Soft U2F: A software-based U2F authenticator for macOS - <AUTHOR> https://githubengineering.com/soft-u2f/ <comment><USER2> Can someone explain how this is an improvement on phone-based, non-SMS 2FA?

This solution seems ripe for exploitation by putting your passwords (if you store your passwords on your computer) and 2FA on the same machine.

<comment><USER3> on an unrelated note: can someone explain why SMS based 2FA was every considered to be a good idea? That crap drives me NUTS.

<comment><USER4> It feels inherently insecure to blast a 2FA code across every device where you've got Hangouts installed. (And if you've got Hangouts installed on the PC where you're logging into, then it's not 2FA anymore.)

<comment><USER5> > It feels inherently insecure to blast a 2FA code across every device where > you've got Hangouts installed.

I think that may be Project Fi specific. To my knowledge, Hangouts doesn't do SMS anymore except for Project Fi customers, and even prior to them forcibly removing SMS handling from Hangouts on my Samsung and telling me to find something else after an update, it never synced SMS messages it to other Hangouts instances.

</comment></comment></comment></comment><comment><USER6> U2F is great and you can get a physical device for around $15. I wish banks and such would adopt U2F sooner than later. They could just sent U2F tokens as giveaways.

Big downside: Apple and Microsoft. They don't support it in their browsers. No browser support, no U2F.

<comment><USER7> safari and edge users are a tiny minority. Most security aware people use chrome anyway.

<comment><USER8> Really, you think security aware people use Chrome? The security aware people I engage with avoid it. The baked in data collection and telemetry are a concern for them. Some of them even remember specific problems, like that time it turned out Chrome was listening on your mic all the time, and sending the a audio back home.

The security conscious people I know use Firefox or chromium.

Of course, your point stands: no one's using safari or edge. :)

<comment><USER9> You always have chromium also don't confuse security awareness with privacy concerns.

Chrome is more secure this means that you have less of a chance having your data compromised including any and all data on your machine by an unknown 3rd party. Since Chrome's data collection is known it can be incorporated into a simple threat model. You know what is collect and who collects it, most security aware people will be OK with Chrome collecting some metrics that in all fairness are likely to be collected anyhow unless they block every JavaScript and Cookie on the planet, do no use any Google service or a service that uses GA in exchange for not having to worry about their browsers being pwned.

</comment></comment></comment></comment><comment><USER10> To Github people: I ordered your yubikey token but stayed away from U2F out of fear that I'd be locked out if I lost the hardware token.

But I didn't realize you could setup U2F and TOTP as a backup.

<comment><USER11> Not only can you do this, but the major services won't even let you set up U2F without a backup factor.

The best current Google auth stack, by the way, is:

1\. U2F

2\. Phone-based authenticator app (TOTP)

3\. Password-manager password

4\. Printed codes

5\. DISABLE SMS. (Google forces you to enroll in SMS to turn on 2FA; you can simply delete your phone number after enrolling everything else).

<comment><USER12> Thank you for letting me know that SMS authentication is not mandatory for Google accounts! I assumed it was for the reason mentioned in your comment.

</comment></comment></comment><comment><USER13> What's wrong with client certificates? Instead of reinventing the wheel they should've just used those which would've given browser vendors a reason to improve their UX regarding client certs.

<comment><USER14> That is roughly all U2F is. It is a per-origin key pair that is registered with each site and used to sign challenges. At some point browsers themselves might implement something like Soft U2F, at which point, they basically will have "improved the UX of client certs".

<comment><USER13> The advantage of client certs over U2F is that client certs use the same proven mechanism your browser uses to verify the server's cert, and can even be handled by the web server. It's also seamless for the user - if needed you can be logged in right from the first request. U2F needs to be implemented over the top in the app itself and the login process is at the minimum two steps (no way to login from the first request).

</comment></comment></comment><comment><USER15> Somewhat disconcerting to see this in Chrome:

Attackers on github-production-release-asset-2e65be.s3.amazonaws.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone numbers, or credit cards).

</comment><comment><USER16> Until Yubikey releases a USB-c version of their nano, I think I'll use this. Since I've had to transition to a keychain U2F device instead of one I can leave in my laptop, I find myself using it far less.

<comment><USER17> I'd expect the U2F protocol to be built into secure elements on laptops before a Type-C Nano comes into existence.

USB-C ports are too precious to keep them filled all the time with an authentication device, and there doesn't seem to be enough room in the male side of the Type-C coupling to allow the necessary circuitry to exist in a slim form factor. Both these problems are solvable, but meanwhile secure elements are already shipped with many laptops.

(An assumption of this comment is that the Nano is kept semi-permanently in the laptop port. That's what the Nano is indeed designed for.)

<comment><USER18> Honestly, I don't know why Apple don't implement U2F on the secure enclave (activated via the TouchId sensor); it seems like such an obvious move.

Maybe they're trying to get iCloud and Safari support all ready to release at- once?

<comment><USER19> Wow, great idea!

I think Web Authentication will slowly make U2F obsolete, in a sense that U2F will become one of many authentication methods, others could also be implemented. Checking WebAuth specs one can see references to Android attestation, TPM attestation so generally secure hardware elements. Implementing a U2F solution would require emulating USB exchange I guess.

Of course U2F still has an advantage that you can take your token and authenticate on a different device but unfortunately newer Yubikeys do not support U2F over NFC and there are not so many other solutions.

</comment></comment></comment></comment><comment><USER20> You don't really[1] need to install this, if you're using Firefox. Just set the prefs 'security.webauth.u2f' and 'security.webauth.u2f_enable_softtoken' to true.

[1] (Unless you need the token to live in your Mac OS keychain, instead of the Firefox profile directory.)

<comment><USER21> My understanding is that the FF softtoken was intended to be temporary while they worked on their HID support. That might not be the case any longer though.

<comment><USER22> Yeah, the software token was only intended for testing purposes.[1] HID support is supposedly a goal for later this year.[2] There is also a third- party(?) add-on for hardware token support[3], but apparently it will stop working with FF 57 as it not was not written for WebExtensions.

(Disclaimer: not affiliated with Mozilla; I just check in on bug 1065729 every so often.)

[1]: [https://bugzilla.mozilla.org/show_bug.cgi?id=1065729#c262](https://bugzilla.mozilla.org/show_bug.cgi?id=1065729#c262)

[2]: [https://wiki.mozilla.org/Security/CryptoEngineering#Web_Auth...](https://wiki.mozilla.org/Security/CryptoEngineering#Web_Authentication)

[3]: [https://addons.mozilla.org/en- US/firefox/addon/u2f-support-a...](https://addons.mozilla.org/en- US/firefox/addon/u2f-support-add-on/)

</comment></comment></comment><comment><USER23> This seems a little restrictive if it doesn't have some sort of 2FA alternative, like a mobile TOTP app or something. I'd hate to be locked out of any accounts for losing my MacBook, or to be unable to use the accounts from mobile or a different platform.

As a secondary/simpler 2FA alternative I like it, but the description here doesn't do much to explain how to get around the problem of only having this available on my macs.

<comment><USER24> the solution for actual U2F tokens is to buy 2 and put one in a safe deposit box. not sure what the solution is for software version

<comment><USER25> Wouldn't work. Too inconvenient. What if you need to add another account? Go to the safe deposit box, create the account, then take it back again?

</comment></comment></comment><comment><USER26> This seems misguided - it is watering down a decent system simply to appease and attract people too cheap to buy tokens; if 2fa is something that is so important to you, and you need it, just buy the damn tokens!

A vague comparison, would be me selling pre-printed 'random' passwords on paper because a user generating their own was 'too difficult'

IMHO, soft token u2f is only useful for testing, development, and personal entertainment

<comment><USER14> What is the attack scenario you feel a hardware token protects you against that a software token will not (for the use cases U2F was designed for)? Sure, hardware tokens prevent malware from actually lifting your private keys. But, to steal your software private keys you likely need malicious code running on your computer. And, once an attacker has that, it is largely game over for all intents and purposes anyway. They can ask your hardware token to sign bogus requests, steal your passwords, etc. Sure, with a hardware token you can wipe your machine and feel semi-confident that you get to keep your private keys. But, really, once your machine has been compromised and you wipe it, setting up new private keys sounds like a wise practice regardless. I'm not arguing that hardware tokens have zero use. But, for most users, the attack model where hardware tokens shine is likely not of value to them.

<comment><USER27> I may be mistaken (and I'm sure someone will point out if I am) but I think most hardware U2F tokens require you to physically press something on the token to validate that it should pass over your keys.

The soft U2F solution presented here still prompts you, but it is easier to imagine the software being modified/owned on a compromised machine than then hardware token being hacked in such a way as to hand over the keys without a physical press.

<comment><USER14> Once you have malicious software running it is largely game over. Sure, the hardware token can require a press..but once pressed what challenge is being signed? Malware can just wait and send a challenge for Site A when you are actually trying to sign into site B. Or, the malware can just wait until you login and steal your browser cookies. Oh, also, Soft U2F can require a similar physical touch if you have a mac with Touch ID.

<comment><USER28> Atleast for my u2f token, I'm being shown the site I'm signing for on a hardware screen.

<comment><USER21> Which device are you using? With U2F, the browser doesn't send the name of the site to the authenticator.

<comment><USER28> I'm using Trezor, I believe it has been preloaded with certain websites so it knows Github and Google and the likes.

It also shows parts of the public key (or so I believe, it is a unique identifier) per website.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> I don't see anyone mentioning that Google won't allow you to use U2F anywhere but on Chrome. E.g last time I tried I couldn't log in using Firefox even if I installed the plugin. [0]

[0] [https://productforums.google.com/forum/#!topic/gmail/IwKFuNh...](https://productforums.google.com/forum/#!topic/gmail/IwKFuNh0mh8)

Edit: link

</comment><comment><USER30> I've been looking into 2FA on Github and I don't understand why you must have either SMS or TOTP (typically a mobile app) as the primary second factor. Why not let users go straight to a yubikey? I don't want my mobile involved in the process at any point. You also can't remove the TOTP factor once you've added a yubikey, so yubikeys are 2nd class citizens, despite being much more secure.

<comment><USER14> The primary reason is exactly the reason you cited (u2f support is not ubiquitous across browsers..especially mobile). We may consider allowing folks to use u2f exclusively in the future, but we started conservatively given the already risky proposition of account lockout with regular 2FA.

<comment><USER30> Thank you for clearing that up. Personally, I'm more likely to lose my phone or have it brick itself (happened to my previous phone) than to lose a yubikey.

</comment></comment></comment><comment><USER31> Extension version with similar functionality: [https://chrome.google.com/webstore/detail/keyless-u2f/bhgbpf...](https://chrome.google.com/webstore/detail/keyless-u2f/bhgbpfmmjenlapdolpeijifcedhcogne). Works with Mac + Windows. Amazing to see more soft solutions for U2F.

</comment><comment><USER32> The benefit of U2F to me is that it is a hardware token. I would never use a software token when I can use a hardware token.

</comment><comment><USER33> The kext shouldn't be necessary for a Safari and Firefox plugin. Is it just there to fake a u2f usb device for Chrome?

</comment><comment><USER34> U2F adoption seems quite slow. Google were in early, and later github and Dropbox. But since then? Feels like nothing happened.

<comment><USER35> Cost is the major problem, with a couple of technical/deployment issues.

The technical/deployment issues to me are the lack of browser support (that means Edge, Firefox, Safari, etc.), the long and slow migration from USB-A to USB-C, and the missing parts of the mobile puzzle. With the latter I mean U2F support for Bluetooth Low Energy (BLE) and NFC on (at least) smartphones.

Ideally, you could visit some secured website on your smartphone, choose to authenticate with Fido U2F, tap your U2F key to the phone, and authenticate with it using BLE or NFC. The same key can be used on a laptop or desktop computer as well using USB.

Those devices will exist (or already exist perhaps), but they will cost a lot more than the plain USB-A U2F keys available now for roughly $15.

To drive adoption, ideally banks would get on board and go for U2F. That way a lot of people would come in contact with the technology, driving adoption and prompting users to use the key for other services as well (for the bank this provides a nice branding opportunity!).

Unfortunately, banks tend to favour private solutions based on TOTP/HOTP in a lot of countries. That means that in, for example, my native country of the Netherlands you will get a small battery powered calculator-like device from your bank that generates the challenge-response verification codes needed to authorize transactions. Each bank has its own solution that only works with them, and each will send you their private branded TOTP-in-a-box device.

Add to this governments that are attempting to introduce electronic ID-cards containing NFC-chips for public authentication with government and commercial entities alike, and you can see why in a lot of countries the only candidates for U2F are global services like GitHub and Dropbox. That reduces the amount of potential U2F users to what are essentially power users.

<comment><USER36> Just a heads up: on the US Amazon site Feitian has a USB-A + NFC token for $16 (and there's a one-per-customer coupon on the amazon product page to knock it down to $10).

Feitian also have a BLE + NFC + USB token for $24 (with a coupon to buy it for $16), but that requires charging a battery, is less rugged, and the USB requires a cable to connect to it.

It's not as cheap as USB-only (there used to be a $6 USB token sold), but NFC support doesn't have to cost much more (especially as the secure element chips they're built around all move towards having NFC support as a baseline anyway).

Also there seem to be a handful of Java Card implementations of U2F on github already (one of them is even sold as a Fidesmo app, if you want to pay for easy installation), so an NFC-only U2F token could presumably be had for as cheap as any javacard-compatible NFC smart card, and then just registered as a second token.

I don't think it's enough to help push U2F forward by itself, but I think if webauthn can get solid cross-browser support for U2F implemented, price won't continue to be a big problem. Having just read up on webauthn, and seeing how many browsers already have test implementations shipping, I'm pretty optimistic U2F is going to be seeing a lot more interest soon.

</comment></comment></comment><comment><USER37> this would be great if it were linked to touchbar fingerprint sensor

<comment><USER21> It is :-)

</comment></comment><comment><USER38> I tried it but it didn't work for me. I'm running Mavericks. Do I need to reboot or something?

<comment><USER21> I've only tested on Sierra, so I'm not terribly surprised that this doesn't work. Would you mind opening an issue so I can help debug? [https://github.com/github/SoftU2F/issues/new](https://github.com/github/SoftU2F/issues/new)

<comment><USER38> Done.

</comment></comment></comment><comment><USER39> I'm surprised they're willing to trust a mouse click on a notification. (Can't that be simulated by malware by using the Accessibility APIs?) I was expecting a U2F authenticator that wanted a Touch ID touch first.

<comment><USER40> Malware is a game-over scenario either way. It can simply steal your session keys or send requests from your browser with an active session.

That said, there seems to be some sort of TouchBar integration[1]. It doesn't currently store the keys in SEP, but that might become an option at some point[2].

[1]: [https://twitter.com/mastahyeti/status/889546786221678592](https://twitter.com/mastahyeti/status/889546786221678592)

[2]: [https://twitter.com/mastahyeti/status/889548782035124224](https://twitter.com/mastahyeti/status/889548782035124224)

</comment></comment><comment><USER41> This isn't also backed-up by SMS, is it? Because the majority of U2F-supporting services seem to be doing that - even Google (and for its own Google Prompt, too).

<comment><USER42> You can disable Google SMS 2FA anytime.

<comment><USER14> And the same is true on GitHub. You can use app based TOTP without SMS.

</comment></comment></comment><comment><USER43> Any plans for a Windows version?

</comment><comment><USER44> If you're already into Bitcoin the hardware wallets also can be used for U2F

</comment><comment><USER45> It'd be awesome to see keybase integration</comment>


Is Intel's upcoming 10nm 'launch' real or a PR stunt? – SemiAccurate - <AUTHOR> https://www.semiaccurate.com/2018/05/29/is-intels-upcoming-10nm-launch-real-or-a-pr-stunt/ <comment><USER2> The author has no idea where yield improvement comes from. I think they like to believe in pie-,in-the-sky magic. Getting to high yield 10nm process Intel have no choice but to start at low yield and ship dice into processors to find out what works: they have to commit to a process flow right the way up to packaging. Otherwise it truly is a pipe dream. You can't run the fab line efficiency if you mix outputs, it wouldn't surprise me if the process chemistry and timing and temps are so different you can't run mix nm scales at all.

Intel have to make and sell! What does the author want them to do with a low yield 10nm process? Design chips without the gpu and package or, design the dies for the future 2+1 you state, burn the silicon which is waiting for yield to work and then use it for the you makes more sense.

Lenovo took a deal. The price and energy budget work for them. It's win:win.</comment>


Digital Media: What Went Wrong - <AUTHOR> https://www.nytimes.com/2019/02/01/business/media/buzzfeed-digital-media-wrong.html <comment><USER2> I mean, is it really this difficult?

Cost of production plummeted to zero, vastly increasing supply. That increase of supply combined with additional sophistication of users meant that ads became exponentially less valuable. Getting desperate, they hitched their wagon on Facebook - and anyone who has lived through any era of the Internet knows that you never build your house on someone else's land.

Most of them raised way, way, way too much as if they were tech plays and could scale like it. Vox only gets around it because they don't pay 90% of their writers.

<comment><USER3> > Vox only gets around it because they don't pay 90% of their writers.

Is this true? Where can I learn more?

<comment><USER2> It's unequivocally true in the case of SBNation, which is their most trafficked property. It follows the model originally brought to market by Bleacher Report, which used unpaid "contributors" creating low-grade SEO chum content in exchange for the nebulous concept of exposure.

See more: [https://deadspin.com/how-sb-nation-profits-off-an-army-of- ex...](https://deadspin.com/how-sb-nation-profits-off-an-army-of-exploited- workers-1797653841)

</comment></comment></comment><comment><USER4> In my mind - if you treat news as entertainment, you're finished.

There are just too many entertaining things to do, that are free or almost free.

The only news I'm interested in surviving, is intelligent, well educated people, talking to domain experts.

HackerNews is a good example - I'm far more interested in getting the occasional insight from a quality comment, than anything that's actually posted on here. If only I didn't have to sift through 100 comments to encounter 1 gem - that should be the journalist.

Trouble is - people view journalism as a job, it's not. Having education and life experience in a field, combined with decent journalism, is a job. Journalism on it's own is just not interesting - being a wordsmith is not more valuable than actually knowing what you're talking about.

<comment><USER5> > Journalism on it's own is just not interesting - being a wordsmith is not > more valuable than actually knowing what you're talking about.

Knowing what you're talking about and informing the public are two different things. Both are necessary parts of journalism, with neither sufficient alone to fulfill the vital role of the press as a check on the three branches of government.

</comment></comment><comment><USER6> >For years, BuzzFeed seemed to be leading the journalism industry toward a brave new future.

Serious question: did anyone honestly believe this to be true?

<comment><USER7> Buzzfeed's actual journalism (not the goofy lists and quizzes) is pretty good. Buzzfeed news also posts all their data for their articles on Github. [https://github.com/BuzzFeedNews](https://github.com/BuzzFeedNews)

<comment><USER8> they didn't start with actual journalism though. they started with complete trash, and then used that clickbait revenue to fund actual investigative journalism

<comment><USER9> Well, that was always the plan. A little bit like the classified and sports sections were paying for that Bagdad bureau.

</comment></comment></comment></comment><comment><USER10> Really from what I could tell the news was always largely pretty crappy just judging by all of the stupid moral panics they were pushing along with the well known phenomenon that anyone who knew their field knew they were getting reporting on it deeply wrong and not just in a 'only knowledge of the basics' way.

The reason why bloggers could compete with them wasn't because bloggers were inherently awesome (although there are a few high quality writers) but because they were essentially crap.

The internet made fact checking easier and they didn't take the opportunity instead just keeping their pipeline of crap going.

</comment><comment><USER11> Legacy media such as NYT and WSJ are refusing to properly cover the real issue of surveillance capitalism duopoly of Google and Facebook. When Candy Crush knows your hometown and your hobbies, there is no need to serve ads on your local newspaper's website and there is no need for hobby websites, or professional sites, or smart sites for kids. So we have no content creation on internet outside of WSJ, NYT, Youtube, etc. And there are no investments in media. And there is no money in media. In turn we have a static internet and privacy scandals and fake news on a few swampy platforms. It's really bad for democracy and for us. And it's bad for startups.

<comment><USER12> Half the comments on HN lately are complaining that the NYT covers Facebook _too much_ and that they're reading it less as a result.

<comment><USER13> Personnally, I think it's too little too late.

They should have told people that 10 years ago, when the IT community started to feel it would go this way, and begun to warn everybody about it.

That's what journalist is about.

Now, they are just repeating what's in everybody's mind.

But society doesn't need parots as journalists. Surprise, we have social medias for that. It needs analysts, reporters, people that help them decrypt the world better.

They completly failed at decrypting the IT world for the last 2 decades, and only started writting about things when a lot of people already understood it and paid the price.

Basically, they don't do their job, and complain we are not supporting them anymore. Sorry but not sorry.

<comment><USER14> > They should have told people that 10 years ago, when the IT community > started to feel it would go this way, and begun to warn everybody about it.

10 years ago, you say?

[https://www.nytimes.com/2008/11/30/business/30privacy.html](https://www.nytimes.com/2008/11/30/business/30privacy.html)

[https://www.chron.com/sports/longhorns/article/Longhorn-s- ex...](https://www.chron.com/sports/longhorns/article/Longhorn-s-expulsion- shows-need-for-caution-on-1774465.php)

[https://bits.blogs.nytimes.com/2008/11/13/does-google-flu- tr...](https://bits.blogs.nytimes.com/2008/11/13/does-google-flu-trends- raises-new-privacy-risks/)

[http://news.bbc.co.uk/1/hi/technology/7196803.stm](http://news.bbc.co.uk/1/hi/technology/7196803.stm)

[http://news.bbc.co.uk/1/hi/programmes/click_online/7375772.s...](http://news.bbc.co.uk/1/hi/programmes/click_online/7375772.stm)

[https://www.nytimes.com/2008/11/16/business/16ping.html](https://www.nytimes.com/2008/11/16/business/16ping.html)

[https://www.npr.org/templates/story/story.php?storyId=887486...](https://www.npr.org/templates/story/story.php?storyId=88748673)

[https://www.cnet.com/news/exclusive-the-next-facebook- privac...](https://www.cnet.com/news/exclusive-the-next-facebook-privacy- scandal/)

Journalists were writing about privacy concerns in mainstream media quite a lot.

<comment><USER13> You are right. I have to think about this more.</comment></comment></comment></comment></comment>


Amount of Content in the Lord of the Rings vs. The Hobbit - <AUTHOR> http://blog.xird.fi/amount-content-lord-rings-vs-hobbit/ <comment><USER2> One day people might realize that a single sentence or paragraph in a book can span a lifetime. There were three Hobbit films and still much was left out from the book. It is nonsensical to judge an adaptation based on the length of the source -- judge the adaptation on how well it _adapts_ a story from one medium into another.</comment>


The personal info of what could be Instacart customers is being sold online - <AUTHOR> https://www.buzzfeednews.com/article/janelytvynenko/instacart-customers-info-sold-online <comment><USER2> I am not surprised. Recently I had an issue with Instacart when somehow one of my order was charged back. The Trust team at Instacart insisted that I pay up and refused to investigate their system, after I provided a lot of evidence of how their system is mixing up my account with somebody else's and there is a bug in their integration with Costco. After more than a week of back and force they closed my account. I decided to reopen it by paying the charged back amount because without it I can shop at Costco. Guess what, after the account was reopened, the other transaction delivered to another person living in another state is still showing up in my account, including t heir other private information like cell phone numbers and CC digits. I decided it's better to buy from amazon instead of costco with Instacart. It's beyond me why their trust department refused to investigate their system with obvious evidence for bugs, and I don't want to text the other person in my account to notify him that his private information has been compromised, because the communication with Instacart made me feel that I am guilty.

If you use Instacart to buy from Costco, be aware.

<comment><USER3> Just tangentially related but recently I tried to buy something from an online store called Adorama and when I tried to place an order I got the notification of the charge from my bank after clicking the order button but the page didn't do anything, initially I though "well lets just get in touch with customer support, pretty sure they can see the charge and let me know what happen with it" oh boy was I wrong, their customer support only has access to orders not transactions, so when a bug in their website charged me without creating an order there is nothing they can do at all; all they did is recommend me to ask my bank to do a chargeback, but my bank says I need to wait 30 days after the transaction to so. So yeah, my lesson was the same, I should have had stick with Amazon because smaller stores just can't be trusted with handling purchases correctly.

<comment><USER4> Privacy.com... is my thing for this reason.

<comment><USER5> as soon as you can use a credit card to fund it, perfection.

<comment><USER4> that will probably not happen because they would be eating a credit card fee...

that service only works because they become the credit card processor and get to pocket the card fee...

</comment></comment></comment></comment></comment><comment><USER6> It's weird to me that we're hearing about this from the press instead of Instacart. If a suspected data dump of Instacart user data made its way to the dark web, surely it wouldn't be difficult for Instacart to buy a subset of it and confirm or deny its validity.

If I was an Instacart customer, I'd feel a lot more comfortable with a preliminary "we're aware and looking into this" statement from Instacart directly as opposed to doing nothing and telling the press that they don't know anything.

When a data dump like this hits the dark web, are companies even legally obligated to look into it?

<comment><USER7> In California, yes.[1]

Instacart has not yet reported this breach to the California attorney general, like they're supposed to.[2] There's a long list of companies with data breaches there.

[1] [https://leginfo.legislature.ca.gov/faces/codes_displaySectio...](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82)

[2] [https://www.oag.ca.gov/privacy/databreach/list](https://www.oag.ca.gov/privacy/databreach/list)

<comment><USER8> Keep in mind that developers hear a user needs to be notified in "the most expedient time possible" and think minutes or hours but the lawyers read that and are thinking days or potentially even weeks in some circumstances. Just because Instacart hasn't notified anyone yet doesn't mean they won't or that they've failed to comply with the obligation.

<comment><USER6> Then the law sounds ineffective to me. There are security researchers featured in this article saying that this dump looks legit, and Instacart still gets to pretend like everything is normal? User data could wind up sitting on the dark web for weeks before Instacart finally gets around to notifying them of the breach.

Tools like haveibeenpwned typically rely on companies' cooperation to report breaches since "data breach" is a legal term. But since Instacart still hasn't reported this, do the security tools get updated in a timely way, or are there millions of credit cards and passwords sitting up for sale while lawyers figure out how to handle the legal side of this?

</comment></comment></comment></comment><comment><USER9> I used to deal with this sort of stolen data (wow, it seems like a long time ago now). A big pile arrived every single morning before dawn.

At this scale you'd expect to find clear evidence it was Instacart users e.g. an account with email address email@example.com. If there's nothing like that in the data then it's immediately suspicious, a small site might just not have any users with such breadcrumb trails in their email but a big dump like this should statistically have something because there are lots of people (including me) using a breadcrumb for every account.

This is how I know for sure that one of the banks I used years ago lost all their customer email/ name data even though they denied this at the time when it was news. I get scam emails to the address I gave them even now.

You'd also expect a company that cares about its users data to have plausible looking "watermark" accounts that trip alarms and so they'd be able to confirm this is their data. Even, if they did a proper job, what the source was (e.g. if you send a subset of data to a partner organisation you can add more watermark data and that lets you know if the data is stolen from that partner)

<comment><USER10> Have always been curious about this; if you stole data or are using stolen data why wouldn't you just strip out the breadcrumb?

<comment><USER9> Two answers for that:

1\. Crooks are lazy. Actually _humans_ are lazy and crooks are human, but even more so criminal activity doesn't tend to come with any quality control. Even obvious data cleanup like fixing escaping often isn't done, because there's no incentive.

2\. Breadcrumbs tend to be obvious to a human but a variety of schemes might be employed which means automation to strip them would need to be relatively sophisticated or it'll miss many of them. I used to use breadcrumbs of the form email@example.com where XX is two digits signifying when I updated this email address, like maybe 14 means May/June 2009. A human can stare at that address, see it says domainname backwards and realise it's a breadcrumb. But a trivial regex match will miss it.

<comment><USER11> I've been using spamex for years. You can generate completely random email addresses.

</comment></comment></comment></comment><comment><USER12> "The company denied there had been a breach of its data."

This is about as serious a breach as it gets. To have (or claim) zero knowledge of it is pretty bad.

If the details of the story are correct, it would imply the attackers had full database access. I would not be surprised to learn the attack vector was gaining a privileged user's credentials, similar to the Twitter hack.

<comment><USER13> It is possible that they phished a few users (or used account details from another leak) and the rest of the data is BS.

I don't think they're claiming zero knowledge. They're doing the exact opposite: they're saying they have complete knowledge, and that it simply didn't happen. I hope, for their sake, that they are correct.

</comment></comment><comment><USER14> Anecdotal: Got hit with a password lock on a pretty unused Instacart account ~7 days ago (Jul 15).

Possibly a password leak from another site resulting in a targeted large-scale account access to download customer data from a leaky API? (Baseless commentary.)

<comment><USER15> I had a similar thing happen last week with DoorDash, after the first two I contacted their privacy@ address and requested an account deletion via CCPA.

<comment><USER16> Isn't that closing the barn door after the horses left?

<comment><USER17> Not necessarily - if you catch it on unsuccessful login attempts and have no evidence they got into the account, it's likely they moved onto the next email address in their list and you can still go in and delete the account pre- compromise.

</comment></comment></comment></comment><comment><USER18> Back in March I started getting Instacart support emails for "Jocelyn Joans" concerning Redwood City Safeway (not nearby). Instacart.com produced an error when I tried to log in or reset my password. Since my email is unique for Instacart, I hadn't used Instacart in 5 years, and I did not have any Instacart correspondence in my email, there's very likely only one way someone could have accessed my account.

I sent an email to legal@ demanding my account be removed and to follow up that it had been done. The support emails stopped but I never heard from Instacart.

Edit: added "very likely;" clarity.

<comment><USER19> > I sent an email to legal@ demanding my account be removed and to follow up > that it had been done. The support emails stopped but I never heard from > Instacart after that.

I must've send close to 50 of these emails to different companies / services I've used in the past. My request was always the same; a dump of my data, removal of my account and confirmation that my account was removed. To nobody's surprise, I never received a response to any of these requests.

<comment><USER4> It might be a little easier now, tell them you're a EU resident... and they have to by GDPR....

<comment><USER19> I don't reside in the EU, but I'm a EU citizen. I've quoted GDPR in those emails, but they don't seem to care. My best guess is that they don't even check the email accounts.

<comment><USER4> Next time, use the topic "Looking for your DPO for a GDPR concern"... trust me, someone will read that....

</comment></comment></comment></comment></comment><comment><USER20> One major factor that may be contributing to this: Instacart doesn't offer 2-factor authentication (2FA)

</comment><comment><USER21> Online shopping carts are a nightmare of reliability. I've pretty much abandoned my trust of them. I even spent time a few years ago contributing to the Ubercart code base. Something is very fishy in the manner in which financial transactions are handled, as if losses and fraud are expected and baked in.

</comment><comment><USER22> I had stopped using them because they always overcharged. I contacted them and got an automated "we'll look into it" then never heard from them again. After reading the report of whatever has happened I tried to change my password. It wouldn't process it. So what now. Cancel the credit card? But other personal information still possibly compromised...

</comment><comment><USER22> I stopped using them because they constantly overcharged and I could get -0- response. We'll look into it and that is the end. After seeing the report I tried to change my password and it wouldn't let me. So what do we do? Cancel the credit card on it? That still leaves personal info out there.

</comment><comment><USER23> fwiw instacart says it is credential stuffing : [https://news.instacart.com/a-security-update-from- instacart-...](https://news.instacart.com/a-security-update-from- instacart-89beb7bf5121?gi=b582efd6d23c)

</comment><comment><USER24> Well, this certainly explains why I keep getting notified by Instacart that someone is failing to log into my account. I'm deleting that garbage now.

</comment><comment><USER25> Anecdotally, both credit cards I used on Instacart got popped for fraud right after each other in the past week.

</comment><comment><USER26> Does instacart actually store credit card numbers, or just tokens? Why would they need to store the last 4 digits?

<comment><USER23> I doubt they store credit card data (who does that ?). Last 4 digits would be to display "Your Visa -5555" in a payment method picker

<comment><USER26> Yeah, I just use google pay with them, which shows nothing, so there's nothing for would-be identity thieves to steal except my name and address hopefully.

<comment><USER23> it seems to be credential stuffing anyway, so unless you use the same password for every website (unfortunately lots of people do), you should be safe.

</comment></comment></comment></comment><comment><USER27> Isn't this their business model?

/s (kind of)

<comment><USER13> Jokes aside, I thought this was going to be about them selling this information, not a hack.

</comment></comment><comment><USER28> Well, this also explains why my instacart account got locked the other day for having too many failed attempts to access it.

</comment><comment><USER29> This is very disheartening, I used instacart quite bit during my time onsite in NYC for a contract. I don't know why these companies have an initial reaction of denying anything happened, when in the end all will find out anyway. More egg on the face, just own it and work to be better.

</comment><comment><USER30> If you're in NYC, Brooklyn, Long Island, or nearby areas, check out our farm- fresh online grocery service, OurHarvest @ [https://ourharvest.com/?coupon=HACKERNEWS](https://ourharvest.com/?coupon=HACKERNEWS).

Use coupon code HACKERNEWS for 25% off your first order. We have a contactless delivery option at checkout if needed.

P.S. I'm the CTO and Co-Founder, if you need anything or have questions, email firstname.lastname@example.com, or check out my GitHub at [https://github.com/niftylettuce](https://github.com/niftylettuce)</comment>


Unexpected Page Fault In Virtualized Environment Advisory - <AUTHOR> https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00317.html <comment><USER3> Someone should make a graph quantifying the number of "mitigations" and performance impacting patch work for popular Intel SKU's since release.

It would be interesting to see how many times they've patched the same processor and how much slower they are now than when they were made due to all the mitigations.

<comment><USER4> Do you spell "someone" A-M-D?

<comment><USER5> I was under the impression that AMD has their own fair share of these vulnerabilities, too. They just aren't as common in the datacenter.

<comment><USER6> AMD never had one as boneheaded as Meltdown. Intel keeps having more and more uncovered, and according to researchers who went on the record in the NYT, they are not handling reported vulnerabilities quickly or thoroughly. [https://www.nytimes.com/2019/11/12/technology/intel-chip- fix...](https://www.nytimes.com/2019/11/12/technology/intel-chip-fix.html)

<comment><USER7> IIRC intel stopped doing as much validation like 10ish years ago (so, 2009/2010). it would be nice to see then publish a paper about how those decisions lead into these problems...

<comment><USER8> Intel willingly admitting mistakes is just about as likely as hell freezing over

<comment><USER9> It really is. I got hit pretty bad by an ubuntu intel-microcode package regression, which has this annoying property that soft reboots fail (and hard reboots are fine). I lost about 3 days of work to this[0], and our mitigation (pinning the package to an earlier version) is still painful, because you have to go through one OS installation cycle and still manually reboot (we do a lot of manual OS installations, and debugging "first installs").

Anyways I was bitching about this to my roommate, and she remarked that hey you know acquaintance X we know works in Intel software security division. I told her to give him crap about it and apparently his response was something like "we should have closed comments on that github issue". I feel like this is not a really appropriate response, even between friends.

AFACIT the package still hasn't been fixed and the official ubuntu solution is to roll back to the nonbroken version.

[0] admittedly slightly poor internal communication is also responsible, since this was observed by our support staff for our customers which didn't make it known to R&D - <USER2>

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> This seems like the usual processor erratum causing potentially very bad things, but only in very rare conditions that no one really understands. It's not another L1TF or similar.

<comment><USER11> Hence why we need open source CPUs pretty badly.

<comment><USER12> I'm pretty sure that high performance open source CPUs will have their own obscure problems. Too much complexity, too many dependencies, too many possible feature interactions.

<comment><USER11> They will, but you'll be able to understand the problem, the fix, and how it combines with other fixes.

I can def see a world soon where all of Intel's woes have combined to the point that they've run out of patch space for their microcode updates, and you have to pick and choose what you want mitigations for.

<comment><USER13> "Good news, our brand new processor has twice as much space for microcode as the old versions!"

</comment></comment></comment></comment></comment><comment><USER14> Anyone know what conditions are required? The advisory is sparse on details.

The errata lists the same vague info: [https://www.intel.com/content/dam/www/public/us/en/documents...](https://www.intel.com/content/dam/www/public/us/en/documents/specification- updates/xeon-scalable-spec-update.pdf)

<comment><USER15> >November 2910

They seem to have gotten information about the bug from the future :P

This could also show that trhey released it in a hurry since they did not fix that typing mistake.

<comment><USER16> It's not a typo, it's in Middle-endian format. :)

<comment><USER13> It looks more like a concurrency bug to me.

</comment></comment></comment></comment><comment><USER17> It feels like the only mails I get from DigitalOcean are about Intel processors.

</comment><comment><USER18> Intel now runs bug bounty program with up to $100k payouts ([https://www.intel.com/content/www/us/en/security- center/bug-...](https://www.intel.com/content/www/us/en/security-center/bug- bounty-program.html)), where one of the requirements is not to leak vulnerability details.

<comment><USER19> Isn't that a pretty standard bug bounty requirement? The idea is that you submit the bug to the company and they fix it before it is disclosed.

<comment><USER20> It is standard in the sense that it's not uncommon. But about as frequently it's not a requirement. Many companies allow complete or partial vulnerability disclosure once resolution is complete. It's often on a case by case basis and requires approval.

<comment><USER19> Oh, I thought that was what you meant (until resolution).. didn't realize they block disclosure forever

</comment></comment></comment></comment><comment><USER21> Skylake and newer.

Is Broadwell and before not affected or are those not mentioned since their support cycle has ended? I'd be surprised with Intel spinning up Haswell production for lower grade CPUs on 22nm, but I can't be sure.

</comment><comment><USER22> There seem to be quite a few security updates today from Intel: [https://www.us-cert.gov/ncas/current- activity/2019/12/10/int...](https://www.us-cert.gov/ncas/current- activity/2019/12/10/intel-releases-security-updates)

</comment><comment><USER17> Intel feels so much like Boeing now.</comment>


A Rare Tour of Microsoft's Hyperscale Datacenters - <AUTHOR> http://www.nextplatform.com/2016/09/26/rare-tour-microsofts-hyperscale-datacenters/ <comment><USER2> _" What came out of this was a realization that we were really building large air conditioners, that we were not in the IT business but in the industrial air conditioning business when you build a facility like this."_

This was one of the big secrets that Google learned early on. Every bit of air you cool that isn't going into a computer is wasted. The issue is that co- location facilities have to be ready for any kind of user equipment, but if you own the entire data center and all the equipment inside you can design it differently and _much_ more efficiently. It stops being computers in a building and starts being a building sized computer.

</comment><comment><USER3> Funny story about datacenters, I worked on optimizing algorithmic performance for 4 years at one the big 4 but I was never allowed in a datacenter because I didn't have a green card. So my team would go on and explore whilst i had beers in the lobby.

<comment><USER4> Can you elaborate on that? Wasn't it a private facility? Why is your green card status relevant to that? Were they hosting government assets and that was a requirement on the government's part? In that case odd that it's "green card" and not "citizenship".

<comment><USER5> maybe by "green card" they mean a green light didn't light up when he scanned his access card. <badum-ching>

<comment><USER6> He likely means the "green card" as in the green card.

Datacenters are sensitive facilities. It's not surprising that they block entrance to many people.

From what I've seen in Europe, I can remember a couple of places in military, datacenters and national research centers where it's clearly written "European Only" on the jobs.

<comment><USER7> Whats the green card?

<comment><USER8> [https://www.usa.gov/green-cards](https://www.usa.gov/green-cards)

"A Green Card (Permanent Resident Card): Gives you official immigration status in the United States. Entitles you to certain rights and responsibilities. Is required if you wish to naturalize as a U.S. Citizen"

</comment></comment></comment></comment></comment></comment><comment><USER9> It will be interesting to see how these improvements trickle down.

At the moment, a few providers have the scale and skills to run datacenters much more efficiently. But I'm guessing that within a few years there will be some generic datacenter-in-a-container available, with efficiency not much inferior to the big four.

At that point, we go back to the hosting market of 15 years ago. Everybody can offer a datacenter without deep technical knowledge, and sell compute cycles on an open cloud market.

It's like all the tiny hosting providers, except that it requires more capital. So it becomes financialised -- if you can get cheap power, low temperatures and good connectivity, and borrow a few million dollars cheaply, then you're in business. But margins collapse precisely because nobody can do it.

In the end, once we get over the transition period of this move to cloud everything, datacenters end up like utilities

<comment><USER10> One issue with data centers in a box and scaling is physical security. It's possible to pack these data centers into containers, but physical access controls and site security is something in which there are cost benefits to grouping lots of them together. Also there are big benefits to locating these things next to cheap power. So it ends up being more economical for a variety of reasons to have these things a bit less tiny and geographically distributed using today's technologies.

</comment></comment><comment><USER11> What really struck me from this is the complete move over to software based networking. If all the big cloud players do this, and if you think a lot of infrastructure will be moving over to the cloud (because of cost pressures) over the next few years, what does that mean for Cisco and other big sellers of hardware based networking gear? Is that whole business going to go away?

<comment><USER12> I guess they'll still have their office gear like SMB, firewall, WAN, etc. to lean for a while.

<comment><USER13> People are already starting to talk about whiteboxing the branch office by running all the "value" as VMs (VNFs) on a generic x86 box.

<comment><USER12> Even in that scenario they still have a bit of an edge because they can still take advantage of their lead on software by turning their stuff into virtual appliances.

<comment><USER8> Which they already do offer:

[http://www.cisco.com/c/en/us/products/security/virtual- adapt...](http://www.cisco.com/c/en/us/products/security/virtual-adaptive- security-appliance-firewall/index.html)

[http://www.juniper.net/uk/en/products- services/security/srx-...](http://www.juniper.net/uk/en/products- services/security/srx-series/vsrx/)

[https://www.sonicwall.com/products/sra-virtual- appliance/](https://www.sonicwall.com/products/sra-virtual-appliance/)

[http://www.watchguard.com/products/xtmv/overview.asp](http://www.watchguard.com/products/xtmv/overview.asp)

</comment></comment></comment></comment></comment><comment><USER14> 1.02 Winter PUE is very impressive.

I took a class on design for low PUE implementation and some comments from government data center technicians who said, in order to comply with the federally mandated PUE requirements, that people were leaving on or turning on zombie boxes to up their IT load.

<comment><USER15> >I took a class on design for low PUE implementation and some comments from government data center technicians who said, in order to comply with the federally mandated PUE requirements, that people were leaving on or turning on zombie boxes to up their IT load.

AFAIK, the DCOI sets a target PUE of 1.5 _or less_ , so running unnecessary workloads to meet the target PUE doesn't make much sense. I would bet there was some other kind of tomfoolery going on (hiding the fact that the DC overspent on efficiency when building out/upgrading the facility, or something along those lines).

<comment><USER16> I took the parent's comment to mean: the datacenter had a relatively fixed amount of power going toward the infrastructure, so they'd turn on additional servers to add more power to the compute side of the ratio. They'd be wasting power but the ratio of power spent on servers to power spent on infrastructure would look better.

</comment></comment></comment><comment><USER17> relevant xkcd [https://xkcd.com/1737/](https://xkcd.com/1737/)

<comment><USER18> I immediately thought of that xkcd with this quote.

My OpEx with the new datacenters is that I have to change the filters, and that is really the only maintenance I have. And we have moved to a resiliency configuration where I put more servers in each box than I need and if one breaks, I just turn it off and wait for the next refresh cycle. The whole OpEx changes with the delivery model of the white box. So we learned quite a bit there, but now we have got to really scale."

</comment></comment><comment><USER19> What do they use for SDN or is it proprietary? My impression is that this is a major part of each large cloud provider's secret sauce.

<comment><USER20> [https://azure.microsoft.com/en-us/blog/ocp-2016-building- on-...](https://azure.microsoft.com/en-us/blog/ocp-2016-building-on-community- driven-innovation/)

[https://www.opendaylight.org/](https://www.opendaylight.org/)

<comment><USER21> Microsoft doesn't use OpenDaylight.

I've never heard of any serious non-research uses of it, and I've spent a good bit of time looking. Every time I've heard a rumor, it had turned out to be false.

</comment></comment></comment><comment><USER22> >Microsoft shifted from outside air cooling to adiabatic cooling, where air is blown over screens soaked with water in the walls of the datacenter to create cool air through evaporation of the water.

I was wondering about that sentence, isn't humidifying air a bit problematic in a datacenter? Computers and water usually don't get along that well..

</comment><comment><USER23> Is this what gives Microsoft that infinite scalability they are advertising now? I'm still not sure how that works.

<comment><USER24> Nothing is infinitely scalable. Someone is lying if they tell you otherwise.

</comment></comment><comment><USER25> It would be interesting to know what MSFT's cost to run apps per users is. That would be a better measurement that captures total cost, rather than just the PUE.

<comment><USER26> That metric primarily captures efficiency and activity of the app, rather than efficiency of the DC. A hello world app would look amazingly efficient by this measure, because it doesn't do anything, so you're basically just capped by how many connections a box can support. A video processing app would look amazingly inefficient just because it's doing so much work.

An infrequently-used app also looks better by this metric than a frequently used app. The service behind the mobile weather app you use might look more efficient than Facebook, just because you use it once a day instead if a dozen.

Disclosure: Microsoft employee, not involved in our data center designs.

</comment></comment><comment><USER27> interesting, i live near Quincy and know a number of people that are helping build their new DCs and a couple that work there. seen many pictures of the inside and how the layout works, cool stuff. what amazes me the most if the crap hardware they run on.

</comment><comment><USER28> I find it funny that we can now have a super-computer in our pockets, but we still build huge expensive data-centers. I wonder if computation is like roads: The more we can do, the more we need.

<comment><USER29> It's a different thing reacting to one person than reacting to a million people, especially when those million people's actions are tightly coupled with each other in a social graph. But if you could fit a million people's state into memory AND also handle a very fast flow of messages at one physical box, well that's probably good enough for government work! But we love stateless, wasteful architectures (wasting server CPU time, memory, and network bandwidth) so that means you need 1000 machines to support 1 million people.

(That's not entirely fair since _locality_ also requires some overhead. One machine that supported a million users might be great if all of those people were in one city. But usually that's not the case, so at the very least you need a box in the top 100 cities (by whatever measure, the simplest being population), at least.)

<comment><USER30> Interesting remark. I make the same calculation as yours and I also find that there currently is 1000 servers per million inhabitants on Earth today (between Amazon, Rackspace, MS and DO). In other words, one server serves 1,000 inhabitants. But given that not everyone has access to technology, let alone pay for Cloud services, I've estimated that we've provisioned 1 servers to serve all online services (bank, electricity, govt, OSS, Netflix, Volkswagen software, etc) for 100 citizen in developed areas.

It's an extremely bad, resource-intensive architecture ;)

The number of servers in private companies might be around 1 per citizen, and the number of processors per human around 100x (incl. mobile phone, tv, smart lamps). Given a proc has 5m transistors and humans have 100m neurons... our architecture is so bad that we're already outnumbered by machines by a factor of 20 at least.</comment></comment></comment>


Well-capitalized Seattle start-up seeks Unix developers - <AUTHOR> http://groups.google.com/group/mi.jobs/msg/d81b6c1fa8f361fc?pli=1 <comment><USER2> [quote from link] Your compensation will include meaningful equity ownership. [/quote]

Yes, but will it ever be worth anything? ;-)

<comment><USER3> If you have to ask then maybe it's not worth. I think that wherever you go you have the chance to make something meaningful if you really want to.

Edit: I didn't realize the date at first, so the downvotes are in order. I still believed in what I said tough.

<comment><USER4> You got downvoted for accidentally raising the very good point that the e-mail does not contain enough information to allow a prospective candidate to decide what equity would be worth? I don't know who gets downvoting power around here but they sure do not have much of a sense of humor.

<comment><USER5> what does an email that has sufficient information to valuate a company look like?

That email has more than enough information to tell me that its probably a good candidate to find out more about.

<comment><USER6> An email only has sufficient information to gauge the future value of some startup _if_ that email has been sent back in time from the future. Preferably it is still smoking and glowing blue and placed in your hands directly by Christopher Lloyd himself.

</comment></comment></comment></comment></comment><comment><AUTHOR> On a serious note, this is exactly how you should write job ads if you want exceptional hackers, imho.

<comment><USER7> Perhaps minus the degree requirement though.

<comment><USER8> so, we always say this... but doesn't the success of amazon, and other "degree" driven companies mean we are wrong??

maybe having a degree does matter?

<comment><USER9> There are many counter-examples. What about the success of non-degree-driven companies like Microsoft, where the founder dropped out before completing school? Does that prove that degrees are silly and worthless?

The thing is that degrees might mean something or they might not; it's not too hard to get through higher education without retaining anything or even learning anything relevant in the first place, but by the same token, some people do some really cool and meaningful work at college and it means a lot. You just have to take it on a case-by-case basis.

<comment><USER10> No, it's a false dichotomy to say that because Bill Gates dropped out of college that all degrees are therefore "silly and worthless". He dropped out of Harvard (where simply being accepted is an achievement in itself) in order to found the the company that would eventually make him the wealthiest person in the world. There is no doubt that he would have been capable of completing his degree had he chosen to.

For regular people who need to persuade someone else to hire them, having a degree certainly helps and is often a requirement.

<comment><USER11> That is the point. Not having a degree doesn't imply that one wouldn't be capable of completing a degree. Bill Gates is an example of that. People here also aren't saying that that a degree isn't "often a requirement" in job listings — they're saying it shouldn't be, not that it isn't.

Incidentally, I would bet most people who don't have degrees could have one if you gave them a full free ride. Getting a degree these days requires several years of your life and huge gobs of money, but that's pretty much it.

</comment></comment></comment></comment></comment></comment><comment><USER12> If anyone doesn't recognize the name of the poster (like me), this is what ended up happening:

<http://amazon.com/>

<comment><AUTHOR> Looks like an interesting start-up, but with the IPO market still frozen, how will they ever exit? Their investors will clearly never get their money back. Maybe Google will buy them to hire their engineers.

</comment></comment><comment><USER13> This part is cute:

"Familiarity with web servers and HTML would be helpful but is not necessary."

Shows just how new the web was in '94.

<comment><USER14> A great contrast to all the other job openings in 1994 that required five years of Java, HTML, and Linux experience.

<comment><USER15> Wow, that's a _really_ tough requirement. Java was first publicly announced in 1995.

<comment><USER16> You get one point for being smart enough to notice that Java wasn't announced til 1995. You lose two points for not being smart enough to realize he was joking.

<comment><USER17> It may not be obvious that it was a joke, given that impossible requirements have been asked of before. Case in point: requiring 3 years of rails development when it had only been in existence for 2 or so years.

<comment><USER18> ..that was the joke

</comment></comment></comment></comment></comment></comment><comment><USER19> Maybe this guy Larry should apply.

[http://groups.google.com/group/comp.lang.java/msg/88fa108450...](http://groups.google.com/group/comp.lang.java/msg/88fa10845061c8ba?pli=1)

</comment><comment><USER20> Hmm.. I didn't know their original name was Cadabra.

<comment><USER21> Bezos changed the name from Cadabra to Amazon because Yahoo would return search results alphabetically.

<comment><USER22> Holy shit.

<comment><USER23> No, that's alphabetically worse, but good suggestion.

</comment></comment></comment></comment><comment><USER24> I find it even more amusing that his one other newsgroup posting is on finding a good dog obedience school in the Seattle area: [http://groups.google.com/group/seattle.general/browse_thread...](http://groups.google.com/group/seattle.general/browse_thread/thread/4565a0ffdb19670b/0f3ba2135943ce01#0f3ba2135943ce01)

<comment><USER25> Funnily enough, it's not even him posting, it's his wife, Mackenzie, posting under his account.

<comment><USER26> My wife did that for a while on a bunch of amazon forums bashing the Twilight series.

It was one of the driving factors for me buying her a laptop of her own that I _never_ log into. I really need a prospective employer or friend Googling my name and seeing that I not only read Breaking Dawn, but that I felt strongly enough about it to bash it with a bunch of other ladies.

EDIT: Just to clarify: the forum was 99% women according to my wife. I am not implying that Real Men don't read Twilight, just that I'd feel like less of a man if I read it. To each his own.

</comment></comment></comment><comment><USER27> Note the signature on his message.

"It's easier to invent the future than to predict it." -- Alan Kay

<comment><USER28> Saw it, and to be pedantic, isn't that a bit of misquote? I've always seen it as:

"The best way to predict the future is to invent it."

<http://www.smalltalk.org/alankay.html>

</comment></comment><comment><USER29> Heh.. I was actually job-hunting about that time. Wish I'd seen it....

</comment><comment><USER30> I like how he says "you should be able to do so in about one-third the time that most competent people think possible"

<comment><USER31> My first thought was "How do I become someone who designs and builds large and complex (yet maintainable) systems in about one-third the time that most competent people think possible?"

<comment><USER32> The best way is to have done it before. Its easy to implement something in 1/3rd the time as someone else, if you've done it before and they haven't.

</comment></comment></comment><comment><USER33> Amazon is still hiring ;) www.amazon.com/jobs

I don't know if we're developing 3 times faster than possible, but from the inside it's amazing to see how many projects launch on any given week without any part of the machinery ever stopping.

<comment><USER16> There's a bug with my amazon prime account. Every time that I pay, I have to manually select "use my amazon payments" balance. I can't save this preference, in a payphrase or just as a normal cookied setting. Thanks!

</comment></comment><comment><USER34> If Google offered its first public services in '98, where did these posts originate from? Did Google merge an existing message board system into Groups when it was released?

<comment><USER35> Usenet. They bought Dejanews and have archives back to the early 80s.

<comment><USER36> Dejanews had been archiving usenet as far back as the mid-90s but they (now google) actually have usenet archives donated by others dating back to 1981.

</comment></comment></comment><comment><USER37> Sadly, the logo no longer contains capitals.

<comment><USER38> why would that make anyone sad?

</comment></comment><comment><USER39> (1994)

</comment><comment><USER40> poorly-Capitalized uk Start-up seeks Money

</comment><comment><USER41> Only very tangentially related, my scrappy, not-too-well capitalized (from Founder's Co-op: <http://www.founderscoop.com>) Seattle start-up (AppStoreHQ: <http://www.appstorehq.com>) is also seeking developers:

[http://blog.appstorehq.com/post/482789903/appstorehq-is- look...](http://blog.appstorehq.com/post/482789903/appstorehq-is-looking-for- one-developer-entrepreneur)

EDIT: Err, why the downvotes?

<comment><USER42> Inappropriate. There are better way to announce jobs on HN.</comment></comment>


How Important Is It for a SaaS Startup to Be Profitable? - <AUTHOR> http://www.tomtunguz.com/how-important-is-profitability-in-saas/ <comment><AUTHOR> That first chart has me worried... This would be the year of a startup bubble burst, if it follows same pattern as last time.</comment>


Beat SMEP on Linux with Return-Oriented Programming - <AUTHOR> http://falken.tuxfamily.org/?p=115

<comment><USER2> A good paper came out a few years ago that defeats ROP by adding protections to ensure that returns/calls/jumps are only taken if the function was entered at its entry point, and rearranging register allocation if the compiler creates unaligned instructions that can be used to ret/jmp. They say the performance penalty isn't huge, but I guess it must be enough if people aren't implementing it.

[1] G-Free: Defeating Return-Oriented Programming through Gadget-less Binaries (<http://iseclab.org/papers/gfree.pdf>)

<comment><USER3> _They say the performance penalty isn't huge, but I guess it must be enough if people aren't implementing it._

There are other, social reasons why it may not be used. Academics are usually evaluated on published papers, so papers are often their end goal. Their code is usually proof-of-concept quality, not production quality. So it's not realistic to be able to take code written by academics and directly integrate it into real software stacks. And the people who are in a position to integrate new features into open source software stacks often have dozens of other features that are also important, so why work on this one? There really needs to be a champion for the idea in the already-existing community for that project.

This work also has the secondary problem of cross-cutting concerns. In order to provide better security in the kernel, they're modifying the assembler. So now you need a champion who works in the assembler, but cares a lot about kernel security.

Good paper, by the way. I've only read the intro, but I'm going to read the rest later. It looks to have a good primer on ROP.

<comment><USER4> I am the author of the paper on G-Free.

G-Free does not modify the assembler, or any other component on a system. It is a completely independent layer between the compiler and the assembler. And its performance overhead is indeed surprisingly low.

Even then, there are numerous reasons I can think of why it won't immediately be included in a production environment (as won't most cutting edge research).

The first reason being, by definition, G-Free is a compiler based solution. You need the source code in order to build gadget free software. This may not be the best fit for an already established production system. However, I can imagine this system being easily adapted into a binary loader, so that it does its trick when loading a binary into the memory.

Then, you have the issues of compiler verification. You are right in saying that research quality code does not equal production quality. We do have a prototype implementation that works nicely, as described in the paper. But who am I to say it is perfect? Well, we compiled a full system with it, and have been running it without problems since then. But you never have the assurance unless you do some formal verification. I would not compile a critical piece of software (something running on an aircraft, for example) with just any implementation, without having solid ( = formal) proof that the implementation is perfect.

<comment><USER3> Calling G-Free an independent layer between the compiler and the assembler is a semantic distinction, not an implementation distinction. The step needs to live in either the compiler (as a post-processing phase) or the assembler (as a pre-processing phase) to be automatically integrated into the software stack.

<comment><USER4> Using your terms, it _is_ an implementation distinction as well. You install G-Free, call 'make' to build any software, it comes out gadget free. You delete G-free, call make, it comes out with gadgets. With our prototype implementation for Linux and GCC, you don't need to touch gcc or gas or the linker or anything else. This is explained in the paper.

If you have a build system where the assembler and the compiler are bundled as a monolithic binary executable, then your argument may or may not hold.

EDIT: Just to clarify, 'make' was just an example. You can also directly call "gcc program.c" or "as anotherprogram.S" and G-Free does its job.

</comment></comment></comment></comment></comment><comment><USER5> "kernel symbols hiding" ... I always find that to be funny. Once your code is in kernel space, searching for kernel symbols by name is easy. Proof is in the program I wrote called virt-dmesg which uses heuristics to search for the main symbol table, and also for kallsyms if available

<http://people.redhat.com/~rjones/virt-dmesg/></comment>


Nvidia's Image Restoration AI: Almost Perfect - <AUTHOR> https://www.youtube.com/watch?v=P0fMwA3X5KI <comment><AUTHOR> An unofficial and partial Keras implementation of "Noise2Noise: Learning Image Restoration without Clean Data": [https://github.com/yu4u/noise2noise](https://github.com/yu4u/noise2noise)</comment>


Rewriting My WordPress Site in HTML/CSS and Comparing Performance - <AUTHOR> https://kevq.uk/rewriting-my-wordpress-site-in-html-css-comparing-performance/ <comment><USER2> With another day and a half of the Bank Holiday to fill you might want to compare performance of Wordpress with Openlitespeed. Theres an ec2 image that makes it easy. My site saw a 5x speed up which has made me an advocate.</comment>


Google launches 'Inactive Account Manager' to deal with your data when you die - <AUTHOR> http://www.theverge.com/2013/4/11/4213126/google-launches-inactive-account-manager-to-manage-data-after-death <comment><USER2> Rewrite of TechCrunch's rewrite of [http://googlepublicpolicy.blogspot.com/2013/04/plan-your- dig...](http://googlepublicpolicy.blogspot.com/2013/04/plan-your-digital- afterlife-with.html)</comment>


Two Weird Tricks with Redux - <AUTHOR> http://jlongster.com/Two-Weird-Tricks-with-Redux <comment><USER2> I like the elegant simplicity of Redux, but it's so low-level and definitely feels like people are still figuring the "right" way to do a lot of things.

I tweeted my feelings on this last week:

        2015: reflux flummox redux marty alt fluxible…
        2016: redux-actions redux-act redux-forms redux-promise redux-ui…

[https://twitter.com/tlrobinson/status/717258992989306880](https://twitter.com/tlrobinson/status/717258992989306880)

<comment><USER3> Heh. Can definitely vouch for that. I recently put together a links repo cataloging most of the Redux-related ecosystem, and was amazed at how many overlapping or similar libraries there were. 12 different promise middlewares, a couple dozen different side effects plugins, and I don't know _how_ many utilities to generate action creators, reducers, and constants.

The list is over at [https://github.com/markerikson/redux-ecosystem- links](https://github.com/markerikson/redux-ecosystem-links) if you want to look.

<comment><USER4> Thanks for putting that together! I'd discovered it a while ago and have been checking out all the utility libraries, trying to find ones that work the way I want. The funny thing is that so far none do, so I'm now working on one of my own...

</comment></comment></comment><comment><USER5> I don't know much about Redux but these tricks seem like they should be less trick and more re-worked flow.

For the first one, if a burger is meant to be consumed differently than fries (serial versus parallel) they why are they using the same mechanism with the burger having a hacked on predicate , service type, dispatch, etc? Why wouldn't the burger just have a workflow that makes sense for how its invoked? For instance if the burger is tied to the UI and a backend request that must happen one at a time then the UI would disallow or provide a way of queueing which I guess this sorta supports but it seems forced and doesn't look like a normal flow.

The second part, ignoring async responses. I don't understand this part. Why can't you just replace your state and drop the existing handlers so nothing async from the previous state occurs? Does redux just not support this out of the box or is the author doing something very edge-case-y?

When I don't want to handle an async response anymore I remove the handle's association with the event it was going to handle. It works like this in native DOM, jQuery, even my own bias data point: msngr. But I'm curious why wouldn't redux be able to handle the same case?

<comment><AUTHOR> There are many reasons why the UI should not care about how the server requests are ordered.

> When I don't want to handle an async response anymore I remove the handle's > association with the event it was going to handle. It works like this in > native DOM, jQuery, even my own bias data point: msngr. But I'm curious why > wouldn't redux be able to handle the same case?

In our case we use the same connection but it switches "contexts" and we want to ignore everything from a previous context. In simpler situations you could make sure the your connection is destroyed before the UI is destroyed, yes.

<comment><USER5> > There are many reasons why the UI should not care about how the server > requests are ordered.

Sure. It was just an example. My main point was the change here felt like a hack and they forced a mechanism that should be processed serially into one that is meant to handle parallel.

> In our case we use the same connection but it switches "contexts" and we > want to ignore everything from a previous context. In simpler situations you > could make sure the your connection is destroyed before the UI is destroyed, > yes.

So wouldn't it be best to sever ties that will cause issues and reconnect them versus anything else? That's typically the pattern you use when you want to replace event handlers. The way in the article just wastes a lot of CPU cycles to support an awkward pattern I've never seen someone use before.

Just my 2 cents. But like I said I've never used Redux so maybe these patterns are normal here.

</comment></comment></comment><comment><USER6> I just started with redux-saga which uses ES6 generators to handle app control flow.

After first impressions, I'd say it's worth a look if you're running into anything near as complicated as talked about here. It's very easy to reason about and test. gaearon - the creator of redux - seems to approve of it as well.

[https://github.com/yelouafi/redux-saga](https://github.com/yelouafi/redux- saga)

<comment><USER7> I just wrote our API layer with redux-saga too, I started with thunks but I didn't like dispatching thunks and actions, also it was hard to reason about flow and side effects: If I update my search form, the results need to be updated, but the action is "update form", not "update form and update search results", the search result update is a side effect more than something that should be actually fired from the update form.

Saga is making side-effects (workflows) possible by subscribing to events.

So in this case I have a saga waiting for 'SEARCH_FORM_UPDATE', then it waits for 300ms, then starts the ajax request flow: a request start action, then a request complete action (or request error).

The code reads almost like synchronous code once you understand yield.

It also allows you to listen to actions that you do not control: we wanted to do something whenever a specific redux-router action happened. You can't do this with thunks, we would have needed a middleware to do this. With sagas you can simply hook up a flow to the action.

</comment></comment><comment><USER8> The isEatingBurger (isLoading) flag seems to be idiomatic in Redux and shows up in tutorials. In addition to preventing overlapping requests, it's useful for spinners, disabling submit buttons, etc. It's cool that you rolled the isLoading pattern into a service.

If you really want to pass around the promise, it's doable. To save in your component state, return the promise from your thunk so it gets returned by dispatch (thom_nic just posted this also). To save in your store, dispatch a 'save' action from the thunk with the promise as an argument. But I agree that it's probably a bad design.

The request sequence IDs are useful for many situations where you need to order or cancel async requests. If you have multiple in-flight requests for an autocomplete field, you only want to set isLoading=false when the last request completes, and you don't want the result of a later request to overwrite the result of an earlier request if the responses come back out-of-order.

</comment><comment><USER9> My usual approach is to avoid middlewares for async-requests and to keep this stuff in a separate layer. For example, it can look like an ApiClient object with ES7 async-methods. Such methods would:

1\. send "Start" action

2\. await for result of fetch("[http://example.com/api/call");](http://example.com/api/call"\);)

3\. send success or error action

this way redux is 100% synchronous and I have an obvious place for throttling requests, keeping trace of promises, etc.

</comment><comment><USER10> In addition to redux-saga ([https://github.com/yelouafi/redux- saga](https://github.com/yelouafi/redux-saga)) which others have mentioned, redux-loop ([https://github.com/raisemarketplace/redux- loop](https://github.com/raisemarketplace/redux-loop)) is another interesting "declarative" approach to sequencing operations that uses promises. I'm not using either (yet), but I wrote up my notes on the differences between them and the thunk middleware approach recently ([https://blog.boldlisting.com/connecting-redux-to-your-api- ea...](https://blog.boldlisting.com/connecting-redux-to-your-api- eac51ad9ff89#.79d5lnivt)). One aspect of these discussions that I find is lost or at least very implicit is the notion of storing metadata about the status of async operations as well as their result is elided together, but there's reason to make mindful choices about whether or not to do that.

BTW, the "Ignoring Async Responses" section here is a useful pattern, even if you're not working on browser developer tools ;). I've been working on a web app and have a polling timeout that I cancel on logout. Not quite the same, but logout triggers a reset of all the state obtained while authenticated, but the timeout ids are also in the store and canceled before being cleared.

</comment><comment><USER11> What stuck out to me is

"In an asynchronous world, you have 3 actions indicating asynchronous work: start, done, and error. In our system, they all are of the same type (like ADD_BREAKPOINT) but the status field indicates the event type."

This is a great suggestion (I have used a very similar schema before, although in flux), and should be the standard suggestion in redux tutorials.

Not enforcing this can lead to a proliferation of inconsistently named constants, especially if a team is learning flux/redux and has not yet settled on a naming schema.

<comment><USER12> Check out flux standard actions for even more consistency:

[https://github.com/acdlite/flux-standard- action](https://github.com/acdlite/flux-standard-action)

<comment><USER13> One problem I have with standard action is that on failure I sometimes want to have more than just an Error as payload. Something like `payload: {error, seqId}`. You could add it to error itself, but I find it more consistent to put it into the payload directly.

</comment></comment></comment><comment><USER14> Can you tell me a use case using the "action" that's sent to "request.run", or is it passed just because it can be.

[https://github.com/mozilla/gecko- dev/blob/master/devtools/cl...](https://github.com/mozilla/gecko- dev/blob/master/devtools/client/shared/redux/middleware/wait-service.js#L51)

<comment><AUTHOR> If you are waiting for a "done" async action (which is usually the case if using this), you might want the action to inspect the value that it was resolved with. We use this in tests: [https://github.com/mozilla/gecko- dev/blob/master/devtools/cl...](https://github.com/mozilla/gecko- dev/blob/master/devtools/client/debugger/test/mochitest/head.js#L1234)

Tests can wait for an action to be dispatched and the promise is resolved with that action, and tests can inspect it.

</comment></comment><comment><USER15> Good stuff,

The EAT_BURGER seems slightly odd, as i've never hit a situation where I would allow a second one to be fired while the first is still pending. I.E. upon EAT_BURGER.start i would disable the UI for the EAT_BURGER action to be fired. I guess that's an idealised world and you've hit something more complicated that requires it though, and the solution is good

I particularly like the async call tracking - very simple and neatly solves your issue!

Cheers

</comment><comment><USER16> re: an action caller needing to wait on the async action to complete: I thought that was a non-issue. If you use redux-thunk and your action creator returns a promise, the caller gets it. So while you're no longer triggering off of a redux action/store state change -- which may or may not be seen as a good thing -- you _can_ get the promise and add a `.then()` which will fire after the async action completes.

I put together a simple example here: [https://gist.github.com/thom- nic/fbedf27a5222a8490aa9028a40b...](https://gist.github.com/thom- nic/fbedf27a5222a8490aa9028a40bf053c)

Basically: component fires a 'delete' action, and then does page navigation when delete is successful. (Not saying this is a good idea to do it that way, just that you _can_ do it.) Or did I miss his point?

<comment><AUTHOR> My post says exactly this. Read the full thing. There are other cases where you do not have a reference to the promise. (think a function being called again at some indeterminate time)

<comment><USER16> Ok, sorry for the misunderstanding - I'll re-read the post and see if I can understand the scenario you're describing.

</comment></comment></comment><comment><USER17> > I've used it a couple times to solve complex scenarios

I would love to know what those scenarios were.

<comment><AUTHOR> Basically a UI optimization. Instead of firing multiple requests to the server a lot, we know that a specific UI event may happen multiple times in a short period, so we "throttle" it by only performing the request once at a time and only re-requesting it if it was requested again.

So far it's always been a UI optimization like that.

You could handle this at the connection layer, but I liked how it integrates with actions better (it gives a finer control over when actions are dispatched)

</comment></comment><comment><USER18> Why not keeping Async operations as react-elements (simple <div/>s with hookds) in the DOM?

</comment><comment><USER19> If I need something with more features than Redux I would probably just use Rx.js.</comment>


Rich Kids Of Instagram - <AUTHOR> http://richkidsofinstagram.tumblr.com/

<comment><USER2> legitimate reasons for class warfare.

<comment><USER3> I don't think we stand a chance. Look at the navy they've got!</comment></comment>


Ask HN: Someone registered my personal name as a domain name to extort money - <AUTHOR> Someone's registered my personal name as a domain name and blackmailing me to extort money. What are my legal option to get that domain?<p>Laws in my country is not well defined and legal route will take a lot time. Is there anything I can do by approaching the domain registrar and web host? I am broke and don't have enough money for a legal fight <comment><USER2> I am not a lawyer, this is not legal advise and probably not great advise.

You said you are broke, so that rules out lawyers. Emails however are free. Contact the registrar and datacenter provider and advise them you are working with a legal team to have their registrar status revoked and AS number revoked for the ISP. Maybe barter with a kvetetcher to nag them daily. There are no grounds for revocation of registrar accreditation, but if the right person reads your email, they may just dump the domain to make the problem go away. Ethics aside, lieing is legal. Debt collectors do it all the time.

<comment><AUTHOR> I can get done through UDPR, but it is very expensive for me at the moment. Let's see if I get any other feasible options.

</comment></comment><comment><USER3> In addition to all the other suggestions posted, compete with the domain. Register the same name with a different TLD and post content, perhaps a blog, with better SEO to obscure the other domain from search results.

</comment><comment><USER4> I don't think you can do anything about the domain itself, but if he's using the domain to spread slander you can do something about that.

<comment><AUTHOR> > spread slander you can do something about that. He is threatening, but > haven't done that yet. I know the one who is doing.

</comment></comment><comment><USER5> Your personal name is not unique. Also, there's no law that forbids to register domain with someone else's personal name. Do you really need this domain? Then buy it. Otherwise, simply don't care about it.

<comment><AUTHOR> Personal name is unique. He is not selling it, He is blackmailing me with some other stuff and threatening me to publish it there.

<comment><USER6> Blackmail is illegal - you may be able to have the police handle that aspect (although I would consult a lawyer, regarding what the police is able and likely to do). Assuming you can afford to let the police know about what he's blackmailing you with, that is.

<comment><AUTHOR> I am talking with the police regarding this. I live in a country where laws are very vague. Hopefully, I can sort the things through that. I was trying to figure out if there is any policies from domain registers or web hosting providers.</comment></comment></comment></comment>


Design Roundtable: WeekPlan - <AUTHOR> http://blog.folyo.me/design-roundtable-weekplan/

<comment><AUTHOR> Here's the original thread on HN where I asked if anybody needed design advice:

<http://news.ycombinator.org/item?id=3548461>

It took me 131 days, but I finally came through!

</comment><comment><USER2> Extremely helpful to understand Web app design. @SachaGreif is one of the best Designer/Entrepreneur who share his learning freely.</comment>


SciDB - <AUTHOR> http://scidb.org/

<comment><USER2> Are they going to lose relational algebra by building over arrays instead of tuples and sets?

</comment><comment><USER3> Haven't they heard about Postgresql? :)

<comment><USER4> I'm sure they have. One of their founders wrote it.

I did't expect much from the site, and their plans seem quite grandiose. Then I saw the founders, and suddenly it seemed plausible.

<comment><USER5> I'm slightly terrified by consensus design</comment></comment></comment>


What tech trends will gain momentum in 2017? - <AUTHOR> https://www.quora.com/What-tech-trends-SaaS-PaaS-Programming-IoT-etc-will-gain-more-momentum-in-2017-and-which-will-falter/answer/Oliver-Wolf-6?share=1 <comment><USER2> Vue.js feels like the dark matter is JavaScript world. The impact is not directly observable, but you can definitely feel it's gravitational pull.</comment>