US quits Paris climate pact - <AUTHOR> http://www.bbc.com/news/live/world-us-canada-40123293 <comment><USER2> This is one of those situations where you should be shaking your head, even if you're a climate change denying conservative or a fussil fuel industrial interest.

The Paris pact was pretty toothless: it was a step forward, but heavily aspirational. Indeed, one of the stated complaints of conservatives was that it did nothing to enforce compliance. The Trump Administration could have just as well ignored it without formally reneging on it and forced the next administration to deal with the egg on the face for failing to meet the USA's commitments.

But instead he's seriously undermined people's ability to trust in the United States maintaining its international obligations for anything except the shortest periods of time. To be fair, what he's done already with NATO is far worse. But this underlines the reality that the United States government is so unstable that it's unable to uphold any coherency in policy or meet its stated commitments.

If you're a small country who's been trusting the USA as a solid ally against regional competitors, you're looking at this and going, "well, maybe I should be focusing more on ties with the EU/Russia/China/India."

It's honestly pretty humiliating for the USA, even aside from the fact that we've just fucked the next generation just to give the finger to elitist liberals and scientists.

<comment><USER3> Yes, the Paris pact was toothless. It was never going to work, just like Kyoto didn't work. So what's wrong with pulling out of it?

Consternation over the Paris accord is, in my opinion, elitist liberal virtue signaling. (Here in the DC/MD/VA area, everyone will complain about this move at Starbucks sipping on lattes while driving one hour each way to work from their McMansion in the exurbs. God forbid we do anything that might require lifestyle changes, _i.e._ have some real hope of working.)

<comment><USER4> Complaining about people at Starbucks sipping on lattes is conservative virtue signaling.

<comment><USER2> Complaining about virtue signaling is conservative virtue signaling.

</comment></comment></comment></comment><comment><USER5> The United States of America spent a hundred years building up a global leadership position. President Trump has effectively destroyed it in a mere four months.

China is adeptly stepping up to fill the void left by the United States. Last week Trump did his best to alienate America's long-standing European allies, who now feel that they are on their own against Russia's expanding European power plays. So Europe is turning to China as well.

Chinese and European leaders have scheduled a meeting tomorrow to state how they intend to expand efforts to fight climate change. Meanwhile, USA is isolating itself with Syria and Nicaragua as the only three countries to stay out of the Paris accord.

<comment><USER6> I think you overstate the case when you say that the US's leadership position has been destroyed. It has certainly been damaged, but the US is still one of the largest, most populous and richest countries in the world. It will have a big seat at the world negotiating table for quite some time no matter what.

<comment><USER7> The USA will certainly have a seat at the table, just not at the head of the table.

This loss of influence isn't going to be readily apparent, it's precipitation will be subtle and over the long term. It may start as a preference for German or Chinese military equipment, then slowly it preference will begin to shift in areas of finance, agricultural products, energy, etc.

If the USA is no longer able to negotiate favorable trade deals, because of their mercurial nature, then we'll probably see corporations move to foreign countries of influence.

<comment><USER6> Yes, I agree with "subtle and over the long term" as opposed to "destroyed it in a mere four months."

<comment><USER8> The _effects_ are subtle and long term. The destruction happened already.

The US has made it very clear that its populace is willing to elect an uneducated populist buffoon, who is happy to break any and all international commitments if it appeals to his base.

Any politician outside the US, from this point onwards, will assume that the US is not a country that can be trusted with any long term plans. (Or, as far as our allies are concerned, with intelligence materials either). It will likely take decades to repair that reputation hit, if it isn't irreparable.

We're not feeling the consequences of it yet, but we will. That's inevitable. You don't suddenly walk into a ballroom, shit on a table, and hope everybody forgets it next week.

</comment></comment></comment></comment></comment><comment><USER9> I have a cleantech startup, and in the industry we see this decision as only having a negative impact on deep red states. Most other states will implement mandates in line with Paris on their own, which will grow their local energy economies (the transition means lots of jobs).

Deep red states that try to slow the transition will just get left behind. Trump is hurting his own base, while not slowing anyone else down. The economics are simply too good to turn back now.

Happy to answer questions. And many companies in cleantech are hiring!

<comment><USER10> Would you company be possible without any sort of government support(federal/local/etc), financial or legal?

<comment><USER11> Would oil companies be possible without the US military defending them in the rogue states they usually extract their oil from?

And that's not even considering the direct subsidies they receive.

<comment><USER12> In California we will be paying 77 cents per gallon just from taxes. So the price at the pumps would be 77cents lower. From every renewable energy we get tax credits. Yes we pay for subsidies of random things like cattle, corn, and oil, but the subsidies like the PTC and the solar energy credit are much more in comparison. This doesn't mean I don't agree with it. The subsidies have dropped the price of wind and solar considerably and we will see a huge economic boom from relatively little tax benefits. The greatest subsidies we could have right now can actually be accomplished through bipartisan support. Funding for transmission lines can be lumped into the infrastructure bill. $7 billion of transmission lines in Texas sponsored by the current trump cabinet pick Rick Perry brought Texas Wind energy production from nowhere to number one in the country and larger than three states below it in just 6 years. Texas is planning to add more win this year then the total amount by the second highest state has in total. He didn't force utilities to build wind farms. Instead he built the infrastructure to make building wind farms extremely cost competitive. There are a dozen possible transmission lines that would create thousands of jobs and connect wind and solar heavy areas to high density cities. If we can get those transmission lines up, we won't have to worry about government for renewable energy because it will be politically and economically in our benefit to use renewables

</comment></comment></comment></comment><comment><USER13> Elon Musk just posted that he will, as promised, be quitting the presidential council: [https://twitter.com/elonmusk/status/870369915894546432](https://twitter.com/elonmusk/status/870369915894546432)

<comment> throwaway-1209 Ballsy move. I strongly suspect this could jeopardize the massive federal subsidies that keep Tesla afloat (and probably Solar City, too). $7.5K per car (which essentially amounts to a 10% per-unit discount out the door) times 84K cars is $630M.

<comment><USER14> Unless the tax credits are extended (and the likelihood of that was essentially zero already), Tesla is set to hit the phaseout point next year regardless, and will have them go to zero one year later. It's likely that if you reserve a Model 3 today, you won't get a tax credit when you take delivery. So that wouldn't change a whole lot. And assuming the subsidy is eliminated for everyone and not just Tesla, it'll make them _more_ competitive.

I'd say the big danger for his stuff is SpaceX and NASA, and I don't think there's much risk there.

</comment></comment></comment><comment><USER15> It was a bit disingenuous for Trump to describe India and China as top polluters

India (population 1.3 Billion) creates lesser CO2 emissions than the US

China's per-capita emissions is just around half of that of the US

 _[Edit: replying to comment about pollution and emissions

The Paris agreement is about climate change and reducing greenhouse gas emissions.

When Trump talks about polluters and withdrawing from the Paris agreement, it seems illogical to suggest that he wasn't referring to CO2 emissions] _

<comment><USER16> Pollution is not CO2.

<comment><USER17> When talking about global warming, yes.

To an overwhelming extent.

<comment><USER16> And this is why the US has so much trouble with climate change as an issue- first it was sulfur dioxide, then lead, then CFCs, now it's CO2. The US has been doing this since the 70's. Now Europe and China want to pretend they care with words, and giving the US's money to the third world, yet every picture of a city in China looks like London in the 1890's and it turns out those oh so green Euro car makers were cheating their emissions tests, but that's not important, what's important is that we hold hands and make pleasant noises at each other.

I don't see how anyone who calls themselves an engineer can stomach when this feel good ignorance is put forward as a solution- this is rearranging deck chairs to the highest degree.

<comment><USER17> What are you talking about?

Lead is bad for your health.

CFCs are bad for Ozone.

CO2 is bad for global warming.

All pretty much universally accepted.

European cars, with cheating and all, are miles ahead of US cars. And they have been heavily fined for cheating, as they should.

And China has not yet contributed a meager percent of the cumulated US CO2. Not to talk per capita.

The planet is not yours.

<comment><USER16> Per capita and cumulated are BS measures to obfuscate that China is a bigger contributor, and likely to grow for a while. The first rule of getting out of a hole is to stop digging- the US has, China hasn't.

<comment><USER17> Let's leave aside if per-capita and accumulated are important metrics or not.

Let's accept that the Chinese are worse polluters than the US.

Congratulations, you are the second worst polluter.

What, did I hear India? Ok, you are just being difficult. Let's say you are the third worst polluter.

What? Did I hear ...? Stop it!

You are one of the worst polluters. Period.

Why do you withdraw?

And yes, you are the worst per-capita and accumulated polluter. In case you were wondering.

<comment><USER16> Actually not the worst per-capita, but I'm sure you have some way to explain Qatar, Australia, or any other country inconveniently higher on the list.

And this is pollution: [https://qz.com/794542/air-pollution-map-by-country- fine-part...](https://qz.com/794542/air-pollution-map-by-country-fine- particulate-matter/)

Which makes CO2 seem particularly cherry picked.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> This is sad news. The direct impact on the carbon reduction might actually be not too large, as renewable energies are actually the cheaper alternative, and as many of the American states are pushing for carbon reductions.

The big downside of the US quitting the Paris climate pact is the political signal it is sending. The pact was significant, because it was the first time the world managed to agree on something (except Syria and Nicaragua). Leaving the pact sends the signal, that the US does not want to internationally collaborate on preventing climate change. Most of our todays problems and challenges can only be solved by international collaboration, be they environmental or economical. It would have the better signal, and probably also served the US interests better, if the US would not quit the climate pact.

</comment><comment><USER19> So Trump is basicly quitting the Paris climate pact for the mining industry, which is mostly automated? Leaving the solar space for China that going to be the leader in solar energy.

I've actually never thought i would say this, but my "admiration" for the US has drasticly declined the last few months. I think this also affects "Silicon Valley".

PS. Am i right that your President only had a one hit wonder with Trump Tower, with daddy's money. Then licensed everything ( the few things he did with casino's failed). And ... He is now the president, because he was in a TV- show? Or am i missing something?

<comment><USER20> As to why he is now the president, it is far from being that simple. Him winning really had very little to do with his qualifications as a candidate.

<comment><USER21> I would phrase that differently.

He was incredibly qualified as a candidate. Huge name recognition, a particular sort of charisma, shameless.

It's the office that he isn't qualified for.

<comment><USER19> To be honest, when your starting a business. I think to have him as a "business partner" would be a very bad idea also.

</comment></comment></comment></comment><comment><USER3> Even as an environmentalist, I'm okay with this. The political reaction to climate change is a farce. The Paris accord isn't going to do anything, just like the Kyoto protocol didn't do anything. It's just a way for people to feel good without making any real lifestyle changes.

<comment><USER22> > Even as an environmentalist

Huh? From your comment history here, you seem like much more of a _laissez- faire_ capitalist than any kind of environmentalist.

<comment><USER23> Some environmentalists are anti-technology types or nihilists, who look forward with pleasure at the idea of humanity suffering for its hubris. The only solution they'll consider is people changing their behavior for moral reasons, which is comfortingly unlikely.

They're not fans of other environmentalists discussing happier ideas, like setting up incentives for economic and technological growth beyond fossil fuels.

<comment><USER22> This is true, however rayiner appears to be neither the anti-tech/nihilist type of environmentalist _nor_ the "set up incentives" type of environmentalist. (E.g., on the specific issue of climate he explicitly rejects setting up incentives or any other "political fix".)

Rather, he seems to believe that the market will provide for all, even when externalities make that irrational for individual actors in the market without some regulatort regime internalizing those externalities.

Hence, my description of him as a _laissez-faire_ capitalist rather than any kind of environmentalist.

</comment></comment></comment></comment><comment><USER24> China+EU have grounds to put tariffs on US products.

<comment><USER17> Problem is, US will put them too.

Actually, Trump wants to put them for other reasons, so we would be falling on his trap there.

<comment><USER25> > US will put them too.

and that will hurt Trump's base supporters more than any other group. The ones that still work in manufacturing that the U.S exports.

<comment><USER17> I really do not care about Trump or his supporters. This is hurting all of us, specially the coming generations.

<comment><USER25> Well I agree with you there. Just pointing out that this they basically cutting their nose to spite the face. They might see some short-term gains, but in the long-run..it will disproportionately impact them more.

<comment><USER17> I wrote hastily, and forgot to point the most crucial observation: I do not care about Trump's supporters, but I also suspect that _he does not care either_.

But even that is not the most salient point: it does not matter if my suspicious is right or wrong. The bottom line is that, whether Trump cares or not, if his policies turn out hurting his voter base, he will never be affected by it.

It's a terrible situation: the long term policies of a powerful politician have absolutely no way of affecting his political career.

He can rejoice in short term benefits: rise in popularity if the economy improves short term or, in the very specific case of Trump, short term financial gain thanks to his very complex network of business interests, while destroying the planet for good.

How can we call that democracy?

</comment></comment></comment></comment></comment></comment><comment><USER26> This is The Weather Channel website ([https://weather.com/](https://weather.com/)) right now (reportedly, I can't see it due to my location):

[https://twitter.com/johncheese/status/870372600693895170](https://twitter.com/johncheese/status/870372600693895170)

</comment><comment><USER27> Does anyone think we might start seeing a brain drain out of the US given the current political climate?

<comment><USER28> Yes, but bear in mind:

* where else will people go? The UK, for example, is also in an anti-immigrant mood. Though Canada may still be good.

* the current political climate in the US is ... unstable. It'll be significantly different in a year or two, one way or another.

<comment><USER29> the UK could be broadly described as anti-low-skilled immigration

most of the UK electorate support increasing the level of highly skilled migration

[http://www.independent.co.uk/news/uk/politics/half-of- britis...](http://www.independent.co.uk/news/uk/politics/half-of-british- public-support-more-immigration-of-highly-skilled-workers-poll- suggests-a7687086.html)

<comment><USER28> That's hardly the same as a guarantee that highly skilled immigrants and their families don't face difficulties and risks in coming to the UK.

For example, last time I looked at the UK papers they were full of cases of EU citizens, who should have indefinite leave to reside in the UK, being harrassed by the Home Office and threatened with deportation.

<comment><USER29> every case I've read about has received the standard automatic rejection letter for not filling in the form correctly (e.g. for not including your passport)

given the Home Office never expected EU migrants to apply for permanent residency, the response was appropriate prior to the referendum result

it no longer is, and the Home Office now have updated guidance on the matter

I'm sure it wasn't nice to receive that letter, but it just a case of the government bureaucratic machine responding at glacial speed to change, as normal

</comment></comment></comment></comment></comment><comment><USER30> Can someone give me pros and cons of this move (serious responses only)?

Thanks

<comment><USER31> I think the only way anyone could argue there are any pros is if they could convince me that Trump has a different long-term plan to address climate change. Unfortunately, all of his actions up to this point indicate that he doesn't have any such plan. I really wish people would stop trying to understand and rationalize this man's actions. He has no rational for what he does other than his own short-lived whims and the general selfishness and narcissism that underlies his world view.

<comment><USER32> That's a Republican orthodoxy, not just Trump. Climate change either doesn't occur, or if it occurs it's not man made, if it's man made nothing can be done. In any case, doing anything is job killing and anti freedom.

I think Trump himself doesn't care.

<comment><USER33> Seems to me that doing something would actually create jobs, but maybe not enough to offset those lost? Shortsighted is what it really is. Who cares if it's job killing if the alternative is civilization killing.

</comment></comment></comment></comment><comment><USER34> The answer from French president Emmanuel Macron to Trump's announcement (in English, video, 03:17):

[https://www.pscp.tv/w/1jMKgoodLyqKL](https://www.pscp.tv/w/1jMKgoodLyqKL)

edit: typos, duration of video

<comment><USER35> The silver lining.

 _" All you talented people in the US, allez, France welcomes you with big arms."_

</comment></comment><comment><USER36> Times have changed. New York Times mocked India two years ago.

[http://www.indiatimes.com/news/india/new-york-times-mocks- in...](http://www.indiatimes.com/news/india/new-york-times-mocks-india-yet- again-this-time-with-a-cartoon-on-climate-change-248245.html)

</comment><comment><USER37> Why was this removed from the front page?

</comment><comment><USER38> Response from the market: [http://i.imgur.com/CDKVSWq.jpg](http://i.imgur.com/CDKVSWq.jpg)

The Paris Accord according to President Trump would have allowed China to do whatever they want for the next 13 years, while India would receive billions in aid.

[http://climateactiontracker.org/countries/usa.html](http://climateactiontracker.org/countries/usa.html) \- US Pledges ( 26-28%)

VS.

[http://climateactiontracker.org/countries/china.html](http://climateactiontracker.org/countries/china.html) \- China Pledges (0%)

<comment><USER39> The announcement came after the market closed, didn't it?

<comment><USER6> Also the announcement wasn't a surprise. To whatever degree this announcement might have an effect on future corporate earnings (a fairly dubious connection imho) it was already priced in.

</comment></comment></comment><comment><USER40> 370 upvotes in 2 hours with 268 comments (as I write this), yet this story is at the very bottom of the front page of HN at #28 (6:15 EST).

Does HN systematically penalize / shadow censor certain kinds of content?

<comment><USER41> You're seeing the effects of a lot of flagging, which is common for things which are either very political, or for which the discussions are overwhelmingly lame. This discussion is both.

</comment></comment><comment><USER42> What are the foreign policy implications of this? Every single other country's reaction that I've seen has been to beg the US to stay in the accord.

</comment><comment><USER17> It has stopped being funny now.

</comment><comment><USER19> The american dream is a prime minister : [https://www.youtube.com/watch?v=T4rWVOeEI7Y](https://www.youtube.com/watch?v=T4rWVOeEI7Y) . It could be shoved aside. Since the US is now 4 months with Trump, another 44 months to go. I am really wondering what he will do next

</comment><comment><USER19> Offtopic, shouldn't this be the #1 post, it's probably blacklisted currently: [http://imgur.com/XdEShU0](http://imgur.com/XdEShU0)

<comment><USER43> Could be manual or because it contains shitpost-attracting keywords, it's a Trump post after all.

(Not implying Trump or his followers are shit, just that partisan issues attract shitposts and unfruitful emotional discussions.)

</comment></comment><comment><USER44> I'd say certain countries have gotten together behind the scenes to take turns playing bad cop. Now it's America's turn, a few years ago it was Australia who refused to sign.

</comment><comment><USER45> Canadians should be happy with the resulting milder winters.

</comment><comment><USER46> Oh, this is just Trump sticking it to Macron for humiliating Trump by crushing his knuckles in that infamous handshake. /s

</comment><comment><USER47> Remember the old story of The Tortoise and The Hare? U.S. is acting like the Hare now…

</comment><comment><USER48> If this bothers you, elect senators who will ratify an actual treaty.

<comment><USER14> Already did. Too bad my senators are canceled out by the senators chosen by the 600,000 inhabitants of Wyoming.

<comment><USER49> Pretty flippant solution by the GP, but to your point, there has to be some consensus among the states, just as there needs to be consensus among nations, no matter how varied the size of their populations. I'm in a small state, so I don't want California and New York setting our policy just as much as you don't want China and India setting yours.

<comment><USER14> States are pretty arbitrary divisions. If California split into 66 equally populated pieces, nothing about the people or land would change, but they'd suddenly have 132 senators instead of 2, and each chunk would still have more people than Wyoming. Or they could split into 1000 pieces and have 2000 senators and completely dominate Congress. Would that be fair, do you think?

</comment></comment></comment></comment><comment><USER50> I just want the hell out of the US.

</comment><comment><USER51> A failed state.

</comment><comment><USER52> This is a bad day for the US, since by such a behavior ("America first -- ignore international pacts"), the other countries will less and less likely follow this country (with exception of Saudi Arabia, of course).

The Europeans are already drawn to China and India and this will grow stronger.

And Trump should not think, that European buyers will be more inclined in the future to support US companies by buying US products.

<comment><USER53> Can you explain how Europeans are drawn to China and India given their records on human rights? Are they not informed about the Chinese government? I fail to see how that's more alluring than dealing with America and Trump even with all his faults and arrogance.

I think this move was bad and miscalculated at several levels, but I don't think it's going to have the impact you suggest.

<comment><USER54> "China and India given their records on human rights?" Are you suggesting there is no country in the world where human rights are not violated? I am not defending the violation, but that sentence sounds naively aloof and disconnected from reality.

<comment><USER53> No I'm not suggesting that at all. I just don't see how Europeans would gravitate towards alignment with those countries after this news given their human rights histories and current governments.

The only thing I can think is that Europeans are more environmentalists and will simply turn the other cheek on those violations so long as they get their climate change deals. Either that or the notion that they'll be pushed toward China and India is overblown.

<comment><USER54> Thanks for the polite response and my apologies for being a bit of a dick in choosing those words. And yes, I agree with the points you made.</comment></comment></comment></comment></comment>


One Google query = one Apollo moon program's worth of computing - <AUTHOR> http://boingboing.net/2012/09/19/one-google-query-one-apollo.html

<comment><USER2> <http://www.quickmeme.com/meme/35efo8/></comment>


Hacked - Magazine - The Atlantic - <AUTHOR> http://www.theatlantic.com/magazine/archive/2011/11/hacked/8673/?single_page=true <comment><USER2> Should be required reading for every one who uses the same password for every site!

</comment><comment><AUTHOR> its an interesting article. Might be a little redundant for people that read hacker news. That said if it gets non techies to seriously consider password diversification and a backup strategy, kudos.</comment>


Google Cloud Print Requires Chrome 9 - <AUTHOR> http://www.thechromesource.com/google-cloud-print-requires-chrome-9/ <comment><USER2> > Hopefully a device will be available, but there could be some humor in it > being unable to print, don't you think?

Personally I don't really care about being able to print from a netbook. I print documents occasionally, mostly when it's required due to some legacy legal reasons. Even though people have different needs, I don't think this is such a big deal. Especially taking into account that Chrome OS netbook isn't going to be your one and only machine any time soon.</comment>


Ask HN: Probability and Statistics online courses - <AUTHOR> Hi HN,
I'm looking for good courses about this topic because I want to remember some stuff and be ready to learn about machine learning and deep learning later.
Do you have some course or a book to study about this?
Thanks! <comment><USER2> First:

[https://www.coursera.org/specializations/statistics](https://www.coursera.org/specializations/statistics)

I've taken the first 3 classes in this specialization and would say it's been invaluable. There's an associated textbook available online for free at:

[https://www.openintro.org/stat/textbook.php](https://www.openintro.org/stat/textbook.php)

Second:

[https://www.coursera.org/specializations/jhu-data- science](https://www.coursera.org/specializations/jhu-data-science)

I've taken the first 6 classes in this specialization as well, and have found them to be pretty valuable. These, so far, have been more about the mechanics of programming in R, and less about the math. The Duke one above is more math, less R. But both are an intermingling of both mathematical concepts and R coding. I find that these two tracks complement each other very well.

Third:

[https://www.youtube.com/watch?v=9FtHB7V14Fo&list=PL5102DFDC6...](https://www.youtube.com/watch?v=9FtHB7V14Fo&list=PL5102DFDC6790F3D0)

A set of videos on Statistics from "Professor Leonard". This is just recordings of all the lectures from a standard college Stats 101 class. But the guy is a good lecturer, explains things well, and has a sense of humor which keeps things interesting.

He also has videos on other topics as well, if you're interested.

More:

I believe Kahn Academy also has a section on Statistics and Probability.

You might also find some of the stuff linked here useful:

[http://people.math.gatech.edu/~cain/textbooks/onlinebooks.ht...](http://people.math.gatech.edu/~cain/textbooks/onlinebooks.html)

or

[http://mathbooks.reddit.com](http://mathbooks.reddit.com)</comment>


The "F" word Silicon Valley loves and hates - <AUTHOR> http://www.npr.org/2012/06/19/155005546/failure-the-f-word-silicon-valley-loves-and-hates <comment><USER2> Surprised this isn't on the front page. It combines two of my favorite things, NPR and YC. I'm sure I'm not the only one who feels that way.

NPR makes me mad sometimes but this was good NPR.

Edit: I feel like journalists haven't figured out yet what great sound bites they can get out of PG. This piece, though, was full of them. The floodgates may crack...

</comment><comment><USER3> This segment was way too short, I was so sad to hear it end when I heard it in the car earlier today. There was so much more to say!</comment>


$99 HP TouchPad Final Batch: HP Employees get first Dip on September 28 - <AUTHOR> http://www.i4u.com/47753/99-hp-touchpad-final-batch-hp-employees-get-first-dip-september-28

<comment><USER2> Isn't this the same day the iPhone 5 is rumored to be announced?</comment>


Show HN - HNTRENDZ (My most recent side project) - <AUTHOR> https://github.com/rationalrevolt/hntrendz

<comment><AUTHOR> This is my first ruby app. I am basically fetching the HN front page every 5 minutes and keeping track of when stories: (a) come to the front page (b) leave the front page. As of now, the apps front page only shows charts of stories that have most recently moved off the front page. There is also a route that shows the trend for a particular HN story (such as [http://apps.defsym.me/hntrendz/7116764](http://apps.defsym.me/hntrendz/7116764) for the Gmail is down story). I have poor front end skills so I admit the app has a lot that can be done to make it usable and pretty. The app is very much unfinished as of now and with my interests shifting to other projects I am hoping someone would like to fork and take it forward. Some things I had in mind: (a) Replace chart.js with highcharts (b) Offer additional views (like top trends etc) (c) Summary statistics - such as when it first appeared on the HN front page, how long it stayed etc</comment>


Review our MVP for preferential polls - <AUTHOR>

Democratic.ly lets you run preferential polls.<p>http://democratic.ly <comment><AUTHOR> <http://democratic.ly/poll/23>

<comment><USER2> Site seems down

<comment><AUTHOR> Misspelling, fixed. Thank you.</comment></comment></comment>


Balsamiq Mockups Makes Big Impression on Hacker Community - <AUTHOR> http://thenextweb.org/2008/08/07/balsamiq-mockups-makes-big-impression-on-hacker-community/

<comment><USER2> _This is one of those rags to riches stories that inspire us all._

Not exactly. Peldi seems to be doing well so far, but I'd characterize his story to date as riches to rags (and hopefully to riches again). It's only been 7 weeks or so since he launched, so it might be a bit early to anoint balsamiq as a huge success.

I sure hope it is though. Very inspiring.

<comment><USER3> I agree. It just depends on if the revenue continues, or dries up once most people who want to buy it, have...

Still a nice success story so far though.

<comment><USER4> Hi there, Peldi here. I also agree, I didn't think the "rags to riches" sentence applied to my situation either...

axod, I agree that Mockups alone might not be a sustainable business (though it's doing MUCH better than I expected at the moment). My plan is to develop 2 new products a year, and to port them to as many Web Office platforms as it makes sense (i.e. turn them into plugins to wikis etc). I have an ever growing list of ideas for new products already. Together these sources of revenue should be enough to keep a small business going, we shall see...

<comment><USER3> Sounds like a good plan :) Should also be a lot of tie ins/plugins/extras you can sell related to mockups I'd expect.

Good luck

</comment></comment></comment></comment><comment><USER5> Looks neat, I'll have to try it out. Admittedly for someone like me working with a very small team pencil/paper layouts are fastest (and cheapest).

Previously, if I needed wireframes of the sort that Balsamiq appears to be good for, I'd use Omnigraffle. But I've known others to use everything from Photoshop to Illustrator to Visio to Excel. And, of course, for web apps and wesbsites, html mockups are always in the mix.

At the end of the day, you need to use what works well for you and anyone else you are working with. But a hybrid approach that mixes different tools depending on the task is generally what I'm after.

</comment><comment><USER6> Just give me Illustrator. Way more flexible.

<comment><USER7> I thought that, and that Balsamiq Mockups looked way too simple to be useful - but it isn't! I rebuilt the basic look of google maps in less than 5 mins...

The beauty of it IMO is it makes you think about the layout of the app/site, not the look of it.

But, saying that...I will be sticking with photoshop for my mockups, just because I DO use my mockups for the design too, but thats just a personal preference, I know a lot of people want to build the layout then find a nice design, thats where this tool is cool!

</comment></comment><comment><USER8> I like Balsamiq, although I prefer Axure (wish they made a mac version) simply because I can create a functional prototype and auto-generate functional specs.

<comment><USER9> The best ones I have used are LucidSpec (<http://elegancetech.com>) and AxureRP-Pro (<http://www.axure.com>), but Balsamiq wins for basic conceptions simply because it is web-based and it is easy to collaborate with others across the globe hassle-free.

<comment><USER10> I prefer Illustrator for sketching because it is easier to drag certain elements straight to Photoshop once you are done. But I will give this a try anyway...

</comment></comment></comment><comment><USER11> For all the coverage this gets on HN, I tried to use the demo and nothing loads.

<comment><USER4> Sorry about that, it's fixed now.</comment></comment>


Ask HN: How to hide all submissions from a specific domain? - <AUTHOR> For instance, I'm not interested in clicking on anything that is account-walled. <comment><USER2> If you're comfortable with JavaScript and Chrome DevTools you could create a Snippet [1] that deletes an entry from the page if the link matches the undesirable domains. You'd have to run it manually though which would probably get tedious depending on how frequently you visit HN.

[1] [https://developers.google.com/web/tools/chrome- devtools/java...](https://developers.google.com/web/tools/chrome- devtools/javascript/snippets)

Disclosure: DevTools docs guy</comment>


Fuse - <AUTHOR> https://www.fusetools.com <comment><USER2> I really don't see the point.

If you don't need cross platform the best choice is native so you can leverage all the platform goodies.

If you do need cross platform and have the budget you will go with 2 native projects.

If you don't have enough budget for 2 native apps you have a few options.

Cordova is good enough for a lot of apps. Even Apple uses Webviews in its own apps. Also check the Missive mail client all built with web technologies:

[https://medium.com/missive-app/our-dirty-little-secret- cross...](https://medium.com/missive-app/our-dirty-little-secret-cross- platform-email-client-with-nothing-but-html-aa12fc33bb02)

We are building a universal app that will work on iOS, Android, Mac, Windows, and Chrome OS with a single code base.

If you need better performance you can always use React Native, NativeScript, or Xamarin.

Why go with this Fuse thing?

<comment><USER3> Hi, I'm Remi from Fusetools. This interview with our CEO Anders does a good job of summarizing what we're about: [https://www.forbes.com/sites/julianmitchell/2017/06/29/this-...](https://www.forbes.com/sites/julianmitchell/2017/06/29/this- ux-design-suite-makes-developing-mobile-apps-quick-and-simple) (feel free to skip past the intro about why app development is A Thing :)

TL;DR We're primarily about being able to create cool stuff in less time (cross-platform is just a side-effect of that). A lot of what we build comes down to creating good workflows for going from idea to the final product, and to find the right level of abstraction so that you can work very quickly (staying focused on the real job rather than boilerplate and glue code) without giving up control and being sandboxed.

<comment><USER4> There's a "welcome ad" redirection on forbes website preventing me from reading any articles there. Maybe choose a better place to host content you want to link to.

Is it really crossplatform when according to your website it only supports the two majors compuphones makers ? Seems to me it's more marketing than anything else.

<comment><USER5> Just gotta wait 3 seconds, man. The welcome overlay on Forbes will let you click through if you wait 3 seconds.

So much hate in your comment. Why are you so quick to be dismissive and rude?

I for one think it's fair to claim they are cross platform if they work with 97.12% of the mobile market share [1].

1\. [https://www.netmarketshare.com/operating-system-market- share...](https://www.netmarketshare.com/operating-system-market- share.aspx?qprid=8&qpcustomd=1)

<comment> yjftsjthsd-h "preventing me from reading any articles there" sounds more like someone with no success regardless of waiting; I would be completely unsurprised if their waiting screen broke sometimes.

> So much hate in your comment. Why are you so quick to be dismissive and > rude?

GP raised multiple apparently valid objections. This is neither hateful nor rude, and your efforts would be better spent on answering issues than name- calling.

</comment></comment></comment></comment></comment><comment><USER6> > Create better native apps for iOS and Android with a new breed of > development tools.

Does no one understand what native means anymore? UI wise, native means using the platforms widget toolkit which this does not seem to do. I'm not sure if it's even possible on android unless they are calling into the java stack for rendering the UI. Notice how in the MacOS screenshots they give a giant middle finger to the current OS theme? Doesn't look like it's using cocoa/carbon (whatever the current mac toolkit is) underneath.

I'm not sure if I'd even consider it native code on android, which would be ART/Dalvik byte code, for better or worse. I also think transpiling from c#/javascript to to c++ would rule it out as being considered native, but that's debatable.

Never trust a project that will lie to you in the elevator pitch.

</comment><comment><USER7> I tried Fuse a while ago and even tough I didn't really got into it it was all very comfortable.

Lot of examples that look very promising really help to get into the main stuff quickly.

Tough, after learning React (preact actually) ; I'm wondering what it could help achieve more than going trough Native React. The last one is already well implemented and is "structured" like react, merging up some learning curve.

as Pier25 said earlier tough, trouble is when you need to implement "fancier" things. At which point you could have gotten into real native anyway.

It saves some time, but the pricing plans are ridiculous.

If you want to build a tool people want to use you need to build up something they'll like first.

I doubt anyone could be using it since more established tools are already been accepted by the community.

I will never pay you for a Visual Studio. I like coding with VIM or Subl, and I look after tools that I can use with a idiot text editor.

Hope you grow up from this :)

Cheers

edit: misread plans

<comment><USER8> Bent from Fuse here again: thanks for the feedback — we definitely know of a lot of people who use both RN and Fuse for different projects. They both have advantages and disadvantages, depending on your team makeup, experience and what type of project you're working on.

Your feedback around pricing is also duly noted.

<comment><USER2> I also think the pricing is unsustainable.

Even if you are making mobile apps all year round, what if tomorrow you don't want to use Fuse anymore? You'd need to keep on paying the subscription to fix bugs.

What if you are a freelancer who only makes mobile apps from time to time? Again you need to pay the whole enchilada to be able to fix little bugs from time to time.

A price per published app would make more sense IMO. Allow devs to use the complete experience for developing, make them pay when they need to compile and publish the app. If you are confident that your users will love your dev experience (which seems your stronger selling point) this would not feel like a trap.

</comment></comment></comment><comment><USER9> Looks like Electron on steroids. The landing page is nice but it's like putting lipstick on a pig - it's still a pig in the end.

Also, I never understood why people hate native languages so much - why do you want to replace everything with Javascript? It's shit - it's a necessary evil in the browser but when the environment gives you something better (Swift, Java, etc) why not enjoy it?

<comment><USER10> > Also, I never understood why people hate native languages so much - why do > you want to replace everything with Javascript?

Because people don't have the time, money or expertise to write multiple completely separate code bases for cross platform apps and having to keep these code bases in sync will dramatically slow down your ability to extend and adapt your product...?

<comment><USER11> Cross platform apps don't need to have separate codebases. Cross platform libraries and toolkits do exist.

<comment><USER12> Existing is not sufficient.

Convince us one of those tools is any good, because it doesn't seem like it, from the traction they've had so far.

<comment><USER13> I want the same thing you want, but I recognize that such a thing is very, very hard to do.

</comment></comment></comment></comment></comment><comment><USER14> there was a team at my work evaluating Fuse, some very vocal fans, but they ended up going with React Native

has anybody actually used Fuse for a real product? we could not find anyone to talk with about it and that was a deal breaker

<comment><USER15> There is a bunch of people on the community slack who are using Fuse to make things. Generally, any question you may have will be answered in there. The dev team sit in there too, so it's first hand help

<comment><USER7> @bent or whoever from fuse team ; THIS is a great thing. Having a active slack channel with people that work on and with the tool is was a great deal for me learning other stuff. I will join you guys here :D

</comment></comment></comment><comment><USER16> Why choose this over native apps?

<comment><USER17> In general, it's a matter of rapid prototyping for POCs or MVPs that don't need much. As an example, I'm currently working on a system that needs a minimal iPhone/Android app. Just a login view and a couple buttons. I'm the only engineer working on this, and I have way more important stuff to do than manage two completely different codebases right now.

So for my MVP, I'm planning to use React Native to build the minimal interface, and then (once funding clears and we can figure out the hiring situation) I'll get one or two engineers to work on building a native app for each system.

<comment><USER16> > and I have way more important stuff to do than manage two completely > different codebases right now.

But why are they completely different? Surely the UI parts are different, but the meat of the work done internally is exposed by a common API?

<comment><USER17> iOS and Android projects look nothing alike. Sure, on the grand scheme of things, comparing the complexity of the backend to an application that is basically two views, the application with two views is a tiny percentage of the whole thing. But duplicating that percentage right now doesn't buy me anything.

</comment></comment></comment></comment><comment><USER18> How is this different to React Native?

<comment><USER3> Hi, Remi from Fuse here. This blog post (by yours truly) is over a year old now so some details are bound to have changed, but from a tech-philosophy standpoint I think it's still valid: [https://medium.com/fuseblog/how-fuse- differs-from-react-nati...](https://medium.com/fuseblog/how-fuse-differs-from- react-native-and-nativescript-525344f02aaf)

</comment></comment><comment><USER19> My understanding is that it is designed primarily to facilitate the interaction between designers and devs and shorten cycle times.

<comment><USER8> Bent from Fuse here — that's indeed our primary design goal. We believe designers shouldn't necessarily learn to code, and coders shouldn't be fluent in design, but getting each role to come close together and to give them a common language and similar semantics, as well as a platform that enables quick iterations, is important to us.

Our CEO (and primary engine coder) was interviewed by Forbes earlier this year, and in the interview he touches on A LOT of these points: [https://www.forbes.com/sites/julianmitchell/2017/06/29/this-...](https://www.forbes.com/sites/julianmitchell/2017/06/29/this- ux-design-suite-makes-developing-mobile-apps-quick-and-simple/#7ba5cb875c7d)

Quick quote:

"Our (former) jobs as programmers at ARM gave us a front-row view of all the capabilities of modern mobile devices, and it became apparent that most developers underutilized a lot of these devices. As a consequence, much of the raw power didn't benefit the end users who bought these pocket-sized supercomputers. Secondly, the way apps are developed hasn't changed much in the last 20-30 years. New tools and computer languages have come and gone, but the process remains largely the same, with developers and designers operating in separate worlds, using a different set of tools.

This is partly because collaboration across these boundaries requires a huge amount of additional work just to translate and re-implement the vision of stakeholders and designers into production code. In turn, this resulted in unsustainable processes of slow iterations for testing and validating ideas. Consequently, you end up with products and user experiences that are less thought-through or polished, even though you've spent an unacceptable amount of time, resources and risk to produce them.

These two takeaways lead us to realize that what was needed wasn't another micro-optimization tool. We had to take a step back and consider the entire development process from through the lens of product owners and designers, as well as developers. Fuse is the byproduct of that process."

</comment></comment><comment><USER20> So it's like Xamarin with less performs??

<comment><USER8> Bent from Fuse here: I wouldn't say so. Xamarin strikes us as something meant for people who want to code C# and work within the .NET ecosystem, while Fuse takes a completely different approach (to both how you develop your apps, and what you spend your time on while doing it). The choice of JS for business logic was also made to enable more people to find an easier path into app development. Our UX Markup (that compiles to native C++ code) is one thing that makes Fuse differ quite a lot from many other frameworks.

</comment></comment><comment><USER21> $125/month bye Looking for alternative React Native

<comment><USER8> I totally get that — thankfully Fuse itself is free (it has the same real-time desktop preview engine for both Windows and macOS, uses the same descriptive UX Markup language, and lets you deploy without cost to both iOS and Android like you're used to).

Fuse Studio is meant for people who want or need extra tooling on top, and is indeed our premium offering (the Fuse Professional plan doesn't just include Fuse Studio, but also premium components, Xcode and Android Studio library export support, multiple viewports and more). It's definitely not just for teams either, it's just _more suited_ if you work together with others.

There's a 30-day free trial of Fuse Studio too, so check it out and see if you'll do more than well enough with regular Fuse.

</comment></comment><comment><USER22> Javascript is already cross platform

<comment><USER23> That's... not what Fuse solves.

<comment><USER22> then what does fuse solve?

<comment><USER24> You run UI components written in C++ instead of embedding an entire browser on a mobile phone.

</comment></comment></comment></comment><comment><USER25> Scrolled down to the first code sample and had terrifying flashbacks to ColdFusion.

</comment><comment><USER26> This looks like Electron for mobile. If so; kill it with fire.

<comment><USER15> It fills the same space as Electron, but does not function like Electron. The majority of code is written with UX, which is then compiled to Native components. It is also possible to have trivial FFI to native code with objc and Java. JavaScript is only used for _some_ business logic.

</comment></comment><comment><USER27> Initially the title make me think this was about libfuse / Filesystem in Userspace

<comment><USER28> Indeed, please could the title be named properly to reflect the site?

</comment></comment><comment><USER29> Since the submission has no legit title either, I'll just respond with:

[https://en.wikipedia.org/wiki/Filesystem_in_Userspace](https://en.wikipedia.org/wiki/Filesystem_in_Userspace)

<comment><USER30> I don't really get the trend of name collisions. First React, now Fuse... what's next, a Linux brand of detergent?

<comment><USER31> What's not to get? Pretty much all words are used as names already and roughly in proportion to how simple they are.

This same comment chain can waste space in pretty much any thread on any product. What's the point in having it in every thread?

<comment><USER32> If the name is already taken, you can at least go for _some_ qualification (capitlization doesn't count).

For example, "Fuse Tools" (or "Fuse Apps"). As a bonus, the domain name is already fusetools.com.

<comment><USER33> They don't care, they win in any case. Their user base don't know about fuse, and:

\- if they are not successful it will not matter;

\- if they are successful they will out google the original FUSE and win.

So their strategy will work for them whatever happens.

It's now just a question of moral stand.

</comment></comment></comment></comment></comment><comment><USER21> $125 / month bye

<comment><USER15> The free version is _free_. The only thing you would have to pay for is the "studio", aka the dev tools.

</comment></comment><comment><USER34> Everything about this is stupid.</comment>


Ask HN: Why aren't websites adopting client certs in lieu of passwords? - <AUTHOR> In light of NIST's recent announcement, and several articles about password managers, why aren't sites being designed with client certs as an authentication or at least 2FA mechanism? <comment><USER2> Could we bootstrap this by starting with support in password manager browser plugins, rather than better UI support in browsers?

Say Lastpass, KeePass, and 1Password agree to support an open public-key auth protocol, where during signup if a site supports the protocol, your password manager will provide a public key instead of a password, and will then sign a challenge with that key during login.

Advantages:

\- Progressive enhancement -- everyone doesn't have to switch at once. Switch if you already use a password manager and want to opt into better security. Start with power users and trickle down as the pattern establishes itself.

\- Workflow -- my password manager is already necessary for me to log into most sites, so I'm already solving the problem of syncing the cert store everywhere I need it. My password manager is also already part of my UI flow whenever I'm asked for a new password. If anything this will simplify my life as a user, because server-side support will let my password manager offer better UI. (This would require some manual challenge response for the rare occasions I can't install the PM -- not sure how tricky that part would be.)

\- Incentives -- supporting the protocol is a value add for password managers -- it's another way to get higher security by using the product.

I'm sure folks are ahead of me -- just tossing out this angle in case it's helpful.

<comment><USER3> I think Mozilla's Persona fixed this general problem even better. Client auth support could easily have been a part of that had they got further into the project.

Unfortunately, there doesn't seem to be a business model around making this better. I think that password manager companies would be shooting themselves in the foot by doing this too. The reason they exist is because this kind of solution doesn't currently exist.

<comment><USER4> I don't really understand the business model point - isn't it the same as the business model for any other browser improvement? Better browser -> more users -> ??? -> profit!

<comment><USER5> I think one catch is that once a standard is in place, open source software will inevitably step in as a replacement for paid software.

</comment></comment></comment></comment><comment><USER6> The arguments against client-side TLS certificates boil down to complex UI and maintainability, but it does have its uses.

At small to medium sized companies it isn't uncommon to host a number of self- hosted services, such as GitLab, MatterMost, some wiki, perhaps OwnCloud, the list goes on. Securing all these services takes some non-trivial effort, even if you manage to get all services talking to your local LDAP server (we did!). Only recently GitLab advised users of the self-hosted solution to upgrade ASAP due to a security issue.

To cut ourselves some slack, we placed all these services behind an Nginx proxy. That proxy is secured with client-side TLS certificates. So if you try to access [https://chat.example.com](https://chat.example.com) without it, you just get a friendly error message (actually, you get a picture of Grumpy Cat saying 'no', but you get the idea). With certificate, you get the service you wanted to access. You still need to log on with the service, but that's usually just a matter of doing it once and ticking the 'remember me' checkbox or something similar. For our users it just works.

Generating new certificates and revoking old ones is fairly simple for the administrators (couple of scripts, ample documentation).

The arguments against public use still stand of course, but for this scenario it is a great solution.

<comment><USER7> I've made the same set-up us well for private services hosted on public IPs which we couldn't put behind a VPN, but I have to say admit this process is not without its own pains.

Nginx for one, didn't have client-certificate support for proxying until fairly recently, and many HTTP proxies and tools still don't. Even when there is support, you might run into some interesting corners cases, since this is a niche functionality, e.g. if you combine an Nginx with an Azure-hosted web app. Both work great in isolation, but not together, do to the strange tricks Azure is doing with TLS renegotiation.

<comment><USER8> > I've made the same set-up us well for private services hosted on public IPs > which we couldn't put behind a VPN, but I have to say admit this process is > not without its own pains.

In the process of doing the exact same thing, and decided on client certs/mutual-auth.

</comment></comment></comment><comment><USER9> Client certs would be awesome but they're not for humans.

I was enrolled at the distance university of Hagen in Germany for a while and they require the use of client certificates for access to their online portal. There were clear instructions for how to create and use a client certificate but I suspect they have an advantage in that many of their students enrol in technical subjects or already have job experience. Compared to an ordinary website they also have the advantage that students HAVE to use the website and they're the only public distance university in Germany so there's no competition.

From a user perspective the client certificate is incredibly cumbersome. It's a file on your computer, so you have to remember where you put it and move it to new devices if you want to use it there too. It also means you're more likely to misplace or lose it though you're probably less likely to leak it compared to a password.

The instructions also largely boiled down to "use Firefox". In Germany Firefox has a huge market share and is widely deployed as the alternative browser in the public sector (although IE still exists due to contracts with intranet service providers). In other countries things look differently.

In Chrome the experience of using client certificates was even more convoluted and the university officially didn't support Chrome because apparently client certificates flat out didn't work in Chrome until fairly recently (i.e. a few years ago).

In terms of UX, creating and using password is trivial compared to creating and using client certificates. Of course this is mostly because most people do passwords wrong. Creating and using a secure non-guessable password is difficult (though services like 1password or lastpass have made it easier at the cost of adding a single point of failure) but it's still marginally easier than creating and using a client certificate.

The big difference though, is that insecure-by-default is not as big of a cost to a website or software as the bad UX of client certificates. Sadly the UX of client certificates likely won't get better in browsers unless more sites use client certificates -- so it's stuck in a Catch 22.

<comment><USER10> Actually they just killed that program, and you won't be able to log via certificates starting early next year.

<comment><USER9> Doesn't surprise me. I always wondered how much support overhead it caused. I worked at the computer pool help desk of another university for a few semesters and it really opens your eyes to how alien some concepts techies find obvious can be for normal humans.

</comment></comment></comment><comment><USER11> Because the UI is terrible, both within the browser and the tools to generate and manage certs themselves. I implemented client certs for an internal API service and I quickly learned that even among a company of generally very clueful people, no one knows really knows how PKI works. No matter how much I tried to document the steps to generating and installing keys, users would have problems, and I would usually end up just doing it for them. The command line tools for PKI are generally very unfriendly, and terms like "private key", "signed certificate", "keystore" and "truststore" are basically meaningless to 99.9% of people, including other developers.

Not to mention that almost no one uses two-way SSL compared to standard SSL, making it very difficult to find good documentation and support for full two- way authentication. Most people assume SSL means server-only authentication and don't even realize client-authentication is possible. Many tools simply don't support it, or require obscure options to enable it. I found it difficult even to get a properly signed client certificate from a major CA, as the standard certs you get are marked for server authentication only.

</comment><comment> vertex-four Client certs have dire usability in browsers - it's impossible to do things like logging out, or using a public machine reasonably, managing certs across all your devices is extremely difficult, etc etc.

BrowserID (Persona) solved some of these issues by issuing short-term certs to devices based on a login, and designing an API for logout, but even the organisation that specced it out (Mozilla) never integrated it into its browser, so it failed on usability grounds.

<comment><USER12> > it's impossible to do things like logging out, or using a public machine > reasonably

Both of those are really the same issue, and they boil down to 'only use a browser instance you own to use a secure site, and don't share ownership of browser instances.' That seems pretty reasonable to me: indeed, anyone who uses a shared browser for private communications has already lost, badly.

The upside of not logging out is never having to log _in_.

You're correct about the pain of managing certs across devices.

<comment><USER13> Threat model! You've only lost to other people who have previously had access to that computer. Sometimes those people aren't within your threat model.

For instance, "a close friend impersonates me on HN" is pretty strongly outside my threat model. And as mentioned for people whose only computers are shared computers, "someone installs malware on the computer at my shelter and spies on my tax return" is a preferable outcome to "I don't file a tax return" (but we still have authentication, because both of those are still much better than "my abusive ex, who is not allowed in the shelter, spies on my tax return").

<comment><USER14> > For instance, "a close friend impersonates me on HN" is pretty strongly > outside my threat model.

You obviously haven't had the same kind of close friends that I've had.

</comment></comment></comment></comment><comment><USER15> I know this is a US-based site, but as July 1st 2016 the eIDAS Regulation has come into force in all EU member states, creating a legal structure for electronic identification, signatures, seals, and documents throughout the EU. Adobe for instance supports EU Trusted Lists: [https://blogs.adobe.com/documentcloud/eu-trusted-list-now- av...](https://blogs.adobe.com/documentcloud/eu-trusted-list-now-available-in- adobe-acrobat/)

In many EU countries getting citizen certificates is getting more usual in order to deal with government paperwork (taxes, forms, healthcare, subsidies, etc.) so now that an unified trust structure exists, maybe it can boost adoption also by browsers and websites.

Edit: here's an official FAQ on eIDAS. It explicitly mentions website authentication and browsers. [https://ec.europa.eu/digital-single- market/en/news/questions...](https://ec.europa.eu/digital-single- market/en/news/questions-answers-trust-services-under-eidas)

</comment><comment><USER16> Usability is awful: [https://support.globalsign.com/customer/portal/articles/1211...](https://support.globalsign.com/customer/portal/articles/1211541-install- client-digital-certificate---windows-using-chrome)

</comment><comment><USER17> I prefer client certificates to passwords when logging into intranet sites, which is just a couple of clicks as opposed to typing (password managers with auto-fill could also be used), but having a system to generate and provide the certificate is not simple. You would somehow have to authenticate and identify the user before you issue a certificate for that person. That "somehow" is usually using a username and password already provided to them (most likely for the system login, which is separate from other applications wanting to use client certificates). Installing directly from a issuing server to the browser is ideal, IMO. Other channels for providing the certificate come with more issues on the security and usability fronts.

There's also a big difference in where the certificate store is and which browsers share it. For example, on Windows the certificate store is _managed_ using Internet Explorer and the same is also used by Google Chrome. Firefox, on the other hand, has its own certificate store (including trusted CAs). So even if you deploy a system to provision client certificates, non-tech users may find that the site does not work on a certain browser depending on which browser they did the initial certificate generation and import from.

Exporting and importing certificates into different browsers is quite easy for techies, but you'd have to provide step-by-step instructions with screenshots for others. And God forbid a browser/system's certificate management interface changes, and you'd have tons of tickets coming to support.

</comment><comment><USER18> With a password, I can log in to the website from anywhere. With client-certs, I have to pre-populate the cert onto all of my devices.

<comment><USER19> Haven't you just described 2FA?

<comment><USER18> No, with 2FA, I need my password, and my phone. I only have to set up one device: my phone (or whatever other 2FA token). I don't have to go through my home computer, my laptop, my phone, my work computer, my friend's computer, etc. and set up my certificate everywhere just because I might need to log in to a website.

</comment></comment></comment><comment><USER20> Since I didn't see this elsewhere - client certs have privacy concerns, because by the time you've done your handshake the other side knows exactly who you are. This pretty much rules out always-presented certs. Because of that, you would need to manage the certs more directly, and then you get into all of the UX issues around managing certs.

</comment><comment><USER21> I would like to extend the question: is any startup/company working on something that would simplify the client certs process? Why haven't we really moved beyond password-based logins yet?

<comment><USER22> I am surprised nobody has mentioned the FIDO Alliance and its Universal 2nd Factor, or it's successor work by the W3C. They're actively working on 'killing passwords'.

U2F originated from Google when they wanted better 2FA for their internal services and they partnered with Yubikey to create the hardware. In a two years study it has been shown to be faster to easy, less prone to user error and more secure[1]. It's basically a client cert on a USB stick, but the standards allow for forms of other hardware as well.

U2F is a FIDO 1.0 standard, the 2.0 version is now being worked on by the W3C Web Authentication Working Group[2]. Microsoft has launched support for a draft of this spec in Windows 10 and Edge under the 'Windows Hello' banner[3].

[1]: [https://www.yubico.com/2016/02/use-of-fido-u2f-security- keys...](https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys-focus- of-2-year-google-study/)

[2]: [https://www.w3.org/blog/2015/11/w3c-fido/](https://www.w3.org/blog/2015/11/w3c-fido/)

[3]: [https://blogs.windows.com/msedgedev/2016/04/12/a-world- witho...](https://blogs.windows.com/msedgedev/2016/04/12/a-world-without- passwords-windows-hello-in-microsoft-edge/)

<comment><USER21> Geez, I even have a Yubikey and I didn't think of that. I use it so sporadically for my 2FA on gmail that it completely fell off of my mind...

</comment></comment></comment><comment><USER23> Because it's not user friendly? Especially across devices

<comment><USER24> I would argue the opposite, the only problem that has to be fixed is a method for distributing certificates, I use client certs for all my self hosted services, and a certificate is much more usable then typing passwords on any mobile device.

<comment><USER23> I don't even know how to install a cert on my phone in the first place, and I'm a programmer.

Yes I could figure it out. But what about my grandmother? She can handle passwords, but definitely not certs.

</comment></comment></comment><comment><USER13> Privacy is the biggest problem - both sides of the connection present their identity simultaneously, so you leak your identity to a MITM. For server-to- server communication, that's fine. For person-to-website communication, the two sides are semantically asymmetric, and I don't want to prove to 184.108.40.206 that I am geofft until 188.8.131.52 proves to me that it's news.ycombinator.com.

UX is the other one. Chrome is removing support for <keygen>, and they have excellent arguments for why: [https://groups.google.com/a/chromium.org/d/msg/blink- dev/z_q...](https://groups.google.com/a/chromium.org/d/msg/blink- dev/z_qEpmzzKh8/IGGYDPcvAgAJ) (Essentially, the ability for a website to inject certs into the _system_ cert store is super weird.)

And without <keygen>, the experience of installing certs is completely awful. Let alone the UX problems with expired certs, etc.

</comment><comment><USER25> I had to abandon them because of HTTP/2\. If one site on the web server uses TLS client auth, and then you go to another site on the same server you receive HTTP 421 Misdirected Request, because of connection reuse.

And almost none browser can deal with them correctly (or could not few months ago) - I'm looking at you Chrome, mobile Opera etc...

<comment><USER26> Would you happen to have links to relevant bugs/issues?

</comment></comment><comment><USER27> 2FA would be nice, but for client certs, as others have said, the UI sucks. Once you have to share the same cert (or manage multiple certs on multiple computers) it becomes too cumbersome for most end users.

Apple Keychain can store certs (I believe), as can most password managers so there's that to help.

But, IMHO, the only way it could get widespread use is if the cert is stored on a physical token that you can connect to your different computers. In the style of the DOD CAC where the private cert never leaves the card itself. Back up the certificate before storing it on the card or USB stick, and then plug that into every computer you want to access. Downside: Without multiple tokens you can't use multiple computers at the same time (easily).

<comment><USER28> I was just about to say the same thing. The only cases where I have seen successful rollouts of client certificates have involved something like a CAC.

It is still clumsy and painful, and I doubt many users would volunteer for a similar approach.

</comment></comment><comment><USER29> The DoD uses them across the board. Even civilian contractors get one, and they carry it with them all the time (it doubles as their ID badge).

<comment><USER30> It takes a lot of organization to make them work in DOD, but in my experience it is worth it. From a dev perspective they are actually easier than username/password, as the client certificate DN is available on the server, so you can know the identity of the user very easily.

</comment></comment><comment><USER31> I think most of it is the fact that users know how the passwords are supposed to work -- basic "do-s nd don't-s" (e.g., do not give them out to "tech representatives" calling your home, etc.), how to change them, etc.

Certificates? Most are vague at best about them. Does closing the browser window stop access? Can you share certs? If your laptop is stolen did certs get compromised? How do you deal with compromised certs? Etc, etc. Ask a generic user something like this and enjoy the answers.

This is slowly changing -- as more organizations switch to cert-based authentication more users get to know and trust them which can lead to wide adoption for personal use.

</comment><comment><USER32> Because there is no easy way to do it.

Source: I've done contracting for government and I've worked on a PoC to determine whether we could bring 2FA to a 10M people country at once.

<comment><USER32> By the way. I should add that the conclusion of the PoC was that is was simple and doable within 3-5 years with rather low risks.

</comment></comment><comment><USER33> I'll add to what's already said:

You'd need to be able to maintain/deploy certs to all your devices in a way that's simple enough for non-technical users to understand; never mind the added requirement for safe private cert handling on each device.

Once you're outside of the browser accessing services, take banks for example, now I need a my browser to have the cert and my mobile apps individually to have those certs as well... or I have certs for the the browser and passwords for the apps (more complexity for the user). Sure my devices can have a cert safe or similar, but the apps/browsers would have to respect that sufficiently for it to be useful (hard enough to get my password manager to work with my phone apps well... certs... eek!)

Finally each browser, app, etc. may have it's own way of dealing with things... making for even more complexity.

I could go on.

Point is there's an awful lot of friction to make that work as simply as the less secure, but apparently socially acceptable, passwords we use today. Whether that should be "the way" or not is irrelevant... consumer choices include factoring in immediate ease of use, right or wrong.

I think there are better arguments for 2FA, since there is something approaching reasonable standards (most applications I encounter support Google Authenticator or that standard at least). You still end up with another ease of use issue, but that might a more surmountable one. (I do hate, though, that I have to use my 2FA on the device which I get my 2FA auth codes from... I understand why, but still...)

Of course, Hacker News is a start-upish sort of community... so maybe unified technology security management for consumers is the next big thing to be "disrupted". :-) Have at it!

</comment><comment><USER34> Doesn't Google handle it's own internal IT services in this way? You don't log into a domain, every internal IT service is available on the web and not behind a firewall, but requires a company provided cert to access? This always seemed better to me than trying to secure a perimeter around resources anyway, usability considerations notwithstanding.

</comment><comment> UK-AL Client certs are great for APIs. I wouldn't use them for actual websites.

</comment><comment><USER35> [https://web.whatsapp.com/](https://web.whatsapp.com/) only allows login through a cert (via a QR-code). Some banks also use this. A smartphone is used a a cert vault. Not a client cert in the traditional sense, though it's basically the same thing.

<comment><USER36> Nah it's not the same thing. Client Authenticated TLS provides a mutually authenticated channel. Mutually authenticated channels cannot be man-in-the- middled. The auth is happening at the transport layer.

A login through a QR code (basically a token) is just normal TLS with the same MiTM risk. Its just an application layer login.

<comment><USER13> I don't understand the security argument you're making. Are you claiming that, if I use client certs, I am protected against a rogue CA issuing a fake certificate for web.whatsapp.com? How?

If you're thinking of a protocol like Kerberos, then yes, you can derive a shared secret because there's a single-point-of-trust authentication entity (the KDC) which has knowledge of both your password and the server's password/key, and yes, _your password_ certifies that you're talking to the right server (as long as the KDC is trustworthy). But that's not how TLS mutual auth works.

</comment></comment></comment><comment><USER37> Some companies use Forcepoint's TLS inspection to monitor all outbound TLS/SSL traffic. I suspect client certs break that. Probably that's a good thing, but if your customers work inside a company using Forcepoint, well, those won't be your customers from 9AM - 5PM their time.

"When you enable SSL decryption for your endusers, SSL-encrypted traffic is decrypted, inspected, and then re-encrypted before it is sent to its destination."

[http://www.websense.com/content/support/library/web/hosted/a...](http://www.websense.com/content/support/library/web/hosted/admin_guide/ssl_enable.aspx)

<comment><USER38> I can confirm.

In my work deploying desktop software to institutions, often academic and medical, I had to disable client-side certs to allow for connections to be made.

Apparently, even though it should be technically more secure, client-side certs are so infrequently used, these types of gateway monitors block connections made with them!

Maybe not as surprising, but non-browser software making connections to servers with non-publicly-signed SSL certs (but embedded CA chains) were also blocked.

<comment><USER39> This makes me sad. Academic and medical sites should really be the last places using TLS breaking gateways. Mainly because staff frequently have to sign legal confidentiality and data access agreements granting them personal access to other institutions patient data rather than having an institutional agreement.

Posture checking and zero internal network trust really needs to take hold in these places. If people must tap TLS, they should do it via installation of software client side, not MITM.

</comment></comment></comment><comment><USER40> I've designed this protocol[1] to make client certs work easy for end users.

Signing up at a site is just requesting a client cert at the site's _private_ CA.

It requires a user agent (a browserplugin) on the client side. The agent keeps check of which certificates belong to what sites so it actively blocks MitM attacks.

Granted, if you need to share your certificates, you'd have to copy them over. For that, use the sync-feature of your browser or design something better. But synching is a separate concern, independent of the authentication protocol.

[1] [http://eccentric-authentication.org/](http://eccentric- authentication.org/)

</comment><comment><USER41> We've been using client certificates at MIT for more than a decade. Many people like them. But, most people hate them. As others said, the usability is the primary issue.

The specific issues are:

1\. You have to install a client certificate on every device you want to use. And, you have to keep that certificate up to date. If you use multiple web browsers (for say UI development testing) you have to install and maintain the certificate it each one. MIT currently issues client certificates with a validity period of slightly less than one year. That makes for a lot of lost time every year for students, staff, and faculty, spent re-installing client certs.

2\. The certificate can be stolen just like a password. But, there is no easy way for the client to revoke a stolen certificate. Many CRL list implementations are lacking or fully absent. There for, organizations that depend on client certificate authentication typically depend on certificate expiration to re-secure compromised client accounts. (See #1 above)

3\. Client certificates are not supported by all web servers. The major players support it pretty well. But, there's been a proliferation of specialized, micro, and nano web servers over the last several years.

4\. You have to invest in securing the signing key for the client certificates. This usually means a decent HSM which costs on the over of $x00,000USD. At MIT for example, there is a web site where anyone can go at any time to generate a new client certificate (again, see #1). This site needs to be able to perform signatures constantly which means the signing key needs to be accessible 24/7 online some how.

5\. Proxies are a problem. If you try and terminate the TLS connection early, the client certificate related operations are not "proxied back". Some proxies like HAProxy will allow you to pass back environment variables set during the client certificate authentication process. But, that is obviously not the same as having the final destination webserver performing validation. This has become much more of an issue with the invention of ClouldFlare's TLS proxying CDN.

6\. If you implement logic to expire certificates at the end of a customer's subscription or enrolment period, it can cause significant headaches with processes where it would be helpful to still be able to authenticate them. For example, if a customer's subscription to your SaaS site expires and you want them to be able to review with out inadvertently sharing details of their account with others. Or, if a student has graduated but they still need to pay some unpaid parking tickets. MIT runs into this issue often due to its use of client side certificates. If you extend their certificate well beyond the end of their system authorization, you have to put a lot of complex authorization code in all of your local apps and websites. While client certificates only provide authentication and not authorization, many implementers use client certificates for both simultaneously. This is especially true when protecting web content and web sites with client certificates.

</comment><comment><USER42> Really interested in adoption of nfc smart cards. Still, it's just not possible now - you'd need hardware, software support on basically every platform. Looking forward though

</comment><comment><USER43> Would TLS-SRP provide the same type benefits as a cert (mutual auth and no secrets on the server), but with a password (less entropy).

[https://en.wikipedia.org/wiki/TLS-SRP](https://en.wikipedia.org/wiki/TLS-SRP)

[https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...](https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol)

</comment><comment><USER44> Rietumu Banka in Latvia uses password, 2FA (classic jumping code keyfob) _and_ client side certs. [http://www.rietumu.com/remote-internet-cert- mac](http://www.rietumu.com/remote-internet-cert-mac) [http://www.rietumu.com/remote-internet-cert- win](http://www.rietumu.com/remote-internet-cert-win) It's crazy.

</comment><comment><USER45> Revenue website here in Ireland does this, you need to have a cert which is read by a java applet, cert is issued after you use a one time password mailed to your home from what i remember, they expire every so often and need to be renewed.

One of the banking sites did as well but dropped it, now my gmail is more secure than my bank account since there is no 2fa on this bank.

The java applet approach must cause endless customer support requests

</comment><comment><USER46> I've done this once, as a client. I believe it was with startssl.com. Somehow I messed it up, I don't know, but in the end it was quite troublesome to get it working. And then I'm a pro user, so I consider myself someone who should be able to get this working.

Another problem is how to manage your keys between devices.

If this would be offered as an extra option, just like Gmail has 2FA, that would be great!

</comment><comment><USER47> Mostly this: [https://www.w3.org/DesignIssues/Security- ClientCerts.html](https://www.w3.org/DesignIssues/Security-ClientCerts.html)

Also it's because a phisical thing you lose easier than forgot a password (new/crashed/different computer, another browser, etc, etc)

</comment><comment><USER48> Client certificates are harder to put in place than a login form. It requires to create the certificates and install them on every device which will log to the website. And you will have to manage the changes/lost of devices.

But I agree it is a good solution in a 2FA for internal applications.

</comment><comment><USER49> A password is safely stored in my brain and 100% portable. I can use it from whatever location. If I lose my computer, the password is not in the hands of bad guys. Not so with a client cert.

<comment><USER50> > If I lose my computer, the password is not in the hands of bad guys.

You really just want a password-protected client cert then (can be specific to the cert or FDE). Your in-brain password keeps someone who steals your computer from getting access and the client cert makes sure that an actor that can sniff the whole network _and_ the ability to break TLS still can't impersonate you.

</comment></comment><comment><USER51> As someone in a country where all on'line interaction with the State is mediated with client-side certs, this question always raises a wry smile.

</comment><comment><USER36> With the proposed deprecation of the <keygen> tag, it's going to get harder to enrol client certificates. This is not the way forward

</comment><comment><USER52> Because it's cumbersome-ness decreases usage

</comment><comment><USER53> Horrible user experience.</comment>


Ask HN: What do you think the world looks like in 10 years? - <AUTHOR> What are your predictions for what the world looks like in 10 years?
What kind of technology will be commonplace and how will everyday life be different?
When I think back ten years one small example is the iPhone, and by extension smartphones.
They are now such a big part of our lives and have enabled the creation of many billion dollar industries and companies.
What does your crystal ball show? <comment><USER2> See the AI hype? this is going to happen to gene editing and biology.

I think that lots of dev's are already interested in the human genom, biochemistry and life science but it's somehow too far away, it's not predicable enough for us, that's because we (humans) haven't understood it yet.

But there will be a time were all those topics will be more predicable for us developers, we will gain more interest in biological programming ?

There will be coursera/pluralsight courses about 'Extract your own DNA and make it blink' courses.

Biology is going to be programmable like a microcontroller. We will order Do it yourself kits like Arduinos and Pi's from Amazon.

Edit:

And that's something I'd really love to see, there is so much potential once real hackers try to solve problems in biology, if we take a closer look at the open source community and how many amazing things they (we) have created, all that awesomeness could also become true for biology.

A few links:

[https://en.wikipedia.org/wiki/Genome_editing](https://en.wikipedia.org/wiki/Genome_editing) [https://en.wikipedia.org/wiki/Do-it- yourself_biology](https://en.wikipedia.org/wiki/Do-it-yourself_biology)

</comment><comment><USER3> It really depends much on how the battery / fuelcell tech will develop over the next years.

If we get good improvements in capacity on batteries you can expect personal electric aerial vehicles to become commonplace (drones / n-copters for personal transport)

</comment><comment><USER4> I suspect that micro and niche manufacturing is going to be a thing. If you have a high value product that you can sell a few hundred of a year, then you might be able to have a sustainable business for your self out of your garage.

There are already folks doing this for small markets, especially for high quality goods. Jeans, knives, various EDC items, wallets... these markets are only going to grow.

</comment><comment><USER5> I see VR and AR becoming much more commonplace.

<comment><USER6> I think it'll remain a niche gaming device that enjoys a brief burst of popularity then decline to a low steady-state, sort of like the Wii.

I just don't see a lot of applications for it beyond occasional escapism. It's an interesting experience for sure but I don't think I even want all of my games to be VR. AR could be more useful but I have a feeling it's one of those things that look good in the movies but winds up being clunky to use in real life.</comment></comment>


Bringing VR Analytics to the Browser - <AUTHOR> https://blog.vrtigo.io/bringing-vr-analytics-to-the-browser-27579784e333 <comment><USER2> Interesting point about the maturity & availability of 3rd party Unity libraries. Do you have any plans to open source your Unity libraries (UUID, etc)?</comment>


High Growth Engineering: The power of proposals - <AUTHOR> https://highgrowthengineering.substack.com/p/the-power-of-proposals- <comment><USER2> Hi Stephen,

Thanks for sharing this. I am a mid / senior engineer trying to work smarter and I believe this newsletter will help me with thinking about problems in the correct context and asking myself the right questions.

I really appreciate the resources attached to this particular topic (the list of questions) as it is something I have personally struggled with in the past in my career.

Do you by any chance have a sneak preview on topics you will be addressing in the near future? I have just been made redundant so am taking the opportunity to learn as much as I can before I get into my next role.

Thanks again!

<comment><AUTHOR> Hey Dan. Great to hear from you.

I touch on the sorts of topics I'll be covering in the introduction of the post. Roughly, it'll be a blend between operating more effectively (e.g. better estimating work, taming Slack), and more technical posts (effectively testing in production, etc)

</comment></comment><comment><AUTHOR> Hi gang. I've just started a newsletter that focuses on discussing techniques for building better software and being more effective in high growth companies. I'm doing this for a couple of reasons. 1) I love writing, and it's a creative outlet. 2) I think it's a sorely under-discussed topic.

Would love to hear feedback and thoughts.</comment>


'Edward Snowden did this country a great service. Let him come home' - k-mcgrady https://www.theguardian.com/us-news/2016/sep/14/edward-snowden-pardon-bernie-sanders-daniel-ellsberg <comment><AUTHOR> Will Snowden write a book?

Im curious about an in depth story of his leaks and him. Citizen 4 didn't provide a lot.</comment>