Moral philosophy: Utilitarians are not nice people - <AUTHOR> http://www.economist.com/node/21530078

<comment><USER2> IIRC, they phrased the trolley question something like "WOULD you push one person off a bridge if it saved five others", not "SHOULD you...", thus selecting not for people who think utilitarianism is correct, but for people who are callous enough to kill. You can prefer the results of utilitarianism without actually being able to stomach killing someone yourself.

(Now, you can argue that it's actually more callous to let the five people die, but I don't think it's the super-empathetic people who will find it easiest to push people off bridges.)

<comment><USER3> It's an old problem. The people who are willing to do the killing are the people who rise to power in such systems. These are the people who are least likely to continue to uphold true utilitarian values once they've attained that power.</comment></comment>


Smashing Through Azure VM I/O Throttle Limits - <AUTHOR> http://www.grsplus.com/blog/2018/07/azure-storage-smashing-through-azure-vm-i/o-throttle-limits/ <comment><USER2> And this is exactly why I use Azure: for some very specific tasks, they rock! Just make sure to benchmark everything

Unlike on AWS, I haven't had some service "not available" within a zone (hint: try to get a Lightsail in Brasil) and DNS is not so bad.

I am eargerly waiting for Azure new DC in Africa, hopefully this year.</comment>


Ask HN: Is it possible to sue a software company for bugs? - <AUTHOR>

Have you encountered cases that people sue software makers for bugs? Is it common? Is it even possible? <comment><USER2> If you look at the majority of consumer software, be it open source or proprietary, you will notice that its license terms always explicitly disclaim all liabilities and warranties of fitness for a particular purpose. Using the software creates a legal agreement to not sue regardless of how buggy the software is. Software development contracts between businesses usually have different terms, so there might be grounds for suit depending on the contract in question. For the typical individual user, they are unlikely to have any legal recourse regardless of how badly software behaves. About the only exception I can think of right now is the infamous "Sony rootkit", but in that case, the major issue was exactly that the software was installed regardless of the user agreeing to the license and that its nature as being independent of the music content purchased was not disclosed.

</comment><comment><USER3> Reckless incompetence pervades the industry because it's long been accepted that there are no real consequences for it. Even if I formally prove my program to be correct, I couldn't offer a warranty because I can't _get_ a warranty that any platform will actually execute my program correctly. Compilers have bugs. CPUs themselves have bugs. And of course every mainstream OS is a huge chunk of native code that casually does unchecked pointer arithmetic, with a long sad history of bugs.

Nobody wants a verifiable platform badly enough to hire talented engineers who take quality seriously (a group that I only wish I could say includes me) to build one starting from sand. Instead we all ship crap for maybe 1/100 the cost, and get what we deserve.

</comment><comment><USER4> Software are made to have bugs. I don't think that this is even possible or should be. But a certain amount quality threshold should be there for any software product. Software should do the primary task it is meant to.

</comment><comment><USER5> maybe you can. if you outsource the development and both parties agreed in the contract--to maintain certain level of software reliability/security.

</comment><comment><USER6> Of course. Winning, though…</comment>


Vital – minimal CSS (8kb) to resuscitate you from framework hell - <AUTHOR> https://engineering.doximity.com/articles/vital-css-framework <comment><USER2> This framework started development over 4 years ago, I formalized this framework and open sourced it because I felt the modern world needed something fresh and simpler.

If anyone has any questions just leave a comment!</comment>


My interview with Groupon when they were in only 10 cities - <AUTHOR> http://www.beyondthepedway.com/groupon

<comment><USER2> Thanks for posting this. One of my favorite clips of Andrew Mason is this one w/ him before Groupon (when it was ThePoint): [http://thedreaminaction.com/2010/07/17/my-interview-with- and...](http://thedreaminaction.com/2010/07/17/my-interview-with-andrew-mason- ceo-of-groupon-before-groupon/)

My favorite line from him is around 3:20: "I wasn't trying to be a tech entrepreneur or anything like that, I didn't know about any of that stuff. I was just a developer."

</comment><comment><USER3> Could you apply subtitles or provide a transcript for deaf readers like me?

It would be very helpful to following the interview.

<comment><USER4> Hawaian looking lady

This is my first .....Groupon is Fun. Time.

Someone else: Good

Hawaian looking lady continues (while counting on her fingers) Girls. Here. Are. Fun and Boys.

They burst out laughing...

Hawaian looking lady continues Love. Wa.Wa.Wi.Wa

(I am not even kidding, this is really what she said)

Music plays for a few seconds until 0:55,

Andrew:

My name is Andrew Mason, and I am the founder slash ceo of Groupon. Groupon is aaaaa local shopping site, and we feature one deal each day on something to do in a city across the United States. We started in Chicago back in November, now in 10 different cities, will be in 30 by the end of the year.

The deals are on everything from restaurants to spas, salons, events activities,sidekicks, all kind of things, anything that's interesting to do in a city and we try to find the best stuff out there. And then we have 50% off, more than that. And the way we get those prices is by this idea of group buying. Hence the name groupon, group coupon.

And what that means is for each one of this deal a minimum number of people need to join in order to actually get that deal. For businesses there is no other way to get a thousand, 3000, 5000, 7000 customers. Guaranteed customers through your door. An ad on the New York Times is not going to do that, or the Tribune, or or putting something on the side of the bus or on the ...., ya' know. None of that stuff is going to give you the same kind of measurable results.

Shawn Bercuson:

We tested a lot of neat things. Huhhh Real estate, apartment rentals. We've contacted by a lot of neat companies. The thing a.. We .. We don't really ..We try not to turn anybody down... People see our model, whether it's hard wood flooring or ya' know, not the traditional groupon. But we are going to try to figure out a way to make it work.

We think outside the box and continue to, again, push the limits...And, I dont know if Andrew already told you this or not, but the mentality we have here is not why, it's why not. Can we make it work, and we are going to do our best to.. To try to accomodate anybody who wants to use groupon as best we can.

Mason:

For every city we go into, there is almost like a mini business and the two or three people that are working on that city, it's like their own mini entrepreneurship. And they get to go in there and start out with 5000 subscribers on the daily email list, getting a 100 groupons sold a day or something like that and watch that grow to the point that they are selling,..ya know.. 2000 and then 3000 a day and then more and more... So everybody in their own way gets to be engaged in the excitement of the growth the group is experiencing.

Pawan:

We handle all the calls . We have a 800 number. So we handle all the calls and the emails to our support at groupon email address. So if people have questions regarding accessing their groupon or questions about expiration dates or what groupon is about. We are essentially the voice.. The first voice they hear when someone contacts the groupon support number.

Interviewer:

Do you get like a lot of questions throughout the day

Pawan:

Yeah. We probably get something like. At least 500, 600 calls a day at least it seems that way. We receive probably at least same number of emails on a daily basis. We are quite fast paced. And..we are constantly busy.

Mason:

We try to build a company that we would like to work for and most of that just means the same thing as being a good person. hmmm. which is you behave the same way you would other people, companies to behave towards you. Hmm so we look for people who have that kind of integrity, but it is also people that are excited by the idea of building a company that feels human in a sense that they are doing the things that amuse them orrrr that they enjoy and have fun with

Bob Matteson:

I was actually the first sales guy that we hired at Groupon...Haaaa, back in October. So I came in on an internship paying me pennies per hour, but haa, I started basically because I thought it was a cool concept and it had some legs. Actually I was run in by a friend of mine Shawn who knew I grew up in Chicago and would be a good guy to kinda think of fun things to do.

Interviewer:

You were the first sales guy.

Bob:

I was the first sales guy.

Interviewer:

How have things changed since that first day you walked in October.

Bob:

Well I did change quite a bit because hmm

I:

Does it rain paper a lot (refering to someone throwing paper at Bob)

Bob:

It does rain paper. See that is something that has changed. So on their 8th floor it did not rain paper.

Mason:

I came to chicago in 1999 and I've always loved it here and when it came to start a business it just..There never were a good reason to do it anywhere else. From threadlist to 37 signals to Everyblock. There is lot of. Everybody that is doing something is sort of carving their own, their place and doing their own thing.. and that is something that I really like about the technology scene here, here in Chicago

Jessi:

I am the community manager here at Groupon. So I run twitter streams, and Facebook pages. I do press outreach as well so. So some of the time the twitter stream you talk to is me, sometimes it's ANdrew. You know if you get lucky. It's a good job, it's fun. I really like it and I am new.

Interviewer:

You've got quite the setup here:

Jessi: Yeah. Exciting. Wheeeeww.

Interviewer: What is your favorite part about groupon?

Jessi: It's a fun environment (then she plays with her hair...maybe she is lying or she likes the interviewer. Just saying). There is a lot of young perople, a lot of energetic people so we really. It's always a good time, it does not really matter. YOu there isn't a bad time. You are always having fun while...which is not a lot of people can say that about their job.. Cool...

End

<comment><USER3> Wow, thanks for taking the time to write a transcript with unprecedented detail!

<comment><USER4> The pleasure was mine :).

<comment><AUTHOR> Looks like you beat me to it. Thanks, appreciate it!

</comment></comment></comment></comment></comment><comment><AUTHOR> As I was checking the referrers to Beyond The Pedway, I noticed Groupon had a page listing all of it's media mentions including my interview from 2 years ago.

I figured I'd share it here since it's such an old interview, most folks coming to my site don't know it exists.</comment>


Ask HN: Framework for social community - <AUTHOR>

Hi. I am currently looking at building a community site around an online game. The game is very well suited for a community and they would most certainly complement each other. The community site would be your basic register, chat, friends etc. Nothing too exotic. It would be nice though to incorporate some dynamic behavior through Ajax/Comet/JQuery etc.
My question is: What would you recommend in terms of language/framework to build an online community site?
At this state I am pretty much open to any language/framework. My approach is to go as lean as possible, releasing very early and try to adjust the site from what we learn once we go live. I have looked at frameworks such as Django/Wicket/RoR, but also at pure CMS solutions such as Drupal/Joomla.
Any and all suggestions are welcome! <comment><USER2> Django has pinax <http://pinaxproject.com/> which I've had a quick look at in the past and seems quite cool and practical.

<comment><AUTHOR> Yeah, I have looked at Pinax and it looks really nice. However, my concerns are that it looks still a bit in development and that the community is still small. I would love feedback from someone who has actually used it to build something like a community site...

</comment></comment><comment><USER3> You might wish to use these (not programming specific but a good resource perhaps?): [http://developer.yahoo.com/ypatterns/social/people/reputatio...](http://developer.yahoo.com/ypatterns/social/people/reputation/)

<comment><AUTHOR> That's really cool. Succinctly and clearly written user patterns, good resource indeed. Thanks!

</comment></comment><comment><USER4> Rather than build a new site up from scratch, why don't you just create a group on facebook or something??? Most of your users will probably be on facebook, and this would also save you a lot of time.

<comment><AUTHOR> We will not be able to provide the functionality this way. We pretty much need to build a new site from scratch... It is not a bad suggestion though and we will certainly integrate with Facebook in some manner.

<comment><USER4> In that case you might also want to consider having a way such that when your users get an achievement or something in the game, their profile on the site gets automatically updated. Then, they could publish these achievements to their Facebook or Twitter streams. This will increase the virality of your game.

<comment><AUTHOR> That is definitely on the road map, however, right now I am just trying to find a good technology stack =)</comment></comment></comment></comment>


Bitcoin $6000 - <AUTHOR> https://www.bloomberg.com/news/articles/2017-10-20/bitcoin-nears-6-000-as-bulls-refuse-to-blink-at-regulation <comment><USER2> Predictions on how high it will go and why?

<comment><USER3> I think bitcoin will go to $10,000 USD and when it reaches the five digits people will stop caring about 1000 USD price fluctuations, just like people no longer care if the price increases or decreases $100 USD.

I think the price will slowly reach $100k and $500k and we'll see trillions in market cap. I think the bitcoin price reflects our economy; the more governments/central banks print money, the higher the bitcoin price will be.

Bitcoin already is a good store of value, but I think in the long term we'll also see bitcoin being used as money, with things like the Lightning Network.

I think we'll see more soft-forks being done by the community to improve the network and make things more efficient.

Also, when the price goes higher than $500k people won't even notice price fluctuations anymore, so the price will remain stable and people will start using it as money.

I also think that people will stop comparing bitcoin to fiat eventually. Maybe we'll say 1 BTC == 1 BTC, or 1 BTC is worth N mBTC?

Of course this won't happen overnight, but it will happen, the only thing bitcoin needs to do is survive until it reaches mass adoption.

We already hit $100 billion market cap, $1tn is right around the corner. The price should only increase with the market cap increasing.

"When bitcoin goes to the moon, it becomes the moon" —Richard Heart</comment></comment>


Backblaze hard drive reliability stats for Q3 2016 - <AUTHOR> https://www.backblaze.com/blog/hard-drive-failure-rates-q3-2016/ <comment><USER3> With hard drive size increasing so quickly but hard drive transfer speeds basically flat, I wonder if there are long-term implications for them with respect to recovery from backup and downtime. For example, if a whole rack goes down, and they are on 32TB drives in the future, for example, could it takes a week or more for their data to get online?

<comment><USER4> Well, uh, yes.

No one really expects that rotational rust will get much faster, and in fact history shows that, compared to the increase in density, the increase in transfer rates are laughable at best. Between 1990 and today you are probably looking at a 20 000 times increase in density, yet transfer rates only increased around a factor of around 150-200. [In fact, from the early 1960 to today it's only a factor of about 1000. There are quite possibly few performance metrics that increased so slowly as disk transfer rate].

Why is that?

Increasing density does only marginally increase transfer speed: Most density increases are achieved by packing more tracks onto the platter, while storing more sectors per track plays a minor role. But a single R/W head can only read a single track, not parallel tracks, hence speed only increases if you pack more sectors into each track, not by increasing the number of tracks. That's why between today and 10 years ago performance in desktop or server drives only differs a little, compared to the capacity increase to 8+ TB in a 3.5" drive.

More platters also don't help in transfer rate, because the alignment of all heads on the actuator is fixed: at any given time only one platter and one R/W head is used (locked to the track). [More platters can help reduce seek time in certain scenarios though]

More disks on the other hand...

<comment><USER5> That's not entirely true.

Higher density means more data per track, not just more tracks per disk. You get an entire track per revolution so a track with more data is more MBps. So linear reads on a higher density drive are faster, and semi-linear accesses (ie, reading two files that are next to each other) do get faster.

I remember reading a story about a guy who built a drive array with high capacity 7200 RPM drives that got within 20% of the performance of the 10K RPM setup they had, by partitioning the drives at the same capacity as the 10K equivalent. The head only had half as many tracks to traverse, so worst case access time was better, and the higher density made up for the lower RPMs.

<comment><USER6> Short stroking helps get more performance from the disk, at least in terms of latency. The bandwidth change occurs because the density is fixed and there are more blocks on the outer rings per track compared to the inner rings so in one revolution you can read more tracks and you don't need to change tracks so often.

You parent comment is right though, there are only small changes in bit density on the track in recent years so the bandwidth is not improving by much.

<comment><USER5> So we went from 1TB to 8TB disks just by packing 3x as many tracks onto drives? I find that hard to believe, and the benchmarks agree with me.

You don't double the write throughout on a disk by doubling the number of tracks. You need more platters and/or sectors per track to do that.

</comment></comment></comment></comment></comment><comment><USER7> We have about 20TB in an AWS S3 bucket we'd like to backup somewhere separate from Amazon. Is there any chance of Backblaze offering ingestion from an Amazon Snowball export ([https://aws.amazon.com/snowball/](https://aws.amazon.com/snowball/))?

<comment><USER8> Yev from Backblaze here -> Believe Snowball is encrypted and fairly locked down, not sure we could do that.

</comment></comment><comment><USER9> How are people using Backblaze's excellent hard drive reliability reports in making purchasing decisions?

For example when I search for HGST HMS5C4040ALE640 on Amazon I get a dealer selling old out of warrantee drives as new.

[https://www.amazon.com/HGST-MegaScale- HMS5C4040ALE640-Coolsp...](https://www.amazon.com/HGST-MegaScale- HMS5C4040ALE640-Coolspin-Enterprise/dp/B01K3UV65O)

I get similar results with many of the other drives listed and with other websites such as NewEgg.

<comment><USER10> I did, I picked HGST because of their reports. No problems so far.

When you buy hard disks ONLY buy from Amazon or Newegg directly - never buy from a 3rd party seller on their site. Especially for hard disks there is too much fraud, and for a hard disk especially the risk of data loss makes it just too risky (unlike other items).

<comment><USER11> > When you buy hard disks ONLY buy from Amazon or Newegg directly - never buy > from a 3rd party seller on their site.

Agreed. A few times I've purchased third-party disks and found (via SMART data) that the drives were well used despite not being sold as such.

<comment><USER12> Just bought some drives that were fulfilled via Amazon (but not sold by Amazon.com LLC themselves). You've given me something to check when they arrive.

</comment></comment></comment></comment><comment><USER13> Looks like they're offline. Google cache link: [https://webcache.googleusercontent.com/search?q=cache:DNdyZ1...](https://webcache.googleusercontent.com/search?q=cache:DNdyZ1o9QqwJ:https://www.backblaze.com/blog/hard- drive-failure-rates-q3-2016/+&cd=1&hl=en&ct=clnk&gl=us)

<comment><USER14> Backblaze always gives great stats with these. I upvoted the story before looking at it.

<comment><USER13> Agreed. I'm always interested in the results , even if their physical usage of the drives is miles above anything I'm ever going to do with a hard drive.

</comment></comment></comment><comment><USER15> Anyone have a reason why the WD30EFRX has such poor reliability in their last table? Granted it's a smaller sample size.

Only asking 'cause it's my main data hard drive...

<comment><USER16> IIRC 3TB drives were among the newer drives commercially available at retail when the flooding happened in Thailand and all retail drives were impacted negatively. Furthermore, aggregate capacity is only one factor in the design of a hard drive and most 3TB drives were made in a manner that reduces reliability (more platters of same capacity or fewer platters with greater individual platter capacity, can't quite remember which unfortunately). I don't see why a manufacturer would put the newest technology into product lines that are older so I'd presume that 3TB drives are among the greatest in number of platters and the extra components contributes to the failure rate.

Among the least reliable drives I saw in previous reports were Seagate 3TB drives (supposedly they had worse reliability than the legendary IBM Deathstars) and after reading about how 3TB drives were designed across manufacturers years ago during the flooding crisis I decided to avoid 3TB drives entirely. Seems like my decision is finally getting some data to back it up now in hindsight (no pun intended).

</comment></comment><comment><USER17> Backblaze is consistently a great service. Needs a Linux client though.

<comment><USER8> Yev from Backblaze here -> have you checked out B2? We likely won't have a Linux client for our backup service any time soon, but our B2 service has a lot of integrators (like Cloudberry and Duplicity, HashBackup, etc..) that can back up Linux machines, a lot of folks have been going that route.

<comment><USER18> > We likely won't have a Linux client for our backup service any time soon

Ok. But why ? Technical obstacles such as having to deal with distribution diversity - or is it a way of market segmentation ?

<comment><USER8> It's a mixture of a couple things. One is that we tend to run pretty lean and our engineers are all booked up for the foreseeable future. Linux users are a passionate community, but we can't quite justify the development time for a market segment that is not very large. Additionally, because we run an unlimited model, a lot of people would immediately sign up and back up their Linux servers for $5/month and we'd sail out of business. We could address that by putting in limits for those types of devices and only allowing certain Linux builds, but that adds complexity and we want to keep the backup side of the service very simple - which works for the vast majority of folks. So it's a combination of a bunch of factors. We hoped that developing B2 APIs and CLIs would give Linux folks something that they could use if they needed to have offsite backups or archives and wanted to use our infrastructure cause we're pretty neat. Long-winded answer, but TL:DR - small market segment, development time/cost, possible abuse.

<comment><USER19> It's worth considering though that the Linux compatibility is worth more than the actual market share. Our company (with roughly 90% Mac / 5% Linux / 5% Windows users) went with Crashplan to have a single backup solution for all of the employees.

<comment><USER8> Absolutely, and that makes perfect sense. Having one system in place definitely beats out multiples. We know we can't be all things for all folks, but Crashplan is great, no hard feelings ;)

</comment></comment></comment></comment></comment></comment><comment><USER20> Really surprising to me that some disks have 4-5% failure rate yearly. Great data

</comment><comment><USER21> It's fantastic to see the confidence interval quoted in those latter tables (I assume 95%?) - that's far more informative than just the mean failure rate.

</comment><comment><USER22> Why aren't you using tapes? Wouldn't that be more suited for back ups - <USER2> and less failures. You probably don't have a lot of reads anyways?

<comment><USER8> Yev from Backblaze here -> Tape tends to have much higher read times, and can even be more expensive than hard drives in some cases. Since we have Backblaze B2 the data needs to be highly available.

</comment></comment><comment><USER23> [https://www.backblaze.com/blog/](https://www.backblaze.com/blog/) \- 404 right now?

<comment><USER8> Yev from Backblaze here -> We're kicking a couple of server. Lots of load from the traffic so we're putting top me on it! TOP MEN!

<comment><USER8> Back now!

</comment></comment></comment><comment><USER24> Where do retired hard drives go? Do you have in house recycling or contract it out?

<comment><USER25> In the Backblaze case, they are securely wiped clean and then recycled.

</comment></comment><comment><USER26> What does Backblaze do with all the removed HD that still work but maybe have a ton of cycles on them? Are they just recycled, or resold?

<comment><USER27> Disclaimer: I work at Backblaze. We securely wipe the drives, then we sell them to a "used hard drive reseller".

</comment></comment><comment><USER28> 404 File Not Found

Not so reliable I gather

<comment><USER8> Yev from backblaze here -> Yea we're kicking a server or two, it's been loading slow from all the traffic so we put top men on it. TOP MEN!</comment></comment>


Break Google - <AUTHOR> http://www.mahdiyusuf.com/post/10246392773/break-google-search

<comment><USER2> When you search for "${", the page is missing 26 lines of minified JavaScript (lines 9-35 of a non-broken page, at least for me), almost certainly because of a templating bug. These lines, among other things, are responsible for adding the top toolbar to the page. (The missing JS is here: <http://pastebin.com/B9cy3T2c>)

<comment><USER3> I think google search uses this templating language:

<http://code.google.com/p/google-ctemplate/>

It makes sense that the ${ could cause problems.

<comment><USER4> Hrm, but is $ a metacharacter in that language?

<comment><USER5> Hrm, did you click the link?

<comment><USER6> Most likely he did. Did you?

If you did click and skim the page at 1000000000 words/sec, those `$` over there are for USD, and not part of templating system.

</comment></comment></comment></comment></comment><comment><USER7> Tip to the poster, and to anyone: Google (and Facebook, and others) have bug bounty programs. You can get paid tens to thousands of dollars if you report vulns to the vendor first.

<comment><USER8> Pretty low bounty.

 _The base reward for qualifying bugs is $500. If the rewards panel finds a particular bug to be severe or unusually clever, rewards of up to $3,133.7 may be issued._

[http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w...](http://googleonlinesecurity.blogspot.com/2010/11/rewarding- web-application-security.html)

<comment><USER4> For random XSS-style things on web pages, that's a high bounty.

The crazy lucrative bugs you may have heard of tend to be drive-by remote code execution in popular clientsides (like IE or Flash), and the stories about valuations tend to be apocryphal.

</comment></comment></comment><comment><USER9> For me just typing ${ breaks the layout. I agree it probably has something to do with a template engine. I know Java EL uses the syntax ${variable_name} and so does Velocity Templates.

The bug doesn't exist on <https://encrypted.google.com/>

<comment><USER10> and it doesn't exist if you search it from the url bar or the searchbar (with google as search engine) of firefox.

</comment></comment><comment><USER11> Oh, cute. Yet another injection flaw in Google.

Guys, (and I don't mean Google, I mean all of us), don't fix injection by plugging injection bugs; put together some framework that actually avoids all of these problems (or at least doesn't let you add bugs).

<comment><USER12> This is actually a hard problem in the general case, and it is an active area of research. One promising approach is _static taint analysis_ , wherein the source code of a web app is analyzed to detect whether "tainted" output is given to a sensitive "sink" without being properly sanitized. See, e.g., Omer Tripp et al., "TAJ: Effective Taint Analysis of Web Applications" (PLDI 2009) (<http://www.cs.tau.ac.il/~omertrip/pldi09/paper.pdf>).

As an example of a difficult case, consider the following pseudocode snippet:

      ...
      if request['raw']:
          print("Content-Type:text/plain; charset=utf-8\r\n\r\n")
          print(doc)
      else:
          print("Content-Type:text/html; charset=utf-8\r\n\r\n")
          print(html_sanitize(doc))
      ...

In one branch, _doc_ must be HTML-sanitized; in the other branch, it must not.

<comment><USER13> That's a poor example. I would never send a document as HTML without tags. html_sanitize() should really be generate_html(), which adds structure to the document.

What the GP is saying (and I agree with) is that generate_html() should use a library which understands HTML structure and only allows content to be generated using a strict API (no _doc+=" <foo>bar</foo>"_ garbage).

Such a discipline _greatly_ reduces the chance of injections, to the point where you have to actively _write code_ to _create_ injection points. And it's simple to follow: any time you write HTML, use the library.

Taint analysis sounds nice in theory, but you can get the same effect by writing code modularly (i.e. only one small module can actually access the raw output stream) and using libraries to create structured data.

<comment><USER14> It's not a poor example, and it's not about sending the document without tags. It's about whether special characters should be escaped, and the answer depends on the Content-Type that the client requested.

<comment><USER15> A framework could use static types to tag whether it is escaped or not.

Then, the framework could map different kinds of requests (e.g: raw content vs. html content) to different types.

Then, the only way to convert between the types are functions that do proper escaping.

</comment></comment></comment></comment></comment><comment><USER16> If this is a templating engine type thing, you should be able to do something like

${KEYWORD}${

If you can figure out what "KEYWORD" is for a given template tag as well. I tried links and a few others, but none that I can identify: it does still reproduce the bug though.

</comment><comment><USER17> Seems likely that it's due to a lack of escaping in a custom templating layer. I wonder if it could be used to perform a XSS attack?

<comment><USER18> Unlikely. You'd have to get someone else to run the same query.

<comment><USER17> ...which you can do simply by posting a link anywhere.

Edit: I guess it would be more helpful to explain why for those not familiar with XSS. If all it takes it a specially crafted URL to your site to exploit it, your site is toast. The security model of the web assumes that people can open even the shadiest of links without negative consequences. I could have obscured the URL with a shortener and named the link "Cutest cat pic ever!" I could have hosted a page on a totally separate domain and put the crafted URL in a hidden iframe. All I have to do is send document.cookie over to my server and now I control your account.

<comment><USER18> My mistake. I thought it didn't work if you linked to it directly. It turns out the bug just manifests itself differently if you do that.

</comment></comment></comment></comment><comment><USER19> And i thought that this was one of the most sanitized input field in the internet. Let's seen how long it takes to google deploy a fix on their search.

</comment><comment><USER20> Interestingly enough, the https version of Google doesn't have this bug.

<https://encrypted.google.com/#q=$>{

looks fine, but

[http://www.google.com/search?sourceid=chrome&ie=UTF-8...](http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=%24){

doesn't.

<comment><USER21> The first one is broken for me too (in a different way, though).

</comment></comment><comment><USER22> Also works if you use the html code: "${" It returns the symbol instead of the search query.

</comment><comment><USER23> They fixed it .. <http://google.com/#q=$>{

<comment><USER24> funny tho that at this point such a query would not return the discussion about this flaw :)

</comment></comment><comment><USER25> Anyone have an explanation for this? Looks like its messing up the CSS for the top link nav.

<comment><USER26> I'm not seeing it. Can you post a screenshot?

<comment><USER27> <http://i.imgur.com/3UuEZ.png>

<comment><USER28> Hmm, anybody have an idea as to why mine's different?

<http://i.imgur.com/OrqtK.png>

<comment><USER16> You loaded the page directly. It only seems to happen if autosearch was involved.

Loading <http://www.google.com/search?q=$>{ does what you see, but entering ${ in to the search box and pressing enter does what everyone else sees.

edit: compare your clean human generated address bar to the other screenshot's messy software generated one.

<comment><USER29> It's still broken, even if it looks different

</comment></comment></comment></comment></comment></comment><comment><USER30> Note: this also works: <http://www.google.com/#q=$%7B>

</comment><comment><USER31> The Google Search Appliance, with roots in Google proper, generates XML results, which are then (normally) transformed via XSLT. (I'm looking at you, XPath.)

[http://mikewest.org/2007/06/escaping-curly-braces-in-xslt- at...](http://mikewest.org/2007/06/escaping-curly-braces-in-xslt-attributes)

I s'pose attributes don't enter into it, but still, I wonder if the XSLT pass (if any) has anything to do with this?

</comment><comment><USER32> I bet Google knows about this and its when they do bug triage its so low priority that it just hasn't been fixed yet.

</comment><comment><USER33> This looks like a javascript issue but I have seen a server error from google - [http://www.rajeeshcv.com/2010/07/have-you-seen-google- search...](http://www.rajeeshcv.com/2010/07/have-you-seen-google-search- crashing/)

</comment><comment><USER34> On a related note, searches for many symbols do not product results. Searching for '&' will bring up results for ampersand, but most others that map well to words do not, e.g. $ => dollar, % => percent, etc.

</comment><comment><USER35> > _Shortest way to produce issue is here —<http://google.com/#q=$>{ _

Making it an actual hyperlink would've been a bit shorter.

<comment><USER36> I would have been suspicious of a hyperlink in this context...since this is potentially discussing a XSS vulnerability on Google (not necessarily, but maybe).

</comment></comment><comment><USER37> Looks like the syntax of Google's CTemplate someone posted today: <http://code.google.com/p/google-ctemplate/>

</comment><comment><USER38> This is from yesterday: <http://twitter.com/#!/passpack/status/114181283097214977>

</comment><comment><USER39> I tried it in my Search box at WordPress.com blog and it has no effect.

</comment><comment><USER40> try to search this and see real break 9999999..99999999999999999999999

<comment><USER41> No, that's designed to break - within that range is a large amount of credit cards numbers, and Google blocks that. The OP however is a genuine bug.

<comment><USER40> thanks for info

</comment></comment></comment><comment><USER42> That's 'cause the money ($) is the key (}). Oh, you're welcome.

</comment><comment><USER10> the bug exists only by searching on the google homepage, searching it on the searchbar of the browser doesn't happen.

<comment><USER43> Breaks for me in either case, just in different ways (an auto-search link breaks the toolbar, while the other one doesn't even display the toolbar).

</comment></comment><comment><USER44> it doesn't break on google.co.ma

</comment><comment><USER45> Everyone seems to avoid to mention the obvious. This breaks the page layout only, not really a critical issue concerning google's integrity/security.

Still, this obviously doesn't look good. Above anything else google has excelled on being simple and reliable. All this javascript goodness added recently might be a step in the wrong direction. If stuff like this starts to happen every now and then, google's reputation might be at stake.

</comment><comment><USER46> If your templating language is going to use a magic character it would seem useful to pick something less common than $. There are several odd characters on my keyboard (§`~±|¤) and if you are willing to use the ALT key there are really obscure characters that you can safely filter from the input instead of going through the trouble of escaping them. Filtering is so much more efficient/easier/safer than escaping.

Imagine how much easier life would be if in HTML we only had to filter for § instead of escape every <, > and ".

<comment><USER47> ~ is not unusual on the internet, it is used for home directory webspace

<http://www.proweb.co.uk/~matt> for instance

<comment><USER47> That's my homepage. It's been a long time since I read it.

Reading it now as a treatise from my younger self, though I didn't write it, I realise that spirit is lost. For a while it was "our" place but now we have to return to the underground.

<comment><USER47> I changed it

<http://www.proweb.co.uk/~matt/oldworld.html></comment></comment></comment></comment>


Ask HN:Where to turn for office designs? - <AUTHOR>

We are in the process of moving to new offices, and would like an interior designer to coordinate and plan the move. Where do startups find good, cheap Interior Designers that might also work remotely (we are based in athens, greece)? Names, Links everything appreciated... <comment><USER2> _"... Where do startups find good, cheap Interior Designers that might also work remotely ..."_

ARCHitect. ARCHitect ... Up there.... Up there.

Joel Spolsky has thought extensively on this problem ~ <http://www.joelonsoftware.com/articles/BionicOffice.html> Joel lets the Architects design and build offices that are not cheap and for good reason ~ [http://www.inc.com/magazine/20080601/how-hard-could-it-be- ad...](http://www.inc.com/magazine/20080601/how-hard-could-it-be-adventures- in-office-space.html)</comment>


High Anxiety (raganwald on Go and learning new things) - <AUTHOR> https://github.com/raganwald/homoiconic/blob/master/2009-10-20/high_anxiety.md

<comment><USER2> According to a recent theory[1], there are _three_ affect systems in the human brain: \- Threat/protection (Safety seeking) \- Drive/Excitement (incentive, resource focussed) \- Soothing/Comforting (Affiliative)

Anxiety problems are caused by the first one. The theory holds that problems with the first system are best tackled using the _third_ one (whereas I imagine that most HN readers are more likely to assume that everything should be done using the second one).

[1]<http://apt.rcpsych.org/content/15/3/199.full>

NB I can't claim that I have any evidence for this theory, as I have only know about it for a short time. Anxiety has ruined my life so far; this is merely the first thing that looks like it might really help.

<comment><USER3> thank you for sharing this.

</comment></comment><comment><USER4> So I recently decided to learn Go myself, after _decades_ of hearing about it from fellow techies. It's incredibly difficult. I read, downloaded apps, and then signed up on DGS as 30kyu (the lowest rank) and have lost every game except for one I won on timeout. I stink. Playing Go is a paradigm shift. Knowing (and being good at) other games is almost irrelevant at my level. This is a little like coming to pure functional programming after decades of kicking ass in the imperative programming world. And like that, smarts and experience _will_ give me a leg up. But later.

So many times, as a smart and capable person, I can see the light at the end of the tunnel in a new endeavor. Even when I don't really see it I trust it's there if I can grasp even a little. But with some things you just feel lost, and that's very difficult for smart people.

This is so different from learning a game like backgammon. One summer in my mid-teens, a friend and I played many times daily over a summer. I've rarely played since, but the strategy is easy enough for a smart person that I can hold my own against anyone except world class players. That's a bit to one extreme, but it's closer to the average experience of a smart developer.

Finding things that I just can't grok after a few minutes of thinking about them (and there are many) has made me more accepting of my limits, and raised my awareness that some things take a mental shift and/or really are complex.

<comment><USER5> I don't think it's that strange. Ultimately you have to play in order to read ahead in the game. People who think they can sit down and learn to read ahead will struggle. But if you start actually playing, a lot of the basic reading ahead will become second nature and then it's on to harder/deeper reading. The same is true of chess. Someone given the rules and a set can't hope to get it in any meaningful way though it is theoretically possible. For Go, if you can find people better than you to play against and keep it up for a year you'll look back and realize that even your initial worries were just a misunderstanding. DGS is not a good place to start. You need to play in volume. Bulk practice.

<comment><USER4> I'll take your advice regarding volume/bulk. It seems sound to me. I took up chess a bit more than a year ago, and tactics practice and non-stop playing have done more for my game than any reading.

<comment><USER5> sorry, by 'read' I meant calculate. Calculation is the chess term, reading is the Go equivalent.

</comment></comment></comment></comment><comment><USER6> Go is a fascinating game but it requires a lot of effort to learn to play well.

I've found that after a hard day of programming the last thing I usually want to do with my free time is solve what is essentially another set of logic problems. I'm much happier if I can do something that lets me turn off and rest that part of my brain for a while.

</comment><comment><USER7> Many won't get/grok the following statement and I suspect those who don't will have a hard time with go.

You cant learn go, you need to feel go.

It's not a coincidence that some eastern philosophy Tao, Zen, others have similar concepts at their core. You can't learn enlightenment. You shed the unenlighted until you are. Approach go with an empty mind. Think not of moves. Look for flows, patterns, feelings. The OA had some of this, "her position looked strong, mine weak an isolated". Seeing that _is go_. Attempting to formalize why you feel that is not go, at least not until you are a master.

Many hackers are optimizes. They want to learn all the parameters and rationally arrive at the optimal solution. Go is highly resistant to this.

Go is indeed like functional programming in that it's a paradigm shift. It will teach you a new way of thinking, a new way to see and understand the world. I highly recommend playing go. Just don't try to learn it.

<comment><USER3> I've heard this many times, but it's orthogonal to the point of the essay. If we take the words "know" and "learn" and replace them with "feel," I can write the same essay. I felt anxiety because I didn't have any feeling for the game. Every time I did something, I felt punished for having the wrong feeling, but I didn't have any feeling, much less a wrong feeling.

You can say there are no wrong feelings, yet the game has a winner and a loser and is very much scored like there are right and wrong feelings. My problem then was what it is now: I have no feeling for the game, and there is no feedback loop to help me feel what is going on.

Which is not to say that you aren't wrong about how to approach the game, but my essay isn't really about not being able to become a good player, it's about not being able to do anything because I had no "feeling" for what to do.

<comment><USER8> I've been there. It's easy for me to ignore the "right and wrong, win or lose" mentality of certain situations, but there are some times when I feel disengaged or nauseous about being in a situation where I am not expected to perform well.

The solution, IMO, is to remember that you aren't the feelings in your head. There was a time you would have had a feedback loop for the game regardless of winning or losing, and you've lost touch with it due to age. Your remedy, which is the correct one, is to persevere beyond your banal mental fortress until a new feedback loop is created.

By the way, I'm a huge fan of your work. Good job!

</comment></comment></comment><comment><USER3> Previous discussion: <http://news.ycombinator.com/item?id=904765>

<comment><AUTHOR> Indeed, and I searched for and found that, but discussion there is closed, it was nearly three years ago, and HN has a _lot_ of new users since then who may choose to share their experiences.

I have now edited this title to be more descriptive, and to match that previous submission.

 _Added in edit: I also see that this has been flagged, so I guess it won't last long, which is a shame. I think there's a lot to learn from this article, but you need to find the lessons for yourself, so many might not see them._

</comment></comment><comment><USER9> If you want to teach someone go, give them an insane handicap to start with. I am only a mediocre player, but I'll play on a 9x9 board and hand out a 9 stone handicap. More than half the time I'll win, then I'll give them a couple of tips. (Unless you're connecting your stones in a solid wall, play 1 space away from me to avoid tactical tricks. Also don't try to kill my stones, just try to build a wall that I can't get through.) Then they usually win.

People often resist accepting the handicap. So I point out that the game has a more complex strategy than anything they have ever seen. The handicap is a necessary part of the game. If they can't accept this fact, then they will never learn or enjoy the game.

Once they are beating me easily with a 9 stone handicap, we start dropping the handicap down one stone per game. Somewhere about 5-6 stones they will hit a wall again. Then I can give more tips and we go to the "adjust the handicap after 3 victories in a row". Over time they start seeing more of what is going on.

Once they get down to a 3 stone handicap on a 9x9 board, then I give them a 9 stone handicap on a 13x13 board. Now they can feel that they are really playing, and start to see how varied it is.

If you're trying to teach yourself, I recommend taking a game like GNU go and doing it yourself. Crank up the handicap to 9 on a 9x9 board, and try to win. Slowly drop the handicap. If you can get someone to give you tips, do. You will improve and can see it in the handicaps you need.

<comment><USER4> In chess there's usually a reluctance for strong players to play weak players, unless it's for mentoring. That Go encourages people of different skills to play a somewhat even game through handicaps seems very sociable and healthy to me.</comment></comment>


My impressions of OS X after about a month of use. - <AUTHOR>

I don't think it's as good as Win 7, but it's pretty close.
Issues (some of which can be addressed by third-party software):
* no reasonable way to write to a CD (!)
* read-only NTFS
* installation of apps can be confusing to people not familiar with macs
* no reasonable way to uninstall software along with its data
* disk volumes (dmg files) can be confusing to people not familiar with macs
* not clear whether installing a virus checker and/or firewall is important to people not familiar with macs
* window management not as nice as win 7 although Exposé is very cool
* strange that closing the last window of an app does not quit the app
* pdf files are not shown in the browser window
What's better than win 7?  The unix-like shell.  You can get this with cygwin under windows but it's nicer to have it built-in.  Also, the remote shell login is easy to enable under mac.  Not obvious how to do this with windows. <comment><USER2> Most of the things you've commented on are things that I actually prefer (being from the Mac world) - but a few things

* You can write blank CDs/DVDs with finder or Disk Utility easily, but the finder behaviour can be hard to work out

* PDF files show for me in the browser, unless I explicitly tell them not to (right click, open in preview) - you didn't install Acrobat Reader did you?

* Read only NTFS is reasonable. Can you read an HFS+, UFS, ZFS or EXT2 volume on your windows box?

* Having an app open, and having a document window open are two different things. This takes a while to wrap your head around, but it's much nicer to keep (say) textmate running, cmd-tab to it then cmd-n for a new window than having to do the whole start menu dance to get a new editor window open.

Other than that, I'd say you'll find it's just personal preferences and experiences that you may see the benefits of in time, particularly with regard to things like window management and app install which I honestly find vastly superior on Mac. Let's just not mention the uninstall. In a month, I imagine the differences would still grate, but personally I now find it much more difficult going back to Windows line editing (home/end instead of cmd-> cmd-<) and other Windows behaviours having been on Mac for so long.

For me, it's all a bit pavlovian I guess. Having to alter my habits to use something I don't want to use and that doesn't reward me is a bit of an affront!

<comment><USER3> Maybe I'm missing something, but window management has always irked me on the Mac.

I often have a bunch of files and projects open in textmate and I end up cycling through them with 'cmd + ~' or using expose to hunt for it. I want something like alt-tab, but for the currently open program, where I can see all the open windows for it (ordered by how recently they've been viewed) and access them easily.

<comment><USER4> Exposé has an "application windows" mode. Aside from the LRU bit, this sounds a lot like what you're after...

</comment></comment></comment><comment><USER5> * no reasonable way to write to a CD (!)

what is wrong with right clicking select new burn folder, put what I want to burn in it, then click the burn button? It certainly isn't that easy in windows.

* no reasonable way to uninstall software along with its data

Sounds like a wash with windows I don't think I have ever clicked uninstall and actually had it uninstall everything correctly.

not clear whether installing a virus checker and/or firewall is important to people not familiar with macs

It comes with a good firewall more or less properly configured by default so one of those isn't needed and no reputable company makes Mac AV so there isn't any to buy even if you think it is required.

* strange that closing the last window of an app does not quit the app

Different than windows yes. Confusing not really, it is quite uniform and regular. It goes back to the whole better build quality no need to unload apps to keep the os stable and performant.

<comment><AUTHOR> I was under the impression that you need to: use disk utility to create a dmg file from a folder; and burn the dmg file while leaving the CD "open" for future additions.

This is rather annoying. Moreover, when you insert the CD into the drive, it opens multiple disk images, one for each session written.

Under win 7, you can just drag and drop a file to a CD folder just like any other drive.

</comment></comment><comment><USER6> You're giving a very shallow comparison overall. This is a set of trivia rather than any detailed analysis.

 _installation of apps can be confusing to people not familiar with macs_

Either you run an installer, or you drag a file to Applications. Are you joking? That's actually one of the easiest things.

 _no reasonable way to uninstall software along with its data_

Not built-in, no. Get AppCleaner, which is free and very reasonable.

 _disk volumes (dmg files) can be confusing to people not familiar with macs_

Each family member of mine who's used a Mac figured this out instantly. They treat it like a plugged-in device, which is a really nifty way of simplifying a complex process.

 _not clear whether installing a virus checker and/or firewall is important to people not familiar with macs_

It's not, which is why it's never talked about.

 _window management not as nice as win 7 although Exposé is very cool_

Something like this doesn't give any information. Does Windows 7 attach its notifications physically to the generating window, sliding the window into view if the notification needs room? Something like that adds significantly to usability, and there are a lot of small window features like that.

 _strange that closing the last window of an app does not quit the app_

The rule on the Mac is as follows: if there's a reason you'd keep the application open when the last window closes, it stays open. That way I can hear iTunes with the window closed (and without some crap about minimizing the window), or I can close a TextEdit window and immediately open a new on. iPhoto, meanwhile, closes instantly, because it's a single-window system.

 _pdf files are not shown in the browser window_

Yes? They do? Preview is built-in.

<comment><USER7> "Either you run an installer, or you drag a file to Applications. Are you joking? That's actually one of the easiest things."

First time I used a Mac, I opened the .dmg. clicked Firefox, and wondering why Firefox didn't work properly, having no idea I was meant to drag it somewhere and that it wouldn't work when run from the image.

<comment><USER6> Only it _does_ run from the image. I use several apps that I don't move to Applications, because I use them so rarely it works to just mount them and run from there.

<comment><USER7> Last time I tried, bookmarks broke. And, of course, it wasn't there when I unmounted the image.

</comment></comment></comment></comment><comment><USER8> Most of your issues are addressed not true issues, but complaints from you about how OS X is not Windows.

* no reasonable way to write to a CD (!)

* installation of apps can be confusing to people not familiar with macs

* disk volumes (dmg files) can be confusing to people not familiar with macs

* not clear whether installing a virus checker and/or firewall is important to people not familiar with macs

These are all just complaints about how OS X is not Windows. All can be done in OS X quite simply if you learn how to use it.

I can understand that you may prefer the Windows way of doing things over the OS X way, but to count your unfamiliarity with a different operating system as a list of issues is not terribly useful.

</comment><comment><USER7> I'd say Powershell is better than bash, dut to having ata properly abstracted from presentation.

Ie, you don't to find regexs to match your data, you can just pipe to 'select' or 'where' and tell Posh what you want.</comment>


Facebook plots first steps into healthcare - <AUTHOR> http://www.reuters.com/article/2014/10/03/us-facebook-health-idUSKCN0HS09720141003

<comment><USER2> The privacy push by Apple will benefit their healthkit and related apps.

Apple has always been a hardware company and this gives them some competitive advantages over google and facebook who can only make money by ultimately selling your information. Realistically, Google/FB probably won't monetize your health information and instead try to use it to attract you to their other services. But I trust Goog/FB less than Apple to keep my information private.

I hope Apple continues to push the privacy angle. I've seen people here on hn state that young people don't care about privacy, but that isn't what I've witnessed. My youngest relatives (grade school to early college) are privacy conscious and use services that they at least think have privacy (snapchat, for instance).

Also, friends and relatives older at retired age are also privacy conscious. The only people I know that don't seem to worry about their privacy are in their 30s and 40s.

<comment><USER3> As someone in the mid-30s and up range, many of us were shaking our heads at the over sharing and privacy implications of those younger - at least here in the states.

Not sure where you feel 30-40s care less about privacy than others.

<comment><USER2> I know it's anecdotal. It's just based on personal observation of my relatives whenever I travel back to the u.s. The oldest and the youngest seem to be the most paranoid about making information public and I think for different reasons. The youngest probably don't want their parents and relatives to know what's happening in their private lives and the oldest are just paranoid of technology.

</comment></comment></comment><comment><USER4> I wonder how this would fit in in countries with universal healthcare?

This is a natural fit for the US, where the _business_ of healthcare happens much closer to (and often involves) the end consumer.

In countries with universal healthcare, I think this would only work if Facebook/Google/Apple made the state provider the first choice to receive healthcare data. The state normally has programs in place already to centralise and analyse health data and what Facebook are proposing is essentially setting up equivalent functions in parallel.

<comment><USER5> There seem to be a lot of private enterprise that competes and prospers even when there is a large state presence. FedEx is an example that comes to mind.

"This is a natural fit for the US, where the business of healthcare happens much closer to (and often involves) the end consumer."

Seems true, but would add that it could go a whole lot closer. The typical consumer is generally insulated by insurance being packaged into employment deals and a near universal culture of prepay masquerading as 'insurance.'

</comment></comment><comment><USER6> Great now facebook can monetize more of my private data, just what I have been waiting for.</comment>


Warren Buffett/Bill Gates reading habits - <AUTHOR> http://qz.com/668514/if-you-want-to-be-like-warren-buffett-and-bill-gates-adopt-their-voracious-reading-habits/?utm_source=pocket&utm_medium=email&utm_campaign=pockethits <comment><USER2> I have an anecdote about this that I thought was really profound at the time and still think is pretty interesting.

I was travelling once in Europe on a train that had all different levels of seating "class". There were sectioned private cars, business class cars and economy class cars.

My friend's Dad is German and found a hook-up for private car service. We were backpacking at the time so this was strange but we enjoyed it. So we were seated at the front, and then business class, and then economy class, and then the food car.

I got up to walk to get some food, passing through each section. In business class, all varieties of people were represented. You could call that diversity. Same in economy.

Except for one thing. Every single person I walked by in business class was either reading or working. Nearly every single person I walked by in economy class was playing games or watching TV. Over 90% followed this pattern.

I know there are all kinds of caveats and nuances that make this very non- scientific, but I was surprised by the consistency. Business class riders were educating themselves, where economy class riders were entertaining themselves.

I do believe that knowledge compounds, and I am always surprised by how much I learn that I don't know.</comment>


Let's Encrypt ACMEv2 and Wildcard Launch Delay - <AUTHOR> https://community.letsencrypt.org/t/acmev2-and-wildcard-launch-delay/53654 <comment><USER2> While HTTPS is being burned into the architecture of the Web, I have a humble question to ask: what is the dear HN community's next-best-option in a scenario if letsencrypt dies/gets sued/goes under/servers not accessible anymore?

I ponder on this question seeing how Google is planning to increasingly depreciate HTTP. While in general, I welcome the security upgrade, the lack of next-best-free-options makes me vary of this config change locking us into a $$$paid-only web publishing system.

<comment><USER3> ACME is a protocol - I imagine most of us are hoping that, should LE fade off, one or more others take the reins and implement it.

<comment><USER4> With PKI,a good protocol isn't the problem but rather making the cost of infrastructure keep-up worthwhile. Anyways, non-pki protocols are in the works.

<comment><USER2> > non-pki protocols are in the works.

Could you kindly link to relevant threads / RFCs / orgs / undertakings currently working on that, please?

<comment><USER5> DANE might provide a solution. See specifically the section [https://tools.ietf.org/html/rfc6698#section-2.1.1](https://tools.ietf.org/html/rfc6698#section-2.1.1), certificate usage 3:

3 -- Certificate usage 3 is used to specify a certificate, or the public key of such a certificate, that MUST match the end entity certificate given by the server in TLS. This certificate usage is sometimes referred to as "domain- issued certificate" because it allows for a domain name administrator to issue certificates for a domain without involving a third-party CA.

<comment><USER6> This would need DNS to be secured though and DNSSEC is still a bit of a mess last I checked and not enabled for a majority of DNS traffic.

<comment><USER5> DNSSEC support is increasing each year, but that's just one issue. DANE would also need to be implemented by browsers for full adoption, not just as a plugin to specific browsers.

Then again, I was responding to the question about an RFC or other standard, not whether it was feasible today. ;-)

<comment><USER6> It would be feasible if DNSSEC wasn't a total mess, tbh. The support for it is still abysmal and a lot of resolvers (including the one in my router) can't handle DNSSEC responses _at all_.

I think using DNS over HTTPS in conjunction with signing the response is going to be more viable since you don't have 200 ways a middle box will break it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> It's hard to complain about a slight deadline miss from an incredible project offering free stuff.

<comment><USER8> Precisely the problem. Real companies mostly prefer to use paid solutions because they have comfort and confidence in knowing there is a business and backing behind it. At least I know I do. I never got the whole developer complex wanting and even expecting everything for free. Seems hypocritical and counter-entrepreneur.

Also for what's worth, I've been deploying Let's Encrypt into production recently using Caddy and (on-demand) TLS and while it works, the rate limits being reset weekly is really scary and VERY VERY easy to hit. I know myself and my clients would be willing to pay for Let's Encrypt Pro (higher rate limits, etc). Take our money.

<comment><USER7> That's not Let's Encrypt's role to play though. As a user, I'd be much more skeptical of an LE cert'd site than a Verisign cert'd site. That's not a knock on LE, that's just recognizing a higher barrier to entry. Let's Encrypt's goal is to get everyone encrypted, not necessarily to ensure everyone is who they say they are.

And as a fellow person who does real business at times, I often prefer paid products because I know I can get support from the company backing it. I don't think Let's Encrypt will replace the entire CA industry, and I don't think it should. (As tyingq says, monocultures are bad.)

<comment><USER9> > not necessarily to ensure everyone is who they say they are

How does Verizon (to take your example) ensures this? They have the same zero verification process for the non-EV cert.

<comment><USER7> At bare minimum, getting a cert almost anywhere else requires a credit card.

<comment><USER9> This is not something which helps to decide whether the target website is what they claim to be.

I can use my CC to buy faccebook.com, and I will get it (again, outside of EV).

I may then be tracked by Interpol for fraud, but to the end user this does not change anything: Verizon has issued a certificate for my faccebook.com

<comment><USER10> IYAM, any major web property such as google, facebook, credit card issuers, etc. should buy up all the most likely typo-ed versions of their domains so that this doesn't happen.

The average user is going to blame Facebook anyway if they get duped into logging in at faccebook.com, and it goes to protecting their brand (trademarks are weakened if the owner doesn't defend them).

<comment><USER9> They do, and if they don't, they end up like the White House a few years ago when whitehouse.<I forgot the TLD> was bought and an almost exact replica was created, according to Rule 34.

My point is that you can buy any site from a CA and no verification is done, exactly as with Let's Encrypt.

Even with an EV there is no guarantee that the requester is genuine ("best effort" to check)

<comment><USER11> With EV the checks basically care about:

1\. Does this entity exist, e.g. it's in an official government business directory and the address details match what was specified 2\. Use a third party directory (e.g. Dunn & Bradstreet) to look up this entity, and phone them. Ask to talk to some specific role at the company e.g. "Head of the IT department" and then confirm the details with that person.

This involves actual humans, albeit basically call centre employees, looking at paperwork, making telephone calls, that sort of thing. I guess you could label it "best effort" but to me that signifies much less.

For Americans a surprise problem with EV is that your country doesn't _have_ a central business directory. Each State runs its own directory, most businesses are registered in Delaware, regardless of their actual home state.

[https://stripe.ian.sh/](https://stripe.ian.sh/) has a completely genuine Stripe, Inc. EV certificate, issued to a Stripe, Inc. just not the one that's famous.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Am I the only one who thinks the way we deal with certificates is just completely backwards? Why should there even be a CA at all for DV certs? We already have to trust the registrar as ultimately they can get whatever DV certs they want so why not just limit our trust to them instead of adding hundreds of additional organizations that can compromise our security? And we pay them for the privilege of doing this??

I get CAs for EV and OV certs, of course you need an additional trusted party there, but the vast majority of websites out there do not use EV or OV certs and to be fair users by and large don't even notice the difference between a DV and an EV certificate in the first place.

We already have DNS, we already trust DNS to issue certificates to people, why don't we just cut out the middle man since they serve no additional purpose?

<comment><USER13> The thing is that "control of the DNS" can mean different things.

I have control of the DNS on my network, and at the local coffee shop. I can use that to attack users, but I cannot use that to obtain a certificate.

I still agree with you in a sense, an alternate solution would be great. But we that middleman is the best we have right now.

<comment><USER14> > The thing is that "control of the DNS" can mean different things.

In every way this discussion is related, "control of the DNS" should mean control of _the one authoritative DNS source_ , in a way which means that if a service across the internet requests a DNS record, it won't be affected by whatever DNS-trick your neighbourhood cafe's wifi may apply.

Trying to muddle the discussion of a fairly straight-forward, reliable scenario with consumer-space DNS resolution is IMO not very productive.

<comment><USER15> But that's the point - the CA is needed to make a reliable verification of the data coming from the authoritative DNS source, since the consumer can't make that check themselves in an untrusted network.

</comment></comment></comment></comment><comment><USER16> I've been using LE from the start and it's been awesome (especially with clients like acme-tiny), but wildcards changes everything.

How many of you are really going to set up a custom DNS updating script?

Maybe I misread something but I remember hearing wildcard certs will only work with DNS based challenges.

Wouldn't that mean the verification tool would need to support every single registrar's / DNS provider's API?

For example, I host my domains (and DNS) with namesilo.com. Is a challenge script really going to know how to interface with their API to add / remove the TXT records?

What about the 50 other popular DNS providers?

<comment><USER17> Yes, but there's already scripts handling many of the most popular.

Check out acme.sh and remember, changing your DNS provider or hosting it yourself really isn't that bad.

[https://github.com/Neilpang/acme.sh](https://github.com/Neilpang/acme.sh)

<comment><USER16> Nice, it looks like they support namesilo and ~40 others.

So my suspicion seems accurate. The script will need to know how to interface with each provider and you (as an end user) will also need to be responsible for setting up your own API keys for whatever provider you use.

<comment><USER18> If you're up for the task, I've wanted to write a script (POSIX /bin/sh certainly) for interaction with DNS providers. Basically lower the entry barrier, and avoid the web interface:

        $ foo mydomain.org --init ovh
        $ foo mydomain.org my.sub A 22.214.171.124
        $ foo mydomain.org my.sub AAAA 1234::abcd
        $ foo mydomain.org --remove my.sub A [184.108.40.206]

etc.

I have yet to find anything that handles any DNS changes in a simple, stupid way. Most API clients I've seen only handle one kind of request: acme.sh only does TXT challenges. DynDNS endpoint only does A records. Etc.

<comment><USER17> It'd be cool to have and it's relatively straightforward from a software engineering perspective, but it's so much boring grunt work that finding someone who wants to implement it might be challenging.

If this is something you need to do a regular basis, you might consider hosting your own DNS and using BIND's nsupdate tool.

<comment><USER18> > hosting your own DNS

meh. There are some things that I'd gladly host, but DNS clerly isn't among them. Too many ways to screw up, probable breakage ahead (only 1 dedicated @ OVH), so many rate-limits to implement; DNS servers a re filled with RCEs... (bind being the worst).

Clearly, nope. Not doing this ;)

</comment></comment></comment></comment></comment></comment><comment><USER19> Crap. I had certs set to expire on 2/28! I was going G to be saved by wildcard. Off to make a bunch of DNS entries....

<comment><USER20> Does your ACME client already support ACMEv2 and wildcards? I think only acme.sh has so far claimed to (happy to be corrected if another client has finished its implementation).

<comment><USER19> I use certbot. I'm not sure as I was just planning on figuring it out for the night of expiration.

<comment><USER20> I'm part of the Certbot team and I can tell you that the ACMEv2 support is still being implemented by my colleagues now; even if it had been included in a release this week or next, you would have been cutting it pretty close! Many of our users don't have the most current release because distribution packagers don't ship it right away (or even for months or years, depending on circumstances).

Certbot's own autorenewals (which I originally implemented and which I hope are currently working for you -- I'm happy to try to find a way to get them to work in your deployment if they're not!) try by default to renew certificates 30 days before expiry in order to give people a lot of time to notice and intervene if something goes wrong. Consistent with that, I'd encourage all of our users not to rely on anything happening less than 30 days before expiry as part of their plan for keeping certificates current on their sites.

<comment><USER19> Thank you for all your work. My renewal went through fine. I had commented it out of crontab, but went fine once I ran it. I was pleasantly surprised when tls-sni worked flawlessly.

<comment><USER20> Great!

One thing to know about the TLS-SNI situation is that TLS-SNI-01 has been disabled for new issuance and only works for renewals. The selection of authentication methods is pretty transparent because the ACME protocol allows the CA to state which methods it will accept for a particular domain authorization (so for the renewals it can state that TLS-SNI-01 is permitted, while for new issuance it can state that it's not, and a client can respond accordingly).

Apparently the ACME WG is working on a TLS-SNI-03 method that will be safer and that might be supported by Let's Encrypt (and ACME clients) at some point. But it's also possible that TLS-SNI-01 could be disabled in the future, even for renewals, even before TLS-SNI-03. So, if you happen to have anything in your setup that prevents the use of HTTP-01 on port 80 for authentication, you should be aware that renewals could potentially stop working at some point (although this isn't imminent), and that you might also have difficulty adding new domain names to your certificates.

[https://community.letsencrypt.org/t/important-what-you- need-...](https://community.letsencrypt.org/t/important-what-you-need-to-know- about-tls-sni-validation-issues/50811)

This unfortunate situation is a nice showcase of the ACME protocol's flexibility, because the CA has a way to tell the client very specifically what authentication methods to attempt or not to attempt for each domain (and if new methods are specified in the future, they can be rolled out incrementally without breaking compatibility).

<comment><USER11> One thing that'd be good here for outside observers is for Let's Encrypt to bake a list of the Blessed Methods used into certificates as OIDs in the Policy section.

Right now a researcher with 5 million Let's Encrypt certificates can see which ones use public keys with unusual patterns, how many are for names in the French .fr TLD, how many have longer key lengths, and so on, but they can't see whether the validation was done with Method 10 (which had this unexpected flaw) or some other method.

Another CA (can't remember which one) was looking at doing this, and it seems like it'd be nice for Let's Encrypt too.

<comment><USER20> I like this kind of thing in principle, but certificates are already getting kind of large and there are a number of other things that one might put in them via OIDs. But I realize ASN.1 is pretty concise; do you know about how much this proposal would increase the size of a certificate by?

Another concern might be that users might not want this to be disclosed because it might give attackers suggestions about how to attack their renewal processes (although of course CAs have been willing to publish information, like issued certs, that some users wouldn't prefer to make public).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> It's not mentioned, but I'm assuming this feature with the same original schedule:

Embed SCT receipts in certificates

Is also delayed? I think this has been quite underrated.

<comment><USER21> I've been following progress in their GitHub issue for it: [https://github.com/letsencrypt/boulder/issues/2244](https://github.com/letsencrypt/boulder/issues/2244)

Most recent comment:

> We're working hard on it, but will probably not land this in production > before the end of February. Still, we are very much aware of the upcoming > deadline and committed to meeting it. Thanks for the enthusiasm everyone! > :-)</comment></comment>


Google reporting "Service disruption". Related to OAuth outage? - <AUTHOR> http://www.google.com/appsstatus#hl=en&v=status <comment><USER2> The status page at [https://status.cloud.google.com/](https://status.cloud.google.com/) has now been updated to include

"We are investigating an issue with Authentication services. We will provide more information by 07:30 US/Pacific."

</comment><comment><USER3> Here is a direct link to the specific incident: [https://status.cloud.google.com/incident/appengine/16003](https://status.cloud.google.com/incident/appengine/16003)

</comment><comment><USER3> Able to log in to our services now; waiting to hear what the root cause is at 7:30a, though. This post-mortem is going to be a doozy!</comment>


"It might be useful" - gmail virus? - <AUTHOR>

Twice today, I have received emails with, inter alia, the phrase "it might be useful" in the subject.  In both cases, the emails had apparently blank PDFs attached.  Anybody else seeing this? <comment><USER2> Have you uploaded the PDF to <http://www.virustotal.com/> ?</comment>


Fuel Book – Turn your car into a smart car - <AUTHOR> http://myfuelbook.com <comment><USER2> So... is this an app? A device? What?

Also, this website needs editing for spelling and grammar.

Edit: It's apparently a car diagnostic port dongle that connects to an app, but I don't really see the point of this over Automatic, which already does all the "car stuff" and integrates with a bunch of services, and Waze, which handles the "social navigation" aspect and has a huge user base.

<comment><USER3> They are based in India, so the spelling/grammar aren't surprising to me.

Looks like they are cheaper, but do less than Automatic. So if monitoring your car is all you want I guess this fits the bill.

<comment><AUTHOR> They do have a nifty feature for opening doors with a knock on your phone or Smart Watch. edit : and the Fuel Book accessory

</comment></comment></comment><comment><USER4> It's listed on Indiegogo, and it's listed as flexible funding (which means they take the money even if they get less than they admit it will take to reach the goal).

If there are any other gigantic red flags anyone has come across I'd love to hear them, but flexible funding in particular screams "scam" about as loudly as possible.

<comment><AUTHOR> Never judge a book by its cover ;) Check out their radio coverage [https://www.youtube.com/watch?v=zilBkjpdVGA](https://www.youtube.com/watch?v=zilBkjpdVGA)

<comment><USER4> I don't know what press coverage has to do with the fact that they're trying to scam people out of a few grand.

They're saying it's going to cost $50,000 to do this. They currently have less than $1,600 committed. They get that money no matter what. So what are they going to do when they get a $1,600 deposit? Have a nice dinner? Make their car payments for a few months?

There is NO reason for a legitimate entrepreneur to use flexible funding. You should ask for what you realistically think the bare minimum is and have stretch goals beyond that. Anything else is one breath away from theft by deception.

</comment></comment></comment><comment><USER5> (I can't believe I'm writing this phrase seriously...) Needs more synergy.

The page shows a large list of things I really don't care about, explaining how it'll make it easier to do things I don't find interesting at all. And its presented as a closed isolated silo. More than that, a collection of silos.

I have a gut feeling there must be some kind of synergy, some connectivity, some compatibility thing that would make a connected car useful, somehow. If someone messages you about your ETA or location it messages its best guess back, perhaps. Or it links to your google calendar to remind you about service appointments or google docs to store and graph long term trends in fuel economy or engine performance. Or predicts on your google calendar based on past use patterns and current tank level when you'll next need to fuel up (so reserve an extra 5 mins on the way to work the day after tomorrow, etc). Or has some kind of car brand oriented community / upload feature where citizens and mechanics who know a lot about toyotas can see my engine upload and, I donno, social web 2.0's me right in the inbox. Or integrates with social location services so I can become mayor of my local gas station automatically (does anyone still use that stuff?). Or integrates traffic/route stuff with live weather radar. Automatic facebook like any place you stop at? Integrate into google now for the benefit of the 5 people who still use google now? And G+ while you're at it? I'm sure putting some actual effort into it could unsilo the app and connectivity and synergy it all up into something more than the sum of its parts.

I don't need another "Its Torque, but our ODB-II scanner costs 3 times as much" or "We're a copy of waze with a new name, which you won't use because of cognitive load while driving so you won't like us (waze makes me uncomfortable while I'm driving)". Especially if the only distinction is something like "Our only difference is we're on kick starter instead of the competitors that have been on the app store forever, and we're from India, and our web design is super cool web 3.0".

</comment><comment><USER6> I have an automatic, and it's neat, but I'm not sure I like it. For $70-100, it's not the cost in dollars. It's more about how much tracking data the thing uploads. I'm a bit uncomfortable with it. It feels like the business model is collect enough information that a company will buy you for the information.

<comment><AUTHOR> But here the device uses the data to like ping the user if there's a chance for an accident with another Fuel Book user or to detect pot holes ahead, I wouldn't mind the device pinging those details.

</comment></comment><comment><USER7> Does it have it's own sim card inside the OBD2 or a smart phone must be in close proximity?

If latter than I do not see much value in what can be achieved by buying a $15 OBD2 bluetooth adapter from Amazon and a $5 app from Google Play/iTunes. Then you own the data too.

Metromile did it right by embedding a sim inside their unit. Thus allowing you to take advantage of it's remote monitoring capabilities and alerts when you say park your car in a variable parking zone.

<comment><AUTHOR> The Fleet version has the inbuilt GPS and Sim version the consumer edition doesn't have it. Have you checked out the Fuel Book accessory HUD which works side by side with the device

</comment></comment><comment><AUTHOR> Fuel Book featured in Product Hunt [http://www.producthunt.com/posts/fuelbook](http://www.producthunt.com/posts/fuelbook)

</comment><comment><AUTHOR> Fuel Books on Product Hunt [http://www.producthunt.com/posts/fuelbook](http://www.producthunt.com/posts/fuelbook)

</comment><comment><USER8> BAFX Products - Bluetooth OBD2 scan tool - For check engine light & diagnostics - Android ONLY === this is $25 on Amazon for a while.

so what's new here?

</comment><comment><USER9> "Send the TAG link to another Fuel Book user and get to know their position, be it a a race or travelling as a group, stay updated."

Forget grammar and spelling. Did they really just suggest this can help with street racing? That's not going to go over well especially when this happens:

"Stuck in an Accident ! Need an Alibi ! With Fuel Book you can reveal your driving speed and survive the predicament."

<comment><USER10> I fail to see how they encourage illegal street racing. Some people use their cars in legal and sanctioned race events. This functionality is useful for people like me who cannot afford a telemetry system during races or high performance driving events (so called "track days").

<comment><USER9> I know very few people who a) have functional OBDII setups in their race cars and b) if they do, they've got more important things plugged into the port than a consumer targeted device. Further, it's pretty common when statements are made such as that to include a disclaimer along the lines of "(* keep racing to the track, not the street)."

</comment></comment></comment><comment><USER11> Very impressive what this small team has built. Certainly they haven't connected to cloud yet, but they have the metadata.

<comment><AUTHOR> You are awesome !

</comment></comment><comment><USER12> Awesome !

</comment><comment><USER13> so how does stxxf like this gets on here to begin with? paid ads?

<comment><USER14> It was posted, and then upvoted 18 times. Flag it if you don't like it.

EDIT: actually you may not have the karma to flag it; I guess just ignore it?</comment></comment>


17 year old geek makes $130,000 selling White iPhone 4 conversion kits - <AUTHOR> http://www.tipb.com/2010/11/17/17-year-geek-130000-selling-white-iphone-4s/ <comment><USER2> SMH: "I've read you've made over $100K in just a couple of weeks, is that correct?"

Fei Lam: "That number is bull. I made only 30-40k. 100k was income before cost of product. Every time a site picks up the story it changes a little bit..."

Source- [http://www.smh.com.au/digital-life/iphone/legal-action- eyes-...](http://www.smh.com.au/digital-life/iphone/legal-action-eyes-creator- of-black-to-white-iphone-4-converter-kit-20101118-17yf0.html)

<comment><USER3> Legal action? What the fuck. They should embrace such people that are essentially fans AND evangelists and not threaten them, just because they haven't been able to ship a white iPhone.

Somebody tell me a good reason why this behavior would be justified.

<comment><USER4> Agree with you but is not whether there's a good reason or not, it's about Apple protecting their brand. They probably won't sue him, at least that's what I'm hoping for a young entrepreneur, but he is definitely not going to be able to keep selling his conversion kit. His supplier is in big trouble.

<comment><USER5> It's not _his_ conversion kit. It's white Apple parts directly from Foxconn (i.e. they are official Apple parts) that a friend of his who works at Foxconn is able to _procure_. More bluntly, they are stolen Apple parts.

</comment></comment></comment></comment><comment><USER6> These kits (both legit Foxconn parts and third party bits&pieces) abound in Shenzhen. I think I saw more fake iPads than real ones, too, but until you start playing with them it's hard to tell they're not OEM.

</comment><comment><USER7> That article is pretty light on content, however it does link to a better version: [http://www.observer.com/2010/daily-transom/white-iphone- four...](http://www.observer.com/2010/daily-transom/white-iphone-four-sending- kid-college)</comment>