Google Will Soon Shame All Websites That Are Unencrypted - <AUTHOR> http://motherboard.vice.com/read/google-will-soon-shame-all-websites-that-are-unencrypted-chrome-https <comment><USER3> Which is hilarious because the reason I can't switch The New Yorker website to HTTPS is because of ads - which I'm getting from Google DFP which allows non- secure ad assets.

In short; Google will penalize me because I use Google.

The universe has a sense of humor.

<comment><USER4> Similarly, Google claimed they would start penalizing websites that showed full-page ads for mobile apps instead of showing you the website. But every single time I try to get to Gmail, or Drive, or Calendar, or _any_ Google service on the web using a mobile device, I'm shown a full page ad for a mobile app. Google has been doing this for years, and it seems like it's also been a year since they said they'd punish all sites that do that. But Gmail still turns up as #1 in search results for email, so does calendar, etc. It seems to me that they have whitelisted themselves and choose not to punish any Google property that breaks the Google rules, despite claiming to do so.

Edit: Typically, when a service tells me "no you can't use this service until you view a full page ad" I just give up and not bother continuing to the service. But the same is not true for Google. I reluctantly click through the full page ad every single time. It's incredibly annoying that I let them get away with this and still use the services. They are so outrageously arrogant about it and it bothers me greatly, but still, I don't change.

Edit 2:

Going to calendar.google.com: [http://i.imgur.com/fNRhhYx.png](http://i.imgur.com/fNRhhYx.png)

First results for searching 'calendar': [http://i.imgur.com/l3A5Wlh.png](http://i.imgur.com/l3A5Wlh.png)

<comment><USER5> > _First results for searching 'calendar':_ > [http://i.imgur.com/l3A5Wlh.png](http://i.imgur.com/l3A5Wlh.png)

Well in your screenshot it seems like you scrolled down on the "calendar" search results. I get some other random thing ahead of Google Calendar, in incognito or not.

It is really annoying (I too hate those things, I would have installed the app if I wanted the app), but the click through thing only happens once in my testing. Are you clearing your cookies regularly?

<comment><USER6> How about using a software to get rid of google ads?

I can erase google ads from DNS level. Users can never reach any google ad at all.

What you think?

<comment><USER7> Adaway was already invented ;)

</comment></comment></comment></comment></comment><comment><USER8> The article title really, _really_ needs an extra word: "Chrome", between "Google" and "Will". At first glance I thought it would be about the search engine, which would be a very disturbing thought indeed; it's already hard enough to find the older, highly informative and friendly sites --- which often are plain HTTP.

Nevertheless, quite convincing security arguments aside, I feel this also has a very authoritarian side to it: they are effectively saying that your site, if it is not given a "stamp of approval" by having a certificate signed by some central group of authorities, is worthless. Since CAs also have the power to revoke certificates, enforced HTTPS makes it easier to censor, control, and manipulate what content on the Web users can access, which I certainly am highly opposed to. I can see the use-case for site like banks' and other institutions which are already centralised, but I don't think such control over the Web in general should be given to these certificate authorities.

With plain HTTP, content can be MITM'd and there won't be much privacy, but it seems to me that getting a CA to revoke a certificate is much easier than trying to block a site (or sites) by other means, and once HTTPS is enforced strongly by browsers, would be a very effective means of censorship. Thus I find it ironic that the article mentions "repressive government" and "censor information" \--- HTTPS conceivably gives _more_ power to the former to do the latter, and this is very much not the "open web" but the centralised, closed web that needs approval from authorities for people to publish their content in.

There's a clear freedom/security tradeoff here, and given what CAs and other institutions in a position of trust have done in the past with their power, I'm not so convinced the security is worth giving up that freedom after all...

<comment><USER9> What we really need is opportunistic unauthenticated encryption with key pinning as a fallback between CA-signed https and plain http. Beating mass passive snooping is worthwhile even if MITM is still a risk.

<comment><USER10> The Fenrir project does something like this. They first establish a encrypted connection and then you can authenticate, or not. The authentication can also be federated.

Its pretty cool, but its not production ready.

The GNUNet has multible layers and do bottum up encryption on the lower levels.

</comment></comment></comment><comment><USER11> Consider this:

\- Squarespace doesn't support SSL (other than on their ecommerce checkout pages) [1]

\- Weebly only allows it on their $25/mo business plan [2]

\- Wordpress.com doesn't support SSL for sites with custom domains [3]

\- If you've never experienced the process of requesting, purchasing, and then installing an SSL certificate using a hosting control panel like Plesk or cPanel, let me tell you–it's a nightmare.

All that to say, this is an interesting development that will leave a large % of small business websites with a red mark in their browser.

[1] [https://support.squarespace.com/hc/en- us/articles/205815898-...](https://support.squarespace.com/hc/en- us/articles/205815898-Does-Squarespace-support-SSL-access-)

[2] [http://www.weebly.com/pricing](http://www.weebly.com/pricing)

[3] [https://en.forums.wordpress.com/topic/support-for-https- for-...](https://en.forums.wordpress.com/topic/support-for-https-for-custom- domain)

<comment><USER12> Then maybe those platforms will finally implement it. In any case, there's an alternative: putting Cloudflare in front of the site. In fact, Google shows me a guide to do so when I search for "squarespace ssl".

Of course, that's hardly as secure as end-to-end HTTPS, but still, I trust the path between CF and SquareSpace much more than between the user's browser and SquareSpace.

<comment><USER13> Please do not put Cloudflare in front of your site. It makes it impossible for tor and VPN users to view your site since they have to solve an impossible captcha to even see the static content.

<comment><USER14> It's possible to turn off security in the CloudFlare control panel. I think the bigger issue is that CloudFlare has become a single point of interception for MITM'ing huge portions of web traffic.

<comment><USER15> I'm not sure, but I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings.

But yeah, this NSA slide is extremely relevant to cloudflare: [http://cdn01.androidauthority.net/wp- content/uploads/2014/06...](http://cdn01.androidauthority.net/wp- content/uploads/2014/06/SSL-Added-and-Removed-Here.jpg)

<comment><USER13> > I think CloudFlare will still hit Tor users with (unsolvable) captchas even > with the lowest security settings.

That is correct. I have not been able to get passed a Cloudflare captcha over tor for any website.

</comment></comment></comment></comment></comment></comment><comment><USER16> This is how it always should have been.

It was mind boggling that mixed content was "insecure" but HTTP was "secure." HTTP is and always has been insecure and should be marked as such.

I know there are a few people who will moan and groan about how overkill HTTPS is, but this isn't about banning HTTP it is just about reminding users that they shouldn't be entering sensitive information into a HTTP site.

Even phishing sites should be DV secure.

<comment><USER17> HTTP was never marked as secure.

Mixed content was marked insecure because there were assets on the page that might not be from where you think they were from. It was an indicator that the little https lock in the URL bar wasn't telling you the whole story.

<comment><USER18> I think this is at the core of Google's thinking on this: unless presented with a negative, users' assumptions are that they're secure.

Which is fair, given that I bet you'd get about a 5% or less recognition rate if you polled a random sampling of people on whether they could define "HTTPS" / "SSL" / "TLS" / "That lock thingie" to any degree of accuracy.

A server shouldn't have the opportunity to serve an insecure connection to the user without the user being made explicitly aware of that fact.

</comment></comment></comment><comment><USER19> Sounds good. I wonder when Google Cloud Storage will start supporting https on static websites hosted through them:

[https://cloud.google.com/storage/docs/website- configuration?...](https://cloud.google.com/storage/docs/website- configuration?hl=en)

If they don't then they're not keeping up with hosting on Amazon's S3, which does support it.

<comment><USER20> Similar (very, since appengine static files are served from GCS), is to write a "python" appengine yaml file that only serves the static content with secure: always.

</comment></comment><comment><USER21> Google should offer stupid SSL certificates either for free or for $1/yr.

Perhaps at least to customers of Google domains. I won't mind switching from namecheap to Google domain in latter case.

<comment><USER22> Getting a Google domain means giving up getting new features from Google :( (pauses to clean up bitterness)

<comment><USER23> No, it does not. Signing up for google apps and choosing to use the google apps account as your primary google user account causes you to get new features on a delayed schedule.

You can get a domain through google without switching your google identity to it. You can also sign up for google apps on a non-google domain. google domains and google apps are not the same thing.

<comment><USER24> On Google Apps there are features that have been deployed years ago for regular accounts and that are still not available for Google Apps customers.

The one feature missing and that was painful for me were Contacts photos with a resolution higher than 96x96 pixels. On a latest generation Android with good resolution it sucks and I would have preferred if Contacts photos weren't synchronized at all. I ended up switching to a CardDAV provider and in the end I gave up on Google Apps for other reasons as well. And for the record, Google accounts had this resolution increased in 2012 ;-)

<comment><USER25> Hold on. Are you saying that that's why Android's Contacts keeps resizing all the photos to like 4x4px? Wow, I've tried everything I could find on Google but it never crossed my mind that it would be related to Google Apps. Thanks so much!

</comment></comment></comment></comment></comment><comment><USER26> In the hopes that it will help spread adoption of HTTPS, I wrote a web server that serves your sites over HTTPS by default, using Let's Encrypt: [https://caddyserver.com](https://caddyserver.com) \- It also redirects HTTP -> HTTPS.[1]

There's a lot of misinformation out there about certificates and HTTPS, but don't let it stop you from encrypting your site. Regardless of Google's move, there is no excuse for any site not to be served encrypted anymore.

[1] Here's a 30s demo: [https://www.youtube.com/watch?v=nk4EWHvvZtI](https://www.youtube.com/watch?v=nk4EWHvvZtI)

<comment><USER27> This is an awkward argument. One of my sites documents how to configure servers, for example. What excuse is there that something like that needs to be encrypted?

The most legitimate reason I've heard is for privacy. I don't believe the gov't is going to lock someone up for learning how to serve web pages.

<comment><USER28> Integrity protection. There are a lot of ways to instruct someone to configure their web server in a way that is subtly insecure, not to mention attacks like [http://thejh.net/misc/website-terminal-copy- paste](http://thejh.net/misc/website-terminal-copy-paste)

It'd be slightly nice if we were able to have integrity-protected HTTP without encryption (lower overhead, easier debugging with packet dumps), but the advantages are minimal (ciphers are not really the overhead, SSLKEYLOGFILE is a thing) and it's a lot of complexity to the web platform, which is a downside for web developers like you and me: the rules for mixed content between HTTP, HTTPI, and HTTPS are going to be much more involved and confusing.

<comment><USER29> You can already send unecrypted authenticated data with HTTPS.

<comment><USER28> Via one of the NULL-cipher suites? That's a somewhat expansive definition of "can" and "HTTPS," since most if not all browsers are unwilling to negotiate any of those suites. Indeed, most SSL libraries make it hard to use those suites: for instance, OpenSSL says (`man ciphers`), "Because these offer no encryption at all and are a security risk they are disabled unless explicitly included."

Which makes sense, since they'd have the exact same problems as an explicit HTTPI protocol, just even more confusing: you'd want to not send things like secure cookies across those ciphers, you'd have to handle mixed content with actual-HTTPS carefully, etc.

</comment></comment></comment></comment></comment><comment><USER30> Why do we have to go through this whole SSL certificates thing and can't just have a simple, automatically secure, I-do-nothing-and-my-website-is-secure protocol?

Seriously though. If secure is the default from now on, why can't it actually be the default?

<comment><USER31> Seriously this. I don't see why encryption and website verification have been wrapped up in the same thing (SSL certs). They're two different things. Encryption should be free, automatic and default.

<comment><USER32> If you don't have a way to confirm that the key you're seeing from the other site is right, you're inherently vulnerable to a man-in-the-middle attack which removes the benefits of the encryption against the attacker.

[https://en.wikipedia.org/wiki/Man-in-the- middle_attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)

httpS://en.wikipedia.org/wiki/Zooko's_triangle

It's not clear that the certificate authority system was or is the best solution to this problem, but it is a problem that calls for _some_ solution. In the case of Domain Validation, we only try to confirm that the key is appropriate to use with the domain name, which is the smallest possible kind of confirmation that can be done to address the crypto problem. There's no attempt to validate or verify anything else about the site.

<comment><USER33> However, having one and not the other isn't totally useless.

Having the browser be able to track and tell me that "Though we aren't sure this is actually google.com, we do know that the exact same cert has been used the last 50 times you visited this website" is something I'd consider to be useful. (Actually, telling me if it changes would be the useful bit).

That would be at least be useful for self-signed certs (though those aren't really needed in light of Let's Encrypt...)

<comment><USER34> > (Actually, telling me if it changes would be the useful bit).

I'm curious. Has anyone ever encountered that scary warning you get when an SSH host key changes, and thought "oh man, I'm getting MITMed, I'd better not connect to this server!", instead of thinking "oh right, I guess they reconfigured the server, now what command do I type to make the warning go away"?

<comment><USER35> I have. Usually it's because i reconfigured the server, but I am ultra paranoid. Most people don't care, but I would expect sysadmins to do so. And who else should login with ssh?

</comment></comment></comment></comment></comment></comment><comment><USER36> Is there a strategic business reason for this on Google's part other than a safer web is better for all? I don't doubt that a more secure web is better for everyone, I'm just more curious about the business drivers of this from their perspective.

The reason I'm wondering is because with AMP, there seems to be a clear strategic benefit from having all of that ad serving data running through them even if the advertisers and publishers are not using the DoubleClick stack or Google Analytics.

By bringing this to market from the standpoint of "improving" the mess publishers have brought upon themselves and speeding everything up, there's definitely a clear win for consumers here. That said, it leaves the door open for something similar to mobilepocolypse where Google updated their ranking signals on mobile to significantly favor mobile-friendly sites. I could easily see this going a similar route where it is a suggestion...until its not because if you don't implement it you'll lose rankings and revenue (and coincidentally feed Google all of your ad serving data in the process).

To be clear, I don't knock them for taking this approach, because if it works it is a very smart business move that will be beneficial to a lot of parties (not just Google). Just looking for other insights into the business strategy behind something like pushing for encryption, and AMP.

<comment><USER37> > Is there a strategic business reason for this on Google's part other than a > safer web is better for all?

The two common reasons for MitM are spying and inserting/replacing advertisements. The latter is stealing from Google, so they want to stop it before it grows too common.

<comment><USER38> We can only wonder how long it will be until Google starts openly advertising and buying newspaper articles against that new ad-replacing browser.

</comment></comment></comment><comment><USER39> For Google, it's not just about providing a secure environment and secure websites. In fact, Google actually has a monetary incentive to get as many websites to move over to HTTPs as possible: convincing website owners to move to HTTPs will help get rid of competing ad networks.

<comment><USER40> How does it get rid of competing ad networks? Does Google have a monopoly on serving ads over HTTPS?

<comment><USER41> It means your internet provider can't inject ads or profile you based on the content of the sites that you visit. Comcast, AT&T, and Verizon have all done similar: [https://certsimple.com/blog/ssl-why-do-i-need-it#4-not- havin...](https://certsimple.com/blog/ssl-why-do-i-need-it#4-not-having-your- content-modified-by-carriers)

<comment><USER42> Sure they can. Your ISP can easily MitM you.

<comment><USER43> Not without throwing cert errors on every site I visit.

The only way they can MITM me is if they compromise my PC as well and install their root CA.

<comment><USER44> ... or rather get an intermediate certificate from one of the umpteen root CAs your operating system embeds by default.

Is VeriSign going to refuse a certificate to AT&T?

<comment><USER45> Verisign will happily issue a certificate to AT&T for a domain that AT&T controls.

Verisign will not issue a certificate to AT&T for google.com--no matter how nicely AT&T asks.

<comment><USER28> Yes, and furthermore there's a very good reason to believe that this claim is true: as soon as they do, every copy of Chrome behind AT&T's network will go and snitch to Google, who will promptly investigate and get Verisign in deep trouble.

Here's what happened when Symantec issued fake Google certificates last year:

[https://googleonlinesecurity.blogspot.com/2015/09/improved-d...](https://googleonlinesecurity.blogspot.com/2015/09/improved- digital-certificate-security.html)

[https://googleonlinesecurity.blogspot.com/2015/10/sustaining...](https://googleonlinesecurity.blogspot.com/2015/10/sustaining- digital-certificate-security.html)

"Therefore we are firstly going to require that as of June 1st, 2016, all certificates issued by Symantec itself will be required to support Certificate Transparency. After this date, certificates newly issued by Symantec that do not conform to the Chromium Certificate Transparency policy may result in [annoying certificate warnings, just like self-signed certs]."

And that was just the work of a couple of employees who were inappropriately testing their issuance system and weren't even intending to attack anything. They got fired, which I expect is also a big part of why Google's response was so _light_.

[http://www.symantec.com/connect/blogs/tough-day- leaders](http://www.symantec.com/connect/blogs/tough-day-leaders)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER46> I think it's pretty funny that on the HN front page right now is a NYTimes article from the company's Google beat reporter about how trying to interview Larry Page is "emasculating" and then this announcement is accompanied by an image "shaming" the NYTimes web site for being unencrypted.

As to the feature itself, I don't think it's a big deal at all. We all know that the average internet denizen doesn't understand HTTPS at all and would just as likely ignore it as anything. The only people that would see and understand this new red X for what it represents would know that it doesn't really matter that the lolcat meme they just downloaded came through an unsecured channel.

<comment><USER47> I work for a SaaS company, we absolutely have customers who email us complaining about putting credit cards in a page served over http.

<comment><USER46> Certainly, and I would be one of them. I'm not saying nobody does care or that nobody should, only that enough people don't care enough to make this "red X of shame" that shameful, really.

Chrome and Firefox have both had to take extreme measures for very similar things, such as web sites using expired (or even unvalidated/spoofed) SSL certificates. Google even reported that using a giant red page with warning labels didn't stop people from clicking through!

<comment><USER47> Right, and I guess I meant to imply that it is some of the unwashed non-elite masses that notice that stuff. Our product is for people who are bad at software and want an easier way to do task X, but they still know to look for the green lock. I don't have strong data but I'd just say-- don't underestimate the web knowledge of people who are mostly making cat pictures.

</comment></comment></comment></comment><comment><USER48> Main problem still is Google: They consider HTTPS and HTTP links the same. When switching a site to HTTPS you lose all your incoming links. Redirects only transfer a small amount of juice. You're toast.

We tried migrating several times to HTTPS only, every time got a huge penalty from Google.

So Google is the main driver for HTTP websites.

<comment><USER49> > They consider HTTPS and HTTP links the same. When switching a site to HTTPS > you lose all your incoming links.

Do you mean that they _don 't_ consider HTTPS and HTTP the same? Otherwise, I don't understand your point here.

<comment><USER48> You're right.

</comment></comment></comment><comment><USER50> Just enabled Chrome to show the little crosses by default for [http://](http://) and I already like having this showing. If you wish to be an early adopter go to:

chrome://flags/#mark-non-secure-as

It is good to see how sites that matter are mostly [https://](https://) already for me. The [http://](http://) tabs I have open such as this article actually are insecure when you think about the amount of trackers on them, so the 'x' is very apt.

</comment><comment><USER35> They should do something useful for the web and remove most if not all the current root certificates. There are so many places that have what is essentially a master key to the internet - and that master key is only going to be more important as more and more sites become SSL.

</comment><comment><USER51> So is there already a solution for https on Github Pages with a custom domain?

<comment><USER52> Stumbled upon Kloudsec here on HN couple days ago [1] and gave it a go. The dashboard is a bit clunky where you kinda have to figure out what to do, but HTTPS works without needing to move the DNS to them, as in case of Cloudflare (which costs 20$ when moving from Gandi).

Basically register account, enter your domain, update your DNS records with an A (replacing the Github pages IP) and TXT record (for verification).

While the change in DNS was in couple minutes on Gandi, Kloudsec DNS took an hour or two to register the change. After that, you go in the "Security plugin" and enable it. If you're using an apex domain, you can remove the www. HTTPS request, since you won't get the cert for that (if you do have an apex domain then you probably know about the CNAME trick on Pages, unless your DNS provider supports ANAME or ALIAS records for the apex domain - Gandi doesn't). It took couple hours again to get the cert.

When it's done click on the "Settings" cog icon for the desired HTTPS domain and enable HTTP-> HTTPS redirect and HTTPS rewrite, then you're set.

[1] [https://kloudsec.com](https://kloudsec.com)

<comment><USER53> I'm not sure what you mean about Gandi charging $20 to move the DNS to Cloudflare? I'm using Cloudflare to add HTTPS to a website on a domain registered with Gandi, and it hasn't cost me anything above the usual domain registration fee.

<comment><USER52> Hm yeah, after reviewing the transfer policies, I guess I mistakenly thought the price for transfer TO Gandi stands for transfer FROM as well. It's still a bit more hassle then what Kloudsec offers.

</comment></comment></comment></comment><comment><USER54> Yes! Funnily enough, the site this story is hosted on is using HTTP.

<comment><USER55> [https://motherboard.vice.com/read/google-will-soon-shame- all...](https://motherboard.vice.com/read/google-will-soon-shame-all-websites- that-are-unencrypted-chrome-https)

They should have it force https.

</comment></comment><comment><USER56> All of this raises the question: why does the new default state require action, while the non-default state requires none?

Is that more or less bass-ackwards?

</comment><comment><USER57> Should static content be encrypted over https? I think it's fair for chrome to call out with an x as I've literally seen local lunch joints take orders with credit card info over http but to serve mostly static pages like the new yorker over http only means that the user's privacy is compromised in that people can see what you're reading - does that warrant down ranking searches? I'm just curious - I work mostly on platforms so I'm not too aware of all of the incentives for trying to move everyone to https as it's not my problem domain necessarily.

<comment><USER58> Because mobile carriers are given broad discretion to do whatever they want to do to your traffic.

They cheerfully modify content, and have built infrastructure to do it even more.

<comment><USER57> hmm ya this is a good point.

</comment></comment></comment><comment><USER59> How will this impact page-speed?

I recall switching the product pages of an e-comm site, which had up to 50 small images per page, from https to http and the change very significantly increased page load speed for the end user

<comment><USER60> I'll guess that the browser opened several connections to fetch all of the content (to work around broken http/1.1 pipelining) and needed to complete many tls handshakes. http2 probably would have done a better job.

</comment></comment><comment><USER61> Several weeks ago I have installed certificate to my web site on NGINX and it wasn't hard. It was fun to do. Also I got A+ from Qualys SSL Labs. What I mean is it is easy to deploy an HTTPS site.

<comment><USER27> Deploying TLS in simple environments isn't overly complicated. It's just cost prohibitive.

</comment></comment><comment><USER62> HTTP + HTTPS is fine

HTTPS for SaaS and e-commerce web apps is fine

HTTP for normal websites is okay (for me, I have no hidden agenda)

HTTPS-only for normal websites is silly, why not offer HTTP too? Every request is unique, no internet anonymity.

<comment><USER63> Why is HTTPS-only for normal websites silly? It ensures the page was not tampered with enroute.

<comment><USER62> Why not HTTP + HTTPS? Let the user decide. HTTPS _-only_ is silly for _normal_ websites. Visitors from cooperate networks or some countries would say, your second sentense doesn't hold in the real world.

</comment></comment></comment><comment> coder-otherstuf While I am a fan of HTTPS everywhere, there are just some use cases that are not feasible for HTTPS.

One edge case I am familiar with is a case where a webapp is used to setup a headless device (like a wireless repeater or hub for example). In this scenario, a user loads the page from a web server, the page instructs the user to put the device in a mode that it acts as a WiFi access point, the user then changes the access point of their machine, the page can now make AJAX requests to the device access point which is also acting as a server allowing the user to POST things like WiFi credentials for the device to use.

In this edge case one of two things need to happen, either the original page must be served as HTTP since no CA will issue you a cert that can be served by such a device. Or the device must act as more than a simple API server and would have to serve HTML pages which would get linked to by the original page. While the second solution is fine to get HTTPS everywhere (with the exception of while connected to the device), it means that the development and improvement of setup UI is tied to device firmware updates as opposed to speed and flexibility of web development.

</comment><comment><USER64> Surely it could be a lot easier...

Everyone already has a known public third party authority -- their domain registrar. Surely the browsers could come up with some protocol where you generate your own keypair, register the public key with the registrar and keep the private key on the server.

Then it could work pretty much like SSH, but with the browser doing out-of- band public key checking. Rather than needing a certificate chain, the browser just checks the server's public key matches the published one. If ok, happy to encrypt. If not, wave flags, and yell "spoof".

Verifying the registrar isn't a fly-by-night can be as complicated as needs be, but that way the registrar (who already gets paid to register the domain) does the complex hassle, while the ordinary domain-buyer just has to keep their server's public key up-to-date with the registrar (ie, fill in one web form at the time you register the domain or whenever you change the server key).

But alas it is not so at the moment. Instead, the current process puts hassle onto millions of individual domain-owners, while keeping life easy for the few (paid) certifying authorities. And then we wonder why so few people want to do it.

<comment><USER38> Even better.

Put the public key in DNS, auth the DNS.

<comment><USER64> I thought about that, but there's so many DNS caches out there with potential bugs to make them insecure and poisonable.

But a set of public keys from the registrar is "content". It's small, so they could just have a server or two to handle it. (But if load/latency was an issue, well everyone's pretty good at content-distribution networks these days...)

<comment><USER38> Well, if someone can manipulate your DNS, you have other issues than your SSL certificate anyway.

Ideally, DNS should be signed by your registrar.

</comment></comment></comment></comment><comment><USER65> I feel a bit of dissonance on hn on the issue of https. On issues of surveillance and spying the responses are often measured and there is generally a balanced debate, and yet on ssl suddenly its a matter of extreme urgency with strident positions backed up by references to mitm, spying and isp injected ads.

This is not as urgent a matter as some here tend to make it, better to resolve it properly than rush into half baked solutions like Google shaming websites. Why should a private company have the ability to shame websites and drive decisions a certain direction without any consultative process and accountability. Surely these are decisions for industry groups and wide consensus, and not individual corporates driven by self interest.

Corporates routinely mitm ssl traffic and no one is shaming them or the equipment makers for that, so ssl and mitm is hardly going to be problem for state actors. For protection against less influential actors, banks and those who process sensitive data have been on https for a long time now so where is this urgency and the need to take action coming from?

Everyone agrees security is good but the mechanism to enable this cannot be given up to browser makers and CAs. This is a complete loss of end user control and a significant step back from the open net that cannot just be brushed aside.

Not everyone needs https and for ads injections the pressure should be on ISPs to stop the illegal behavior. Why can't we shame ISPs instead of forcing all websites to https?

Other solutions like signing content that empowers individuals rather than corporates and vested interests should be explored. The same browser makers went ahead and arbitrarily started flashing grave warnings on self signed certs without any consultative process or accountability.

</comment><comment><USER66> Why don't I like this?

I don't think it's HTTPS.... I think I don't like that one company has this much power over the web.

This seems awfully familiar...

<comment><USER67> I don't like this because I've always thought that HTTPS shouldn't be a mandatory baseline. It doesn't make a whole lot of sense to me that a random website with no financial transactions or anything should require HTTPS. [Edit: And thus, it makes less sense to me that the site should be penalized by anyone for NOT having it.]

"Ah, yes. Bob's Trivia Emporium has HTTPS. I know this is really Bob's site and that the data is from his site."

If anyone has compelling arguments to the contrary, I'm open to hearing them.

<comment><USER68> HTTPS assures the integrity of the data transferred is from the origin domain, so it prevents your ISP from injecting additional ads into tour site, which some ISPs like to do [1].

[1]: [http://arstechnica.com/tech-policy/2014/09/why-comcasts- java...](http://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript- ad-injections-threaten-security-net-neutrality/)

<comment><USER67> That doesn't convince me; it's like saying every Tom, Dick, and Harry should get encrypted phones because Verizon has the capability to tap into conversations. The onus should be on the provider, not the customer.

<comment><USER10> You dont think that normal user should use encrypted phone sevices? Are you serious?

</comment></comment></comment></comment></comment><comment><USER69> There are occasionally times when I want to suffer a MITM attack. For example, when I am on an airplane, at a hotel, or basically any other time I have to fill out a webform to get online. Perhaps those forms should not exist, but until they don't, I hope [http://xkcd.com](http://xkcd.com) continues to work.

<comment><USER32> Google has a service for this: [https://www.chromium.org/chromium- os/chromiumos-design-docs/...](https://www.chromium.org/chromium- os/chromiumos-design-docs/network-portal-detection)

</comment></comment><comment><USER70> I wonder if this will reduce malware that injects advertising into users' browser sessions. Seems like a win-win, but I don't trust Google at all. They want all private data un-encrypted and available for their own analysis/mining/auction when it comes to their own servers and services.

</comment><comment><USER71> So is there a lets encrypt solution for shared-hosting systems?

<comment><USER72> The solution for shared hosting environments is for your provider to integrate with Let's Encrypt (or any other free CA that might pop up in the future).

Once this change goes through, providers will be forced to either do that or (if they think forcing users to keep paying for SSL, even though it's de-facto mandatory) watch their customers move somewhere else. There's plenty of competition out there, and a lot of them already support Let's Encrypt[1].

[1]: [https://github.com/letsencrypt/letsencrypt/wiki/Web- Hosting-...](https://github.com/letsencrypt/letsencrypt/wiki/Web-Hosting- Supporting-LE)

</comment></comment><comment><USER73> Yes, shame all libraries/swimming pools giving their schedule online without HTTPS. Shame gutenberg project, the documentations for OS, code, your washing machine.

Why would money from libraries gutenberg project, NGOs informations go to more expansive OPEX for web hosting when an information is clearly designed and OK to be public?

And does not require adds or payment.

Google has some _godwin point_ very authoritative views on the internet and the protocols that make me dislike them.

Especially that their business model it is to not pay transit for distributing their contents. Basically every fucking internet users pay the 95th percentile transit to google products even if they don't watch videos on youtube, don't use gmail or else.

These people are like ... catholic priests. Do as I say, not as I act and be good members of the community.

<comment><USER28> What additional money is needed to implement HTTPS? It's like an afternoon of a sysadmin's time; it doesn't require any more opex.

If you have a favorite library or NGO that doesn't support HTTPS for lack of funding, I am personally happy to donate an afternoon's of a sysadmin's wages to them. (Or to set it up for them, honestly.)

Project Gutenberg is already over HTTPS, so I'm not sure what you mean by that. If you think they were strongarmed by Google into it, instead of having decided this long ago as a simple and obvious step for the good of their mission, a reference for that would help inform the discussion.

<comment><USER73> buying a certificate and changing it yourself. So it costs minimum price a certificate, and at least one person competent enough.

And competence in terms of spending is way more than the certificate.

Outsourcing security without knowledge is praying for being abused.

So sometimes you are better in terms of costs and efficiency without.

And HTTPS cost more for rural users because you cannot cache SSL contents.

So in africa, alaska, yukon, peta ouchnok people with small providers have to pay a tax.

And it increases also the 95th percentile.

So basically everybody except google will pay for this but it will impact more the poorest content provider & users.

<comment><USER28> Certificates are free. The required competence is only marginally more than the required competence of setting up a website, and is rapidly dropping to zero more. (And _is_ , if your website is hosted by a third-party service, which is a pretty reasonable approach for the organizations you name.)

I don't understand what you mean by "Outsourcing security without knowledge is praying for being abused." From your original argument, the website admins don't care about security, right? So the worst that happens is their setup is insecure, but their setup was insecure to start with, and the were okay with that. You aren't _more_ at risk from outsourcing your HTTPS versus just not doing HTTPS.

I'd be very surprised to hear that people in Alaska are getting their internet via an HTTP cache. Frankly, I'd also be surprised to hear that people in Africa are, except possibly for certain mobile internet. I'm curious, where does this happen?

Even so, and especially for mobile internet, HTTPS isn't a problem. The provider gives you the phone, so they can control the software, certs, etc. on it. They can run a caching proxy server that takes "HTTPS" requests in plaintext, and sends them out over HTTPS if they can't be satisfied from the cache. (It's pretty easy to configure an HTTP forward proxy this way.)

<comment><USER73> Certificates are free? Some are. Do you trust certificates given without checking the real identity of the user?

I do not. It has a cost. If you do not check you have the perfect tool for a MITM.

Then is https more expensive than http?

Of course you idiot. Have you never seen your CPU burn under https? With TLS the load is on the first connection. Meaning it is around x% (x said to be 1 by google) for long sessions IF and only IF you have a costly engineer optimizing your stack. And I know by experience that google cipher suite are sometimes close to be ridicusly weak in order to achieve this. (I saw an RC4 while playing with gmail). And that is servers side. Add the client side.

So what about no "engineer". What about an SSL2.0 cipher suite having RC4 MD5 ... and all the default weak settings recommended you can see on the internet?

Well, the illusion of security is no security. the S of https is for security. Having a tag saying I am secure if any government or criminal organisation can break your ciphering in a matter of seconds is no actual security. And it defeats the purpose of TRUST granted by security.

Then way pay the extra x% of https in this case?

Oh! I just read your last paragraph.

Can someone explain to this person why HTTPS cannot be cached? Oh! It can it : has been sold to Tunisia by MS in 2007, France to lybia circa 2005, China is doing it ... for intercepting and deciphering citizens conversation.

Caching HTTPS is basically doing a Man In The Middle attack. It requires a "joker" certificate nicely given by a root authority. Doing so (as microsoft did) normaly induce "the death penalty" of security firms. MS is alive, hence anyway we cannot trust https ... since snowden revelations.

The proxy would still have to do the handshake anyway to have the https => cpu load.

The premise of security are trust. https nowadays is a costly joke.

For the record operators especially when IP routing goes through shared tunnel of collects (3G) have been traditionnaly using a protocol called WCCP to cache transparently your http content. And 4G is deployed substantially in USA & wealthy European countries, but not everywhere.

So even if you don't have a proxy your operator may.

And if you think all USA is at 1Mb/sec for 50$/months read this [http://seclists.org/nanog/2015/Oct/337](http://seclists.org/nanog/2015/Oct/337)

Last and least : I worked in an ISP 10 years ago. One of the datacenter was 5% of france global traffic, the electricity used was as much as a city of 40K inhabitants.

It makes internet as an industry the biggest user of fossil energies. According to my approximation we should be around 2%[+1%?] of the global national consumption. Very near transport industry (plane + trucks). And https will not help.

So I see no other arguments for https than being sheeps.

<comment><USER28> > Certificates are free? Some are. Do you trust certificates given without > checking the real identity of the user? I do not. It has a cost. If you do > not check you have the perfect tool for a MITM.

But you just said that HTTP was fine, right? You can MITM plaintext HTTP too, so I don't understand why that's a problem for HTTPS to be (potentially) MITMable.

> Of course you idiot.

I have stopped reading here. Please read [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment></comment></comment></comment><comment><USER74> So what would this mean for web development agencies and the likes, who've made hundreds of thousands of websites (most without SSL) and would now be forced to convert them all to use https?

How many clients would be willing to pay to cover some of the time wasted doing that?

And how about the potential SEO impact? I mean, Google says switching to https shouldn't affect things, but I've seen tons of sites lose rankings after a change.

Okay, using https is a good thing and all, but the inconvenience caused by having to make this change could be massive.

</comment><comment><USER75> It's very surprising that Google doesn't sell certificates on Google Domains or offer any ssl support in GCE storage stack and yet they are going so strong after web encryption. What about setting an example ?

</comment><comment><USER76> Sounds good to me, thanks to Let's Encrypt. All my personal sites are now on https and HTTP/2 (thanks to Go 1.6). I don't use ads so I have nothing blocking me from https.

The only situation where I still want to use HTTP is one page I serve, which uses websockets, and I don't want to use secure websockets, but that's the only exception.

I'm glad to be in this boat. Once again, it's mostly thanks to Let's Encrypt being awesome, and I'm thankful to it.

</comment><comment><USER77> Cue the sound of 100,000 static-hosted S3 bloggers grabbing their free Amazon SSL cert and setting up CloudFront. And man that AWS console sure is wonky.

<comment><USER78> I tried setting up SSL with Cloudfront yesterday and it was a complete mess. The validation method is sending an email to the domain contacts as listed in whois. So if you have whois privacy enabled, you cannot receive the email and therefore cannot setup the cert.

This is definitely a bug, because the system supposed to also send emails to email@example.com, firstname.lastname@example.com, and a few others. With whois privacy enabled, I never received _any_ of those emails.

Even _with_ whois privacy, you are supposed to be able to receive an email via the privacy registrar's proxy email... but Amazon parses it incorrectly and ends up sending the email to email@example.com

I'm not the only one:

[https://forums.aws.amazon.com/thread.jspa?messageID=698280&t...](https://forums.aws.amazon.com/thread.jspa?messageID=698280&tstart=0)

[https://forums.aws.amazon.com/ann.jspa?annID=3510](https://forums.aws.amazon.com/ann.jspa?annID=3510)

</comment></comment><comment><USER79> This is stupid. Making https a requirement will break most web pages on hardware older than 2005 or so. This sucks for anyone without money.

<comment><USER12> It doesn't make HTTPS a requirement; it just shows a red lock.

</comment></comment><comment><USER80> Hopefully costs for certificates will come down to encourage it as well. Services like letsencrypt can help.

<comment><USER81> Supply and demand would dictate otherwise

<comment><USER82> Well it's not like certs are a limited quantity; they take no time to produce, no limited resources to produce, and no manpower to produce. Supply and demand works when demand outstrips supply, so the price goes up to put downward pressure on the demand. There's no possible way for demand to outstrip supply of certificates, so prices shouldn't go up.

</comment></comment></comment><comment><USER83> I think one of the big problems with unencrypted websites is shared hosting, who refuse to use SNI certificates (often because it would require upgrading their infrastructure). So users have to pay for a static IP which effectively doubles their hosting costs so most don't bother.

<comment><USER84> If they don't bother why should people bother to pay for their hosting? There are many, many hosting companies that do bother and I am using one of them. Had no problem installing Let's Encrypt cert on shared hosting via cPanel there.

<comment><USER85> Who are you using?

<comment><USER84> I am using ASO.

</comment></comment></comment></comment><comment><USER86> My website runs on a vps with NodeJS as the backend. I could easily self sign a certificate but chrome displays a huge warning to users. How about signing certificates for free google. Https is easy to implement but the fact that it costs is bs.

<comment><USER87> LetsEncrypt offers free, automated certificates and is recognised in all major browsers (IE, Chrome, FF, Safari). [https://letsencrypt.org/](https://letsencrypt.org/)

<comment><USER86> Oh wow I've actually heard of this before thanks for the tip.

</comment></comment></comment><comment><USER88> "mark non-secure origins as non-secure." The name of that option seems to be chosen to apply a bit of pressure to anyone who sees it. Nothing wrong with that of course - it's our existing habits of trusting HTTP that are strange.

</comment><comment><USER6> I think 80% of web sites will be labelled as red-unsafe.

SSL layer security is good but sometimes a certificate is expensive and not free. Suppose that you have 10 domains and not all of them are for SNS, banks and etc..

At what minimum cost will you purchase a HTTPS certificate?

<comment><USER89> nada.

[http://letsencrypt.org/](http://letsencrypt.org/)

<comment><USER90> Most shared hosting accounts charge extra for a dedicated IP address, both for setup and on a monthly basis. Don't underestimate how many blogs, churches, small businesses, etc still use services like that.

To be fair, many of those sites probably ARE insecure, but it seems to be a little bit overkill to "shame" them for not implementing encryption.

<comment><USER91> SSL hasn't required a separate IP since Windows XP. And XP no longer has any security support, so anyone running it has bigger problems.

<comment><USER90> Guess you're right, fair enough. I still don't agree with putting a scarlet letter on these types of sites though.

<comment><USER91> Nothing short of that will get HTTPS adoption to approach 100%. Many people have commented that it seems odd to complain about broken HTTPS but not about HTTP; I agree with that. As long as browsers show unencrypted HTTP as "neutral" rather than "bad", far too many sites simply won't care. This has been a long and gradual step, but it needs to happen for HTTP to finally go away.

<comment><USER6> HTTPS is rather more secure than what HTTP is. Because it creates a relative secure tunnel between the client and host. But HTTPS does not mean 100% secure, it's easy to be hacked by MITM or traffic been spied.

I think that getting rid of HTTP should not be shamed in that way. But google is planning on doing this thing.

Just as someone said, MITM attackers can switch google ads to others, and I think this is the reason why Google wants to shame those sites who use Google Ads and not use HTTPS. Google can make an increasing revenue by this act.

And yet HTTP2 is out, will google shame those sites who only support HTTP1.0/HTTP1.1 ? I don't think so. Because this has almost nothing to do with revenue for Google.

<comment><USER91> > But HTTPS does not mean 100% secure, it's easy to be hacked by MITM or > traffic been spied.

I don't know what properties you think HTTPS lacks here, but no, HTTPS doesn't allow "easy" MITM or eavesdropping. If you want to break HTTPS, you either need to compromise an endpoint, or pressure an accepted certificate authority to risk destroying their entire business by issuing a fraudulent certificate.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER92> [https://news.ycombinator.com/item?id=5238164](https://news.ycombinator.com/item?id=5238164)

Still not solved... calm down Google!

<comment><USER93> Use Let's Encrypt to automatically issue a cert valid for each domain?

</comment></comment><comment><USER94> Is there a good guide on making S3 sites work with SSL?

<comment><USER95> You can use the new AWS Certificate Manager[0] with CloudFront[1], which you can attach to your S3 bucket. The docs aren't brilliant, though.

[0]: [https://aws.amazon.com/blogs/aws/new-aws-certificate- manager...](https://aws.amazon.com/blogs/aws/new-aws-certificate-manager- deploy-ssltls-based-apps-on-aws/) [1]: [http://docs.aws.amazon.com/acm/latest/userguide/gs.html](http://docs.aws.amazon.com/acm/latest/userguide/gs.html)

</comment></comment><comment><USER96> So, can someone tell me: Will they be assholes and shame BlogSpot sites (i.e. Google's own service)? Or will it be upgraded or something?

</comment><comment><USER97> I used Cloudflare's free SSL - is this enough?

[https://www.soundshelter.net](https://www.soundshelter.net)

<comment><USER98> Yes. Google can't know what happens between Cloudflare and your server. (Communication there is also less likely to be intercepted as between the user's browser and the internet.)

<comment><USER97> Good to know - <USER2>

</comment></comment></comment><comment><USER99> This might have the unintended consequence of causing people to go numb to the "false positive"

</comment><comment><USER100> Is there a checklist somewhere that specifies each of the things that Google requires / forbids?

</comment><comment><USER101> So what about the overhead of https?

<comment><USER28> For the last few years, effectively zero.

[https://istlsfastyet.com/](https://istlsfastyet.com/)

[https://www.maxcdn.com/blog/ssl-performance- myth/](https://www.maxcdn.com/blog/ssl-performance-myth/)

[https://www.imperialviolet.org/2010/06/25/overclocking- ssl.h...](https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html)

Not to mention that if you use CloudFlare just to get a free SSL certificate out of them, you're also getting a CDN, so the performance overhead is _negative_.

<comment><USER102> I thought the same, but reality isn't that nice. Got this response: [https://news.ycombinator.com/item?id=10602621](https://news.ycombinator.com/item?id=10602621)

I was able to replicate this on my own server too, but haven't immediate solution (all the obvious things like OCSP stapling were already configured, following common sense and various "best practices" guides) and I hadn't enough spare time to properly investigate why TLS takes longer.

If someone had encountered this or knows the possible culprits, would be glad to hear suggestions.

<comment><USER28> I don't currently see a 500 ms difference, so maybe they figured something out. From my shell, I see about 35 ms to [http://www.stavros.io/404](http://www.stavros.io/404) and about 85 ms to [https://www.stavros.io/404](https://www.stavros.io/404) (the HTTPS site serves actual content and the HTTP a redirect, which confounds the numbers).

The HTTPS server is currently offering me a 4096-bit-RSA certificate, signed by the 2048-bit-RSA StartCom class 1 intermediate CA. There's no security benefit in a 4096-bit cert signed by a 2048-bit one, since any attacker capable of breaking 2048-bit RSA but not 4096-bit is just going to attack the CA cert and sign their own forged cert (and any attacker _sorta_ capable of breaking 2048-bit RSA will dedicate their brute force effort to CA certs). And to my knowledge, all current CA intermediate certs are 2048-bit. Meanwhile, because of math, 4096-bit certs take a lot longer to handshake: see e.g. [https://certsimple.com/blog/measuring-ssl-rsa- keys](https://certsimple.com/blog/measuring-ssl-rsa-keys)

CertSimple's data indicates a 25 ms difference between 2048-bit and 4096-bit keys on their server, so I'd expect that the 4096-bit key is responsible for at least most of the performance difference here. A few years ago I screwed this up on a production shared web host, and I believe we saw a greater than 50 ms difference. (While we're at it, that cert is SHA-1, so it's possible they can get a reissue for free.)

Were you able to replicate the 500 ms (!) performance difference on your own server? Are you using a 2048-bit cert and reasonable cipher suites?

<comment><USER102> Currently I see ~200ms difference (repeated those tests a good number of times, of course, those are results closest to average):

        $ time curl -4 -s -o /dev/null https://drdaeman.pp.ru
        curl -4 -s -o /dev/null https://drdaeman.pp.ru  0.00s user 0.00s system 2% cpu 0.300 total

         $ time curl -4 -s -o /dev/null http://drdaeman.pp.ru
        curl -4 -s -o /dev/null http://drdaeman.pp.ru  0.00s user 0.00s system 7% cpu 0.107 total

The host isn't doing anything, although the server is old weak Atom machine so it could take some time to do RSA. I followed some guides (say, used Mozilla- recommended cipher list) to get "A+" rating with SSLLabs. Currently it's just "A", I guess because of SHA1 deprecation on Startcom intermediate certs. [https://www.ssllabs.com/ssltest/analyze.html?d=drdaeman.pp.r...](https://www.ssllabs.com/ssltest/analyze.html?d=drdaeman.pp.ru&s=126.96.36.199)

I'm also using 4Kbit RSA keys, maybe that's the cause, especially given that the server is a tiny Atom HTPC sitting in the kitchen (100ms is because I'm accessing it from the other country). Will try to find some time on weekend and test with 2Kbit ones to see if this is indeed the cause.

\</comment></comment></comment></comment></comment><comment></comment><comment>--

Added: seems that this worsens with latency, because I see extra 200ms. Maybe the cause is extra network round-trips, not crypto overhead. Or maybe there's something with my curl...

        $ time curl -4 -s -o /dev/null http://stavros.io/404
        curl -4 -s -o /dev/null http://stavros.io/404  0.00s user 0.00s system 4% cpu 0.180 total

        $ time curl -4 -s -o /dev/null https://stavros.io/404
        curl -4 -s -o /dev/null https://stavros.io/404  0.01s user 0.00s system 2% cpu 0.370 total

Unfortunately, don't have time to meditate on Wireshark output right now. :(

<comment><USER28> > I'm also using 4Kbit RSA keys, maybe that's the cause, especially given that > the server is a tiny Atom HTPC sitting in the kitchen

Yeah, the combination of those two things is very likely to not do you any favors.

It is worth clarifying that Google et al.'s claim that SSL is essentially no overhead is conditioned on the assumption that you're using reasonably modern and full-featured processors, especially with AES-GCM in hardware. (Which is pretty common on laptop processors these days even without trying hard to find it, but probably won't be on an Atom HTPC.) I think that's reasonable, since if you're seriously worried about performance and latency, you're probably starting off with good hardware, and your worry is that investment will go to waste if you turn on SSL. At least for running a web server for fun on an old personal machine, the added latency is real and is unfortunate but I'd guess also not such a big deal. But maybe that's a bad assumption?

</comment></comment><comment><USER103> Yeah. Still not paying for a cert on my person home-pages just so I can have my own page come up first when people google my (worldwide unique) name.

That page contains static HTML and does not need SSL, and it's not "insecure" just because you may be on a network which MITMs traffic. That makes _your network_ insecure, not my page.

So yeah. Not interesting. Not worth it.

<comment><USER104> Just set mine up for free, today. Letsencrypt.org works great. I recommend the simp_le client.

<comment><USER55> Yeah, there's really no excuse anymore really. They've made it insanely easy to generate certs.

</comment></comment></comment><comment><USER105> If they could just wait until cPanel has LetsEncrypt support that would be great...

</comment><comment><USER47> It's funny that vice themselves doesn't automatically forward to https.

</comment><comment><USER106> And I always thought TLS is the virtual equivalent to those TSA locks.

<comment><USER87> What gave you this impression?

<comment><USER106> The uncontrollable number of masterkeys.

</comment></comment></comment><comment><USER107> HN could do its part: for example, start marking all [http://](http://) links red. For our content sites, we can also announce to users this change and roll something out.

</comment><comment><USER107> Basically efficient, low-latency caching for html and css content is over unless there's SRI for them. It makes sense to have a mini webpage delivered securely that lists hashes for all static assets, and then serve some static assets insecurely to take advantage of CDNs as long as they don't disclose individual app actions (assets everyone sees on many pages). The downside is the balancing of risk for activity leakage based on insecure assets. Of course, some dynamic content and sensitive state needs to remain secure. The issue is that securing everything depends on whether you're willing to trust your CDNs and caches with your certs and private keys (granted, you already trust them to display the correct content.). That sort of technical risk management needs to be considered carefully if insecure assets can dramatically speed up UX (because TLS sessions take some or a lot more work... since how would the browser and backends do session caching or pipelining across infrastructures and providers that likely have multiple IPs? One connection per provider, each keeping their own cache for their HA boxes?)

Maybe there needs to be an insecure HEAD or CACHE open standard to check content freshness of a secure page via crypto hash (say canonical uri, etag and last modified) to avoid building up a full TLS session to see nothing's changed?</comment>


Crypto Mining Scripts Explained - <AUTHOR> https://www.mycryptopedia.com/crypto-mining-scripts/ <comment><USER2> I must give Coinhive cred for introducing AuthedMine:

[https://coinhive.com/documentation/authedmine](https://coinhive.com/documentation/authedmine)

> The JavaScript Miner, Simple UI and Captcha, when loaded from > authedmine.com, will never start without asking for consent from the user

</comment><comment><USER3> I was hoping for a more technical article though.

<comment><USER4> Same. This is HN and I was hoping for an in-depth look at how the whole thing works between the client & server, how credits are handled, what checks are in place to prevent cheating, etc.

</comment></comment><comment><USER5> I recently wrote a simple scanner that goes through a list of websites, accesses them with a headless browser and measures the CPU performance on the browser's process. It's fairly good at identifying obvious miners, but false positives are abound. It's available here: [https://github.com/wrinkl3/MineSweepR](https://github.com/wrinkl3/MineSweepR)

Any idea what metrics could be added for miner detection? I briefly considered proxying the browser's requests against a domain blacklist, but then you'd just end up with a more elaborate version of NoMine.

</comment><comment><USER6> Does anyone have any data on how much on average the CPU is taxed from the mining?

From Kiro: However, if you give them an incentive to run the miner for longer durations (like giving them in-app rewards) it may be good.

I have such an incentive, that may keep tabs open all day. But if its 100% and degrades performance so much that will discourage users from doing it. I doubt it will work.

<comment><USER2> For Coinhive you can choose how many threads it should use and how much it should be throttled.

</comment></comment><comment><USER7> How much $$$ can you gain by exploiting visitor's CPUs?

<comment><USER2> Microscopic unless you have a lot of visitors. You will get much more from ads. However, if you give them an incentive to run the miner for longer durations (like giving them in-app rewards) it may be good.

<comment><USER8> Not just a lot of visitors, bit visitors that stay on your page a long time. Like the UFC video site that was caught out.

</comment></comment></comment><comment> loup-vaillant Yet another co-opting of the term "crypto"…

Not the title, which for once _does_ provides a hint that it's about crypto currencies (the "mining" bit). It's the domain name that's disheartening.

 _Edit: Downvote all you want, I like my language stable. I also like more general terms to be shorter than specific ones._

<comment><USER7> From the HN guidelines:

 _Please don 't comment about the voting on comments. It never does any good, and it makes boring reading._</comment></comment>


Ask HN: Is there a Y Combinator equivalent in Australia? - <AUTHOR>

Is there anything like a Y Combinator equivalent in Australia? Love to hear if there is as I have one start-up in motion, and a lot more ideas in mind that could use small funding and advice to thrive (but yes know I need to concentrate on one thing at a time to get results!) <comment><USER2> Even if a YC-like firm starts up in Australia (and I know of a few people who think it's a good idea) it won't be of the calibre of YC, if the track record of emulators even in the US is anything to go by. Like Silicon Valley itself, the further ahead YC gets, the more it attracts the best startups and investors, and the further ahead it gets.

The most determined Australian founders are leaving Australia to try and make it on the world stage, so any Australian-based version would be limited to startups that are less determined, or whose ideas are Australia-focused, which by definition would be smaller in scale and ambition.

@Bootload is right to point out Pollenizer - Mick and the crew are doing great things to help develop Australia-focused startups, though the type of investment and support they provide is quite different to YC.

Your best bet is to find the startup community in your city and start interacting with them and sharing your ideas and experiences. The Silicon Beach mailing list and weekly meetups in Sydney and Melbourne are the best way to find fellow founders. The Hive events are also great, though less tech- focused. They started in Melbourne and now happen in Brisbane and Sydney, each month. We also run Hackernews meetups in Melbourne a couple of times a year. Follow @ycmelb on Twitter or stay tuned to HN for announcements.

Ultimately, rather than hoping for a YC-copy in your local area, your best bet is to develop yourself to a point where you can get funded by the real YC.

<comment><USER3> _"... Ultimately, rather than hoping for a YC-copy in your local area, your best bet is to develop yourself to a point where you can get funded by the real YC ..."_

I agree there really is only 1 YC. Having to travel 23hrs by Jet to get there redefines _determination_.

The Hive ~ <http://thehive.org.au/> & (podcasts) <http://thehive.org.au/?feed=podcast> you can hear Tom & Finn back in '09 at the Hive where I saw them present this talk ~ [http://thehive.org.au/tom- howard-and-fenn-bailey-from-adioso...](http://thehive.org.au/tom-howard-and- fenn-bailey-from-adioso/) & [http://thehive.org.au/podpress_trac/feed/68/0/tom-howard- fen...](http://thehive.org.au/podpress_trac/feed/68/0/tom-howard-fenn- bailey.mp3)

</comment></comment><comment><USER4> I never saw anything even approaching YC while I was in Syd. Two questions:

1) What's stopping you from moving to the US?

If you wanted to, you could be here on an effectively permanent basis in a matter of weeks (we have an unfair advantage in the form of the E3 visa, a version of the H1B for Australians). Get in touch if you'd like to chat about this.

2) Are you making the most of a community which isn't formalised/mature enough to support a YC equivalent?

There are some real kickass entrepreneurs in Sydney, who I'd say are more approachable and helpful than their equivalents in cities with a more mature startup community. Get in touch for some names, or just show up to Silicon Beach drinks and talk to as many people as you can.

</comment><comment><USER5> As an Aussie, in the current YC batch, I have to say that the answer is unfortunately no. YC is just an unbelievable phenomenon, and I think it's unlikely to be successfully replicated anywhere.

To understand my answer, you really need to understand the value that YC gives you. The money is one thing, but it's really not that much -- I don't think you should be doing YC if the money is your primary objective. What has been amazing for me is the access to people who have, it is no understatement to say, changed the world. Getting office hours with PG is massively helpful -- it's saved us a bunch of time when we've been worried about something to just head into YC's offices and have a candid discussion about it with Paul, and he has a particular talent for focusing startups energy in the right direction (users and cheques!).

The big part of this that will be especially hard to replicate in Australia is the introductions to all these people -- fundamentally, those people live in Silicon Valley, and there's not much you can do to change that.

My last comment here is that I don't think Australia (well, Sydney in particular, that's where I'm from) has the same kind of acceptance of entrepreneurs that we have here in the Valley. It's pretty weird to go to a party and not run into someone else who is starting a company over here, but entirely the opposite is true in Sydney -- everyone who could start a company takes an ok job and enjoys the lifestyle. I'm not saying there's anything wrong with that, but you don't get the same exposure to the startup lifestyle in Sydney, and it's a big mental barrier to get over.

I hope I'm wrong, and I'd love for it to change, because I do think there's some real talent in Australia that could be doing great things (and frankly I miss the beaches!). But making that happen is going to be a lot harder than just throwing some cash around.

</comment><comment><USER6> I work with jamesg (who's already commented) as an Aussie in the current YC batch.

The short answer is there isn't really an equivalent, although I think I speak for many expat Aussies in saying we wish there were!

There are certainly many entrepreneurs in Sydney - check out some of the local meetups like <http://www.meetup.com/open-coffee-sydney/> or contact people like Mick Liubinskas and Bart Jellema.

However as James said, the incredible wealth of talent, opportunity, and funding available in Silicon Valley has to be seen to be believed. Without such a context, I think it will be hard to develop such a seed funding model.

The debate about why Australians need to come to the Valley to start companies has been raging for decades - see commentary on Atlassian's most recent round of funding as a classic example.

I think it notable that YC's specific value proposition especially makes sense in a climate where later stages of funding are plentiful. I have no quantitative data to back this up, but it appears sensible to assume that the volume of deal flow (in $M terms) raised in Australia for tech startups would need to be massively higher before a seed investment funnel model would make sense.

Finally, go for it! If not now and you, then when and who? :-)

</comment><comment><USER7> There's the government neis program. [http://www.centrelink.gov.au/internet/internet.nsf/services/...](http://www.centrelink.gov.au/internet/internet.nsf/services/neis.htm)

<comment><USER3> _"... There's the government neis program ..."_

Aus Government _anything_ (insert current gov inititive) is the _"kiss of Startup death"_.

<comment><USER8> I disagree. Me and friend started a moderately successful web publishing business years ago while on NEIS. Of course our plans did diverge significantly from the plan we submitted to them to get approved. Obviously you shouldn't expect a lot of useful advice them but 6-12 months to work on something is still quite good deal.

If you actually have any evidence of this "kiss of Startup death" you should post it.

<comment><USER3> _"... If you actually have any evidence of this "kiss of Startup death" you should post it. ..."_

start here ~ <http://siliconbeachaustralia.org/lifeguard/>

<comment><USER8> You wouldn't care to point out any particular section. It is quite a long document and the language appears to be a bit vague and political in nature. Or is your point that this is kind of document is actually part of the problem.

Either way I think that the NEIS program is a bit smaller that what these guys are talking about. If you do a NEIS program you are just as likely to be applying alongside people who are wanting to sell homemade candles at markets. It is really an employment program rather than ITC.

</comment></comment></comment></comment></comment><comment><USER3> _"... Is there anything like a Y Combinator equivalent in Australia? ..."_

The closest I can identify is at Mick Liubinskas at Pollinizer ~ [http://www.pollenizer.com/pollenizer-investing-in-web- startu...](http://www.pollenizer.com/pollenizer-investing-in-web-startups/) & <http://twitter.com/pollenizer>

<comment><USER9> Hi guys, yep, there are two initiatives that we are working on that will address this market. One is Pollenizer co-founding startups (above link), and the second is more a straight YCombinator model which (to be announced in the next three months).

Our bootcamps are the starting point for us; <http://www.pollenizer.com/services/bootcamp/>

We are aiming to run bootcamps in Brisbane, Melbourne and Perth later in the year.

Email me at email@example.com if you want to connect.

</comment></comment><comment><AUTHOR> Thanks for the great feedback and comments everyone, I didn't expect to get so much great feedback! I will definitely take up a number of the suggestions and hopefully meet some of you at the various meet-ups and events (in Melbourne at least). And I've touched base with Pollenizer and hope to be at a Bootcamp soon.

To answer some questions such as to why can't I go to the USA. I've got a 7 month old son these days, so the international thing is a bit impractical at the moment. Plus I think there are some great opportunities to be exploited domestically, which obviously isn't taking on the world but I see a lot of opportunity to build good local businesses in Australia.

Jamessg, I agree it's not so much the money, but the access to people that have experience and have done it all before to provide that important guidance and save $ from being wasted on the learning curve.

Anyway thanks again to everyone, really appreciate your help, and hope to meet up with some of you in person soon.

</comment><comment><USER10> I guess they're still working on <http://www.seedaccelerator.com/> which looks like YC. In terms of YC-like quality (mentorship and alumni + VC networks/connections) I don't think there's anything close in Australia.

</comment><comment><USER11> There us one similar program in Chile, from the Chilean Gov't. It's called Start-Up Chile, which give $40k for no equity!!! They are currently recruiting at www.startupchile.org Sydney - Santiago = 16 hrs flight, less than to Silicon Valley :)

</comment><comment><USER12> Unrelated question: if we only consider tax laws, what's the best place in the world for startups to be? (The answer might be useful for startups that plan to bootstrap and don't mind hiring employees who telecommute.)

<comment><USER13> Maybe incorporate offshore (Belize, Panama, Seychelles), and work from Costa Rica. Zero tax, and no sea-sickness issues. Might be a problem to get investment, or sell your startup though..

For bootstrapping, the main problem I found with taxation and incorporation is the bureaucratic overhead - it becomes the top idea in your mind for a time and distracts from building your product. So the trade off might be worth it.

</comment></comment><comment><USER9> StartMate was announced today;

<http://bit.ly/d2HeQB>

<comment><AUTHOR> Well that answers the question once and for all!</comment></comment>


Salesforce Buys Email Contact Manager Etacts (YC W10) - <AUTHOR> http://techcrunch.com/2010/12/21/salesforce-buys-email-contact-manager-etacts/ <comment><USER2> Quite disappointed in the way Etacts handled this. here I was disappointed on their behalf not knowing they had sold. The best they could/should have done is to say we are selling and we are shutting down. That is the proper thing to do, period. We as customers/users deserve that much.

Why the secret? Especially if the news was still going to come out!

<comment><USER3> Are you serious? You really can't think of any reasons they wouldn't be 100% open about this?

<comment><USER4> I have never seen a company post a blog that said "we're shutting down" only to hear later that they got bought. Ever.

<comment><USER5> Usually in term sheets there is a clause that says the founders cannot talk publicly about the acquisition.

Salesforce can do whatever they want.

</comment></comment></comment></comment><comment><USER6> Apparently Salesforce is getting their own AppSumo YC Bundle

</comment><comment><USER7> To me this is a worrying trend, what happens in a couple of years time when users have decided there no longer jumping on the latest startup products because they either get successful and shut down the product or fail and shut down the product.

How do you do interviews talking up how important the product is, why everyone needs it, only to discard it after a short period of time. These talent acquisition's must really be getting big in dollar terms? Because otherwise it all seems irrational.

</comment><comment><USER8> So why the oddly worded shut down message on their website? Why not announce the acquisition?

<comment><USER9> Maybe they bought it for the team, not the product. If the product is then getting killed, people that use the site wouldn't care why: they just care it's going away.

<comment><USER8> Some users might be happy to know that the service got bought out.

Take it in reverse: if they were closing down due to personal illness or death or something else horrible, would you still argue that the users don't care? I doubt it. Customers are human after all and care.

</comment></comment></comment><comment><USER10> Talent acquisitions seem to be big business this last year.

Is this a recent thing buying 'teams' and shutting down the stupid startup thingy they were working on for the last year?

Is conventional hiring talent really that broken?

<comment><USER11> Yes, conventional talent recruiting really is that broken.

This process may not be all bad though. The entrepreneurs get some liquidity and at least a modest success on their belt.

Story A: "Started something cool. Built a product people wanted. Was acquired by Company X. On to something new."

Story BY: "Started something cool. Built a product people wanted. Didn't quite get the traction we hoped. Stuck it out for 3 years. Finally decided we just couldn't build a business out of it and shut it down."

In my mind, Story A is much better for the entrepreneur than Story B. Of course, the trick is knowing when it's time to move on.

</comment></comment><comment><USER12> Seems like YC is clearing out their inventory.

<comment><USER13> Year-end inventory clearance sale?

<comment><USER14> But wait! Order in the next 23 minutes and get Rapportive absolutely free! (just pay due diligence)

</comment></comment></comment><comment><USER15> Maybe they should be more transparent upfront about the sale, no? Seems a bad way to handle a sale with your current users.

<comment><USER16> What more do you need to know than the following: "We have decided to pursue other opportunities and will be shutting down our service on January 31, 2011. Thanks for supporting us and for all you've done."

<comment><USER15> Well I am sure they are entitled to it but I don't understand the secrecy around the sale.

<comment><USER16> I'm actually quite interested in knowing what type of transparency you are looking for and how it will help you as a customer/user of etacts? Seriously - I realize we all have an innate selfish desire to hear the details of the deal (myself, more than most, I suspect) - but in terms of the etacts guys being transparent with their user base, so their users know what next steps to take - what else should they have done/what would you have liked them to do for you?

<comment><USER17> Is it really so hard to understand that users want to know why a company is shutting down a service they use? Even brick & mortar places will usually tell customers "Our lease renewal would be too expensive" or the "Sales have slowed due to the economy". All they had to say was "We've been acquired by Salesforce". They handled it differently than most companies do.

<comment><USER16> Oh, I totally understand that users want to know why a company is shutting down - myself included. Heck, I'd also like to know if they are selling any of their services/IP, who they are selling them to, and, as long as we are playing this game, I'd _love_ to know what the terms were, how much, and whether the team will be moving to salesforce as well. These are all things that I very much am interested in.

My Nit with the OP is that they made a comment about how etacts was handling "transparency" with their user base - and I believe that they did 100% of what I'd expect any service provider I'm with do - give me a heads up, in advance, as to what the next steps with their organization and service were (and issue me a partial refund - I'm not sure if the etacts guys had paying customers yet).

As a interested observer, I want much, much more. As an etacts customer, I'm satisfied that they've provided me the transparency I'd expect of any responsible service provider.

Compare this to how Yahoo has been handling delicious - "Sunsetting?", "Closing", "Keeping up", "Selling?" - who knows - it's not even clear they know/knew.

</comment></comment></comment></comment></comment></comment><comment><USER18> This is odd. Both Salesforce and their acquirees have been pretty vocal and open about their previous acquisitions. What's so different this time?

</comment><comment><USER19> That explains it.

</comment><comment><USER20> good news for one of my clients - <http://ming.ly> \- they're a social CRM for gmail similar to etacts (but a bit more full-featured)

</comment><comment><USER21> Perhaps Salesforce framed the message this way to avoid the negative publicity that comes with transitioning a free service to a paid service?

It may not be the most sound logic, but at least it would make some sense.

</comment><comment><USER22> Congratulations guys!

I didn't remember etacts launched this year. Howie's mixergy interview seems ages ago.</comment>


Google Coral AI Board Steps Out of Beta to Battle Raspberry Pi – HotHardware - <AUTHOR> https://hothardware.com/news/google-coral-ai-board <comment><USER2> Although Coral is pretty cool, I've been really happy with the JeVois. It's a USB webcam that happens to have a quad core processor (with GPU) that runs TensorFlow inference an other algorithms at reasonable frame rates. Tiny, and $50. Very customizable.

</comment><comment><USER3> Can regular humans buy their TPU or it still only a thing you can rent time on?

<comment><USER2> You can buy Coral, which is known as an "Edge TPU", which is different from the Cloud TPU that you can rent time on. I don't think Google sells its Cloud TPUs as a physical product (not sure you're want to, it's not like popping a V100 in a server).</comment></comment>


Interviewing? Come bearing gifts - <AUTHOR> http://schlafnotes.tumblr.com/post/7764173293

<comment><USER2> "12 hours studying the company and market".

For all but new job hunters, you should have a decent grasp of the market you work in already.

For some type of work, it's a bit different - for web work, you may know the web scene pretty well, but nothing about the insurance industry. If you're going for a web job at an insurance company, getting familiar with the industry _some_ will help a bit, but probably not too much during an initial interview.

I had one case where I knew more about the industry the interviewing company was in than the person interviewing me, and I had to bite my tongue and not correct him when misstatements were made. In other cases, there was little I could glean from the company about what they actually did, so it was hard to research too much, and my assumptions ended up being wrong. I'd _tried_ , and they appreciated it, but I didn't actually know much about that industry (got the job anyway). Maybe just because I'd tried that swayed the decision? Dunno...

</comment><comment><USER2> I thought this was going to be about actual 'gifts'.

I haven't interviewed for a traditional job in a long time, but I sometimes used to bring something with me - milk and cookies, brownies, flavored popcorn, etc - as a bit of an icebreaker. I didn't always do it, but it helped to keep things a bit more casual, sometimes gave the others in the group something to snack on while a couple others of us would have a discussion, and what not.

In one case, I brought some milk and cookies to a smaller company, and it happened to be the owner's birthday. He was pleased as punch. :)

<comment><AUTHOR> That's what I thought too when I saw the title. I didn't think anyone brought actual gifts to interviews, but it's cool to know that someone has! I wonder if anyone would have a negative reaction to bringing actual gifts.

<comment><USER2> I've never had a 'negative' reaction - the receptionist who saw me at the milk/cookies interview didnt know what to do with me, so she took the milk to the break area, but that was it.

A small tray of cookies (milk's too hard to do) or popcorn (we have palsiespopcorn.com right near the house - easy to pick up), I've found, is generally a nice icebreaker, especially if you have an afternoon interview.

I've also found these to be a really nice thing to bring to new consulting projects for kickoff meetings - few people ever turn down a piece of fudge :) I don't do it all the time, but enough to keep people happy.

</comment></comment></comment><comment><USER3> It's a lot of work to spend 12 hours researching a potential company, especially if you're applying to multiple positions. But I guess whoever is hiring you will know that you're committed and passionate about the position and company.</comment>


Your bank isn't much safer than the ones that failed in Cyprus - <AUTHOR> http://qz.com/65869/your-bank-isnt-much-safer-than-the-ones-that-failed-in-cyprus/

<comment><USER2> Sounds like now is the time to move your wealth to Litecoin and Bitcoin.</comment>


List of Datasets on the Web - <AUTHOR> http://www.datawrangling.com/some-datasets-available-on-the-web.html <comment><USER2> I don't want to spoil the fun too much, but if you are subject to EU law (and don't ask me whether that depends on whether the data is European or on whether you are in Europe; I am not a lawyer) you cannot simply grab data of the net on the theory that raw data is not a creative work and thus not copyrighted. Just in case anybody gets it into their head to do innovative things with web-accessible databases of facts, Brussels has given us the wonders of the EU Database Directive, which makes raw data copyrightable. Phone books, registries of commerce, postal code databases, train timetables, and other such things that cannot be copyrighted in the US do fall under a copyright-like _sui generis_ IP regime in the EU.

Not that there isn't a case for sometimes just ignoring the fancy details of the law and going with "do first, ask permission later."

But I thought maybe you should know.

<comment><AUTHOR> Good point, some of these datasets are open/free...others are not. If anyone is going to use a "seemingly-free" data set in open source code, try to get permission under the appropriate license. There is a good overview of the difficulties here: <http://en.wikipedia.org/wiki/Open_Data>

</comment></comment><comment><USER3> Thanks for passing this link along.</comment>


List of HN Hacks - <AUTHOR>

The list: http://bit.ly/qqdqlK<p>Add your HN script here: http://bit.ly/r2BrjG <comment><AUTHOR> Clickable link to the list: <http://bit.ly/qqdqlK>

<comment><USER2> Please don't use link shorteners. Many people here, me included, will not click the link.</comment></comment>


Pieter Levels Is Bootstrapping 12 Startups in 12 Months. Ask Him Anything - <AUTHOR> http://www.bootstrappers.io/posts/eiHZctkgDTkDiYC7H

<comment><USER2> That's awesome! I'm trying to do the same thing. I'm trying to do 6 bootstrap starts in 12 months.

Although my digital nomadism is limited to cafe's with no time limit.</comment>


How a $2.7B air-defense system became a 'zombie' program - <AUTHOR> http://graphics.latimes.com/missile-defense-jlens/??ftcamp=crm/email//nbe/FirstFTEurope/product#navtype=notification <comment><USER2> > Raytheon mobilized its congressional lobbyists. Within the Pentagon, Marine > Corps Gen. James E. "Hoss" Cartwright, then vice chairman of the Joint > Chiefs of Staff, came to JLENS' defense, arguing that it held promise for > enhancing the nation's air defenses.

> At Cartwright's urging, money was found in 2011 for a trial run of the > technology — officially, an "operational exercise" — in the skies above > Washington, D.C.

> Cartwright retired the same year — and joined Raytheon's board of directors > five months later. As of the end of 2014, Raytheon had paid him more than > $828,000 in cash and stock for serving as a director, Securities and > Exchange Commission records show.

How is this level of blatant corruption/conflict of interest tolerated in the USA?

<comment><USER3> You obviously don't live here. That's a drop in the ocean of corruption and scandals. That's peanuts!!

<comment><USER4> I think it's fair to say that America has become a corporation.

<comment><USER5> yea, we call it the American Dream. maybe we'll wake up one day.

</comment></comment></comment></comment><comment><USER6> I quit my job at Raytheon right after I was assigned to the JLENS program . Every day there were meetings with f-bombs being exchanged between managers and employees. The environment and culture became extremely toxic. Safe to say I didn't want to have anything to do with the defense industry after that.

<comment><USER7> Nathaniel Boronstein has interesting take on this. You might describe him as an old-school left-winger, as anti-war as they get (ok, that's my description, not sure if he'd agree!), but somehow he ended up consulting for NATO, right smack in the middle of defense-contracting madness.

He found the experience rather surprising in many ways, and you might say his viewpoint was a bit more nuanced afterwards....

[http://guppylake.com/~nsb/WarSpy/SpyInHouseOfWar.pdf](http://guppylake.com/~nsb/WarSpy/SpyInHouseOfWar.pdf)

<comment><USER8> That was a great read, thank you. His observation about the corrupting influence of military money on researchers was interesting - it's obvious in hindsight that the AI researchers were only interested in taking positions that aligned with the "someday" goal of getting AI into combat, if only to secure funding. That his harshest criticism is reserved for fellow academics and the cadre of contractors wasn't what I expected to take away.

<comment><USER9> His description of the contractors was really scary.

</comment></comment></comment></comment><comment><USER10> $2.7B sounds like a rounding error somewhere in the Joint Strike Fighter budget

<comment><USER11> $2.7B here, $2.7B there, pretty soon you are talking real money /s

I'd be curious if the number of these projects in total exceeded the cost of the big ticket items like the JSF.

</comment></comment><comment><USER12> I wonder if a better technical system would be to mount some sensors on top of a mast. Use a gimballing camera to detect objects moving in a straight line through the air. Use microphones to detect engine noise and trilaterate the position. If the system detects something anomalous send a photo to a human to verify.

If you placed a tower every half a mile along the eastern seaboard you would need ~2500 towers. A $2.7 billion budget would allow $1 million per tower.

</comment><comment><USER13> Using a fat stationary blimp target to defend against air attack is pretty stupid. Even in WWI blimps were not exactly successful (though of course they were filled with hydrogen). I'd rather have a fleet of smaller drones with smaller radars flying around making a more redundant and flexible system. But then again I am not a defense company raking in billions.

</comment><comment><USER14> >Even if all those problems could be overcome, it would be prohibitively expensive to deploy enough of the airships to protect the United States along its borders and coasts.

Is this even a proposal? I thought they were mostly worried about protecting their own butts in Washington.

</comment><comment><USER15> So, when engineering crazy things, many valuable lessons are learned that could help us all. Do we get any of that knowledge for this product WE paid for?</comment>


NSA - The Price of Hypocrisy - <AUTHOR> http://www.faz.net/aktuell/feuilleton/debatten/ueberwachung/information-consumerism-the-price-of-hypocrisy-12292374.html

<comment><USER2> Kind of a silly tangent, but: it looks like Keith Alexander is wearing a Casio F91W, which is infamous for being the watch of choice of terrorists, particularly Osama bin Laden and numerous Guantanamo detainees. It's also popular with hipsters and hackers. I wonder if it was some kind of dog whistle? Or the same wardrobe people that put him in an EFF shirt to make him appear "relevant" did it.

[http://en.wikipedia.org/wiki/Casio_F91W#Claimed_use_in_terro...](http://en.wikipedia.org/wiki/Casio_F91W#Claimed_use_in_terrorism)

<comment><USER3> Kind of a shame that "using cheap, high-quality equipment" is now evidence of criminal activity. As if I wasn't inadvertently on enough government watch lists already :(

(See also: encryption, tor; next up, using any OS that isn't certified NSA- backdoor-compatible?)

</comment></comment><comment><USER4> I have to say, this whole NSA Snowden revelation has shaken a bunch of us out of our little fantasy bubble, and we have lost all faith in Google and other internet services providers to protect our private information.

But the real catastrophe here is that these U.S. companies have suddenly and irrevocably lost the trust of the rest of the world, as the article rightly points out. Software is one of America's last bastions of competitiveness and our stupid government has managed to undermine even that.

So long, Internet. It was fun while it lasted. I just hope there will still be a few good paying jobs left after the crash, maybe in the field of cryptographic communications; that seems like it's got a lot of potential in our post-privacy era.

<comment><USER5> Why do you blame companies? If you were the CEO of Google and a government official came to you with a request for a backdoor and a solid promise to make life real hard for you if you refuse to cooperate, what would you do?

<comment><USER6> I like to think that I would react as did Todd Beamer and the other passengers of Flight 93. Sometimes circumstances call for heroic action at the risk of one's self.

<comment><USER5> I'll tell you what I would do if I was a government official. I'd smile and ask you kindly if you are sure you don't want to cooperate. If you say you are, I'd leave. Then I'd find every piece of evidence I have against you and your company, get public opinion on my side, sue you, destroy your reputation, give hidden subsidies to your competitors, accuse you personally of tax evasion and your company of not acting in the interests of public. It wouldn't destroy your company, but you'll lose plenty of money, the public wouldn't listen to you because you'd have no evidence and because the public opinion is on my side already. No one will ever know of your courageous act. More importantly, by punishing you I'd show other companies what happens to those who misbehave.

And don't be naive. The judges are in my pocket, public opinion is in my pocket, I have power which your money can never buy and you are on your own, as all of your competitors are just waiting for the chance to jump in and destroy you.

</comment></comment></comment></comment><comment><USER7> "First of all, many Europeans are finally grasping, to their great dismay, that the word "cloud" in "cloud computing" is just a euphemism for "some dark bunker in Idaho or Utah.""

It is not as though there were no warnings:

[https://www.gnu.org/philosophy/who-does-that-server- really-s...](https://www.gnu.org/philosophy/who-does-that-server-really- serve.html)

</comment><comment><USER8> "the word "cloud" in "cloud computing" is just a euphemism for "some dark bunker in Idaho or Utah.""

I always said that and I believe that the "cloud" is just some intermediary paradigm, in some time and hopefully soon, people will host all their data at home and will only upload it encrypted to on line vaults to have them backed up and redundant for accessing.

For now, I am really looking forward for an Evernote / Dropbox hosted outside of USA/UK/etc to start.

<comment><USER9> I do not think so. Hosting your data at home is significantly more complex than cloud hosting (dropbox, icloud) and will always be - bandwidth is the smallest of all issues. There's absolutely no gain if data is stored on shrink-wrapped boxes that are remotely administered by a provider because then, all data will just be collected at home. So you'd need a trustworthy and extremely simple and robust (open source?) solution that allows every, even the computer-illiterate persons to set up a storage at home. I don't see that coming soon.

<comment><USER10> here's what you do - design a beautiful cube that has a few ports (USB, firewire, whatever). It should also connect to the local wifi network. It'd ship with Dropbox-like software so synching files to it over the home network is dead simple.

Then, you make some sort of lifetime guarantee that you'll keep up with changes in storage and interface technology. Guarantee that the thing will be later upgraded to seamlessly translate people's wedding photos to the next big image format. Guarantee you'll keep it forward and backwards compatible to future OS updates. Guarantee it'll work with future phones and tablets, etc.

Maybe even build in some kind of automated off-site backups in case of fire, theft, flooding.

If you made it simple, and if you earned people's trust that this is really an _investment_ \- I think you could really clean up with local home storage.

<comment><USER11> Syncing over the home network wouldn't be enough; one of the big features of Dropbox is that you can sync devices anywhere. Eg: my phone, my office PC, and my home PC all share the same Dropbox folder.

Since we're not all IPv6 yet, the cube will need to set up a secure tunnel out of the home network to a public endpoint, probably on a server run by your company. All syncing would have to go through that server, preferably with end-to-end encryption so the server can't access the data. (It can still be captured for offline cracking, though.)

</comment></comment></comment></comment><comment><USER12> "It's probably not a coincidence that LiveJournal, Russia's favorite platform, suddenly had maintenance issues – and was thus unavailable for general use – at the very same time that a Russian court announced its verdict to the popular blogger-activist Alexei Navalny."

This was news to me.

</comment><comment><USER13> I am glad somebody else out there is interested in the debate that lies at the intersection of the surveillance state and the "internet of things".</comment>


Show HN: I trained a recurrent neural network to draw dick doodles - <AUTHOR> https://dickrnn.github.io <comment><AUTHOR> Here's the JavaScript code: [https://github.com/dickrnn/dickrnn.github.io/](https://github.com/dickrnn/dickrnn.github.io/)

</comment><comment><USER2> I read that as click doodles! Then was surprised when I opened the site. Err. Thanks "Richard"

</comment><comment><USER3> This is hilarious. Thanks.</comment>