Google is today's avatar of Microsoft, which is yesterday's avatar of IBM?? - <AUTHOR>

I just read the extract from the book "The Self-Destructive Habits of Good Companies". The author and well known academic Jagdish Sheth says that he's closely watching a clutch of hugely successful companies such as Google and Cisco and he is convinced that on their way to success, these companies have unintentionally acquired certain bad habits which might lead to their downfall. With success, Google will become arrogant and complacent. Google is today's avatar of Microsoft, which is yesterday's avatar of IBM.<p>"I used to think that competition destroys good companies. Strangely, I found that's not true: companies destroy themselves," says Sheth. "On the way to becoming successful or achieving survival or greatness, companies begin to acquire bad habits." None of these habits, he says, are acquired intentionally but it happens as a side effect of growth. <comment><USER2> If you're interested in this sort of thing, check out the Innovator's Dilemma and the Innovator's Solution.</comment>


Artificial Intelligence Still Isn't All That Smart - <AUTHOR> https://www.bloomberg.com/view/articles/2018-08-16/smart-machines-won-t-be-ready-to-do-complex-jobs-anytime-soon <comment><USER2> >> In the business world, machine learning often goes by the annoying moniker of "artificial intelligence." That science-fiction buzzword evokes visions of godlike sentient computers, when in fact, the product is much closer to a statistical regression. Machine learning is about using algorithms to predict things — whether a web-security image contains a cat, what a Google user wants to search for, or whether a self-driving car should brake to avoid a crash. No one yet knows how to give a single computer system the mental flexibility to reason and learn like a human being.

While the last senetence is true, the rest of the opening paragraph of this article commits the typical sin of promulgating a reductionist definition of "machine learning", probably because of a lack of historical perspective into the origins and the use of the term.

Historically, then, the broadest definition of "machine learning" is the one given by Tom Mitchell, according to whom a machine learning system is one that can improve its behaviour over time. This covers machine learning algorithms that are really nothing like statistical regression- decision tree learners, or the wide array of algorithms and systems that learn logic-based representations that predominated in the early years of the discipline (and are still going, if I may, with Inductive Logic Programming).

In short, neither prediction, nor statistical regression are necessary or sufficient characteristics of machine learning. Indeed, there is nothing stopping a system that would learn to reason from examples from being categorised as a "machine learning system".

Nothing- except the incomplete understanding of experts from other disciplines, perhaps, like the author of this piece.

<comment><USER3> I've studied machine learning a fair amount, and the algorithms are fancier, but it's still all model fitting by minimizing error. Regression is also model fittining (polynomials) by minimizing mean squared error. Not a huge difference...

<comment><USER2> >> I've studied machine learning a fair amount, and the algorithms are fancier, but it's still all model fitting by minimizing error.

That's only true if you define machine learning as "model fitting", however there are many algorithms and techniques that have nothing to do with fitting a curve to data points and are very commonly considered to be machine learning.

E.g. decision tree learners, nearest-neighbour algorithms, Bayesian inference algorithms, Expectation-maximisation (and friends), clustering algorithms- none of these really um fit under "curve fitting", although of course you can broaden the scope of what is meant by "model fitting" to include potentially anything that looks kinda like it from a few steps away.

Then of course there is the very broad family of logic-based machine learning systems, pioneered by Ryszard Michalski and others in the '70s and Inductive Logic Programming, that learn logic theories from relational data and do not perform optimisation or model fitting (they tend to be greedy).

Basically, it's mostly the gradient-descent based algorithms that do curve fitting (linear regression, perceptrons, SVMs and, er, that; oh, and gradient boosting). These approaches are currently dominant but that's all.

There is much more to machine learning than curve fitting.

<comment><USER4> All of those require a training step, and that is the same error minimization as curve fitting.

Basically they are curve fitting in a high enough dimension.

Even theory builders can be thought of as curve fitters. The error metric is greedy, the curve is not differentable, but that's it.

That said, of course there is much more to it, than training. (And as we saw with OpenAI's dota bots and DeepMind's AlphaGo Zero, with good feature engineering, adversarial learning setup, beating human performance is only a matter of processing power.)

<comment><USER2> >> All of those require a training step, and that is the same error minimization as curve fitting.

>> Basically they are curve fitting in a high enough dimension.

>> Even theory builders can be thought of as curve fitters. The error metric is greedy, the curve is not differentable, but that's it.

I don't understand most of what you are saying and the bits I understand, I don't see how they're true. Could you please explain in a little more detail? For example, how is, say, recursive partitioning, as in decision tree learners, or storing data points for later comparison, as in KNN, "curve fitting in a high enough dimension"? What is the function being fit and where are its parameters?

Full disclosure: I study ILP algorithms for my PhD and I have implemented a couple myself. There is nothing like optimisation going on in there, just (inverse) resolution and some ordering of the search space. Most have nothing like an "error metric", greedy or not. And I have never heard anyone describe logic-based learners, including ILP algorithms, as curve fitting before.

<comment><USER4> If something requires training, it constructs a model, the model can be represented as a probability distribution. I think of that as the curve.

ILP (let's say simplex algorithm or other hill climbers) don't require training, but they nevertheless try to optimize the utility (or goal) function (which implicitly defines a metric on the space), which is a hypersurface, which is a curve in an even higher dimension.

Since the cardinality of the set of solutions is not one, and usually infinite, picking one solution over the other is optimization. (And - if I'm not mistaken - unless we know that the search space is convex, we don't know if there are better solutions or not.)

I don't think anything that doesn't build a model is machine learning. (Decision trees build a model, Bayes classifiers build a model, etc. And I'd say all are curve fitting.)

I'm not doing a PhD at all, so I'm not claiming that I'm an authority on each correct terminus technicus for AI/ML/optimization math/CompSci, but to me they fall under the model/curve fitting umbrella.

<comment><USER2> The Simplex algorithm is a _linear programming_ algorithm. ILP is _Inductive Logic Progamming_ , not linear programming. ILP algorithms do not perform linear programming, do not have a utility function and do not use optimisation. What they do is search a space of hypotheses for a hypothesis that is consistent with some background theory and that explains some set of examples. Wikipedia has an introduction:

[https://en.wikipedia.org/wiki/Inductive_logic_programming](https://en.wikipedia.org/wiki/Inductive_logic_programming)

You will not be able to understand the operation of ILP algorithms if you try to look at them from the point of view of function optimisation, or, indeed "curve fitting". You need a different set of tools, that of logic programming and automated theorem proving- because the process is essentially that of logical deduction. Please let me know if you delve into the subject and have any questions (see my profile for my email address). I'm always happy to support attempts to understand my research subject.

The same goes for other machine learning algorithms: if you use the wrong abstractions to understand them, you'll get the wrong idea about them.

For instance- KNN doesn't "require training" as per your condition for machine learning. It just memorises all its examples. Is KNN not machine learning? It is- because it gets better the more examples it has. If you stick to thinking of everything as "curve fitting", either you'll misunderstand what KNN does, or you'll start thinking that KNN is not machine learning.

Decision tree nodes are all unique - their probability is always 1/n, where n is the number of all nodes in the tree. In other words, their distribution is uniform. If you try to understand decision trees as "a model represented as a probability distribution" you'll find out that every decision tree learner builds the same model. Obviously that's not true, because each decision tree recognises different classes.

And so on.

When we talk of "curve fitting" what we mean is that we have the function of a line (not necessarily straight) like αx + βy + γz + ... where the variables are the attributes of a set of examples and the constants are unknown and we wish to learn them. These are the "parameters" of the function that are optimised by curve fitting algorithms. We say that a curve is being "fit" because we assume there is some function that we don't know that describes a line whose points are the entire class of entities from where our examples are drawn. And since we don't know what this function is, we instead try to approximate it with a function that "steps" on the few points that we have- or in other words, "fits" those points.

In decision trees, KNN, Bayesian inference, etc, etc, there is no line function and therefore no curve that we are trying to fit. You won't find a line in higher dimensions either. Whereas there is probably some curve that can fit the data points given as training examples to the algorithm, the algorithm, lacking a line function, cannot represent that curve. And while you can sometimes _visualise_ the end result as a curve, this is only a convenience and, more importantly, it is not always possible. For example- decision trees again (because they're easy): look around for visualisations of decision trees. You will find tree diagrams aplenty, but not a single line curve. Because you can't really fit a line on a bunch of decision tree nodes. It's a graph. Where's the line? Where are the parameters?

You've obviously made an effort to organise what you know about machine learning, the better to understand it. But you're missing lots of details and the result is actually hindering your undersanding. In a sense, by looking at everything from the point of view of "curve fitting" you're missing the forest for the um, trees.

My advice is: if you really want to understand machine learning (or at least to sound a bit knowledgeable about it) keep an open mind and don't rush to conclusions. There is much more to machine learning than what you can get from reading a few blogs, a couple of wikipedia pages and a few popular articles in the tech press. Even experts don't yet have a high-level theory of what machine learning is and how to treat different machine learning algorithms in a high-level, unifrom manner, as some well defined class of objects with common characteristics. That should give you a hint about how close your all- encompasing, "it's all curve fitting" definition is to explaining anything.

<comment><USER4> Interestingly I thought ILP is integer linear programming. (The first hit for ILP algorithm.)

And then I read DeepMind's delta-ILP post you linked and was even more confused as that talked about gradient descent, and then looked at your Metagol example, and ...

So, decision trees are a great example, as they were the first thing I've encountered ~15 years ago about machine learning, and I think it's a first class ML citizen. But they are in their pure form absolutely vulnerable to noise.

And as soon as noise enters the picture it becomes optimization. And I think that's the model fitting that should be the primary concept. (I used curve- slash-model, but I should have used just model.) [And even if there's no "fitting", like with kNN, you still have data, and either you use a constant classification set of points, or you'll see bias, but then the question becomes what set to use.]

And you're right, that treating everything as X is folly, after all, it gives you no information, decreases no entropy. But I'm looking at it from the perspective of what's intelligence. And it seems to be always on this spectrum of how to optimize for something. (Making hard things easy, by learning rules/algorithms.) After all that's why are we really interested in ML, no?

> But you're missing lots of details and the result is actually hindering your > undersanding. In a sense, by looking at everything from the point of view of > "curve fitting" you're missing the forest for the um, trees.

If you were so kind to elaborate on this, I'm very interested. And in general, anything that comes to your mind about my ramblings! Thanks for your detailed comments!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> AI is a lot dumber than people expect... which is the scary thing. If you look at Leela Zero's training, you'll see a lot of huge flaws pointing to massive failures of reason and areas where it is frankly incapable of making basic generalizations. Yet variants of this same technology beat the best Go players, synthesize realistic voices, give sentence labels to images, drive cars, translate language, etc. Makes you wonder that, if such an unintelligent bit of math can fake so much, whether intelligence is really that mysterious or whether it just seems that way because we don't know how to write it.

</comment><comment> Digit-Al I don't think we are that close to creating artificial intelligence for a very simple reason.

To solve a problem you must first be able to define the problem to be solved. So, define intelligence. Take your time, this comment will wait for you. Done? Good. Now define it in a way that everyone else agrees with and that doesn't fall to pieces under scrutiny.

Philosophers have been trying this for thousands of years and are still no closer to an answer. As far as I can tell we don't have any test for intelligence that is good enough to establish, for absolute certainty, that another human being is 'intelligent' let alone anything else.

Define the problem and the requirements to consider the problem solved and only then do we have any hope of coming up with a solution.

<comment><USER6> Well, this seems to be the definition Deepmind uses: [https://arxiv.org/abs/0712.3329](https://arxiv.org/abs/0712.3329) . And there has been work to establish a quantitative measure of the extent to which an agents behavior is intelligent or mechanical: [https://arxiv.org/abs/1805.12387](https://arxiv.org/abs/1805.12387) .

<comment><USER7> Thanks for sharing such interesting papers!

May I ask what makes you think that the first paper has Deepmind's definition of intelligence? Was it said so by Deepmind at some point?

<comment><USER6> Shane Legg, one of the authors of the paper, is also the co-founder of Deepmind and it is cited in several of their papers. There are some old videos of him discussing it here: [https://www.youtube.com/playlist?list=PL985E81376A4D061E](https://www.youtube.com/playlist?list=PL985E81376A4D061E) .

</comment></comment></comment></comment><comment><USER8> Take AlphaGo, because I know Go quite well. A computer is making better decisions than a human, using a pretty reasonable approximation of the same mechanism as a human but scaled up. It needs relatively more resources (gameplay time, expert attention, etc) to a achieve a more focused result than a human expert.

At the moment, it is very easy to suspect that it is only the economics of training a neural net (hardware, specialist attention, data gathering an processing) that is holding us back from AGI.

Human brains can evolve by chance. Nothing fundamental is stopping us from creating a synthetic one. Natural Intelligence isn't that smart either, realistically.

<comment><USER9> We're getting really good at climbing trees. We've got guys who can climb even the tallest trees, no problem. Any day now, we're gonna finally climb to the moon.

<comment><USER10> The tree climbers may well build a rocket and land on the moon anyhow.

I think it's a good idea not to add unwarranted mystery to the subject. We have good reason to believe our computers are underpowered for the task. This is a challenge, and while I think it's going very fast, our collective sense of proportion of the timeline seems optimistic. In my view, if it happens this century, humans will have achieved an impressive feat.

If we continue with geometric increases in flops/watt, maybe the rosy predictions will be closer than expected.

I suppose what I'm implying is that nervous systems are doing computation, and not something mysterious that we don't understand. The tree climbers knew they needed to climb higher and realized they'll need another tool not a different understanding of spatial geometry.

<comment><USER11> > We have good reason to believe our computers are underpowered for the task.

What are those reasons?

It appeared to me as if we had amassed a terrific reservoir of computational ability - but we wasted nearly all because it was expedient to waste resources when they were ample.

If I gave you a computer with 1 billion times the processing ability of current supercomputers, can you convince me that you'd be capable of replicating the functionality of a biological brain?

<comment><USER10> Do we have a terrific reservoir of computational ability though? The number are important because they seem to be about a million times too inefficient.

A human brain might take 36.8e15 computations per second [1] and does all this using about ~20 watts! That's pretty impressive at around 1.84e+15 ops / watt vs our current 6e+9 ops / watt [2] from silicon. We have to make about a million times more efficient processors to match the brains efficiency. My 4lb laptop takes what feels like forever to do a limited deep learning task given how inefficient it is.

If you gave just me the sort of computer needed, that alone would very likely not be sufficient. I just don't think we should draw too strong of a negative conclusions before we all have the necessary equipment to match the work of the brain.

But if myself and fellow computer users did have access to efficient powerful computers, we'd probably want to write algorithms that allowed us to make many attempts at the solution per second. I'd imagine writing a simulator to project many agents into where they are competing for resources and many of these simulations taking place concurrently. Something of a multiverse of simulation and optimization.

[1] [https://en.wikipedia.org/wiki/Computer_performance_by_orders...](https://en.wikipedia.org/wiki/Computer_performance_by_orders_of_magnitude) [2] [https://en.wikipedia.org/wiki/Performance_per_watt](https://en.wikipedia.org/wiki/Performance_per_watt)

<comment><USER11> > Do we have a terrific reservoir of computational ability though?

We do (and I wrote a long post with a list of bullet points proving so before I just deleted it), but I don't think we should waste time debating whether this is true or not true. We're on the same side after all, your objective is my objective.

> But if myself and fellow computer users did have access to efficient > powerful computers, we'd probably want to write algorithms that allowed us > to make many attempts at the solution per second. I'd imagine writing a > simulator to project many agents into where they are competing for resources > and many of these simulations taking place concurrently.

I recommend you look at David Krateneur's ideas, he has a video called "The Stupid Ways That We Have Thought About Intelligence". [https://www.youtube.com/watch?v=pi7h6nmkvAM](https://www.youtube.com/watch?v=pi7h6nmkvAM)

> Something of a multiverse of simulation and optimization.

An artificial imagination really.

I really recommend watching that video.

</comment></comment></comment></comment></comment></comment><comment><USER12> Glad we are finally seeing some gradual pushback on the ridiculous hype of the past few years. What is currently called "AI" can be useful in some very narrow scenarios but even then it's dangerous when people put too much trust in it (same as any system—computerized, mechanical, or bureaucratic). Blindly trusting the algorithms that brought you the Facebook and Twitter timelines to make decisions about real things in human lives would be disastrous, and we already do far too much of it.

</comment><comment><USER13> For an informed opinion see [https://news.ycombinator.com/item?id=17766473](https://news.ycombinator.com/item?id=17766473)

</comment><comment><USER14> It doesn't have to be intelligent to be usefully applied broadly and upend our economies.

</comment><comment><USER15> Even for very low-paid labour labelled as "low skilled", there are tons of intricate judgements call. I've read sociology articles on this matter, for instance a woman working in a factory at arranging cakes in boxes. She explained all of the small evaluations, complex decisions she had to make at the quick pace of the factory chain, like how to dispose different cakes to maximize box fill, of get sure that all cakes are properly seated and won't move in transport, etc. She deemed herself "unskilled", however at the same time concluded that it took her many months to master the skill of arranging cakes in boxes.

Ditto for mailmen: now they're using a program call "GeoPost" to "optimize routes"; actually the program is unable to account for myriads of things that an actual, human postman must take into account, for instance the postman is supposed to deliver mail on the even side of the street first, than on the odd side on his return trip an hour later, according to the software. That works well for wide avenues, but in small residential areas people will get out of their house and call the postman if he delivers mail for the opposite-side neighbour but not them. Silly human, with their feelings :)

In fact the craze for AI reminds me so much (once again) of good ol' grandpa Marx. As competition rages and given the tendency of profit to fall, companies try to get rid of living labour and replace it with "dead labour" (machine labour). But once again it meets the wall of value, which only comes from living labour. This all adds up perfectly.

</comment><comment><USER16> Sigh. Here they go alternating from AI is a "super genius threat" to "it isn't that smart".

Maybe an objective, honest and non-clickbait "Current State of AI" would mean they wouldn't have to swing from one extreme to the other every few months.

However you define "smart", currently AI is mostly domain-specific "smart". Though there have been advances in general AI (non-domain specific AI), but we are nowhere close an autonomous generalized AI.

<comment><USER17> The state of AI is such that it can be used to detect faces from a crowd to falsely arrest you, deny you a home loan based on nothing, cut you off from social media based on a misunderstanding, and still can't transfer knowledge between domains.

<comment><USER18> ...and still can't avoid running over pedestrians because they were pushing bikes which confused it.</comment></comment></comment>


Reasoning About LLVM Code Using CodeWalker - <AUTHOR> http://arxiv.org/abs/1509.06083 <comment><USER2> Is the code for this available anywhere?</comment>


Clojure Atlas: a visualization of the language and standard library - <AUTHOR> http://clojureatlas.com?ring-session=916f7e8a-6f55-4b79-b753-5c8d90ecf51a

<comment><USER2> Clicking "Try it!" fails for me

edit: Chrome

<comment><USER3> I kicked the heroku dyno. Seems to work now. Thanks for pointing that out, I'll have to dig into the cause. (Had been hosting the Atlas on Elastic Beanstalk until last week; I guess the kinks aren't out yet.)

<comment><USER4> same problem for me right now.

<comment><USER3> Tweaked again. Getting rather plastered… :-)

[http://www.clojureatlas.com/org.clojure:clojure:1.4.0?guest=...](http://www.clojureatlas.com/org.clojure:clojure:1.4.0?guest=t)</comment></comment></comment></comment>


I don't want to learn your garbage query language - <AUTHOR> http://erikbern.com/2018/08/30/i-dont-want-to-learn-your-garbage-query-language.html <comment><USER2> Totally agree. I only use Postgres on my stuff now (MySQL in a pinch if there's legacy reasons). I got burned too many times by ORMs.

The other point is that the data is the most important part of the application in most cases. Understanding how the data fits together, how it's structured and stored, and how to make sure it doesn't corrupt, is one of the key tasks in creating a system. ORMs don't help with this, but SQL forces us to think about the data. Which is good. I can't count the number of bad architectural structures that seemed like a good idea at the time but that I've had to discard (thankfully in the end) because the database told me they wouldn't work.

</comment><comment> nevi-me SQL doesn't fit every use case. Ansi-SQL being the standard, has been extended on by most vendors. I too often get frustrated by the idea of learning some new query dialect, but context matters.

In the case where a vendor creates something that looks like SQL, it's frustrating if the basics that I expect from ANSI-SQL aren't there. This especially if my data is stored relationally.

If the database/store doesn't behave or store data relationally, SQL often doesn't work well. At least you need some mechanism which the vendor might not want.

I can't expect to use SQL for a graph database. It also might not work so well for a KV store that doesn't have relations/joins.

MongoDB's query language is actually good. I know they support SQL on the enterprise product, but it feels like a compromise.

I suppose the rant has some merit, but I'm trying to say that SQL can't solve everything.

An interesting project is Apache Calcite, which gives a single SQL query model to various data stores. Perhaps one could write a plugin if they really want to use done random database that doesn't use SQL.

</comment><comment><USER3> I actually had a spell the other day where I looked at alternatives to SQL, which mostly produced Tutorial D variants. And there are some nifty ones, there are query languages that will compile to specific SQL dialects so that you can keep using a familiar database engine. They just aren't used much.

Somehow, we've come to accept a Babel of general purpose programming languages(albeit mostly centered around Algol variants) but the same really hasn't happened with databases. Either it is a form of SQL or it is pooh- poohed as weird and bad.

And I don't think that that's because SQL got everything right and we should worship vintage language design - I think it's just a case of specialized demand and barriers to entry making the database market move slower. A lot of shops fail even at using basic features of SQL, so maybe it's asking too much to get beyond a passing familiarity with relational concepts and one syntax to interact with them.

</comment><comment><USER4> The author has a point, and Sql is good when it is a human interacting with the database (that's what it was designed for after all). But when it comes to software/library interacting with the DB it is simply terrible.

Some times you just want to say say hey, give me this specific data and in that case Sql is the easiest solution. But if you have more complex model and you have a bunch of parameters and you need to build one or more queries based on these parameters then you are better off with ORM. I think that's actually how the first ORMs got started, people got tired building queries with strings.

</comment><comment><USER5> A good ORM should map pretty directly and logically to SQL, and in my experience is about convenience more than anything. In all fairness, you practically have to be able to write your own ORM to use an ORM effectively; understanding all the black magic under the hood so it doesn't shoot you in the foot. I still think it's worth it though. There are also very light weight ORMs which take in a sql query and just do object mapping with the result. As with everything, it depends on your use case.

</comment><comment><USER6> Interesting point of view. I've been toying with the idea of using a controlled form of SQL as a DSL for an API instead of REST routes. Since I code in Clojure, I use a lib called Korma to help me build SQL queries. It has a rather good intermediary format and I started to extend it in order to support "additionnal SQL verbs and keywords". For instance, consider my home- made CONJURE BY verb. It works like INSERT but with a find-or-create-by flavor. Here is how it looks like on the client side of the api.

(conjure my-record (by {:linked-record-id 1}) (values {:field "abc"}))

Upon reception, it is translated into requests with classical SQL verbs

(let [existing (select my-record (where {:linked-record-id 1}))] (or existing (insert my-record (values {:field "abc" :linked-record-id}))))

I really did this out of curiosity, and actually this works pretty well. Once normalized in an easily parsable format (here s-expr based), it's pretty easy and straightforward to manipulate SQL: extracting where statements, merging them and reinjecting the result in a new query is actually quite easy.

Want to have authorizations on what fields can be read/written by the client ? Well it's not that hard to deep-walk a query looking for unauthorized fields.

Want to return data as a graph of entities like GraphQL rather than as a table or at least resolve foreign keys to the subentity they're refering to ? This should be doable.

What about complex query features ? Joins, filters, conditionals and boolean combinators, limitation on the number of results, grouping, etc ... It's all already here.

This leads me to wondering why are we so opaque about our abstractions ? In my view, the relational model is very useful and convenient and should be extended upon. I don't like the way GraphQL has been implemented (disclaimer: i never used GraphQL): to me it's mostly rebuilding what lies one level below although it is more general than my own proposition since it abstracts away the relational model.

As for ORMs I have nothing against them. Actually with the "abstraction transparency" strategy described above, they would be a very convenient way to write a client for such an SQL-based API : it would essentially boil down to writing an adapter.

</comment><comment><USER7> I just want to point out that some ORMs let you use SQL queries directly and thus you don't need to know much more than your model's layout.

</comment><comment><USER8> Ever worked with younger Java devs? They're so entrenched in JPA (Java ORM interface) they think it rather than SQL is the standard query language.

</comment><comment><USER9> Here here. Long live SQL. With Postgres and JSON extensions its super simple to get JSON direct from your database.

There's a special place in hell reserved for the creators of ORM's. Every one I've used is especially awful. The worst has got to be ActiveRecord: a giant, slow and bloated leaky abstraction shit-cake that every Rails TODO list app programmer who can't be bothered to learn SQL seems to love.</comment>


Verified by Visa and MasterCard SecureCode: or, How Not to Design Authentication - <AUTHOR> http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf

<comment><USER2> So very true. 3DS is technologically horrible. In exchange for protection from certain types of chargebacks, a merchant is expected to iframe a 1995-looking webpage from Visa or MasterCard asking the cardholder to create or enter a password. It's abrupt and unexpected, does not fit into the checkout process of any website, and because it's framed the customer has no idea what site they're really giving their password to. All this adds up to lowering conversion rates and undermining all the anti-phishing efforts the banks undertake by telling you to never give out a banking password without checking the address bar.

The paper recalls a perfect example from one of its authors -- the official 3DS page is served by securesuite.co.uk for some UK banks, so he calls his bank and they tell him it's a phishing scam. Yet merchants are expected to do this, lest their chargeback rate climb too high and the account be terminated.

I've only encountered 3DS in the wild once, and only after registering a card for it in the process of testing my own implementation. It only took two days of running VBV and MSc on one of my websites to see that it would be completely economically infeasible -- doesn't matter if I'm protected from chargebacks if it means half my customers abandon checkout out of fear and confusion.

I've had a real hard time handling card-not-present fraud on my websites. I sell packaged self-service advertising services on one site, and it's highly targeted by the do-no-goods that want to use it to push traffic to affiliate sites and phishing scams. They use stolen credit cards to buy the advertising hoping to funnel good money, or more stolen cards, from the traffic back to their accounts. I still have one merchant account in limbo (bank holding 6 months worth of payments) from spending two years working on fraud detection methods to battle this. I only got chargebacks below 1% through geolocation, country blocklists, proxy detection, my own and 3rd party blacklists, minfraud risk scoring, in-house risk scoring and pattern matching against past fraud, and phone verification of all high risk orders.

</comment><comment><USER3> If you want to accept Maestro payments you _have_ to implement 3DS or face a £25000 fine - at least in the UK.</comment>


Brakeman Pro Engine Is Here - <AUTHOR> https://brakemanpro.com/2016/09/14/brakeman-pro-engine-is-here <comment><USER2> Brakeman is really high quality. If you are doing anything appsec related with ruby or are not an appsec person with a ruby codebase, brakeman is very helpful.</comment>


Moving beyond localStorage - <AUTHOR> https://journal.standardnotes.org/moving-beyond-localstorage-991e3695be15#.5ua9rs4vk <comment><USER2> > It's hard to believe that as of 2016, the best method for offline storage in > a web app was localStorage

IndexedDB has been around and usable for long enough that I used it on projects >3 years ago, with a fallback to localStorage just in case (looking at you, IE9). Apache Cordova even gave a nice little abstraction over sqlite so that using IndexedDB + phonegap was seamless and gave even more storage (IIRC). It was a pretty solid success for the data-heavy project I was on at the time. Load times the second time around were slashed to almost nothing. The app logic just needed to retrieve anything new since <latest timestamp> from the back end and update the UI.

Our experience was pretty great, though. I definitely highly recommend implementing some sort of domain-specific data caching layer with IndexedDB if you have the chance and if you're moving enough data to justify it. Just make sure you think through the update logic (e.g. use timestamps or log-structured data), and handle merge conflicts appropriately if necessary (i.e. if your app can be used offline).

There are plenty of great wrappers out there that simplify most use cases, too. We ended up going with localForage [1] to simplify refactoring away from localStorage.

[1] [https://github.com/localForage/localForage](https://github.com/localForage/localForage)

<comment><USER3> What I would really like to see would be Realm in the browser. My experience using it (for mobile development) has been so much better than what I went through with IndexedDB as web developer that it is not even funny.

Now that Realm is entirely open source it could even be a real possibility to have support for it build into web browsers.

</comment></comment><comment><USER4> Maybe it is a poor example, but I don't understand how IndexedDB and WebCrypto have anything to do with a distributed chat system like Slack.

For a system where I can join a channel at any time and see what's been said in the past, the information has to live on their servers and be readable. Even more so if you want to be able to search for something someone said across your entire Slack account. You aren't going to have all of that data local to your machine and browser.

<comment><USER5> * I don't understand how IndexedDB and WebCrypto have anything to do with a distributed chat system like Slack*

Uh, what? The OP didn't mention Slack at all. I mean, you could make this kind of...comment on anything: "What does X have to do with Y?" (In this case, X=(WebCrypto & IndexedDB) and Y=(Slack)). But it's not very useful.

<comment><USER6> The article had a very prominent image of a tweet from @SlackHQ about the lack of encryption at rest - [https://cdn- images-1.medium.com/max/1400/1*OBXEceCpTP4jUeTZu...](https://cdn- images-1.medium.com/max/1400/1*OBXEceCpTP4jUeTZuRrC_A.png)

<comment><USER5> Yes, you're right. I missed it. I guess he's making a point about wanting his own chat history searchable on his client, and yet opaque to the server-side Slack operators. I agree it's not a great application, though.

</comment></comment></comment></comment><comment><USER7> For everybody starting to use indexedDB I recommend to take a look at Dexie.js ([http://dexie.org/](http://dexie.org/)) for a minimalistic wrapper which might save you from a lot of pain as working directly with indexedDB is no fun imho.

<comment><USER2> Another protip: localForage [1] makes it fairly easy to drop in IndexedDB if you're used to the localStorage interface. The only drawback is that you have to refactor into using promises, since IndexedDB is async.

[1] [https://github.com/localForage/localForage](https://github.com/localForage/localForage)

<comment><USER8> Nice name and interesting API: [https://news.ycombinator.com/item?id=13421321](https://news.ycombinator.com/item?id=13421321)

</comment></comment></comment><comment><USER9> Even worse, the pathetic 5mb limit is trivially bypassed, so it's really just an annoying but ineffective restriction:

[http://feross.org/fill-disk/](http://feross.org/fill-disk/)

</comment><comment><USER10> This still doesn't explain how large scale search indexing could take place effectively... the data still needs to float upstream un-encrypted, processed and indexed.

Somehow offloading full-text indexing to the client, uploading encrypted indexes to the server and then elegantly combining those indexes across users to display a unified search would be arduous and I don't see anyone doing it.

Also, IndexedDB has been around for _years_ and still suffers from a variety of cross-browser inconsistencies that make it a little painful to work with.

</comment><comment><USER11> How on earth is SlackHQ's response reasonable? Let me count the ways it's not.

There are plenty of database systems (MySQL enterprise, Postgres, Oracle, SQL Server) that support encrypted data-at-rest and there are even more ways to run a DBMS on top of encrypted disks and volumes (dm-crypt, Bitlocker).

Running in the cloud? Amazon AWS provides EBS encryption (and likely more) and Microsoft Azure provides data at rest encryption for all storage types (tables, queues, page and block (disk) blobs) and transparent encryption for Azure SQL Database.

Want more control over the encryption in the cloud? Amazon and Azure both provide HSMs, called CloudHSM and Azure Key Vault, respectively. Azure supports additional encryption at the VM level integrating with Bitlocker and/or DM-Crypt.

There's really no excuse for not having figured out data encryption for customer data and secrets at this point.

Edit: It appears Slack has since updated their security docs and they now use encryption at rest. Good! It's inexplicable to me that anyone would believe that a database index would be incompatible with encryption.

<comment><USER12> I don't understand how any encryption like this helps, unless it's end-to-end. When somebody breaks in, they just get the encryption keys as well, no? Can anyone point out what am I missing here? Thank you.

<comment><USER11> When "somebody" breaks in, what level of access do they have? In a larger business, access should be compartmentalized and enforced not just with policies but with encryption where possible.

Virtual machine or cloud service administrators shouldn't have the ability to read customer data, they should just see binary blobs.

A devops/sysadmin employee might have access to the machines running the database, but even if they log in they shouldn't necessarily have read access to the database files, and even if they should, again, customer data should be encrypted blobs to them.

This means that even if you phish the CEO of the company, you still have to obtain additional access to read customer data. If using AWS or Azure encryption properly, it may even require obtaining credentials for multiple users.

This isn't even the full extent of the encryption possible, keys can be placed in silos per tenant, and decrypted only once a user logs in. Then even if you are a developer, you wouldn't have access without intercepting client communications.

</comment></comment></comment><comment><USER5> Haven't read through the WebCrypto standard, but it's hard to create a real barrier between a server process and a client process on the web. In essence, any good crypto UI would have to happen outside of the client process, so that the server cannot intercept your input. (This is my objection to well-meaning companies that say "Hey, we can't even read your stuff, it's encrypted on the client" because, if you have auto-update, or if you ccan inject code into the client, that privacy guarantee can be revoked at any time.)

<comment><USER13> > if you have auto-update, or if you can inject code into the client, that > privacy guarantee can be revoked at any time

Anytime you use software built by someone other than you, any guarantee can be revoked at any time - the distributor can put whatever they want into the software! When a distributor makes claims about the privacy/security of a product, at some point you either trust them and take them at their word, or you don't - in which case, it doesn't matter what they say.

Unless the product is open-source and self-hosted, that is.

<comment><USER14> If the binary you are using is signed, and the signature is well-known via a side channel, you can at least make sure you're running the same binary.

If the binary was built from a known source, and the build is reproducible, you can even be sure that the binary really represent the code in question; bugging a compiler so that it injects a malicious payload _and keeps a crypto signature the same_ is a bit hard. (But the whole "trusting trust" chain applies.)

<comment><USER13> I'm with you there - I was more talking about the trust that needs to exist that the (official) binary distributor really is following through on their claims about privacy or security.

</comment></comment></comment></comment><comment><USER15> Having a local storage of this type is half the problem. The other half is syncing the data between different browsers and keeping it backed up. Imagine if all your mail, years and years of it, lived in IndexDB inside your browser on your one device.

I think browsers should implement a standard way to sync local storage, identity information (think private keys instead of passwords), cookies, etc. across all the browsers you use. Oh and obviously it should all be encrypted at rest and you get to choose which service you use to sync the data, so you can avoid the less trusted ones. What kind of utopia would this be?

</comment><comment><USER16> The sad thing is, there was this idea for WebSQL ages ago and it would have solved this problem AND made database-backed apps easy to write, plus firefox and chrome already use sqlite internally so you could reuse that as the engine. Apparently it wasn't hip enough for the NoSQL folks though.

<comment><USER17> Actually, the issue (as I understand it) was that a web standard requires at least three different implementations (otherwise, it's less of a standard and more of a plugin). Chrome basically exposed SQLite to web apps, which meant other browsers would have needed to reimplement SQLite in order for WebSQL to become a standard. That said, I do wish they had gone the SQL route vs NoSQL.

<comment><USER18> Mozilla talked about why they didn't support it here: [https://hacks.mozilla.org/2010/06/beyond-html5-database- apis...](https://hacks.mozilla.org/2010/06/beyond-html5-database-apis-and-the- road-to-indexeddb/)

</comment></comment></comment><comment><USER19> Assuming you are storing only encrypted data on the server and cannot read it without the user's password, what happens if the user loses their password? Are they just left with a bunch of unreadable data that came from the server?

Doesn't this approach also make it difficult to share information between other users?

Having offline-first, client side encrypted apps seem to have a lot more problems than just "you know who" spying on you.

<comment><USER20> The big use case for this would be for workplace use, not for social / community use. In that case, since it's the company's account system (whether it's actual SSO, or just access to the email account where password resets go) that authoritatively identifies users, it's reasonable for the company's IT department to have a way to issue replacement keys that can also decrypt the data.

Encrypting data client-side doesn't make it difficult to share information between other users of the same system: all you do at the protocol level is send them a message with the data, or perhaps with a key for decrypting a stored file. It's really just a matter of UI to make it smooth. If anything, it makes it slightly _easier_ because you can use any transport mechanism you like for sending the ciphertext; you're no longer obligated to route everything through HTTPS connections to a single server. So, for instance, you can throw encrypted uploaded files in an S3 bucket, and maintain availability for existing data even if the service provider is having an outage, because users can access and decrypt that data using their client.

It does make it more difficult to share it outside the system (to people without accounts) without storing it decrypted.

<comment><USER19> Thanks that actually makes a lot of sense.

</comment></comment></comment><comment><USER8> More details about the 50% disk space limit: [https://www.raymondcamden.com/2015/04/17/indexeddb-and- limit...](https://www.raymondcamden.com/2015/04/17/indexeddb-and-limits)

</comment><comment><USER21> re: "But if the server could read your data, then practically any engineer of the company could read your data [...]"

A caveat: this tends to be true of startups. If you don't know who you're dealing with, it's probably a safe assumption to make. But larger companies often have internal permissions in place to prevent any engineer from reading user data.

</comment><comment><USER22> First time I've ever seen the IndexedDB API described as "delightful".

</comment><comment><USER23> Hey, I'm kind of a novice to web dev (especially when it comes to security) so could somebody please explain why you can't implement end-to-end encryption and search capability ?

<comment><USER24> You can only search data if you can read it, so it needs to be unencrypted. With end-to-end, this means only the data you have locally, so you can only do local searches. In the Slack example, (I assume) Slack uses their servers to pre-fetch search results for a faster experience.

</comment></comment><comment><USER25> How do others handle cross subdomain support of local data? IndexedDB and localStorage do not support subdomains best I can tell.

eg. mysite.com and app.mysite.com sharing local db.

<comment><USER26> Have you looked at this (use iframes and postMessage).

[http://stackoverflow.com/questions/4026479/use- localstorage-...](http://stackoverflow.com/questions/4026479/use-localstorage- across-subdomains)

I haven't used it myself but am planning to for a project I am working on now.

</comment></comment><comment><USER27> A question - does it matter for webcrypto API's trustability to have window.crypto be redefinable to anything a piece of JavaScript code desires? (Ex: extensions)

I find it hard to make any claims about safe local encryption using webcrypto API if, post encryption, a new extension can be installed that will sniff the keys as you decrypt to access your data.

Thoughts?

<comment><USER28> In the browser, extensions can be thought of as programs with root permissions in many cases. They can do anything to the page. But this isn't new to the web, your kernel can be "changed" if you give something permission to change it and that kernel can sniff your keys as well.

There's definitely a "societal" issue around how much power extensions have, but I don't think it's any different than most "platforms" in that if you give something root, it can do anything.

<comment><USER27> At this point, my browser's (Chrome's) URL bar reads "Secure | [https://news.ycombinator.com/...."](https://news.ycombinator.com/...."). I have quite a few extensions loaded including ad blockers. Is the "Secure" statement trustable? Should window.crypto be trustable in the same way? ... as a guarantee provided by the browser in spite of extensions? Is that even possible?

<comment><USER28> Well it's secure in that the connection between you and ycombinator is secure.

But any of your extensions that have permission to modify the page, can be modifying it in any way shape or form.

So they could be rewriting my comment, they could be calling out to external servers sending all the contents of your page, they could be recording every keystroke on that page, and more.

So no, you can't trust that "Secure" statement absolutely.

And while the browser _could_ make window.crypto immutable or "un modifiable", it would be a false sense of security as an extension could just get the result from the page when it's put into the DOM.

</comment></comment></comment></comment><comment><USER29> The solution is easy, make a real app.

</comment><comment><USER30> This article is a very long write about nothing. Throws up topics and questions, and provides no explaination or answer.

An example of medium click bait that leads to medium's eventual demise. Being a platform for badly written PR bullshit will not work out for medium imho.

</comment><comment><USER31> So after a bunch of work is done, I can have search on Slack like I have now. I understand it's better to have my chats encrypted at rest, but I wonder how many users are interested enough in that to make this change happen.

<comment><USER14> > how many users

Everybody who exchange somehow sensitive info in Slack from their laptops and phones? Because these devices can be stolen.

OTOH such people should use a full-disk encryption on laptops anyway. With phones, it's a bit more tricky, especially if an external SD card is used, but solutions still exist, AFAIK.

<comment><USER32> From my experience in the industry the common advice is you shouldn't share sensitive info in Slack/HipChat/whatever else is bound to get hacked.

</comment></comment></comment><comment><USER33> WebCrypto is security theater. The server could just swap the JS for a version that decrypts your secrets client-side and uploads the plaintext (or just uploads the key) to the server. Next time you hit the page your secrets are compromised.

Also, if you use "50% of the user's disk space" you can go fuck yourself.

<comment><USER34> How is that any worse if you stick with CryptoJS, where you get the entire implementation from the server anyway? Or any other application you download that uses crypto and has an update mechanism for that matter?

<comment><USER33> CryptoJS is security theater, too. Doing crypto in JavaScript in a browser is never secure.

An application with a silent update mechanism has the same problem. An update mechanism that tells you its happening and waits for your approval does not.

<comment><USER35> What about browser's (says Chrome) auto update feature? Security theater too?

<comment><USER33> Becomes more difficult to say. I would suggest that it is, yes. However, the tradeoff is more difficult to make, you have to decide if you trust Google not to push a sour update (but consider that it might be compelled to by a state actor). Also note that Chrome might have different secrets to share in the first place, it could just break future SSL connections or share saved passwords or something.

Personally, running Chromium on Linux, I don't get automatic updates and go through the usual process of signed updates from package maintainers only when I approve them.</comment></comment></comment></comment></comment>


In Defense of Chargify - <AUTHOR> http://blog.trackjumper.com/2010/10/in-defense-of-chargify.html

<comment><USER2>
      Chargify was underpriced.

Unless you have some inside information, it's hard to say if they were undercharging for their service. Without knowing what their overhead was like I don't think it's fair to say that the service was underpriced. Just because they can charge a lot for something doesn't mean they should.

One would hope they would have been able to sustain the free tier based on the revenue from the paying tiers so that they could sustain the free tier in the hopes that many of them would become paying customers.

On twitter, however, they claimed this change was a move to get rid of accounts where users had paying customers but weren't actually paying chargify yet. This would have been fine, but they also doubled prices for anyone who had between 50 and 500 customers and raised the prices for the other tiers as well. Their explanation doesn't match with their actions.

      Chargify offers great service.

In my experience it was really just mediocre service. While I give them credit for trying, It seemed like Lance was handling a lot of the support himself and to his own admission he's not a technical support person. There were a couple of times he just sent my partner links to the documentation without actually answering a question. No offense to Lance or anything, but it was clearly a good idea to hire a technical support person. The only problem is, now that I'm fully integrated, I don't really need help / support unless their service goes down or something breaks.

      Chargify has been very transparent.

Only after the fact. Sure, they get a couple of points for that but I still wouldn't consider this a good thing.

      You must do your own due diligence

Do you often ask a service if they are going to raise their prices any time soon before you sign up? Do you think they would have said yes if I had asked them 6 months ago? Honestly, I thought $49/month was a pretty fair price and didn't really expect it to change any time soon. I looked at all of the options out there and felt like chargify offered the best service at the best price. Would you consider me foolish?

The bottom line is that they offer a great product but it still needs some work. Doubling what I pay for it really broke my trust and if they don't fix some of the issues with the product soon, I'll be writing my own solution.

<comment><USER3> Are there any other SaaS alternatives to Chargify?

I was planning on implementing it into my app next week but I'm having doubts now with the price. There is no entry level option any more. For an app that is prerevenue, the up to 50 for free account was very compelling.

Now I'm required to pay $99 upfront regardless.

I may write my own as well. There's quite a few rails frameworks.

<comment><USER4> There's a really detailed breakdown here:

[http://www.untitledstartup.com/2010/02/accepting-payments- on...](http://www.untitledstartup.com/2010/02/accepting-payments-on-the-real- time-web/)

</comment></comment></comment><comment><USER5> Could it be that Chargify's troubles in finding clients are caused by lack of demand for flexibility in payment system? It's one thing to dream about having sophisticated and flexible payment system. It's another thing when such flexible system is offered to paying customers.

Customers don't like to navigate across gazillion payment plans and generally prefer simple and stable payment options.

My guess is that companies that play with pricing too much -- do not have long-term success and therefore cannot really grow and support Chargify.</comment>


A Year of Clojure - <AUTHOR> http://tech.puredanger.com/2010/12/31/a-year-of-clojure/

<comment><USER2> Great post Alex. I've recently started to experiment with Clojure on SemWeb apps, RDF, SPARQL, etc. In your post you talk about how Clojure enables you to abstract better than Java. I was just hoping you would discuss a specific example (maybe even in a production environment) instead of how many LOCs you saved.

<comment><AUTHOR> I did write one blog post earlier this year but it's a pretty trivial example. The zipper/tree stuff I'm writing up will go into quite a bit more detail. That article will be in the new Code Quarterly journal sometime this year.

</comment></comment><comment><USER3> Great post, I really want to play with Clojure, but when I looked into it last year it was very apparent that it was built on Java. Not just the JVM, but the Java ecosystem, you were expected to use Maven or Ant for building, jdbc for database connectivity, things like that. I'm sure this is great for someone coming from Java who knows how all of these libraries and tools work, but it felt like I'd have to remember Java just to understand their documentation. Has this changed? Is Clojure standing on it's own now feet now?

<comment><USER4> There is a fairly nice Clojure build/dependency tool called Leiningen. It uses maven repositories under the hood but you usually don't have to worry about that.

There are libraries in contrib that wrap JDBC database access so you don't have to interface with any of the Java classes.

clojuredocs.org documents core and contrib very well in a non-javadoc style.

So by and large, yes. Of course Java still shines through from time to time - I'm not sure that can be helped. But overall things have improved and are still getting better.

</comment></comment><comment><USER5> >What macros? I'm a bit embarrassed to say I've not yet written a single macro. Partially I tend to think the function version should exist regardless in most cases and partly I work with three other Clojure gurus that can satisfy my macro whims faster than I can state the need. Let's call it a goal for 2011.

Heh, he hasn't completely grokked macros yet; they should _only_ be written if the goal couldn't be done as a function.

<comment><USER6> Or, perhaps, if it gets you nicer syntax. The classic macro example "unless" could be written with a function, but then you'd need to write

(unless (< 1 2) #(println "hi"))

every time.

<comment><USER5> Arguably, that's not the same, as long as you define "unless" as not having the hash there.

I'm not quite familiar with the hash -- is that just making a vector with _println "hi"_ as its elements? How does the unless work with multiple statments? I'm sure you know that unless has an implicit _progn_ in it -- does this? What's the code to implement this? I tried, but couldn't really figure out what to do with the vector.

<comment><USER7> The hash is the anonymous function form. In the example, presumably the unless function calls and returns the value of the passed-in function when the test is logical true, otherwise returns nil.

<comment><USER5> Ah, interesting. At least in clisp -- the Lisp I fired up to test this -- the hash is syntax for vectors:

> (type-of #(+ 1 2)) (SIMPLE-VECTOR 3)</comment></comment></comment></comment></comment>


Beastie Boys Sue GoldieBlox Over Alleged Misuse of "Girls" - <AUTHOR> http://pitchfork.com/news/53130-beastie-boys-respond-to-toy-company-goldieblox-over-alleged-misuse-of-girls/

<comment><AUTHOR> I'm curious why the company didn't attempt to contact the band before using their song claiming Fair Use. It seems obvious that the Beasties aren't against the message of the commercial or campaign, but it is their intellectual property, and MCA's last will prevents use of their compositions in commercials. Monster Energy had the same thing happen to them in the same circumstance when they used Sabotage.</comment>


Startup Weekend San Francisco 2 from April 3-5, 2009 - <AUTHOR> http://socialapp.wordpress.com/2009/03/11/announcement-startup-weekend-san-francisco-2-april-3-5-2009/ I am looking for other developer's who will be going for Startup Weekend to partner up. I have signed up as a Back end Developer. <comment><AUTHOR> I have signed up as a Back End developer for the event. I would be interested to meet up with someone who is also going there and team up with them before hand.

</comment><comment><USER2> I am going as well. Registered as user experience guy.

Went last year and had a blast!</comment>


Anatomy of an Amazon EC2 Resource ID - <AUTHOR> http://www.jackofallclouds.com/2009/09/anatomy-of-an-amazon-ec2-resource-id/ <comment><USER2> Seems a bit out of date. RightScale posted this follow-up yesterday that seems to have more information as to the actual number of instances launched.

[http://blog.rightscale.com/2009/10/05/amazon-usage- estimates...](http://blog.rightscale.com/2009/10/05/amazon-usage-estimates/)</comment>


Data compression proxy for Chrome for Android (beta) - <AUTHOR> https://developers.google.com/chrome/mobile/docs/data-compression

<comment><USER2> Hope there's an opt out. I can imagine all this web history coming back to bite some day.

For example during a murder trial: "And is it true Mr X, that you browsed the page 'Top 10 amusing CSI murder strategies" "Yes, but.." "And was number 6 not the exact method used to murder Ms Y?" _Jury murmers in disapproval_

It's like numerology, the more data points you have the higher than odds of finding a couple of data points that coincidentally line up, all in a conveniently subpoena friendly Google data centre.

<comment><AUTHOR> You have to explicitly enable it in chrome://flags - the default is off. So, yes, there is definitely an opt out!

<comment><USER3> Can we run our own proxies? That would be a good compromise - and we could tunnel SSL to our own servers safely and privately.

<comment><USER4> This guy did: [http://00f.net/2012/06/02/mod-pagespeed-as-a-proxy-for- your-...](http://00f.net/2012/06/02/mod-pagespeed-as-a-proxy-for-your-phone/)

And so did this guy: [http://vincent.bernat.im/en/blog/2011-mobile-browsing- conten...](http://vincent.bernat.im/en/blog/2011-mobile-browsing-content- optimization.html)

You could even take mod_pagespeed and start selling your own competing optimizing proxy; it's open source.

(Evil idea: run an optimizing proxy in a part of the world with very slow or expensive-per-byte internet and make money via ad insertion or replacement.)

<comment><USER3> Now to figure out how to combine this with mod_spdy.

</comment></comment></comment></comment></comment><comment><USER5> One of the things they explicitly call out is DNS late binding: it doesn't look like they make any exceptions for CDNs and other services that use geo-IP lookups. You could argue that the speed improvements do away with some of the need for CDNs, but there will probably be some other cases that this breaks. You'd want some way for a specific domain to opt-out: perhaps a DNS text record that gets read and indicates that a site shouldn't be optimized?

<comment><AUTHOR> The IP address of the visitor is forwarded in X-Forward-For, which is a standard header and CDN's can leverage that. Having said that, note that this can actually work against you.. The whole idea is that all of the requests are multiplexed over SPDY between the device and the proxy. So you actually want the closest resource to the proxy, not to the device (and the proxy as close to the device as possible, of course.. :))

</comment></comment><comment><USER6> So yeah, I know, it actually works, it actually provides benefits. I know, opera has this option too.

But really, sending all my data via google, as if all the rest going through them wasn't enough.. doesn't make me all that comfortable. No one company should control OS, client, data at rest and data flows. It's too much responsibilities in one single place.

</comment><comment><USER7> How does it know if the image is just going to be displayed and can therefore be recompressed vs when the image is used for data? For example many WebGL apps have data in PNGs because they are normal maps or heighmaps. Mucking with the data will mess them up.

Other apps store data in their PNGs. For example Monoco encodes its saved game files as screenshot PNGs and stores the save data in the lower order bits of each pixel. Mucking with the data would make it impossible to load saved games.

Is there a way for a page to opt out for these cases?

<comment><AUTHOR> Specify "Cache-Control: no-transform" on assets that need to be skipped.

<comment><USER7> And how do I do this if I don't control the server? For example there's all these samples being served off of github.

<http://mrdoob.github.com/three.js/>

AFAIK there's no way to specify a header from standard HTML and it's highly unlikely that most people will have access to the servers that serve their content to set these headers on a per file basis

</comment></comment></comment><comment><USER8> I don't have an Android phone handy, but I'd love to poke at this. Does anyone know the IP addresses they're using for the proxy? Is there any authentication that limits this to Chrome on Android or are they essentially running this as an open proxy?

<comment><USER9> Be assured that if you were not identified, they'd have no reason to run the service in the first place..

Without looking I can safely say it's not a public proxy, probably tied to your device's Google Accounts session.

<comment><AUTHOR> "note that secure connections (HTTPS) are routed directly from your mobile device to the destination, bypassing the optimization proxy – only HTTP requests are routed through and optimized by the proxy. Further, the use of the service does not require a Google account; navigation in incognito tabs bypasses the proxy; original IP address of your device is forwarded to the destination via the X-Forwarded-For header – the data compression service is a transparent proxy."

<comment><USER6> That's actually cool. I hope they'll keep it that way.

</comment></comment></comment></comment><comment><USER10> I think it's the same thing Opera Mobile has been doing for a long time now ...

<comment><USER11> Yes Opera Mobile has the turbo mode which is similar to this technology <http://www.opera.com/turbo> where it proxies the connection and compresses the data.

Opera Mini on the other hand uses OBML [http://dev.opera.com/articles/view/opera-binary-markup- langu...](http://dev.opera.com/articles/view/opera-binary-markup-language/) which is an entirely different thing.

<comment><USER12> OBML is a superset of a compressing proxy.

</comment></comment></comment><comment><USER13> I wonder if the Engine behind it is Open Source or could we use this services from other browsers like Firefox?

This is beneficial for Getting pass Firewall restriction, from China Firewall to Office Internal Firewalls. Speed up Internet connection, especially in places where the shared internet is extremely slow. ( Office or Public Computers )

While i am already using my own VPN for this purpose. It is much slower compared to a normal internet collection if your VPS is not located close to you.

</comment><comment><USER14> This seems to only be available to devices capable of a mobile data connection. My WiFi-only Nexus 7 doesn't have the options while my Galaxy Nexus does. I suppose the utility of this service would be limited on a true WiFi connection, but I commonly use my GNex's hotspot capabilities. It's a shame that it seems I can't use this over that connection.

Edit: Seems there's a newer version, but the Play Store tells me it's incompatible with my Nexus 7. That would explain the missing flag.

<comment><AUTHOR> Nexus 7 incompatibility appears to be a bug... stay tuned.

</comment></comment><comment><USER15> This seems like a rough equivalent of "Onavo" for Android: <http://www.onavo.com/apps/android_extend/>

<comment><USER16> Similar perhaps in that they both compress the stream. Onavo creates a VPN between your device and their proxy server, but it still uses the traditional TCP/IP stack. Google's solution will hopefully work better. Onavo only worked over cellular data and in my testing it was noticeably slower. The advantage was only in the amount of data. I'm hoping, and from the sound of things, this solution will reduce bandwidth and return data faster than an unproxied connection.

</comment></comment><comment><USER17> wondering if this means I can bypass the GFW in China to visit some blocked sites(facebook.com, etc) ?

</comment><comment><USER18> In theory it could also be used to circumvent country lock for videos and such?

<comment><USER19> Well, that probably depends on whose locks you're trying to get around. igrigorik noted that the proxy does pass along the user's IP address in the X-Forward-For header, which could be used to preserve a country lock.

Who will actually do that? I can only speculate. I'd expect Google video sites to pay attention (they tend to be pretty technically savvy in implementing their country blocks). On the other hand, I suspect most non-Google sites to not pay attention unless the proxy usage becomes large enough to notice (or unless they're already triggering off of X-Forward-For for other proxies and the like).

</comment></comment><comment><USER20> Wonder if they just reused bits of now dead Google Accelerator...

<comment><AUTHOR> PageSpeed optimization libraries (under the hood): <https://developers.google.com/speed/pagespeed/psol></comment></comment>


Ask HN: How can I make sure that my skills develop in a small company? - <AUTHOR> This seems relevant given the recent massive discussion on big vs small companies. Throwaway just in case.
I'm currently finishing my PhD in computer vision. I'm about to start a job at a small hardware startup. The environment is great and it feels very close to being not work, which is nice.
Down the line I would probably be looking to join one of the big players in vision like Google, but right now I feel like I need more experience. I'm 25 now, for reference.
The team are highly educated (all post-doctoral), but I would probably be software engineer number one i.e. C++/python. If and when we start shipping code it's probably going to be up to me to define in-house coding standards, source control, documentation, unit testing and so on.
I don't have a formal background in computer vision (physicist) and while there are lots of concepts that I'm aware of from, well reading HackerNews, I don't really know what industry best practices are. I worry that while I can get the job done, I have no idea whether the code solutions I produce are 'professional' (not sure what a better word is here).
How should I go about improving myself in this respect?
How do I learn the things that would be (I assume) common practice if I was a SWE working for a megacorp or being mentored in a startup instead? <comment><USER2> You will do fine. Pick a project you like or whose codebase you will be leveraging, and follow their coding standards and practices. Get working code up quickly and don't get distracted. If you end up at a big co., you will look back on this time jealous of the freedom you had and the creativity it supported. Just be sure to deliver working code and useful functionality quickly.

</comment><comment><USER3> From my high horse...or perhaps between it and me.

The engineering that matters at a startup is driven by business concerns. A well organized codebase isn't a product. Best practices revolve around making money or at least surviving.

Industry best practice in the hardware industry is selling hardware. A professional matches a budget and requirements to what can be done and what cannot be. The whole idea of being a professional is getting paid to apply expertise to the specific circumstances and not promote one's trivial values. To put it another way, a professional turns down jobs that violate their non- negotiable values. They don't take money and then impose them on the unwilling.

Experience will give you professional judgement. That will make you better.

Good luck.</comment>


Calling Community Leaders – Let's Build Community Stack Together - <AUTHOR> https://felicianotech.com/blog/calling-community-leaders-lets-build-community-stack-together/

<comment><USER2> K, so, LOVE the idea, just a couple of recommendations. First, it sounds like this is one person's idea. I'd highly recommend starting locally with your own community before posting online for development. This will allow the online call for help to come from a community. Second, by starting locally, the author will gain experience working in a collaborative and consensus driven manner. Not an easy skill to gain but one which will be invaluable for such a project. Third, there are already groups working on this. Maybe join their project, branch off of it, or reference them and comment why the author believes a new project will better serve a community. And lastly, there is no single-stack that will provide the single solution. The nature of communities requires dynamic, evolving, flexible, multiple approach solution sets. Best of luck!</comment>


Ruby.. for the most part isn't worth bothering with. [2006] - <AUTHOR> http://duckdown.blogspot.com/2006/03/large-enterprises-and-why-they-dont.html

<comment><USER2> the author should have talked to Gemstone before writing that blog post.</comment>


What Happens When Apple Passes Microsoft In Value? Yes, When. - <AUTHOR> http://techcrunch.com/2010/03/26/apple-microsoft-stock/ <comment><USER2> This comes up a lot but it always misses one aspect of this. Microsoft has returned many many billions to shareholders and continues to do so with a quarterly dividend. When they started along this dividend path they made a large special dividend payment to shareholders. This makes these kinds of comparisons very difficult and of questionable meaning. One of the reasons companies like Apple don't want to pay out a dividend is that keeping the money in the bank drives up the stock price. A business with 1 dollar in sales is worth X. A business with 1 dollar in sales and 1 dollar in the bank is worth X + 1. This simple effect makes it easier for the stock to climb and options of executives to be more valuable. It does not necessarily make the business any better especially after a certain point when there's enough money to withstand downturns. This is why market caps are a not a good way to compare businesses. You can consider things like return on assets, net profit margins etc. and see if those feel like better measures of the quality of a business. After a certain market cap, I think it's more correct to look at a business as large or large enough rather than an important measure of something.

<comment><USER3> You don't really have to pay a dividend when you're stock is rising like Apple's is on growth. It's a fairly new thing for MS to pay one too and it's only because the growth ended. Since MSFT started issuing a dividend, Apple's stock has gone up over 1000% the dividend doesn't compare.

<comment><USER4> Correct, because stocks are a thing in themselves and not something related to the actual or expected value of the company.

</comment></comment></comment><comment><USER5> What most people don't realize is that while Apple claims to be a _mobile device_ company, the truth is that Apple is really a _mobile ecosystem_ company.

 _It's the ecosystem_ which is the key! The seamless iTunes/iPod experience was built on the foundation of a workable, legal, profitable music download ecosystem. Apple then leveraged this into the iTunes/AppStore/iPhone mobile device ecosystem.

Remember the lessons of the iPod. Lots of people made mp3 players with more/better stats and features. But no one else had the ecosystem on which to base a smooth and seamless experience. (And the marketing to not only bring it to our attention, but make it hip.) Right now, lots of people are making phones that can _do more_ than the iPhone, but once again it's not the device, it's the ecosystem. And as heavy-handed as Apple may be, they're still at least twice as good as any of their rivals. The carriers are suffocating the gosling that will grow up to lay the golden eggs. Apple is feeding theirs enough so it will grow up marginally healthy. That's why they're winning.

(Palm understood this, but by trying to sync through iTunes, they put Apple in the position to sabotage their ecosystem. Bad move.)

EDIT: Suspect I am being punitively downmodded by someone whose post I criticized.

<comment><USER6> I agree - Apple has a tendency to create good devices and then services around the devices.

iPod:iTurnes iPhone:App Store

These services are great because they act as monopolies: "You want to make something for the device? You have to sell it in our store where we take a cut."

So far this has worked quite well and I imagine the returns on capital are huge.

</comment></comment><comment><USER7> Apple's elephant in the room is Steve Jobs. He's undoubtedly one of the greatest, if not _the_ greatest business leader of the twentieth century, and a lot of Apple's fortunes can directly be ascribed to him being at the helm of the company.

It's uncertain what will happen when he passes the torch along, voluntarily or otherwise. There are ongoing concerns about his health, he has had a liver transplant, he's had cancer and as Wikipedia states: _On January 14, 2009, in an internal Apple memo, Jobs wrote that in the previous week he had "learned that my health-related issues are more complex than I originally thought" and announced a six-month leave of absence until the end of June 2009 to allow him to better focus on his health._ [1]

As the Sculley period shows Apple without Steve Jobs might not do as well. He's truly one in a million, and a lot of the company's fortune has his signature on it.

[1] <http://en.wikipedia.org/wiki/Steve_Jobs#Health_concerns>

<comment><USER8> Agreed on all points. I suspect the problem is that characters such as Gates and Jobs, who are focused visionaries don't leave much room in the highest ranks for people like themselves. To put in another way, put two Steve Jobs' in one room, and only one will leave.

So the people who excel in companies like Microsoft and Apple can't be the same kind of uncompromising visionaries like Jobs and Steve, they are almost by definition the best #2 guys in the industry.

I expect that Apple will slowly turn into Ballmer-era Microsoft. Profits will climb for a while, but the new leader won't likely have the guts to attack new markets and develop revolutionary products. For if the executive did want to do those things, he would have started his own company 20 years ago.

<comment><USER9> I am not really an Apple hater or fan and the only thing I would miss if Apple went down would be Mac OS X. I know Darwin is open source but what makes Mac OS X awesome is the GUI + Darwin.

</comment></comment></comment><comment><USER10> What happens? Nothing. Absolutely nothing.

<comment><USER11> What happens to the companies themselves? Nothing.

What happens to perceptions? Probably something.

There's always mistrust of the biggest player. If Apple become's the most valuable technology company in the world, their propensity to control their stack will be even more a focus for the media.

I think Microsoft will relish being an underdog for a change: "Clearly we're not a monopoly. We're not even the biggest technology company in the world."

Even if both companies change nothing, they will be seen differently.

<comment><USER12> I'm not so sure about this -- it would only play out this way if people's perception of size were based on the company's size, rather than their exposure to the company.

For one example: one of my business clients has a couple of die-hard Mac users (who I'm happy to support), and the administrator there is one of those "bah, Macs are toys, why don't they just get a PC like everyone else?" idiots. I mentioned to him one day that Apple had enough cash in the bank to purchase Dell outright. However, this did not at all change his perception of Apple.

It doesn't help that many individuals' exposure to Apple right now is through consumer devices like the iPhone and iPod, and not so much through "serious" computers.

Oh, and also: software. I'd hazard a guess that most of my clients don't think of the stuff on their iPhone as software in the sense of "stuff that runs on a computer". I suspect that they think of it more as "features", so for them, the only Apple software that they know of is iTunes.

</comment></comment></comment><comment><USER13> Cisco held the title of "world's most valuable company" at one point during the bubble (see <http://news.cnet.com/2100-1033-238483.html> \- March 27, 2000).

That proved pretty meaningless then, as it would for Apple now.

Market cap is not a good basis upon which a company should frame its strategic planning and for the article to suggest that Microsoft may do this vis-a-vis Apple and Google renders its analysis pretty superficial.

<comment><USER14> Good point. Volkswagen did as well, during the kerfuffle with Porsche in 2008:

[http://www.autoblog.com/2008/10/28/volkswagen-temporarily- be...](http://www.autoblog.com/2008/10/28/volkswagen-temporarily-becomes- largest-company-in-the-world/)

</comment></comment><comment><USER15> Apple still has to contend with Nokia for the largest mobile computing firm slot, as far as it concerns mobile phones. Granted, Apple has the larger profit because of its iTunes/Apps ecosystem which enables the iPhone, but Nokia still has the larger sales numbers and is working hard to build its ecosytem with its new Maemo OS. I also find WinPhone 7's concept of ''hubs'' radically innovative and superior to the the apps concept. In other words, no one is sitting still...

</comment><comment><USER16> I find one thing a bit unbelievable. The author says Chrome OS is meant to kill Windows. I don't believe Chrome OS is meant to kill Windows...From what I read it is more of a new style of platform developed for Netbooks and less powerful devices. There is no way that something like that could kill Windows in my opinion. Aside from that, I really don't believe the anything happens when Apple passes Microsoft. Some of Microsoft's bigger innovations aren't out yet, such as their new Mobile 7 phones and even Project Natal, which comes out for Xbox 360 later this year and could give Microsoft a big Holiday stock push.

<comment><USER17> I would suggest reading innovators dilemma, todays "less powerful devices" can very quickly become what everyone is using tomorrow.

<comment><USER18> It's more likely that Windows, when it finally does die, won't die because of a single product like Chrome. Rather it will die slowly of a thousand cuts.

</comment></comment></comment><comment><USER19> I realized the headline "question" is just rhetorical and fashioned to be link-bait, but can't resist offering an answer of: "Nothing."

...because this is not the long-dreamed-about NCAA national football title.

It's not about titles. Or even dollar totals. Whether Apple as a country can _continue_ to offer great value to its shareholders (wish I were one) depends on its long-term business model (and ability to judge consumer tastes/desires). And they certainly _could_ potentially make some strategic missteps like any huge corporation (can you say, 'Toyota'?).

More interesting than Apple teaming up with MSFT at this point would be Apple moving into Google's turf: _search_.

What if Apple bought up DuckDuckGo and invested as much innovative energy there as it has in hard/software? It's sounding likely that they'll soon be launching iAd to compete with other online ad processes. They're already getting practice at building huge server farms (Maiden, NC).

I wouldn't rule out Ads/Search from Apple: it would just require getting ratcheted higher up on Steve's priorities.

<comment><USER5> The fact that a single person can create a Google competitor indicates this is something that Apple might _not_ want to get into.

<comment><USER20> Just because a product can be replicated by a single person doesn't make them competitive in any way. I don't think that is a valid concern.

Also, by your very argument, Google might not have wanted to get into search either. But of course, anyone would laugh at such a statement.

<comment><USER5> _Just because a product can be replicated by a single person doesn't make them competitive in any way. I don't think that is a valid concern._

It's not a concern. That was never my position. What it does tell us is that search at that level is becoming a _commodity_.

The Google ecosystem as a whole, on the other hand, is not a commodity. That is the competition Apple needs to be concerned about.

 _Also, by your very argument, Google might not have wanted to get into search either. But of course, anyone would laugh at such a statement._

Just because you weren't able to synthesize the facts into something more than a straw man, don't assume that it's not possible. Sergey and Brin were pioneers, so of course it's not commodity when they did it. I think the case is strong that it is now.</comment></comment></comment></comment>


sf code-a-thon for health tech 10k+ & prizes 9/24-9/25 - <AUTHOR> http://www.health2challenge.org/code-a-thon/

<comment><USER2> Good luck to all the teams!

</comment><comment><USER3> I'll be there!</comment>


Ask HN: Software to help with investing? - <AUTHOR>

Any pre-written platforms or open source software I can hack on, to help with investing in funds and/or shares?
I'm looking for something that pulls together past data, future predictions, market feeds, helps identify under-performing shares or sectors -- basically something that uses big data to help me make better decisions.
What's worked best for you? <comment><USER2> Quantopian has an interesting platform. I've only played with it but they do have a live trading system where you can have algos trade for you at 1min intervals. I forget what the max runtime is per iteration but (I'm pretty sure) you can call outside services so you could set up a private server to do analysis and mix the information to achieve more computation per iteration.

<comment><USER3> If you're specifically interested in hacking on open source software in the financial/algo trading space, Quantopian also maintains Zipline, which is an open source backtesting/financial simulation library. We'd love to get pull requests and/or feedback. You can find the source on Github here: [https://github.com/quantopian/zipline](https://github.com/quantopian/zipline)

Disclaimer: I work for Quantopian and I'm a Zipline maintainer.

<comment><USER2> Sorry for the delayed reply. I'll take a look! I've been meaning to play with Quantopian more but have just been in permanent crunch mode lately for work.</comment></comment></comment>


Economics Simulation - <AUTHOR> http://nbviewer.jupyter.org/url/norvig.com/ipython/Economics.ipynb <comment><USER2> Previously discussed: [https://news.ycombinator.com/item?id=10962026](https://news.ycombinator.com/item?id=10962026)

</comment><comment><USER3> This is awesome. Any other such simulations for economic phenomenons?</comment>


Chrome/Firefox aren't checking CA revocation lists - <AUTHOR>

Chrome isn't checking revocation lists anymore (source: https://www.imperialviolet.org/2012/02/05/crlsets.html) so for everyone reissuing keys today, their sites are still vulnerable for Chrome users, right?
I checked Google's own (custom) CRL and they don't have any serials from Comodo or Verisign's revocation lists, but they do have some from GoDaddy. Verified with https://github.com/agl/crlset-tools.
Update: Added Firefox to title based on mbrubeck's findings. <comment><USER2> In order to attack an HTTPS connection, the attacker has to have MITM position against the victim: the ability to intercept TCP connections.

Such an attacker can obviously also block the CRL/OCSP lookup if one is made. Even with revocation checking enabled, no browser that I know of will fail a TLS handshake if the revocation check is blocked.

(You can configure Firefox to do this. Tools -> Options -> Advanced -> Encryption -> Validation, check the box for "When an OCSP server connection fails, treat the certificate as invalid" \- so says [https://wiki.mozilla.org/CA:OCSP-HardFail](https://wiki.mozilla.org/CA:OCSP- HardFail))

I claim that soft-fail revocation checking is basically nonsense. That's the point that I'm making in [https://www.imperialviolet.org/2012/02/05/crlsets.html](https://www.imperialviolet.org/2012/02/05/crlsets.html).

Making it hard-fail isn't viable: it makes OCSP servers a single point of failure for huge parts of the web. That's why Chrome has a CRLSet system that actually can achieve real goals. The attacker has to persistently MITM the client in order to block the CRLSet update.

The CRLSet is limited in size. I had hoped that CAs would use the reason code mechanism in CRLs to remove the "administrative" revocations that dominate their CRLs. (Those are revocations where there's no suggestion of compromise.) Some do, but most don't.

It's not true that the CRLSet doesn't include any Comodo or Symantec (who now own Verisign's old CA business) CRLs. In fact, Symantec/Verisign CRLs are the biggest contributor to the CRLSet.

But it's true that the CRLSet is limited in size. We focus on CRLs for CA and EV certificates. I don't think the world has a great answer to the revocation problem when certificates are valid longer and longer periods.

<comment><USER3> Would it be feasible to make OCSP errors abort the TLS connection if it only applied to sites that have requested HSTS?

<comment><USER2> We did this by mistake once and got bug reports about PayPal being flakey. (PayPal was an early HSTS adopter.)

<comment><AUTHOR> Understandable, admins would just have to start treating OCSP like they do DNS (if it fails you can't visit site).

<comment><USER3> A thought: given that admins already have something that they treat like DNS-- which is to say, DNS--could certificate revocations be distributed as DNS TXT records, and thus reuse all the caching infrastructure DNS currently implies?

<comment><USER4> I think this would be a good approach on many levels.

It appears there is already an (expired?) internet draft for this: [https://datatracker.ietf.org/doc/draft-pala-rea-ocsp-over- dn...](https://datatracker.ietf.org/doc/draft-pala-rea-ocsp-over-dns/) [http://tools.ietf.org/html/draft-pala-rea-ocsp-over- dns-00](http://tools.ietf.org/html/draft-pala-rea-ocsp-over-dns-00)

But i could not find any browser support or even plugins.

I guess all current development is behind DANE and/or multi-OCSP-stapling; second one has some chance of being deployed soon.

[https://bugzilla.mozilla.org/show_bug.cgi?id=611836](https://bugzilla.mozilla.org/show_bug.cgi?id=611836) [https://datatracker.ietf.org/doc/rfc6961/](https://datatracker.ietf.org/doc/rfc6961/)

\--igor

</comment></comment></comment></comment></comment></comment><comment><USER5> Current versions of Firefox also do not use CRL, if I understand correctly. It seems most modern browsers prefer OCSP instead, with CRL only as a fallback or not at all. You can find some of the rationale at these links:

[https://mail.mozilla.org/pipermail/firefox- dev/2013-April/00...](https://mail.mozilla.org/pipermail/firefox- dev/2013-April/000329.html)

[https://mail.mozilla.org/pipermail/firefox- dev/2013-May/0003...](https://mail.mozilla.org/pipermail/firefox- dev/2013-May/000334.html)

[https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...](https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol)

[https://wiki.mozilla.org/CA:ImprovingRevocation](https://wiki.mozilla.org/CA:ImprovingRevocation)

<comment><AUTHOR> From my understanding of the source I posted they're removing OCSP support as well: "There are two protocols/formats involved: OCSP and CRL, although the differences aren't relevant here."

</comment></comment><comment><USER6> I'm hoping to see a chrome extension that flags every certificate issued before 2014/04/07 as insecure. In the meantime, I am switching to firefox to use certificate patrol for anything I care about.

<comment><USER7> Who are you and what did you do with the real joeyh? The real joeyh hopes for a chromium extension and switches to iceweasel in the interim.

</comment></comment><comment><USER8> [https://code.google.com/p/chromium/issues/detail?id=361230](https://code.google.com/p/chromium/issues/detail?id=361230)

<comment><USER8> The Chromium team seems to have an all-or-nothing policy when it comes to security. c.f. [https://code.google.com/p/chromium/issues/detail?id=53](https://code.google.com/p/chromium/issues/detail?id=53)

<comment><AUTHOR> For that bug at least they're now forcing the OS login before looking at the passwords in the Settings page. Not perfect but something.

</comment></comment></comment><comment><USER9> Yes it does. It's just not enabled by default.

<comment><AUTHOR> How many people are going to check that box under "Advanced Settings"? 0.1%?

<comment><USER10> Unlikely to be that high. The 0.1% that may dig in those advanced settings is likely the same 0.1% that disabled the thing back when it was enabled by default. CRLs are worthless.

<comment><USER11> How are they worthless?

<comment><USER12> They're worthless because clearly no one is using them. They may theoretically be useful, but it doesn't matter if they're never put into practice.

<comment><USER11> Do you mean nobody on the CA side or the end user side? CA's suspend certificates all the time - instant e the scam site had theirs pulled a few weeks ago...</comment></comment></comment></comment></comment></comment>