Grammarly shared its tokens with all websites - <AUTHOR> https://bugs.chromium.org/p/project-zero/issues/detail?id=1527&desc=2 <comment><USER2> Last year I signed up for a paid subscription to Grammarly...then I read terms of use[1]. I know...it should have been the other way around, but here it goes:

> "By uploading or entering any User Content, you give Grammarly (and those it > works with) a nonexclusive, worldwide, royalty-free and fully-paid, > transferable and sublicensable, perpetual, and irrevocable license to copy, > store and use your User Content in connection with the provision of the > Software and the Services and to improve the algorithms underlying the > Software and the Services."

First I thought that may be this is just me being paranoid. So I compared their terms of service with Evernote's[2] and summarize the differences for them in the support ticket asking termination of my account. I reproduce that here for reference:

> In Evernote's TOS

> – It's clearly noted that the user retains their Copyright to the content;

> – and the license to Evernote is a limited and they don't "obtain any right, > title or > interest" other than they point out;

> – they don't require sublicensable and transferable rights to User Content > which is different than having the rights to share the content with other > contractual partners (which they require);

> – the agreement on content is irrevocable as long as the content is stored > on the service.

[1]: [https://www.grammarly.com/terms](https://www.grammarly.com/terms)

[2]: [https://evernote.com/legal/tos.php](https://evernote.com/legal/tos.php)

Edit: Formatting.

<comment><USER3> Is the grammarly ToS more than a CYA? I think they may do it that way to protect themselves from being sued after retaining your work. But I don't like the possibility of them owning your work.

<comment><USER2> I agree that like many of such documents, it is CYA indeed. I don't mind CYA, but this is just sloppy encroaching legalese gobbledygook.

</comment></comment></comment><comment><USER4> I feel like the first thing we should talk about is how this is effectively a keylogger, similar to Windows 10's inking and typing setting, albeit with likely poorer security.

Collecting everything you type into a web browser (or MS Office) and sending it to them seems like a really bad idea.

<comment><USER5> Aren't all password managers keyloggers too?

<comment><USER4> I personally stay far away from password managers, especially as browser extensions. I'd really recommend _everyone_ look at how many of their Chrome extensions have the permission to "access your data on all websites", and consider whether or not they _really_ trust the companies or individuals who made those extensions with that permission.

It's eye-opening to people when I ask them about an extension they have, say "Honey", and they say they like it because it saves them money. And then I point out it can access _everything they do online_ , and ask them if that's a concern or not.

<comment><USER6> > I personally stay far away from password managers

I am curious how you manage your passwords.

<comment><USER7> Use an out of band password manager, whose key is never transmitted over a network. Or a notebook that is physically secured. There are a number of solutions for password vaults, and you can use a variety of means to synchronize them if needed.

The notion that it's a good idea to trust a browser extension for secrets management is pretty bizarre to me if you're protecting high value assets.

<comment><USER8> As always, it depends on your threat assessment and what is practically possible. For the vast majority of users, using a password manager browser extension [1] is a large improvement over password re-use over dozens of sites. Most folks will also not want to put in the effort to use an out-of- band password manager.

(Not directed at you personally, but I often hear such comments from people who are then perfectly fine to use a password manager in X11, where in a the default configuration every application can read your keystrokes, screen grabs, clipboard, etc.)

[1] Preferably one that communicates with an out-of-process password manager over an authenticated channel like 1Password.

</comment></comment></comment></comment></comment></comment><comment><USER9> I nearly missed this bit at the bottom:

> Grammarly had fixed the issue and released an update to the Chrome Web Store > within a few hours, a really impressive response time.

Nice to see a company take this kind of thing appropriately seriously (although of course it should never have happened in the first place).

<comment><USER10> It seems like it would be more fair for the headline to use the past tense.

<comment><USER11> Gotta get that HN karma tho

<comment><USER12> You are getting down votes because HN has a policy that the HN Title should match the Title on the link to prevent editorializing in almost all cases.

This prevents users from creating click bait headlines to _get that karma tho_ , the majority of the time. Cases where the actual title is the click bait like this one, are the unintended consequence of that policy.

<comment><USER13> That's true, except the guideline reads "Please use the original title, unless it is misleading or linkbait" and you can argue that once a vulnerability is fixed, implying it's still there is misleading. So we often edit those titles to past tense once that's more accurate. Same with "$site is down" -> "$site was down".

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment></comment></comment><comment><USER14> Another nice thing about Grammarly is that the plugin just blindly detect contentEditable inputs and start screwing with their content. This very much breaks modern WYSIWYG web editors, which typically expect to have control over the editable content. Which more or less comes down to "move over page scripts, I'm a browser plugin, this is _my_ webpage now".

<comment><USER15> LastPass does this as well to input fields. Made it unusable for me. Haven't used a password manager since (was a couple of years ago). Has this problem been solved well recently?

<comment><USER16> I have been a 1Password user since ~2010 and never once has it ever made an input field or login form unusable for me. (I used LastPass briefly before, but vastly preferred 1Password's native apps and more secure architecture, which was completely validated when LastPass was hacked a few years later)

</comment></comment></comment><comment><USER17> I have no idea if it's still an issue, but ~1.5 years ago, I was sorting through my email, and discovered that a small plain text message was taking up >3MB in my inbox.

I dug in a bit, and it turns out that Grammarly was embedding a gigantic amount of code into the email messages in the form of stylesheets and other things.

Needless to say, after raising it up the chain, we had the extension blocked company-wide.

<comment><USER18> I uninstalled it a couple of years ago when I realized it was doubling the load times for every single page I visited. That embedded code is probably why.

</comment></comment><comment><USER19> Although as a non-native speaker I find their service very attractive, I've so far refrained from installing their apps/extension. I was never confident enough about how Grammarly would keep safe every word I type (emails,...). This bug is a confirmation I should not trust them or any similar service.

<comment><USER20> I tried it and my browsing exeprience was just terrible. It made Chrome so slow that there was a delay in typing and the character appearing. Haven't tried it again.

<comment><USER21> This was my experience as well. I don't know how anyone is able to use it; it brought my 2017 MacBook pro to its knees every time I would start writing a HN comment. I uninstalled it after about 5 minutes.

<comment><USER22> No issues with speed or anything, chromium, linux.

<comment><USER23> I had no speed issues here, either. Chrome, Windows and OSX.

That said, I removed it because the button in the lower right kept getting in the way of things like resizing the textarea.

</comment></comment></comment></comment></comment><comment><USER24> This, just like Mozilla's screenshot addon, and all the other examples, shows why it's an insane idea to mix addon content with the websites, and why it's important to make sure that addon content can run on the UI layer of the browser, and not within of the content of the sites.

Relying on "best practices" is always a security disaster waiting to happen, if you don't enforce security and separation in the design of the APIs and languages already, you won't get security.

<comment><USER25> > it's important to make sure that addon content can run on the UI layer of > the browser, and not within of the content of the sites

I don't get this thinking at all. Browser addons are trusted. That's the point - they have special privileges to adjust browser behaviour.

If you go around installing malicious addons, you get no more sympathy from me than if you'd gone around installing malicious kernel modules.

<comment><USER24> The problem is the opposite.

For example, Firefox' screenshot addon would inject HTML into the page, and then the page could take the screenshot's data and use it.

Addons currently have no way to reliably display their own UI on top of the page, without the page intercepting it.

<comment><USER25> Oh, right, I didn't get that from your original comment.

I agree, addons' workings shouldn't be exposed to untrusted websites.

</comment></comment></comment></comment><comment><USER26> I think Chrome's (and now Firefox') awkward extension sandboxing is partially to blame, though.

When you add an extension page script, you get access to a page's DOM, but you're completely isolated from the page's own JS: You get your own JS context and window object without any modifications the page may have done to it. That's usually reasonable as a page can mess with the built-in methods of its context, so if an extension were to rely on them, the risk of privilege escalation attacks would be really high.

Except sometimes an extension _does_ want to interact with the page JS, (e.g. for accessing data the page only keeps in JS objects but not in the DOM.)

As far as I know, there is no safe way to do this in Chrome. The recommended (!) way is to inject a script element into the DOM and exchange data with the page script via some makeshift communication channel, e.g. postMessaging yourself. This will of course drop you right back into the hall-of-mirrors of potentially manipulated builtins that the page script isolation was trying to keep you out of. But apparently now it's ok if you have to deal with that by yourself.

From the looks of it, it seems Grammarly tried to open exactly that kind of communication channel and didn't correctly secure it.

<comment><USER27> > I think Chrome's (and now Firefox')

Chrome and Firefox have _very_ different behaviors here.

In Chrome, there is no way at all to get hold of the page's JS objects.

In Firefox, the default behavior is that you don't interact with them, but you can explicitly ask for them and once you have them you can work with them. Depending on what you do with them, you may or may not be creating security bugs, of course.

Critically, in Firefox you can have your separate clean builtins _and_ be interacting with actual page JS objects at the same time.

There are arguments for and against both models, of course.

</comment></comment><comment> rwx</comment><comment> I never felt comfortable using SaaS for checking the grammatical mistakes. If you are linux user then "the language tool" is your best option.

[https://languagetool.org/](https://languagetool.org/)

you can download it and run it as stand alone application

<comment><USER28> Thanks for this suggestion. Unfortunately, LanguageTool failed to catch some basic errors, like subject-verb agreement. E.g.

      I'll close the ticket once the item have been completed.

</comment></comment><comment><USER29> What's the etiquette for disclosure timeline on something like this? It feels like 99.9999% of end users won't see this public disclosure, and waiting enough time for auto-updates to be applied would be ideal. Public disclosure as soon as the patch is available lets bad actors know about it while the vast majority of users are still vulnerable.

<comment><USER30> Project Zero is very aggressive about releasing exploit details as soon as a patch is available- they don't wait for users to actually have a chance to upgrade. This caused some drama when they were releasing vulnerabilities to password managers.

<comment><USER31> In the free software world, full disclosure when the fixed version is available is a normal practice. Partial diclosures are rather frowned upon.

</comment></comment></comment><comment><USER32> TL;DR: update your Grammarly plugins so that you get the fix to this issue.

<comment><USER33> Maybe I'll sound stupid, but is it possible to force an update of a chrome extension without removing it and then adding it again from the store? Is that application-specific?

thx!

<comment><USER34> Yes, after you enable Developer mode: [https://i.imgur.com/Uehu1As.gif](https://i.imgur.com/Uehu1As.gif)

</comment></comment></comment><comment><USER16> So… I of course had no specific idea about this, but in 2014(?) I declined recruiting pursuits from Grammarly after realizing that their developers were almost entirely managed from another hemisphere. It sounded like a very top- down, low-collaboration, anti-engineer environment. I am not at all surprised that major issues like this can and would occur in such an environment.

</comment><comment><USER35> I am waiting for the typical "CEO of Grammarly here. I will answer any questions you may have" comment, but I guess not.

<comment><USER36> Not everyone reads hackernews

<comment><USER2> I'm sure someone at that company does.

</comment></comment></comment><comment><USER37> Between this disclosure and grammarly.com, I've been trying to understand how Gramarly works, and therefore understand the impact of this event. Let me know if i got this right:

1) Grammarly is a fancy grammar/spelling correction tool.

2) You use it by opening an account, and installing their browder extension.

3) As you type text into a web page, the extension sends that input back to Grammarly, where their software analyzes it and provides correction recommendations.

4) The text that was sent back is persisted under your account, and is available for retrieval.

5) A software bug in their extension allowed a script on any site to see your Grammarly auth token.

6) As the result, any malicious site could log into your account, and see what you've been typing.

Is that the rough gist of it? If yes, then how in the world does #4 make any sense? Why store and expose that data, knowing that it's likely to contain troves and troves of sensitive and PII information...

</comment><comment><USER38> garmmarly perhaps ranks up there amongst the most annoying startup names.

</comment><comment><USER39> Kind of tangential, but does anyone else worry that systems like these will start to dictate what is "correct" language. Basically pushing narratives subtly through "correcting" totally acceptable speech.

<comment><USER40> Most people with any writing capability do not use these tools. They are for foreign speakers of English or extremely poorly educated native speakers, they only affect the bottom 50% of written content which is not what affects the development of language.

<comment><USER41> Um, I just wrote a lengthy comment about how this is not exactly the case: [https://news.ycombinator.com/item?id=16322795](https://news.ycombinator.com/item?id=16322795)

It's only mentioned in the comment, but the amount of mistakes in tech-related writing, by native English speakers and otherwise, is gargantuan and overwhelming, and I'd wish using something like Grammarly (if safe, open source and so on) was a requirement for putting your writing on the web.

As it is, the quality of writing is so bad, that I (as a foreign speaker) don't improve my English in any way by reading it, and I have to be very careful not to repeat these mistakes in my own writing later.

</comment></comment></comment><comment><USER42> The day I heard about Grammarly (saw a Youtube ad). Free to use, I thought to myself, this surely monetizes by analysing all my input in their servers, wherever they are.

It looks like a good product. If they offered a true offline version for desktop with 4+ updates a year, I could see myself paying for it.

</comment><comment><USER43> It doesn't say anything about token rotation and lifetime. Is there any information directly from Grammarly?

How long are those tokens valid for?

Did they invalidate all existing tokens?

</comment><comment><USER44> bit.ly had a similar vulnerability that I detected in 2008 through their bookmarklet. Unfortunately it seems I lost my exploit PoC. [https://eligrey.com/blog/bitly- vulnerabilities/](https://eligrey.com/blog/bitly-vulnerabilities/)

</comment><comment><USER45> I blocked Grammarly at my last company, nothing like giving a company tracking access to everything you type or read, and their EULA gives them the rights to everything they track.

Using Grammarly is stupid, paying them is downright insane.

<comment><USER4> We block extensions, period, on Google Chrome, as it prevents most malware outright. But then we've also discovered Grammarly's Microsoft Office plugin installs to the user folder (without requiring admin rights) as well. I've made a request to our antivirus vendor to add detection and blocking of Grammarly specifically, for the moment we're detecting it a different way.

<comment><USER46> May I ask how you're detecting it? If you can't say [or don't want to] for whatever reason that's fine, I'm merely curious is all.

<comment><USER4> We have a couple different layers we can work with here, both on the computers and the network.

<comment><USER47> He asked for a specific thing, and you answered with nothing at all.

<comment><USER48> What if GP was working for Grammarly and wanted to avoid detection?

<comment><USER46> I do not, but that's not an invalid concern.

</comment></comment></comment></comment></comment></comment></comment><comment><USER49> How did they fix it?

<comment><USER50> Should wait to see if data was compromised, they can fixed the extension though.

</comment></comment><comment><USER51> Are there any good open source grammar checkers for English? Spanish? German?

I recently loaded Wordperfect for Win3.1 into a Win3.1+Dosbox instance because I remember it's grammar checker back in the 90s was far superior to what's built into MS Word today. I've been meaning to test it out and do a comparison blog post.

<comment><USER52> There's LanguageTool, a wonderful open-source tool. I've only used it for English, but it supports a lot of languages. There's also addons for a lot of editors.

[https://languagetool.org/](https://languagetool.org/)

</comment></comment><comment><USER53> That's almost as pathetic as their "Lily the Social Media Manager" ad.

</comment><comment><USER54> Its not surprising what so ever, where's that ad money coming from? Must be shady practices.

<comment><USER55> They sell a "pro version" with extra features.</comment></comment>


05/11/01. When did u know you wanted to do  a startup? (for me..) - <AUTHOR> http://money.cnn.com/magazines/business2/business2_archive/2005/11/01/8362807/index.htm For me it was somewhere between reading that article and December of 2005. <comment><USER2> Geesh, you expect me to remember these things?

Sometime in November, 1995.

Actually, that's a little inaccurate. I had entertained ideas about being a professional shareware developer when I first learned Pascal - that was when I was 12, so about 1993. The November date in question was on the way to a WoCoMal math meet. One of my teammates asked our driver & math teacher "Are you a millionaire?", to which he replied, "No, the only millionaire on the faculty is John [one of the school founders, and another math teacher]. He founded and sold a company for like $40 million." That kinda planted the seed that yes, owning a business was achievable and it did happen to people like me.

It kinda grew into "I'm going to start my own startup" over time. I was writing a MUD at the time, and about a year into the project (which I eventually gave up on), I found out "Hey, people actually pay for games like this!" Then after high school, I worked for a tech startup founded by the aformentioned math teacher/school founder, and found I liked it. Then I took a long holiday from startup stuff while I was in college, though I did have primary implementation responsibility for a non-profit. Then I came back to it my senior year, because I realized "Oh shit, I have to get a job now" and realized how sucky most jobs were. Applied to SFP05, wasn't really ready for it, was rejected, took a job at another startup that I'd interned at instead. Then this year I started letting it be known that I was interested in starting a company, and got 3 overtures for cofounder positions within 8 months. Took the most promising, applied to YC for SFP07, was rejected, going ahead anyway, and we'll see about WFP08...

</comment><comment><USER3> When I realized that it's difficult to find places to work where you're not working for a f __king moron. I want to make cool things and work with people who don't suck. I don't really care if that means a startup, but things certainly seem to point in that direction.

</comment><comment><USER4> Around 1980.

</comment><comment><USER5> 12/22/2005

</comment><comment><USER6> 04/18/2007

<comment><AUTHOR> Is that the day they emailed me back that rejection.</comment></comment>


As Tether flails, cryptocurrency exchanges launch rival stablecoins - <AUTHOR> https://techcrunch.com/2018/10/25/as-tether-flails-cryptocurrency-exchanges-launch-rival-stablecoins/ <comment> T-A Speaking of the devil [1]:

The Riksbank's e-krona project proposes in its most recent report that the Riksbank should:

\+ Begin to design a technical solution for an e-krona in order to test which solutions are practicable and possible to realise

\+ Draw up proposals for legislative amendments needed to clarify the Riksbank's mandate and an e-krona's legal standing

\+ Continue investigating the financial aspects of an e-krona

[1] [https://www.riksbank.se/en-gb/payments-- cash/e-krona/](https://www.riksbank.se/en-gb/payments--cash/e-krona/)

</comment><comment><USER2> Claims of Tether failing are slightly exaggerated:

[https://coinmarketcap.com/currencies/tether/#charts](https://coinmarketcap.com/currencies/tether/#charts)

It was closer to failing in Apr 2017, dipping below 0.92$, while recently it only dipped below 0.96$. Perhaps it's somewhat worrying that it hasn't been above 1$ since Oct 11, but it's still managing to stay within a few percent.

<comment><USER3> Any drop past $1 longer than a few minutes indicates Tether isn't really backed by USD. Which is what the external evidence also shows (no audit, Tether terms explicitly say they are not redeemable for USD, etc)

</comment></comment><comment><USER4> Is there anyone that trusts there is a USD for every Tether without an audit?

</comment><comment><USER5> can a person short a stablecoin?</comment>


New video games bubble? - <AUTHOR> http://money.cnn.com/quote/shareholders/shareholders.html?symb=EA

<comment><AUTHOR> We missed the boat for the great gaming bubble of 1980s but maybe it's time for our own bubble. The game budgets are so high now that you have to sell hundreds of millions of copies just to break even.

Not to mention the Zynga IPO.

And there will be no bailing out of the games industry.</comment>


Python NLTK Sentiment Analysis with Text Classification Demo - <AUTHOR> http://text-processing.com/demo/sentiment#demo <comment><USER2> Worth mentioning:

Open source sentiment analysis library based on NLTK: <http://github.com/tawlk/synt>

(Trains on as much twitter data as you want to learn internet slang)

Simple gist to do basic sentiment analysis:

<https://gist.github.com/1266556>

</comment><comment><USER3> The NLTK python lib is a great tool. I've been playing around with this recently and having a lot of fun. More recently I started looking at SCOTUS oral transcripts:

[http://jarv.org/2012/02/a-text-analysis-of-supreme-court- ora...](http://jarv.org/2012/02/a-text-analysis-of-supreme-court-oral- arguments/)

The two articles here by the same author are interesting for folks who are interested in more about sentiment analysis

[http://streamhacker.com/2010/05/10/text-classification- senti...](http://streamhacker.com/2010/05/10/text-classification-sentiment- analysis-naive-bayes-classifier/) [http://streamhacker.com/2010/06/16/text- classification-senti...](http://streamhacker.com/2010/06/16/text- classification-sentiment-analysis-eliminate-low-information-features/)

</comment><comment><USER4> I wrote an article on use the NLTK library for gender prediction [http://stephenholiday.com/articles/2011/gender-prediction- wi...](http://stephenholiday.com/articles/2011/gender-prediction-with-python/)

It's quite a versatile library.

</comment><comment><USER5> <https://github.com/dotpot/Custom-String-Parser>

</comment><comment><USER6> Needs more cowbell. "Wasn't that a fucking great movie?" => 0.7 Negative sentiment.

<comment><USER7> "A better film has never been made. If this film was any better, it would simply cease to exist. Really, nothing about it could be improved. I have no complaints whatsoever about the acting, the script, or the cinematography. I was sad to see it end. I am going to go back tomorrow and watch it again."

1.0 Negative sentiment

<comment><USER6> WOW! That is unbelievable. Usually things get better with more tokens. What a broken library.

</comment></comment></comment><comment><USER8> "The movie was great"

Neg?</comment>


USPS backlog sparks worries that ballot delivery could be delayed in November - <AUTHOR> https://www.washingtonpost.com/politics/postal-service-backlog-sparks-worries-that-ballot-delivery-could-be-delayed-in-november/2020/07/30/cb19f1f4-d1d0-11ea-8d32-1ebf4e9d8e0d_story.html <comment><USER2> Better signup for early ballots.</comment>


Hulu, a Victim of Its Own Success? - <AUTHOR> http://www.wired.com/epicenter/2009/05/hulu-victim-success/

<comment><USER2> No it's a victim of an business model that's not willing to change. If anything, Hulu should be the evidence every single TV exec should hold up as the new way works.

Hulu's way may not be the only or best answer of "how does the new way work?" but it's certainly proof enough that the new way does work and the industry should start experimenting to find the best solution.

<comment><USER3> The problem cable companies have is their revenue is insane and they are used to it.

I am canceling Cable TV (with DVR and HDTV) service becasuse it's overpriced and I have slowly gotten to the point where my TV is on 1-2 hours a week, which is not worth 80$ a month. The sad thing is I would pay 5$ a hour for what littel TV I watch, but they don't have anything like that as an option.

When people who makes as much money as I do cancle their service because of poor value, they must see the end of the road. They don't procude the content, and while they are the middle men of chioce most people will move on to other things in time which will reduce their power with the people who create content. There was a time when TV could clame they where filtering out the junk which justified their posistion but 300+ channels killed that idea. So I expect thier only real option is to become an ISP or try and creat the next Hulu.

</comment></comment><comment><USER4> Eh, Hulu might be too ahead of the curve. e.g., they may get strangled by broadcast and cable TV before their (assuming they don't adapt) inevitable death.

I heard this on NPR yesterday -[http://www.npr.org/templates/story/story.php?storyId=1040594...](http://www.npr.org/templates/story/story.php?storyId=104059403) . It pointed out that DVR is decreasing the value of a Thursday night ad slot, since if people watch a Thursday night show on Sunday (after the weekend plans have been made), why should ad execs pony up for the prime time ads? Obviously Hulu can play ads during a certain time period, irrespective of shows, so this doesn't hurt them.

Overall, cable and broadcast TV are not sustainable in their current form. My guess is that they'll eventually go to a la carte style subscriptions at the last moment to avoid completely going under, and not a moment sooner.

<comment><USER5> Offering video on the web opens up so many more options then the current methods, and many more revenue models. As you mentioned, the ads can be updated to be the most current since the video is being streamed right then and there.

On top of that, the networks can easily have more targeted and relevant ads. They can track all of the shows people are watching, and know exactly how many people are watching them. There are additional hooks for people to discover new shows.

You can have different subscription models, with the free version allowing people to watch only the most current episodes, then being able to pay additional to see all of the previous episodes and seasons. People can pay to not have advertising if they want. Plus any other combination or other pricing models that you can think of can be used.

In exchange for giving up control, they would gain an incredible amount of flexibility on how the content is priced and used. They are crazy for not moving ahead with this with the amount of money they could make off of this.

*Edit:Grammar fixes

</comment></comment><comment><USER6> The "off to the torrents" message doesn't mean much to the industry. They'd rather have 2x viewers on legal, revenue-generating sites and 5x viewers on torrents than have 10x users on legal, non-revenue-generating sites. They want to maximize their paying customers and don't give a damn about non-paying customers. (Only on the web would this seem naive.)

<comment><USER7> Hulu customers _are_ paying customers, and it _is_ a revenue-generating site. They watch ads. Now, they aren't anywhere near as much "paying" as someone watching the same show on a conventional channel (who also pay by watching ads), but they are not freeloaders, either. Hulu customers could already have been torrenting, but preferred the Hulu experience, even with ads.

I make no further inferences, other than to point that out. (I would point out that it doesn't seem feasible to make a show directly for Hulu, for the ad rates they get, vs. the obvious feasibility of making a show for a conventional channel.)

</comment></comment><comment><USER8> As lame as it sounds, I would be supremely happy to be a victim of success like that</comment>


DMCA exemption for repairs, modifications, research on your vehicle takes effect - <AUTHOR> http://ifixit.org/blog/8510/car-repair-illegal-dmca/ <comment><USER2> I haven't kept track, but last time I read about it, DMCA lobbyists managed to get a pretty absurd restriction into the exemption: Cars may only be repaired by their _owners_ , so handing your car over to a repairman or to researchers would still be illegal.

This means in practice the excemption would only change things for people who are both highly skilled in the relevant technology and are interested in fixing their _own_ cars - a very small subset of the initial group of people affected by the DMCA restrictions.

Does anyone know if that restriction is still present?

<comment><USER3> Could you temporarily transfer the ownership to the garage? Absurd indeed

<comment><USER4> If the common law fundamentalists are to be believed regarding "title" versus "manufacturer's certificate of origin", you aren't even actually the owner of "your" car.

<comment><USER5> What's the deal with that? Do the car companies try to say that you are only licensing the car (just like software companies only sell you a license, not actually software you can own)?

<comment><USER4> The issue isn't with the manufacturers, but the state. I can't do it justice and the whole subject is a bit crackpotty, so you're going to have to read up on your own. For example - Rights vs Privileges by Michael Badnarik.

I say "common law fundamentalists" because there is a whole community of people who have ran with these ideas and believe that the key to restoring their rights is just asserting them harder. While it would be great if true, I don't subscribe to this view and think it's much healthier to view such legal reasoning as explanations of exactly how things decayed to the point we're at.

<comment><USER5> Oh, are you referring to the freemen of the land and similar?

</comment></comment></comment></comment></comment></comment><comment><USER6> This is great news. It is alarming to realize that a majority of devices built after 2020 will be connected to the internet without the choice for us to vet their security. Securing these devices must be a proactive endeavor.

<comment><USER7> Only if you buy them.

<comment><USER8> They will be built into infrastructure (including up to your property line), building structure, & appliances. I suppose one can go to a wood cabin in the woods, off grid (unless that sort of lifestyle flags you as "radical").

</comment></comment></comment><comment><USER9> There is going to be a huge market in refurbished, older non-computerized machinery and automobiles.

With farm and heavy equipment, this tends to be true already, since it is effectively indestructible, as the depreciation is significant, while the costs to replace with a brand-new model is astronomical, and so stuff gets rebuilt, welded up, patched up, and reused until it is completely kaput, often decades after it was built.

Automobiles are trickier, especially if you are in an area that gets snow and uses a lot of salt in the winters, since the bodywork rots out quickly, much faster than the expensive mechanical components, like the engine and tranny, wear out.

<comment><USER7> Non computerized automobiles are those before fuel injection became common, which dates back to the early 80's. One option would be anything with mechanical diesel injection pumps, but those will at some point be harder to get past emissions inspection.

Keeping a car that old on the road is going to be tricky, the engines do wear out at some point and bodies will go faster depending on the climate. Anything from that era will soon be a classic with associated spare parts prices.

Tractors from the 1940's still run pretty good though, there's plenty of them and they were built to last.

<comment><USER10> There are different levels of 'computerised', though. An early 90s car with EFI and ABS does have some processors in it, but they're standard modules (so can just plug a new one in if one fails) running from EPROM and have very limited communication. Unless you're worried about it being EMP-proof, that's not really a problem.

Modern cars where everything is controlled by a central internet-connected computer are a whole different proposition.

<comment><USER11> > Modern cars where everything is controlled by a central internet-connected > computer are a whole different proposition.

Are cars really built this way? I thought they were still basically a network of devices, for safety reasons.

<comment><USER10> I believe it's moving more in that direction - reading the teardown of the Toyota code in the unintended acceleration case, that one system seemed to be running a whole bunch of unrelated stuff as well as reading the accelerator pedal. Also witness the numerous reports recently of people being able to affect various critical subsystems (ABS, central locking) wirelessly on modern cars.

(I'd be amazed/horrified if ABS _wasn 't_ an independent module which talks to the rest of the car, but if you can give it instructions over the wire then it's still vulnerable.)

</comment></comment></comment></comment></comment><comment><USER12> ObQuote: "If a law is unjust, a man is not only right to disobey it, he is obligated to do so." \-- Thomas Jefferson

<comment><USER13> Well, this is common rule for russia - disobeying stupid laws, but, believe me, you don't want this. In such conditions everything is simple - you are always guilty.

<comment><USER12> I certainly didn't want this, but it seems we've had it for some time now. And I see no reason to celebrate winning back a small, limited exception from an unjust law that should never have existed.

</comment></comment></comment><comment><USER14> woo!

right to repair is something I never want to go away. I'm thankful for these kinds of organizations fighting a battle that I can't.

the least I can offer is a good shout of approval!

<comment><USER15> and a donation to EFF ;)

</comment></comment><comment><USER16> How did the DMCA ever get passed? It's an absolutely insane, ludicrous set of laws.

I'm going to start selling shirts that say "Today I Broke The DMCA". No matter who wears it, it's probably true.

<comment><USER17> It's the aftermath from inventing intellectual property. Patents were once called monopolies. What I find amusing is, you get this staunchly anti- government/libertarians who are also incredibly pro-IP. And yet IP is all based on governments granting monopoly power over ideas, with violations enabling the owner to engage in all kinds of punative behavior with the government as the strong arm. Ironic.

I think there's something valid about a government protected temporary monopoly. But in the case of copyright, for example, it's life plus 70 or more years. It is ridiculous, as in, worthy of ridicule. Medical patents are 20 years, which itself is too long, but it's made worse by rather permissive ways in which they can be effectively renewed by barely changing the medicine.

You know what it is? It's a way to get white collar work to continue to pay out more than, and longer than, the actual amount and duration of work on a thing takes. It's an incentive to do that kind of work. But I agree that it's grossly lopsided when you can't do repair or research on that same material - that's one of the original points of patent and copyright law. Put your ideas on paper so that you not only get protection for a while, but others can create derivatives that are better, and thereby we learn more about it all.

<comment><USER18> To be fair, most forms of property come from government-granted rights. The very idea that you can own _land_ is kind of weird when you think about it.

<comment><USER19> It's not really weird when you think about ownership just being a bunch of people agreeing to mess up anyone that tries to take something you've claimed. It takes a lot of work to maintain such an agreement, so people have to be compensated for it. If they aren't compensated to their liking, they'll take that thing and maybe other things you've claimed and maybe ruff you up for good measure.

<comment><USER20> "A bunch of people agreeing" is what a government is?

<comment><USER21> Almost. A governments is a bunch of people agreeing plus the power of those people to punish those who do not agree, without being punished back.

<comment><USER20> I'd argue the "power to punish without being punished back" stems from "being a bunch of people that agree" \- ie: a bigger bunch of people than any one sub-group they might want to punish for being in disagreement.

Then there's the shift in power that comes from control over weapons and infrastructure ... but AFAIK the _coordinated_ masses still have power on their side - partly from the assumption that given enough "external" disagreement, some people on the inside are likely to cross over.

Indeed, one could argue that the most terrifying part about the Snowden disclosures on mass surveillance, is that the current government is poised to deploy counter-measures long before any opposition consolidates and organizes. This might take the form of buying out individuals - or "dissappearing" or taking out individuals that are perceived to be in the process of becoming important.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> One thing that I thought was funny about the hackers remotely hacking the Jeep, is that after the article was published and posted here, an HN user went on and reported them to them to High Way patrol.

[https://news.ycombinator.com/item?id=9921987](https://news.ycombinator.com/item?id=9921987)

<comment><USER23> And the HN user that reported them did the right thing IMO. Ethical research is a thing.

The user reported them to hi-po not because they were 'hacking', but because they intentionally created a dangerous situation on a highway by stalling a car, which could have gotten multiple people killed.

It's similar to the guy that decided to connect to the turbofan with his laptop on a populated passenger airplane _in flight_.

<comment><USER24> > It's similar to the guy that decided to connect to the turbofan with his > laptop on a populated passenger airplane in flight.

Link?

<comment><USER25> Wired published a relatively lengthy article on the incident(s):

[https://www.wired.com/2015/05/feds-say-banned-researcher- com...](https://www.wired.com/2015/05/feds-say-banned-researcher-commandeered- plane/)

</comment></comment></comment></comment><comment><USER26> Is this like a non-profit wing / initiative of the ifixit.com company?

<comment><USER27> iFixit is a social mission driven company. Just about everything we've done over the last ten years has been to expand the right to repair and make it possible for everyone to fix every thing they own.

But there are a whole lot of other organizations also interested in making repair more legal and affordable, and they wanted to start contributing time and funds. So we started Repair.org with them. There's a bunch of awesome organizations involved — ISRI (the recycling association), IAMERS (the medical device repair association), EFF, and a bunch more.

[http://repair.org](http://repair.org)

<comment><USER26> Thanks so much for taking the time to clarify!

</comment></comment></comment><comment><USER28> before DMCA - "whatever is not prohibited is permitted", in the DMCA world - "whatever is not permitted is prohibited". New generations wouldn't even know it the other way.

</comment><comment><USER29> Why just cars? I'd like to be able to "repair" my printer when it runs out of ink.

</comment><comment><USER30> And what is going to happen after three years of freedom? Back to jail again?

</comment><comment><USER31> I was under the impression that only the distribution of any changes you make including the original code would be unlawful in this regard. Can someone clarify?

<comment><USER32> You are 'circumventing copyright protections' by changing the code. Something somewhere in these systems is supposed to stop 'tampering' avoiding that breaks the DMCA just like breaking the DVD encoding broke it.

</comment></comment><comment><USER33> "No user serviceable parts inside"

</comment><comment><USER34> I don't get how it was illegal before since reverse engineering was always legal [1]. What is the difference with DMCA?

[1] [https://en.wikipedia.org/wiki/Reverse_engineering#Legality](https://en.wikipedia.org/wiki/Reverse_engineering#Legality)

<comment><USER35> The DMCA only allows reverse engineering for a very narrow "interoperability" purpose. "I wanted to fix my car" isn't "I wanted to achieve interoperability with something else", so it was illegal.

</comment></comment><comment><USER32> Won't this just lead to manufactures using better crypto to lock us out from changing things?

I mean, secureboot-like practices can be pretty effective at preventing modifications. They can also be sold as 'security' rather than 'fuck you we want as much control as possible'.

</comment><comment><USER36> Only the wise men in congress would say "being able to fix your own car is a great idea, so we're going to allow that - for three years"

</comment><comment><USER37> There needs to be a stronger push to completely repeal DMCA 1201.

</comment><comment><USER38> If something like the DMCA was illegal, it would make sense.

</comment><comment><USER39> The power of DMCA is only because of Google. The day we find an alternative to this great search engine of our times, DMCA will render itself toothless.

<comment><USER40> I fail to see how you think Google is responsible for the DMCA power. Google fought against acts like SOPA because it would have seriously hurt their business. The real people pushing DMCA power are Sony, RIAA, Warner Bros, and the entertainment industry who have the most to lose when it comes to this issue.

<comment><USER39> Then why do they remove the results from their so-called organic search based on DMCA requests?

I can also understand if the results are removed just from the USA based (google.com) site, but they are also removed from google.co.uk, google.co.in, etc. Since US Govt. has no jurisdiction over these other countries, I think its improper to apply DMCA blacklisting over there.

<comment><USER41> How does that equate to google search results being the only reason the DMCA has teeth? Do you think they're funding Jon Deere's legal team?

</comment></comment></comment></comment><comment><USER42> For those who don't take the time to read the (short) article, here's the most important part (IMO):

>The downside: In 2018, advocates will have to ask for permission to repair their cars again—a daunting process that costs a massive amount of time, effort, and legal fees.

>But we're trying to change that. Yesterday, iFixit and Repair.org submitted comments to the Copyright Office in support of carving out a permanent exemption for all repair and security research—for cars and everything else. Hopefully, fixing your tractor or hunting for security vulnerabilities in your car won't be a jailable offence ever again.

>If you want to help make the world safe for repair, join Repair.org—they're on the front lines every day, fighting for your right to fix everything you own.

<comment><USER43> In the spirit of hyperlinks, [https://repair.org](https://repair.org)

</comment></comment><comment><USER44> This applies to my computer as well. I use it to drive on the information superhighway.</comment>


The Open Source Data Science Masters - <AUTHOR> http://datasciencemasters.org/ <comment><USER2> Like many people here have mentioned, mastering everything can take far too long, and is completely unnecessary in practice.

It is much, much more important to master the foundations, which consist of: 1) Probability and statistics 2) Linear algebra, and 3) Programming proficiency

To be more precise here is what you would need to know in each area:

1) Probability and stats: Properties of the most common distributions (Normal, Poisson, Exponential), conditional probability, properties of expectation, Bayes rule and its applications, hypothesis testing, confidence intervals, bootstrap / jackknife, know how to compute the power of a test, be able to run Monte Carlo simulations to model real world phenomena.

2\. Linear Algebra: Know enough to understand and compute Eigenvalues / Eigenvectors, SVD and various matrix factorizations.

3\. Programming proficiency: Algorithms and design patterns. Its enough to know the typical undergraduate algorithms course content: trees, heaps, hash tables, various sorting algorithms, graph algorithms: shortest paths, spanning trees, max flows.

If you know this, you can easily pickup everything else on a need-to-know basis. Depending on the domain you are working in, that might entail either natural language processing, computer vision, machine learning or big-data tools like Hadoop / Spark etc. All of that is very easy to learn once you have the foundations.

<comment><USER3> One thing I think you are missing here is

4) Elements of numerical analysis

Under standing how matrix inversion works on paper is very different than a computer implementation. If you don't understand how floating point really works, you are bound to make fundamental errors in this kind of work, etc.

<comment><USER4> Are most people doing data analysis actually going to be implementing their own numerical algorithms though? I'd imagine most people just use whatever library is available in R, Python, or whatever other language they're using.

<comment><USER5> It's important having at least a basic knowledge to avoid common, really stupid pitfalls that libraries can't handle out of the box but humans can (i.e. non-interpolable functions, small number division...)

</comment></comment></comment></comment><comment><USER6> Here's the problem with stuff like this. If you actually learn all the stuff that is listed it will take you at least 3 years if not more. All the subjects listed require prolonged study if you want them to become part of your intellectual repertoire and then it takes some more time until you are comfortable applying that knowledge in non-trivial settings. On top of all that you have to stay motivated to consistently study and make progress alongside whatever else you are doing for your day job.

I program every day and I'm been studying parsers, virtual machines, and compilers for some time now and it still requires hard work to not fall back on bad habits. It takes even more effort to consistently apply techniques I learned while studying those subjects in day to day programming. There is no royal road.

<comment><USER7> It's worthwhile to explain why many people find the OSDSM useful.

The topics listed do indeed require depth to acquire an adequate proficiency to understand and command them. The OSDSM is most useful for people who don't know where to _start_ , which is often the hardest part. The hardest things are often the most trivial in hindsight.

Typical interaction:

Q: I want to be a Data Scientist. What do you think I should study first?

A: Build a basic proficiency in linear algebra, programming in python, and statistics. Then take cursory classes in the subjects in the OSDSM that interest you. You'll figure out what depth is most meaningful to you from there.

Q: What does a Data Scientist actually need to know?

A: Totally and completely depends on what you want to do. There are people who crunch click logs all day, people who comb the tendrils of search algorithms, and yet others who seek terrorists and criminals in statistical signs among the bits and bytes. See my last answer for relevant guidance.

e.g. [https://medium.com/@clarecorthell/the-brief-multi-tweet- enum...](https://medium.com/@clarecorthell/the-brief-multi-tweet-enumeration- of-job-titles-encompassed-by-data-science-8d48a988e3a1)

<comment><USER6> In that case I have some feedback. As a beginner I still don't know where to start after reading your post. There are 101* bullet points in your post distributed among IDEs, books, online courses, libraries (the programming kind not the book kind), programming languages, pure math, applied math, database theory, machine learning, natural language processing, visualization, etc. and there is no obvious ordering on how hard or easy things are because the very first link in the math section is another list of bullets tackling some heavy- duty mathematics and I say this as someone who studied mathematics at a graduate school level.

Expanding mailshanx's answer will be much more helpful to beginners than the current 101 bullet points.

*I just counted the bullet points with document.querySelectorAll('li') so there are some false positives.

<comment><USER7> Start here: [http://bit.ly/uwintrodatascience](http://bit.ly/uwintrodatascience). It's the first bullet.

</comment></comment></comment></comment><comment><USER8> Here's my personal list for those interested, inspired by the Data Science Masters: [http://danielcompton.net/2014/03/23/data-science- curriculum](http://danielcompton.net/2014/03/23/data-science-curriculum)

</comment><comment><USER9> The field of Data Science is so wide and there are many techniques. How do you decide on what to specialize since you don't know which techniques are going to be needed to solve your next problem?

<comment><USER7> The truthful meta-answer which you probably don't want to hear: We only have a statistical likelihood (of dubious confidence) of what will transpire in the future. We have no knowledge of the future. None. Same is true of your knowledge of your future problems. Use some basic bayesian logic and guess in an educated manner, like with most prediction problems.

More practical advices: Find out what problems you're interested in working on, then google, read books, engage people working on those problems to tell you more about how they solve them. Another great place to start is to look at your business' biggest inefficiencies and informational gaps, and determine which of them could potentially be addressed with prediction or statistical inference. This used to be called Business Intelligence. Even a coffee shop can benefit from understanding simple seasonality.

</comment></comment><comment><USER10> The list of Python libs is very helpful. Thanks for putting this together.

</comment><comment><USER7> I'm curious about the audience here -

What career goal is driving your interest in learning Data Science?

<comment><USER11> It's more of a response to the market. Beginning about 5 years ago I was increasingly asked to do more numerically oriented things. Prior to that I was mostly writing applications that generated SQL and wrapped the results in some HTML. Pretty boring. Data science is more compelling.

Over the past 15-20 years there has been a massive amount of information piling up in databases and log files; not just from web applications but from desktop and mobile apps too. And there are companies who want to pan for gold in that data. So if you want to do something more interesting than fiddle with canvases, or CSS or MVC frameworks, then data science is fairly accessible if you're not afraid of math. Furthermore, most companies will have a need for it even if you don't really care to develop their software products directly.

NB: I doubled my salary by moving into data science. Nowadays gas station attendants can write a Rails app to search a database. The bar has been lowered. Understanding stochastic gradient descent (among other things) and knowing where/when to use it commands more earning power.

<comment><USER12> "I was mostly writing applications that generated SQL and wrapped the results in some HTML. Pretty boring." \- This is basically why I'm interested in making the move (eventually). Earning power may turn out to be a perk but the main motivation is something that is perpetually stimulating.

</comment></comment></comment><comment><USER13> how does someone who has a responsibility and dependents keep up with the time to learn all this stuff? time is of the essence.

<comment><USER7> I took six months off for the OSDSM. I am very aware that it was a luxury to do so. I had to take loans, move out of my apartment, and I studied 10 hours per day.

If you weren't working 10 hours per day, 6 days per week for six months (1440 hrs), and you took 6 hours per week to do the same, it would take you more than 4 years to finish a similar curriculum.

Managing your time is still the hardest part of self-study. It always will be. Most people pay institutions to structure their lives with a workload, deadlines, time off, expectations, and consequences (positive and negative). Having the time for self-study is a luxury few people have; most people won't have the time, money, and opportunity to give up for a "classic liberal education," and by extension they won't have time for self-study, either (one such conversation on the topic: [http://www.newyorker.com/culture/culture- desk/loud-nathan-he...](http://www.newyorker.com/culture/culture-desk/loud- nathan-heller-joshua-rothman-elite-colleges)). That's part of why new forms of education like The OSDSM are so necessary. Such curriculums fit exceptional cases that are less and less the exception.

</comment></comment><comment><USER14> Is there something similar but for a CS degree?

<comment><USER7> Try CodeAcademy and CS106a (how I learned programming at Stanford) [https://www.udemy.com/cs-106a-programming- methodology](https://www.udemy.com/cs-106a-programming-methodology)

I've started cataloging some of the best beginning resources here. Main benefit is that people can battle out what the best resources are in PRs. [https://github.com/datasciencemasters/go/blob/master/basic-p...](https://github.com/datasciencemasters/go/blob/master/basic- programming.md)

</comment></comment><comment><USER15> Thank you for putting this together, looks like a great collection of resources.

</comment><comment><USER16> no ggplot under visualization - what's up with that ?

<comment><USER7> You'll find R resources here: [https://github.com/datasciencemasters/go/blob/master/r-resou...](https://github.com/datasciencemasters/go/blob/master/r-resources.md)

The OSDSM maintains a focus on python resources.</comment></comment>


Hearts and Stomachs: Upton Sinclair's "The Jungle" - <AUTHOR> https://www.wilsonquarterly.com/quarterly/who-writes-the-rules/hearts-and-stomachs/ <comment><USER2> Today we have "ag gag" laws that work to stifle speech that alerts citizens to issues related to the provenance of their food. To my eye, such laws are blatantly unconstitutional--but many blatantly unconstitutional things are routinely allowed in the service of Capital these days.

</comment><comment><USER3> As an aside, Upton Sinclair wrote a book on fasting that presages a lot of our current interest and knowledge on the subject. Worth a look.

</comment><comment><USER4> Odd that The Jungle is mentioned here. Does everyone realize that the US isn't doing any inspections of any food facilities any more?

<comment><USER5> Where are you getting this information? Can you provide a source?

<comment><USER5> I personally found this on google: [https://www.eater.com/2020/3/23/21191632/fda-routine-food- su...](https://www.eater.com/2020/3/23/21191632/fda-routine-food-surveillance- inspections-suspended-coronavirus-covid-19-pandemic)

I'm not sure it's what you're referring to. This seems coronavirus specific. From the original comment I thought that inspections were suspended indefinitely.

</comment></comment></comment><comment><USER6> I read this in school and I am amazed how it stuck with me. The imagery of the factory, the workers, etc.

<comment><USER7> Sinclair had an amazing economy of words. He could describe a scene so well in so few words, and simply.

</comment></comment><comment><USER8> My favorite "fun" fact about The Jungle was that Sinclair originally meant the book to expose the working conditions of the meat packing plants, but instead everyone focused on the way the meat was processed and got up in arms about that instead. He apparently also had to tone down some of the book's more socialist leanings before being allowed to publish it.

Source: [https://en.wikipedia.org/wiki/The_Jungle](https://en.wikipedia.org/wiki/The_Jungle)

<comment><USER9> He said himself I believe "I was aiming for their hearts, but missed at hot their stomach"

<comment><USER10> Which is why the article is titled "Hearts and Stomachs". These fun facts are the point of TFA!</comment></comment></comment>


Show HN: Eskéndereyya – Learn how to read and write Arabic - <AUTHOR> https://github.com/samihasan/eskendereyya <comment><USER2> I'm going to be a sour horse, and I apologize, because it looks like much effort went into this project.

Is this meant as a romanization method, such as ローマ字ーー> 'romaji/roumaji' or as a way to have "more correct" pronunciation for learners?

I hold a firm belief that romanization is terrible for learning a language. It is counter productive (less inclination to learn the proper writing system(s)), leads to incorrect pronunciations more often than not, and there are always competing standards - so two people may learn two different ways to romanize a word, which can be a problem for homophones.

To at least try and give _some_ constructive feedback, use of IPA [0] would be beneficial for reinforcing pronunciations.

[0] [https://en.wikipedia.org/wiki/International_Phonetic_Alphabe...](https://en.wikipedia.org/wiki/International_Phonetic_Alphabet)

<comment><AUTHOR> Hi Nadya,

Thanks for your feedback.

I am not really familiar with romanization schemes of the Japanese language. So, I can't really comment on the specific point you raised but I'm familiar with other schemes of Arabic and most are lacking or cumbersome to use esp. for beginners.

The raison d'etre for my project is bridging the gap that Arabic learners esp. beginners face when they explore the language and how's mastering Arabic script whether in reading or writing is asking too much from them at that stage and how's that affects their learning journey very negatively.

This learning curve is just too steep for them and I really wanted to help them to make the first steps to learn the language without the unneeded complexity and like I said on the introduction part, Arabic script is not going anywhere and they have to get acquainted with it very closely if they are serious about learning the language but too early in my opinion could be counter-productive for them.

Eskéndereyya is not a substitute or competitor for IPA or any other fully- featured pronunciation or romanization system. Like I said in the "Design Philosophy", it has "just enough" academic rigor to get the job done. For people who want more academic rigor and comprehensiveness, they're advised to check other systems for review.

</comment></comment><comment><USER3> I spent a stint learning Arabic and I think learning the alphabet is the easy part. Learning the grammar and building working vocab is harder. I think learning the Arabic alphabet makes it easier to pick up Arabic. It has the beautiful property that is a phonetic language so no guessing how to pronounce words one the alphabet is learned

<comment><AUTHOR> Hi,

Have you completed the whole guide?

Eskéndereyya doesn't only support MSA but other regional derivative languages/dialects like Egyptian and Syrian Arabic. Also, it would be a good idea to refresh your memory and test your knowledge of the language.

I agree with you that the Arabic script is and will always be better for writing Arabic texts but this writing system was developed to fill the gap for beginners and as a stepping stone to the full experience of learning Arabic.

</comment></comment><comment><AUTHOR> Hi,

This is Sami. I developed this comprehensive writing system of Arabic in Latin alphabet to help Arabic learners esp. beginners to improve their reading and writing skills in Arabic without the immediate need to be familiar with the Arabic script.

Please try it out and let me know what you think in the comments below.

Looking forward to your valuable feedback.</comment>


Firefox3 has too many bugs - 80% of 700 bugs marked as blockers will not be fixed in Firefox3 - <AUTHOR> http://www.techworld.com/applications/news/index.cfm?newsid=10655 <comment><USER2> It's still better than Firefox 2, I can't go back.</comment>


Body Language Trainer (63 cards) - <AUTHOR> http://sonamics.com/en/ <comment><USER2> I have trouble with these kinds of interpretations... The "If X then Y" style of presentation is probably helpful for some people, but it can ignore a lot of the context. There is no disclaimer, or anything to clue you in to when these don't apply.

For example, "The Scribbler", The Trainer says: "The person doodles or draws without a particular goal. Boredom - The person has no interest in the current topic or has tuned out completely. 'I would like to do something else now.'"

I'm a very visual person, and sometimes I scribble or doodle to help me think. It's actually because I'm more interested in something, and I want to explore (visually) some of the ideas around the topic. It helps me to relax and be more creative.

I could also see this being a poor interpretation in, for example, a design firm, or with a visual artist. It's true, they could be bored, but that isn't always the only interpretation.

Also, I see "The Patrolman" can also be a sign of insecurity, a way of minimizing space or being non-offensive. "The Eye Wiper" might just be because the persons contacts are bugging them, or maybe some medication is drying out their eyes. So there is a lot of room for interpretation that the article misses.

<comment><AUTHOR> You are right. Body language can (and should) always interpreted with the context in mind. What we did was to describe the case which fits 90% of the time – without blurring the cards with exception disclaimers (e.g. this person may also be on medication for his/her eyes or a tiny fly just poked the eye).

We will start writing a little intro to the cards: context is important and there are always exceptions to the rule.

Thanks for the input.</comment></comment>


Ask HN:  How to create a decentralized insurance system a la bitcoin? - <AUTHOR>

How could one create a decentralized disruptive health insurance system a la bitcoin?
I have a general idea for it as a protocol that would track insurance pools with limited terms and risk factors.  Each pool would consist of diversified risk profiles and of course it couldn't be anonymous if payout and risk factors were to be attributable.  The advantage I could see immediately is instead of the excess pool money going towards profits it could be distributed to all pools equally.  This ensures increased overall value the longer the system stays active.  It is similar in nature to a life mutual but different in several ways.
The main issues I would like to get my head around are two fold:  1) How do you distribute benefits? This could either be by consensus or formula or value of the account (so its zero sum).  2) Coming up with a programmatic way to devise pools.  This is probably the biggest problem because from my understanding insurance companies use actuaries and massively complex formulas to do this work now.
I know there are economic and pragmatic issues that may make this unfeasible but I thought I'd throw it out to the brains on here and see if there was any reasonable way to achieve such a thing.  It would certainly be great to make insurance more efficient, less centralized, and hopefully more affordable.
Disruptive technology, solving all the developed world's ills. <comment><USER2> I apologize if this post comes out sounding very negative, but "Insurance" is susceptible to negative Black Swans.

[http://specialtyinsurance.typepad.com/specialty_insurance_bl...](http://specialtyinsurance.typepad.com/specialty_insurance_blog/2009/06/black- swan-theory-in-insurance.html)

Any algorithm you come up with will eventually meet a large sigma event and destroy your system unless it includes a whole lot of exclusions, or inversely unless it covers only very specific events.

Tackling Health seems daunting to me, maybe start with some kind of property insurance (computer insurance against theft/damage?)

</comment><comment><USER3> The canonical problem of health insurance is not profit making, it's that most of the people who contribute have to be excluded from receiving benefits. Not sure how a distributed model is going to do a better job at that than current models.

Bitcoin is trying to solve a mathematical problem (double spending), you're talking about a problem that in my opinion doesn't have a mathematical solution.</comment>


Interesting Resume Design - <AUTHOR> http://peterjwagoner.com/about-2/

<comment><USER2> "Interesting", maybe... Good? I don't think so.

What does this guy do? Scanning it, all I managed to get what that he builds electric bikes and other nerdy things. Spending more time, I finally learned that he's a copywriter.

This does not inspire confidence.

If this were to pass my desk, I would likely not take it seriously. (Granted, I look at developer resumes, so that matters, some.)

</comment><comment><USER3> What wccrawford said. No idea what this guy does.

Also, it's an artifacted image, which is probably the worst delivery method considering 95% of the content is text.

</comment><comment><USER4> to be fair, I don't see him mention it as a resume, the poster did. He just has it as "about", which it is.</comment>


Ask HN: Does my co-founder need to quit his job before we seek seed money? - <AUTHOR>

Is it common for seed funds (like Kima15 for example) to expect co-founders to have quit their jobs before being approached? Or is there another way to do it that lets the fund commit to investing but on condition that the deal only closes once the co-founders have quit their existing jobs and come on board full time (with say a fixed time period for this to happen within e.g. 45 days)?<p>In my case, my co-founder wants to come on board full time but can't afford to quit his senior position at an existing well funded start-up until I have at least some guarantee that I can get a seed round together. <comment><USER2> It really depends. Generally, once big money is involved (500k ), you should both be full time.

I totally understand where you're coming from. Full-time co-founder here with my counterpart having a full time job (a resident physician at that!). It's tough but it works somehow especially since we are at the seed stage. But once we start raising real money (1M ) there's no way he'll be able to continue IMO. It can work but it's best if everyone is full-time.

I do know of a company with a co-founder who is also a resident physician and they just raised $3M. So there's a real-world example of it working out. And being a resident physician at a top-2 school is a much more difficult position to drop out of - there's no going back.

Most investors will ask for 100% time commitments but if you spread responsibility it can work (like the above scenario).

What matters most is: are you guys getting shit done? Are you making forward progress? Things can always be better and more efficient but if you're moving forward - keep moving.

You'll know when you need to propose the ultimatum to your co-founder. If there's money on the table and he has to quit, it's easier vs. the assumption (risk) of money being there.

Finally - add a few more players to your team. Offset the work to great people. It will not only make you more efficient but will show investors that people want to work with you. And they're committed to your product without having real cash flow. As a CEO, one of the most exciting things is getting great people to work with you. It's a great feeling and proves leadership. And some good 'ole fashion convincing. Good luck.

<comment><AUTHOR> Thanks. So I guess it can be done under the right circumstances.

>What matters most is: are you guys getting shit done?

Shit is most definitely getting done. A fully functioning MVP will be up and running in January and my co-founder is ready to quit his job and join immediately if we get a seed round in place.

I've also got a third guy who's great at what he does and is ready to be our first hire (again, once we have some seed money available).

Also, in terms of the size of the seed round we'd seek, it's going to be a lot closer to $150K than $500K.

</comment></comment><comment><USER3> Are you full time yourself? I'm by no means an expert but I was under the impression that at the seed stage, they expect at least one of you to be full time. You might need a very good answer though, to the question of "how do you expect me to believe in you if you don't". (That question probably goes unspoken often, so if you have a better answer to it than they will expect, you might want to answer it before they ask.)

I've upvoted you, I'm NOT speaking from first hand experience so I really hope someone with more experience can give better advice. Good luck!

<comment><AUTHOR> I was hoping for a few replies as well as I'm really struggling to find anyone in a similar position that's gone through it. To answer your question, yes, I'm full time and have been working on it for almost 18 months. Bootstrapped with all my savings and some family money.

</comment></comment><comment><USER4> It's a fairly strong negative signal. Convince your cofounder to quit his job and convince him that you will definitely get funding. It will be a good test of your leadership skills.

<comment><AUTHOR> Thanks Kevin (just followed you on twitter btw). The negative signal is what I'm worried about.

In your experience, do you think I have a chance of successfully counter balancing that with the fact that I've already committed a large amount of my own money, built a fully functioning MVP and have a team ready to go? i.e. this is well beyond the pipe dream and fancy power point presentation stage.</comment></comment>


A change of lawyers at the FSF - <AUTHOR> https://lwn.net/Articles/704938/ <comment><USER2> Is there a story here?</comment>


To Catch a Phone Thief, Take a 'Theftie' - <AUTHOR> http://online.wsj.com/articles/to-catch-a-phone-thief-take-a-theftie-1401301130 <comment><USER2> If I'd steal a phone, first thing I'd do is take the battery out. Right after the job. Second, do a full wipe using Odin or similar tools. Third, reflash the firmware.

As long as the device I stole is not an iPhone, the phone is now completely under my control. And for what its worth, to avoid tracking it is iirc possible to put in fake IMEI, BT MAC and WiFi MAC addresses. No one compares these anyway, and e.g. a swap of the 3rd and 4th char would escape many people.

<comment><USER3> The crossover of people who know to do all that and people who steal phones is very, very small. People who tend to get in to petty thievery are not the type of people who have the technical skills or even the forethought to take those precautions.

<comment><USER2> If you're doing this on "professional" level, likely the guy picking up your loot will have told you at least about 1), alone to reduce the risk of cops tracking down the merchandise. If you proved to be not at least totally bananas, he might also tell you a bit more - the less time the stuff is in his hands, but in yours, the better for him.

</comment></comment></comment><comment><USER4> This reads like a submarine PR piece for Lookout. These products/services aren't new at all, and there are many, many other providers than the ones mentioned in the 'article.'

<comment><USER5> Yep. Leverage the new "selfie" trend to get a news story placed about your product = classic PR maneuver.

</comment></comment><comment><USER6> Oh the power of PR and/or money to pay media entities like WSJ. Other apps like Cerberus have had this functionality for _years_.

<comment><USER7> No need to allege some kind of payoff conspiracy. I got the same pitch. Editors just decide whether it's interesting enough or new enough to warrant a post or not. Some readerships are far less likely to have heard or other mobile security options, so a high-profile one adding this makes it news - like when Facebook adds 2-factor auth years after Twitter does it.

</comment></comment><comment><USER8> if you install one of this (i use cerberus for android) you'll get a bunch of pictures of yourself when you fail to unlock your phone.

makes for a good tumblr: [http://invalidpin.tumblr.com](http://invalidpin.tumblr.com)

<comment><USER9> It's worth noting that Cerberus, with a one-time price of 3€ (about $4) is considerably cheaper than some of the options mentioned in the article (~$30/year).

</comment></comment><comment><USER10> So once I have this photo of the thief, what next?

From reports I've read online, even when you go to police with a location of your device, they won't do much.

<comment><USER7> There was a case a block or two away from me where the person made the phone ring while the cop was there, which made it reasonable for the cops to enter and conduct a limited search. It was a sort of a clearing house for fenced electronics, if I remember correctly. So it depends a lot on the circumstances. If the phone had been off, I bet it would have turned out differently - though if you had a pic of the guy and the GPS said it was there an hour ago... maybe.

</comment></comment><comment><USER11> [http://www.paulgraham.com/submarine.html](http://www.paulgraham.com/submarine.html)

</comment><comment><USER12> Note to self: when stealing phones, cover camera lens with thumb

<comment><USER4> Even easier, power them off ASAP. Don't turn it back on until you've removed the SIM and taken it out of any Wifi range. These anti-theft services all rely on having connectivity.

<comment><USER13> Exactly why phones NEED to require the passcode/touch ID/whatever when turning the device off. Could add the same to Sim removals: "SIM HAS BEEN REMOVED, ENTER PASSCODE TO DISABLE ALARM"

<comment><USER14> Or just build cerberus into your ROM and use the authorised SIM feature.

It will take a pic and send me an email of its location if another SIM is put in.</comment></comment></comment></comment>


How SAML 2.0 Authentication Works - <AUTHOR> https://gravitational.com/blog/how-saml-authentication-works/ <comment><USER2> Great article. I had to integrate SAML 2.0 in a product not-too-recently and it's absolutely horrible compared to Oauth workflows. Maybe it's the different ecosystem: most IDPs are big, bureaucratic institutions with tons of middlemanagement where OAuth providers tend to be tech orientated players looking to scale their product with minimal friction. Anyways, tons of documentation is outdated, or too light on details or orientated towards management rather than developers.

passport-saml [0] really deserves more love for how (mostly) wonderful it is at making integrating SAML into node applications.

0: [https://github.com/bergie/passport- saml](https://github.com/bergie/passport-saml)

<comment><USER3> As a SAML IdP operator, you're not wrong -- the typical SAML IdP operator is an insitution or a BigCo's internal SSO, while the typical OIDC/OAuth provider is a tech company that runs a data silo -- but consider that SAML IdPs and SPs frequently have to engage in a dialogue to peform an integration, while OAuth 2.0 providers just kind of exist by fiat, and wait for SPs to show up. OIDC evolved from OAuth 2.0 so the UX expectations remain: the SP's operator expects to have to go through some web-based SP registration process provided by the OIDC IdP.

In SAML, the IdP and SP can exchange metadata, but plenty of fly-by-night SPs can't consume it, and need to be configured by hand. Tons of vendors of claim their SP supports SAML, but their implementation was hacked together in someone's basement and doesn't support SAML medadata, is hardcoded to use NameIDs, can't do key rotation, and the like. Some vendors intentionally "simplify" the terminology and translate well-specified SAML terms like "Assertion Consumer Service" to nicer sounding common words, like "login URL", largely obscuring meaning and making any integration an exercise of repeated trial and error.

Garbage IdP software exists too. The SAML specs are very accommodating and offer lots of options, so even among parties that don't flout the text of the standard, the interoperability matrix can be challenging. It's best if your product supports all the options, because the other guy's handmade product probably won't. Then, with attribute release and usage, some vendors ask for email address and use it as a persistent non-reassinable identifier, and some vendors ask for a persistent non-reassingable identifier and if it looks like an email, they'll probably send mail to it. It's frustrating.

Really, because each standard's deployment base, the incentives are different: the typical SAML SP offers a product it wants to sell to an institution or BigCo and the IdP is trying to be careful with its attribute release, while the typical OAuth provider is the data silo itself, full of user data, and SPs want to integrate with it to surface that data in their own application. OIDC then shipped a bunch of standard claims to carry identity info too, but the nature of the typical deployer has hardly changed.

<comment><USER4> As someone who has built and maintains the SAML implementation for an SP it's funny how many of your complaints about bad SPs match my issues with bad IdPs.

Most IdP-as-a-service vendors produce their own metadata, but can't consume SP metadata. They invent their own terminology, make it hard to pass attributes, and rarely offer options around which binding to use.

It's unfortunately all too common to get into a situation where _The spec says X and Y are valid. The interoperability profile requires X. But this popular vendor only implements Y, and does it incorrectly_.

<comment><USER5> I'm a SAML consultant. I help IdPs become "good" IdPs, and I help SPs become "good" SPs. Both sides are usually bad in some way or another, and both sides usually want to shift the blame to the other side as soon as they can.

The number of times I've been CC'd on a terse email from one admin to another saying it's the other guys fault after I've clearly told them the list of things on their side that could be causing the issue is pretty much uncountable at this point.

</comment></comment></comment></comment><comment><USER6> Fun fact: In the AWS Console, you can set up SAML for users to log in. Instead of logging in as a specific IAM User, they are "logged in" to a specific IAM Role. You could almost say that their SAML login is "bound" to that IAM Role.

It is also possible for the IdP to tell AWS that this user is eligible to "bind" to multiple IAM Roles; the user selects which role to bind to after authenticating with the IdP. CloudTrail logs will include the IAM Role, and the identifier of the individual bound to that role. So if you already have a SAML IdP, you might not need a separate authority (like a Vault installation) to give temporary credentials to people.

The only annoying thing, is that the SAML login to the AWS Console is _not_ SP-initiated, it is IdP-initiated. It is more formally known as an Unsolicited SSO (in that the SP is suddenly getting a SAML assertion it did not ask for). So you have to know the correct way to initiate this on your IdP. In our case, browsing to [https://aws-console-idg.stanford.edu](https://aws-console- idg.stanford.edu) redirects you to [https://idp.stanford.edu/idp/profile/SAML2/Unsolicited/SSO?p...](https://idp.stanford.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=urn:amazon:webservices), which starts the Unsolicited SSO.

You also need to configure your IdP to include some AWS-specific SAML attributes in the response, telling AWS what role(s) the user is allowed to use. This can be annoying, but in our case the group managing the IdP simply scripted it, so adding a new IAM Role is not a big hassle.

Information on how to configure this—for both the AWS side and the IdP side—is available at [https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr...](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html)

<comment><USER7> We've been using SAML to log in to AWS for the better part of a year now and it's been pretty good for us.

When logging in, you assume a role (sts:AssumeRoleWithSAML), I'm surprised you did not mention the worst part: logging in to the CLI with this. You either have to manually input the returned SAML assertion to the AWS cli[1], but luckily there is a tool called saml2aws[2] to do this with the majority of identity providers.

saml2aws sadly didn't have proper support for assuming many roles at once, so we even ended up writing our own tool for this.

This is something AWS has completely ignored so far and I am not aware of any progress towards a better CLI experience.

[1]: [https://aws.amazon.com/premiumsupport/knowledge- center/aws-c...](https://aws.amazon.com/premiumsupport/knowledge-center/aws- cli-call-store-saml-credentials/)

[2]: [https://github.com/Versent/saml2aws](https://github.com/Versent/saml2aws)

<comment><USER6> Ah yes, you're right. I had completely forgotten about this, simply because I haven't used it. But yeah, it's a big annoyance for a lot of people.

</comment></comment></comment><comment><USER8> SAML is a simple enough in concept (I as SP don't know who you are, but I am configured to trust IdP, so if you can get a signed document from IdP saying "the bearer of this document is X", then I'll trust that), but XML canonicalization and signing is a pain to get right, validation has a number of gotchas, the standard has too many optional parts and is too configurable, and it's difficult to test conformance. Having implemented both SPs and IdPs before, gotten them wrong in a few subtle but dangerous ways before getting them right, and having had to test against a variety of IdPs and SPs before determining that it was mostly compatible after adding a bunch of IdP-specific configuration parameters, I don't recommend SAML 2.0 itself if it can be avoided.

OIDC isn't perfect, but it is much better. The entire assertion is a JSON Web Signature, so there's no opportunity for ambiguous extra unsigned data and the canonicalization is dead simple (UTF8 base64 URL of bytes). Fewer optional components. Smaller message sizes.

Edit: if you need a SAML IdP for your organization, I had great experiences with Okta. Ping was opaque, less flexible, and overly complex. Didn't do the configuration side of ADFS, but it wasn't particularly hard to communicate with.

</comment><comment><USER9> Clear and simple guide. I struggled to implement SAML login for so long on a project because every guide is just a long enterprise wordy document or doesn't correctly defines terms and concepts.

</comment><comment><USER10> How does the logout process work?

Or what happens when the user is removed from the idp? How does service provider know the user is supposed to be logged out?

<comment><USER11> In most cases, SP doesn't know user is removed from IdP. If there's a need for such feature, you resort to shared sessions - IdP has control of storage service where SP's save sessions (say, Redis). Once user is removed from IdP, IdP deletes the session record in Redis and SP loses all user info.

This implementation happens rarely.

The single logout process is often flawed since it depends on SP's accurately processing the request and returning the user back to IdP if a session has been successfully destroyed. This often fails due to network connectivity, problems with session destroying at the SP, SP's not implementing the SingleLogout properly etc. What I've experienced and seen in many cases is that IdP simply kills the session it has on the user and stops right there, then the rest of the SP's handle it through back-channel.

I work in this area so I'm relaying my experience through past 10 years of implementing SSO for various enterprises.

In reality, the SAML protocol is quite straight-forward but something odd happens when people hear the term SSO. It's not magic, it's quite trivial but takes a bit of discipline to grasp it fully and implement properly.

<comment><USER12> > it's quite trivial

I've been tasked with authenticating in an existing application via SAML 2.0 I've got the whole SAML 2.0 specification printed and sitting on my desk right now. It sure doesn't _look_ trivial.

<comment><USER6> When people say "Don't roll your own encryption" or "Don't implement $ALGORITHM, just use libsodium", I think that also applies to web authentication (be it OAuth or SAML).

If you are the 'client' that wants to authenticate an incoming user, then I'd point you to an existing SP like Shibboleth or SimpleSAMLPHP or even CILogon (which bridges SAML and OAuth). If you are handing out authentications, then you are an IdP and I'd point you to something like Shibboleth or ADFS or Okta.

It is good to have the relevant RFCs to hand, but I would not make an implementation from scratch, unless there was a very good reason for it.

<comment><USER12> I'm trying to build an "SP" or "relying party" as I've learned in the jargon of the domain. Building an implementation from scratch is the last thing I want to do. I feel like I'd rather pull out my own teeth. But a difficulty of finding any information about it has lead me to start reading all the official specs as a kind of last resort.

In my initial research, I did discover Shibboleth, but was under the impression that it was an IDP only. I will check out the SP component, because I would _love_ to not implement it from scratch.

At first glance, I see this: [https://www.shibboleth.net/products/service- provider/](https://www.shibboleth.net/products/service-provider/) It basically seems pretty opaque. The downloads at [https://shibboleth.net/downloads/service- provider/latest/](https://shibboleth.net/downloads/service-provider/latest/) don't really provide much clue of how to build them or incorporate them into my app, which is written in a different language than any of these source files. I'll keep looking.

<comment><USER13> I was just tasked last week with implementing SAML auth for our applications and have settled on Shibboleth.

For the SP I just installed it from yum after adding the centos repos.

There is a repo config generator at [https://shibboleth.net/downloads/service- provider/RPMS/](https://shibboleth.net/downloads/service-provider/RPMS/) that I used.

It installs as an apache module and I am building a flow from my load balancers to hit the apache/SP and proxy some traffic to the application after authentication success so we can create our login session.

I have a PoC going now, but the documentation is not terribly clear to me and it is really confusing me about some options I need to tune.

For my initial testing, I built the SP and used [https://samltest.id/](https://samltest.id/) to test against an IDP.

Shibboleth SP docs: [https://wiki.shibboleth.net/confluence/display/SP3/Home](https://wiki.shibboleth.net/confluence/display/SP3/Home)

<comment><USER14> If your language/environment supports using Apache HTTPD as a proxy, then you can use mod_auth_mellon to secure your web application. That's just one option, there are lots of others.

<comment><USER12> I have heard about these options, but the problem for me is identifying any of them and figuring out how to use them. My web server probably has to be IIS or Kestrel. I've been trying to figure this out for a few weeks now. And I've spent about a day trying to figure out how to do anything with the Shibboleth SP. I think I got it installed, but I can't really tell if it's doing anything or how to use it. And even then, there doesn't seem to be any information on how to actually use it for authentication in _my_ application.

From my perspective as an application developer, writing an application that authenticates via SAML 2.0 is a nightmare, despite the ubiquitous claims of how simple it is.

<comment><USER14> If your app is .NET, look at Sustainsys ([https://saml2.sustainsys.com/en/2.0/](https://saml2.sustainsys.com/en/2.0/)) or ITFoxtec ([https://www.itfoxtec.com/IdentitySaml2](https://www.itfoxtec.com/IdentitySaml2)) libs. Unfortunately there isn't a clear architect/dev-level guidance at the protocol level on key decisions that need to be made when implementing SP that tightly integrates with your app. Give one of these a shot and post your questions on StackOverflow.

<comment><USER12> Thanks. This looks more approachable. I'll give these a shot.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> As usual in this kind of articles, the logout process is left out...

<comment><USER16> Yep, would also really like a single signout example

</comment></comment><comment><USER17> Shout out for simplesamlphp, which confusingly comes as two projects: simplesamlephp/simplesamlphp (a full web application which can implement SP or IdP), and simplesamlephp/saml2, a library of components for parsing and building SAML messages. I just used the library, which meant building a lot of the logic around what to actually do with the messages, but once you've learned the protocol inside out, it's easy to use ( as ever, the code IS the documentation!) but has a few limitations - because it was built to support a specific application. One very handy feature (relating to others' commenting about SPs that can't parse metadata) is the metadata parsing.

</comment><comment><USER14> For a technical intro to SAML, the best place to start is the original OASIS Technical Summary doc at [http://docs.oasis- open.org/security/saml/Post2.0/sstc-saml-t...](http://docs.oasis- open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html) . It's still very much relevant and it doesn't gloss over important details (profiles as a central concept, profiles other than web browser SSO [such as single logout], multiple bindings in a profile, etc)</comment>


Google Chrome tops 'Dirty Dozen' vulnerable apps list  - <AUTHOR> http://www.networkworld.com/news/2010/111510-google-chrome-dirty-dozen.html

<comment><USER2> The article bases this on that they had the greatest number of security updates in the previous year - when the app was basically a beta.

This leaves aside the question of what is more secure - an app where you get security fixes every day - or one where the makers deny there are any faults.

</comment><comment><USER3> "Google Chrome in the No.1 spot with 76 _reported_ _vulnerabilities_ "

Reported by Google's bug tracker and security team, if the random sampling of vulnerabilities I looked at are any indication.

Seems like the secret to "winning" this list is to just hide everything in- house. I wonder what the list would look like if Microsoft's bug trackers were public viewing.

<comment><USER4> Opera didn't even make the list. Seems like <https://bugs.opera.com> is for internal use only.

</comment></comment><comment><USER5> Network World is owned by International Data Corp (aka IDC, IDG) and this[1] blog author seems to think that they are the puppet of Microsoft. While I certainly cannot make an argument one way or another, this raises the question of how valid this report is.

I couldn't believe when I read this article that in related content, the top item was "IE9 tops Chrome, Firefox in HTML5 Compatibility"[2]. That's what made me research if there was any connection between Network World and Microsoft.

[1] <http://techrights.org/2010/06/11/idc-idg-and-propaganda/>

[2] <http://cl.ly/3A0q1F2o44000u1O2P3l>

<comment><USER6> Not to mention that Safari and WebKit are specified as two different, ranking products on this list.

<comment><USER7> Aren't they different?

The fact that they use roughly the same engine doesn't count for very much. It's the implementation that matters.

<comment><USER8> Safari consumes WebKit (as does chrome). They are not merely "roughly the same engine", one uses the other.

<comment><USER6> And, since Webkit is a development branch, it's extremely unfair for it to be used as a "target" in this sense. It's going to have tons of security fixes, because it's _bleeding edge code._

</comment></comment></comment></comment></comment><comment><USER9> I'd like to know, how many of that 76 vulnerabilities were able to escape chrome sandbox?

<comment><USER10> also... How many of those vuln. were actually found in the wild?.. How many days were the flaws open?..

This is a very-very weird article.

</comment></comment><comment><USER11> Wouldn't it be more appropriate to order the list by the number of distinct successful exploits of an app's vulnerabilities? In that case, unless I am mistaken, Chrome would be at zero.

</comment><comment><USER12> I think this list is more likely a measure of the apps with the most security testing performed on them if it isn't an outright falsification altogether.

</comment><comment><USER13> Fortunately Chrome is a dynamo at updating itself. It's generally invisible to the user.

</comment><comment><USER14> So the most vulnerable apps are the ones everybody uses. Huh. Who'da thunk.

<comment><USER15> What do you mean, exactly? Chrome + Safari don't crest 10% of web share.

</comment></comment><comment><USER16> oh no, articles like this are so misleading, Google Chrome tops the list as the most security enhanced patched browser -- not the most vulnerable. This probably has everything to do with the bounty that Google has offered and the fact that Chrome is heavily being worked on. To say Google Chrome is the most vulnerable browser is a huge lie, name just one exploit that you can use on the browser right now. If I were Google I'd sue for slander!

</comment><comment><USER17> I'm shocked, shocked to see open source Chrome and Firefox closer to the top, while closed source IE and Opera are closer to bottom.

</comment><comment><USER18> This is complete and utter crap when it comes to statistics.

Does most number of bugs reported mean anything? No. I can NOT report the bugs because I don't have the IE source code. I can report 2 bugs a year, and never have them resolved, so I'm secure I guess, yet I'm actually worse off. How fast from report to release does a bug take on average to be fixed? How much of chrome's reported vulnerabilities reside inside the sandbox vs leaking outside the sandbox (this is a big one, if the answer is none then chrome is still insanely secure)? What about the fact that many security problems in chrome likely are problems in Safari except without the niceties of the sandbox?

This is all crap.

</comment><comment><USER19> I'm not sure what the first paragraph in the article states. The part I'm having trouble with is: most discovered software flaws requiring security updates and notifications. Does that mean that Google Chrome fixed the most bugs, or were the most bugs found in Google Chrome?

If it was the former, Google is being shown in a positive light and they don't have any sort of "dubious distinction", and if it was the latter, then Google has an explanation for that. Lots of bugs are found in Chrome since Google pays developers a lot of money to find bugs in Chrome (not really sure about the others).

From the same site: [http://www.networkworld.com/news/2010/110110-google- offers-b...](http://www.networkworld.com/news/2010/110110-google-offers- bounty-to-web.html)</comment>


Ask HN: Is there an Open source alternative to AutoML? - <AUTHOR> Is there an open source, transparent tool like Google AutoML that allows us to use NAS to build interesting and well performing neural networks?<p>Would this be something that people would find useful? <comment><USER2> Fast.ai is close.

What is NAS?</comment>