the same with OpenID Connect, though not as severe. The spec was narrowed a bit, but it is still way too broad.

<comment><USER14> I recommend looking at the basic client profile of OIDC to start. It is a good cut through all the options.

Also you may want to look at the OIDC conformance testing tools for testing if you are building your own library or server. Certification costs money, but the conformance testing tools I believe are all open source.

</comment></comment></comment><comment><USER15> I agree that the learning curve is too steep with OAuth and OpenID and that supporting multiple scenarios could be part of the problem.

One specific problem I've faced is that it's very complicated to configure a development environment for unit and integration testing. I think there is huge demand for something that works well for Docker Compose and unit testing frameworks while still being a production grade solution.

I haven't evaluated everything out there but so far the best solution I've found is Keycloak. Unfortunately it takes 20 seconds to start on my computer and up until very recently I had to go through the configuration procedure each time you launched tests. I was fortunate enough to get a PR ([https://github.com/jboss- dockerfiles/keycloak/pull/152](https://github.com/jboss- dockerfiles/keycloak/pull/152)) accepted which allowed me to load a working configuration file directly into the unaltered Docker container with some users and roles for testing purposes.

So if you have something that starts quickly, is easy to combine with Docker Compose and with unit testing frameworks, and could be used in a production scenario... Let me know. ;-)

Oh, and it also needs to be on-premise.

<comment><USER16> I agree that Keycloak + Docker Compose is a great combination for development and testing. We use this setup in JHipster ([https://www.jhipster.tech](https://www.jhipster.tech)) when you choose OIDC for authentication. It auto imports users, roles, and OIDC apps so everything works right away.

<comment><USER8> Matt, you guys should switch JHipster to FusionAuth! Less IBM-ness you know. ;)

</comment></comment></comment><comment><USER17> I recently built an app that outsourced the entirety of the account creation, email validation, MFA and authorization to AWS Cognito and AWS ELB. All I have to do is verify a signed JWT passed in by a header by the ALB (and configure all that stuff and automate it into CloudFormation).

Never building this infrastructure again. What a huge time saver.

My company used Okta. We ended up cancelling it as it did not seem to offer any value whatsoever and was crazy expensive for our 300-odd users.

<comment><USER18> Is that architecture helpful for a saas app that needs to support users from corporate customers using single sign-on via an OIDC or SAML provider like Azure AD or ADFS?

I looked into using Okta or Auth0 for this sort of setup, but both were prohibitively expensive for a saas app.

<comment><USER8> FusionAuth is free. Less pain, more awesome! ;)

And it integrates with AAD and ADFS.

</comment></comment></comment><comment><USER19> Maybe off-topic a bit, because it only handled authentication, but I really miss Mozilla Persona.

You just included some javascript in your frontend, maybe a 5-line function in the backend, and people could authenticate to your web app.

No need to store a password and correctly crypt the hash, provide a password change function, provide a password reset function (what a PITA to get correct).

Why hasn't anybody created something comparable yet?

</comment><comment><USER20> This is a sales piece for Okta. And I disagree with them.

OpenId Connect and OAuth work great and are reasonably designed. The documentation is dense but you'll do fine if you read some of the popular blogs about it summarizing the different flavors.

Their comparison to "rolling your own crypto" is jarring. Rolling != using. You're likely a moron if you write your own crypto library and that applies to not using pre-made OAuth/OIDC libraries as well.

</comment><comment><USER21> The complexity of OpenID Connect or even just SAML is exactly why I developed RosLogin for the ReactOS infrastructure: [https://github.com/reactos/web/tree/master/www/www.reactos.o...](https://github.com/reactos/web/tree/master/www/www.reactos.org/roslogin)

Our web services are all running under the same base domain reactos.org and we wanted a Single Sign-On system for all of them. I was surprised to find out that doing this simple seems to be an unresolved problem: CAS, OpenID Connect, and SAML all want you to set up heavyweight authentication servers and a certificate infrastructure for identifying each participating web service. A lot of protocol messages need to travel for a simple action like a user login when a site-wide session cookie could just do the same job. Sure, those systems support advanced features like access control and delegated authentication, but this is all not required if you just want to link a few web services under your own control, say a MediaWiki and phpBB forums.

RosLogin simply sets a site-wide session cookie on each user login. Each web service then just calls RosLogin::isLoggedIn() to check its validity and retrieve the user name. No certificates, no protocol messages, and no heavyweight server software is involved. Together with centralized Login, Registration, and Self-Service pages, RosLogin currently needs no more than 1600 lines of PHP code - perfectly auditable from a security standpoint!

The ReactOS infrastructure is mostly built around PHP web services, so PHP bindings and plugins for Drupal, MediaWiki, and phpBB are currently the only ones available for RosLogin. However, our few non-PHP services can still plug into the same user database by connecting to RosLogin's underlying OpenLDAP directory.

</comment><comment><USER22> OAuth 1.0a handles both authorization and authentication. I still think it's unfortunate that Big companies are pushing for OAuth 2.0 and trying to blindsided developers as if OAuth 2.0 is an upgrade to OAuth 1.0a. It is not! OAuth 1.0a provides authenticity, integrity, and non-repudiation. Something that OAuth 2.0 cannot match.

<comment><AUTHOR> I agree! I really liked OAuth 1.0, especially from a security POV. But, the working group has moved on, and OAuth 2 is the standard now :x

<comment><USER22> Not everyone is using OAuth 2. Mastercard makes a security decision to stay with OAuth 1.0a. [https://news.ycombinator.com/item?id=17482178](https://news.ycombinator.com/item?id=17482178)

<comment><USER23> Also twitter whenever the app is supposed to act on behalf of a user. (OAuth 2 is simpler, and is available for accessing public data not on behalf of a user.)

[https://developer.twitter.com/en/docs/basics/authentication/...](https://developer.twitter.com/en/docs/basics/authentication/overview/oauth.html)

<comment><USER14> Twitter is very reluctant to find out how much removing OAuth 1.0a (and their previous incarnations like XAuth) will break in their legacy infrastructure and for existing trusted clients. A migration path would mean adding OAuth 2 in addition to all the previous mechanisms, and then likely acting over a long migration timeline.

</comment></comment></comment></comment></comment><comment><USER24> So, I know I'm naive and all, but it seems odd to me that this isn't baked into normal web frameworks. It is entirely ordinary for a website to want to allow a user to login using Google/FB/Yahoo/whatever other id's, so that they don't have to make a new id (and remember a new password) just for your website. Probably half of the websites made with frameworks want this.

Oddly, if I want to do it, I rarely find this "baked in". Many other features which are less common, are, or else have middleware that makes it pretty much just "add this line to your config file".

I have had to mess with Oauth two or three times in ten years, so needless to say I am hapless at it. If I did it less often, or more often, it would be fine, but it's not. Does anyone know why this isn't rolled into frameworks like Django, as a boolean that you set to TRUE?

<comment><USER25> Its baked into ASPNET Core, and its still a pain in the ass.

Even though the middleware handles JWT validation, cookie storage, redirects etc (which are a big part of it) there are still a tonne of little details to OAuth that clients need to know enough to specify:

\- what grant flow are you using (code, hybrid, implicit, resource owner etc.. all are valid for different and overlapping scenarios, based on how secure you want to be and how much hassle you want your users to experience)

\- client id and secret management, and registering this with your server

\- refresh tokens: i.e. how do I prevent my user needing to log in every 15 minutes without making my jwt last an insecure amount of time.

etc. etc. etc. I've built OAuth/OIDC into dozens of apps, and have deployed my own identity providers (not rolled my own, thank the gods, just used a framework for the server side) and its still the bane of my development existence.

<comment><USER6> That is another good point - generally you want to force a user to reauthenticate whenever they enter an elevated security context (account management, personal information, etc). With the OAUTH flows there doesn't appear to be s way to do this. If I tried to send them through the login process again, they would just end up back at my callback address because their token was still valid.

<comment><USER14> Two ways to interpret your problem:

1\. You want to perform a stronger form of authentication for users who are interacting with certain parts of your application

In this case, you can proceed in two ways. One would be to use the OpenID Connect authentication context parameter and request the stronger form of auth directly. I personally dislike this approach because it bleeds business logic into all your clients, although it is popular in some government use cases (where authentication levels are part of the API contract).

You can also have the applications represent the elevated security context as scopes (e.g. a moderation or admin scope). The business logic within the AS can interpret requests for these scopes as requiring stronger authentication

2\. You want to reauthenticate the user when they go to an elevated security context.

The AS should be responsible for your authentication policy, and deployments tend to go simpler if you don't split this responsibility with the application.

The traditional way to do this would be similar to the scope rule above: scopes representing access to elevated contexts, and the AS recognizing it needs to enforce stricter authentication rules for this to work. For instance, you could have a rule that the user needs to reauthenticate every half hour, and make access tokens which have elevated privilege scopes have a limited lifetime to force retrieving a new token.

A more modern way to do this might involve stepping back and looking holistically at why you are reauthenticating the user. This might be because you are worried that someone may have walked up to an unlocked machine and proceeded to try to access administrative features.

For this, you might instead look at using EMM and machine policy to reduce that risk rather than impacting UX - such as reducing the time of the screen lock and eliminating the ability to use hot corners to keep the screen awake for users with administrative access. Your AS can then detect and rely on EMM compliance as a factor.

</comment></comment></comment></comment><comment><USER26> The reason it (OAuth) was built was for user convenience one-click signing in for the most part and frankly that is more important than most considerations or tradeoffs if it's accomplishing the job. I do feel like this is always a bear to put in apps and I've even gone to the lengths of making a highly reusable microservice to handle this for my apps because it is just annoying in general to keep setting up. I don't like igcognito or firebase as they are too limiting on providers. I just took the approach of using an already rich ecosystem of Node.js and Passport compatible plugins for providers and having config lookup based on both signed requests coming in and where they originate. Was definitely worth the time doing this.

</comment><comment><USER27> Isn't this like a bicycle company saying no-one cares about walking anymore ?

</comment><comment><USER28> We've started using AWS Cognito which provides social logins and oauth and even mobile client and web sdks for integrating. Writing yet another authentication system was just too much and it's great how there's services like okta and aws that are stepping up and letting people just use those and at least in the case of Cognito, at minimal cost.

<comment><USER8> I've heard that Cognito is very limited in terms of features and can be a headache to get working properly.

I haven't used Cognito, but I work for FusionAuth ([https://fusionauth.io](https://fusionauth.io)) and we have a number of developers that have switched from Cognito to FusionAuth because we cover more of their use cases outside of plain authentication.

Not sure if you have had similar experience with Cognito being limited.

<comment><USER28> Well Cognito is a different product from what fusionauth is. As far as I know, Cognito is not going to be what you want to use for SSO for example. It's more for consumer facing services. As for hard to set up, that hasn't been my experience. If you're familiar with aws already it's trivial and interacts with other aws services. Like you can let users directly upload to s3, authenticate automatically via api gateway. I got it working pretty quickly. The mobile app support is great too. Cognito is also much cheaper than okta. You don't pay anything for the first 50,000 monthly active users.

</comment></comment></comment><comment><USER29> Original OpenID implementation was so simple and the scope of it was so small, i wonder where we got all this complexity

<comment><USER30> OpenID (not connect) had a weird OpenID URL users had to care about. Mine was something something google something u8. Nobody cared. Sites like HN removed OpenID logins. OpenID died.

OpenID Connect just standardised the existing practice of being authorised to use an identity provider as a type of authentication.

Edit: actually something something o8:

[https://www.google.com/accounts/o8/id](https://www.google.com/accounts/o8/id)

Again, this was required for USERS, not developers.

This is someone asking how to log in: [https://webapps.stackexchange.com/questions/18899/how-do- i-f...](https://webapps.stackexchange.com/questions/18899/how-do-i-figure-out- my-google-openid-url)

<comment><USER31> This is an implementation issue, not a spec issue. Pages can delegate to another identity provider (primarily used for vanity URLs, for example I could say that [https://nullable.se/](https://nullable.se/) should map to my Google OpenID, for example), and the identity provider can claim a different URL than you asked for (for example, Steam always uses [https://steamcommunity.com/openid](https://steamcommunity.com/openid) as the provider, but will claim a different URL for each user).

Combine these, and Google would have been perfectly capable of making everyone just type google.com. That they didnt' says more about Google than OpenID.

Besides, people were perfectly capable of showing the same pickers back then as you are forced to use with the current OIDC/OAuth2 abomination.

<comment><USER30> > That they didn't says more about Google than OpenID.

HN did the same thing. In fact pretty much every OpenID site implemented this weird expectation. Part of helping a standard get adopted is making sure it's implemented correctly.

</comment></comment></comment></comment><comment><USER32> I kinda feel like this was on the right track but then it turned into, let me sell you something.

</comment><comment><USER33> Here's my problem with OIDC and I don't know where to bring this up to find out if my hopes are widely off or I've missed something big and it already exists...

There's nothing specified anywhere that allows an application to interrogate an RP about the available scopes. I just don't see how fine-grained resource access can be done with OIDC without requiring the user to grant much coarser access first. I found a draft spec once but it was abandoned and the author didn't reply to an email I sent...

<comment><USER34> And a problem for the Resource Server: no common way to check the validity of a token. You may be lucky and get a JWT but even then there's no specified URL to get the keys to check it. Usually you get an opaque token and hope the client gives you a way to know where it comes from so you can do some specific server to server call.

So you can't implement an independant RS which does not care about clients and how they authenticate their users.

<comment><USER35> Look at the JWT, take the issuer claim, take the .well-known config off that url, and you have keys. Match that against the known permanent issuer you expected, and verify the signature of the JWT against the keys. If you're accepting things that aren't JWTs then you're not doing oauth.

<comment><USER34> > If you're accepting things that aren't JWTs then you're not doing oauth.

As a resource server: [https://tools.ietf.org/html/rfc6749#page-10](https://tools.ietf.org/html/rfc6749#page-10)

Access tokens don't have to be JWT. And some OpenID authentication server give opaque tokens: your resource server has to know how to call it to check the token and get some user infos if available.

<comment><USER35> Yes, I misread and typo'd.

</comment></comment></comment></comment></comment><comment><USER36> Years ago, I did care about adding FB login for a while, until my app has been removed from approval because of some strict guidelines. I'm pretty sure it required effort to resolve. From these days, I didn't even consider adding any oauth unless good presence for the project is achieved.

</comment><comment><USER37> This article kinda glossed over what the fuck openID Connection is actually for.

Like in a big way that I have no idea what the fuck OpenID is, what authorization and authentication are in this context, and why oauth doesn't handle both.

<comment><USER38> Authorization = Can I do this?

Authentication = Am I this person?

Technically, OAuth only cares about Authorization. It provides an opaque token to the client that authorizes future requests. It doesn't tell the client anything about who the token is for.

Turns out most clients need to know who is logged in (such as loading basic profile information, email address, avatar, etc). In practice this is usually done through some sort of /user endpoint that accepts an OAuth token. This /user endpoint implementation is service specific.

OpenID Connect tries to fill that space by providing a standardized way to perform authentication and identity information.

<comment><USER14> More than that, the bearer model of OAuth doesn't guarantee the token represents a particular user or even a particular client.

Any assertion that you are dealing with a particular person needs to be targeted at you. There were security vulnerabilities with some early OAuth deployments that used OAuth for authentication which didn't understand this - and that allow one service that had a relationship with a user to act as that user against all other services which trusted that AS.

For Facebook, they solve this by having the token stamp information about which client it was issued to, which the client is required to verify. For OpenID Connect, they decided to preserve the ability of OAuth access tokens to be opaque to the client, and create a new token called an id_token.

</comment></comment></comment><comment><USER39> > Back in pre-2007, there was no way for developers to build apps that needed > to securely access user data in another service.

I understand there are cases and people when this is needed but as for me I bloody never want anybody to access my "user data in another service" and that's why I strongly prefer plain old email sign-up: in many cases if you sign-up with your google account the service will also request your contacts list, your personal details and everything and I never want to share these.

Nevertheless the single sign-in feature OAuth/OpenID provide seems very convenient (unless implemented improperly when the service would take your OpenID and still ask you to set a password, a login name and/or e-mail address) so I still use it for some services.

<comment><USER40> Just think about companies like Mint who scrape your banking and financial information using your creds. Not sure if Mint has changed this or not (or if the banks opened an API) but at one point it was the case.

In the enterprise space these solutions help a lot. Especially with the rise of enterprise cloud software solutions like Salesforce, Workday, and ServiceNow.

<comment><AUTHOR> They still do that for 99% of the banks, since most banks don't support OAuth/OIDC yet :(

Chase recently switched over to OIDC which was pretty neat, but for most banks, it is an absolute nightmare.

<comment><USER14> There are several initiatives (such as Open Banking) which are mandating certain levels of access.

</comment></comment></comment></comment><comment><USER41> I care...

</comment><comment><USER42> tl;dr nobody cares how the sausage is made. they just want the sausage. they are hungry.

<comment><USER43> Unless I'm misinterpreting, this apparently includes the people whose job it is to make the sausages (i.e. Okta).

<comment><USER42> After spending enough time making sausages, I too, would not want to know</comment></comment></comment>