State of Cybersecurity at Airports - <AUTHOR> https://irishtechnews.ie/state-of-cybersecurity-at-top-100-global-airports/ <comment><USER2> Mobile app security can be a big deal. I remember a few years ago the app for British Airways would make a non-encrypted call to BA servers to get the SSIDs and passwords for the WIFi access points of their airport lounges. While trivial in comparison to other security leaks it goes to show that small but important things can easily be overlooked.

<comment><USER3> We see a lot of security researchers time and time again finding security issues with mobile apps. Not sure if security matters more than adding features quickly.

</comment></comment><comment><USER4> "66% of the airports are exposed on the Dark Web"

What exactly does this mean?

<comment><USER5> The actual study talks about it a bit more (linked in another comment). "Recent leak of highly confidential data (e.g. PII, PHI, IDs, financial records, plaintext passwords for production systems, etc.)"

</comment></comment><comment><USER5> The actual study the article references: [https://www.immuniweb.com/blog/state-of-cybersecurity- top-10...](https://www.immuniweb.com/blog/state-of-cybersecurity- top-100-airports.html)

</comment><comment><USER6> Backup source: [https://web.archive.org/web/20200130122835/https://irishtech...](https://web.archive.org/web/20200130122835/https://irishtechnews.ie/state- of-cybersecurity-at-top-100-global-airports/)

</comment><comment><USER7> For some reason, I fully expected Schiphol airport to be one of the three.

</comment><comment><USER8> First hand knowledge of why airports are getting such terrible scores.

Airlines use agencies to do a lot of their tech work.

And agencies never really hire the "best and brightest" \-- when they need to staff up after winning a project, they hire whatever freelancers they can get their hands on; whatever freelancer allows them to still make a 40-70% margin that is.

Airlines will go with the lowest bidder, more often than not, and all of the funding for a website or app is Capital Expenditure (CapEx) -- meaning there's no ongoing money set aside to do updates and security patches.

While airlines probably do have some sort of under-staffed IT department, most of the projects are owned inside of the airline's marketing team's budget. This means the airline's IT department is typically intentionally excluded from the talks between the airline's marketing team and the agency doing the work. Making maintenance of whatever gets delivered a lot harder.

The Airline's marketing team will say things like, "Our IT guys are slow, if we ask them for an estimate they'd say 3 years... we want this done in 6 months." Even if the agency staff wants to flag a tech or security issue... the dev doing the work is more often than not just on a contract, and would have to fight his manager (who would then have to fight the account manager) to get any sort of time to fix the defect. The airline's marketing team will lean on the agency to cut corners to hit the date.

Just an aside, often times the airline's IT staff is so under-funded, their only option is to lock down every bit of equipment. So the airline's marketing team ends up using OLD laptops with Windows 7, and can't even install things like Slack. So all communication between the airline's IT marketing team and the agency vendor happens on personal text messages, or via Whatsapp. Files are sent via whatever temp large storage host the marketing guys know how to use... I remember asking for a schema and getting back large chunks of customer data, over 100k rows, all sent via whatever "free large file upload" tool was popular at the time. I had to watch an ad video to download, seemed a lot more secure than a password...

When the project is finally launched, the agency won't have put together any sort of documentation around it if that documentation wasn't part of the requirements in the bid. And more often than not there's no security review. True story... we shut down an internal testing server, and had a client call us panicked. When we gave them code, they couldn't get their IT guys to load it onto their servers... so they just changed the DNS over to their test servers. This website was gathering customer details, and serving as the source of truth for the marketing CRM for years... we weren't told us the test server was now customer-live, but doubtful anyone would have cared since all we did was mark up the cloud hosting bill and pass it on to the airline.

Also you can replace "airline" with just about any company type here that uses agencies, but certainly true for airlines.

<comment><USER9> At least in North America, airlines and airports are not the same corporations.</comment></comment>


With Free Bikes, Challenging Car Culture on Campus - <AUTHOR> http://www.nytimes.com/2008/10/20/education/20bikes.html?pagewanted=all

<comment><USER2> The nice thing about cars is that drivers of automobiles don't usually drive on the sidewalk at speeds up to 25mph in crowded areas while talking on the cellphone at the same time. Or if they did, they would at least get fined.

<comment><USER3> Yeah, some people on bikes are incredibly inconsiderate, but the _bike_ isn't the problem. If more people rode bikes, the social norms about where to ride / not to ride would be better understood, and the social pressures would be clearer. This sort of thing also happened when cars where new, though then people actually _got killed_ instead of just annoyed. See Clay McShane's _Down the Asphalt Path_ ([http://books.google.com/books?id=hoFKI- yodUQC&pg=RA1-PA1...](http://books.google.com/books?id=hoFKI- yodUQC&pg=RA1-PA176&dq=cars+hitting+pedestrians+%22new+york%22+italian++neighborhoods&ei=cez9SNqgMIHwMpSh2cML))

Similarly, people who don't know about how to ride bikes safely are far more likely to ride against traffic, weaving in and out of parking lanes and sidewalks, etc. Most people in the US have had no education about how to ride a bike in traffic safely, because riding bikes as transportation has never really been a mainstream thing. (Even two or three one-hour classes and showing people how to fix a flat tire would go a long way, I think.)

<comment><USER2> I agree with you! And I've seen less of the behavior I've mentioned; I'm just wondering if it's because bikers are starting to get ticketed, or if bikers have been in near-accidents and have become more careful. Colleges and large companies should definitely hold sessions on safety.

<comment><USER3> It's probably both happening in tandem -- it seems to be a gradual social change, in part due to rising gas prices. A noticeable percentage of college students have biked around for years, but it seems to have increased significantly over the last few years, and I see significantly more people biking around downtown Grand Rapids, MI in general.

</comment></comment></comment></comment><comment><USER4> Bikes are over-rated as campus transport.

A large fraction, perhaps even most, trips are in the company of someone else. Often said someone does not have a bike. As a result, the combination is the slowest of both worlds - the bike has to be unlocked and locked at the ends of the trip and the distance is travelled at walking speed.

Note that the unlock/lock time exceeds the time saving from extra speed on short trips.

<comment><USER5> I need max. 15 seconds to unlock the bike and start riding it. You say you can't be 30s faster on a bike than someone travelling at walking speed, even for short distances? I guess you can't only if it is 30s walking distance.

<comment><USER4> > You say you can't be 30s faster on a bike than someone travelling at walking > speed, even for short distances?

If you're more than 2-3x faster than pedestrians, you're a danger unless you're separated from them, and bicyclists are rarely separated enough on a college campus.

1mph is 264ft/minute. Reasonable walking speed is about 3mph, or over 750ft/minute. A safe bicyclist will cover that distance in about 20 sec, saving at most 10 sec.

Meanwhile, the walkers had a conversation.

And, since students have 10 minutes between classes, the time saving of faster transport doesn't buy them anything even if they're going 1,500ft..

That's why students who own bikes don't use them all that much. They're only useful to/from campus and for long-hauls.

<comment><USER3> Agreed, though the to/from campus trips are worth keeping in mind.

Also, bikes need more maneuvering space than pedestrians. Not as much as rollerbladers, though. (Don't get me started...)

</comment></comment></comment></comment><comment><USER3> There's a major incentive for the university that the article completely misses -- parking (spaces, security for lots, dealing with on-campus traffic jams, etc.) for the entire student body can be surprisingly expensive. I wonder how that compares _over four years_ to the cost of one $480 bike. Also, if they're buying a bike for every student, they're probably paying quite a bit less than retail.

</comment><comment><USER6> It gets damn cold in Maine in winter.

<comment><USER3> So wear a coat (and a scarf and gloves). If you're on a bike, your blood is pumping, and you're probably generating far more heat than the people sitting in cars waiting for the windshield to defrost.

I've biked through four or five Michigan winters so far. It's really not a big deal if you dress sensibly.</comment></comment>


Data shows GPL is losing to permissive licenses - <AUTHOR> https://www.theregister.co.uk/2020/01/17/mit_apache_versus_gpl/ <comment><AUTHOR> In 2012, 60% of open source projects had copyleft (GPL-like) licenses. In 2019 copyleft was down to 33% and still falling albeit more slowly, with permissive (MIT-like) licenses dominating the modern open source licensing landscape.

<comment><USER2> Back then people also did a study checking the licenses in Debian and got the opposite result.

The general conclusion back then was that large and long lived projects tend to favor GPL, while smaller and short lived projects tend to favor permissive. The media number of files per project on github is 1, the median number of authors is also 1. In comparison, Debian packages has significant higher median numbers.

So far I have seen nothing to contradict that finding.

<comment><AUTHOR> Only time will tell for sure. I think the shift from SourceForge+Patches to Github+PullRequests drove significant change in the number and demographics of developers actively committing to open source projects (that is just a belief at this point, I haven't found hard data to confirm or deny it). Large multi- developer projects like the ones you cite in the Debian data tend to be older because it generally takes time for projects to mature to large developer counts. If that's the case (and all this is very much data-poor speculation), then you would expect larger multi-developer projects today to preferentially exhibit the older GPL-biased license preferences in ways that an equivalent sample in 2025 would not or would with lower strength.</comment></comment></comment>


It's time for social network neutrality - <AUTHOR> http://www.betabeat.com/2011/07/19/its-time-for-social-network-neutrality/

<comment><USER2> A very interesting article! It neatly articulates why API lock-ins are analogous to other "traditional" monopolies. This paragraph was particularly illuminating:

 _Social networks are a critical layer of infrastructure for a wide variety of applications and content. Unlike physical networks, opportunities for lock-in emerge not at the physical layer but at the social layer: our connections. In other words, they do not wield monopoly control by dint of massive up-front fixed costs but rather by the accumulated value contributed by users in the form of the social graph!_

However, to play the Devil's advocate, I am not entirely convinced that unlike electricity, or water, why these services are considered essential, considering how recently the entire concept of a social graph emerged. I see a strong case for enforcing neutrality rules for the internet, partly because a lot of the costs were initially bore by taxpayer money, but the same can't be said of Facebook and Twitter.

</comment><comment><USER3> I'm ambivalent about this. It's unfair to basically nuke Twitter/Facebook's business model by turning them into utilities. OTOH, it was unfair of Twitter to promote themselves like a utility for a few years and then dramatically change course (even though it was obviously inevitable to some people).

Related: [http://www.zephoria.org/thoughts/archives/2010/05/15/faceboo...](http://www.zephoria.org/thoughts/archives/2010/05/15/facebook- is-a-utility-utilities-get-regulated.html) discussion: <http://news.ycombinator.com/item?id=1350689>

<comment><USER4> That danah boyd article is excellent. She nicely describes the trade offs inherent to regulation.

</comment></comment><comment><USER5> Pushing for existing closed networks to be somehow regulated seems like a worse solution than pushing for federated social networks where you can switch as you like and still communicate with everyone. The best way to avoid abuse is to have a system with a low cost of entry for new players and a low cost of switching for users.

<comment><USER4> Totally agree with you. I'm not pushing for regulation, I'm arguing for data portability.</comment></comment>


Moving to Flash, Part 2: Important Differences Between Java and ActionScript 3 - <AUTHOR> http://blog.sharendipity.com/moving-to-flash-part-2

<comment><USER2> It's a very nice web page, and a cool idea for an app.

He's right: Java is sputtering. There is an advantage for desktop apps, however. When I pitch the product, I can load it right on the customer's desktop without a clearance from an IT person, assuming Java is installed. I don't know how to distribute a flash app as a desktop app.

<comment><USER3> How about AIR? Does that need IT approval?

<http://en.wikipedia.org/wiki/Adobe_Integrated_Runtime>

<comment><USER2> I'm embarrassed to admit that I hadn't checked into AIR before this post. It looks like if approval has been given for flash (and it probably has), then it's a snap to deploy using AIR. Adobe charges for this, don't they?

<comment><USER3> I don't know much about AIR, myself, which was partly why I asked. The impression I get is that the runtime and Flex SDK are free, so you can theoretically put together applications without paying Adobe. Adobe charges money for the Flex Builder IDE, though, which is supposed to make development easier, and it looks like other Adobe products can output AIR applications.

<comment><USER4> you have fallen into adobe's trap. that's exactly what they _want_ you to believe.

yes, it's perfectly possible to download the free sdk, and write your first "hello world" app that prints a line of text to the face of the applet. so then you start planning on how you're going to do this. and then say you want to do something simple, like for example, _use flash gui controls_ , then you'll learn the horrible truth. it's impossible to do such a thing without buying adobe flash cs3, which costs 700 bucks.

and even if you spend that 700 bucks, adobe flash cs3 is a gigantic steaming turd. i spent a day or two trying to make my peace with it, and failed.

so i decided to forgo flash gui controls altogether, and used javascript controls instead.

<comment><AUTHOR> We're using Flex Builder which should allow us to create all of the GUI controls we need. It's $250. Regardless, it's true that the free tools aren't all that useful.

<comment><USER4> i never investigated flex builder, so i'll take your word for it. javascript controls turned out to be the solution for me, so i didn't look any farther than that.</comment></comment></comment></comment></comment></comment></comment>


SoundCloud faces do-or-die vote by investors - <AUTHOR> https://techcrunch.com/2017/08/10/soundcloud-shut-down-possible/ <comment><USER2> "Soundcloud is fine and will be around for years, stop backing up all of the music".

Didn't the CEO say something along those lines ~2 weeks ago when they forced the archive.org folks to stop pulling down a backup copy of everything? Funny how quickly that was proven to be BS.

Not that anyone should be surprised by this outcome.

<comment><USER3> Reminds me of the financial crisis when banks that were losing billions would claim to be "Awash with liquidity." Once the CEOs admit weakness, the sharks circle tighter.

</comment></comment><comment><USER4> > employees secretly using Spotify.

Well yeah. There's not even competition there. And shouldn't be really, they are fundamentally different platforms.

<comment><USER5> And that's the problem -- the CEO wasted a ton of time and resources trying to create a Spotify competitor that just burned resources.

</comment></comment><comment><USER6> How can a website that lets people upload music files and comment on them, and play the music POSSIBLY need $170 MILLION to operate? I just don't get what they could possibly need that amount of money for.

<comment><USER7> Some random guesses:

* Business development teams for the Nth media company collaboration scheme * App development teams for the Nth iOS app redesign * Back-end and ops teams for the Nth overwrought storage architecture * Front-end teams to explore rewrites in the Nth proposed in-house JS/CSS framework * Operations people to keep the aforementioned people paid and fed

</comment></comment><comment><USER8> > Now it's asking investors for $169.5 million at a pre-money enterprise > valuation of just $150 million

Ouch. I hope they get the money. I really don't want it to go away. I have not found an alternative that has so many 1+ hour long megamixes :(

<comment><USER9> I've always got my mixes from mixcloud. Never really saw what differentiated soundcloud.

<comment><USER10> As someone who uses both platforms and actually prefers Mixcloud as a product, the user base is simply not there. I see much more engagement on Soundcloud.

Maybe it's different for other creators, artists, DJs, but I'd guess that's a very common experience when comparing both services.

<comment><USER11> Mixcloud founder here, thanks its appreciated. Theres one big different on engagement, we tend to see lower play counts, but higher number of minutes listened per play. You'll start to see us surfacing this data more in the upcoming months, and I expect everyone to be pleasantly surprised.

<comment><USER12> Since you are here, can you also surface anything about potential plans for offering an improved (and possibly paid-for) streaming quality and/or offering the mixes available for download? I'm in it for the mixes and I want to love Mixcloud, but there is only so much fun to be had with discovering a mix that cannot be played on a quality stereo and/or in a place without internet connection (so at the party, in other words) and those will in any case go on my priority list if and when Soundcloud finally goes down.

</comment></comment></comment></comment></comment><comment><USER13> What a messed up article. I don't know this CEO but using a picture taken at a festival two years ago as proof of incompetence seems very cheap.

<comment><USER14> Indeed–that image caption serves absolutely no purpose except to beat on someone who is at a low point anyway.

And it doesn't even make sense! Taking a vacation every now and then is likely to improve productivity, and for SoundCloud specifically, it seems almost necessary to go to Burning Man and mingle. The criticism is especially rich coming from a guy who looks at least twice as stoned in his official TechCrunch photo than the SC CEO at Burning Man.

Creating SoundCloud is more than 99.x% of people ever achieve, including me, the author, and the editor of this shameless excuse of an article. SoundCloud is obviously beloved by many. If they don't find a way to get those people to pay, they're in good company.

At least they're not selling to AOL.

<comment><USER15> How dare you suggest that people should take vacations and have a life?

</comment></comment></comment><comment><USER16> Shameless plug: if you or your friends have important data on SoundCloud, check out my free service to back it up: [https://scupper.io](https://scupper.io).

<comment><USER17> Or make a true backup by _downloading_ it all with e.g. youtube-dl instead.

<comment><USER18> Can't help but wonder what the sound quality of a downloaded youtube vid converted to mp3 would be vs a straight up mp3 or FLAC.

<comment><USER17> youtube-dl's name is unfortunate since it.grew.to support many other sites, such as SoundCloud. You can download flac or wav files often using it on SC content.

</comment></comment></comment></comment><comment><USER19> For all those looking to make a SoundCloud clone: What is HN's opinion on its failings (from a user perspective) — i.e. how would you make SoundCloud better right now?

Also interested to hear those who can balance with commercial viability.

<comment><USER20> Go back to basics.

Keep it focused on community facing artists, remixes, dj sets, etc.

From what I've seen they suffered most from lack of direction, weak leadership, and no real business plan from the beginning. It seems (correct me if I'm wrong) it started as a hobby project and got twisted into a SaaS model that didn't fit it's purpose or audience.

As far as monetization - why not have a Patreon-esque system of support specific content producers/artists? I don't think a blanket monthly subscription is really a good fit but personally I would pay 1-5$ / month for specific artists/content providers and follow only them.

<comment><USER15> > _why not have a Patreon-esque system_

You've lost me there.

You can't, because people don't pay and don't want to pay, unless they are forced to, as in there's actual scarcity (i.e. no way to easily get that content from anywhere else).

<comment><USER21> Clearly it can work, because it works for Patreon. It also works for twitch, who allow people to "subscribe" to streamers they like. This entails paying $5 a month (half to the streamer, half to twitch) to receive exclusive chatting rights, special "emotes", and other non-essential features. People do it not because they want access to the special features, but because they want to support the streamer. It seems that people are adverse to paying only when it is on an-item-by-item basis, but are not adverse to it in general.

</comment></comment></comment></comment><comment><USER22> Privacy Badger would have to be disabled whenever I accessed SoundCloud. That was my indicator to avoid it.

I miss the days of RSS podcasting.

</comment><comment><USER23> > If it can't find funding or a buyer, SoundCloud could vaporize, destroying > its massive archive of user-uploaded music, podcasts and other sounds.

Wrong. If Soundcloud goes bankrupt then the state tries to find a buyer for a new SoundCloud with a virgin cap table. So Soundcloud won't disappear whatever happens.

<comment><USER24> Are you sure that is what happens, given that SoundCloud is a German company? Afaik a kind of administrator gets appointed by the Court who can take over administration of the company, not sure about the cap table though.

<comment><USER25> SoundCloud looks like a UK company with a german daughter company to me:

[https://m.soundcloud.com/imprint](https://m.soundcloud.com/imprint)

</comment></comment></comment><comment><USER26> Of course we are all thinking (hmm should we do a clone) and believe me I am not going to deny it's tempting, hell I might even be pushing for something like that.

But the reality is most likely that someone is going to buy them for no money and then continue the platform trying to beat the dead horse alive.

The reality is that you don't make any money on streaming services if you don't hold the rights. Netflix and Spotify should be a good inspiration for how to do it and they aren't even doing as well as one might think.

But there is a very simple way to make a good (non funded) business out of soundcloud and that is to turn it into a paid platform for artists who want to push things up there.

</comment><comment><USER27> "Employees told us the company is "a shitshow," with a lack of product direction, talent leaving and employees secretly using Spotify."

Weird. I never really thought about SoundCloud and Spotify being actual competitors. I've always felt that SoundCloud did a lot better with indie/obscure artists, remixes, and the whole "soundclown" meme genre, whereas Spotify did a lot better with commercial/mainstream artists and albums. I use both frequently.

<comment><USER28> That's part of the problem. They focused all their attention on making a Spotify competitor, when the core principle of what SC unique is the community and a vast underground culture of unknown artists hoping to make it big.

The two are similar in that they're online streaming services, but insofar as everything else, not even close.

</comment></comment><comment><USER29> The reason I stopped using soundcloud as soon as I could was the fact that soundcloud uses 128kbps mp3 for most of the songs. If that would be at least 160k or 128k opus that would've been fine. But 128k mp3 is noticeably worse.

</comment><comment><USER30> Being in the music industry, I always had a negative experience using SoundCloud - It's not surprising that by neglecting their user's needs they are systematically imploding.

<comment><USER31> Could you elaborate? I was under the impression that SoundCloud is one of the few platforms that treats musicians well, and lets fans discover really small bands/djs.

</comment></comment><comment><USER32> i really like soundcloud for drum and bass mixes that would otherwise be pretty difficult / impossible to find otherwise. I will miss it if it goes under :(

<comment><USER33> devil's advocate, why not youtube, or reddit, and if downloading is a problem, mega?

<comment><USER34> Not the user you replied to, but for me, Youtube's "automatic mixes" loop pretty quickly. Also, YT is a bit more of a pain to use on mobile (either leave a video running, uses up battery and data, or use a modded version of Youtube which pretends it's Youtube Red and has background playback enabled).

Soundcloud "just worked". It even caches your feed after you listen to it, so I was able to use it without it using my mobile data for a while.

</comment></comment></comment><comment><USER35> I pretty much saw this coming. Posted to a IPFS group last year about using IPFS to make a decentralized soundcloud clone. I was lucky enough to get a response from Juan, the creator of IPFS.

[https://groups.google.com/forum/#!topic/ipfs- users/1Mu2Vh8sh...](https://groups.google.com/forum/#!topic/ipfs- users/1Mu2Vh8shI0)

<comment><USER35> I honestly don't understand the hate. If you're going to DV me at least take a sec to read the thread or let me know what your issue is. The thread has some good responses from Juan; that's really the only reason I posted it here. I thought of going decentralized because (at the time) I loved soundcloud. I used it as an artist and also as a listener. I've been around long enough to know that their model was not sustainable and eventually all the great content would disappear. Decentralized makes sense for something like SC. Let the people who find it valuable share in the costs of serving it a la bit torrent.

<comment><USER36> I see 2 problems with this approach:

1) IPFS does not work in the browser.

2) People might not want to share because of the copyright issue.

<comment><USER37> There's an alpha implementation of the IPFS and libp2p stack here: [https://github.com/ipfs/js-ipfs](https://github.com/ipfs/js-ipfs) and [https://github.com/libp2p/js-libp2p](https://github.com/libp2p/js-libp2p)

</comment></comment></comment></comment><comment><USER38> lol, just wondering why there is no soundcloud ico yet, as it seems so easy to set it up [https://icobox.io/](https://icobox.io/) \- would it be too much data for a blockchain based system? \- does anyone need a distributed soundcloud?</comment>


Checklist for Better Web Graphics - <AUTHOR> http://www.merttol.com/articles/web/checklist-for-better-web-graphics.html <comment><USER2> Please do not submit almost every article from your blog to HN.</comment>


Nothing but the Truth - <AUTHOR> https://www.themarshallproject.org/2016/05/24/nothing-but-the-truth#.3B7gSQIuU <comment><USER2> Don't Talk to the Cops: [https://www.youtube.com/watch?v=6wXkI4t7nuc](https://www.youtube.com/watch?v=6wXkI4t7nuc) (advice from a cop)

There is no benefit to talking to the police without your lawyer present. None.

<comment><USER3> Don't talk to cops indeed. They had a meandering 5-hour conversation and they still had nothing to go on, but ended up arresting and convicting him of murder for having mentioned a medicinal tea and because his memories of the hours surrounding the time of the murder (two years earlier) were fuzzy. All the while the guy had no idea he was even being interrogated!

</comment></comment><comment><USER4> I thought it was illegal to videotape and audiorecord someone without their knowledge?

<comment><USER5> Like many legal matters, it varies between states. The majority are "one party" states, where it's okay so long as one member of the conversation knows and agrees. (And like many legal constraints, they are usually laxer for law enforcement.)</comment></comment>


Ask YC: What else do you read? - <AUTHOR>

What other sites are on your daily must read list? Not techcrunch/techmeme et al, and maybe not even web related, but interesting and not the same crap that gets cross posted to a bazillion blogs.<p>I love: http://paul.kedrosky.com/ http://fintag.com http://www.acceleratingfuture.com/michael/blog/ <comment><USER2> WSJ, my local paper (The Phoenix), & <http://watrcoolr.us>

</comment><comment><USER3> I read StraightDope.com from time to time. Some pretty interesting stuff turns up there.</comment>


Researchers, Traders and Energy Funds - <AUTHOR> https://www.bloomberg.com/view/articles/2017-07-17/researchers-traders-and-energy-funds <comment><AUTHOR> > But who will pay cash for the SAFE token at the formula price? I don't know! > The point is that we're all having fun.

> It feels sort of appropriate that the two big risks to the tech industry are > (1) that many tech startups are essentially unambitious repackagings of low- > tech grocery-delivery businesses and (2) that tech firms will build robots > so advanced that they will take over the world and destroy human > civilization.</comment>


China hospital demolished 'with people inside' - <AUTHOR> http://www.bbc.com/news/world-asia-china-35262802 <comment><USER2> My reading of the article is that the bodies were already-deceased bodies in the morgue. Not a good thing of course, but the title implies that people were alive inside.

<comment><USER3> While nobody died and the morgue did get hit, there were definitely people inside:

 _However, hospital officials said three doctors and a patient were in the building at the time of demolition, and that some hospital workers were injured when they tried to stop the demolition, Jinghua news reported._

<comment><AUTHOR> Moreover, one photo shows what appears to be an X-ray machine tipped over.

Demolishing a building with non-decommissioned radiology equipment present isn't exactly the best idea.</comment></comment></comment>


A year on: Flash still not on the iPad, and that's still a good decision - <AUTHOR> http://www.itworld.com/personal-tech/167413/year-flash-still-not-ipad-and-thats-still-good-decision

<comment><USER2> Click to Flash is the ideal middle ground for mobile devices. Only load the Flash when the user explicitly requests. 90% of the time, the user won't notice the Flash missing, the other 10% it is available on request. That solves the issues of 1) Flash in the background draining the battery or exploiting security holes and 2) the annoying advertisements.

It's great to have Flash there when you need it. So many sites still have integral Flash content.

<comment><USER3> That doesn't address the user experience when interacting with the apps written for desktop computers on a tablet, which was one of the core complaints.

The truth is that interacting with applications written for a different platform sucks. It sucks especially for Flash because Flash was generally used to build interactive applications that HTML/JavaScript couldn't. However, it isn't confined to Flash. I've had HTML5 apps that expected mouse/keyboard usage that couldn't be replicated on a tablet and they sucked, too.

<comment><USER4> I'd rather have a poor user experience than a zero user experience.

<comment><USER5> This will be bad for device manufacturers though. Many users will think "iPad with Flash still can't use lots of Flash" when many Flash sites depend on things such as mouseovers and other events that don't make sense on a touchscreen UI. We would know it's the site's fault, but it'll give iPad/Android/etc. a bad image.

</comment></comment></comment></comment><comment><USER6> I've used flash on 2 Android devices. My experiences so far:

* On my Nexus One: Yes, flash is to slow to be worthwhile, and input tends to be awkward on the small screen anyway. Uninstalled.

* On a Xoom (running 3.1): I just downloaded flash last week to watch a couple episodes of Legend of Neil while I was at lunch. Playback was great, about what I would expect if I were using a small screen netbook or something like that. I was quite glad I had the _option_ to use flash. My browser is set to only load plugins on "click", so I get the best of both worlds really (not sure if that was the default or not). Flash only loads when I want it to, but it's there if I _do_ want it.

<comment><USER7> I must echo the experience with Flash on the Xoom running 3.1. Performance is, finally, quite acceptable.

<comment><USER8> How is it on battery life?

<comment><USER9> Probably about the same as if you played that video with some other technology.

</comment></comment></comment></comment><comment><USER10> He even acknowledges in the report that he hasn't tried Android 3.1, in which the main claim to fame is that Flash doesn't suck.

If you're going to write an inflammatory article, can you at least test against the latest version, especially when the main improvement in the latest version is on the thing you're testing?

<comment><USER11> > in which the main claim to fame is that Flash doesn't suck.

Sorry, didn't flash suppose to stop sucking in 2.2, 2.3 and 3.0? Sorry, I'm just curious, not flaming.

<comment><USER12> Surely the article ought to simply be one word: "yes". Apple made its decision in __2007 __. If and when flash really stops sucking (performance, UX, and security wise) and users demand it, perhaps Apple will reconsider. Since the likelihood of two of these three things is almost zero...

</comment></comment></comment><comment><USER13> Yes, because the only use for Flash is games. /sarcasm

No, I use Flash on my Android for those idiotic sites that use it as an integral part of the site. iPads can't go to those sites, but I can.

I agree that it's a dog and far too slow... But I only use it when I have to.

<comment><USER14> In the past month or so, I've had friends with iPhones ask me several times to look something up because the website they were checking (restaurant sitesin a couple of case, and a local band site in another) used a Flash menu or splash screen. It's obviously idiotic for the website designer to do such a thing, but it's extremely common. I gloat a little every time an iPhone user has to ask me to do something on my Android phone.

<comment><USER15> The greatest gift Steve Jobs has given web developers is a cast-iron reason to give clients why doing their navigation in Flash is a bad idea.

It's saved me hours over trying to explain the proper reasons.

<comment><USER14> You believe restaurant owners are calling up web developers, and saying, "Hey, we need a new website. Make it with Flash."? And that the web developers are trying to convince them otherwise? No. The responsible party for the abomination that is Flash websites lies mostly with web developers. I've even met a few of them over the years. They use Flash because it is easy/cheap/fast to produce flashy (pun incidental) websites. Some of them also like it because it means the client has to call them for updates to the website, even trivial ones.

Restaurant owners are victims of Flash websites, just like end users are. They just don't know enough to know it.

I hate Flash as much as anyone, and I'm glad Jobs refused to put it in the iPhone, whatever his reasons, because it means Flash is losing its stranglehold on some kinds of site faster than it otherwise would have. But, in the meantime, my phone can visit those sites, while iPhones can't.

<comment><USER15> In my experience no. Clients know what Flash is and they will specifically ask around for a 'web designer' who 'does Flash'.

Heck. I've even got a client who tells me to put some jQuery on the site to jazz it up a bit! He didn't seem too impressed when I billed him for optimizing my array access code using jQuery.each()...

</comment></comment></comment></comment></comment><comment><USER16> I can't speak to tablets, but its great to have on my phone. I'll routinely pull up things like espn3 when wanting to watch a game when I'm not at home. For that, it works wonders.

<comment><USER17> Same for me with stock price charts.

<comment><USER18> Same for me with Lexulous on Facebook, and some Web sites.

If I load up a restaurant web site, chances are it'll be at least partly in Flash. Flash may not be perfect on my HTC Desire Z, but it gets the job done and I appreciate that.

</comment></comment></comment><comment><USER19> I have been using a galaxy tab 10.1 for the last two weeks, and flash was one of the first apps I installed. As the founder of a hybrid html/flash site, I have been sorely missing the opportunity to demo my work on a tablet - but I was elated by the performance of flash on my tablet. What Jobs said is partially true - I use flash exclusively for video. Fortunatly, the user interface is html/js - so 'porting' to the tablet is a matter of adding a few event listeners that respond to 'press in addition to 'click.

</comment><comment><USER20> I find the all-or-nothing articles about Flash to be tiresome. No, flash is not as good on phones as native apps. No, you can't load up a flash video or game and know with certainty that it will work well. But yes, you can watch most videos you find floating around with reasonable framerate, and yes there are sites which have games that work pretty good (Kongregate is one). I used to watch Conan on my Nexus One in bed all the time and it worked fine. That not cutting edge hardware.

Do we have to say something is "worthless". Is the line between worthy and worthless so razor thin? Why can't we just say something is merely ok, or it's hit or miss?

</comment><comment><USER21> If Flash doesn't work on the web then people won't use it.

But it's my _choice_ whether to use Flash or not, and to decide whether it's useless, a bit useful, or absolutely vital. It's not for someone else to make that choice for me.

<comment><USER22> Agreed. I will never install it on any device I own, but I appreciate being treated like an adult rather than being told "You'll put your eye out!"

</comment></comment><comment><USER23> I do not use flash on my Atrix. It is slow, and it sucks to use. The only legitimate reason to use it is to have access to video streams that are not YouTube. However, last I checked, streaming video in a supported codec to a mobile device was a solved problem. Maybe some sort of a standard would emerge that would allow video hosting sites to not have to use Flash. I feel that it should have the number 5 in it somewhere. Maybe starts with HTML... </sarcasm>

I have Flash support on one of the fastest phones in the US. Watching Hulu is _so_ painful that it is useless. I don't care if Adobe wants to give me the choice. However, I wish more sites would learn to not rely on it.

<comment><USER24> The problem is that encoding in multiple codecs is prohibitively expensive, and it's an ongoing cost that businesses smaller than Youtube don't want to pay. Therefore the most cost effective solution is to use Flash since you can't deliver high quality video in a single codec to all PC users without it.

You lose iPad, but at least the codec you're using allows you to deliver HTML5 video there fairly easily. The point is your stuck with Flash unless you want to incur a cost per video of encoding multiple codecs, and in many cases this can't even be automated effectively without a human being involved.

<comment><USER25> > The problem is that encoding in multiple codecs is prohibitively > expensive...

So encode it to H264. It'll work in most browsers natively, and Flash reads it fine as a fallback.

<comment><USER23> Exactly. That's what I meant by "solved problem". Alternatively, start supporting WebM: [http://blogs.adobe.com/flashplatform/2010/05/adobe_support_f...](http://blogs.adobe.com/flashplatform/2010/05/adobe_support_for_vp8.html)

<comment><USER3> WebM would not help you at all if you only want one codec, unless youre comfortable losing every iDevice immediately. If you want one codec, it's H.264. Native support on iOS and Android devices, and you can support Chrome via Flash (which is seriously making me think about switching back to FireFox).

<comment><USER26> (Note that Firefox, as well, does not support H.264 for many of the same reasons — and never did.)

</comment></comment></comment></comment></comment></comment><comment><USER27> I know Apple was hoping that not supporting Flash would make everyone provide alternate avenues to their content but I don't really see it. Just "you need Flash to view this" and I wish I had even a somewhat buggy Flash version over nothing.

<comment><USER28> My experience has been the opposite (though I don't for a second doubt yours): I've been surprised by a) how few things I missed having Flash for when I first started not having it and b) how many _fewer_ things I miss it for in 2011 than when I first started not having it - it used to be that I felt like I couldn't watch video on the web on my iPhone... now when I hit a site that doesn't have HTML5 video I'm surprised (and think poorly of the site rather than of my device).

<comment><USER20> I don't think iOS shows the missing plugin box like it used to. It seems that now it just shows an empty box, which makes it look like you're seeing everything. Can someone confirm that they changed this on a software version at some point? It's my experience on the iPad. When I first got it I would run into 4 or 5 sites a day where I couldn't watch the video. I don't experience it as much now because I've trained myself not to follow links to videos at all unless it's YouTube.

</comment></comment></comment><comment><USER29> For my two phones (HTC Hero, HTC Desire) it's always been rubbish: not touchy, seconds-per-frame, not fullscreen, frequent massive updates. I've now uninstalled it as of two months ago.

</comment><comment><USER30> I still find Flash useful on my Atrix for watching video-on-demand services, but its ability to use a touch-centric interface is atrocious. Not horribly upset that it isn't on my iPad.

<comment><USER31> The multi-touch APIs are relatively new in Flash Player. Hopefully that will improve as developers work against those as well as the mouse-centric APIs that have been used traditionally.

<comment><USER32> No, hopefully it will just go away. Flash should be considered legacy at this point, we shouldn't be developing new dependencies when we're finally getting movement on the HTML standard.

<comment><USER24> What high quality codec can I encode into such that all common browsers will be able to view HTML5 video right now?

Also, YouTube doesn't default to HTML5 video for browsers that support Flash. Why is this?

</comment></comment></comment></comment><comment><USER33> Totally disagree, I've used both the iPad and a Honeycomb tablet. I was able to watch so much more content with the Android tablet, stuff from blip.tv, custom players, even custom streaming video players. It's not as good as the desktop version, but it's a lot better than the Flash player on Boxee and others.

</comment><comment><USER34> There may certainly be issues with Flash on Android, but it's not useless on all tablets.

Flash works great on the Blackberry Playbook. When other developers ask me about the device, at some point I typically end up demoing Amazon streaming video. Most are quite surprised by how well it works.

</comment><comment><USER35> I really enjoy watching south park studios on my xoom. The controls are a little slow but the frame rate is smooth at hd resolutions.

</comment><comment><USER36> =>"A few minutes later I suggested that my co-worker buy his mom a netbook."

Since it was for a mom, it had to be Windows but if it's not windows, I would seriously want to defer the idea of buying even a netbook. It's not just the mobile devices and OS. It extends even further. Adobe could probably give genuine reasons for bad flash on Apple devices (they say Apple did not co- operate enough) but what stops them from making it better on Linux. There is no bigger pain than running flash on ubuntu. I run ubuntu 11.04 and my laptop turns off itself within 2 hours of running flash.

</comment><comment><USER37> Flash sucking on tablets, phones, or even netbooks (at least ARM based), isn't entirely Adobe's fault. The SoC manufacturers are tasked to get Flash working on their chipsets. That means nVidia, Freescale, TI, Samsung, Apple. Adobe's NDA for working on Flash is... well, restrictive. I'd bet that anyone who has signed it isn't going to be one of the companies top programmers, due to the nature of some of the restrictions in it.

<comment><USER38> Why is an NDA so restrictive that no developer with good outside options would sign it, not the fault of the company that has written it?

</comment></comment><comment><USER39> It's not really useless. The sweet spot is to disable browser plugins in the Android browser by default. And then only enable the Flash elements you specifically want. It works well for Hulu and whatnot.

Now, if the Android browser didn't let me disable everything by default, I would run screaming.

But with the scheme it has, it satisfies both camps, the people who don't want the encumbrance of Flash, and those who do.

</comment><comment> mike-cardwell Flash on my Viewsonic G-Tablet running Cyanogenmod 7, is fine.

</comment><comment><USER15> On my phone I can't say I use Flash, but it's come in very handy at times for (cough) legacy sites.

<comment><USER40> By "legacy" do you mean restaurant?

<comment><USER41> No, I'm pretty sure that he doesn't.

<comment><USER15> It really sounds like I meant porn, didn't it? It's really going to sound even more like that now, if I deny it, isn't it?

Damn.

</comment></comment></comment></comment><comment><USER42> I can't say anything to tablets with flash just yet, but it works fantastically on my G2. Every site I've ever tried works perfectly, and quickly, even with the g2 having a previous gen CPU (single core). I can't imagine why it would not work on a tablet as well as it does on my phone.

I read the article, and it's kind of annoying that the OP makes this judgement based off of facebook games. It doesn't sound like he made much effort at all. It sounds more like that he's trying to reinforce or convince himself that the lack of flash on ipad isn't a shortcoming. I guess this goes well with the Apple religion articles I've seen lately.

</comment><comment><USER43> The title is a strawman. I don't think it's particularly controversial to say that flash sucks, and Apple is technically justified in not supporting it on their devices.

But that's not what the issue was. The real controversy was Apple's decision (via a revision of its developer agreement) to ban the Adobe flash-to-iOS translator. _That_ is a huge problem, and I don't see how "Flash sucks on android, see?" has any bearing on it.

<comment><USER44> That may be the controversy _you_ are concerned about, but for many, the key controversy has been Flash in the browser using a plug-in. Some concrete examples:

[http://www.gottabemobile.com/2010/02/21/my-take-on-the- flash...](http://www.gottabemobile.com/2010/02/21/my-take-on-the-flash- controversy/)

[http://www.roytanck.com/2010/02/28/my-thoughts-on-flash- and-...](http://www.roytanck.com/2010/02/28/my-thoughts-on-flash-and-the- ipad/)

<http://mashable.com/2010/01/28/flash-ipad/>

So talking about the Flash plug-in isn't a straw-man or a made-up controversy, it has been a real point of debate.

Note also that the terms of the developer agreement changed in a way that apparently allows the Flash cross-compiler, so the controversy you are concerned about has now been resolved:

[http://www.fastcompany.com/1687857/did-apple-just-open- the-d...](http://www.fastcompany.com/1687857/did-apple-just-open-the-door-to- adobe-flash-on-iphones)

All told, I think it was unfair of you to whip out the straw man accusation.

</comment></comment><comment><USER45> I'm quite fine with no Flash on iOS, too. I never use it on Android - Jobs is right when he says the interfaces for Flash apps don't work well on touch screens, and I can't think of any sites where it's required. I guess it's nice to know it's there on Android if I need it, but I never miss Flash when browsing on my iPod.

</comment><comment><USER46> Gah,I love my iPad but I am constantly annoyed by the lack of flash. There are more and more videos embedded in web pages and it is only getting worse. Something has to give and I think I will sooner move awaymfrom the iPad than the rest of the world will stop using flash for video.

</comment><comment><USER47> On a related note, has anyone been able to compare the performance of apps built using the Adobe exporters (iOS and AIR for Android) vs. apps developed in the native languages (Objective C and Android SDK)?</comment>


Facebook plans to launch 'GlobalCoin' currency in 2020 - <AUTHOR> https://www.bbc.co.uk/news/business-48383460 <comment><USER2> The _only_ crypto that made me think it might work was JP Morgan's coin where they (a trusted third party) pegged each coin to an equal amount of dollars

Something like this (it's not clear if it is a pegged or just out there coin) from something with Facebooks reach would be ... potent.

If they just have some other floating coin, who cares. But if you deposit 100 bucks with FB and then can spend it anywhere anywhen. yeah Inthink that might be game changing.</comment>


The Pixel Factory - <AUTHOR> http://acko.net/files/gltalks/pixelfactory/online.html#0 <comment><USER2> _Any one_ of these diagrams is the sort of thing that in one fell swoop demonstrates a principle and how something works, where a lecturer at Uni may spend twenty minutes with a couple of diagram and plenty of hand gestures and produce an inferior result. The _combination_ of them all together makes this the sort of thing that would be a superb basis for more complete educational/training materials.

<comment><USER3> The thing is, a lecturer spends 20 minutes doodling this and can explain most of the same, especially if there is some ability to directly interact with the audience and clear up misconceptions. Maybe in the worst case a good lecturer takes twice as long to get the explanation across. If need-be, the lecturer can elaborate on any piece, or draw a completely new picture as the situation demands.

By contrast, making the fancy animated version takes 20 hours, plus another several hundred hours (or perhaps 1-2 orders of magnitude more) to build the framework underneath. Even better would be to make interactive explanations, but that would take dramatically more work than even the animated version.

If someone can spare the time to do it, it obviously has tremendous value, but each animator can only explain a tiny number of things in this medium, compared to, say writing a whole book with the same amount of effort. It's similar to the contrast between telling hundreds of stories around the campfire or writing a novel vs. animating a few minutes of a Disney film.

Ideally we'd have ten thousand skilled animator/programmer/educators working on creating such explanations, sharing tools and ideas, coordinating effort to build more complete curricula, etc., but there's not currently anyone paying them to do it, so today there are only a handful, working as volunteer hobbyists. There's no incentive for current educators (say, college professors or high school teachers or textbook authors) to spend their time making this kind of thing, since it's not an established and recognized genre yet, and a vanishingly small proportion of them have the requisite skills.

<comment><USER4> Honestly this presentation didn't work for me. I was amazed at the spectacle and a few things like perfect math world vs pixels and multi-sampler helped explain a few things but over all it was all over the place and didn't seem to get to many points or insights. It seems more like someone was asked to do a presentation, didn't have a solid idea of what to talk about, and so threw together a bunch of stuff until it filed their allotted time.

I'm not trying to be discouraging. A great presentation can go a long way to making things understandable. For example this video explaining jpeg worked for me [https://www.youtube.com/watch?v=Q2aEzeMDHMA](https://www.youtube.com/watch?v=Q2aEzeMDHMA)

My point is only that fancy graphics and animation are not enough. The presentation actually has to get it's points across. Maybe this one worked for everyone but me but it didn't really work for me. I don't really know what to suggest to make it better. Maybe it all made more sense live with more talking.

There were a few "bugs" For example slide 22, bi-linear filtering, pixels can't be 2 colors so that slide made no sense.

On the positive side I would love to know what software to use to make presentations easy. Yea, I get the author made his own but in general, making animation is hard work. Worse, once I've made them, even if they didn't end up being good for explaining I put so much work into making them that I can't justify starting over for something that works better. So, anything that would make that process not be so much work would be amazingly helpful.

<comment><USER3> Try the lecture: [http://acko.net/tv/webglmath/](http://acko.net/tv/webglmath/)

</comment></comment></comment></comment><comment><USER5> See also the same author's presentation "Making WebGL Dance, or How I Learnt to Stop Worrying and Love Linear Algebra".

[http://acko.net/files/fullfrontal/fullfrontal/webglmath/onli...](http://acko.net/files/fullfrontal/fullfrontal/webglmath/online.html)

(Shares some slides with the new one)

</comment><comment><USER6> Great job, Steven. I don't think I have ever seen anything like this before on the web. This was extremely fun to watch/read. I'll be taking a look at MathBox.js and see if I can build something fun with it as well.

<comment><USER7> If you haven't seen his website front page, it's well worth a look too: [http://acko.net/](http://acko.net/)

I think it's been on HN before, It was the first WebGL site I've seen that _just worked_.

</comment></comment><comment><USER8> > Note: these slides have not (yet) been optimized for low-end GPUs or mobile.

Wow, yeah. I'm using an old laptop with Ubuntu. Firefox ground to a halt, crashed and then my computer spontaneously rebooted.

<comment><USER9> Yeah, it's a bummer. I have a desktop a bit on the low-end (though I don't usually have problems), and Firefox hung on me, even the music playing in another tab started getting jerky. Didn't get to see the slides :(

</comment></comment><comment><USER10> Exceptional visualisations! At least for me, seeing things like the camera zooming so it's placed between the perfect-vector world and rasterised world just makes it so clear. A picture is worth a thousand words, but a visualisation like that may be worth ten thousand.

</comment><comment><USER11> This is incredible. I've learned a lot of this before, but without the awesome slides, but this presentation makes most of it so easy to understand that it becomes _obvious_ that that's how these problems should be approached.

It really does go to show how much of a difference presentation goes to aid learning and (more importantly) understanding.

</comment><comment><USER12> That's beautiful. WebGL makes you realize that all the "designers" fooling around with CSS are playing in the kiddie pool.

Of course, as soon as you use WebGL, users expect the visual quality of an AAA game. What you tend to get is crap like this.[1] It's possible to get the GPU to do great things for you.[2] But that's a programming exercise. Good 3D content is expensive. Most of the WebGL demos available either have very little content, or are recycling old video games.

All this technology, already deployed, and little good content for it.

[1] [http://montagejs.github.io/beachplanetblog/](http://montagejs.github.io/beachplanetblog/) [2] [http://madebyevan.com/webgl-water/](http://madebyevan.com/webgl-water/)

<comment><USER13> WebGL has some other, less-flashy uses.

I've worked around some really shitty canvas performance by switching to a WebGL backend, because of dumb memory leaks on IE.

</comment></comment><comment><USER14> A picture might be worth a thousand words, but animation is worth a thousand pictures.

The way animation illuminates an understanding of the holistic wholeness rather than the discrete part normal education teaches, is so underutilized in education.

Heres to hoping someone soon will specialize in creating animated educational material.

</comment><comment><USER15> What does this guy do for a living? Research, teach? Develop? Whatever it is, I'm amazed he has time to make these incredible 3D presentations.

</comment><comment><USER16> I am teaching Computer Graphics for about the 15th time this fall. I have always wanted to to an animation of the GL pipeline -- I think it would explain a lot -- maybe this will inspire me to do so.

The problem, is soon as I finish, the pipeline will change, technology will switch, and it will soon be archaic. This is a huge amount of work!

I applaud the herculean effort and great result.

</comment><comment><USER17> This is great, I'm a complete noob and I learned a lot! Something that I didn't understand though is how sampling rate and the justification for Apple's Retina are related (slide 31). I probably just don't know enough about either, but I'd greatly appreciate it if someone could explain. :)

</comment><comment><USER18> My mind is totally blown.

Does anyone know if the author has written or presented on his workflow as he goes from idea, to concept, to rough draft, to finished product? I'd really love to learn how he goes about it... Pixel Factory was so dense and clear thinking, beautiful, intuitive. Wow.

</comment><comment><USER19> Great presentation, although I didn't finish it because the load times between steps got to annoying (it seems like they only load when you switch to the next slide, instead of preloading at least the next one or two slides)

<comment><USER20> Yeah, my issue isn't loading times. But the need to press a button (a small button on my phone) for the next slide instead of using a swipe gesture.

It's still a great well crafted presentation. I've been given a much better understanding of some graphics concepts than I otherwise would. Will definitly come back and finish it.

</comment></comment><comment><USER21> Impressive and really efficient presentation (not surprising from Steven Wittens).

</comment><comment><USER22> Great presentation, however I must say the transition effect on texts are a bit too much. As soon as they appear I try to read them but they move around for a half second. A bit annoying

</comment><comment><USER23> Wow this is incredible stuff. I work with shaders everyday so have an understanding of the concepts discussed, but I've never visualized them like that! Really captivating.

</comment><comment><USER24> Amazing! :D Learned a lot about pixels

</comment><comment><USER25> These slides are the best way to learn graphics! It also shows the true potential of the web !!

</comment><comment><USER26> Sigh. Running the latest Fedora on an AMD A10 with Firefox and this barely works at all.

<comment><USER27> It blocks my latest FF on a 3-year old Mac Mini with 4GB or memory. That's not much, but that's not ancient technology, either.

</comment></comment><comment><USER28> As with previous presentations, the author has struck educational gold so to speak.

</comment><comment><USER29> I feel lucky I get to watch these slides at 5K resolution on my iMac! Amazing!

</comment><comment><USER30> Cool!

</comment><comment><USER31> Incredible work!

</comment><comment><USER32> The author of this is both a programmer and an artist. Totally inspiring work.</comment>


0.01% of Wikipedia as a printed book - <AUTHOR> http://www.labnol.org/internet/wikipedia-printed-book/9136/

<comment><USER2> Only 5,000 pages? I have books that are over 2,600 pages that don't even break 2.5" (eg Machinery's Handbook). Even using standard 20lb printer paper, my calculations don't have it breaking a foot. They must have used something like card stock, just to add shock value to it.

Seriously though, turning Wikipedia into dead tree media is something that should be taken more seriously. Without much effort, relatively interesting primers on subjects could be put together with relatively little effort. Think "Cryptographic algorithms" or "Battles of WW2" or "Countries of Africa" Collect and curate a selection carefully, and throw it up on some place like lulu.

<comment><USER3> <http://en.wikipedia.org/wiki/Paper_density#Conversions>

5000 pages of 20lb paper would be 0.485m tall.

2.5"/2600 = 0.024m, which looks like 4lb paper - seriously thin.

<comment><USER4> Even easier to visualize: a ream of paper (for example, what you put in your printer) is 500 sheets. So, stack five of those on top of each other, and you have 5000 pages (plus a little extra for the wrappers.

Needless to say, it's nowhere near the tower pictured in the photo.

EDIT: corrected "sheets" for my previous, incorrect "pages", which changed the number of reams to five.

<comment><USER5> No, but ten of those stacks might be a lot closer. Check your math!

<comment><USER4> I had ten originally, but then I was reminded that 1 sheet equals two pages (recto and verso). So, 5000 pages = 2500 sheets = 5 reams.

Even ten reams is significantly smaller than the tower pictured, though.

</comment></comment></comment></comment></comment><comment><USER6> I like the idea of demonstrating the impressive size of Wikipedia by printing a book. However, the article withholds important base information:

* Which paper format and size has been used? (Letter? A4?)

* How big are the page margins?

* Is it printed one-sided or two-sided?

* Which font and font-size have been used?

* What line-distance has been used? (100%, 150%, ... ?)

* What does the "0.01%" refer to? (to the number of words, or just to the number of articles?)

Without this information, the given facts like "5000 pages" are almost meaningless.

<comment><USER3> The latest results aren't available yet, but the most recent word count of _6 billion_ dates from Nov 09. 0.01% of that over 5000 pages would give 120 words per page. Something is missing.

Nor does the "0.01%" refer to the number of articles. The author's website says this is a printout of the (English) "Featured articles" (currently 3235). Neither dividing that by the number of English articles (3.6M) or total articles (18.1M) gives 0.01%.

So I can't see where they got 0.01% from.

<http://stats.wikimedia.org/EN/TablesWikipediaZZ.htm>

<http://en.wikipedia.org/wiki/Wikipedia:Featured_articles>

<http://www.rob-matthews.com/index.php?/project/wikipedia/>

<comment><USER6> Although I appreciate your effort, I don't think it makes any sense that we try figure this out on our own.

It's the task of the author, not the readers, to deliver those facts.

<comment><USER7> Some of the comments at the article site seem to be from the author. One of them says they selected 400 articles from the featured articles and at the time that was 0.013% of all the articles.

</comment></comment></comment></comment><comment><USER8> What I like most about Wikipedia is the random reading binges, where you get from History of Lithuania to Glass Onion (Beatles song), stop by at surface- to-air missiles and finish with the Carlsberg brewery.

Perhaps print-on-demand unique pre-made binges "100% guaranteed random subjects" are a business idea? As an alternative to newspapers in train station kiosks?

<comment><USER9> This. The choose-your-own adventure element to Wikipedia is what makes it so immersive.

</comment></comment><comment><USER10> Here is a twelve volume set consisting of the entire edit history of the "Iraq War" entry on Wikipedia.

<http://booktwo.org/notebook/wikipedia-historiography/>

</comment><comment><USER11> There's an easy way to print from the wikipedia or any wikimedia wiki:

<http://pediapress.com/>

It's also open source, video here: <http://www.youtube.com/watch?v=D1K03AZfpDM>

</comment><comment><USER12> For a different axis, see also: <http://booktwo.org/notebook/wikipedia- historiography/>

<comment><USER13> I heard about this back when it was released. IMO a much more interesting reading. I heard the guys behind it have other projects.

That kind of book provides a view on the events never before available. It's a condensed testimonial about a globalized/globalazing society and its many cultures.

</comment></comment><comment><USER14> He could have separated the book into different volumes and alloted different books for different topics. Would have made his and the reader's life easier

</comment><comment><USER15> Wow, how short is that guy standing next to it, if the book is only 19 inches high? It comes up to his knees!

</comment><comment><USER16> "Think of the trees!" -Unless</comment>


Protowire – Adds prototyping to Sketch - <AUTHOR> https://protowire.com?utm_source=hackernews&utm_campaign=launch <comment><USER2> This looks awesome for prototyping.

You should re-post this as a "Show HN." I think lots of folks would be interested in it.

[https://news.ycombinator.com/show](https://news.ycombinator.com/show)</comment>


I cloned a Letterpress app in Web - <AUTHOR> http://rollingword.com/app#matrix still simple, lacking lock tiles. <comment><USER2> Unfortunately, I can't read the buttons - can you offer an English version of those?

<comment><AUTHOR> left one is login in by google right one is login in by tencent(aka china facebook)</comment></comment>


Researchers "Translate" Bat Talk. Turns Out, They Argue–A Lot - <AUTHOR> https://www.smithsonianmag.com/smart-news/researchers-translate-bat-talk-and-they-argue-lot-180961564/ <comment><USER2> There was another group that studied insects and automated posture detection from video for them which allowed them to search for recurring behaviours and found a few different behaviours that the animals switched between, among them one that was hard to interpret which they called "Whatever" iirc.

I'll see if I can find a link.</comment>


SanDisk and Nexenta release open-source, flash software-defined storage array - <AUTHOR> http://www.zdnet.com/article/sandisk-and-nexenta-release-open-source-flash-software-defined-storage-array/ <comment><USER2> > Built on top of Oracle's ZFS, this scale-up, unified block (FC and iSCSI) > and file (NFS and SMB) storage solution runs on Linux

I thought Nexenta was Solaris based and not Linux?

<comment><USER3> More specifically, NexentaStor (the OS which was explicitly mentioned in the article) was at one point based on OpenSolaris, and subsequently switched to illumos when Oracle inevitably murdered the OpenSolaris project.

The article reminds me of people who try to claim that "Mac OS is a Linux distro".

</comment></comment><comment><USER4> _> Built on top of Oracle's ZFS_

Didn't OpenZFS[1] diverge from Oracle ZFS? Initially Oracle didn't want to continue their ZFS in the open and there was a split. I didn't really follow what happened to that split afterwards. Nexenta is using OpenZFS.

[1]: [http://www.open-zfs.org](http://www.open-zfs.org)

<comment><USER5> Correct - except Oracle didn't just close ZFS, they closed all of Solaris. And they did it in the most spineless way ever - they just stopped releasing code without ever bothering to address the community.

<comment><USER4> Yes, indeed. I was just focused on ZFS itself. There was a great talk about all that by Bryan Cantrill: [https://youtube.com/watch?v=-zRN7XLCRhc](https://youtube.com/watch?v=-zRN7XLCRhc)

He says what he thinks about Oracle there ;)

</comment></comment></comment><comment><USER6> Got $3,000,000?

They said the pricing is based on $1.5/raw GB, which means 3 mil for the 2PB configuration.

Maybe Santa can give me one for Christmas.

<comment><USER7> It's not great at the bottom end, either: 64TB raw for $96,000

Get a 24 x 2.5" 2U server, 3 8 channel SAS controllers, and 24 1 TB SATA SSDs. $15k or so will buy that. 3 of them are 72TB for $45K, so less than half the price, and certainly capable of saturating any network you can afford to run. Of course, if you just need 24TB, you can just buy one of the smaller machines.

You can fit it in one 4U machine with 72 x 2.5" disks for less money, but also less disk I/O, CPU, RAM and network bandwidth.

Is this "Big Data"? No, but neither was their 64TB config.

<comment><USER8> I wouldn't run nexenta any more, but your setup has no HA and no support.

<comment><USER9> You can run 3 x 24TB as a cluster, built for $45K, and get HA/failover... You can still run SmartOS/Illumos and ZFS for that matter... You should also be able to use any number of databases (Cassandra, RethinkDB, Cockroach) on there.

</comment></comment></comment></comment><comment><USER10> So, is this supposed to compete with the offerings from Pure Storage and Solidfire?</comment>


Encrypted web traffic now exceeds 90% - gator-io https://netmarketshare.com/report.aspx?options=%7B%22filter%22%3A%7B%7D%2C%22dateLabel%22%3A%22Custom%22%2C%22attributes%22%3A%22share%22%2C%22group%22%3A%22secure%22%2C%22sort%22%3A%7B%22share%22%3A-1%7D%2C%22id%22%3A%22https%22%2C%22dateInterval%22%3A%22Monthly%22%2C%22dateStart%22%3A%222019-10%22%2C%22dateEnd%22%3A%222019-10%22%2C%22segments%22%3A%22-1000%22%7D <comment><AUTHOR> We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end- to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ago. It's a great development (all the limitations and caveats notwithstanding) IMO.

<comment><USER2> Ironically, Telegram markets itself as the most private and secure messenger, but in reality, it's much less private than WhatsApp or Viber: any regular (non-secret) Telegram chats are not end-to-end encrypted - if they were, you wouldn't be able to access them from a new device after authorization with a password.

<comment><USER3> This marketing message always confused me: my techie understanding was that Telegram is actually one of the _least_ secure messaging choices. If you want security, my understanding is that your preferences should go Signal, Whatsapp, iMessage, Hangouts or whatever Google's flavor-of-the-month messaging app is these days, Telegram, and Facebook.

<comment><USER4> I was following you until Hangouts...

<comment><USER3> Google's security is still better than both Telegram's or Facebook's. It's not _great_ , but that's why it's #4 on a list of 6. If you care significantly about privacy & security I would not use anything worse than iMessage, and even that's borderline.

(Your opinion of whether Google or Telegram is better will likely also depend upon whether you think malice or incompetence is a bigger threat. Google's business model relies upon it snooping on you, but they have _really, really good_ security people ensuring that nobody else snoops on you. Meanwhile Telegram has less of incentive to actively violate your privacy, but they may let other parties violate your privacy by passively fucking up their engineering. They've done stuff like roll their own crypto algorithms, which is a terrible no-no for anyone that cares about security.)

<comment><USER5> How is iMessage worse versus Hangouts? Is Hangouts even end-to-end encrypted? IIRC it isn't, neither is Google Chat (a product which is replacing Hangouts from what I can tell), just Allo and Duo.

<comment><USER6> That's not what they said; they've said that iMessage has better security than Hangouts, and that this user wouldn't use anything "worse" ie. further down on their list than iMessage

<comment><USER7> It is worse in that Hangouts does not make false claims about its security, so people who use it know that they are using it for features provided by the kind of security it provides (only between the user and Google), like searching chat history across devices.

iMessage can also only guarantee security between the user and Apple due to Apple distributing the public keys (but to a lesser extent because it uses worse crypto), but it does not provide the usability features like searching full chat history across devices that Hangouts does.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I don't know why so many people here are patting themselves on the back over this. This is not the kind of encryption people were talking about in the 90s and 00s. A lot of this encryption is not point-to-point. It merely secures user's interaction with some middleman (or their server). What would the numbers be if you subtracted all the traffic that can be snooped on by Google, Amazon and Cloudflare?

<comment><USER9> What are you talking about about? I think you better look up how https/tls works??? Sure you have to trust the certificate authority. Also can you imagine the scandal that would erupt if Google or AWS cloud was discovered to be eavesdropping on companies running things in their cloud? I don't think so.

<comment><USER10> > can you imagine the scandal that would erupt if Google or AWS cloud was > discovered to be eavesdropping on companies running things in their cloud

Remember the "SSL added and removed here" image?

[https://thumbs.mic.com/MTBjNTQzNTMzZiMvbWVtejZOdjJsaUdUVkZEa...](https://thumbs.mic.com/MTBjNTQzNTMzZiMvbWVtejZOdjJsaUdUVkZEa3I1cVgyVkRjTlFFPS8weDQwOjQ5MXgzNDkvODAweDQ1MC9maWx0ZXJzOmZvcm1hdChqcGVnKTpxdWFsaXR5KDgwKS9odHRwczovL3MzLmFtYXpvbmF3cy5jb20vcG9saWN5bWljLWltYWdlcy9kMjg1N2Q0MzliNGEwMDcyNmQwMzYwMGVjMTEzMzdkMjA2MDE4MWM2OTIzYjliN2NmYzc5ZGIyMjkxNDMwOWY0LmpwZw.jpg)

<comment><USER11> That wasn't eavesdropping by Google. That was Google not using encrypted traffic on internal wires. And that changed a lot of years ago.

<comment><USER10> Yes, it was the US government eavesdropping for them without their consent, but the end result is basically the same.

Yes, that exact hole was patched, but the point is it wasn't the end of the world that great grandparent implied it would be.

<comment><USER7> Google Compute Engine didn't even exist at the time that slide was made, or at least was not publicly available. That slide was about government intercepting Google's traffic, not cloud customer traffic.

<comment><USER10> It was certainly smaller, but GCE was first publicly available in April/May 2013, Snowden leaked things in June 2013. I'm not quite sure when this slide was released but sometime after that.

Google moved to fix the problem after the start of the leaks. Pretty quickly (good for them), but after.

<comment><USER7> The slide was created long before Snowden leaked it, which is before GCE was publicly available. I said, "before the slide was _made_ ," not "before the slide was _leaked_."

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Good news for sure, but note that this isn't a total Internet scan:

> We collect data from the browsers of site visitors to our exclusive on- > demand network of analytics and social bookmarking products.

More details about their samples: [https://netmarketshare.com/methodology](https://netmarketshare.com/methodology)

I would be more inclined to trust sources like [https://transparencyreport.google.com/https/overview](https://transparencyreport.google.com/https/overview) and Firefox Telemetry which come directly from the browsers. But even these do not count data from mobile apps (most of which have to be encrypted now I think), embedded applications, scripts, and APIs.

<comment><USER13> > from mobile apps (most of which have to be encrypted now I think)

Since the end of 2016 on iOS and since Android v9, apps _have to_ communicate over HTTPS. I guess you can technically visit HTTP sites via a browser, but I'd bet that >90% of the traffic from smartphones is over HTTPS.

<comment><USER11> > since Android v9, apps have to communicate over HTTPS

That isn't true. It is the default but Android lets you override the defaults and use unencrypted traffic both in WebViews and in networking APIs.

<comment><USER14> It's not true in iOS either. It's possible for an app to whitelist specific domains.

</comment></comment></comment></comment><comment><USER15> Also likely because in the past the internet was really diverse. One would visit 20 sites possibly during one session.

Today, the landscape looks more like: You visit Google, click some links that open in AMP (still Google), visit some social networks (primarily Twitter and FB-owned properties). These companies already operate TLS-only, which helps these numbers.

<comment><USER16> Right. Encrypted web traffic at 90% is different than encrypted web sites at 90%.

<comment><USER17> When netflix is half, torrent traffic included add in google/facebook/faangs and you arrive at 90% easily.

<comment><USER18> I thought torrent traffic was generally not encrypted.

<comment><USER19> Not to mention the world-class encryption used by torrents is RC4. It would be hard to pick a worse cipher (the encryption protocol was designed in 2006).

</comment></comment></comment></comment></comment><comment><USER20> That's good. One structural issue with the internet down, many more to go. There is essentially no guarantee that cloud providers don't snoop through memory and steal your keys and sift through your data, for instance. There are just some big companies that we implicitly trust. Whenever the endpoint for encryption /decryption is under the control of a 3rd party, any guarantee of data safety isn't real. We have devices that constantly go out looking for new code to run, with proprietary blobs in firmware, which means they're 3rd party controllable. Control of the internet is in the hands of organizations that can't be held accountable for abuse of power over individuals.

I guess I'm just saying I don't have faith that a system (I'm talking about the intersection of technology, government, and business here) which puts so little power in the hands of individuals will do an adequate job of serving their interests in the long term.

</comment><comment><USER21> We do need HTTP because sometimes public WiFi networks need you to agree to terms before any requests stop being redirected. I recently found [http://neverssl.com](http://neverssl.com)

That being said those public WiFi's shouldn't be redirecting sites in the first place because for HTTPs sites browsers don't even let you see the page.

<comment><USER22> [http://http.rip](http://http.rip)

<comment><USER23> I personally prefer [http://example.com](http://example.com) as is it is explicitly http-only, adminitred by IANA.

It boggles my mind that we haven't yet agreed on a signaling mechanism at the AP level (DHCP?) for signaling captive portals, as this seems to be quite a common use-case.

</comment></comment></comment><comment><USER24> Awesome! Any idea how much of that is attributable to LetsEncrypt and HTTPSEverywhere?

<comment><USER25> Is a LetsEncrypt certificate "just as secure" as other certs? I have to imagine the answer is "no" simply because LetsEncrypt is free and the other certs aren't -- what more do you get by paying for a cert?

<comment><USER26> It is just as secure, you get nothing more by paying.

<comment><USER27> So for my personal projects, I use lets encrypt. As far as I know (and I could be wrong now, haven't checked in a while) - their certs are _only_ good for 3 months. Which is simple enough to get around - run a script on your box that updates the cert every 90 days automatically.

At work, we use a paid certificate that is good for a longer period of time (normally a year). So that's one benefit to paying, I suppose.

As far as encryption technologies and security, the traffic encrypted by a lets encrypt cert is just as secure as the traffic secured by a paid-for CA signed cert.

<comment><USER16> The fact that Let's Encrypt certificates expire quickly is a feature, not anything to do with paid vs. non-paid.

Let's Encrypt could have just as easily generated certificates good for a year or more. But the point of Let's Encrypt is to force you to do this in an automated way, using scripts like you suggest.

You're not getting around anything. The choice was by design.

[https://letsencrypt.org/2015/11/09/why-90-days.html](https://letsencrypt.org/2015/11/09/why-90-days.html)

</comment></comment></comment></comment></comment><comment><USER28> While this milestone is wonderful, don't forget that it can't be decrypted _for now_. IMO we trust contemporary encryption algorithms too much, putting too much data through the wires that will only increase in value. We aren't at the end of the evolution either: we still don't have really secure random generators everywhere, we are still using key exchange methods that aren't quantum proof. And of course, computer programs (as well as hardware) still have security bugs.

<comment><USER29> Encryption is worthless without properly enforcing it. How easy is it to trick your victim's bank into granting you access with a SIM swap? We need 2FA everywhere and stop relying on SMS for authentication.

<comment><USER30> I agree that we need 2FA and that we shouldn't rely on SMS. That said, saying encryption is worthless because other threat vectors exist is a bit hyperbolic. Security is all about defense in layers. There's several orders of magnitude difference in the difficulty of performing a SIM swap attack vs sucking up passwords on coffee shop wifi.

</comment></comment></comment><comment><USER31> This doesn't mean 90% of all websites. This simply means 90% of web traffic which I'm assuming a good chunk of it comes from a few handful of services such as Netflix and YouTube

<comment> dr-detroit most of the traffic is people watching people play videogames

</comment></comment><comment><USER32> No, it didn't. NetMarketShare has a very limited view into these things. Actual data from browser makers

Firefox - 80% [https://letsencrypt.org/stats/](https://letsencrypt.org/stats/)

Google -- 88% on Android; 84% on Windows; 91% on Mac; 73% on Linux [https://transparencyreport.google.com/https/overview?hl=en](https://transparencyreport.google.com/https/overview?hl=en)

</comment><comment><USER33> I actually just set up SSL on my EC2 instance after reading this comment section. It was stupid easy, and I can't believe I didn't do it before

</comment><comment><USER34> Nice. Remember the days when IT professionals would exclaim that this was a bad idea?

Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.

<comment><USER35> No, haha. When was that a thing?

<comment><USER36> Back in the 1990s and early 2000s, it was very common to have "transparent proxies": your router or the ISP's router was configured to transparently redirect all connections to TCP port 80 to a Squid caching proxy or similar running on a nearby server. This meant that images, CSS, JS, or even whole pages (the web was much less dynamic back then) were transparently cached and shared between all users of that router. That could save a lot of bandwidth. Encrypting the HTTP connections completely bypassed the caching proxy; to make it worse, IIRC some popular browsers didn't cache the content from encrypted connections as well, so every new page view would have to come from the origin server. Obviously, the IT professionals which set up these caches didn't like it when most sites started switching to HTTPS, since it made the caches less useful.

<comment><USER37> A common problem back then with those caches back then was that in their common configuration they would limit the maximum upload size to a few megabytes... which would manifest itself as a broken connection when such an upload was attempted.

We regularly had to tell customers "can you try whether uploading works with this HTTPS link? now it suddenly works? okay, use that link from now on and complain to your network admin/isp"

</comment></comment></comment></comment><comment><USER38> The 50-50 point appears to have only been June 2017, so the cutover rate is really quite rapid. I wonder how quickly we'll see 95%, 99%, and how long the long tail will be.

[https://netmarketshare.com/report.aspx?options=%7B%22filter%...](https://netmarketshare.com/report.aspx?options=%7B%22filter%22%3A%7B%7D%2C%22dateLabel%22%3A%22Custom%22%2C%22attributes%22%3A%22share%22%2C%22group%22%3A%22secure%22%2C%22sort%22%3A%7B%22share%22%3A-1%7D%2C%22id%22%3A%22https%22%2C%22dateInterval%22%3A%22Monthly%22%2C%22dateStart%22%3A%222017-05%22%2C%22dateEnd%22%3A%222017-06%22%2C%22hiddenSeries%22%3A%7B%7D%2C%22segments%22%3A%22-1000%22%7D)

</comment><comment><USER39> One thing we recently started looking at is outbound traffic, i.e. links that people click within our website/app. We're going to publish some results (and joint forces) soon, but I wanted to share here because I feel outbound links are something usually ignored. Yet they can contribute to a significant part of the total Internet traffic.

So, upgrading outbound links from http to https (where possible) can be another way to contribute to achieving 100% of the web traffic encrypted.

</comment><comment><USER40> The Federal Government may not like this but this is heading to as it should be. Sometimes the government needs to be saved from itself!

<comment><USER41> Governments can force CAs to give them certs. HTTPS only stops non-government attackers.

<comment><USER42> They would be killing the CA by doing this, since all certs have to be publicly logged in order to be trusted by Chrome or Safari: [https://en.wikipedia.org/wiki/Certificate_Transparency](https://en.wikipedia.org/wiki/Certificate_Transparency)

If a minor CA suddenly issued a cert for, say, mail.google.com, they'd be distrusted by every browser/OS within days. If a government made a habit of doing this, there'd soon be no trusted CAs in their jurisdiction.

The US probably has the best chance of getting away with this since they also have all the major OS/browser vendors in their jurisdiction. But if Mozilla/Apple/Microsoft/Google all mysteriously decided not to distrust a CA that was issuing bogus certs for high-profile sites, it would be pretty conspicuous.

</comment></comment></comment><comment><USER43> Excellent progress and a great credit to LetsEncrypt and others that brought free cents to the masses. There's almost no excuse to not encrypt anymore. The "not secure" shaming of non https sites by major browsers also applied some needed peer pressure.

</comment><comment><USER44> Does this include Netflix traffic? Which would skew the results.

<comment><USER45> Wouldn't the result be skewed if it _didn 't_ include Netflix?

</comment></comment><comment><USER46> Thank you LetsEncrypt.

</comment><comment><USER47> Thank you Edward Snowden

</comment><comment><USER48> The trend is going in the right direction.

</comment><comment><USER49> greate!

</comment><comment><USER50> I wonder how much of this is due to Cory Doctorow's novel Little Brother.

</comment><comment><USER51> To the 90%: if you've got nothing to hide then why are you encrypting your traffic?

<comment><USER52> Probably sarcasm but...why shut the door when you're in the bathroom?

<comment><USER45> I like this analogy. We all know what goes on inside a bathroom, it's not really a secret. But it _is_ private. There is a difference between secrecy and privacy, and this analogy captures the difference well.

I think I first heard the analogy in Cory Doctorow's presentation _The Coming Civil War over General-purpose Computing_ , which was ironically given at Google. I highly recommend people watch it.

</comment></comment></comment><comment><USER53> Oh, so finally most of the porn sites are defaulting to https?

</comment><comment> ga-vu It's been at over 90% for more than a month, from what I can tell

<comment> gator-io if you look at the trendline, it was 88.7% last month:

[https://netmarketshare.com/report.aspx?options=%7B%22filter%...](https://netmarketshare.com/report.aspx?options=%7B%22filter%22%3A%7B%7D%2C%22dateLabel%22%3A%22Trend%22%2C%22attributes%22%3A%22share%22%2C%22group%22%3A%22secure%22%2C%22sort%22%3A%7B%22share%22%3A-1%7D%2C%22id%22%3A%22https%22%2C%22dateInterval%22%3A%22Monthly%22%2C%22dateStart%22%3A%222018-11%22%2C%22dateEnd%22%3A%222019-10%22%2C%22segments%22%3A%22-1000%22%7D)

</comment></comment><comment><USER54> Great. Now nobody can see what you do except companies who sell everything you do...

</comment><comment><USER55> I'm sorry, but there's a lot of smart people here. Why is everyone assuming HTTPS means no one is snooping? I presume someone is snooping no matter what.

<comment><USER56> Snooping on Https requires significant resources. Snooping on http is very cheap. A good analogy is locking your door. Sure, can be dealt with. But most would be criminals won't go further than twisting the door knob.

</comment></comment><comment><USER57> I know this is good and all, but it does bum me out that Netscape 4.8 works much worse than it did even a few years ago. I prefer it to iCab, which might fair slightly better. Any suggestions for Mac OS 7.6 web browsers that support the minimum encryption required these days?

<comment><USER58> My suggestion is to set up a proxy. This has long been necessary to run browsers like Mosaic on the modern web, since many websites are inaccessible from HTTP/1.0 (or earlier!)

It's funny how ever-moving Internet standards mean an Apple II from 40 years ago is more functional than an iMac from 20 years ago.

</comment></comment><comment><USER59> This is good to keep out moderate bad guys from your data. But the not so much for the NSA. The NSA already captures traffic end to end including the key negotiation and can break the rest [https://arstechnica.com/information- technology/2015/10/how-t...](https://arstechnica.com/information- technology/2015/10/how-the-nsa-can-break-trillions-of-encrypted-web-and-vpn- connections/)

<comment><USER60> Even when it was first discovered, only 8.4% of the top million web sites were estimated to be vulnerable to the Logjam attack:

[https://arstechnica.com/information- technology/2015/05/https...](https://arstechnica.com/information- technology/2015/05/https-crippling-attack-threatens-tens-of-thousands-of-web- and-mail-servers/)

Now I would expect the number to be much closer to 0%.

</comment></comment><comment><USER61> This statement would be more meaningful had it been phrased something like this: "encrypted web traffic, which most adversaries cannot snoop on, exceeds 90%".

There will always be an adversary, far powerful than you, with an ability to snoop on your traffic - be it your ISP, the other endpoint, or owners of the infrastructure that you consume, but do not control.

<comment><USER62> You portray encryption as a magical energy. To the best understanding of cryptanalysis research, current TLS is secure. Hypothetically it could be broken and publicly unknown, but this is not a matter of "power".

> the other endpoint

It's not sensible to say encrypted web traffic is snooped on by an actor with direct access to the plaintext.

<comment><USER61> The simple statement made in OP, does not capture the complexity of operational security, which is very difficult to get right. I was merely trying to illustrate that.

For e.g., even though TLS is end-to-end secure (and I don't doubt that), a website that uses CloudFlare front [1] is susecptible to its secure traffic being intercepted by CloudFlare, because by-design TLS would be terminated at CloudFlare servers'. However, note that the end-user does not notice that, rather he sees his traffic end-to-end encrypted.

[1] [https://support.cloudflare.com/hc/en- us/articles/200170416-E...](https://support.cloudflare.com/hc/en- us/articles/200170416-End-to-end-HTTPS-with-Cloudflare-Part-3-SSL-options)

<comment><USER42> > a website that uses CloudFlare front [1] is susceptible to its secure > traffic being intercepted by CloudFlare, because by-design TLS would be > terminated at CloudFlare servers

Keep in mind, this is also true of cloud providers. By running the hypervisor, AWS has full access to your instance's RAM and could snoop on traffic if they pleased.

A compromised service provider is a risk you're accepting unless you own and physically control the hardware terminating TLS. Whether this is an acceptable risk comes down to your threat model. (As do so many things in infosec.)</comment></comment></comment></comment>