Fake Goods Sold by AliExpress, Amazon, eBay, Walmart and Wish - <AUTHOR> https://www.cbc.ca/news/business/marketplace-counterfeits-fakes-online-shopping-1.5470639 <comment><USER2> I get that people are outraged about this. And that's one side of it.

But I also feel like people need to know how to use these platforms. If you're getting a heavy discount, from a sketchy source, then maybe there's a reason for it. Idk about Wish, but platforms like ebay, aliexpress, etc. are great even for things like electronics if you know what you're buying like leds, microchips, etc. Makeup, perfume, power related applications, audio, etc. are the types of products that I would be very wary of. I think it still might be possible to find good sources for those things, but it's more of a gamble.

Before we crucify these platforms, and call for more regulations, etc, let's also remember that they do provide a valuable, cheap service for some.

<comment><USER3> > If you're getting a heavy discount, from a sketchy source, then maybe > there's a reason for it.

Talk about a perverse incentive. Maybe I should sell fake AirPod Pros for (MSRP-$3). Enough that the price feels right to make you think it's the real deal, and as a reward, I'll make more profit!

<comment><USER2> Then it wouldn't work.

They purposefully price it low so that people will go against their better judgement because they can get a really great deal. It wouldn't really be the same scam if they priced it higher.

And I am not saying price is the only indicator. Just that low prices are usually a red flag.

Although, there are studies that show increased sales for products by just increasing their prices and nothing else. So that incentive exists either way, scam or not.

</comment></comment></comment><comment><USER4> > _What 's more, the product was found to contain 751 times the amount of lead > Health Canada considers acceptable in cosmetics._

How long are we going to let companies hide behind their "platform" bullshit?

They know this happens but, because they're not the actual seller, they get to offload the liabilities to some fly-by-night company that'll close down and reopen under a different name.

Lead in products is dangerous and people should be going to jail but nothing ever happens.

Get caught, close the company, open a new one, pay some fees to open the reseller account and continue hurting people.

<comment><USER5> This frustration seems like it's just being directed at the closest entity you can shake your fist at rather than the actual cause.

Suppose all those fly-by-night companies set up merchant accounts on Shopify or just bought cheap Wordpress template and hosted it themselves and did the exact same thing. The world of boutique men's watches is absolutely rampant with this. Would you be demanding that Shopify or Tim Berners Lee vet all the products before they're sold. Would you demand that Visa/Mastercard do it? What about UPS/FedEx?

If you want to require businesses to get licenses and submit themselves to regular safety audits then just say _that_. Don't try to offload the responsibility of law and public policy to random corporations.

<comment><USER6> They should have to buy liability insurance and if the insurer won't insure them, they can't list.

<comment><USER5> Offloading the work of law to insurance companies rather than retailers doesn't really sound like we're making any progress.

Sidebar: this is super common btw, had more than one law professor go on a rant about how all the CS people in their courses just want to push everything to the actuaries and create a de-facto court system within insurance.

<comment><USER6> Insurers already do this... They don't insure risky companies or they have to charge such a high premium that constantly failing and restarting is not cost effective. I think most complaints here are from people trying to buy legitimate products.

</comment></comment></comment></comment></comment><comment><USER7> Why is anyone shocked AliExpress products are fake? I only go there if I want a knock off version of something (shirts, AirPod cases, etc.). Ebay and Amazon are also not surprising either, but both retailers often have the "official merchants" of products that are being sold. As long as you buy through the official storefronts, then you're good to go.

<comment><USER4> We shouldn't have to be investigative reporters in order to buy products that won't harm us.

Even the merchant name is bullshit on Amazon.

Try finding Apple headphones and see how many are sold by merchants named "Apple".

Amazon has to know that product is not actually being sold by Apple, yet they allow the counterfeiting to continue.

<comment><USER8> > We shouldn't have to be investigative reporters in order to buy products > that won't harm us.

There are other marketplaces that offer a much higher quality guarantee than Amazon. Shop there instead.

<comment><USER4> Why do you accept that it's ok to sell harmful products?

Amazon is a $1 trillion dollar company. It's not some guy selling things out of the trunk of his car. It should be reasonable for me to assume buying something there is safe.

<comment><USER9> individual freedom. I hate nanny government regulation. The government's role isn't to protect people from making bad decisions.

Harmful is subjective. Don't ban my plastic bags or straws.

<comment><USER3> Fire risk batteries being harmful, for but one example, is hardly "subjective".

Apparently in your world, it's perfectly okay for Joe Johnson to create an Amazon merchant account called "Apple" and sell me and sell me defective products under the Apple label.

</comment></comment></comment></comment></comment></comment><comment><USER10> I have basically stopped buying anything from Amazon that I can just buy direct from the manufacturer. Especially clothes, kids toys, etc. Most online stores now have shipping that is almost as fast, and 9 times out of 10 an extra couple of days shipping is not a big deal.

<comment><USER11> That 1 time in 10 is still a factor, though...

Many retailers still operate on the old expectation that when you order something, you'll get it in "6-8 weeks", which nowadays, is frankly ridiculous!

I ordered a crib from a local Canadian retailer, and the thing arrived after THREE MONTHS, and I had to pick up the box from the warehouse myself!

You have to give Amazon props for their logistics systems, they've gotten it down to an art. If I were to order the same crib from Amazon, it would've been at my door in 2 days' time.

Might've been a fake crib, though heh.

<comment><USER12> Given that a fake crib can actually kill a baby, this is one of those times where I put aside my convenience and drive to a real brick and mortar store and buy the crib myself.

<comment><USER13> Your comment implies that a real crib wouldn't be able to do the same.

</comment></comment></comment></comment><comment><USER14> If you're buying from AliExpress/Wish (aka: direct from china) I don't think there's much room for being surprised when you get fakes. eBay in many cases too.

Amazon especially needs to get its shit together, though. I unsubscribed from Prime and have all but stopped using Amazon because of how it's turned into basically "eBay with marginally faster shipping" at this point given all the absolute offbrand crap that's filling the site.

<comment><USER15> I have as well, but Amazon isn't bad when what you need is cheap crap (a bag of 1000 cable ties, for example). Bonus: they keep offering me free trials of Prime so I just save up a cart of stuff and then buy it when they give me free shipping.

<comment><USER16> Would you order those cable ties if you were a low-voltage contractor suspending a bundle of ~100 cables for 200' above an ACT grid ceiling? Cheap cable ties may work for bundling cables in your home rig or home stereo setup, but they may not be sufficient for a more robust load that a commercial application demands.

<comment><USER15> No, I wouldn't. But I'm not a low voltage contractor. To hold two Cat5e cables running through my basement, though? Sure. Heck I'd use tape if it wasn't a pain to remove later.

If I was buying for a commercial project I would use a supplier I trusted.

<comment><USER16> That's fair, the 1000 pack is what contractors generally buy, which is why I wanted to make the point that counterfeit junk could make its way into permanent installations in commercial spaces and eventually fail. Not all contractors use quality materials, though generally the ones that offer guaranteed work and stand behind it spend the extra money for Panduit/Legrand/Etc.

<comment><USER15> To be fair to you, I probably misstated when I said 1000, it was just an example. I think what I actually bought was really closer to 200 or something.

</comment></comment></comment></comment></comment></comment><comment><USER17> People actively seek out fakes, especially in the luxury space. For every person who would be glad that their faux product was intercepted, there's just as many who would be mad they didn't get their Gukki belt, or just not notice.

<comment><USER18> _People actively seek out fakes_

Then they should be marketed (and priced) as such.

</comment></comment><comment><USER19> I noticed that Wish gives refunds on counterfeits without question, provided you upload a photo of the item. It got me wondering if that's to avoid any legal liability. The law states that "trafficking" in illegal goods is a crime, and clearly these platforms don't want to be charged.

So, assuming they're actually legally required to refund purchases of counterfeits, I think a reasonable recourse would be to have as many people as possible order as many counterfeits as possible and then demand refunds. The platforms' cost per transaction goes up, and the manufacturers/resellers are out their items plus shipping.

I feel this would work best if the actual manufacturers that are being copied did the buying, that way they have legal recourse at their disposal and a literal pile of evidence if the refund is denied. And they can destroy the counterfeits.

</comment><comment><USER20> "Show me the incentives and I will show you the outcome."

There are currently few economic incentives for these market places to try harder to stop counterfeit vendors. The solution seems to be harsher consequences for the marketplaces.

I'm also kind of surprised by Walmart's inclusion. There are no examples in the article on their products, and they say that Walmart disputed the findings, so what's the deal? I wasn't aware that they were using 3rd party vendors in the same way Amazon does.

<comment><USER21> I believe Walmart's online store offers items from third parties but honors Walmart's return policies and guarantees. In order to compete with selection of options for online marketplaces like Amazon, I imagine they had to start sourcing products from third parties that don't typically appeal to the masses and fit in their store models.

In physical stores, last I checked, counterfeits weren't really applicable in anyway and seems to be fairly well quality controlled.

</comment></comment><comment><USER22> And Shopify. It's probably #2 behind Amazon, if I had to guess. Their one-stop deploy a drop ship website is far too convenient.

<comment><USER5> Every online marketplace/platform becomes an opportunity for price arbitrage via dropshipping.

I felt silly when I bought a few rolls of shelf-liners on Amazon and they shipped in a Walmart box because I didn't check.

</comment></comment><comment><USER23> This is all by design, I remember reading this WSJ article last year.

[https://www.wsj.com/articles/amazons-heavy-recruitment-of- ch...](https://www.wsj.com/articles/amazons-heavy-recruitment-of-chinese- sellers-puts-consumers-at-risk-11573489075) "A new product listing is uploaded to Amazon from Chaine every 1/50th of a second"

Amazon is heavily invested in getting as much Chinese trash on their US site and it does not seem to care much about the counterfeit problem.

</comment><comment><USER24> My experience:

1) I've been a seller on Amazon. 5 figure SKU counts, branded products. I was constantly being asked to provide invoices to prove that I had the right to procure and resell the products I was listing. I was also beholden to their metric standards and got delisted from the Buy Box regularly, until I could improve my numbers (operational bumps while we refined our processes... the standards were high enough if we fumbled a little bit, circumstances required a bit of time and attention to restore SOPs to required levels).

Not sure what these other entities are doing, but within the bounds of what I interacted with, and the age of my account, I wouldn't have been able to stay on the platform and keep selling if my fulfillment, returns and customer service metrics didn't stay within the acceptable thresholds.

2) I buy from Amazon regularly... household items, books, etc. So far, never had an issue with fakes. Always Prime, usually Fulfilled By Amazon.

</comment><comment><USER25> This is why Costco is worth what it's worth. Why risk buying garbage elsewhere?

</comment><comment><USER11> My wife and I purchase a lot of things from Amazon. We're taking a more critical look at what we buy ever since we had a baby.

We bought our car seat and stroller from Amazon, and we were honestly not sure whether it was certified for use in Canada. I shouldn't have to doubt any purchase I make online from a reputable retailer, but it seems Amazon no longer makes the cut for me.

For what it's worth, the car seat _did_ have the right stickers, but stickers can be faked too...

<comment><USER26> There's an absolute ton of fake climbing gear on Amazon, claiming to be legitimate brands and certified. Furthermore, goods from different suppliers are often mixed together in Amazon warehouses. So buying from the brand's own account doesn't necessarily mean it came from them!

I would strongly advise not getting any safety equipment like a car seat through Amazon.

</comment></comment><comment><USER27> So does wal-mart mix SKUs like Amazon, so that even when buying 'direct' from WM, you can get 3rd party supply?

Or is direct from wal-Matt part of their actual controlled store inventory?

</comment><comment><USER28> I guess if your marketing team has invested in invidious consumption as your strategy then you can expect low cost copies, I mean just look at LVMH and it's owner, that french guy who was for a few hours the world's richest man. They marketed to Instagram and black culture but did not seem to understand that low income low paid workers also live in the ghetto and will seek the bargain item over the unattainable Peng ting.

</comment><comment><USER29> In Switzerland, when you buy something for a price that is obviously too low (like a brand new iPhone for 100$) you lose all protection given to you by law in this purchasing contract. If it's a knock off, tough tiddies.

</comment><comment><USER30> They don't care about fixing this. Fake goods are a promotion for their platform as long as the quality is not super terrible.

<comment><USER31> Some do, some don't. Depends on the brand.

</comment></comment><comment><USER32> How to protect dump people from themselves?</comment>


Apple Has 250 Ninjas Spying the Competition At CES - <AUTHOR> http://gizmodo.com/5875150/apple-has-250-ninjas-spying-the-competition-at-ces

<comment><USER2> Where did the '250 Apple employees' claim come from? I mean, there's nothing in either that article or the original article that shows where they got this number (in fact the original article doesn't mention it at all).</comment>


Unpaid Laborers Are 'Slipping Pleas for Help into Zara Clothes' - <AUTHOR> http://www.independent.co.uk/life-style/fashion/zara-istanbul-unpaid-workers-inditex-bravo-clothing-tags-notes-a8037256.html <comment><USER2> No pictures of the handwritten notes in the article?

Seems like that should be included

<comment> jo-han pictures of notes (not handwritten though) are shown in: [https://twitter.com/trtworld/status/927528929279307776](https://twitter.com/trtworld/status/927528929279307776)</comment></comment>


Why governments are not attacking Silk Road (yet) - <AUTHOR> http://maxwellhansen.com/blog/?p=66

<comment><USER2> or the Goverment could just pose as buyers, work to identify the vendor and then extort vendor to release customer addresses, and proceed to arrest past and future clients.

<comment><AUTHOR> Why would the dealer talk? Giving out more customers would just be more evidence against himself.</comment></comment>


Beware of being too open about your company on Hacker News - <AUTHOR> http://jacquesmattheij.com/Beware+of+being+too+open+about+your+company+on+Hacker+News <comment><USER3> This reads like personal drama in the form of a blog post. I didn't learn anything from it about how I should comport my company on HN, but the title pretty much demanded I click through. Irritating.

<comment><AUTHOR> Suggested changes ?

<comment><USER4> Do not write about inane topics with a lack of insight.

<comment><AUTHOR> The insight to me is that if you post your turnover figures there will be people right here that will not even blink at cloning your pages to copy your concept.

That's news to me. If you think that's 'inane' that's fine with me but I think the insight is a valid one.

To me that says that there are lurkers on HN that are here with no other purpose than to look for stuff they can rip off.

</comment></comment></comment></comment><comment><USER5> Clones are great, since you look at what they copied and then know what your competitive advantage wasn't. Ever heard of my clones? There are about half a dozen by now. Life is still going great for me.

<comment><AUTHOR> I think the good news here is that they're all unable to hit that fine line that Zachary knew how to strike and for him it might not matter much, but start-ups can be vulnerable and being 'open' may not be the right approach.

Especially if it looks like you are sitting on a real moneymaker. Zachary is going for subscribers and at the rate it's growing the turnover of awesomenessreminders might well be in the hundreds of thousands before long. That sort of success is bound to bring the vultures in larger numbers than what bingo-card-creator would experience, with the combined pressure of so many jackals it might become a real problem.

After all, if you're the #1 in the field and you're making as much as you do it can't be too lucrative for your competition to be fighting over the remainder of the market, but how do you think it would develop if you made a million or more per year? I'm fairly sure the competition would heat up quite a bit.

By the way, I think you have a great thing going with opening up your figures like that, for the last week or so I've been see-sawing back and forth about doing the same thing, I'm not yet 100% convinced it's the way forward (but I'm a lot less vulnerable than Zachary at this point in time).

</comment></comment><comment><USER6> Here's a rule you have to get used to:

There is never just one of a thing on the Internet. There are twelve.

Clones are par for the course. Once in a while the clones win, but not very often. They definitely keep you on your toes. Plus you can steal ideas back from them as well. They are kind of like your personal farm league.

</comment><comment><USER7> If someone creates a site that makes money and can be cloned in a few hours of work, of course people are going to copy it.

Isn't that why investors want to know what the competitive advantage is with any company they're going to invest in? To prevent this sort of copy-catting?

</comment><comment><USER8> A good point, but I think it's a simple distillation from two more important points: 1) Your business can be cloned; if it's any good, it will be - <USER2> on it. 2) Always always always be careful about what you put on the internet. If someone complains about their business idea being stolen after posting it online, they sound like the high school girl who can't fathom why her ex- boyfriend would put the naked pictures she sent him on the internet. Those were supposed to be _private_.

PS: Here's a fun thought. If you have recently had or are soon going to have a daughter, you are going to have to, at some point, teach her about not distributing naked pictures of herself. I doubt it's as bad an epidemic as TV makes it out to be, but you can bet the bank her health teacher isn't gonna touch that with a 10ft pole.

</comment><comment><USER9> I think these clones are taking the concept way too far...having a total stranger call you every day saying "I miss you and I love you" is creepy and deranged.

EDIT: It gets worse. Who would want to receive a random phone call of "I want to nibble on your nuts"?

<comment><USER10> Personally I don't even understand why people want a useless phonecall _every day_. It might be funny the first few times, but would that wear off rather rapidly for me.

However, if there's really a market for a "nut nibble" call-service, I don't see anything creepy or deranged in providing it. There's surely much creepier and more deranged things out there...

</comment></comment><comment><USER11> I'm not sure how posting on HN actually does anything more for these clones. The idea is obvious. The text is _there_.

What stops any Joe from doing the same?

Obviously it's just dumb, stupid, and unprofessional to copy from a fellow HNer, but I don't see how it gives them any boost.

Thoughts?

<comment><AUTHOR> I think it's the fact that Zachary has been very open about his growth and turnover that brings this on, not the idea per se.

</comment></comment><comment><USER12> I'm not sure what the "openness" is that is being referred to here. It just seems that various people took a quite simple idea, and copied it. Short of not telling people about your business, how are you going to stop this?

<comment><AUTHOR> I think the big draw here is the money involved, not the concept per se.

When Zachary launched this was the general sentiment: <http://news.ycombinator.com/item?id=1616154> but then it took off and people started literally _copying_ his website to clone it.

</comment></comment><comment><USER13> The clones are basically letting Zachary do the market research and the initial minimum viable product development to validate a concept before jumping in. Since Zachary releases a lot more market data, he just saves the clones whole bunch money.

</comment><comment><USER14> 1/ There is full credits to the original in the clones.

2/ The clones are better looking than the original

3/ I am assuming the whole thing is a farce

But, who knows, maybe clones work, let's try, says, a wiki, looks like a good weekend project <http://simpliwiki.com>

As alreay signaled (by stevederico)

Ideas are worth nothing, , execution and timing are everything. <http://thenextbigtechthing.com/ideas-are-worth-nothing/>

<comment><AUTHOR> > There is full credits to the original in the clones.

There is now, yes: <http://news.ycombinator.com/item?id=1694596>

<comment><USER14> That they had to be reminded about credits tells something.

OTOH, that they added the credits tells something too.

This is so Darwinish!

<comment><AUTHOR> > OTOH, that they added the credits tells something too.

Yes, that guy had been called out earlier for ripping off content from apple... it tells me he didn't learn much.

</comment></comment></comment></comment><comment><USER15> Ideas are worth nothing, execution and timing are everything. <http://thenextbigtechthing.com/ideas-are-worth-nothing/>

</comment><comment><USER16> Let me ask this way, What did Zachary gain by putting the numbers out?

<comment><AUTHOR> I think it helped to make people see that it was a 'valid business' and that in turn got him quite a bit of press I believe.

As a 'bootstrapper' it can be a lot harder to get press than with a company like YC behind you.

<comment><USER16> I thought he got press coverage (Time) prior to his posting the numbers. I believe that, other than telling others that it is a 'valid business', announcing those numbers did not achieve anything useful for him.

<comment><AUTHOR> Ok, that may be true. I thought the membership counter was on the homepage right from day one, but I may be mistaken.

<comment><USER17> it was on the homepage from day 1. i recently removed it. i thought that it would be a good social proof counter and all my friend enjoyed keeping track of how it was growing. the site started out as a fun thing that happened to be profitable. i had no idea that it would grow like it did.

i want to continue sharing information among the community, but it's pretty weird that those guys straight up jacked my style without even emailing me. i honestly don't know how i'm going to proceed.

</comment></comment></comment></comment></comment><comment><USER18> This is the paradox of capitalism. As things become cheaper, they become more like a commodity.

These clones of ideas are simply turning that idea into a commodity and aside from some minor surface changes, they're really the same. The competition created is fairly artificial.

Instead of thinking of it as a rip off, think of it as a way to improve your own commodity offering.

</comment><comment><USER19> you should think of it as validation, if someone is willing to use their time to clone the product. Its mainly about execution, getting users, and building something people want, just building a product now and days can be done fast, cheap, and easy.

<comment><AUTHOR> Validation is one thing, but cutting and pasting whole pages of text goes a bit further than that.

</comment></comment><comment><USER20> If a clone proceeds to take all your business, I would suggest that perhaps your business model was not sustainable.

</comment><comment><USER21> You don't see that as a complement?</comment>


Tony Blair: We don't have to leave the EU to control immigration - ezequiel-garzon http://institute.global/news/we-dont-have-leave-eu-control-immigration <comment><AUTHOR> Did anyone manage to distill his alternative plan for control immigration?

<comment><USER2> > As the paper shows, we can curtail the things that people feel are damaging > about European immigration, both by domestic policy change and by agreeing > change within Europe to the freedom of movement principle, including > supporting the campaign of President Macron on the Posted Workers Directive.

The alternative plan is to persuade the other 27 EU members to cancel the current vision of the EU and to adopt the view the UK always would have preferred, namely that the EU should be reduced to the single market without free movement of people and all this business unfriendly social charter stuff.

So actually no new plan, just another example that most Brits don't get what the EU is about.

But actually there is a glimpse of self-awareness in his text:

> and the process of enlargement to the East was begun, with British > leadership at the fore. There was a price for this. As Europe enlarged, to > help those former Soviet satellites develop, Western Europe paid through > structural funds to support that development. Hence much of the so-called > Brexit divorce bill.

<comment><USER3> There is the Belgium model.. and this seems to be supported by EU law:

[https://www.ft.com/content/d736fe48-a912-11e3-bf0c-00144feab...](https://www.ft.com/content/d736fe48-a912-11e3-bf0c-00144feab7de)</comment></comment></comment>


Kansas family sues mapping company for years of 'digital hell' - <AUTHOR> https://www.theguardian.com/technology/2016/aug/09/maxmind-mapping-lawsuit-kansas-farm-ip-address <comment><USER2> I don't know the relevant laws surrounding this, but I'm surprised they're only suing for $75,000 for something that's been going on for almost 15 years.

<comment><USER3> Nuisance lawsuits tend to be for sums of money large enough to be "worth it" but small enough to encourage defendants to just settle for a quick payment instead of risking court costs that might exceed the settlement payment. It's not an explicit tactic or anything, merely the outcome of continued selfish self optimisation on behalf of both plaintiffs and defendants seeking "justice money" through such lawsuits.</comment></comment>


PC Assembly Book (2006) - <AUTHOR> https://pacman128.github.io/pcasm/ <comment><USER2> Author here. Surprised to see this here.

I wrote most of the book for the class I was teaching in the 90's. All the textbooks I could find were for 16-bit DOS assembly. I wanted to do 32-bit and use free software. I picked NASM and djgpp because most of my students used Windows. There was no free express version of MS Visual Studio back then. I also wanted to cover interfacing with C since that's how one typically uses assembly, plus it shows how C operates under the hood.

I went into industry in 2000, so never had the time to update it to 64-bit.

<comment><USER3> > I grew frustrated at teaching 16-bit real mode programming and decided to > change to 32-bit protected mode. However, I soon ran into a problem. I could > not find a textbook that covered 32-bit protected mode assembly programming!

I skimmed through the book a bit and there is an explanation of what protected mode is in chapter 1, but the actual teaching assembly part of the book seems to be all 32 bit real mode. Is that correct?

<comment><USER2> No, it's all in 32-bit protected mode.

</comment></comment></comment><comment><USER4> imo it really increases you understanding of security issues, stack, heap, over- and under-runs, debugging without source-code, low level caches etc. people often dismiss it because it not being a useful language to implement applications, but it's kind of essential when optimizing C (you might want to play with inline assembly called from C - not always to make things faster but to better understand where your money is spent).

A great place to visit for a break is @x86instructions Twitter[1] feed. Absolutely hilarious (and you will need some humor to keep your sanity with Assembly on Intel), e.g.:

MOV - Literally Copy Something Instead Of Moving It

or

VLTAYTMPNL - I'd Like To Add Your Scalar Vector Lane To My Professional Network On LinkedIn

...

[1] [https://twitter.com/x86instructions](https://twitter.com/x86instructions)

</comment><comment><USER5> I'd encourage every programmer to learn some basic assembly. Arguably ARM assembly is slightly easier to learn but either one will give you a better understanding of the API that your programming languages are abstracting over.

And in my experience it makes teaching about C pointers so much easier.

<comment><USER6> I'm going through this at the moment.

I've come to the point in my life where I've realised I don't understand modern computers, so tasking myself with trying to learn about this stuff.

My mental model of computing is stuck at around the Z80, I wrote a gameboy emulator a few years ago, but that's far away from what modern machines are doing!

</comment></comment><comment><USER7> I got a printed copy of this book. It's a great introduction to x86.

</comment><comment><USER8> I'm learning about compilers and operating systems. And I don't know how much assembly should I learn. Ofc, I can't read whole x86 manual.

<comment><USER9> Enough so that you're comfortable that you have a solid mental model of what the CPU is actually doing when a given program is running. (i.e. at least get to the point where the CPU is no longer a black box to you.)

<comment><USER8> I did take a computer architecture class but all there was addressing modes and few basic instruction classes. Things got difficult when I started studying OS. Then I came to know that sopport for things like page table, higher privilege level instructions etc are all in Architecture itself (Though I still have to read about them from manual). I don't know what else am I missing.</comment></comment></comment>


Ask HN: What is your server side language of choice and why? - <AUTHOR> <comment><USER2> Erlang, because is the realisation of Alan Kay messaging.</comment>


UK judge says 'freedom of information' means choice of digital file format - <AUTHOR> http://www.washingtonpost.com/blogs/the-switch/wp/2014/08/05/uk-judge-says-freedom-of-information-means-choice-of-digital-file-format/ <comment><USER2> I can't think of anything more obtuse than releasing a database as a hundred plus page PDF. It seems like the bureaucrats responding to these requests are specifically trained to _not_ release information.

<comment><USER3> They want to minimize the amount of time they spend on the FOIA requests, because it comes out of their operating budget. So they select the releasable records and then print them to pdf, where they can do any necessary redaction before release.

Exporting them into another _database_ where they can be manipulated freely is beyond the skills of most database users, and requires an expensive database administrator, who will have to have meetings with the administrator of the original database, which might result in travel requests, expenses...at which point most organizations will invoke the clause in FOIA rules (at least in America) of charging the requestor the reasonable costs of the data retrieval, which in a case like this will be substantial - at least a few thousand. Bear in mind that that FOIA requests are rarely so broad in scope as to justify the release of an entire database; most requests are for a subset of information about particular individuals, timeframes, political administrations or suchlike.

I often dig through stuff like this in PDF format (because I enjoy reading court cases), and while I can't say I like it, if I really need to get the data out I set up some sort of scraping macro. Most people want something in human readable form and I suspect that if they were given an optical disc with an SQL dtabase on it, or even an XML file, they'd complain about the impenetrability of it.

Perhaps you could suggest some good candidates for release formats that met the criteria of being easily accessible/convertible as well as being manipulable and easy to produce.

<comment> jon-wood > Perhaps you could suggest some good candidates for release formats that met > the criteria of being easily accessible/convertible as well as being > manipulable and easy to produce.

The entire case here was around the requestor specifying he'd like the data in Excel format (although presumably CSV would also be acceptable). I can't think of many databases which can't export query results to CSV, or indeed many civil servants who are so completely inept with a computer that they couldn't redact information as (or more) easily in Excel than they could with a PDF.

<comment><USER4> _> 'I can't think of many databases which can't export query results to CSV...'_

This is pretty much irrelevant as these requests are not going to end up in the hands of a DBA, or anyone with anything approaching direct access to the databases in question.

It's going to end up with someone who has an adversarial relationship with their own IT department as a 'maker of work'. Bureaucracy isn't something these agencies foist on the public, it just as bad if not worse inside.

The request will go up and down through a series of managers, directors and deputies before being put on the schedule for a change control board meeting.

In that meeting, a representative of the database administrators will explain that this request is not only complex, but potentially quite dangerous. He will point out that required data is actually completely accessible via a clunky mainframe interface wrapped in Java.

Some plebe in the receiving office of the request will end up clicking through that Java interface and printing/exporting the requested data _one page at a time_.

This process will repeat itself until such requests are a weekly if not daily occurrence at which point the plebe might be given a dedicated interface for exporting such requests.

 _> '...or indeed many civil servants who are so completely inept with a computer that they couldn't redact information as (or more) easily in Excel than they could with a PDF.'_

I take it you've not met many civil servants then?

In any case, the mechanics aren't really the issue. It's the game of hot potato behind the scenes and the eschewing of responsibility that takes place at all levels.

I can virtually guarantee that even if all the stars aligned such that someone did obtain and redact a fully electronic copy of such data it would be rejected for release due to the 'unfamiliar' format. Someone in the chain would fear that they couldn't be sure of what they were releasing because it's not in the specific format they're used to.

<comment><USER5> I know many civil servants. The ones with access to run queries on a database know how to export to Excel. If anything, there's an over reliance on Excel.

</comment></comment></comment></comment></comment><comment><USER6> I'm sure there are political reasons, but it is very hard for me to understand _why_ agencies purposefully keep the data obscure.

Opening data stimulates innovation around that data. It benefits society by allowing analysis to provide value, and improves the economy through the sale of related products.

Every time I see things like this, I cannot help but hope that if not my children's generation, at least my grandchildren's will be one that takes for granted accessible free information from public agencies. So many good things would come from old world beaurocrats relinquishing their stranglehold on data that is payed for by the people who need it the most.

<comment><USER4> _> 'I'm sure there are political reasons, but it is very hard for me to understand why agencies purposefully keep the data obscure.'_

I can understand / attest to both of the following stances by experience:

Thinking idealistically, it's a basic deterrent against lazy, disingenuous, 'data out of context' arguments. By keeping that data obscure you're building in a selection process. Requiring potential detractors to put forth even the small effort of cutting, pasting and sorting will deter many before they begin.

Thinking cynically, it's a basic deterrent against uncovering widespread lies and corruption. Keeping the data obscure will encourage the people who might uncover your schemes to look for easier, juicier targets.

 _> 'Opening data stimulates innovation around that data.'_

It's an enabler sure, but I'm not so sure about a stimulator.

As best I can tell, most FOIA requests primarily serve the lawyers hired by various agencies to sue each other or the Government in the process of contract grievances.

 _> 'It benefits society by allowing analysis to provide value, and improves the economy through the sale of related products.'_

It certainly could, but it's easy to forget that many people working in Government are just as self-interested as anyone else. They're no more interested in the big picture than the next man. More importantly, no one below the level of perhaps a local Mayor and his/her lieutenants have their jobs tied to economic performance or general well-being of their constituents.

</comment></comment><comment><USER4> My general impression, having seen the 'inside' of such processes, is that everyone would be better served by mandates around open data than continued interpretations and amendments around FOIA.

1.) The most common sort of requests (salary schedules, the outcomes of past competitive bid processes) are for information that could/should simply be public in the first place.

All this stuff can simply be published as part of a normal workflow rather than manually compiled on a per request basis.

2.) Compliance could be checked trivially via API rather than having to wait for failures to bubble up over time and potentially raise scandal.

3.) Proper funding could be allocated and structure put in place to build and maintain these services. As it is, there's a good chance any given request lands on the desk of some plebe who lacks the knowledge, tools and authority to handle the request correctly or efficiently.

</comment><comment><USER7> Well that will just result in someone manually cutting and pasting stuff into excel and exporting a CSV. We are doomed to live the following by specifying it:

[http://wyorock.com/excelasadatabase.htm](http://wyorock.com/excelasadatabase.htm)

This is due to government assignment policy which is delegate it until there is no one left to delegate it further resulting in the lowest paid and skilled workers performing the above.

<comment><USER3> I don't think that's peculiar to government - sounds like any other large organization with a hierarchical structure.

<comment><USER7> I've worked in various capacities in government and non-government organisations. It is much worse in government than not from experience because they are cesspools for the incompetent at best. In a private sector company people are considerably more aware of their standing and not heavily unionised into artificially secure positions.

</comment></comment></comment><comment><USER8> I can see this backfiring if someone requests data in some ancient and obscure format just to be annoying.

Data needs to be provided in a reasonable and usable format; that imposes some responsibility on both the provider and the requester.

<comment><USER9> Would there be anything to prevent someone from creating a one off file format that requires a license fee and just start making FOIA requests in that format. If not, this seems like something that could be exploited for profit.

<comment><USER10> Don't FOIA requests usually require you to pay reasonable fees? I know they're not free....

</comment></comment></comment><comment><USER11> Recently I was trying to get hold of local plan housing allocation which detail where new building is likely to be. The local authority would only give me PDFs of maps with hundreds of insets which obfuscate everything. With a proper digital format national mapping would be possible. The public could easily find out where new developments are going, something that is very hard to do now.</comment>


History according to E.H. Carr - <AUTHOR> https://www.newstatesman.com/culture/books/2019/05/eh-carr-what-is-history-truth-subjectivity-facts <comment><USER2> I analyzed Carr's 'Twenty Years Crisis' in my doctoral thesis on realist theory in international relations. In addition to 'What is History?' this is a great read, with the underlying idea that you can't assume that things change just because we want them to change, or even because a lot of people agree that they have. While he was focused on foreign affairs in Europe, the same likely holds true for domestic politics, too.</comment>


Using designs on Dribble - <AUTHOR> Is it ok if I use designs on Dribble for my applications? <comment><USER2> No, not without explicit permission by the designer. They post on Dribbble so you find and hire them, not to give away stuff.</comment>


A trail of toxicity: the US military bases making people sick - <AUTHOR> https://www.theguardian.com/us-news/2019/may/23/chemical-colorado-springs-military-communities-pfcs <comment><USER2> I live near a Navy air Base and am concerned by the amount of unfiltered pollution spewed out by cargo and fighter jets.</comment>


Apple reportedly giving the Chinese gov access to devices for security checks - <AUTHOR> http://qz.com/332059/apple-is-reportedly-giving-the-chinese-government-access-to-its-devices-for-a-security-assessment/

<comment><AUTHOR> Title shortened a bit to comply with the 80-character limit.</comment>


Uber Valued at More Than $50B - <AUTHOR> http://www.wsj.com/articles/uber-valued-at-more-than-50-billion-1438367457

<comment><USER2> This chart is interesting, noting that they don't use the world "unicorn" they call it the "billion dollar startup club"

[http://graphics.wsj.com/billion-dollar- club/](http://graphics.wsj.com/billion-dollar-club/)</comment>


Turning the world into a 'safe space' – but at what cost? - <AUTHOR> https://thehill.com/opinion/civil-rights/496981-hygienic-fascism-turning-the-world-into-a-safe-space-but-at-what-cost <comment><USER2> It is obvious now that if totalitarianism is to be imposed on a modern country, the easiest route is via scientific authority coupled with technological tools. In the US, the constitution (such as it is) was voided and very few people objected. (This is an objective fact, not a value judgement. I am as confused and concerned as the next person.)

That does not mean that the current situation is an attempt to impose a totalitarian system, but it does give me pause.

<comment><USER3> An indefinite state of emergency is an indefinite state of tyranny. I don't like any of this one bit. The arbitrariness of the Covid restrictions, quarantining the healthy, the symptomless, and the young, who show extremely low levels of susceptibility...is crazy. We've never approached a pandemic in this way in human history. Even during Spanish flu, which was several orders of magnitude more deadly than Covid, there was a few weeks of shutdown in a handful of cities and mask wearing mandated in a handful of cities for a few weeks at most.

In my particular state, Texas, 3300 have died from Covid. 6 months into the pandemic. Population 27 million. In 2018 we lost over 10,000 to the common flu. At this pace Covid will have fewer deaths than the flu in 2018.

I think they've turned the entire planet into a TSA checkpoint. Asinine process, arbitrary rules, shutting down businesses who have no legal recourse, forcing compliance and huge fines for not doing so. This is all too much. An individual has the sovereignty to assess their own risks. Give people information, but let them make their own choices.

I have yet to hear when these arbitrary draconian policies will be rolled back. The disease may be with us forever. Somehow our ancestors went through Spanish flu, tuberculosis, polio, and smallpox without these sweeping policies. It's quite maddening.

<comment><USER4> How many of people contracted Covid-19 and will have health issues for the rest of their lives? How does that compare to the flu?

<comment><USER2> How many of people have lost their jobs, begun using drugs, or suffered permanent psychological damage and will have health issues for the rest of their lives? How does that compare to the benefits of the lock down?

It's a very difficult situation to understand.

<comment><USER4> Agreed. It is a difficult situation to understand. And I think we are still in the early stages of learning about the virus, what it does to various human bodies, ages, etc - and more importantly - that we should not roll back the lockdown until we think its safe to do so no?

<comment><USER2> I don't know.

</comment></comment></comment></comment></comment></comment><comment><USER5> This also depends on the country.

We have in France a heightened level of terrorist attacks (plan vigipirate). This is in place for two years now and gradually everybody starts to ignore it because the authorities did not lower it.

It started on everyday life, then schools were not that protected anymore, then the administration buildings.

I actually had to look up whether it is still in place.

So you have countries where a long state of alert can turn into tyranny, then you have France where everybody ignores it after some time.

</comment><comment><USER6> Honestly a horrible article. From comparing the current state of affairs to Henry Simon's utopian socialism, or asserting that Bill Gates symphatizes with Chinese authoritarianism, or even the term 'hygienic fascism' and Italian blackshirts and "climate crusader Jerry Brown".

Are we looking at the same US here? The US can't even get people to wear masks properly while cases are exploding and riots took place. I'm pretty sure the US is far away from Brave New World technocracy.

What strikes me as oddly 'fascist' if we are going to use that word is this acceptance of death and disease in the name of freedom, as if safety does not matter and mom and pops and the sick and the weak have to be sacrified so the economy can keep going and the youth can enjoy their beachtime. I mean it really betrays a childish worldview to think safety and freedom are polar opposites. _Public health is a requirement, not an enemy of freedom_. You don't have much freedom if your lungs don't work.

<comment><USER7> > You don't have much freedom if your lungs don't work.

Freedom and safety may not be polar opposites, but there's certainly tension between them. Many believe that you should have the freedom to decide what to do with your own lungs. The idea that you lose freedom because your lungs don't work seems to be a willful misinterpretation of the idea of freedom from government.

<comment><USER8> Should you have freedom to walk naked? Nudists were advocating this kind of freedom for a long time. I personally have sympathy for this point of view.

Passing COVID-19 or flu onto another person, especially elderly, may kill that person. Walking naked with mask if you keep your body clean as far as I can see will not kill anybody. So, why should we enforce clothes if we do not enforce masks?

<comment><USER9> Bans on public nudity are almost certainly motivated by moral decency and not subjecting children to this, not for health reasons.

<comment><USER8> I know. So, just to be sure. Are you suggesting that limiting freedom because of "moral decency" is ok, but limiting freedom because you can kill people is not? And what is "moral decency" anyway, because in many Asian countries people will look at you as if you are breaking moral standards when without a mask.

Also, children are perfectly able to handle asexual nudity. A lot of countries in Europe allow being top-less in public places like beaches.

There is just no way to justify things like enforcing bras on women, but not enforcing masks in crowded places during pandemic.</comment></comment></comment></comment></comment>


Ryzen R1000 SoC offers dual Zen and triple Vega cores with a 12-25W TDP - <AUTHOR> http://linuxgizmos.com/ryzen-r1000-soc-offers-dual-zen-and-triple-vega-cores-with-a-12-25w-tdp/ <comment><USER2> Practically speaking, most people who want this tech probably should just get an AMD laptop (Ryzen 2500U), or build a AM4 MicroATX PC build.

Your typical Ryzen 5 2400G is quad-core, 3.5 GHz (3.9 Boost) with 8x Vega EUs. Typical builds would be around 20W to 70W ([https://www.anandtech.com/show/12425/marrying-vega-and- zen-t...](https://www.anandtech.com/show/12425/marrying-vega-and-zen-the-amd- ryzen-5-2400g-review/13)). Its hard to beat a standard PC build in cost, flexibility, and performance.

Ryzen 5 3500U laptops are under $600. Quite bad specs (as any other $600 laptop would be: 720p, Hard Drive, etc. etc), but yes they are available. [https://www.newegg.com/Product/Product.aspx?Item=9SIA6ZP8Z20...](https://www.newegg.com/Product/Product.aspx?Item=9SIA6ZP8Z20670) . The 3500U also is quad-core with 8x Vega EUs.

For those with power and size restrictions, as well as the need for a long- term embedded solution... this R1000 SoC will fit their bill. Digital signage, Casino slot machines, etc. etc.

\</comment><comment>--

For those with supercomputing needs, Vega 64 and Radeon VII have 64x Vega execution units. Even a RX 580 GPU has 36x EUs (just ~$200).

<comment><USER3> Thinkpad E485 seems like a nice little machine that satisfies my main requirement -- any kind of upgradability.

Other than disappointing 720p camera and one USB 2.0 port (why not USB3???), everything else looks ok:

* 14" 1080p IPS (is an option, which should be checked off)

* Upgradable RAM (Up to 32GB)

* 2.5" bay

* Upgradable NVME (128GB standard option)

* Weight 1.75Kg -- I can deal with that. Ultrabooks are ~1 kg. This seems reasonable.

<comment><USER2> I personally would go with an HP or Dell.

The HP Envy x360 Ryzen 2500U laptop I got was $699 for 1080 IPS and... a very, very, very good service manual. [http://h10032.www1.hp.com/ctg/Manual/c06001791](http://h10032.www1.hp.com/ctg/Manual/c06001791) (EDIT: linked the wrong laptop a few times... this is the one I got)

HP's and Dell's stuff usually have manuals of this caliber. As such, I usually buy a cheap HP or Dell and then service some upgrades myself (replace the hard drive, get an NVMe, upgrade the RAM, etc. etc.)

HP has been pushing "pen" compute, so it has a capacitive touch-screen and active digitizer, for anyone who likes Microsoft OneNote. Microsoft created the new universal pen standard, so its now possible to mix-and-match stylus across different laptops now (at least... any stylus that follows the universal pen protocol). Its still a relatively new protocol, but I got a Wacom active-stylus working with my HP laptop, so I'm pretty happy.

\</comment></comment></comment><comment>-

Its more expensive than what I listed, but I'm personally willing to pay a bit more for slightly better quality than the bottom-tier stuff. The only real downside to the HP Envy x360 is the terrible 6-bit screen: yeah its IPS but its got subpar brightness and poor color accuracy. Good enough for my purposes, but any artist will want to spend on a more accurate color- calibrated laptop screen.

But yeah, just visit a store (Best Buy, Fry's, Microcenter), pick a Dell or HP you like the screen / keyboard / touchpad of... double-check online to ensure that the service manual has all the features you expect (M.2 slot, SATA, etc. etc.)... and just buy the bog-standard mass-production model there and then. Order a few parts online (new M.2 SSD) and you'll be set.

<comment><USER4> Do you run Unix on the HP Envy?

<comment><USER2> Nope. Honestly, if I need Linux, I spin up a VM, use Ubuntu (Windows Store), or ssh into one of my Linux boxes.

A laptop is a "client" system. Windows license came free, so there's no real $$ problem using Windows from my eyes. And now that Ubuntu on Windows works well, I got all the SSH / command line tools needed to interact with my servers quite well.

\</comment></comment></comment><comment>--

I'd bet on Dell for Linux support. Specifically their Ubuntu Linux line of laptops. They're expensive, but they are high end and seem like they're worth it to anyone who needs a real Linux environment.

[https://www.dell.com/learn/us/en/555/campaigns/xps-linux- lap...](https://www.dell.com/learn/us/en/555/campaigns/xps-linux-laptop_us)

I've heard good things about this line, but I've never used it before. Basically, its a laptop with every device driver optimized to work with Linux well. You gotta pay up for it, but I've never heard any issues come out of any user of the Dell Linux line.

<comment><USER4> Thx - I respect your choice. In my situation, though, my dev env has to be a non-virtualized Linux OS with good gpu access.

</comment></comment><comment><USER5> If AMD can afford to announce this now rather than 1st of May, which is their 50th anniversary, it suggests they have seriously impressive announcements to make in the anniversary event.

<comment><USER6> Why? This doesn't look like anything new. It's just a cut down, low power variant of old, existing tech (zen, 14nm, vega - we've all heard this story for the last 2 years). It's kinda cool, but it's not worthy of an event of any kind, either.

The article words it really badly for some reason. For example "dual quad- threaded cores" \- except it isn't, it's dual dual-threaded cores, more commonly just referred to as 2c/4t. And calling it "triple vega cores" sounds cooler than the "vega 3" it actually is. Slightly faster than Intel's i3-8145U from Q3 last year (also 2c/4t), but same basic product & capabilities as those that have been on the market for years.

Only semi-interesting part is the dual 10gbe. Cost on that would be the interesting part if this suddenly results in a new lineup of consumer NAS products with cheap 10gbe options.

<comment><USER7> ECC memory support in such a small package is interesting. I I don't have high hope that we'll get a consumer lineup and buying the industrial pc is usually not worth it if you need to build a NAS.

<comment><USER6> > ECC memory support in such a small package is interesting

Intel has been equipping Atom SoCs with ECC support for a while now. For example the Atom c3950 - 16 cores, ecc memory, 24w TDP, and a tray price of $389.00

[https://ark.intel.com/content/www/us/en/ark/products/97940/i...](https://ark.intel.com/content/www/us/en/ark/products/97940/intel- atom-processor-c3950-16m-cache-up-to-2-20-ghz.html)

You'll find all sorts of fun supermicro boards using Atom CPUs in this series at reasonable-enough retail prices, even.

> buying the industrial pc is usually not worth it if you need to build a NAS

I was more thinking Synology or Qnap consumer/SOHO NAS products, not DIY NAS.

<comment><USER7> > I was more thinking Synology or Qnap consumer/SOHO NAS products,

Yeah, lets just hope so. Why I was skeptical is that the margins is so low in consumer products that good hardware is often not even given a consideration by the producers. Although that might be changing as consumers get more and more educated and start to demand more from the companies.

</comment></comment></comment></comment></comment><comment><USER8> "Early adopters include Atari, which is using it for its VCS"

Wasn't aware of this before!

[https://en.m.wikipedia.org/wiki/Atari_VCS_(2019_console)](https://en.m.wikipedia.org/wiki/Atari_VCS_\(2019_console\))

<comment><USER9> I wouldn't get your hopes up. The Register (I know people have opinions about The Register) reported on Atari's press reveal last year[0] and the VCS wasn't actually a thing. So Atari tried to call them out on it, and they posted their recordings of the event.

I personally don't need another TV-connected video game system, and I did enjoy my playthrough of Alone in the Dark (Infogrames is calling themselves Atari these days) but I'm not buying one.

[0][https://www.theregister.co.uk/2018/03/22/atari_lempty_box/](https://www.theregister.co.uk/2018/03/22/atari_lempty_box/)

[1][https://www.theregister.co.uk/2018/06/21/atari_interview_in_...](https://www.theregister.co.uk/2018/06/21/atari_interview_in_full/)

</comment></comment><comment><USER10> I wonder if pc-engines will come out with a new board based on this. The APU platform is getting a bit long in the tooth.

<comment><USER11> I asked Pascal Dornier about the V1000 and was told that the TDP of the newer SoC's is well outside of the cooling capacity of the standard APU case so it's a no-go. The current APU2 g SoC TDP is 6.5W where as the V/R SoC's start at 12W.

I also asked about a version with audio, video and socketed ram and was again told no. The reasons were A. little demand and the market is already saturated, B. Socketed RAM is not as easy to implement as you think, C. HDMI licensing is expensive for a small company, D. AMD does not give them good support.

</comment></comment><comment><USER12> > dual quad-threaded cores

ooh, is that the first SMT4 on an amd64 processor?

<comment><USER13> I think that was an awkward way to say a 2 core, 4 thread CPU. IE 2 threads per core. [https://www.amd.com/en/press-releases/2019-04-16-amd- expands...](https://www.amd.com/en/press-releases/2019-04-16-amd-expands- embedded-product-family-adds-design-wins-and-customers-new)</comment></comment>


Syria bans iPhone, the greatest device ever built by a Syrian. Go figure. - <AUTHOR> http://www.timeslive.co.za/world/2011/12/02/syria-bans-iphone-to-cover-up-protest-clampdown-report

<comment><USER2> I wasn't aware that the iPhone was in fact engineered, designed, component sourced or tech specced by Steve Jobs.

Or that Syria was his "home country" as stated.</comment>


Our Beta is Now Open to All Developers - <AUTHOR> https://www.firebase.com/blog/2013-02-13-firebase-opens-beta-to-all-developers.html

<comment><USER2> Having built a bunch of real-time infrastructure before, I'm glad that there is now a better option than hundreds of hours of blood, sweat, and tears. (lots and lots of tears)

Firebase is a neat take on what a world of real-time for "free" could be like. If nothing else, I dare you to find a faster experience for prototyping that can subsequently scale into your production app. :) I also know several of the guys there - all of whom I would work with in an instant if I had the chance. The beta is a big step for them, but I can guarantee you even greater things are to come from that team.

Congratulations guys!

<comment><USER3> Thanks Chris, I'll look into it based on your recommendation!

</comment></comment><comment><USER4> This is great news. One thing I can't get my head around, I actually spent some time yesterday evaluating using Firebase, cloned the FireFeed demo app and browsed it, but I still have one thing I guess I'm missing completely.

Can someone explain this: is there any way to have a secure app with only HTML JS and no back end at all? I assume you must at least have something on the server to add your secret key, right? Or is there some magic way to ensure no one else is writing or reading to/from your Firebase acount. I'm sure it's documented, but if it does, it's not that clear to me, seems there has to be at least one small server layer for you to make it really work, did I miss something?.

<comment><USER5> Great question! The key to our security model is our Security Rules system. Security rules are authored by the developer and stored as part of their Firebase. Firebase then executes them automatically to validate all reads and writes of data.

You can check out the rules for Firefeed here: <https://github.com/firebase/firefeed/blob/master/rules.json>

And be sure to check out our Security Quickstart Screencast, walking you through the system: <https://www.firebase.com/docs/security-quickstart.html>

<comment><USER4> Few more questions if I may:

1) indexing, didn't see any options, I assume it's planned in the future along with more complex query language?

2) self register as a RequireJS / AMD module, is this planned?

Again, this is great. thanks

<comment><USER5> 1\. The API was designed pretty carefully to ensure we wouldn't box ourselves into any corners that would limit our real-time or scalability capabilities. So we've intentionally avoided advanced querying for now. You may see features along these lines in the future, but right now we recommend denormalizing your data during writes to match how you want to consume the data (which is a pretty common nosql practice). Firefeed is a good example of this, actually.

2\. RequireJS is on our radar. I don't know too much about it, but if developers want it, we'll likely end up adding it. :-)

<comment><USER6> On the denormalization front, is it possible to do transactions without locking / syncing the entire tree. I'm thinking friendship modeling like:

      user1.friends = ['user2']
      user2.friends = ['user1']

<comment><USER5> Transactions have to be done at the common ancestor of the data being modified, so it's best to use them for data that's nearby in the Firebase data tree. You /can/ do a transaction on a large chunk of data (e.g. the entire user list), but the client would need to sync the entire data and there'd be a greater chance of contention.

If you need atomic bidirectional friendships though, you can do it if you structure your data a little differently. To turn a friendship between a pair of users on and off, you could set /friends/user1/user2 to true iff user1 and user2 are friends. Then you can write security rules that are based off of that to allow and deny access to the users' data.

</comment></comment></comment></comment></comment></comment><comment><USER7> Disclaimer: I did contract work for Firebase.

First off, the Firebase team is beyond incredible. The dedication they show to their users and their product vision is unparalleled.

Second, the product is awesome. I can barely throw together a static HTML file without help and now with Firebase I've been able to mash together all kinds of neat little interactive WebGL demos.

As I spend more time developing my programming skills I'm happy knowing that Firebase will be there to help me grow.

Awesome release guys! Congrats!

</comment><comment><USER8> I love Firebase! <http://scratchpad.io> wouldn't have been possible without it, and the team is super responsive to support requests.

<comment><USER9> Did not know this tool. Great stuff you created there!!

</comment></comment><comment><USER10> Awesome product. Built socrates.io on it and plan to use it for all my other similar projects

Keep killing it guys!

<comment><USER11> Oh god that "blinking cursor" in the socrates.io tab is annoying.

</comment></comment><comment><USER12> Firebase allowed us to build socrates.io over one weekend. We didn't have to write a backend, plus we got realtime for free.

I'm excited to see their product mature.

</comment><comment><USER13> This looks like a fantastic service for game developers (indeed, one of their examples is multiplayer Tetris). Building backend infrastructure to facilitate realtime communication and features like leaderboards, and making them scale when the game becomes a hit, is difficult. Anything that lets game designers get back to developing the gameplay itself is hugely beneficial. For certain types of games it'll probably make more sense to use a dedicated service like Photon Cloud [1] that focuses solely on realtime multiplayer, but for simpler web games, Firebase looks promising.

[1] <http://cloud.exitgames.com>

</comment><comment><USER14> I see they have a transaction system to manage conflicting edits. How does that handle nested data? If a parent is renamed or moved in the order is an offline edit to the child element rejected?

I want to add synchronisation to my lists app (<http://human- friendly.com/software>) but I'm not sure that there is a solution that always gets it right without nasty user interventions or throwing away data in some scenarios. My fear is continually pushing it down the priority list for development.

<comment><USER15> We definitely allow you to manage lists in a consistent manner. Can you email me directly with your exact use case and I can help you get started? andrew at firebase dot com.

</comment></comment><comment><USER16> Is it possible to use Firebase with Ember for instance? Technically, I know it's possible, but I mean, is it a viable option? Or, say, there would be a lot of redundancy between both?

<comment><USER15> Yes! Absolutely. A number of people are doing this already. We don't yet have an official binding for Ember, but we do have one for Backbone [1].

[1] <https://github.com/firebase/backfire>

Update: There's a user-built binding for Ember here: <https://github.com/maiah/emberfire>

<comment><USER17> An example with AngularJS would be fantastic, if anyone has something to share. I'm doing some teaching at the moment with AngularJS.

<comment><USER18> Here are some GitHub projects that user Angular & Firebase

[https://github.com/search?q=firebase+angular&ref=command...](https://github.com/search?q=firebase+angular&ref=commandbar)

</comment></comment></comment></comment><comment><USER19> I found this particularly interesting - <https://www.firebase.com/docs/security/custom-login.html> \- since it allows you to integrate with existing apps.

Are there any other BAAS providers that have something similar?

</comment><comment><USER20> If you want to write code instead of back ends, this is the tool for you. Don't waste a minute dealing with servers and databases and real-time technologies. Just get Firebase and build your product.

<comment><USER21> Curious, what do back ends consist of if not code?

<comment><USER22> Semantics. Back ends are coded; it's just boring code. In any case, I can see this being useless for a lot of commercial projects if there is is no way to avoid data travelling outside your network. Or at least, that might make businesses apprehensive about using it.

</comment></comment></comment><comment><USER23> I've been following this team, and the product, since pre-launch. They've made a great product by listening and being really responsive to users and building what we, developers, want.

</comment><comment><USER24> Great work guys.

Any chance of creating Java and .NET clients?

</comment><comment><USER25> It seems like Firebase removes the backend completely. It just pushes data sent to it to all clients. This means data is always handled client side.

So instead of (Client)->[Your Server]->(All Clients), Firebase replaces your server so you effectively get (Client)->(All Clients).

 _This means if you wanted to save something you would have to make the (Client)- >[Your Server] request separately._

<comment><USER15> Firebase persists all data permanently (and we back it up, etc.), so your data is "saved" just by using Firebase.

If you want to access the data from your own servers, we recommend actually having your servers talk to Firebase directly. So the data flow becomes (Client) -> (Firebase) -> (Other Clients and your servers)

We provide a Node.js client and a REST API to make this easy.

<comment><USER25> Awesome! I guess I'll be giving Firebase a try then, thanks for clearing that up.

</comment></comment></comment><comment><USER26> I said this last time Firebase was on HN, but I'm more than happy to say it again: if you're doing anything with real-time, you owe it to yourself to give Firebase a shot. We've been using Firebase for 8 or 9 months now, and I can't being to count how much time it's saved us, allowing us to focus on what makes our app unique rather than scaling a real-time communication server of our own.

</comment><comment><USER27> Firebase is such a massive time saver! It seems every JavaScript developer I introduce to it love it instantly.

I wish I had thought of it :-)

</comment><comment><USER28> Looks interesting.

The idea seems to be that Firebase is all the server back-end you need. I can see how that could work for many applications.

On the other hand, as applications grow I can also see how you might arrive at a point where you _do_ want to run code on a server. Is it possible to access a Firebase database from the server-end of things?

<comment><USER5> Absolutely. Our Node.JS Library[1] and REST endpoints[2] are for exactly that. So you can still keep all the benefits of Firebase (real-time data synchronization between all clients of your app) while augmenting it with server-side code specific to your needs.

[1] <https://www.firebase.com/docs/nodejs-quickstart.html>

[2] <https://www.firebase.com/docs/rest-api.html>

</comment></comment><comment><USER29> The tutorial on the website is pretty cool, any other ones I can check out? Good luck with Firebase it's off to a great start!

</comment><comment><USER30> Congrats James + team. I'm super excited to get this into Codiqa, I think the rapid development aspect is hugely valuable.

</comment><comment><USER31> Written some node.js + socket.io applications in the past. I like that you packaged storing info in the database. This is a great tool for a hackathon but if you are doing anything more complicated I think you would want to write you own back-end. Good idea guys keep innovating.

<comment><USER9> Agree with you. Sounds nice to throw a quick prototype or small apps (btw <http://scratchpad.io> is awesome) for someone who dont know scalable/parallel technology such ar Erlang or Node.JS. If you are creating a startup and planning to charge customers, I suggest you invest in your backend.

</comment></comment><comment><USER32> Just added real-time cursor/selection synching on Plunker using Firebase. It couldn't have been much easier to integrate.

Demo: [http://beta.plnkr.co/edit/?p=preview&s=FirebaseInBeta](http://beta.plnkr.co/edit/?p=preview&s=FirebaseInBeta)

</comment><comment><USER33> Here's a rough threaded comments example made with Firebase and Knockout. I'm sure there are better ways to do this.

<https://github.com/reproveme/firebase-comments>

</comment><comment><USER34> Firebase powers the realtime syncing in SlideScroll. I've also used it on several of my smaller project. It's easy to set up and way more stable than trying to roll you own socket implementation.

</comment><comment><USER35> I think it would be helpful to explain how this compares to using Pubnub, Pusher, SignalR, etc for real time communication? What additional features does this have, etc

<comment><USER15> [Firebase founder here] We talk about this briefly in our FAQ [1]. Here's the quote:

"PubNub and Pusher are both great services that provide simple real-time messaging for applications with a "publish / subscribe" model. Firebase takes a broader approach and provides real-time updates, data synchronization, and data persistence as one unified service.

This unified approach allows for simpler application development. Developers who build their software with Firebase will automatically handle real-time updates, and their products will work in "off-line mode", both without any extra work from the developer. More importantly, Firebase can serve as a complete backend for most applications—completely eliminating the need for developers to manage servers and write server code."

[1] <https://www.firebase.com/docs/faq.html>

</comment></comment><comment><USER36> So glad to see it out of beta. Can't wait to start using it!

</comment><comment><USER37> Looks very useful, what do you guys think of the pricing? seemed a little expensive to me, maybe 1000 connections at a time are enough?

</comment><comment><USER38> I was thinking about something like this could be really handy last night. Great work!

</comment><comment><USER39> Congrats James & team! I'm looking forward to building something rad on Firebase.

</comment><comment><USER40> Congrats guys! I love Firebase!

</comment><comment><USER41> Great team, amazing product, really excited about where they're headed.

</comment><comment><USER42> Could this be used for updating windows live tiles in an app?

</comment><comment><USER43> I can't get over how radically expensive their bandwidth is.

1tb for $2,000? Wow, breathtaking bandwidth costs. That's at least ten times higher than I would have expected.

It makes Firebase completely unusable for any service that needs scale, unless you've got more money than you know what to do with of course.

<comment><USER15> [Firebase founder] I would caution against comparing our pricing to S3 or any other non-realtime storage service. Firebase's use case is primarily for serving structured data (the type of data that lives in a database). For most apps, this is a small piece of overall data usage. Your site probably spends most of its bandwidth usage on downloading static content -- HTML, CSS, images, videos, etc -- which you don't need to store in Firebase (you can, but if you're looking for a cheap way to store big video Files, Firebase is not the answer).

Also keep in mind that for most apps, 90%+ of infrastructure costs come from running servers, not bandwidth. So while we may seem more expensive than other services, we eliminate your costs for servers and backups. The _only_ thing you pay is the per-bandwidth/storage price. Also keep in mind that Firebase apps can often use less data per-user than traditional apps, since they push data only when it changes, rather than polling.

The vast majority of the apps on Firebase today will fit nicely in our free plan.

<comment><USER43> I wasn't comparing Firebase to S3 (etc) so much as to what bandwidth actually costs service providers.

The only rational explanation I can come up with for the high cost is that it's a means of throttling use until you can acquire greater scale.

I've tracked Firebase with great interest since first hearing about it on HN. I'm disappointed by the cost, but I'm willing to give it a try and see how the value proposition ultimately stacks up.

In my use case, bandwidth is the primary cost concern with Firebase, but it's all text data (constantly dumped, so storage requirements are modest).

<comment><USER15> Keep in mind that most of our costs are also not bandwidth. Our primary costs are the servers, our CDN, backups, and operations. Bandwidth is just one small piece.</comment></comment></comment></comment>


Change your Last.fm password - <AUTHOR> http://thenextweb.com/insider/2012/06/07/change-your-last-fm-password-now-there-may-have-been-another-security-breach/ <comment><USER2> Jeepers, I just changed my linked in password. I had the source for PGP back in 1993, I don't recycle passwords for anything remotely important, I use gnarly long passphrases, two factor authentication and what-all else, and I AM SICK OF IT. I'm beginning to think that IBM had the right idea witht he thumbprint scanners in the laptops. I'm tired of the maintenance security imposes on me, the lack of a meaningful industry certification, and on developers' insistence that I use passwords of between X and Y length and containing particular combinations of characters, numbers, etc.

Every time I read about one of these avoidable breaches, I feel tempted to gin up a class action lawsuit and force a company to either write a painfully large check to acknowledge the time and trouble it has imposed on its customers - say, about $5 each - or sell itself to its users in lieu of money. I'm not actually going to go to that effort, but sooner or later some enterprising law firm will, and I'm sure everyone here is going to be all hand-wringy about it.

We need to automate security and make it customer-centric. It is plainly too complicated to be left to individual web service providers, just as brick-and- mortar stores do not manufacture their own door locks or burglar alarms. Vendors, if you feel you can't safely outsource this job to a third party, then you need to hire full-time security monitors and start facing up to security as a line-item cost rather than a check-box you can forget about after you've put it in place.

Sorry to be ranty, but when established firms are losing millions upon millions of passwords literally on a _daily basis_ , something is drastically wrong with the state of the art. This is a problem that can't be prettied away with CSS or smoothed over with a few tweets and blog posts.

<comment><USER3> Funnily enough I opened a new bank account the other day (Chase) and to my surprise they don't allow special characters to be used in the passwords.

It indeed appears that the entire system is broken beyond repair. It seems like it is becoming the norm to expect to be exploited at some point so the de-facto preemption is to have someone to blame. As the manager of a datacenter we recently moved into said "we're here to provide a subject for you to point your finger at should there be a breach".

WTF, industry.

<comment><USER4> Many banks are encumbered by old mainframe systems that still do a lot of their computing. I don't know how much of that bubbles up through to the web interfaces we deal with, but I know many tellers and agents are still on green screens, or on interfaces that are just pretty wrappers to mainframe terminals.

<comment><USER5> I've heard that excuse from banks and such before, and, frankly, I suspect they are lying.

Oh, I fully believe that whatever ancient mainframe they are using might limit passwords to some small number of mono case characters with no funny characters allowed.

However, that would only apply to passwords for mainframe accounts. The bank is NOT going to be creating a login account on the mainframe for each bank customer. Our bank accounts are just entries in an application database on the mainframe.

If there is some kind of per customer password that the mainframe stores with the bank account data and that the online system has to provide when sending transactions to the mainframe, and it has such a limit, and the bank cannot update the application and database for some reason, that still should not be visible to the customer doing online banking.

The part the customer sees online should have its own password database, which allows good passwords, and in there it should have (encrypted!) whatever the ancient limited mainframe password is for that customer's account.

Unless the web interface itself runs on an ancient mainframe, I strongly suspect that there is no acceptable excuse for only allowing short passwords from a limited character set.

Banks are simply not very good at security, or they don't care. Hell, they insist on mailing me things that include my full credit card number, ensuring that someone who wanted to inconvenience me just has to drive by my mailbox at the right time and steal my statement. How freaking hard would it be for them to X out all but the last 4 digits. Yes, that would mean someone whose statement covers multiple cards might have a collision--so don't issue two cards with the same last 4 to two people who receive a joint statement.

<comment><USER6> The reason they don't allow special characters is to prevent situations where the customer has forgotten his password and needs to go through an excruciating verification process to access his own account.

</comment></comment></comment></comment></comment><comment><USER7> Is there a cryptanalytic reason why a company that has a database full of MD5/SHA1 hashes can't perform a one time upgrade by computing bcrypt(salt, the_old_hash) for every hash they have in the database and then when someone logs in do bcrypt(salt, md5/sha1(password)) to check the password?

<comment><USER8> That's what I did when I migrated our application to bcrypt some time ago.

I had some questions about whether using an md5sum as the bcrypt input, with much less keyspace (only hex characters) had any impact on security but nobody could/would answer.

I'm guessing that knowing that the plaintext for the bcrypt hash is always going to be 16 characters of 0-9,a-f might have some impact on crypto analysis but considering the passwords most people use I'm guessing it's only going to be a net win in terms of entropy.

<comment><USER9> Yeah sure, bcrypt(salt, md5/sha1(password)) is in general less "secure" than bcrypt(salt,password)#, it's still more secure than md5/sha1(password).

# Note though, that you need at least 20 printable ascii chars to get the 128 bits of entropy possible in an MD5 hash, so for _most_ passwords, you could optimize your cracker by only bruteforcing bcrypt(salt, md5/sha1(password)) using shorter strings as password guesses rather then needing to bruteforce the whole 128 bit MD5 space. With bcrypt and salt though, that turns into an "only practical for state-level attacker" I think.

<comment><USER10> Only for users with >128/160-bits of entropy in their password, which probably means your password is well over 20 chars long.

</comment></comment></comment></comment><comment><USER11> Last.fm sounds like the canonical example of a site that where it makes absolutely no difference if your password gets exposed.

Worst case, some malicious individual on the internet will learn that I still like the Beastie Boys, even though it's not 1994 anymore. And possibly they'll listen to music in my name.

This is why one has a throwaway password. For throwaway accounts at throwaway sites like this. Getting your throwaway password thrown away should by definition not be something you worry about.

<comment><USER12> I have over 150k songs scrobbled to Last.FM and have been a member since 2005. I actually can think of very few other services that I would care as much as if my Last.FM was compromised/deleted.

<comment><USER13> Same. 127k songs since '05, and I still cruise through the site regularly and look at what i was listening to on this day in 20xx.

I briefly paid for the site's radio functionality before it was crippled. It feels to me like they've died a similar death to Flickr (acquired, core team left, innovation stopped). Such a shame.

<comment><USER12> Agreed. Last.FM is such a trove of data. It is fascinating to see what I was listening to and when, and especially looking at macro events and seeing how that influenced the worlds listening habits.

It took Last.FM until 2012 to implement the ability to find your friends from Facebook. Seriously. It really is such a shame; they're a service that needs to be spun out.

<comment><USER14> Their event listings used to be my go-to place to find out about concerts. The problem is they have a bug they've never fixed (after at least 2 years) where you can't see events happening on the current night. I think it's related to timezone, and the fact they are based in the UK.

Now I've got songkick, which kicks ass at keeping me informed about shows. But the whole reason songkick is so effective for me is that I imported my listening history from last.fm when I first signed up.

</comment></comment></comment></comment></comment><comment><USER15> 17.3 MILLION MD5 hashes (unsalted, not that it matters), of which over 16 million have already been cracked.

<comment><USER16> What?!

This means next leak will be one million CRC32 password hashes?

Or maybe LM hashes. Or crypt on old /etc/password files

<comment><USER17> ROT13?

<comment><USER18> Ive seen a legacy application still in use which puts the password in a (non- secure) cookie as ROT13 and cleartext in the db.

</comment></comment></comment></comment><comment><USER19> Passwords need to die. There will always be bad implementations on storing passwords and those will hurt many users. We need something better.

<comment><USER20> Easy: everybody authenticate with Facebook Connect, then we just have a single location and storage mechanism to secure.

<comment><USER21> s/secure/crack.

<comment><USER22> Also one password to change, though.

</comment></comment></comment></comment><comment><USER23> Do LinkedIn, eHarmony and LastFM have any parts of their software stack in common? Same 0day?

<comment><USER24> They're all Hadoop users.

<comment><USER25> I doubt their Hadoop clusters have password data stored in them.

<comment><USER26> It would be very foolish, but I do wonder if they used Hadoop to compare their hashes with publicly exposed hashes after breaches of other sites (for example, Gawker or Zappos) in order to force reset affected users.

</comment></comment></comment></comment><comment><USER27> @CrackMeIfYouCan posted this on twitter:

A bit of stats on last.fm leak:

1) It happened a WHILE ago. 2010/2011

2) 17.3 million raw-md5

3) 16.4 million cracked. 95% cracked.

<comment><USER28> Any info on how and why so many were cracked? Passwords too simple?

<comment><USER29> MD5, unsalted. On commodity hardware you can compute those blazingly fast. A brute force attack, ignoring word lists, is totally possible.

That's ignoring all the resources that offer access to precomputed hashes (I don't want to call a list of MD5 hashes a rainbow table).

Easy or not, passwords saved with this scheme are unprotected.

</comment></comment></comment><comment><USER30> Holy cow.

Apparently reporting the vulnerability to them 5(!) years ago was not enough :/

<http://discuss.joyent.com/viewtopic.php?pid=139497>

* Communicate over SSL/TLS (avoids session hijacking scenarios and is a reasonable choice in general)

* Hash AND Salt user passwords (we use PBKDF2)

Take one day and fix this in your own products & you just saved yourself a major PR disaster in the future :)

</comment><comment><USER13> Does anyone have a dump of the hashes?

</comment><comment><USER31> Here's the method I use to manage website passwords: For logins that I don't really care about that much, say last.fm, I use my standard medium-strength 6 character password with a number and a capital letter, something like jfi3Jo. I can remember it because I use it often. For logins that I do care about like my email or bank I salt my base password by inserting three characters from the site's domain name into the front, middle and end of the base password. For example, my login to Hacker News would be yjfic3Joo, where yco from ycombinator.com is added in the front middle and end of the base password.

I know it's not the most secure method in the world but I think it is a good compromise between remembering the passwords and providing a unique-per-site decent strength 9 character password. If someone figured out my scheme they could get into all my accounts but in order to figure out my scheme they would have to brute force crack two of my 9 character passwords from hashes from two different sites and then match up the two accounts and compare the differences, that is the risk I currently take.

<comment><USER32> I wrote a large paragraph on now I do my passwords then realised how silly it is to tell the world :D

</comment></comment><comment><USER33> It is OK to suggest users to change their passwords, but shouldn't they stop sending their session cookies over plain HTTP? Session hijacking is now widespread and an easy way to get into non-important accounts and then escalate to more interesting accounts.

[1] <https://www.owasp.org/index.php/Session_hijacking_attack>

PS: I'm leaving this comment without any reference to the site name, so I can copy and paste it verbatim in the future; it looks like this kind of breaches will not stop soon.

<comment><USER34> _PS: I'm leaving this comment without any reference to the site name, so I can copy and paste it verbatim in the future; it looks like this kind of breaches will not stop soon._

Be aware that there is the possibility[0] that HN's (or other sites') anti- spam features may detect a copy-pasted post as duplicate or artificial content, and kill it and/or your account. It's probably better to add a link to the original post, with some article-specific text.

[0] Based on speculation and inference, not actual knowledge.

</comment></comment><comment><USER35> Looks like passwords need to be replaced with something else, obviously most companies, excluding none, are completely unable to handle them properly. Time for a big disruption.

</comment><comment><USER6> I doubt my new password will be any safer, so I can't really use one which follows my current pseudo-random patterns.

I'm now convinced that password managers, with random generated passwords, are the way to go. At least they have a strong incentive to focus on protecting user data. Still scared of not knowing my own passwords, and giving them to a third party, though.

<comment><USER36> Agreed, I would never trust my passwords to a private third-party with closed code-base. And KeePass still seems a little meh, especially regarding device support. So for now I'm using an encrypted file synced with DropBox.

</comment></comment><comment><USER37> I was worried for a minute, but I can't actually think of anything a hacker could do with my last.fm account that I care about.

</comment><comment><USER38> To be 'fair': when Last.fm first launched, md5 was probably 'state of the art'. I mean take a step back, they have been around for like forever.

The question is: How would you go on about moving your user database from md5 to a more advanced algorithm? Validate a user's password on log-in and then encrypt it with the new, more secure algorithm?

<comment><USER39> Yes, that's exactly what you do. In Django 1.4 (the latest), they store passwords using PDKDF2 or bcrypt. The nice thing is that it automatically upgrades the hash function if it used to be something else:

_______

Password upgrading

When users log in, if their passwords are stored with anything other than the preferred algorithm, Django will automatically upgrade the algorithm to the preferred one. This means that old installs of Django will get automatically more secure as users log in, and it also means that you can switch to new (and better) storage algorithms as they get invented.

[https://docs.djangoproject.com/en/dev/topics/auth/#password-...](https://docs.djangoproject.com/en/dev/topics/auth/#password- upgrading)

_________

So it would be trivial for the big sites to have switched transparently to a safer hash, even if MD5 was Ok when they started. You could also add salts in the same way, if you were storing unsalted hashes.

<comment><USER16> Kudos to Django because this is _very_ important

Like in bcrypt discussion saying you can tune the amount of work. Sure, but what to do with the existing hashes!

Of course, the user needs to retype their keys, but it's better than keeping old credentials.

(or maybe you save the original credentials with strong PK crypto, together with the hash, then periodically decrypt _offline_ and rehash)

<comment><USER40> In regards to "what to do with the existing hashes" bcrypt can detect the original work factor and hash to that. Not sure how you would upgrade that for users, however.

</comment></comment></comment></comment><comment><USER41> I just changed my password and deleted my Last.fm account. Just because I changed my password doesn't mean a new MD5 hash of my new password won't leak tomorrow. If you can't trust the service, don't use the service.

To delete your Last.fm account, go to the "Data" tab in settings. Click on "Delete entire account for user".

</comment><comment><USER42> There's a great deal of room for improvement in password protection, which would make stealing a password very difficult. Some discussion on developments in that front here: <http://news.ycombinator.com/item?id=4047968>

</comment><comment><USER43> News of this kind make me even more glad that I use random generated passwords for every site, with LastPass to manage all of that. (Waiting for a snarky comment about LastPass being supposedly hacked some time ago.)

</comment><comment><USER44> And WizzAir keeps passwords in plain text. What can be done to shame them?

</comment><comment><USER45> Last.fm Password Security Update

<http://www.last.fm/passwordsecurity>

</comment><comment><USER46> Wouldn't I want to keep my last.fm password static lest they leak my new password?

</comment><comment><USER22> I saw this in another thread today, and I am _never_ NOT using it again:

<http://supergenpass.com/></comment>


Ask HN: What is "vouch"? - <AUTHOR> I see a new Vouch button has appeared under /newest but I couldn't find any information it.  It appears to override the automatic flagging system (and presumably is only available to users with high karma).
Can anyone point to more information, discussion about how it works, and guidelines about when it should be used?
I used Vouch on https://news.ycombinator.com/item?id=11589331 which seems to have been unfairly marked Dead.  Apologies if I'm doing it wrong. <comment><USER2> Yeah, it's for reviving posts that are unfairly [dead].</comment>


Ask HN - will you please include password rules to login form? - <AUTHOR>

So many times I have to ask for a reminder because I don't know what the password rules are - 6 char or 8? Has to have 1 upper? Has to include a special char? Add the password rules to the login form! <comment><USER2> It's a good thought, and an area that's ripe for all sorts of standardisation. My passwords follow a system which is secure, but doesn't conform to all the password requirements of all sites, so I get caught out with this problem all the time.

</comment><comment><USER3> And make it possible for a mobile user(using opera mini) to login,Its been impossible for me.</comment>