Goodbye to GNU Libreboot - <AUTHOR> http://lists.gnu.org/archive/html/info-gnu/2017-01/msg00001.html <comment><USER2> E-drama aside, this is probably for the better, given the following:

\- The developer has sole commit rights against the repo and hence no further would could be done on it without forking.

\- The developer's continued trashing of the FSF poisoned the well for any number of people who might have wanted to work on Libreboot, GNU-version or otherwise. The fact is, no one wants to be part of a "contentious" fork.

It's a pity that it came to this, because I think the project would likely have received much more support as a GNU package. On the other hand, the lead developer made it very clear that she no longer wished for it to be a GNU package, and she seems to have devoted considerable time and resources (monetary included) to the project.

So it goes. I say good on Stallman for not using the GNU's muscle to maintain ownership of the project.

<comment><USER3> _she seems to have devoted considerable time and resources (monetary included) to the project._

For a bit more context: Her full-time job is Minifree, a company she founded that sells computers with Libreboot pre-installed. Minifree has then contracted other developers to work on support for more hardware.

<comment><USER4> Well reading the front page it seems to mee that all they do is to _deblob_ coreboot and combine it with GRUB and another package.

<comment><USER5> Libreboot also disables Intel ME and other such unwanted gubbins, which Coreboot doesn't do (or doesn't expose a means to configure it to do so).

</comment></comment></comment></comment><comment><USER4> This is from [http://lists.gnu.org/archive/html/libreboot/2016-09/msg00036...](http://lists.gnu.org/archive/html/libreboot/2016-09/msg00036.html)

 _LR > I'm declaring here and now to the whole world that Libreboot is no longer LR> part of the GNU project. I do not believe that the FSF or the GNU project LR> deserve to exist._

Mistakes are everywhere and are done by everybody. A mistake was done by some people in FSF, the reaction is exaggerated to say the least. Furthermore, it's not clear whether or not the fired person was fired for being a trans. In fact in an email in the thread Stallman says:

 _The dismissal of the staff person was not because of her gender. Her gender now is the same as it was when we hired her. It was not an issue then, and it is not an issue now._

Whatever the case is, even though I know null about the project, I can easily say that Leah Rowe, whoever she might be, is apparently toxic for the project. Hopefully, given that it's free software, the other maintainers can get rid of her.

<comment><USER6> It's very difficult to classify people by e-mails. I worked with so many people who were very nice to me. We'd discuss requirements. I'd even type up timelines and e-mail them docs.

Next day, a thread with every manager in the planet saying our team was stonewalling everything, being unhelpful, etc. etc.

My boss would come up to my cube and say, "Stop e-mailing these people! Why are you e-mailing them? Pick up the phone and call them!"

I hate to rush judgement, but looking at the statements that are out, I am really unhappy with her approach, her statements and her totalism. Just because you don't agree with a policy doesn't mean the FSF shouldn't exist. Pulling your project feels reactionary.

I'm guilty of reactionary anger too. I'm human, we're all human. We feel like we've been wronged often by our neighbours or our landlords or police. This might have just been a bad week for her and some rushed decision making. But if she's always like this and doesn't learn from it, then she'll find herself alone in other communities in the future.

Just a side note, there was a good video by School of Life on anger. I don't actually agree with all of it. Their premise is weird, but it would actually put her reaction to the FSF in a different light:

[https://www.youtube.com/watch?v=coiCkmcKjX8](https://www.youtube.com/watch?v=coiCkmcKjX8)

<comment><USER7> In one of her latter posts she confesses that the person who was fired was a close friend of hers. So I think this is a case of her being too close to the subject matter to be objective. In fact I think she came to realise this herself but not until it was too late for her and the project:

[https://libreboot.org/gnu/#leah-not-a-hero](https://libreboot.org/gnu/#leah- not-a-hero)

<comment><USER4> Well that does not justify any of this trouble she caused, indeed, it only makes it worse. Even the fired person herself has finished their frienship with her.

<comment><USER7> I wasn't justifying her actions but at the end of the day witch hunts like this happen all too frequently online. It's way to easy for people to overreact and to a wider audience than ever before. The smart thing we can do as 3rd party observers is just ignore the fighting rather than participating in the outrage. Let the offended individuals vent and then let the argument disappear into obscurity. The alternative is escalation and we've seen how badly that can turn out (remember the grim Adria Richards Python conference saga which resulting in multiple job terminations and threats of sexual assault and death?).

</comment></comment></comment></comment></comment><comment><USER8> Context: [https://www.reddit.com/r/linux/comments/54agii/richard_stall...](https://www.reddit.com/r/linux/comments/54agii/richard_stallman_and_gnu_refused_to_let_libreboot/d80ifar/)

Original email that sparked the controversy: [http://lists.gnu.org/archive/html/libreboot/2016-09/msg00036...](http://lists.gnu.org/archive/html/libreboot/2016-09/msg00036.html)

<comment><USER9> Is the reddit user "BaronHK" the same person who posted [http://zammit.org/libreboot-screwup.html](http://zammit.org/libreboot- screwup.html) or just someone quoting it? My sense is he's the latter, but I'm not 100% sure.

In any case, the zammit.org statement _sounds_ like it's a more believable reflection of the libreboot community. All the libreboot.org stuff reads too much like one perhaps-toxic person getting up on a soapbox.

<comment><USER10> > one perhaps-toxic person getting up on a soapbox.

Quite possible, and sadly seems to be happening more and more within the FOSS world.

</comment></comment></comment><comment><USER11> Looking at how one-sided the discussion here but especially on reddit is should be worrying.

Not saying it's the case, we all don't know, but if the accusations are right, it's absolutely reasonable to not want to work with these people. You can say all you want about being professional and not having politics influence your technical decisions, but that's easy to say if it's not your life style choices that are discriminated against.

<comment><USER10> The only person that can set the record straight, the person that was let go by the FSF, have been silent the whole time.

<comment><USER12> It seems the person would rather not be part of the drama. Leah was having a heated argument with this person. As a way to get back/appease (??) to this person, Leah blew up on FSF, against the wish of that person.

[https://libreboot.org/gnu/#leah-not-a-hero](https://libreboot.org/gnu/#leah- not-a-hero)

<comment><USER10> Dear deity...

</comment></comment></comment></comment><comment><USER13> These situations are awkward because any other resolution would've made GNU look like an aggressor. This response acknowledges that GNU isn't a fan of the maintainer's choice, but all other outcomes are sub-par, and they don't want to fork or engage this topic further. The maintainer wins by default.

</comment><comment><USER14> All due respect for Leah Rowe and her work on libreboot, but this kind of drama only hurts the OpenSource (regardless of the name you like to use) initiative.

Stallman did the right thing I guess.

<comment><USER15> I don't think it's fair to lay the blame for the drama at her feet. The FSF could have handled this more professionally from the beginning.

<comment><USER16> What are you talking about? FSF handled it 100% examplary from the get go.

Leah Rowe however was the toxic and crazy drama queen who couldn't keep a civil tone, and even her initial email included the word "fuck".

To top it off, she had zero proof for her allegations, and the person she claimed to represent specifically didn't want her to raise those allegations in her name.

In the rest of the world, we refer that as slander and libel. She should be happy nobody bothered to sue her. On either end.

Given Leah's behavior, I cannot see how on earth the FSF could have acted more level headed, reasonable and professional.

Seriously... what did they not do right?

<comment><USER17> I don't have much to add to this discussion... but historically the FOSS community loves sharing Linus' nastygrams... I find people having a problem with this developer's tone somewhat sexist and irrelevant.

</comment></comment></comment></comment><comment><USER15> Seems like a good call by rms to drop the matter instead of insisting on a permanent feud over a project that GNU is apparently not very interested in.

</comment><comment><USER18> I'm aware of the original problem and was reading before about it and even if this was all handled very badly publicly by some sides at least I read this email and all that is there is perfectly reasonable, is written in a good tone and leads to an acceptable conclusion. Stallman did what he could with this decision to stop the e-drama. I'm all happier for it.

Afterwards I read the comments here, people saying that Minifree is actually her job, which I find amazing because it provides things I care about and I want to see it growing up.

Finnaly I clicked on the link someone posted - [https://libreboot.org/gnu/#leah-not-a-hero](https://libreboot.org/gnu/#leah- not-a-hero) \- and got surprised and kinda annoyed ( I may even say it pissed me off, when usually nothing I read on the interwebs provokes those kind of feelings in me ) by the fixed overlay currently there on the page:

"It took the GNU project 4 months to finally honour Libreboot's decisions, but on 5 January 2017, RMS formally acknowledged it - his reasoning is flawed. They should have immediately honoured Libreboot's decision to leave GNU, but instead they arrogantly resisted it for months, and the only reason they gave up was because they realized that all of Libreboot's core developers were OK with leaving GNU and still preferred to work with Leah Rowe. This page explains why no project should ever join GNU."

This is just so bad and putting more wood to the fire for no reason at all than e-drama. I was hoping people were a little more grown up, but as usual I got disappointed.

</comment><comment><USER19> My hope is that the project continues irrespective of its relationship to other organizations. It's pretty damn important.

<comment><USER8> I don't necessarily agree. Coreboot is important. Libreboot is nice to have.

<comment><USER9> Is that because there is very little original development occurring in Libreboot (it's my understanding that it's basically Coreboot with some binary blobs removed but not actually replaced).

<comment><USER3> Libreboot and other projects with a similar relationship to upstream suffer from a paradox: It appears that no original development is happening there, because all of the original development is sent upstream. The work done by developers hired to work on Libreboot looks like work done on Coreboot, because Libreboot cooperates with Coreboot and sends their work upstream.

</comment></comment></comment></comment><comment><USER20> TL;DR

Quote: "Reasons: (1) it had not been a GNU package for very long, (2) she was the developer who had originally made it a GNU package, and (3) there were no major developers who wanted to continue developing Libreboot under GNU auspices."

</comment><comment><USER21> Sounds like half the story.

The libreboot website says that they left GNU to protest transgender discrimination at the FSF.[0]

[0] [https://libreboot.org/](https://libreboot.org/)

<comment><USER22> more near a 10th of the story

Neither side wants to put up any substantial verifiable information about it, so there is nothing to talk about on that front.

<comment><USER23> Not sure why this has been downvoted. Neither party in the firing dispute with FSF has gone public, so drawing any conclusions based on the minimal amount of information we have right now is not wise.

</comment></comment></comment><comment><USER24> Having seen a number of 'libre' projects disappear or radically change management (sometimes under unlitigated accusations of harassment or misconduct), I hope that important projects to the freedom of computer use continue to exist.

Recently TrueCrypt has disappeared, TOR got new management (a bunch of suits), etc.

Personal spats aside, these projects are bigger than the organizations and people who sacrifice so much to contribute to them.

I might recommend to the FSF and GNU that these sorts of projects need to be given special attention with regard to their continued existence, the happiness and healthiness of the contributors, the transparency of internal activities, and the thwarting of intelligence/infiltration activity.

The continued, healthy existence of free software depends not only on the code but on the institutions and the people who provide, advertise, decide and distribute that code.

</comment><comment><USER25> So, is there any truth to the accusations of discrimination and harassment over at FSF?

Either way this kind of drama would seem par for the course for people who view software development through political and philosophical lenses, but from a practical perspective it makes her mic drop seem a lot more noble if she's right.

<comment><USER26> >Either way this kind of drama would seem par for the course for people who view software development through political and philosophical lenses

If you are a software developer and don't think about the social impact of what you do then you're being irresponsible.

<comment><USER27> You can even generalize that statement to "If you don't think about the social impact of what you do then you're being irresponsible."

<comment><USER28> You can further generalize it to "If you don't think then you're not being responsible."

</comment></comment></comment></comment><comment><USER29> Finally some resolution to this e-drama!

</comment><comment><USER30> Personally I think the FSF ideology taken too far is pretty ridiculous anyway.

</comment><comment><USER31> (off topic) Since the transgender topic was mentioned, I just was curious what Audrey Tang has been up to lately:

[http://www.taipeitimes.com/News/taiwan/archives/2016/08/28/2...](http://www.taipeitimes.com/News/taiwan/archives/2016/08/28/2003654031)

She's the Digital Minister of Taiwan now. Well deserved.

</comment><comment><USER32> > Skype: No way! See stallman.org/skype.html.

I always get a chuckle out of his soap boxing. He's not wrong, just amusing.

</comment><comment><USER33> The attitude that comes across in this message... this is the problem with GNU and that whole sector of the OSS community that seems to follow the 'Stallman' way.

"you aren't allowed your freedom because <incomprehensible jibberish>" from people who advocate software freedom is a total headfuck

<comment><AUTHOR> What freedom is being withheld by the FSF in this message? They're granting the maintainer's wishes to a T. The maintainer even explicitly requested that the FSF make a public announcement about it.

<comment><USER33> its the tone and attitude, not the literal interpretation of the statement nor what has happened. 'once your project is under the GNU aegis its there for life' \- its fair enough to make that decision, but the result here is not respecting the ideal that very many people have about having a freedom to do what you want with 'your stuff', and what constitutes 'your stuff'

if you don't particularly care for ideals of ownership or materialism then this isn't so objectionable. it makes a lot of sense, because then you don't even see the project as 'yours' and doing so is obviously counter to the ideals of the GNU project and FSF.

however, the sad practical reality of the world is that most people care a great deal about these kinds of things - its a part of why there is so much proprietary software, and also why many places i have worked forbid GPL dependencies, often in a list of "free software licenses we can't allow in dependencies" along with some statement about why - which is usually about how its 'infectious' nature means that it can't be used without forcing other parts of a product to be made into GPL software - an unacceptable price to pay, because the freedom to keep things private is considered as being so valuable.

"you can use our free (as in speech, not beer) software freely, but provided that you sacrifice your freedom of ownership on your own software"

this is another one of those kinds of statements i generalised as with "you aren't allowed your freedom because <incomprehensible jibberish>"

i don't think its a big leap to consider that sort of statement mind boggling from a philosophical standpoint - you want to advocate freedom with something that curtails freedom?

its the same principle with the idea that GNU projects are somehow owned by GNU, and that this is irreversible. again, its trying to advocate the philosophy by doing something that is counter to it.

now, i don't consider the maintainer in this case to be in the right. they should have been aware that this is the nature of GNU projects. i also consider her attitude to be so far out of touch with reality and overly-self- entitled that it is a little disturbing... but back to the point, i don't roll in these circles and even i am aware of this philosophy for GNU projects... but aside from that leah should have learned what her decision would mean before making it.</comment></comment></comment>


Looking Back at WWDC 97 - <AUTHOR> http://bslabs.net/2017/06/01/wwdc-1997/ <comment><USER2> Apple invited me to present at WWDC97 as a young independent developer with a startup making software for "webmasters" on the Apple internet platform; "What cool sites use" according to Apple's marketing back then. Little did I know what a turning point it would be for Apple, although I had already placed my eggs firmly placed in their basket.

I got to demo my Common Lisp based social web application server and showcase how to extend it with dynamic, hot-loaded components. Apple said I could talk about pretty much whatever I wanted within the scope of the conference, so I included an introduction to how it used what I labeled Light Weight SGML, soon better known as XML.

It was a blast from the past seeing my presentation again 20 years later. I had prepared the slides to be displayed in a web browser, generated from extensible markup using my WebSlides tool, but my handler at Apple insisted on converting them to PowerPoint. They weren't all sold on the web eating the world yet.

Despite having a complementary ticket for the conference, I had no time to stick around, flying straight back home the day after to prepare the next product release. The following years were quite a ride, like having a tiger by the tail. Then came 2001.

<comment><AUTHOR> Very cool! You're the last one here? [http://s3.bslabs.net/wwdc/1997/401%20Web%20Server%20Programm...](http://s3.bslabs.net/wwdc/1997/401%20Web%20Server%20Programming.pdf)

<comment><USER2> Correct, that's me attempting to spread the gospel of Common Lisp web server programming to what seemed like an endless mass of Apple developers at WWDC 97.

</comment></comment></comment><comment><USER3> I found this one [0] particularly interesting :

\- speech recognition as input

\- support for Microsoft devices

\- Marathon game engine details

[0] [http://s3.bslabs.net/wwdc/1997/107%20Game%20Sprockets.pdf](http://s3.bslabs.net/wwdc/1997/107%20Game%20Sprockets.pdf)

<comment><USER4> Game Sprockets were a neat concept for the time -- bundle a bunch of useful tools for building games into a set of standard system libraries. A response of sorts to ActiveX. Perhaps my favorite feature was the standardized control remapping interface -- many games were still rolling their own user interfaces for this, or simply not allowing controls to be remapped.

Unfortunately, not very many games ended up using Sprockets. (And the framework never made into Mac OS X at all.) Shame.

</comment></comment><comment><USER5> I didn't go to this one, but I was at the 96 WWDC. I remember all the shocked faces in the audience when Apple couldn't demo all the System 8 features in one build, and the weakened memory protection to be almost useless. There was a realisation that Apple's software story was bogus and they couldn't build a modern OS.

The purchase of Next was an acknowledgment of this. It's amazing how it turned out.

</comment><comment><USER6> Always interesting to read about Apple in the 90s. As someone who was born in the late 80s and by no means could afford Apple until after my secondary education, I grew up a Windows guy. I'm somewhat of a diehard Linux/Apple guy now but it's great to see the parallels of then and now...a lot of distrust of Apple these days but I knew nothing of it at the time(back then).

</comment><comment><USER7> Interesting to see Craig Federighi as a presenter, since he left Apple in 1999 and did not return until 10 years later.

</comment><comment><USER8> I stopped going to the WWDC almost a decade prior to this.

<comment><USER8> Don't understand the downvotes. The 1989 WWDC was the best one ever, they announced System 7, how could I ever top that?

And I even participated in a panel and gave a speech!

It would have been all downhill from there for me.</comment></comment>


Dunbar's Number - <AUTHOR> https://en.wikipedia.org/wiki/Dunbar%27s_number <comment><USER2> were you reading the tipping point?

<comment><AUTHOR> No, but in Googling it, it looks like a very interesting book...

[https://en.m.wikipedia.org/wiki/The_Tipping_Point](https://en.m.wikipedia.org/wiki/The_Tipping_Point)

Dunbar's Number (approximately 150), on the other hand, is (apparently) the approximate maximum number of people in a given group -- before formalized rules are needed for behaviors of individuals in that group.

Applied to Law... you might think of it as societies of less than 150 people -- require no laws, but when you reach that 150 person threshold, then you start needing laws...

It would be an interesting sociological experiment to begin with a desert island, add people to it, one by one, and then figure out when/where/why the first laws are created...

My guess (and it is only a guess), is that those first laws would be related to the concept of property, specifically land-use rights...

I'm guessing that this would vary relative to the size of the island and to the number of people on it... that is, with enough land per person, no one would care, but once land gets scarcer (relative to population) those laws would spring into existence...

All of that is theoretical, of course. Without the ability to try the experiment on several islands of varying sizes, I wouldn't know...</comment></comment>


Google display ads go 100% HTML5, Flash banned Jan 2 2017. - <AUTHOR> https://plus.google.com/+GoogleAds/posts/dYSJRrrgNjk <comment><AUTHOR> Interesting Flash video isn't affected yet. Waiting for HTML5 EME (ie DRM) to become more widespread?</comment>


Police Body Cameras: What Do You See? - <AUTHOR> http://www.nytimes.com/interactive/2016/04/01/us/police-bodycam-video.html <comment><USER2> > Not exactly a fight, is it? We silenced the pounding dance music, but you > get the idea.

Yes, I do. You intended to obscure relevant information to purposefully misconstrue or obfuscate the event.

The point of the cameras is that they are _additive_. That video, even without audio, as an addition to a statement that says something to the effect of "we danced with each other" would be viewed in an entirely different context. If it was in addition to one party stating "we never got close to each other" then it means something else.

In the end, it's additional information. If you have no information about the event whatsoever from the parties involved, just some footage without sound, then you have much larger problems.

<comment><USER3> One of the author's here — you're nailing the exact point that we were trying to emphasize. In real cases, we often have incomplete or obscuring documentation, and draw conclusions from that. The addition of another perspective can radically change our perception of an encounter. Granted, it's artificial to the point of absurdity in this case, but the point is made.

<comment><USER4> Reasonable person standard. A civilian does not typically get that close to a police. If I got that close to a traffic cop, I would probably be in jail.

<comment><USER5> A few things:

...do you live in the US?

> A civilian...

Police _are_ civilians. Some people see this as hair-splitting, but it's a _very_ important distinction.

> If I got that close to a traffic cop, I would probably be in jail.

In the US, if you're jailed _just_ for being in close proximity to a police officer, then you've been jailed illegally. (If, however, you refuse to give the guy some room when he asks for it, then you _can_ be detained and ( _maybe_ ) jailed.)

<comment><USER6> > Police are civilians ... it's a very important distinction.

The misuse of the word is a symptom of the real problem, it is deeply ingrained in police culture that they are fundamentally different. I think it was one of Dave Grossman's books, an author that enjoys a military and LEO following, that put forward the idea that they are sheepdogs - protecting the flock from the wolves. So that is a big problem, as the idea has gotten picked up in popular culture.

I don't really mind cops insisting that they aren't civilians, because I agree with them to a point - the root word doesn't seem to apply anymore. That is unlikely to change without a major overhaul in the standard escalation of force model, where the officer is taught to control a situation by being one level of force above everybody else - making them aggressors by default.

<comment><USER5> > The misuse of the word is a symptom of the real problem...

Agreed.

> I don't really mind cops insisting that they aren't civilians...

 _I_ do. ;) Because...

> [Police use as a] standard [situation control mechanism the] escalation of > force model, where the officer is taught to control a situation by being one > level of force above everybody else - making them aggressors by default.

 _Military_ police use _de-escalation_ of force by default when interacting with non-combatants. It is _drilled_ and _drilled_ and _drilled_ into their heads that the very _fact_ that they are armed and/or armored _automatically_ escalates the situation, so they _MUST_ _continuously_ work to de-escalate the situation from the _microsecond_ that they arrive on the scene.

Civilian police would be _so_ much more competent and _so_ much more reasonable if they had the same training that actual _military_ personnel receive.

<comment><USER6> The only difference between what I said and what you said is that you've added that MP training emphasizes deescalation. Both MPs and civilian police observe the same force continuum, but it seems to me that MPs are simply more disciplined. I don't think it is realistic to try and bring regular cops up to that standard of discipline, it would be much easier to simply provide a less flexible justification for violence. Many years ago when I was in USMC security force I remember being trained on actions that nudge the escalation of force - which was likely the first time I heard the phrase "furtive movement". While I'd seen a fair amount force applied subsequent to that period of instruction, I never heard that justification used. It seems to be the go to justification outside of the military.

My point is that giving cops the latitude that the escalation of force provides is like giving the CEO's 15 year old nephew the commit bit and letting him write safety critical software in non-MISRA C.

<comment><USER7> _I don 't think it is realistic to try and bring regular cops up to that standard of discipline_

Why is that? I can understand if you think there's a practical problem with doing so (but would still lament that), but I think that ideally "regular cops" should absolutely be held up to that same standard. I mean, look... these people are literally given life-and-death responsibility over the general populace. They should be held to a _ridiculously_ high standard.

<comment><USER6> > Why is that?

It is a practical problem. The military has an extremely long institutional memory and has perfected the process of mental conditioning over hundreds of years, to the point where 18 year olds can be given the power to kill and dropped into situations with little to no supervision - and it generally doesn't result in an x-rated version of Lord of the Flies. The methods that the military uses to accomplish this would not work for police without a costly tear down and slow rebuild. The list of methods is far too long to list here, but they include a culture of self policing enabled by a meaningful shared experience (basic redefinition of family), and a mythology that requires a carefully managed narrative of history (Gen MacArthur's farewell address at West Point is full of examples).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> They don't mention what I think is the biggest benefit of body cameras - deterring bad behavior (by police and civilians).

When the Orlando, FL police department did a 12-month trial with body cameras:

 _In the 12 months from March 2014 through February 2015, use-of-force incidents — also known as "response to resistance" incidents — dropped 53 percent among officers with the cameras. Civilian complaints against those officers also saw a 65 percent decline._ ([http://www.huffingtonpost.com/entry/police-body-camera- study...](http://www.huffingtonpost.com/entry/police-body-camera- study_us_561d2ea1e4b028dd7ea53a56))

<comment><USER9> Exactly. What is the point of NYTimes running this kind of piece, except to court favor with police unions.

It only serves to cloud the issue, by encouraging people to forget that bodycam video and dashcam video are strictly additive evidence.

A preponderance of the evidence shows that police will do anything they can to suppress information that makes them accountable. Hence dashcam audio that gets disabled, nearby security camera footage that gets deleted, and so on.

Maybe NYTimes is just afraid that they will alienate the police unions if they state the truth: that all law enforcement and the general public alike are protected and constrained by low-cost video recording.

<comment><USER10> > Hence dashcam audio that gets disabled

"Chicago Police Department officers stashed microphones in their squad car glove boxes. They pulled out batteries. Microphone antennas got busted or went missing. And sometimes, dashcam systems didn't have any microphones at all" [https://www.dnainfo.com/chicago/20160127/archer- heights/what...](https://www.dnainfo.com/chicago/20160127/archer- heights/whats-behind-no-sound-syndrome-on-chicago-police-dashcams)

</comment></comment></comment><comment><USER11> While cameras will never be the whole story, it does not hurt to have an additional piece of evidence. Something I noticed while watching the videos was that the wearer of the camera did not even have it properly strapped down, so it was flapping all over the place attached to a t-shirt making the video even worse (which is what the makers of these videos wanted). I think if the camera was properly secured to a normal police uniform or vest it would be much clearer what is going on.

<comment><USER12> I appreciate your comment, but couldn't it also be the intent of the police officers wearing the camera _not_ to secure it, because shitty footage is sort of more the desired effect than an unintended consequence?

I took this video as being an investigation of that very possibility.

<comment><USER7> Possible, but the intent of the article seems to be to cast doubt on the value of body cam footage as a matter of its inherent limitations. Police intentionally not securing the camera to their body properly wouldn't be in service of that.

</comment></comment></comment><comment><USER13> To me, this article proved that body-camera evidence is extremely valuable, you just have to be methodical when interpreting it. I watched the videos carefully, frame-by-frame, and only made one error (I didn't identify the taser in one of the videos). Re-watching that video while knowing what I was looking for (as I would if comparing testimonies), it was easy to see that was what had happened. I see how someone who wasn't really thinking about it would be fooled, but if you think about what the videos show, they're excellent data.

In the first one - the camera was bouncing around a lot, and the main question was whether the guy was punching the guy wearing the camera. I looked at the angle his arms were at in still frames, and concluded that they couldn't be punches. The same works for both angles of the traffic stop video: you have to pause and think through some geometry, but you can figure out that the officer and suspect don't touch with reasonably high confidence.

</comment><comment><USER14> I'm not sure what the stats are supposed to show, but I suspect they live updated stats don't quite prove the bias the author was intending to show.

At the time I'm writing this, both the majority of those who trust and those who distrust the police saw the situations as non-threatening. The difference between the groups is about 9% points, but that is hardly the kind of difference you'd expect from how it is phrased.

That said, the point of body cameras is to help prove or disprove claims by those involved in an incident about what happened. The use of the tazer is not directly visible but even in the shaky body cam you can see the officer grabbing the tazer and hear a distinctive clicking noise as the suspect falls to the ground. It doesn't fully refute the claim that the suspect is reaching for the gun, but as far as the hands are visible, it certainly doesn't support the claim either (and the cop's aggressive behaviour while the suspect is standing still certainly makes the claim more dubious).

It's also important to realize that when these are treated as evidence they won't just be shown once. They will be scrutinized frame by frame, repeatedly, down to the individual pixels if necessary.

There is no perfect evidence. Even crystal-clear, unobscured video footage of a crime doesn't tell the whole story. But court cases are not about proving what happened -- they're about merely eliminating all reasonable doubt about whether a suspect did commit the punishable crime they are charged with.

As with all "facts" in life, court cases only deal with degrees of probability. You don't have to _know_ because you _can 't_ actually know.

<comment><USER3> Yeah, have to admit — we really had no idea what the spread would be. In some ways, it's surprising that there's much of a difference at all—or perhaps gratifying.

A point of clarification for the curious—the majority of both groups actually found the situations threatening. The 'serious' threat percentages in the larger numbers, is confined only to the those who chose 'Very threatening' in the questions.

From what you've observed, it sounds like we should revisit that choice (earlier drafts displayed 'Somewhat threatening' and 'Very threatening' choices grouped together, in which case a strong majority of both people who trusted and distrusted the police, found the situations threatening.)

</comment></comment><comment><USER15> You mean showing a couple seconds of a clip without any sound or context is how these cameras are going to be used?

<comment><USER16> Yeah that's exactly what I thought. The guys dancing at the top of the article was a 3 second clip. You don't see the lead up or hear the sound, how are you meant to judge from that

<comment><USER17> The scary part in that is the line of what is admissable in a courtroom; what if a jury is provided the same video without the surrounding context?

<comment><USER18> The defendant's lawyer would say "this is footage of the officer dancing with my client" and context magically appears in the courtroom. But now we have to wonder why anybody is in a courtroom with a jury at all, if that's what the footage actually shows.

</comment></comment></comment></comment><comment><USER19> _It showed that the suspect fell because the officer shot him with a taser.

These details were not captured by the police body camera, though, revealing another important point: Body cameras prioritize the officer's point of view._

The tazer, including the officer aiming, was clearly visible and it causing the fall was very obvious from the body camera.

Same with the other videos. You don't even need software to analyze frame by frame, the web player is enough to see what is going on.

Cameras protect the innocent because they do not lie.

</comment><comment><USER20> Anybody else watched the video and thought they were dancing? It occurred to me but then I dismissed it because it seemed so disingenuous to use that as an example of the footage being unclear.

<comment><USER21> Yes. But I didn't see it as disingenuous, I simply saw it as a test of determining the action that was occurring.

The point of the article seemed to me to be about whether you can reconstruct the true narrative of a situation from fragmented and incomplete data. So It seemed valid to me to use any scenario to test that ability, dancing included.

</comment></comment><comment><USER22> This article misses the point. The benefit of body cameras isn't for the gray areas, the benefit is to remove the egregious (on both sides) edge cases.

</comment><comment><USER23> The point of the body cam isn't to provide an all seeing narrative it's to increase the chance that if any party does anything flagrantly unreasonable it'll likely get caught on camera.

</comment><comment><USER24> Two things:

1\. Police purposely buy and insist on camera models that have very limited vision, range and abilities because they want it to be as bad or worse than a cop's limited observation ability

2\. Police have learned a new trick - they do not legally have to release the camera footage at all - it is essentially for their own purposes only - so if it helps them, they release it - if it works against them, they don't release it and nothing you can do about it

If we want to change this, the same lawmakers that give police millions of tax dollars for cameras needs to set higher standards, better cameras and full release of videos to all involved parties in a very timely manner or face criminal penalties of their own.

</comment><comment><USER25> i had a reasonable interpretation of the videos, not 100% i missed the taz, thought he just stumbled, but other than that i thought it was relatively useful to see those body camera shots.

<comment><USER26> I had to watch each video twice before answering. And if I hadn't been given the possibilities in a multiple choice format, I may have gotten something wrong.

I found the car stop the most threatening for the officer. Seriously, if you're stopped by the cops, hands on top of the steering wheel... reaching for insurance papers looks hella scary.

<comment><USER14> Well, you can clearly see a lot of commotion happening inside the car. It's clearly not a good idea to just walk next to the driver's side if you already see flailing arms and get no reaction from announcing your presence.

I would have expected the officer to pause for longer before approaching the door and to be a lot more vocal about what he is doing -- precisely because he can't tell what is going on from a quick glance. You don't want to get stabbed but you also don't want to taze or shoot an innocent person to death.

</comment></comment></comment><comment><USER27> _Even if the camera was on the officer's glasses or hat, the up-close footage would be confusing._

The original footage was _not_ confusing, in my opinion. It was fabricated to look like a violent interaction faced by an officer, and that is the most likely situation. The audio off is necessary for the fabrication.

A camera mounted on the officer's glasses/hat would only make it even clearer as there'd be less jerk. Perhaps a larger viewing angle would be useful too.

<comment><USER28> I worked here in the UK with body worn video. Cameras attached to heads are really awful, while they're normally pointing in the right direction as officers move around the video is virtually unwatchable as the view slews around.

Most of the videos linked to are a bit artificial, in my experience video taken while an officer runs isn't normally all that interesting.

The biggest bonuses we found were: Just telling someone it was being recorded often made things less aggressive. Drunks & disorderly offenders would plead guilty once they'd been shown the video from the previous night which means an officer doesn't have to go to court. Less complaints and often there is a way to sort out the truth. Domestic violence was a lot easier to prosecute, my favourite tale was a drug den with a small child where within 24 hours the parents had somehow managed to repaint / get fresh furniture when the social workers went back the following day.

Most of the UK officers I've met have been good folks trying to do a difficult job, although the US officers I spoke to do did seem to be a bit more military in their attitude.

</comment></comment><comment><USER29> In an investigation, I wager these videos would be analyzed frame by frame, seeing them like this makes it far more difficult to figure out what happened. Just looping them several times it becomes much clearer.

</comment><comment><USER30> 65% "tend to trust the police" Are people living under rocks?

<comment><USER21> Some people don't live in the US.

I live in the UK where we have a completely different approach to policing.

I trust the police. They work hard in our communities to gain that trust. They don't always get it right and they have their issues (some very big) but on balance they are a trusted part of (most of) our communities here.

I really don't want to get into a flame war or anything, it's just that lots of different place in the world have very different police forces.

</comment></comment><comment><USER31> I wonder what it would look like if the videos were stabilized. It could dramatically decrease how wild they seem and make it easier to understand what's going on.

</comment><comment><USER32> Moral of the story: we should all wear body cameras, just in case we're involved in some sort of altercation, involving the police or not.

<comment><USER33> I can see a point in time where police are accompanied by a couple of drones that give different perspective to go along with body cameras.

<comment><USER34> That sounds very helpful and frightening at the same time.

In the future where everything is recorded the records should be sealed unless a warrant for those recordings is presented. The warrants should be made public.

Recording everything is alredy happening in some cities, like London, but the control is on the side of law enforcement.</comment></comment></comment>


Humans nearly wiped out 70,000 years ago, study says. - <AUTHOR> http://www.cnn.com/2008/TECH/04/24/close.call.ap/index.html?eref=rss_mostpopular

<comment><USER2> For anyone interested in the original paper (this journal is freely available to all): <http://download.ajhg.org/AJHG/pdf/PIIS0002929708002553.pdf>

</comment><comment><USER3> Amazing how short the memory of science journalists can be. This is old news. As you'll find out if you do a quick google: <http://www.google.com/search?q=humanity%20near%20extinction>

A lot of the results are older than, well, last week.

I believe this idea was even mentioned in a National Geographic documentary. Humans are smart because they're the descendants of a small group (some say around 2000 - so much for inbreeding being bad for your offspring, I guess) that managed to survive some terrible event at some point. The dumber ones died off.

Along those lines, btw, I read somewhere that even after this near extinction it was still only a limited number of people that actually produced any offspring. The worst example of this is the Inca and the Dahomey empires where only the emperor / king and a few highly placed officials could actually have sex, but even in Medieval Europe most peasant males (that is to say, most of the population) did not have any children at all.

</comment><comment><USER4> This is the most astounding news story I've read in a month. It is amazing that something like this could have happened as recently as 70,000 years ago. It does finally explain the African Eve, though.

<comment><USER5> What do you mean that it "finally explains the African Eve"? There would have to be a last universal common female ancestor whether this had happened or not.

<comment><USER4> It explains why she was so surprisingly recent.

<comment><USER5> Ah, I see what you mean. That makes sense.

</comment></comment></comment></comment><comment><USER6> Not sure if this is the same as the Mt Toba supervolcano eruption 74,000 years ago in Sumatra that started a 1000 year long ice age and probably reduced the human population to 10'000 individuals: <http://www.bradshawfoundation.com/journey/>

</comment><comment><USER7> same as <http://news.ycombinator.com/item?id=172767>

</comment><comment><USER8> Humans! Fascinating!

</comment><comment><USER9> dont worry -- we'll step forward and pick up the slack where nature has failed</comment>


AI on the Web - <AUTHOR> http://aima.cs.berkeley.edu/ai.html

<comment><USER2> Jeff Hawkins, who made a breakthrough in the field and I presume indirectly inspired IBM's Blue Brain experiment, is not in the list. No wonder, though: the official science is too conservative to accept fresh and worthy ideas that fast.

www.onintelligence.org

<comment><USER3> Norvig doesn't really update the list any more, so a lot of the more recent stuff/people is missing.

Also in the YouTube age, a ton of very interesting lectures/demos/talks are online in video format and he doesn't catalog any of it.

<comment><USER2> His book _On Intelligence_ was published in 2004.

<comment><USER4> I really liked that book. Did he really make a breakthrough, though? I know his system is available now, but how does it fare, compared to other technologies?

<comment><USER2> The breakthrough is in the idea that what our brain does is basically it generalizes input and performs detailization on output. It seems so obvious even speculatively that both generalization and detailization are the core of natural intelligence, yet the AI science so far failed to include them as research subjects at least.

And it seems like Jeff Hawkins found both mechanisms in the neocortex.

Surprisingly, at the moment we don't have any theory for generalization, not even a single try to formalize it and create algorithms -- not to be confused with the theory of inference. Evidently, this is terra incognita and a very promising one.

His claim, though, that what he's found is _the_ intelligence looks like an exaggeration. Intelligence is not only generalization, although there is no intelligence without it.

</comment></comment></comment></comment></comment><comment><USER5> AInews.org - all the latest artificial intelligence news - a glimpse into our future</comment>


Nvidia Crushes Its Q4 Earnings, Posts 41% Revenue Growth Year-Over-Year - <AUTHOR> https://techgage.com/news/nvidia-crushes-its-q4-earnings-posts-41-revenue-growth-yoy/ <comment><USER2> I would bet a strong percentage isn't "gaming" but mining, which is going to prove more volatile for their revenue stream over time.</comment>


The trojan Emoji - <AUTHOR> https://poststatus.com/the-trojan-emoji/ <comment><USER2> It's sad to see this mistake being made repeatedly. It kind of works like this

      1) Small project started, MySQL is used because that's all the developer knows
      or it's convenient
      2) Strict mode is never turned on; developer has no idea it exists
      3) App gets popular
      4) Too late to enable Strict

It's really the main reason why I don't recommend MySQL. Theres so many mistakes waiting to be made.

<comment><USER3> > 2) Strict mode is never turned on; developer has no idea it exists

MySQL has been my hair-tearing problem for many years - [https://reddragdiva.dreamwidth.org/593924.html](https://reddragdiva.dreamwidth.org/593924.html) \- and _I_ had no idea it existed.

There's a secret "don't suck as much" switch? TURN IT ON!!

<comment><USER2> Wait until the developer learns they need to support unicode.

</comment></comment></comment><comment><USER3> Why why why did MySQL have to win the damn race. It's the PHP of databases: it more or less works, but you're relying on a cardboard skyscraper built on a foundation of poop. And this _will_ come back to bite you.

Why MySQL Is Not My Favourite Database: [https://reddragdiva.dreamwidth.org/593924.html](https://reddragdiva.dreamwidth.org/593924.html)

</comment><comment><USER4> For anyone interested in knowing how the UTF8 attack works, Mathias Bynens has a fantastic presentation which describes the technical details: [https://www.youtube.com/watch?v=qFfjJ8pOrWY](https://www.youtube.com/watch?v=qFfjJ8pOrWY)

Here's the slide deck: [https://speakerdeck.com/mathiasbynens/hacking-with- unicode](https://speakerdeck.com/mathiasbynens/hacking-with-unicode)

Interesting anecdote from the talk: This isn't just unique to Wordpress. Spotify was vulnerable to this at one point.</comment>


Louis Rossmann, the guy who repairs Apple hardware, is under attack - <AUTHOR> http://www.mackungfu.org/LouisRossmanntheguywhorepairsApplehardwareisunderattack <comment><USER2> Cache for those who don't want to disable their ad blocker: [https://archive.is/KtPyk](https://archive.is/KtPyk)

<comment><USER3> Another way - I disabled that site's Javascript privileges on my computer using the "Quick Javascript Switcher" extension for Chrome.

</comment></comment><comment><USER4> One of the not-so-well-kept secrets is that you can find schematics and sometimes even the board layouts for almost any laptop, and even some smartphones (including iPhones). You just have to look in the right places and not be afraid. ;-)

I'd guess a lot of them are leaks from Chinese OEMs, and we have their insecurity to thank for it. The whole third-party repair industry is basically built on this fact. Due to its unofficial nature and somewhat uncertain legal status, usually only sites in the far East will host this material. This is the part of the Internet the companies don't want to exist or you to know about, but it's there (and sadly, shrinking, so archive what you have and may come across in the future) if you look hard enough.

Here's a good intro to the culture that enables this:

[https://www.bunniestudios.com/blog/?page_id=3107](https://www.bunniestudios.com/blog/?page_id=3107)

As someone who has studied a lot of these schematics (including the one for my laptop), it is interesting how similar a lot of them are, and I'd bet it's given me far more knowledge about how modern laptops work than any course or other method of formal learning. Of course, for repair they are invaluable.

Relatedly, if you search Google for "X laptop schematic", it now fills the search results with user manuals and other completely useless and irrelevant content. You have to specifically quote the word "schematic" to get what you want. Once you start seeing "results removed due to DMCA" you're getting close.

A few years ago a similar thing happened, although not with Apple:

[http://www.wired.com/2012/11/cease-and-desist-manuals- planne...](http://www.wired.com/2012/11/cease-and-desist-manuals-planned- obsolescence/)

If I remember correctly, in that case Streisand Effect happened and you can still find those manuals online.

</comment><comment><USER5> It's interesting to see how the main philosophy behind Apple products is to prevent this kind of tinkering and that they are also used by a lot of hackers (tinkerers).

I know the answer is "they just work" but it somewhat troubles me. I'm also a pragmatic but then I think about cases like the Bitkeeper debacle and Linus Torvalds vs Richard Stallman positions then. And who was right in the end and how this concluded with the birth of Git.

Ok, it's exactly not the same scenario (HW vs a SW product) but maybe someday we will see a similar conclusion...

</comment><comment><USER6> This site requires disabling ad blockers before showing content. It's not worth the risk to me, personally.

<comment><USER7> Isn't there a big button to just show the article? There was for me but I opted in to ads and it's just a tiny banner ad at the top. I figure if it is a smaller site and they ask to opt-in for ads, they are going to be good citizens with their ads. Actually, I went back and there are more ads than I noticed initially so it is a bit over the top compared to the actual amount of content.

Summary: Youtuber who does surface-mount component repair of Apple laptops on video demonstrating that Apple's repair stance is silly (ie 15-30 minutes to fix an issue instead of just swapping out the logic board) is threatened by unknown party over (unofficial) schematics used. Schematics likely unofficial from Chinese sources. Youtuber doesn't name who is threatening them but assumed to be schematics source or Apple.

</comment></comment><comment><USER8> Here's a case were the schematics were declared non-copyrightable.

[https://en.wikipedia.org/wiki/Behringer#Legal_cases](https://en.wikipedia.org/wiki/Behringer#Legal_cases)

</comment><comment><USER9> His site also seems to have download links for Adobe Photoshop, which I'm guessing are malware links

edit: maybe not, can't really tell with the adblock nonsense

<comment><USER10> Not malware at all, it are links to the Adobe support pages:

[https://helpx.adobe.com/photoshop/kb/uptodate.html?sdid=XT3P...](https://helpx.adobe.com/photoshop/kb/uptodate.html?sdid=XT3PH8LV#NotConnected)

</comment></comment><comment><USER3> I hope that every pro-Apple techie is happy with the monster that they've helped to create by enthusiastically jumping into the Apple ecosystem over the past 10 to 15 years.

If you're starting to see the light - please consider using my own personal tactics for never giving Apple any money, but still being able to use Apple products:

\- Only buy used or unofficially-refurbished Apple equipment.

\- Don't use any of their services unless they're free.

\- Don't buy any apps, only use the free ones or pay for them through non- Apple channels.

\- If you end up giving money to Apple in any way, try to make them lose it somewhere else down the road (i.e. by heavily using their free support services, talking people out of using their products, etc.).

</comment><comment><USER11> I was just at his shop a few days ago and his guy there said they couldn't fix a loose RAM chip so now I'm out $700 for a logic board, contrary to the article's acclaim:

>Using a microscope connected to a camera, Louis walks the viewer through the entire procedure, which involves tracking down the problem via common sense and diagnostic tools, and then replacing the faulty components. This is the kind of "surface mount" repair Apple considers impossible – much to Louis' frequent amusement.

However I'm on his side here. Apple's approach is quite troublesome: soldering everything so it's impossible to upgrade, creating iPhone screws that if put back in the wrong place short the phone, etc. I know catering to the non- technical, to the point of being anti-technical, has been a hallmark of Apple's (Jobs') philosophy since the beginning but I don't have to like it.

<comment><USER12> It is basic job security. If people were able to easily repair their older devices, fewer would buy the new ones. Or pay big dollars for new replacements for damaged ones.

<comment><USER13> I agree, this reminds me of the iPhone replacement program they have going on. It's a incentive subscription model to update your phone model each year.</comment></comment></comment>


Ask HN: Contribute effectively for open source - <AUTHOR> What do you recommend for this? <comment><USER2> Find an existing project that's already in your area of interest - e.g. a sporttracker if you're into running - and start contributing to that. No point in starting someplace that's completely alien to you.

<comment><USER3> Preferably, pick an existing project that you already use in your area of interest.

</comment></comment><comment><USER4> I recommend you do it. /s

In seriousness, I think you need to be more specific about what you want to know/understand, your question is pretty open ended.</comment>


Google Custom Search Engines have been broken since Friday - <AUTHOR> http://www.google.com/support/forum/p/customsearch/thread?tid=1c0253059479f92f&hl=en

<comment><AUTHOR> Google seems to have made a new release of their javascript code on Friday evening which has broken all(?) embedded Custom Search Engines.</comment>


TheDeadline - Your Intelligent Personal Assistant - <AUTHOR> https://the-deadline.appspot.com

<comment><USER2> Im testing, and Im really liking. It is easy, and fun to do things.. sure it has some things to improve, but as a first public version, it simply rocks!

</comment><comment><USER3> I have been using this myself, as an alternative to a customer's project that has too many features that I don't need.</comment>


Fingerprints to be tested as 'currency' for foreign tourists in Japan - <AUTHOR> http://the-japan-news.com/news/article/0002859676 <comment><USER2> So basically, if someone has a device like a credit card skimmer for these terminals and gets your fingerprint they can buy stuff as you? And unlike a credit card, you can't change your fingerprint.

</comment><comment><USER3> 1) Biometric stuff is relatively easy to copy and fake 2) I might be ok for the government to have my fingerprint, but not the first shop on the street.

</comment><comment><USER4> How do I revoke my stolen fingerprints? And then generate new ones?</comment>


How to implement HTTPS in an insufficient manner - <AUTHOR> http://www.troyhunt.com/2013/04/5-ways-to-implement-https-in.html <comment><USER2> The author lists 5 problems, but all of them have to do with the fact that the website in question is not 100% HTTPS. So it's really just one problem that has many different implications.

When you maintain both an HTTP site and an HTTPS site, it's nearly impossible to toss state back and forth between them without exposing yourself to at least one of these problems. Even if you do everything perfectly, people will complain that they get logged out when they visit HTTP URLs. The only solution is to treat HTTP, from now on, as if the only response it could produce were:

        HTTP/1.1 301 Moved Permanently
        Location: https://www.example.com/remainder/of/url

That's it. If you handle personal information, never send "200 OK" responses over plain HTTP, ever.

Need more server resources? Maybe. And this is probably why 99% of websites that have the problem the author mentions resist making changes. But the "HTTPS uses more server resources!" complaint is so 20th-century it's not even funny anymore. If you're not going to invest in 10% more server resources (or 5%, or 25%, or whatever) to protect your users' personal information, I seriously doubt that you deserve anyone's business in the first place.

<comment><USER3> No, please don't do this:

If a visitor goes to <http://domain/some/url> they should _not_ redirect to <https://domain/some/url> \- it makes it harder to catch pages that use the wrong protocol.

Better to redirect <http://domain/some/url> to <https://domain>

Edit: if you're logging referrers from your own domain with non <https://> urls AND using secure cookies, ignore my comment!

<comment> trust-me Nooo, don't erase the address that took me 5 minutes to type. What you say doesn't make any sense. You should obviously configure the https redirect as a site wide setting and not per page.

<comment><USER4> That's clearly true from the usability perspective. However, the problem is that bulk redirections like that make it very difficult to catch insecure resources.

For example, let's suppose you have a secure page that's referencing some JavaScript resource via a plain-text connection. Because of the redirection, the browser will ultimately fetch the required file, but only trying plain- text HTTP first. That one plain-text request can be hijacked by a man-in-the- middle attacker and abused to take over the victim's browser (and account).

Further, if your users have bookmarks to plain-text pages, their first access to your web site is always going to be insecure, which means that they can be attacked via sslstrip.

These problems are solved with Strict Transport Security, but it will probably take some time until we can fully rely on it.

In the meantime, the plain-text URL can be preserved, and the redirection carried out via an intermediary page that explains why links to plain-text pages are dangerous. It's ugly, but I don't think there's a better (safer) way.

<comment> trust-me Yes, these are real problems, but how is redirecting to the home page helping in any way? When the user navigates back to the page she wanted the in-secure script will still be fetched. A MITM is still able to serve a copy of your page.

<comment><USER4> I wasn't arguing for redirecting to the home page, only to avoid redirecting (to the intended destination on port 443) automatically.

If a user's browser ever sends a port 80 request, you've already lost (assuming the MITM is there). On your end you may even never see a plaintext request. But in all other instances, displaying an intermediary page is a chance to educate your users, and possibly get them to change their bookmarks.

Further, with little work you may be forcing the MITM to do some custom coding (a lot of work) in order to make the attack seamless.

I wouldn't do this for just any web site, but if you're running a bank or something similarly sensitive, it would probably be worth it.

<comment><USER2> _If a user's browser ever sends a port 80 request, you've already lost (assuming the MITM is there)._

Not really. Although old browsers don't support HSTS, they still respect the "secure" flag in cookies. So if an old browser ever requests an insecure resource, no cookies are sent with it, so the bad guys can MITM your connection all day long and no harm will be done. You only need to make sure that your own web pages never request resources over HTTP, and this is relatively easy to do.

> _On your end you may even never see a plaintext request._

If so, there's no point doing fancy redirects anyway. How do you redirect a request that you never see? Therefore this scenario isn't really worth losing sleep over.

> _displaying an intermediary page is a chance to educate your users, and > possibly get them to change their bookmarks._

Users don't want to be educated, period.

Also, technically when a browser encounters a 301 redirect, it should update the relevant bookmark automatically. In reality no browser does this, but that's what the standards say anyway.

<comment><USER4> > Although old browsers don't support HSTS, they still respect the "secure" > flag in cookies. So if an old browser ever requests an insecure resource, no > cookies are sent with it, so the bad guys can MITM your connection all day > long and no harm will be done.

Not true. Once a MITM hijacks the victim's communication with the server, she can do whatever she wants, including stripping the "secure" flag from session cookies. She may not be able to compromise a previous secure cookie, but she can hijack a brand new session, wait for the user to authenticate, and gain access that way. The communication from the victim to the MITM will be plain- text with insecure session cookies; the communication from the MITM to the server can be SSL with secure cookies.

And if we're talking just about an insecure resource (not a page, but, for example, a JavaScript file), the MITM can simply inject malicious code into it and hijack the browser that way.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> I'm the guy who originally contacted Troy Hunt about this, as he mentions in the blog post.

What annoys me is I'm a very young developer, and I've only really just become interested in security (12 months ago I didn't even know what hashing was!!!), yet there's developers out there with years and years of experience making huge sites for the likes of Tesco and TopCashBack for vast sums of money and they don't think about incorporating even the simplest foundations of internet security a novice like me would implement without even thinking! How is this possible?! If I'm doing it in tiny little php sites with 1 unique visitor ever, why are these 'experts' not in there huge corporate sites with hundreds of thousands of users a month?!

<comment><USER6> Years and years of experience? Often not, and that's speaking from years and years of experience!

Vast sums of money? Yes, at least the outsourcing vendors who churn this sort of thing out.

Unfortunately you're the exception Mark so good on you for that. Well I mean unfortunate for the greater web using population, but very fortunate for you!

<comment><USER7> To expand further on those points with a personal anecdote... I worked on a "big website" for a very big government department. I was still in university at the time, had about a year's experience with the platform, and was earning close to callcenter wages.

The government only contracts to companies on a particular whitelist, which we weren't. They paid a company something in the region of £300,000 for the website.

That company then outsourced 100% of the work to the tiny (single digits employee count) company I was at.

They paid us £40,000.

My share of that works out at about £2,000.

The fact something cost half a million dollars in no way implies any kind of quality, or that the people working on the software will know what they're doing. (Really: another horror story involved a website that only needed to work in IE6... and had been built and tested purely in Firefox)

</comment></comment></comment><comment><USER8> This is the same guy who exposed similar flaws with Tesco's (UK supermarket chain) systems [1].

Why on Earth these companies are given free advice, but think they (or their PR folks) know better is beyond me. Take the advice! You've now got a security flaw, documented, waiting for Joe Hacker to take your customer's data and shoot a hole through your business, and its reputation.

[1] [http://www.troyhunt.com/2012/07/lessons-in-website- security-...](http://www.troyhunt.com/2012/07/lessons-in-website-security- anti.html)

<comment><USER9> Could someone explain to me why storing un(salted/hashed) passwords is such a big thing? Sure, it doesn't hurt to salt and hash passwords[0], but since users aren't supposed to reuse passwords anyways, what's the problem in storing 7UgHxJYjkgWDyCa9gsrH rather than db5670ac4a274055e3f785300bec563c48306bf3ab8cb32223a4cd311984a3b4?

[0] And possibly normalise their length/character set, something that comes for free with hashes.

<comment><USER10> Firstly, an attacker with access to your backend database will have full access to user credentials if passwords are not salted and hashed. An attacker can then sign in as any user. The attacker may not be trying to steal all your have and may instead be looking to make life difficult for a single specific user.

Secondly, users will reuse passwords. An attacker with access to the plaintext password and the user's email address can use this to try to gain access to other services.

Thirdly, the attacker in the first example could be a disgruntled employee. You don't want a disgruntled employee causing trouble.

Lastly, I like to protect myself. A user of your services may claim you or your employees are signing in as them. It is convenient to be able to honestly state that this cannot happen.

<comment><USER9> I give you the first three points, though at least the first one sounds a little academic, given that someone with access to the backend database could probably effect queries 'simulating' an active user.

However,

> Lastly, I like to protect myself. A user of your services may claim you or > your employees are signing in as them. It is convenient to be able to > honestly state that this cannot happen.

sounds odd, since the user transmitted their password in clear text to the server at least once when registering, unless you use browser-side hashing/salting, in which case this hash would then take on the role of a password (i.e. wouldn't help at all). Furthermore, anyone with database access could overwrite the hash in the database, log in with the password matching the new hash and then put the old hash back in place.

<comment><USER8> > Furthermore, anyone with database access could overwrite the hash in the > database, log in with the password matching the new hash and then put the > old hash back in place.

With a salt, it removes all doubt. If an employee has a grudge against one customer, they could take the unsalted pass, and authenticate as that customer, no database transactions; essentially no paper trail.

If that scenario happened on a hashed and salted database, you'd have transactions that X employee changed the salt & hash, then 20 minutes later changed it back. As soon as (CEO/CTO/Mr. Manager) finds that out, X employee is held accountable for their actions.

</comment></comment></comment></comment></comment><comment><USER11> SSL should really be all or nothing. The same way browsers don't like loading insecure content from a secure origin, they should also squirm at the idea of submitting a form to a secure area (from non-secure) -- including if the parent is non-secure. An iframe isn't good enough.

</comment><comment><USER12> Do i have to pay or create accounts on third party services to use HTTPS (in nginx)?

I never used https on my sites because there are some giant warnings ("dangerous") in browser when you go to a website that is self-signed. No warnings on plain http.

<comment><USER13> You can get a free SSL certificate at <https://www.startssl.com/> , so that should not be a reason to keep you from using it.

I do agree that the extreme mistrust of browsers towards self-signed certificates is an odd thing.

<comment><USER14> > I do agree that the extreme mistrust of browsers towards self-signed > certificates is an odd thing.

No, not at all; it's the whole point of SSL. The guy MITMing an SSLed website can create a cert for that site himself, but he can't get it signed by a CA. So he has to sign it himself. Thus, from the browser's perspective, all self- signed certs are possible instances of "there used to be a CA-signed cert here, but now you're being MITMed."

Now, that's not to say something _like_ self-signed certs wouldn't be nice-- given some sort of distributed pin cache, we could have something closer to an SSH/PGP model where everyone's current self-signed cert "fingerprint" is on file, and alarm bells go off if you see a cert different from the one you're supposed to see. But without that, self-signing is literally no more secure than no SSL at all: anyone else can also self-sign to MITM you.

<comment><USER9> > but he can't get it signed by a CA.

I strongly doubt that.

<comment><USER14> Well, like I said--it's the whole point of SSL. If he can (and the CA responsible isn't immediately shut down), it means SSL is fundamentally broken.

</comment></comment></comment></comment></comment><comment><USER15> Https article served over http. Lovely.

Edit: Besides that problem #1 is offtopic since it has nothing to do with https and that 3/4 other points are captain obvious, #4 is actually a good one. It's so obscure that many will forget to enable it ("all pages are secured anyway"), but whenever a user visits _any_ http page, an attacker can inject a small frame loading the http version of my website, and even if I redirect, the cookie was already sent and read by the attacker. Only an HSTS header or enabling the secure-cookie option protect against this.

<comment><USER16> If every blog on the internet had a static IP to serve HTTPS over, we'd have even less IP addresses available than we do now.

<comment><USER17> IPv6 or SNI

<comment><USER18> SNI has the added merit of working on practically everything these days.</comment></comment></comment></comment>


Book Review: Designing Data-Intensive Applications - <AUTHOR> https://henrikwarne.com/2019/07/27/book-review-designing-data-intensive-applications/ <comment><USER2> I've also read this book a couple times but sadly as a engineer in large and mature company I hardly find any opportunities to actually apply or strengthen the learning, then as time goes my learning just decays.

How are you tackling the issue? It's not like that one can find distributed system projects easily.

<comment><USER3> Considered switching jobs to something more interesting?

<comment><USER4> I have switched reasonably frequently in the last 5 years (approx 1.5 years at each job). Jobs are never as good as promised and sometimes turn put badly enough that you want to switch again soon. And its always a hassle switching. It does seem to be the most reliable way of getting a pay increase.

<comment><USER3> Well, keep your head up. There are some companies worth working for out there… there must be :) Maybe you start your own thing…

</comment></comment></comment></comment><comment><USER5> I've previously written about my experience with this book. It's so good that I'm starting to recommend it to CS students and early Software Engineers as a great introduction to the theory around many cloud services.

</comment><comment><USER6> Every book should be written like this one.

<comment><USER7> A detail I really liked were the maps. Somehow I feel they helped me retain more concepts.

</comment></comment><comment><USER8> Such a good book, recommend it to any software engineer.

Does anyone know of other books like this? That teach theory with good pedagogy?

<comment><USER9> From the ones I've read: The _Head First_ series of books are really really nice... other such books... D Crockford's JavaScript: The Good Parts; B Eckel's Thinking in Java; Skiena's The Algorithm Design Manual; M Nielsen's Neural Networks and Deep Learning; J Kurose's Computer Networking: A Top-Down Approach; R Lafore's Data Structures and Algorithms; J Bloch's Effective Java.

<comment><USER10> I'd add Andrew Tanenbaum's "Operating Systems: Design and Implementation"

</comment></comment></comment><comment><USER11> Can anyone recommend me a well written book on distributed systems? I've finished reading Designing Data-Intensive Applications last year and enjoyed it a lot.

</comment><comment><USER12> I love this book! After reading it, I can finally say I know something about data. The book gave me a systematic view of the technics related to the data. I marked lots and gave the book to my intern.

</comment><comment><USER13> I require this book for my Databases class since nowadays we cover more than just the relational model. I hope students will keep it.

</comment><comment><USER14> Would anyone recommend a good book for devops or CI/CD?

</comment><comment><USER15> Excellent book. I've read it a few times now.</comment>


Ask HN: Should size 0 elements be visible? - <AUTHOR>

If you go here: https://jsfiddle.net/r6zmvdwj/3/, I've added some css that sets the width/height to 0px. But I blow up the border and padding. Even though the width/height are set to 0px, the box is still rendered. Why? <comment><USER2> Because the css box model defines width and height as the dimensions of the content. Padding and border are added around the content.</comment>


Ask HN: Any tools for two way synced music listening? - <AUTHOR>

One of my work mates and I used to use the Soundrop app in Spotify to have a synced shared playlist. We grew up together and have similar tastes in music and its fun to occasionally talk about a song or share new stuff with each other. He is on the other side of the country from me. Is there any other options? I've tried the few obvious ones that come up when Googling but none of them are as seamless and simple as I'd like. Does anyone else do this? Any awesome solutions that you've come across? <comment><USER2> I believe that was the basic concept behind Turntable.fm (RIP). There were a number of competitors but I think they may have all bitten the dust as well.

Sad, because (like you) I love the idea of being able to sync my music with someone else.

[1] [https://en.wikipedia.org/wiki/Turntable.fm](https://en.wikipedia.org/wiki/Turntable.fm)

</comment><comment><USER3> Collaborative playlists in Spotify?

[http://www.tomsguide.com/faq/id-2343246/collaborate- spotify-...](http://www.tomsguide.com/faq/id-2343246/collaborate-spotify- playlist.html)

<comment><AUTHOR> Collaborative playlists are great but it don't allow users to listen to the playlist synced together real time.

</comment></comment><comment><USER4> If you're somewhat technical I believe you can achieve this with hubot</comment>