AdNauseam: Browser extension to fight back against tracking by ad networks - abc-xyz https://github.com/dhowe/AdNauseam <comment><AUTHOR> Apart from actual malware, this is the only browser extension I know of to have been blacklisted by Google. If you want to use it in Chrome you have to jump through hoops. For the record, I approve of AdNauseam. I have every right to browse the internet how I choose. My computer, my control. I am firmly against the corporization of the internet.

<comment><USER2> > If you want to use it in Chrome you have to jump through hoops.

Why would a potential AdNauseam user even use Chrome?

<comment><USER3> Multiple and fully isolated user profiles - hugely important for the work I do. I know Firefox has containers, but they're not really feature complete compared to Chrome's, and the UI experience leaves a lot to be desired, there's just to many friction points.

edit: forgot to also mention, I'm also aware FF has profiles as well (about:profiles) but the implementation has too many speedbumps. As I mentioned in another post on HN, the profile manager needs to be an upfront and first class UI citizen, something hidden away with a fairly poor UIX.

<comment><USER4> Firefox has profiles too, although they are probably even even harder to use than containers.

<comment><USER3> Yeah, I forgot to add to my comment something about their Profile implementation which feels like another half baked idea.

</comment></comment></comment></comment></comment><comment><USER5> This extension apparently simulates clicks on blocked ads. I'm not comfortable doing that.

First of all I don't see the point. I don't click on ads, so there is no profile that advertisers can extract from that.

Having an extension that simulates clicks would only link to my supposed profile shit that I don't want, plus in my experience from when I worked in the ads industry, the user profile often gets compiled from better signals, like actual searches, apps used, websites visited, articles being read, or data freely provided by the user himself, like age, sex or location.

Clicks on ads are misleading because the ads themselves are misleading. It's not a good signal unless it leads to a conversion and a click is just part of the funnel and not a conversion. In fact the only really useful signal is that the user clicks on ads, in general, or in other words you're inviting publishers to serve you more ads.

Also this "fighting back" attitude is not very constructive. If you hate the direction of this industry, consider paying for shit that you consume, instead of pushing for extensions that will inevitably get banned (due to this being essentially fraud) and that are pushing more and more publishers towards native apps and towards DRM, because the open web is a risky platform due to these extensions.

\---

For protecting my privacy, besides Firefox's built-in trackers blocking and uBlock Origin, I also use and recommend Privacy Badger ... this is a neat extension that automatically learns about trackers that follow you around the web; it can brake some websites, but it's the best at bypassing protections against ad/tracker blocking.

<comment><USER6> A couple of quick points:

\- Your ad profile will be built based on pages you visit as you indeed note, not just things that you click. Any noise you can introduce surely has to be a win for obfuscation? Would be interested in your thoughts here because you have more experience than I do!

\- I'm not certain that paying for content makes any difference from a data mining perspective. Loading a NYT article causes uBlock Origin to deny 14 requests; I don't currently have a subscription but I imagine those assets are still loaded even if I'm signed in (with much clearer markers towards my identity!)

\- Fighting back is a fine way to effect change. It's clearly working or Google wouldn't be banning this extension from their store or limiting their API.

I'm very comfortable with this so it's interesting to speak with someone who isn't. If adblocking is on the rise, I wonder what the next step will be towards monetizing content? Micropayments didn't take off (perhaps unsurprisingly) and subscription models seem to not have the return that people had hoped. There's huge amounts of money on the table but a lot of very smart people don't seem to have hit upon anything yet!

<comment><USER6> Also I upvoted you - I'm not sure why you're being downvoted without explanation since you've axiomatically added an interesting viewpoint to the discussion.

<comment><USER7> What exactly does it clarify to modify "add" with the adverb "axiomatically"?

<comment><USER8> It clarifies that the writer likes Jordan Peterson.

</comment></comment></comment></comment></comment><comment><USER9> In previous discussion about AdNauseam one user familiar with the ad industry said [0]:

> I worked in adtech a few years ago, and AdNauseam-style click fraud is a > relatively trivial to detect and ignore. It does nothing, and adtech > companies don't care about your hate of online advertising the least because > that's what brings in the cash.

Then other user clarified [1]:

> The most usual technique is to setup click baits/traps, once you click on a > trap link you (= IP or UID via cookie) are added to an ignore list, where > all your actions are not invoiced to advertisers. Simple and works,

With all that in mind I came up with an idea at a time [2]:

> What would happen if there would be a popular extension that would share UID > cookies between all its users?

Now, the question is: is it worthwhile to do something like this?

[0] [https://news.ycombinator.com/item?id=19279384](https://news.ycombinator.com/item?id=19279384)

[1] [https://news.ycombinator.com/item?id=19279452](https://news.ycombinator.com/item?id=19279452)

[2] [https://news.ycombinator.com/item?id=19281078](https://news.ycombinator.com/item?id=19281078)

<comment><USER10> Claiming it's trivial to detect feels like a weak attempt to try to discourage people from using the extension because it's anything but, and that it's something ad networks fear will become mainstream like regular adblockers.

The click baits/traps would, in terms of cookies, be countered by the Cookie AutoDelete extension and whenever you browsed in private mode. As for blacklisting IPs, that seems very risky since an IP is often shared among many users (and it's always a risk people use same device, e.g. a MacBook), and it would continue to result in an increasing amount of legitimate users being wrongfully blacklisted as the extension's user base grew. Moreover, assuming these techniques are actually used, then it's safe to assume that at least a few ads would be clicked before they detected they were malicious clicks. And this would be the case whenever a user used a new IP with no cookie present. I'm definitely not convinced it's something ad networks can reasonably detect, especially considering it's important that the ads are served as fast as possible.

</comment></comment><comment><USER6> I used this for some time and it's great; built atop ublock origin and does exactly what it purports to. The only downside is that it is used by such a comparatively small market-share that it's harder to blend in, but I imagine modern browser fingerprinting negates this concern anyway. Also it's (tellingly) banned from the Chrome store last I used Chrome, and you had to install it via a zip file. There is (or at least was) a user-hostile nag each time you start Chrome (or Chromium) about allowing an unidentified extension but I guess that's now moot if Chrome now doesn't permit sanctioned ad- blockers.

<comment><USER11> They should promote the hell more out of the fact that it's uBO underneath. For a long time, I didn't install AdNauseam simply because I trusted uBO more, and didn't want to have two ad-blockers in a single browser.

<comment><USER6> I agree with this - it's there (annoyingly, phrased exactly the same way I wrote my comment but I swear I didn't know and I haven't been on that page in months!) but they're not exactly leading with it. uBlock Origin has a strong brand and it's a bit myopic not to leverage that in a more prominent way. Still, I'm glad it's getting noticed and I'm sure their install base went up a fair bit from this thread alone!

<comment><USER11> I'm on a fresh desktop setup and just installed it, so it's +1, and when I go back to my usual workspace, it'll be +3.

</comment></comment></comment></comment><comment><USER12> Best part is it tells you how much ad spend you have caused. It's crazy how quickly the number reaches 4 figures.

<comment><USER13> The fake clicks that this generates is one of the most trivial to filter out for even the most simple ad systems. It's costing ad companies and advertisers approximately zero dollars.

It's a nice additional data point to identify and track the users running it, though.

<comment> abc-xyz 1\. If it's so trivial and costs ad companies nothing, then why would Google go out of their way to ban the extension when it's essentially just an ad blocker that clicks on the ads in the background?

2\. How would you filter out AdNauseam ad clicks with genuine ad clicks?

<comment><USER13> It's banned because it's made by people intentionally trying to not just subvert, but inject _fake_ data into Google's core business model. It's like asking "why doesn't Apple allow Cydia in the App Store?"

AdNauseam clicks occur far more often than normal ad clicks, aren't associated with other ad load events, timing is all similar, ads are clicked regardless of predicted relevancy. There's dozens of obvious, and hundreds of non obvious, ways to detect if a particular user is a bot or not. Literally legions is PhDs study this attack vector and work at Google and Facebook.

<comment><USER14> PhD time doesnt cost "nothing" like you said in grandparent post.

<comment><USER13> They're working on actual hard problems, like combating click fraud attempted by organized crime and actual sophisticated actors, and they're working regardless of the existence of this extension.

This extension just isn't effective, and any time working in the ad industry makes that overwhelmingly obvious.

<comment><USER15> LOL, that's great idea!

Adnausium can just connect us through an anonymizing server so that we can sell our well chosen (by them) clicks to those organized crime and sophisticated actors. Heck, those bad guys would probably be willing to pay me or Adnausium a fractional CPM for the service.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Not sure why simply blocking the ads isn't a better signal than trying to send mixed messages that they can just filter out. Ad blocking already is fighting back, is more environmentally friendly, and doesn't expose you to anything.

<comment><USER17> > trying to send mixed messages that they can just filter out.

How does this work? Remove clicks from people that click many ads? Doubtful!

It is noteworthy that Google doesn't bitch too much about AdBlocking in the past, but lost their shit at AdDauseam![1]

[https://www.theregister.co.uk/2017/01/05/adnauseam_expelled_...](https://www.theregister.co.uk/2017/01/05/adnauseam_expelled_from_chrome_web_store/)

</comment></comment><comment><USER18> \- Blocking ads had the nice argument of being more "green" because of less internet requests, less CPU and data usage.

\- How do I make sure this extension will not download and run a javascript exploit from fake ads ?

Security, ecology, business threat : they are valid arguments to Google for banning it

</comment><comment><USER19> I like the data-breaking approach to anti-tracking and ads. I wonder if it would be more effective to fuck with cookies, like randomly scrambling your cookies with other browsers'.</comment>


Apple becomes latest target of the Beltway Shakedown - <AUTHOR> http://washingtonexaminer.com/tim-carney-apple-becomes-latest-target-of-the-beltway-shakedown/article/2530298?custom_click=rss <comment><USER2> Is this for real? The article paints this as a political mugging: "Give money to our ecosystem—lobbying, contributions, PACs, etc—or we'll harass you in Washington." Is this actually how this works? Is there any incentive for Apple to engage these people beyond implied threats?

<comment><USER3> Like Willie Sutton, politicians go where the money is.</comment></comment>


IndexTank is now open source - <AUTHOR> https://engineering.linkedin.com/open-source/indextank-now-open-source

<comment><USER2> How does this compare to solr or elasticsearch?

<comment><USER3> There's some really good info in this white paper from their old site, [http://indextank.com/_static/papers/IndexTank%20WhitePaper%2...](http://indextank.com/_static/papers/IndexTank%20WhitePaper%20Technical.pdf)</comment></comment>


Show HN: Sortedchef track nutrients and calories - <AUTHOR> http://sortedchef.com/ - too much pie and gravy? I made an app that allows you to make meals and drag-and-drop them into meal plans. Nutrient daily % calculated relative to your specified desires. <comment><USER2> Link: [http://sortedchef.com/](http://sortedchef.com/)

</comment><comment><USER3> Stories without URLs are penalized, so you'd be better off reposting this using the link, then adding your text as a first comment in the thread. Good luck!

<comment><AUTHOR> Oh - thanks for the heads up I'll try again tomorrow

</comment></comment><comment><USER4> Aqui</comment>


PHP 8 JIT performance in real-life web apps - <AUTHOR> https://stitcher.io/blog/jit-in-real-life-web-applications <comment><AUTHOR> Some background information about the JIT in PHP: it was clear from the start that it wouldn't affect classic web applications all that much, since there's not a lot of "hot code" to be found over there, especially since by default PHP doesn't use any long running processes to handle requests.

There are some benchmarks out there that claim the JIT has an immense impact on PHP performance, but these only measure specific code samples in isolation. The JIT _can_ open doors for PHP to venture into new areas of programming, but we shouldn't expect it to significantly impact our day-to-day web programming.

<comment><USER2> It will have so much impact in our asynchronous development. Those using Reactphp and Amphp will enjoy the JIT favour.

<comment><AUTHOR> The only benchmark I know of testing async PHP was flawed big time and was debunked a few days later.</comment></comment></comment>


Unix History Repository - <AUTHOR> https://github.com/dspinellis/unix-history-repo <comment><USER2> Wait, what? How could someone reconstruct single commits? There was no Git back then! The patch program is quite old (1985), but those patches go back to 1972.

<comment><USER3> Here's the first "synthetic commit" from June 20, 1972

[https://github.com/dspinellis/unix-history- repo/commit/67174...](https://github.com/dspinellis/unix-history- repo/commit/6717481c358b484385b4f5d5b95205e2a924a2c7)

<comment><USER4> The accompanying publication explains it more: [http://www.dmst.aueb.gr/dds/pubs/conf/2015-MSR-Unix- History/...](http://www.dmst.aueb.gr/dds/pubs/conf/2015-MSR-Unix- History/html/Spi15c.pdf)

>Curating and processing available snapshots as well as old and modern configuration management repositories allows the reconstruction of a new synthetic Git repository that combines under a single roof most of the available data

</comment></comment></comment><comment><USER5> The FreeBSD repository also has commit history for BSD in the "csrg" tree [1] (this presumably stands for Computer Systems Research Group, which was the group at UC Berkeley that led BSD development [2]):

[1] [https://svnweb.freebsd.org/csrg/](https://svnweb.freebsd.org/csrg/)

[2] [https://en.wikipedia.org/wiki/Computer_Systems_Research_Grou...](https://en.wikipedia.org/wiki/Computer_Systems_Research_Group)

</comment><comment><USER6> OK, you are going to say that Subversion is old and outdated. But it is not: [http://svnvsgit.com/#dvcs-myth](http://svnvsgit.com/#dvcs-myth)

<comment><USER7> >no access control, full copy of repository on every computer, no exclusive files locks and so on

but those are _benefits_

<comment><USER7> actually, on reading the rest of the page... _backs away slowly from religious war_</comment></comment></comment>


A16z AI podcast touches on cultural challenge in tech - <AUTHOR> http://a16z.com/2016/06/29/feifei-li-a16z-professor-in-residence/ <comment><AUTHOR> Fei Fei Li has some great quotes near the end (starting around 31:10):

"I find it very hard to convince women and underrepresented minorities to work in AI."

"We are not sending the right messages to attract people of all walks of life - we tend to just celebrate geekiness, nerdiness, but when you have an ambitious young woman coming into our department or into the AI lab... if we present ourselves just as geeks loving to do geeky things, we're missing a huge demography..."

"We're missing a huge opportunity attracting diversity because we're not talking enough or thinking enough of humanistic missions in AI."

I have a little sister who often wonders whether she should keep studying engineering because of things like this.</comment>


Interventions to Slow Aging in Humans: Are We Ready? - <AUTHOR> https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4531065/ <comment><AUTHOR> quote: 'There was consensus that there is sufficient evidence that aging interventions will delay and prevent disease onset for many chronic conditions of adult and old age. Essential pathways have been identified, and behavioral, dietary, and pharmacologic approaches have emerged.'</comment>


Effect of swearing on strength and power performance [pdf] - <AUTHOR> https://www.keele.ac.uk/media/keeleuniversity/facnatsci/schpsych/staffdocs/richardstephens/Stephens%20PSE%20Author%20Submission%20Nov17v2.pdf <comment><AUTHOR> >WARNING: This paper contains language that some readers may find offensive</comment>


The Covid-19 Economy: We won't recover until 2022 - <AUTHOR> https://chimerais.com/covid19-may13-prospects <comment><USER2> This is where it's very important for chartsmiths to acknowledge the extremely chaotic nature of the economy right now and its high degree of uncertainty. The IMF is just making stuff up right now. Nobody knows what the hell happens when you shut down the whole world for 2-6 months. One thing is apparent, is that our debt is growing faster than our economy. We may be approaching the limit of how much debt can be produced and still get returns on growth. This current situation has a lot in common with the Great Depression, but we weren't as over-leveraged in the 30s. Based on the world's total debt levels of $250 trillion with a pre-Covid economy of roughly $80 trillion...I'd say we're in for a world of hurt over the next decade or so.

<comment><USER3> While I strongly disagree with MMT, supports would argue that the central bank can manipulate the currency to the degree that basically any debt is not a problem.

<comment><AUTHOR> This is true as long as your currency is a reserve currency and people are willing to access it, buy bonds denominated in it, etc. The central bank can print money and inflate debt away as long as it's seen as the asset of last resort.

The credibility of the US government becomes critical in maintaining this.

</comment></comment></comment><comment><USER4> I've been thinking a lot about whether the correct way to think about it is more of a "reset" than a "recovery". So much about what we are doing with the economy right now seems theoretical that it's hard for me to think about it any other way.

<comment><AUTHOR> Interesting idea! How would you differentiate between the two? I guess with a reset, you stop everything, turn it all off, and turn it back on. Is that what you mean?

<comment><USER5> I don't think "reset" was meant in the computer sense of "turn it off and on again".

I think the implication is that our financial indicators have outrun the actual state of the economy. We're _resetting_ in the sense that we're forcing the indicators to match reality again.

To _recover_ would mean the numbers would go back to where they were before, which isn't going to happen.

<comment><AUTHOR> Oh, that's a much more eloquent interpretation. Also a bit scary, but I think you're right.

</comment></comment></comment></comment><comment><USER6> We need a new economy. The ability to work and survive does not need to be so precarious. If households could make everything themselves, no abstract shock or "job market" would disturb them. But that is not reality. The key challenges... dependency coordination, natural resource control, and circular negotiation. Answer these to clarify the transition.

<comment><USER7> An autarcic approach was left behind for a reason. Specialization and economies of scale provide far more with better efficiency.

The closest steps towards it have involved automation to effectively deskill and delabor processes usually for logistical advantages - take printing for example.

Using today's technology the best we would have is essentially a "remote compound" with a well water, and septic tank as very basics. Beyond that gets into renewable power sources like solar or wind and batteries, more extreme maybe a fully automated garden based upon indoor farming tech scaled down. All take up space and are more expensive such that it is not the cheaper option unless you are at the fringes. And it would be very far from making everything themselves. That world is gone for a reason.

Even if a housshold could be self sufficient that would be insufficient for a society - infrastructure needs support as well.

<comment><USER8> I'm not in favor of every household going fully self-sufficient, but I think it's time we evaluate if we really need extreme efficiency in many aspects of our lives. I believe there are many services that would be less damaging and less polluting to the world if implemented at the community level. Growing and delivering food is a great example.

</comment></comment></comment><comment><USER9> > We won't recover until 2022

Even if the lockdowns in the US ended today, there won't be a recovery for at least 2 generations.

Although the FAANG companies can weather a lockdown, virtually no other businesses can shutdown while still paying rent without bankruptcy.

For those unfamiliar with business, here's some examples of the slim margins and huge overheads outside the FAANG bubble:

\- Major grocery stores typically make 1% of gross. One percent.

\- Large car dealerships typically employ 500 people and finance their "floorplan" (inventory) with short-term loans.

\- Large restaurants typically have 100 staff.

When you throw a wrench into their cash flow, those owners decide maybe the time is right for retirement.

A similar thing happens in the accounting field.

Periodically the IRS makes major changes, and the older generation of accountants says "enough", and moves to Florida.

<comment><USER10> This is bad, but you are being way too dramatic.

If it takes two generations to recover from this, then this is worse than WW2's impact on Germany.

<comment><USER11> Please don't compare the virus with a world war.

World wars are followed by a miraculous age of prosperity. Home are destroyed and can be rebuilt, tenant and landlord alike passed away. Rent is cheaper if not free in some places. All debts are forgiven and anyway the creditor is likely to be dead. Business that closed or lost their workforce can start over from scratch.

A virus is nothing like that. It gives no boost to the economy. It doesn't make more homes available or make rent cheaper. Debts continue to accrue with interest while there are no revenues coming in.

<comment><USER12> I feel like you're missing a basic sanity check here. If your position commits you to believing that having a bunch of infrastructure blown up is _good_ for the economy, that it stimulates growth when a bunch of people die and most businesses disappear, you need to back up and think about where your train of thought got lost.

<comment><USER13> It's certainly true that the rate of profit on _new_ investments goes up when you destroy existing capital stock. In normal times, continuous expansions make bad money chase after good, and you need downturns to wipe out the malinvestments. War wipes out both good and bad money alike, so that, very temporarily afterwards, almost all investments are "good money": pick a rebuilding project and invest in it, and it'll probably turn a healthy profit.

</comment></comment></comment></comment></comment><comment><USER14> What was that about exponential growth and nature? I'm sure the 0.1% can rest on their billion-dollar laurels for the next decade, but at some point the next batch of $100-millionaires will become restless and steer they system toward their desires. I'm hopeful: greed always wins, and as a flea on the back of the big dogs, I don't need much to be happy.</comment>


Digramly - build diagrams online with great ease for free - <AUTHOR> http://www.diagram.ly/ <comment><USER2> Cute. Spent a bit of time trying to figure out how to get an arrow: It's not obvious that you need to drag to get an arrow object, because if you just click without dragging, all the other objects will create a new instance at top left. I started out assuming that the UI would be select the object, then click to make a new instance where you wanted it. So, once an object appeared, I thought the intended UI was, click to get object, move it to where you wanted. I think you need to either not create a new object unless the user does drag, so they understand that something more is required (which is how visio seems to do it) or make 'new instance at top left' work for all objects.

<comment><USER3> 'Cute' is the right word for this -- it lacks basic functionality. I've been using <http://www.lucidchart.com> for a while which is an amazing browser- based experience.

<comment><USER4> Have you tried this one?

<http://www.gliffy.com/>

<comment><USER5> That requires flash

</comment></comment></comment></comment><comment><USER6> This is the easiest and best way I've ever found to draw electrical circuits. Oh my god. So much components. I'm shaking in happiness for all the time I won't have to waste trying to fight inkscape & friends. (Not even mentioning latex packages to do this)

<comment><USER7> Circuit lab (<https://www.circuitlab.com/>) is pretty good too.

<comment><USER8> (Note: I'm a developer of CircuitLab.) It used to surprise me to see just how common it was for people to use general-purpose drawing/diagramming tools for electronics. In fact, Inkscape plus copy+paste is the de-facto schematic tool of choice for the Wikipedia project: [https://en.wikipedia.org/wiki/Wikipedia:WikiProject_Electron...](https://en.wikipedia.org/wiki/Wikipedia:WikiProject_Electronics#Drawing_circuits) ! Nothing against Inkscape -- in fact, Inkscape is what we use to prepare symbols for insertion into CircuitLab -- but it really says something about how painful a lot of electronics-specific software must be that users will jump to general purpose vector drawing tools instead.

<comment><USER9> Feature request: hold down the space bar to get a drag cursor that moves the whole workspace around. (And ideally also hold spacebar + cmd to get a zoom in cursor, spacebar + option for a zoom our cursor.) These controls are used by every Adobe app (and have been widely adopted by other drawing/graphics software) and they're amazingly useful, because they make it lightning fast to alternate between moving around the canvas and doing whatever else.

<comment><USER8> We've currently got Ctrl+Drag (or Cmd+Drag on OS X) for panning around the workspace, and the mouse wheel up/down is mapped to zooming in/out. (Probably need to better document these somewhere!) Compatibility with other keyboard/mouse conventions is something I will pass on to the UI team.

Agree about "amazingly useful ... lightning fast" to switch between modes -- we just added a keyboard shortcut for re-running the last simulation, just so we could eliminate the burden of explicit mode switching between schematic capture and simulation.

</comment></comment></comment></comment></comment><comment><USER10> It would be nice to have "gist" like functionality. Users could embed the diagrams to their blogs, others could fork their own copies.

</comment><comment><USER11> This tool badly needs to generate a URL along that top that when shared loads the diagram I just created...

<comment><USER12> We've integrated it with Google Drive, so you can now share the document via that.

</comment></comment><comment><USER13> Will give this a go next time. I have been using Lucidchart <http://www.lucidchart.com/> which is one of the better diagramming tools I've tried.

</comment><comment><USER14> For future readers: Mentioned diagramming programs/apps

<http://www.diagram.ly> (based on mxGraph, a javascript lib)

<http://www.lucidchart.com/>

<http://www.gliffy.com/> (requires flash)

<https://www.circuitlab.com/>

<http://www.umlet.com/> (download)

<http://www.flowchart.com>

<http://docs.google.com> (drawings not diagrams)

gojs.net (still in private alpha)

I'd add that I've tried:

<http://www.lovelycharts.com>

<http://www.cacoo.com> (flash)

</comment><comment><USER15> This is one of the nicest browser-based drawing tools I've seen. While I can't see it replacing Inkscape for most of my work, the ability to edit the mxGraph markup is super cool, along with the SVG export option.

</comment><comment><USER16> I like this! I tried to bookmark it with Cmd+D, and noticed you trapped that keyboard event for the duplicate function. It might be better to use shift instead of meta to avoid colliding with copy, paste, etc.

</comment><comment><USER17> I am actually looking for a decent UML editor. So I create a class, click it, expecting to get at the very least a couple of text areas labeled "Methods" and "Fields." Instead, I get a WYSIWYG editor that looks like it came out of the early 2000's. My immediate reaction was to jump back and shout "DAAAAAA!" (I am not joking about that.)

Now, obviously I don't know exactly what your target audience for this is. But in general, my experience is that if you provide a WYSIWYG editor, the users will do horrible, horrible things to your content. They are usually prone to glitching out in addition. And more specifically, for editing UML, a WYSIWYG editor is just about worthless - it provides no structure to the data, and it makes it incredibly easy to bork up the structure of the class. (Also, the editor doesn't really mesh with your site's design very well.)

So, my advice would be to provide a bit more structure to the content of individual diagram elements (at the very least, separate text boxes for Name, Methods, and Fields in a UML class), and find a less obtrusive WYSIWYG editor if you decide to continue going down that route.

<comment><USER18> OTOH, I found adding properties and methods using the text editor to be much quicker than the clicking/tabbing around in a dialog box which is the way it's done in UML editors I've used. So I don't know what the right balance is.

What killed it for me, for UML, is that the properties and methods don't have their own connector points for attaching an arrow to.

</comment></comment><comment><USER19> I have to say that this is the easiest diagramming tool I have ever used. I am impressed!

</comment><comment><USER20> Interesting. There's no Facebook 'like' button, but there are Google Plus and Twitter social networking widgets. Is this some kind of a transparent statement or a rebellious move against Facebook as a non technical target audience? ;]

<comment><USER12> Neither of us that write diagramly have a facebook account, although we do sometimes wish we had one so every person we know could invite us to take their "10 questions about your rabbit" quiz. We're too old and out of date to use this modern technology, it just gets us flustered.

</comment></comment><comment><USER21> The service is called 'Diagramly' not 'Digramly'

</comment><comment><USER22> Neat and very easy to use. This tool made me hate diagrams a bit less ;)

Obviously this is a missing component in Google Docs (and even done in the same spirit). Good chance Google will acquire this... or build their own.

<comment><USER23> Google docs does have drawing tools. Insert > Drawing...

<comment><USER22> Except Google's Drawing is a simple drawing, not a diagram.

</comment></comment></comment><comment><USER24> this is pretty sweet.

a feature that i have yet to see anywhere (which would be trivial to add, btw), is labeling the actual connection endoints, like with IP or MAC addresses in network diagrams.

also something that probably needs to be implemented in the mxGraph lib is obstacle avoidance during connection routing, so that routes don't run into or under other objects, this is non-trivial.

bonus would be allowing a connection re-route only to specific "alternate" endpoints or ones that match some definable ruleset when a block is moved around on the diagram.

</comment><comment><USER25> A few things that would make me use this:

\- Shapes for user interface widgets (windows, buttons, text fields, etc.) for desktop and mobile

\- A way to easily share my diagrams via a url (could be as easy as generating a url in the form of <http://www.diagram.ly/?diagram=[hash> of the xml])

\- Direct uploading of exported images to a image sharing website (e.g. imgur). Although you might be able to generate a little revenue by hosting them yourself and serving them up alongside an ad?

</comment><comment><USER26> Amazing tool! Well done :) Which company is behind this?

<comment><USER27> Given that it is "powered by mxGraph," which is a product of jGraph, that would seem to be the company.

</comment></comment><comment><USER5> Very very nice.

One observation, on the export it looked like it was trimming the result and not including the entire lines. I had two circle shapes, one over the other and at export it clipped the top of the top shape, and bottom from bottom. Almost like the math is calculating from the center of the line shape and forgot to account for the line thickness when calculating export cropping.

Thanks for making this tool.

</comment><comment><USER28> That is great, well done! I'll be using this a fair bit!

A thing that annoyed me, when I double clicked an object to type text it, it seemed to type the text at the top, rather than the middle of the object. Once I was done editing, it popped to the middle. Not a big deal, but the only negative thing I could find!

</comment><comment><USER14> Hmm... I might be able to us this for doing programming structure charts. I've unfortunately yet to find a program or app that has all the things I want with WYSWYG, much less groups them, but this has most of them.

Would love the ability to upload my own vectors for use, and to create a custom group of vectors.

</comment><comment><USER7> Nice work.. I didn't expect it to be so responsive. Almost feels like using a desktop application.

</comment><comment><USER29> Impressive! I especially like the image search and how it jumps right into the app without any preliminaries like a signup page or a plea for cash.

..And it exports in almost every format that matters. I'll definitely be using this next time I need to put a diagram together.

</comment><comment><USER30> I love diagram.ly. I use it all the time to create sitemaps and flow diagrams. My only complaint is that exporting diagrams doesnt always product the result you wanted the first time, but it usually just takes some setting tweaks to get it right.

<comment><USER12> If you contact us at forum.jgraph.com, we'd be interested in the input that produces the wrong output.

</comment></comment><comment><USER31> Awesome!

May lack some sharing functionality but some really neat objects available and really easy to user.

<comment><USER32> +1 on the sharing functionality.

It's great that you're just dropped into the editor, but when you actually cook up a quick little diagram there's nowhere to go but 'Export to' > 'Save to disk' > 'Open Twitter' > 'Upload & share' ...

</comment></comment><comment><USER33> Very nicely done. I like how the menu work. Especially how the Open and Save mapped to browser's upload and download. Excellent work!

</comment><comment><USER34> This is very cool. But then I look at the maker of the Diagram Library and the cost per license is $7,900 dollars ???

Talk about expensive libraries.

</comment><comment><USER35> Very timely, since I'm getting ready to plan out a major project. This is going to be prominently bookmarked. Thanks!

</comment><comment><USER36> I'm missing a simple UML dependency arrow, like the "uses" but without the text (looks cleaner IMHO).

<comment><USER12> Double click on the edge (or any cell) to edit the text. In this case, just remove it.

</comment></comment><comment><USER37> Does anyone know of a library that you could use as a basis to build similar functionality?

<comment><USER38> \- If you want just drag and drop use jQuery UI.

\- If you want to connect divs use jsPlumb.

\- If you want flowcharts use jsPlumb + jQuery UI. jQuery to drag elements on to the diagram div and jsPlumb to connect them.

You can achieve almost every thing what ever is being done here. I have used it personally to create something very similar. jsPlumb is MIT License, so you don't have worry about any thing.

</comment></comment><comment> momma-joe nice, i've been using Flowchart.com which gives me collaboration.

</comment><comment><USER39> VERY nice... will try and use that next time, well done!

</comment><comment><USER40> It is very impressive that it works flawlessly in IE7.

</comment><comment><USER41> I'm impressed it works well on an IPad - good job!

</comment><comment> momma-joe nice, i've been using Flowchart.com which offers real time collaboration too!

</comment><comment><USER42> It's awesome!! But why is it free? Seems like this is a pretty slick product that you could be making money off.

Are you hoping to be bought? Are you just trying to help people out? Are you already rich?

As I said, it's awesome, and I'm going to use it. But I just want to understand the motivation!

<comment><USER12> We don't like/understand or want to enter the market for selling to end users (low cost, high volume, high earache, low clue). We sell the underlying JavaScript diagramming library at higher cost in lower volume and I find the more developers pay, the more polite they are to deal with.

This is simply the main example application that ships with the library. We just deploy it on Google App Engine, it does all the availability and scalability for us. Because it's pretty much entirely client-side, we pay trivial costs for serving a little static bandwidth and it gives us free marketing for the library.

So, it will stay fully featured for free and I don't want to pollute it with ads and you'll be seeing a large number of new features added through this year. We're also considering open sourcing the diagramly part (not the core mxGraph, you'll be able to use that hosted Google Maps style) so people can throw up their own custom diagramly sites.</comment></comment>


More Than One Third of Tutanota Emails Are End-To-End Encrypted - <AUTHOR> https://tutanota.com/blog/posts/encryption-percentage <comment><USER2> Did they ever fix their protocol?

[http://seclists.org/fulldisclosure/2015/Jun/58](http://seclists.org/fulldisclosure/2015/Jun/58)

How do they prevent man-in-the-middle attacks on their customers, even if their server is the one performing the attack?

<comment><USER3> They commented on this on Reddit: [https://www.reddit.com/r/fulldisclosure/comments/3anfjk/tuta...](https://www.reddit.com/r/fulldisclosure/comments/3anfjk/tutanota_encrypted_email_service_malleable/)

"This is not a vulnerability in Tutanota. We have built Tutanota with multiple layers of protection for our users. We currently use TLS and DANE to protect authentication and data integrity and (only tunneled) RSA-OAEP and AES-CBC to provide confidentiality. We have always communicated this transparently, it is nothing new. Neither the confidentiality nor the integrity of our users' data has been at risk. However, we know that the implementation is not perfect regarding this detail. That is why we are going to implement the following features as soon as possible: - Signatures/MAC - 2-factor authentication - Algorithms resistant to attacks of quantum computers - Simple verification of downloaded Tutanota apps Regarding the described issue, we know of two possible attacks on AES-CBC. Neither of them is feasible against Tutanota users: - Bit flipping: You need access to the plain text email and you have to be the MITM. - -Plaintexts are available at the sender and recipient only. We use secure TLS algorithms and DANE to protect against MITM. - Padding oracle: There is no padding oracle in Tutanota. Tl;dr There is no known vulnerability in Tutanota. Security is the heart of Tutanota, and we will fix vulnerabilities immediately."

<comment><USER4> An end-to-end encrypted messaging company claiming to use DANE to protect end- users. Sheesh.

<comment><USER2> Especially when the objection I raised is that the server can perform privileged active attacks on the client software.

I'd say avoid Tutanota.

</comment></comment></comment></comment><comment><USER5> _" There is simply no reason NOT to encrypt anymore Even to people not very interested in protecting their privacy, there is simply no reason anymore to let the spies look into their mailbox while they can have exactly the same product with automatic encryption."_

Actually, there are good reasons not to: Spam filtering. People have forgotten how bad spam was. It isn't possible to fight spam centrally when all email is encrypted.

Pretending that there aren't any downsides isn't the way forward. It's important to be open about the issues at stake, then say what's possible with the tools that can be created.

<comment><USER6> Let's imagine a world where spammers has to encrypt their emails. That would initially be a hassle and resource demanding, but it would be used against spammers. The recipient could demand a resource demanding encryption which for a normal server take about a second but if you were to send out millions it would be impractical.

<comment><USER7> If that's so easy to do, why don't recipients "demand" some proof-of-work right now?

There's also exactly zero overlap between encryption and proof-of-work. I don't see why you phrase it as if encryption makes proof-of-work either possible or easy.

<comment><USER8> The network effect changes (very expensive) which limit adoption of proof of work also limit adoption of encryption. Assuming encryption is adopted, the vendor(s) involved could simultaneously demand using Hashcash or another email proof of work system.

One should seriously estimate and discuss the environmental implications of such a change before working towards it though, I think.

[https://en.wikipedia.org/wiki/Hashcash](https://en.wikipedia.org/wiki/Hashcash)

</comment></comment></comment></comment><comment><USER9> It's ironic: In many ways, the simplest problems are the hardest for hackers to solve. We naturally understand programs and protocols that flummox average users, including PGP and Bitcoin. Donning the veil of techno-ignorance is an elusive skill, so it can take a long time to figure out how something valuable can be reduced to a truly idiot-proof format.

Lots of different approaches to encryption have pitched themselves as the easy-to-use replacement for PGP. Alas, so far, none of them have taken the world by storm.

<comment><USER5> _Lots of different approaches to encryption have pitched themselves as the easy-to-use replacement for PGP. Alas, so far, none of them have taken the world by storm._

That's good, though. PGP is the only one that's given true safety. Everything else has broken, either in theory or (mostly) in implementation. The problem is a social one, and it doesn't need to be solved quickly. It's fine if it takes several more decades before we find the right model.

Those that want to protect themselves can do so. Those that don't, don't. Not such a bad outcome, all things considered.

It seems like PGP's web of trust model was the mistake, anyway. There's not much wrong with the model of "here's my pubkey, and now you can send me data securely." The key can be intercepted or subverted, but what changed since the 80's was the rise of instant messaging. In 2015, you're often talking to people in realtime, and you want to talk and send data to them securely. To do that, you're exchanging keys in realtime, over some kind of chat program. (Even emailing someone a pubkey counts as a form of chat.) In that context, the web of trust is unnecessary.

<comment><USER10> Emailing somebody your public key sounds like a really bad idea. What about your friend's evil sysadmin who replaces the public key that you sent with another one, thereby enabling MITM? You might as well not use PGP in that case. Of course, once your friend has established that it was indeed your public key, it's all fine, but doing initial key exchange over unauthenticated channels sounds like a recipe for disaster.

<comment><USER11> > What about your friend's evil sysadmin who replaces the public key that you > sent with another one, thereby enabling MITM?

You could also send with it detached key signatures from mutually trusted friends. This would add weight to your claim that this key belongs to you. Then, your recipient can check that your message's contents (including your pubkey) are signed by a key that your receiver can adequately measure authenticity. Does that seem right?

If a hostile MITM modifies your message and/or your key and signature, then these friend's signatures won't match. If they change these signatures as well, then those won't match the receiver's already trusted keys.

[Aside: One other way I have played with was to rate another signed message by a friend (who sent me his pubkey as an email attachment) with a likelihood that he wrote it, and then I checked if that message's signature matched. As a qualitative heuristic test, it did increase my confidence in that key significantly, though I would have liked to have some trusted 3rd parties witness his possession of it.]

</comment></comment></comment></comment><comment><USER12> OK, so who manages the keys, and how?

I am aware of only two general principles to do this: centralized certificate authorities (possibly chained), and decentralized assurance, a. k. a. web of trust. Their advantages and drawbacks seem pretty clear by now.

So, which is it, and if a CA (which I'd assume), who has the keys and how is crytographic trust obtained?

</comment><comment><USER13> There is nothing wrong with PGP, and I don't understand the desire to see its demise. I agree that it has not been properly integrated with MUA's to the point it is seamless for casual users, but I believe it's the best we have for now.

</comment><comment><USER14> I think that should read "Only one third of emails are end-to-end encrypted".</comment>


Unikernels: Rise of the Virtual Library Operating System - <AUTHOR> http://queue.acm.org/detail.cfm?id=2566628 <comment><USER2> The projects themselves have progressed since this article and MirageOS is doing pretty well [1]. There was also a recent HN discussion on an experiment to create (and run) one VM per URL, which was built via MirageOS [2].

Although there are many applications of the unikernel approach, a longer term goal that I'm particularly keen to work towards is the idea of distributed personal clouds. Enabling people to run their own infrastructure, without becoming sysadmins, would be pretty cool [3]. Of course, there are other ways to achieve this but unikernels offer certain benefits.

[1] [http://openmirage.org](http://openmirage.org) (I'm involved with the project).

[2] [https://news.ycombinator.com/item?id=9263146](https://news.ycombinator.com/item?id=9263146)

[3] [http://nymote.org/blog/2015/brewing-miso-to-serve- nymote/](http://nymote.org/blog/2015/brewing-miso-to-serve-nymote/)

<comment><USER3> Regarding #3, I'm working on a project [0][1] that might be able to achieve that. It's not a direct goal of the project, but could be a subset of the primary goal. The primary goal is to be able to take a system description and be able to run it anywhere, be it public clouds or private hardware.

The base image is CoreOS (so, not a uni-kernel, but still pretty sweet). You can search Docker Hub for containers and create multi-datacenter, (and soon) multi-provider clouds. I do think uni-kernels may be the way to go, but AFAICT the proper tooling just doesn't exist yet.

It's still in pre-alpha, so there are many amenities that I plan to add that don't exist yet, but it will launch clouds (what I'm calling a set of related CoreOS clusters), create fleet units, and start your applications.

If anyone's interested in helping work on it, let me know or send a PR. All the code is free (MIT) and on github (link on top-right of site).

[0] [http://www.cloud-launcher.io](http://www.cloud-launcher.io)

[1] [http://www.cloud-launcher.io?simulator](http://www.cloud- launcher.io?simulator) | Just a simulation; won't create machines; any credentials will be valid

</comment></comment><comment><USER4> I'm ambivalent about unikernels.

On the one hand, I applaud the effort to simplify the software stack and promote the use of a safe language all the way down.

On the other hand, I wonder if running lots of small OS kernels on a hypervisor is the best way to do this. Might it be better to simply run each application as a process on a conventional OS kernel, perhaps with containers for isolation? This post from Brendan Gregg argues pretty convincingly that virtualization imposes a substantial performance penalty:

[http://dtrace.org/blogs/brendan/2013/01/11/virtualization- pe...](http://dtrace.org/blogs/brendan/2013/01/11/virtualization-performance- zones-kvm-xen/)

I understand that a key premise of the unikernel approach is that the millions of lines of C code in a conventional OS kernel like Linux are a problem. But in any real Xen deployment I'm aware of, Linux is running in dom0 anyway. So why not take Xen out of the picture and run each application as a process in a container on Linux, using raw sockets so you can still implement the TCP/IP stack in OCaml? For deployments on Amazon, I guess the unikernel approach has the advantage that you're running on top of Xen anyway, so you're eliminating a layer. But for running on one's own servers or an ARM-based device like the Cubieboard2, it seems to me that Xen is just complicating things.

I guess one benefit of Mirage's use of the OCaml module system is that we can experiment with multiple deployment approaches and use whichever one works best in practice. So there's nothing stopping me from running a Mirage application on Linux with raw sockets rather than as a Xen unikernel.

<comment><USER5> > I guess one benefit of Mirage's use of the OCaml module system is that we > can experiment with multiple deployment approaches and use whichever one > works best in practice. So there's nothing stopping me from running a Mirage > application on Linux with raw sockets rather than as a Xen unikernel.

That insight is spot on. The reason we're spending so much time on the clean- slate MirageOS stack is that it's a codebase that will last the test of time. It makes it possible to build code that's more future proof against changes in deployment environments. It's Xen/KVM/vSphere today, JavaScript and Docker tomorrow, and probably Unix sockets forever, all from the same codebase. Our use of OCaml + functional programming also had a good trajectory with practical formal verification, so the future of the stack is exciting.

</comment></comment><comment><USER6> In general, I get the impression that the whole virtualization trend is just a way to re-invent process isolation with newer technology.

<comment><USER7> The process isolation is very useful _but_ they've got a point, why we should run million lines of code until we get to the point to run a single web server? Have we ever asked our self why the operating system which its only responsibility is running a web-server should take 300 seconds to boot?

<comment><USER8> Boot time is rarely an issue when working with long running daemons such as web servers.

We run the millions of lines of code because web servers typically serve up web applications which in turn depend on a whole host of infrastructure being available. The millions of lines of code support all the possible hardware that you could throw at it (and so you can save some if you compile your kernel just for that purpose), and if you know exactly which services your web-app will depend on then you can prune even more.

Specialization always pays off in terms of efficiency and it always costs in terms of ease of expansion and adaptation to future needs.

<comment><USER9> Boot time of a server is somehow important when you dynamically spin new instances. If spinning a new instance were a sub-second process, you could allow the number of instances you run (and pay for) to follow the demand much more closely.

But here the boot time is a proxy metric of complexity.

It's great to have software that can do a wide spectrum of things. But your server most often does a _narrow_ spectrum of highly predefined tasks. You often go to great lengths to obviate and disallow any other activity on it, for security reasons.

So it would be great if you took the universal software, somehow cut it to your task set, and could throw away the unused parts (which are 90%+). Unfortunately, this is not really attainable with traditional OSes. Unikernels allow you to do just that—with some quite noticeable limitations, as of now, though.

</comment></comment></comment></comment><comment><USER10> It is somewhat disappointing to see the term "OS virtualisation" used to describe what is really still just virtualised hardware; albeit with a less traditional OS on top of the HVM hypervisor. It makes more sense to reserve the term to distinguish container-based technologies, where what is virtualised _is_ the operating system -- not the hardware it runs on.

<comment><USER5> The term "OS virtualisation" is just fine here -- it refers to the support required to virtualise an operating system, which conventionally means the device driver, scheduler and memory interfaces. Providing such a layer lets any reinterpretation of "OS" still run above it.

Container-based technologies are far more nebulous in their definition, since it covers individual operating system concepts that don't quite migrate across distributions. FreeBSD jails, Solaris zones, LXC, MacOS X app sandboxes are all container-based virtualisation, but differ greatly in their details and specific interfaces.

</comment></comment><comment><USER7> This reminds me of Ling/Erlangonxen, unfortunately Ling is not a free- software, it's opensource but not a free-software.

And the fact that your operating system is the actual language you're coding with, reminds me of the fantastic project by Niklaus Wirth, The Project Oberon. The project Oberon is a language and operating system you can learn more about it at [http://www.inf.ethz.ch/personal/wirth/ProjectOberon/](http://www.inf.ethz.ch/personal/wirth/ProjectOberon/), [http://www.inf.ethz.ch/personal/wirth/](http://www.inf.ethz.ch/personal/wirth/) and a video by professor Niklaus Wirth himself: [http://bit.ly/1ClvKSX](http://bit.ly/1ClvKSX)

<comment><USER11> How is Ling not free software? From its LICENSE¹, it's using the Berkeley DB/Sleepycat license, which is considered Free by both the OSI and FSF.

¹ [https://github.com/cloudozer/ling/blob/master/LICENSE](https://github.com/cloudozer/ling/blob/master/LICENSE)

</comment></comment><comment><USER12> Is there a project for a DBMS on MirageOS? I would relay like to try out MirageOS on a web shop project of mine, but can't imagine to start writing a database, or even a file system to store images..

<comment><USER5> There are three ongoing efforts:

1) The Irmin Git store, which is designed to run both on Xen unikernels and in JavaScript. Thomas Leonard is working on integrating the latter, with very promising results for a React-style interface in the browser. Thomas Gazagnaire is integrating the Xen backend at the moment. Expect an announcement of both of these just as soon as they're ready.

2) The Rump Kernel project has very promising results with MySQL running as a unikernel, so we're working on integrating a MirageOS frontend with a MySQL backend unikernel.

3) The Ctypes library (0.4) that's just been released supports Xen compilation for OCaml bindings, so writing bindings to Sqlite would let you link in directly with a unikernel; [https://github.com/ocamllabs/ocaml- ctypes](https://github.com/ocamllabs/ocaml-ctypes) . There's an ORM we wrote ages ago with this in mind: [https://github.com/mirage/orm](https://github.com/mirage/orm)

So the db efforts are full steam ahead at the moment, but no fully released one yet for production. Keep an eye on the blog at [http://openmirage.org](http://openmirage.org), or drop a note to <mirageos- email@example.com> for your intended usecase.

One interesting advanced prototype that Dave Scott from Citrix built is the XenStore database as a unikernel (that powers inter-VM communication) on top of Irmin. Video: [https://www.youtube.com/watch?v=DSzvFwIVm5s](https://www.youtube.com/watch?v=DSzvFwIVm5s) and a presentation at the Xen Developers Summit: [http://decks.openmirage.org/xendevsummit14#/](http://decks.openmirage.org/xendevsummit14#/)

<comment><USER13> > 2) The Rump Kernel project has very promising results with MySQL running as > a unikernel, so we're working on integrating a MirageOS frontend with a > MySQL backend unikernel.

Interesting. The big issue I see from the proposed model (spin up your application on-demand) is the need to retain a long-lived connection pool to a "traditional" container/machine with a standard relational database (the cost of reestablishing a connection every time would obviate any benefit of the scheme).

<comment><USER5> That's true with a TCP connection and its three-way handshake. With a shared memory vchan across two VMs, establishing a connection is less than a millisecond (if that).

<comment><USER13> Sure, but if you're using both a read/write master and a hot standby for read- only queries on another machine, you're going to need TCP.

</comment></comment></comment></comment></comment><comment><USER14> My first thought when reading about MirageOS was that they are effectively cramming DOS into a VM.</comment>


The Rise of the Cryptopticon - <AUTHOR> http://www.iasc-culture.org/THR/THR_article_2015_Spring_Vaidhyanathan.php

<comment><USER2> Privacy rich vs privacy poor is still a thing these days. I think it will be a great day when not especially tech savvy individuals can opt into being privacy rich. What alarms me is how absurdly difficult it is to get bulletproof opsec for even the most mundane everyday tasks. Somewhere in the early 2000s smart-phones were still being marketed as phones. Now it's abundantly clear you own a beacon and a piece of SIGINT-enabled closed- hardware. This is interesting reading, but throughout the piece, I couldn't help yell: "Throw out your f __king smartphone then " if you are averse to spying.

<comment><USER3> > "Throw out your fking smartphone then" if you are averse to spying.

It was like I was reading something I'd written, right up until this last bit.

(Just some thoughts. Not taking a point with or against you here.)

People want normality. Smartphones are normal, and so normal people want them. I feel strongly that normal people also want privacy, but only enough to say so and not enough to be inconvenienced or live abnormally. If told that normal smartphones are incompatible with privacy, they will then start saying things about not really needing or valuing privacy.

Cognitive dissonance in action.

imho the fix is still to work at making larger chunks of privacy free for normal people :)

<comment><USER4> No reasonable person would forgo a smartphone. And indeed, doing so would be abnormal, and so bad OPSEC. What's crucial, I think, is being present at all times to the fact of total surveillance. Given that, we can choose sometimes to put the smartphone in a sound-proof Faraday bag. Or use a VPN and/or Tor. Or whatever is appropriate to the context.

<comment><USER5> What are the circumstances where normal people would need a soundproof faraday bag?

<comment><USER4> Going for an interview over lunch?

</comment></comment></comment></comment></comment><comment><USER6> Note:

"Cryptopticon" (cf. "Panopticon")

not

"Cryptonomicon" (Neal Stephenson novel)

\----

Not that this isn't a valuable and fascinating article (and extremely relevant to anyone who connected with that novel), but noted for other inattentive readers who potentially started into it expecting something else.

</comment><comment><USER7> This piece is a well-built observation; woven from the oft frayed edges of film and books. Really cool to see someone have moderately concise and clear thought that binds across the many fields interested in their respective piece of the larger "issue" facing our current moment.

It's difficult to not share in the author's ambivalence, if not disdain, for the passing dawn of techno-omniscience.

It's that theme of the opacity of the motivations creating a fear response that's most interesting. Yes, we are enjoying these things because they are designed to be enjoyable, free, helpful. But, how is this going to bite me and/or us in the ass once it's beyond the ability to rein it in?</comment>


ImGui: Bloat-Free Immediate Mode Graphical UI for C++ with Minimal Dependencies - <AUTHOR> https://github.com/ocornut/imgui <comment><USER2> I made a similar thing (c++ opengl gui) and ported it to webassembly

[http://shi-yan.github.io/AssortedWidgets/](http://shi- yan.github.io/AssortedWidgets/)</comment>


Ask HN: How do you avoid writing buggy Java code? - <AUTHOR>

<comment><USER2> You could do this (although it is likely to be impractical): avoid writing java code altogether. Use a language with better abstraction features like Scala or Clojure. Those two compile to JVM bytecode so you could still use them in your java project.

</comment><comment><USER3> haha... Is this a joke?</comment>


Show HN: A ratings visualizer for tv shows - <AUTHOR> http://www.showplots.com/ <comment><AUTHOR> A small group, including myself, built this as part of a learning project. We used Angular, Node, Express and D3. Any feedback would be greatly appreciated.

</comment><comment><USER2> very clever name choice.

</comment><comment><USER3> so cool!!</comment>


Show HN: Poke – An anonymous proximity messaging app for web - <AUTHOR> https://poke.sh <comment><USER2> Not working on phone. geoLocation request timed out. tried several times.</comment>


Codesearch: indexing and performing regex searches over large bodies of code - <AUTHOR> https://github.com/google/codesearch

<comment><USER2> For those who don't know this codebase was originally on code.google.com and was recently moved over.

Codesearch also powers etsy's Hound ([https://github.com/etsy/Hound](https://github.com/etsy/Hound)) which is pretty cool.</comment>


IE10 Platform Preview 2 Released - <AUTHOR> http://blogs.msdn.com/b/ukmsdn/archive/2011/06/29/ie10-platform-preview-2-released.aspx <comment><USER2> IE's rate of adopting new features seems to be catching up with the other browsers. For technical details, see their Guide for Developers [1].

The interesting bits since the 1st preview (for me, a web developer) are:

        More CSS gradients
        Async script tags
        Form validation
        Web workers
        Drag and drop and File API

Things I'd really like to see in IE10 before its released (and are hopefully realistic):

        More HTML5 form stuff
        CSS3 text shadow
        CSS3 animations and transitions
        History API

As I'm wishing away, I'll add: support for XP, WebM/Ogg video support and a friendly public bugtracker.

[1] <http://msdn.microsoft.com/en-us/ie/gg192966.aspx>

<comment><USER3> I agree that those four items you mentioned I think would make IE10 a very competent browser. Do you have any idea how hard they each are to implememnt (since they've all been implemented in existing browsers)?

Regarding XP support -- I hope they never support it. I really wish the OS would go away. They do support WebM today, just install the codec. Presumably if you have Chrome on your machine, WebM will work with IE (I assume Chrome installs the codec). Given that IE is not open source, you will almost certainly never see a public bugtracker.

<comment><USER4> Agreed on XP. It's just a complete dead-end waste of effort at this point. XP is already 11 years old, and _two_ major releases have happened since. Even RHEL2 is newer!

It was plenty good 6 years ago, but time marches on.

</comment></comment></comment><comment><USER5> Big win here (for me) was the File API finally got added so you can do DnD uploads now. IE has actually supported the DnD API for a while now, but didn't have the File API component to make the upload happen.

Rendering speed didn't seem much different than 9 and slower than Chrome 12 for me; not by much though. Now adays it seems all these browsers are rendering at insane speeds given what they could barely pull off 5 years ago.

I love the browser wars.

<comment><USER6> There is a polyfill out that handles the lack of File API in IE and earlier versions of Safari; <http://sandbox.knarly.com/js/dropfiles/>.

Also, great list of polyfills available at the Modernizr github repo; [https://github.com/Modernizr/Modernizr/wiki/HTML5-Cross- brow...](https://github.com/Modernizr/Modernizr/wiki/HTML5-Cross-browser- Polyfills) .

</comment></comment><comment><USER7> You can run the examples at <http://ie.microsoft.com/testdrive/Views/SiteMap/Default.html> with your favourite browser and sneak at the code. Great if you are familiarizing yourself with HTLM5 and CSS3.

</comment><comment><USER8> Some of the most interesting work is only hinted at in the blog. IE 10 PP2 now leads on EcmaScript standards conformance.

IE 10 only fails 7 tests compared to 200 for Firefox 5 out of a total of 10000 tests.

I don't use Opera, but according to this page <http://en.wikipedia.org/wiki/ECMAScript> Opera lags the other browser and fails 3000 tests. Does anyone have Opera and willing to run the conformance test here: <http://test262.ecmascript.org/>

<comment><USER9> FF5 is a production release, IE10 is a "platform preview". Not exactly a fair comparison.

<comment><USER8> That's a good point. It would be interesting to get a read on the latest Aurora builds. I might install it and do it later today.

<comment><USER10> I can help with that, I am running Nightly 7.0a1 (2011-06-29) My results: Tests To Run: 10935 | Total Tests Ran: 10935 | Pass: 10732 | Fail: 203 | Failed To Load: 0

</comment></comment></comment></comment><comment><USER11> Still won't run on XP.

But all the other advanced browsers, Chrome, Firefox and Opera will (with hardware acceleration).

(oh and Microsoft forced an OS update yesterday that installed .NET to the useragent in Firefox, AGAIN)

</comment><comment><USER12> Awesome, loving they added FileReader and drag-n-drop. Also definitely love that they added media queries, but I thought that was crucial for IE9 so they get no brownie points here.

Now, how about WebGL and WebM? Eh? Eh? Eh. Oh well.

</comment><comment><USER13> I really love the "selectable rendering engine" in the menus. It is a bit quirky when trying to switch back and forth, but seems to switch okay from the one used to render the page into the one of your choosing.

Also, it was via this release that I learned about the .exe.local directory. There is a "iepreview.exe.local" directory which evidently supersedes the DLL search path (and that is probably how they are able to package all the render engines in a "live" copy of Windows).

</comment><comment><USER14> Has there been a formal announcement from Microsoft on what the IE release schedule will be going forward? It seems the competition from the likes of Firefox and Chrome has accelerated IE's roadmap.

</comment><comment><USER4> I am loving this minimalistic window. Give me a little address bar, a half- decent bookmark menu, and I'm sold.

</comment><comment><USER15> Glad to see the addition of the HTML5 input types. The lack of support in ie9 held back using them for me.

</comment><comment><USER16> Did they fix that godawful UI with regards to squeezing in the url bar next to the tabs?

<comment><USER17> IE's platform previews are simply minimal-chrome wrappers around the rendering engine. You'll need to wait until an IE 10 beta appears to find out what they've done to the UI.

</comment></comment><comment><USER18> Spells good news for the web in general.

</comment><comment><USER19> Good work Microsoft for taking things seriously.</comment>


Another Ten One-Liners from CommandLineFu Explained - <AUTHOR> http://www.catonmat.net/blog/another-ten-one-liners-from-commandlinefu-explained

<comment><USER2> Be careful with that wget -r.

Use -np to make sure that wget doesn't go up a directory tree from where you start.

<comment><USER2> This comment also makes me think that wget was made for a different time, a different web.

I guess a wget for web 2.0 would be neat. It's still a super useful tool, though.

</comment></comment><comment><USER3> The "read wikipedia via DNS" one was slick.

</comment><comment><USER4> I use sshfs and backintime in my scheduled backups.

</comment><comment><USER5> good stuff those one-liners are</comment>


/u/161719 tells us all why surveillance is not OK - <AUTHOR> http://www.reddit.com/r/conspiracy/comments/1fwj66/u161719_tells_us_all_why_surveillance_is_not_ok/ <comment><USER2> I like this a lot. It does a good job of dispelling the poor I've-got-nothing- to-hide defense. Being against a surveillance state isn't about being against the state being able to prosecute criminals, it's about being against giving the state (a group of people) the architecture to leverage personal information to maintain a political agenda. This sounds conspiratorial in the US and, I think, for now, it kind of is. However liberty is chipped away in bits and pieces, not in broad swings of an axe.

"161719" is absolutely right, it probably won't be Obama, or the next President, or the President after that abuses the surveillance architecture that has been put in place. However, the day will come when the chips are down on some administration, because of some terrorist attack (domestic or foreign) or politically volatile situation, and there will be immense political and moral support for them to utilize our, now, nascent surveillance architecture to stop bad things from happening that are morally gray (like a political movement that is highly divisive). That's the nightmare scenario. Those who take the government's surveillance abuses seriously aren't (de facto) anti- security or anti-law-and-order they are concerned, I think, rightly so about the path we are headed down.

<comment><USER3> >"161719" is absolutely right, it probably won't be Obama, or the next President, or the President after that abuses the surveillance architecture that has been put in place.

You'd be surprised how fast things can go downhill under proper conditions.

In 1984, Sarajevo, which prided itself as being the most cosmopolitan and tolerant of cities in Yugoslavia, was at the top of the world. At the time, Yugoslavia a very advanced and prosperous country with the world's sixth largest army and fifth largest air force (by air assets), and nearly matched the largest economies of the Eastern Block by GDP (Poland and Czechoslovakia). It also enjoyed significantly more political freedom than the Eastern Block, with most citizens able to freely travel to both Western Europe and the Eastern Block countries.

That year, Sarajevo hosted the Winter Olympics, and basked in the admiration of the world. There was little to no talk of "ethnic tensions" or "ancient hatreds", and all three major religions mixed freely, along with a sizable Jewish population dating back to the 1400s. Sarajevo had by far the highest rate of interreligious marriage of any Yugoslav city.

Six years later, Bosnia was in a state of horrific sectarian war, Sarajevo was under siege, and a campaign of religious genocide against the local Muslim population was well underway in the countryside around the city. War refugees brought with them tales of violence unheard of in Europe since the Nazi years. The brutal war lasted for another 3 bloody years, with almost 200,000 dying in Bosnia alone from the violence.

My point is, given the right conditions, things can go downhill from "pretty good" to "god-awful" incredibly fast.

<comment><USER4> From my quick skimming of Yugoslavian history, the period from the end of World War II and in particular the 1970s up to 1986 was actually frought with economic and ethnic tensions. One of the sections of the Wikipedia page is titled "Ethnic Tensions and Economic Crisis." [1]

People should also note that the Ukranian activities have been a long, unfolding process - there was the Orange Revolution there just 10 years ago. The recent events are not unanticipated.

I mention these b/c your post refutes the PP's belief that the U.S. is far from "downhill." I do not believe the U.S. is anywhere near "proper" :) conditions for things to go downhill. It is still wise for us to inhibit the growth of surveillance apparatus, but the U.S. is quite different from the war-torn former Communist republics. We have had some challenges like recessions, the Enron scandal, etc., but we are simply too large, too diverse and have too much momentum for damage in any part of our country to spread and threaten the entirety of it.

I believe the majority of the spying apparatus which has been uncovered has been for national and individual economic cheating and gaining military initiative rather than controlling the population. Gaining access to individuals of interest, however, is a handy fringe benefit, I imagine, and we should certainly curtail the growth of systems which abet this activity. We could start by not working for and not letting our friends work for, the architects and implementers of these systems! Of course it's not a problem for most of us in this particular sphere, because so many of us focus on delighting and creating value for customers instead! yay!

[1] [https://en.wikipedia.org/wiki/Yugoslavia](https://en.wikipedia.org/wiki/Yugoslavia)

<comment><USER5> I'm not necessarily arguing with you, but the Wikipedia page was obviously written long after the Yugoslav wars. Hindsight is always 20/20 -- after any major event, we can go back and pick out the causes, but that doesn't mean the causes were apparent or even extraordinary at the time. It's just an effect of confirmation bias.

Suppose the parent was correct and the US was a decade from the same sort of chaos. In such a 2024 world, loads of people could write about the conditions that led up to the current conditions. The rise of the surveillance state, the beginnings of an anti-government movement in the Tea Party, those things would be obvious in 2024. However, if (as is more likely) 2024 America is a lot like 2014 America, no one is going to be writing those articles about how the rise of the surveillance state led to...not much.

<comment><USER6> I remember how the conflict started in Slovenia. It was initiated by the Yugoslav federal army, which was Serb-dominated. To think of an analogous sequence of events in the U.S., you'd need the U.S. army dominated by one faction, e.g. Texas. Then say California decides to secede because they are tired of giving money to support red states. Federal army comes in (or actually is already in) and starts shooting at state-level national guard and police. That's roughly what Slovenia was like.

It's a huge stretch because the U.S. doesn't really have ethnic factions like YU used to. And its army is not really Texas-controlled, or even if it were nobody would care. :-)

</comment></comment></comment></comment></comment><comment><USER7> I think this story is touching. But it misdiagnoses the real danger facing the US at the present time and misapplies the lesson to be learned, which no doubt is applicable in some parts of the world.

The real danger facing the US at the present time is not of becoming a fascist surveillance state. It's of becoming a corporation, with a vast sea of indentured servants, where the owners of the corporation are a small group of people with wealth beyond one's wildest dreams. This is the dystopian scenario that Orwell would write about if he were alive today. In this future, you will have to be on good terms with the management of the corporation, or you will find yourself in great difficulties. The owners will take pride in the acts of charity and goodwill that they bestow upon you, the poor, and will expect gratitude in return.

<comment><USER8> Corporations are many. Government is one. Corporations don't have police force or armies because they would be paying for them out of their own pocket. Instead, they lobby the government to use violence/regulation/wars where it is required for profits, and then taxpayers pay for it.

So, what you really want, is remove opportunities for corporations to use free money. Then everything they do, they'd have to pay for out of their own pocket. And that would be a game changer.

<comment><USER9> The thing is, large corporations aren't many; they aren't one either, but they're a few. The number of powerful conglomerates in the US is comparable to the number of states (maybe double). There's plenty of power for each, and without a strong central government, those corporations will merge to form fewer, more powerful ones.

This isn't hypothetical. This was the situation in the US about 100 years ago when the robber barons ruled the country. And by the way, some of them did pay for their own police force (the Pinkertons) to fight the unions.

</comment></comment></comment><comment><USER10> I'd love to share the optimism that the genie can be put back in the bottle, but I don't.

When we talk about surveillance on western forums, we mostly refer to the work by the five eyes community, but they're not the only community interested in or doing this sort of thing. Russia's SORM-2, expanded for the Sochi Olympics is a prime example, the Chinese have something similar too.

The fact is that even if western governments turn round to their intelligence agencies and tell them to stop all of this, other countries will still fill the gap.

If Germany tells America to stop spying on German citizens in Germany, do you think America will stop spying on them? No, of course not. Do you think the German intelligence community will give up benefiting from such information if it helps them bypass any new privacy laws put in place? No, of course not.

It's here. The difference between the Stasi and the NSA when it comes to surveillance is not intent, simply capability. Any intelligence agency that would've had this level of capability would've pushed it as far as they can, it's what they do and they're not going to change.

<comment><USER11> Of course there will always be bad guys out there trying to subvert freedom. I think it's reasonable for those of us in the "free world" to expect our governments to help defend us from these bad actors, not use our taxes to fund them!

<comment><USER12> "If only it were all so simple! If only there were evil people somewhere insidiously committing evil deeds, and it were necessary only to separate them from the rest of us and destroy them. But the line dividing good and evil cuts through the heart of every human being. And who is willing to destroy a piece of his own heart?" ― Aleksandr Solzhenitsyn, The Gulag Archipelago: 1918-1956

<comment><USER11> Cute quote. Now explain how it relates to my point. Here it is again, for your convenience: Evil _may be_ inevitable, but that doesn't mean it must be government funded.

</comment></comment></comment></comment><comment><USER8> But people can still vote and I'm sure that voting and democracy will help them elect honest leaders who have their best interest in mind, right? I mean, it worked in 2008 with Obama, right? Right?

<comment><USER13> You are being sarcastic, right?

<comment><USER13> I guess some people genuinely believe that they "choose" their leaders. Ok.

<comment><USER8> I was being sarcastic, yes.

<comment><USER13> Ok. I was referring to all the downvotes on that question.

</comment></comment></comment></comment></comment><comment><USER14> It's funny he mentions animal rights activists...

[https://www.youtube.com/watch?v=u6QbLK5aySU&t=2m47s](https://www.youtube.com/watch?v=u6QbLK5aySU&t=2m47s)

The actual document he is referring to: [http://imgur.com/NobVcQD](http://imgur.com/NobVcQD)

</comment><comment><USER15> The problem is, its very hard to deter a government from surveillance. And its almost impossible to even build tools that will stop governments from prying - if they wish to do so (The problem is not crypto of course). That is why we started building [http://bit.ly/blibonline](http://bit.ly/blibonline) \- but then its no match to any government.

<comment><USER16> Government should really lose it's practical power on many matters.

Examples: government officials actually should be very transparent, as in "they can't refuse they are constantly monitored by public". Legal opportunities for various kinds of "closed doors negotiations" should be sharply reduced, as in "closed door negotiations are only allowed in cases 1), 2) and 3)", for example, military, international talks. Many decisions involving specific actions are required to have the name of the decider, who is both required to be questioned by public and, if public decides, removed from the position (mechanism of decision is another matter).

</comment></comment><comment><USER17> r/conspiracy is a joke full of hyperbole. That's a pretty large jump from Snowden's NSA leaks to the government using threats regularly to control people to full on civil war with all journalists dead or in jail.

<comment><USER14> 1) the original post was not made on /r/conspiracy, it was crossposted there after the original was inexplicably deleted and the user banned 2) the federal government does use threats to coerce people to snitch on their peers 3) the federal government has in the past and is currently prosecuting journalists in leak investigations, with jailtime being a possible outcome. If you widen the scope you can see that they actively suppress journalists overseas who raise inconvenient facts about US policy.

<comment><USER18> Where was it posted originally?

<comment><USER14> [http://www.reddit.com/r/changemyview/comments/1fv4r6/i_belie...](http://www.reddit.com/r/changemyview/comments/1fv4r6/i_believe_the_government_should_be_allowed_to/caeb3pl)

There. Whole bunch of drama, as you can read about if you enable subredit CSS.

<comment><USER19> So apparently he criticized Israel -- which you can do in Israel, but not in the US. It's not worth the drama to discuss any of that.

<comment><USER20> You certainly can do it in the US. Perhaps something special about the (sub) reddit thread?

<comment><USER5> Sure, you _can_ , but it's not politically acceptable by either side of the political spectrum.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> For anyone who owns a website, remember to sign up for [http://thedaywefightback.org](http://thedaywefightback.org).

</comment><comment><USER22> I don't like conspiracists. I think their motive is good, but the result is always poor and often irrelevant because it's politicized.

That story is just over-reaching.

Conspiracy is a dog biting its own tail, I'm sure many people try to use conspiracy for political goals, just like Nazi propaganda did.

If I were a politician, there are many ways I could use conspiracy theories to change the public opinion. I don't think it entirely make any conspiracy theory wrong, but as always, be careful of movements of groups of people.

If you don't understand what I mean, watch Promised Land (Gus Van Sant movie with matt damon about fracking in a small US town). It describes very well how to use FUD in politics to efficiently change the public opinion.

<comment><USER23> this person claims to be a victim of oppression and surveillance, and you're comparing the recital of this story to nazi propaganda. ok.

i don't see how the story is over-reaching. people like you are the reason systems like prism exist - "oh, things got bad in some far away country, but this is _america_ , something like that would never happen here. _our_ politicians would never abuse the powers they are illegally giving themselves, so we don't really have anything to worry about".

this is the world we live in now. things are going to get worse before (if) they get better. unfortunately, i may never be able to tell you "i told you so", because in the future there may be no platform for us to express our discontent.

<comment><USER22> > "oh, things got bad in some far away country, but this is america, something > like that would never happen here. our politicians would never abuse the > powers they are illegally giving themselves, so we don't really have > anything to worry about".

I actually believe free speech is a strong set of checks and balances, which once acquired, is hard to remove. It's a strong safety against abuse. It's something people actually believe in. Do you really think evil people are crazy enough to plot against free speech ? It's easier to just use free speech to prove someone's claims are stupid.

Oppression occurs mostly because of economics, not because of surveillance.

Aren't you happy Snowden remembered free speech ? It's a great example of summoning the courage to defend important concept, but there is no reason to compare a developed country, democratically-elected government, using congress and plenty of other of other functional institutions, with developing and third world countries. You got to watch history too.

On top of it, I agree about how surveillance can be used to blackmail people, but I doubt you can entirely shut dissent with just blackmail. Blackmail is not a good thing, but you can't honestly believe, with the amount of communications and books, that Orwell predicted the future. Orwell warned us, just like Huxley, so it's not like it's going to happen in the US.

I just want to have a honest debate, and I will shoot any emotional attempts to explain how this or that is good or bad, because it's not enough. This comment is just using emotions and fear to make a point. FUD if you prefer. I want to believe that surveillance is setting an apocalypse, but I'm just skeptic enough to just think twice.

</comment></comment></comment><comment><USER24> This post strongly reminded me of Beatrice and Virgil.

I'd like to point out that the protagonist loses the moment he turns on his friends. That's the turning point.

</comment><comment><USER25> The mechanisms for surveillance and the political will to oppress are orthogonal. The Gestapo didn't need XKeyscore.

</comment><comment><USER26> The problem with this is he's assuming the US government is the same as his. It's not. If the government emailed you a sexy picture with threats, how long before you show it to the press and the police? Remember, local police are not under the jurisdiction of the federal government. Neither is the press. Nor are state and local government officials. It's not the same. Any comparison is naive.

</comment><comment><USER27> this story sucks (downvote me, I don't care)

/u/161719 is not even good for writing fiction; is not even good for writing anything at all</comment>