Whois public database is in breach of GDPR, according to European authorities - <AUTHOR> https://www.theregister.co.uk/2018/04/14/whois_icann_gdpr_europe/ <comment><USER2> Note that since the issue is GDPR compliance, this should only be a problem for registrants who are natural persons. So if Whois data were only collected and published for corporations, there shouldn't be a problem.

I always felt uncomfortable having to submit my personal data, specifically: my address and phone number, and for it to be published like that (regarding domains where Whois protection services are not allowed). I can understand the motivation for this with regards to corporations and organizations, but what benefit is there with regards to natural persons?

<comment><USER3> Most of the whois hiding services cost money, so if I get this "service" for free now, I don't have much sympathy with the whois guys.

If it's about contacting people, they could make the abuse@ or webmaster@ address mandatory, then you can separate it from your normal email accounts, because the majority will be spam anyway.

<comment><USER4> >Most of the whois hiding services cost money

Where? I never paid a dime

<comment><USER5> Please do share the registrar that blocks all whois data for free!

<comment><USER6> Gandi

<comment><USER7> Gandi user here. After I read your comment I tried to enable this but it doesn't work.

When I change whois privacy to enabled and press save it just says "Unable to update the contact."

This happens both with my .com and my .net domain.

<comment><USER6> Weird; I have active domains where it's working. Given it requires a contact info update, could be an unrelated bug. I'd definitely file a ticket.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> A little-known fact: WHOIS is extensively relied on by spam fighters like Spamhaus to do their good work, which collectively saves all of us from an enormous tidal wave of spam that would otherwise consume vast resources. Internally, the anti-spam and more generally the anti-abuse community builds a huge and mostly real-time cross-referenced database of information about domains and IP addresses. This database would be impossible to build without WHOIS.

For example, if one domain shares the same contact email address as another, then the domains are related somehow. Doing some data mining on a variety of signals which are apparent in the WHOIS records can help to cluster related domains to help anti-abuse researchers find newly problematic domains by following the trail through WHOIS.

I'm not sure how researchers will do their job effectively without WHOIS. This development is truly a disaster for anti-abuse.

<comment><USER9> Never mind the WHOIS, those other anti-spam databases may be GDPR-violating, as well. Did that spammer affirmatively opt-in to having his origin addresses/domains/IPs and response phone-numbers/etc tracked in your anti-spam data? Probably not!

<comment><USER10> That doesn't seem to be personal information.

<comment><USER11> I believe IP addresses are considered "PII" under GDPR, since they can be used to identify an individual.

[https://gdpr-info.eu/art-4-gdpr/](https://gdpr-info.eu/art-4-gdpr/)

[https://eugdprcompliant.com/personal- data/](https://eugdprcompliant.com/personal-data/)

<comment><USER10> "PII" only seems to exist in US law, GDPR has "personal data".

I am far from an expert an GDPR, but it doesn't seem to be so clear cut. Even if IP addresses in this context are considered personal data, there may be "legitimate interest" in processing them for blacklists, e.g. [https://gdpr- info.eu/recitals/no-49/](https://gdpr-info.eu/recitals/no-49/) could apply. I am confident a workable solution for spam blacklists will be found.

I have the impression that a lot of the fear around GDPR is unfounded if one uses a reasonable and restrictive approach of processing and storing personal data.

<comment><USER11> Yes, IPs and any other information can be kept if there is a legitimate interest. For example if another regulation requires you to keep full information for AML or tax purposes, you can't immediately comply with a right-to-be-forgotten request to delete all the data you hold.

It's still personal information though (which was my original point), and so you still need to comply with GDPR by minimizing usage, not sharing it to processors without permission, having a procedure for telling users what data you hold on them, etc. And I think you'd have a harder time claiming that the other stuff is required too, specifically the addresses and phone numbers. You can do spam detection without that information, even if it would be less effective.

The problem I see with GDPR is just that we won't know precisely where the boundaries are until there's some case law to set precedent. It may prove to be easy to comply with, or it may prove to have some sharp edges that are expensive to comply with; we really can't tell.

</comment></comment></comment></comment></comment></comment><comment><USER12> Whois is no longer such a good idea in this age of doxing anyway. I don't know anyone who isn't hiding their whois details and writing fake names and addresses.

I had the misfortune of using namecheap and entered my real details once. Their whois privacy didn't apply to the particular gtld and I only found out once the spam arrived. Never putting any real details ever again.

<comment><USER13> Spam is only the beginning. Wait until a crazy person gets angry at yuor site.

<comment><USER14> Oh no someone is sending nasty messages. If your on the web it's to be expected.

<comment><USER15> It's all fun & games until your doorbell rings.

<comment><USER16> Or you hear the police shouting.

</comment></comment></comment></comment></comment><comment><USER17> > From the article -

"Critics point out that ICANN has largely brought these problems on itself, having ignored official warnings from the Article 29 Working Party for nearly a decade, and only taking the GDPR requirements seriously six months ago when there has been a clear two-year lead time."

> From: > [https://www.icann.org/resources/pages/what-2012-02-25-en](https://www.icann.org/resources/pages/what-2012-02-25-en)

"ICANN was formed in 1998. It is a not-for-profit partnership of people from all over the world dedicated to keeping the Internet secure, stable and interoperable. It promotes competition and develops policy on the Internet's unique identifiers.

ICANN doesn't control content on the Internet. It cannot stop spam and it doesn't deal with access to the Internet. But through its coordination role of the Internet's naming system, it does have an important impact on the expansion and evolution of the Internet."

\---

Editorial: The disconnect is frightening.

</comment><comment><USER18> One month to adapt? They have had two years. Also, I fail to see how this is a problem, considering that quite a few domains nowadays seem to use WhoisGuard or a similar service anyway.

<comment><USER19> Hardly. ICANN is not an EU organisation. The idea that GDPR is a global law is a new thing.

Also,

 _The letter also has harsh words for ICANN 's proposed interim solution, criticizing its vagueness_

Of all the people to criticize others for vagueness, EU data protection people are the very last who should be talking. GDPR is _nothing but_ vagueness.

<comment><USER20> It's not like WHOIS wasn't problematic before, e.g. even inside ICANN people have been pointing out conflicts with data protection laws for over a decade. And ICANN not being from regions with stricter regulation isn't actually _that_ relevant, since ICANN doesn't directly run WHOIS. The registries and registrars do it, many of which _are_ in the stricter jurisdictions.

GDPR being globally applied certainly ups the overall pressure, and is the reason they want to change the overall wHOIS rules instead of making special rules for individual countries, but the key thing seems to be the fear that there actually might be painful fines now.

</comment></comment></comment><comment><USER21> It is always the same, a law is enacted and it includes a window of a few years to give everybody time to implement it. A few weeks before the law goes into effect, everybody is screaming that they need more time. I guess we don't leave university after all.

</comment><comment> Anthony-G Original blog post from Michele Neylon of Blacknight (registrar based in Ireland): [https://blacknight.blog/game-over-for-public-whois- article-2...](https://blacknight.blog/game-over-for-public-whois- article-29-gives-icann-the-advice-it-asked-for.html)

As an ex-customer, I've found that Blacknight are generally supportive of Internet freedoms and they do a lot to advocate the adoption of IPv6.

<comment><USER22> That's a much better article.

</comment></comment><comment><USER23> Why does WHOIS need someone's phone number anyway? I didn't have a phone number between 1993 and 1998 and I would have liked to have had a domain back then. (I almost did buy one, except they were too expensive back then.)

<comment><USER24> Probably all so they know which direction to point lawyers / government agencies towards when they come knocking about your domain.

<comment><USER25> They could just send an email to abuse@[domain] like anybody else.

<comment><USER26> In my experience of recent years, addresses like abuse@, webmaster@, hostmaster@ and postmaster@ normally bounce. It's a real nuisance when I want to report bugs in web systems, or in email systems where they're doing enough things badly wrong that they trip (or get close to tripping) spam filters, _et cetera_.

<comment><USER24> Sadly I never setup any of those, usually only admin@ and then move on. To be fair I usually list one of the available emails on my sites where it makes sense, or provide some way of contacting me directly. I will definitely create those and forward them to admin@ from now on though. But the issue still remains as others said, now you can claim you never got an email.

</comment></comment></comment></comment></comment><comment><USER27> Interesting, I just queried the WHOIS records of a .im domain which used to display my personal information, but now it displays:

                    This information has been redacted to comply with European Union General Data Protection Regulations (GDPR). Please contact us at email@example.com if you have any further queries.

        Domain Managers
        Name: Redacted
        Address
        Redacted
        Domain Owners / Registrant
        Name: Redacted
        Address
        Redacted
        [...]

<comment><USER28> Particularly interesting, as the Isle of Man isn't in the European Union.

<comment><USER29> If the TLD authority on the Island is offering a good/service to an EU person, even if they are outside the EU, they will need to protect that data in the way that the GDPR specifies. So they can either decide to not publicize that info for EU persons (based on address?), or not publish any natural person's data.

But let's say they didn't want to. No consequences, right? Not quite... the .im authority allows EU businesses (domain registrars) to register domain names (for example, I can go to transip.nl and register a .im domain name). TransIP has to comply with the GDPR. If TransIP collects my information to pass it outside the EU, they need to be certain that the organization they provide it to is also GDPR compliant. If they don't have those assurances, they can't give them the info. So not being GDPR compliant is not great for the .im revenue stream.

Finally, I have no clue about the legal regime on the Isle of Man. If I were them, I would probably try to sync up a lot of my laws with the UK (and thus EU, for now) laws. So my guess is they have some sort of data protection act, and that it's in line with the GDPR (or will be very soon).

</comment></comment></comment><comment><USER30> Whois can perfectly have only technical data.

\- domain expiry

\- domain registration date

\- nameservers

Everything else is not needed and as such would comply with GDPR.

<comment><USER31> If you want EV certs you definitively need more information than that, part of the idea is that there is public verifiable information that only the owner can change.

<comment><USER32> But does it need to be personal information?

<comment><USER31> I think the short answer: It depends.

In some cases it's not enough to register the domain on a legal entity, it needs to be a person, and that person needs to exist in the company and needs to be contactable. You cannot get around this with EV certifications.

</comment></comment></comment></comment><comment><USER25> It sounds like a positive policy to me, I don't understand the backlash of the author of this article, personal details have no relation to domain names and I don't see why they should.

<comment><USER33> Personal details related to a car, right? And real estate? I don't understand your argument.

<comment><USER34> So write your name, address and telephone number on the back of your car. Maybe you don't want to, and thats ok.

<comment><USER33> ...I think you're forgetting about that whole registration thing you do each year.

</comment></comment></comment></comment><comment><USER35> I didn't mind my info being in whois records. Until websites started hosting that info. And Google started crawling those websites.

There's a big difference between your wife's ex guessing your domain and running whois on it to find her home address, vs just being able to Google her name to find it.

<comment><USER36> Isn't every single one of those websites violating that TOS of the registry, that the data may be queried, but not stored?

(queue the "there's no difference" brigade - yes there is)

<comment><USER35> I'm guessing they didn't actually store it, because it got cleaned up shortly after I deregistered the domain.

</comment></comment></comment><comment><USER37> Completely unacceptable response from ICANN. They don't need a special exemption. Turn the service off until you can fix it. And they had plenty of time!

</comment><comment><USER38> If whois is not public, how do I even know if I own my domain?

What if the company that I register my domain with just registers it for themselfes and when I have built a million dollar business on it, they sell it to somebody else?

<comment><USER39> The .tk domain is notorious for this.

</comment></comment><comment> martin-adams I wonder if Companies House in the UK is also affected. I tried to get them to remove personal information a while back as it wasn't a requirement for new businesses. They said no.

I supplied that information long before Companies House made it easily available.

I will try again after the GDPR is place.

<comment><USER40> > it wasn't a requirement for new businesses

Companies house asks for director name/address/dob when you register a company

<comment> martin-adams Correct, but new directors can opt to keep that information private and out of the public domain. So what I meant was, having the information public is no longer a requirement.

</comment></comment></comment><comment><USER41> Don't see a problem. I don't get why do I need to provide my full name, address and a phone number to register domain. What's even worse is that someone can just look it up.

</comment><comment><USER42> This will end WHOIS I think. It should provide interesting to see the side effects of abuse/spam where they can't be identified as easily anymore. On the flip side, mass IP demand letters will become much harder when you can't target someone as easily.

</comment><comment><USER43> It would be fun to compile a list of EU government websites that don't comply with GDPR.

</comment><comment><USER44> Why did ICANN require "thick" whois data from registrars?

Ms. Jelinek's letter suggests that collecting this user data , possibly for the benefit of various "stakeholders", was outside the scope of ICANN's charter.

Why was it a requirement for ICANN-approved registrars to collect and share this user data? What was the rationale?

<comment><USER45> I believe the main reason for this (along with the requirement that registrars "escrow" contact info for all of their domains with an approved third party such as Iron Mountain) is so that the domain ownership information can be recovered in the case of a registrar failure. E.g.: registrar closes unexpectedly, or registrar suffers some catastrophe and loses the contact info.

</comment></comment><comment><USER46> I get so much SPAM from WHOIS, email, phone, and texts. My hosting service wants to charge me to anonymize it.

Twisting ICANN's arm to hide this information is desperately needed.

</comment><comment><USER47> Absurd. Users "consented" when they signed up for a domain. Don't like it? Use a whois service to anonymize.

<comment><USER48> GDPR requires "freely given, specific, informed and unambiguous" consent. It also says that "Silence, pre-ticked boxes or inactivity, however, is presumed inadequate to confer consent."

This kind of explicit consent was not given in the case of most domain registrations, and anyway, GDPR allows for withdrawal of consent, so even if you did grant it in the past, you can withdraw it now.

<comment><USER47> That's why I put "consent" in quotes. (I think GDPR is a waste of resources, even though I have profited from some implementation activities.)

<comment><USER48> They didn't consent though, not by the standards of the GDPR, so their personal information _cannot_ be published in WHOIS. So, no, paying extra for an anonymizing WHOIS service is not necessary; this will be the default level of service from a registrar.

I'm not sure what your intended argument is; can you rewrite in plain English and without scare quotes?

<comment><USER47> Yes, I understand that. Consent was originally in quotes because it wasn't actually consent in GDPR terms.

However, I will continue to argue that it was consent in a more general sense: They bought a domain, therefore their info is published in whois. It is necessary to provide the service. If they do not want their info published, they could have taken action to prevent it (whois service, alternate name, alternate email.)

<comment><USER48> It is not necessary in the purchasing of a domain name to publish personal information in WHOIS. Come GDPR implementation date, it is likely that the vast majority of newly purchased domains will not publish information into WHOIS. Given that _most_ of these domains won't have private info go into WHOIS, how can you possibly argue that it's necessary?

All that's needed for the domain name system to work is to configure nameservers on the domain. That's it. Anything else is certainly not necessary. All WHOIS has ever done for me is resulted in fake domain renewal mailings, spam emails, and unsolicited spam/phishing calls. None of this is anything close to necessary.

<comment><USER47> ICANN and domain registries think WHOIS is necessary. Therefore, it is necessary. Technically, it is not required, you are correct.

And guess what? All that spam and stuff is still going to happen without whois and with the GDPR. It's cute that you think otherwise, but once your info is out there, there's no getting it back. Spammers don't care about your "consent" or your "right to be forgotten."

<comment><USER48> Source on domain registries thinking that WHOIS is necessary. It's a cost center, not a profit center, and some of us would rather not have to do it.

And no, that info would _not_ be out there, and certainly not in such an easily discoverable format, without WHOIS. There's plenty of incoming spam I've received, both physical mail, email, and phone calls, that can be solely attributed to registering a new domain name with publicly visible info in WHOIS. Had that information not been public, I would not have gotten that spam, full stop.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER49> So block Europe from all DNS. Simple.

<comment><USER50> That would be a very aggressive response from ICANN, though it might work from an arms race perspective.

I don't think cold war era thinking alone is the solution to these issues; there are likely other, less destructive, paths.

<comment><USER49> It would be a pretty aggressive response, and certainly not one anyone would be pleased with at all. Not consumers, not ICANN, and not anyone really. But... the European Union is being extremely aggressive here to start with. They are seeking to dictate global policy and threatening gigantic sanctions if not responded to on a very short timetable. One would have to presume that they would prefer the database being blocked from access to its continued accessibility, and that might be the only possible option in order to avoid those sanctions.

I certainly do hope there are other less destructive solutions, but it's not like GDPR or the problems it has with WHOIS just sprung up suddenly. The EU knew this was going to be challenging and would require discussion, but the discussion has apparently reached the point where they have decided going on the offensive is their best option. It's not like ICANN could just flip a switch and change everything to be in compliance but they're refusing to. What the EU wants is a huge change, and you can't just stamp your feet and expect it to magically happen. But that's the unreasonable path they've chosen.

</comment></comment></comment><comment><USER51> nobody mentions namecoin?

</comment><comment><USER52> Pity this is flagged. It's hacker relevant, the Register is a well regarded technology site, and I'd rather a plain speaking title with some mildly rude words than some Vox clickbait.

<comment><USER53> > the Register is a well regarded technology site

Is it? (Honest question, I have no idea.)

Most of the links at [https://news.ycombinator.com/from?site=theregister.co.uk](https://news.ycombinator.com/from?site=theregister.co.uk) are dead for some reason.

<comment><USER54> Yes. I often disagree with it and they are often sensationalist and abrasive but I always enjoy reading it.

<comment><USER55> Yeah, I think "often disagree and often sensationalist" is a good assessment. For any given Reg article, I won't rule out that maybe the author is a nutter, but they're usually well-informed or interesting or amusing or some combination.

<comment><USER52> Yeah, I expect they know what they're talking about, and have an opinion which they'll make obvious - which I may not necessarily agree with.

Sysadmin folks would know the term 'BofH' which got popularised by The Register.

</comment></comment></comment></comment></comment><comment><USER56> Wow, this is the first time I've seen a [dead] article on the front page. Not sure I understand the front page algorithm. Vouched, of course, as it's definitely newsworthy to hackers to know that the law is potentially going to shut down the whois service.

<comment><USER57> I think the previous version was removed because it used The Register's sensational title. Also, I thought you couldn't submit anything from The Register. Every time I've tried I've gotten an error, and their titles are always sensational anyway.

<comment><USER58> It's not particularly sensational, it's just British slang. Very much in the tradition of Private Eye et al. I find it a little disappointing that HN mods believe British slang is a reason to depart from the original-headline-only policy when any amount of SV hype is let through unchallenged, tbh.

</comment></comment></comment><comment><USER59> First ... they came for ICANN, and I did not speak out.

<comment><USER60> A bit melodramatic, don't you think?

Corporations will continue to have their details listed, this covers what info can be stored and published about actual persons.

</comment></comment><comment><USER61> Yikes, GDPR is a well-intentioned shitshow. It's trying to graft new requirements onto something that was never designed to support them. And it looks like it is going about as well as trying to slap multiplayer on top of a hoary old single-player game engine.

<comment><USER22> These aren't new requirements. They've been part of EU law since 1995.

</comment></comment><comment><USER62> Correct move :). ave Evropa

</comment><comment><USER63> I hope ICANN will get a huge penalty for continuing their whois service after end of May.

</comment><comment><USER64> I really don't see why DNS records should be in the purview of the GDPR. I also think they are not public enough. It can be hard to contact people. Information is outdated, false or just hidden. Usually being able to call the person responsible for a domain and say hey your email server has relaying enabled and pushing out a lot spam gets them to fix it.

I can understand person not wanting to put their address, but I say phone, email, name and points contact should be necessary. It is a public system after all.

Spam can be a problem as well, but these records do serve a purpose. They also are important for ownership of a domain if a dispute was to arise.

<comment><USER65> You've obviously never been threatened, harassed or stalked simply for running a blog with real contact information in the whois records.

<comment><USER14> Stalking really? Threats and harassment. Just tell them to gtfo!

I would be more worried about swatting with the address component. I can see that for corporations/businesses.

<comment><USER66> Telling them to GTFO doesn't really comfort you if you receive fake (hopefully) bomb packages at home or whatever else (frequent mailings of poop for example). The local police generally also doesn't do very much for you (unless it's _really_ bad, like a real immediate threat to your life from an actual pipe bomb). Even if they do, that doesn't mean it will stop anytime soon.

In the meantime it's slowly eating away at your sanity: Is this real mail? Can I go outside for groceries without getting stabbed? These are not fun concerns to have to have. Seeing as it's 100% avoidable and unnecessary to have this information available in this way, I don't think it is a bad thing to remove it.

<comment><USER64> I must be made of sterner stuff. I have had what I suspect was a used condom mailed to me. I have had people call my work before. Calls that just hang up. Lots of spam and other angry emails.

I find it more amusing that people would waste their only life on such stupid things.

I do think the adress requirement is perhaps a bit much for an individual. Thats why I mentioned that. Kinda wish I used a PO box for my domains. However, its already there already. So I dont worry about it much anymore.

The only thing I consider personal is your adress. If your name and phone number and contact email are problem. Then a phone book is just as much of a problem.

<comment><USER67> You can publish your own personal data as much as you like.

This is about people who don't like that and are forced to do it if they want to own a domain.

And of course phone books are subject to GPDR as well: in a EU country, if you don't want your phone number to appear in the phone book, just inform your phone provider, and your record will be deleted. (I guess in the future you will even have to give explicit consent to let the number appear there.)</comment></comment></comment></comment></comment></comment>


Constitutionally, Religious Gatherings Must Enjoy the Same Rights as Protests - <AUTHOR> https://www.cato.org/blog/religious-assemblies-must-enjoy-same-rights-public-protests <comment><USER2> I don't think religious gatherings should be banned explicitly, just that the number of people sharing air indoors needs to be tightly regulated. With the protests, they're at least outdoors and the vast majority are wearing masks. If religious people can meet outdoors and wear masks in the same fashion, have at it.

<comment><AUTHOR> As a person who attends organized religious services several times a week, I can sort of see why the right to protest the Government may take precedence over anything else. It's the one right you really can't touch even in an emergency.

That being said, I really appreciated being able to attend a minyan last Shabbos (outdoors, with restrictions).

<comment><USER3> If the reason for banning minyanim was to prevent loss of life, that same argument can be made for allowing protests, to prevent loss of life.

</comment></comment></comment><comment><USER4> Can we maybe give those that are arrested during protests give the same rights that churchgoers enjoy? In church there is a good distance between families and service is quick, but police seem to enjoy locking protesters up in holding cells for far longer than necessary.

<comment><USER5> The proper comparison is between law-abiding protesters and law-abiding churchgoers.

Yeah, protesters that break the law, especially by committing serious acts of violence or property damage, can expect to spend quite a while in jail. Many would say not nearly long enough.

<comment><USER6> Like slashing tyres?

<comment><USER7> > Like slashing tyres?

Are you referring to this?

[https://www.snopes.com/fact-check/slashed-tires- protests/](https://www.snopes.com/fact-check/slashed-tires-protests/)

> Law enforcement officers in Minnesota slashed the tires of cars parked near > demonstrations against police brutality in May 2020.

> Rating: True

</comment></comment></comment></comment><comment><USER8> Churches are indoors, protests are outdoors typically.

<comment><USER9> For what it's worth if someone had sad - "Please have service outside." I think everyone who goes to church would have been happy. That wasn't presented as an option. Frankly to me the idea seems more like after the fact rationalization.</comment></comment>


Guitar Tuner for Chrome - <AUTHOR> https://www.songtive.com/apps/tuner/?utm_source=hackernews&utm_medium=social&utm_campaign=tuner <comment><USER2> I'll have to try this out when I get home from work and see how well it works.

<comment><AUTHOR> Thanks! Let me know if you find any issues.</comment></comment>


Terrible Password Security Advice From Jakob Nielsen - <AUTHOR> http://www.chriskite.com/2009/06/23/terrible-password-security-advice-from-jakob-nielsen/

<comment><USER2> From Neilsen's article: _But password masking and Reset buttons are not something users actively seek out._

Reset buttons might not be, but password masking sure is. There's nothing quite as startling as seeing your password in plaintext. Not having the bullets is just going to make you _look_ insecure, and appearances matter in the psychology of security. You don't want your users feeling insecure.

Even if this wasn't a daft idea, he's beginning to contradict himself, anyway:

 _It's therefore worth offering them a checkbox to have their passwords masked_

contradicts his claim on his "Reset buttons must die" piece:

 _The extra choice requires extra thinking, and the time saved by using an optimal interaction technique is often smaller than the time wasted on having to think instead of just moving ahead with a single interaction technique that is always used._

So for all the time you save by seeing your password in the clear, you lose by having to deal with the extra checkbox.

Also worth noting: browsers have autofill these days. Just loading a page on one of these browsers would be enough to disclose your passwords. Forget shoulder surfing, just create a diversion, browse to a few sites on the victim's computer, and you've got the lot.

<comment><USER3> Someone pointed out.. in FF 3.0.11 at least:

Edit > Preferences > Security > Saved Passwords > Show Passwords > Yes

Lists all my saved passwords in cleartext.

</comment></comment><comment><USER4> I'd like it both ways: I want a checkbox to show me my password if I chose. Feel free to leave it off by default.

<comment><USER5> I'd like a typical GUI browser to let me right-click a password field and use a "show secret text" option. But it should _never_ be the default, at least not for people like me who present on laptops too infrequently to form defensive habits around what my colleagues are about to see.

Why oh why can't we just carry around certs on USB fobs? Isn't it the future yet?

<comment><USER6> I have that. Firefox web developer toolbar. It lets you do pretty much anything, including "Forms->Show Passwords".

I'm pretty sure there's no easy way to make it the default behavior, but you're just 2 clicks away from having it on the page you're viewing.

<comment><USER7> This is not appropriate for general consumers. They need a right-click "Show" option.

</comment></comment></comment></comment><comment><USER8> I've found that novice users often associate hidden passwords with encryption. They think that because they can't see the password nobody else can.

These users are often more likely to use a less secure password in visible prompts out of fear of compromising their more secure ones.

<comment><USER9> Then maybe that's the solution. A browser in ssl mode hides the password by default, while unencrypted connections get the visibly "unencrypted" password. Would then also keep most people from using thier best passwords on unsecure sites.

</comment></comment><comment><USER10> The biggest problem is that if passwords are put in text boxes, I can just hammer the back button after another user has been using the browser until I get to a login form and see the password.

</comment><comment><USER11> It's a shame we don't have more sophisticated authentication systems for the web yet. I don't believe any tweaking of password authentication is going to make it safer or easier. The weak link is always the human choosing, remembering, and entering the password. If we ever want to make the web more secure we'll need something that is a mixture of smarter software complimented by hardware (RFID, public keys stored on USB sticks, RSA key generators, SmartCards, etc)

</comment><comment><USER12> Surprisingly Schneier agrees with Nielsen: [http://www.schneier.com/blog/archives/2009/06/the_problem_wi...](http://www.schneier.com/blog/archives/2009/06/the_problem_wit_2.html)

</comment><comment><USER13> There has been a lot of hubbub about Nielsen's comments lately, but it isn't the first time I've seen this. <http://letsfreckle.com/blog/2008/12/calamity- howlers/> describes why the freckle team decided to show the password. I think that it depends on the web app; if your customers are the type that would look at this as a security risk, then mask the password. Just realize that password masking really isn't protecting passwords.

</comment><comment><USER14> Just out of curiosity, why aren't we using certificates for authentication instead of passwords by now? They can't possibly be worse overall, can they?

<comment><USER15> Several reasons. First, that's only useful for a single browser (or if the OS can manage the cert, a single computer or maybe domain account). Using certs, there's no easy way to login from your friend's house, or from the internet cafe.

Second, it would have to be supported at the browser level well enough to be at least as easy as password usage, which is hard, since password usage is super-easy, as long as you choose a weak one (and people avoid sites that enforce good passwords, if they can). I'm using Safari, and I can't find anything about client-side certificates in the prefs. I know IE and Firefox support them fairly well, as I've used them for intranet sites in the past, but I don't think it's easy. Basically, the first time a site demanded a cert, the browser would have to walk someone through generating one, and it's hard to see how that could be made easy enough for people to sit through it.

Third, any cert that has a password to unlock is going to be at least as difficult for the user as just using a password, and any cert which _doesn't_ require a password will be vulnerable to being stolen by trojans, etc.

You can get all the good things about using a cert by just making your site SSL-only and using a cookie, and this also avoids some of the bad things (inconvenience), but not all (vulnerability to trojans).

</comment></comment><comment><USER16> I tend to agree with the article here. There might be some immediate, apparent benefits to just showing the password, but in the long run a hidden password is helping the user more.

It's frustrating to mistype a password and not realize it, sure, but it's much, much worse to have your password fall into the wrong hands just because someone happened to look at your screen at the right moment.

</comment><comment><USER17> What about a feature for HTML that would allow a configurable amount of plain- text "follow" when typing into a password field... for example:

<input type="password" follow="1"/>

Then, when I type in my password, it will show your password as stars, but with the last 'follow' number of characters in plain-text... like:

Follow of 1: * * * * * * * a

Follow of 3: * * * * * tra

</comment><comment><USER18> Pfff. Show password technology is here today: type password, select all, cut, type username, tab, paste, enter. But I want the _option_ to mask the password.

I prefer the OSX wifi password dialog, with a checkbox to show the password that's off by default.

</comment><comment><USER19> Try this on Firefox. Go to <http://news.ycombinator.com>

       1.Right click
       2.View Page Info
       3.Click on Security Tab
       4.Click on View Saved Passwords

</comment><comment><USER20> The semantics of a password input say nothing of its presentation. It is up to the browser to render the password field with clear text, stars, or whatever style it is configured to use.</comment>


How Apple caused our iPhone app to crash for 3 days - <AUTHOR> http://www.breefield.com/essays/critical-app-review

<comment><USER2> This has got to be super frustrating as an app developer. Not incredibly surprising, coming from Apple.</comment>


How to expand your Joomla site's features with extensions - <AUTHOR> https://opensource.com/article/18/11/how-to-joomla-extensions <comment><USER2> It's 2018 and people still use Joomla.

TIL</comment>


Announcing: MIT App Inventor Open Beta Preview - <AUTHOR> http://appinventoredu.mit.edu/developers-blogs/hal/2012/mar/announcing-mit-app-inventor-open-beta-preview <comment><USER2> One of our beta users of Blueprint ( <https://blueprint.io> ), who incidentally also used to teach CS where I went to high school, signed up and sent a message saying that her students have been using App Inventor, that it was a great way to intro app development to those who have no programming background, but that it has the downsides of being Android-only and requiring a connected device for emulation, so she got a bunch of her students to sign up with us and they're having a blast. So, if you would like an iPhone alternative to App Inventor, give us a shot!</comment>


Ask HN: Effective communication in the office? - <AUTHOR> Hi HN,
I am working on some soft skills in the office, and this might seem dumb, but I am trying to figure out how to write requests and comments that are constructive and firm but not intrusive or abrasive.
For example, a co-worker said they'd schedule a meeting for tomorrow, and I wanted to point it out to them that they made the meeting at the wrong time, so I said:
"For the meeting, it looks like you scheduled it for today instead of tomorrow", and he responded a little coldly, so unsure how I came across.
Another example is the way I ask for things. From a sentence today,
"if you have some bandwidth, I was wondering if you could [do X because Y]"
I needed the data by the next day but this person just came back from vacation and had a big backlog, so I wasn't sure how to convey that but also be respectful of their time. My boss needed the data for a presentation to his boss but it was a little unclear how important the data, so I sort of let it slide. I ended up getting the data anyway.
Does anyone have guidelines, maybe books, or examples of converting common phrases to get the point across?
Apologies if I am overanalyzing.
Thanks for any help! <comment><USER2> I would recommend two books:

[0] How to Win Friends and Influence People

[1] How to Talk So Kids Will Listen & Listen So Kids Will Talk

\---

[0] [https://www.goodreads.com/book/show/4865.How_to_Win_Friends_...](https://www.goodreads.com/book/show/4865.How_to_Win_Friends_and_Influence_People?ac=1&from_search=true)

[1] [https://www.goodreads.com/book/show/769016.How_to_Talk_So_Ki...](https://www.goodreads.com/book/show/769016.How_to_Talk_So_Kids_Will_Listen_Listen_So_Kids_Will_Talk?ac=1&from_search=true#)</comment>


Behind a Backend-as-a-Service Provider: The How and Why of Our Architecture. - <AUTHOR> http://www.spire.io/posts/our-architecture.html

<comment><USER2> Full disclosure, I'm heading up the backend development for Zipline Games Moai Cloud (<http://getmoai.com/>). We're targeting game developers so that lead us to some different use cases and language choices (like Lua).

Thanks for sharing this, at first read through it sounds a lot like the architecture mongrel2 provides (which we use). If you were to swap out the node.js dispatcher with mongrel2 and the redis queue with ZeroMQ.

Have you run into any issues using redis as a queue? If it were replicated across machines I wonder if you could have multiple workers dequeuing the request. If it's on a single server wouldn't the blocking operation on the list become a bottleneck?

Again, thanks for sharing, the offering looks great.

<comment><USER3> Regarding the architectural question:

We actually tested a few designs using m2 and 0mq during our R&D phase. 0mq's push/pull sockets provide the same "take" behavior as the Redis RPUSH/BLPOP, so we definitely could have used m2 as the HTTP end of a similar architecture to what we use now.

One of the considerations that led to the choice of Redis was the transparency of the queueing and dequeueing. The messages in the queue are easily inspected, and the Redis MONITOR command helps greatly in debugging.

More important from a design perspective was our desire to hide the HTTP specifics from the workers. m2 pushes a JSON or tnetstring representation of the HTTP request to its workers, but we want the task we send to the workers to be generalized, stripped of information that is only meaningful for HTTP. We also want to classify the task by resource type and requested action, which allows us to use multiple queues. Multiple queues allows us to implement workers on an ad hoc basis.

M2 could work here if our request classification only depended on the URL. But that is a limitation we are not willing to accept. Request headers can be very useful in dispatching, especially those related to content negotiation (Accept, Content-Type, etc.)

There is an interesting hybrid approach using mongrel2: write one or more m2 handlers that perform the same function as our node.js dispatchers. I.e. m2 sends the JSON-formatted request to an m2 handler that deserializes it, removes the HTTP dressing, classifies the request according to type and action, then queues a task in the appropriate queue. A worker takes the task, does its own little thing, and sends the result to an m2 handler that knows how to re-clothe the result as an HTTP response and deliver it to the m2 cluster.

Regarding the question about queue behavior across replicated Redises:

I do not know for certain, but I do certainly hope it is not possible for an item in a Redis list to be popped by more than one client, no matter how the replication is configured.

With our architecture, we could relieve at least some of the strain on the task/result messaging system by using a cluster of Redis servers for the task queues. Each queue server might have its own cadre of workers listening for tasks. The return trip (getting a result from a worker back to the HTTP front end) is a little trickier, because it matters which HTTP server is holding open the HTTP connection. You could use PUB/SUB (which I believe is how m2 currently does it), or each HTTP server could be popping results from its own result queue.

When using a single Redis server, the only hard limitation we have seen with using the BLPOP operation is the number of client connections Redis can keep open. In case it's not clear, the BLPOP is blocking for the client, not the server.

<comment><USER4> Nice post.

Do you do anything special to make the queue which your workers are BLPOPing durable?

Is there a reason you didn't use Redis pub/sub? Seems like the perfect use case.

<comment><USER3> The "queue" is merely a Redis list. Durable by default.

Redis PUB/SUB is not suited for the task queues we use, because any number of subscribers will receive the messages. We want to guarantee that only one worker will act upon each message.

<comment><USER4> Err, I guess I meant something else. For instance, what happens if one of the workers goes down after popping? The message is lost, right?

I think I invented your architecture in my head that isn't near reality. I imagined you were using the workers to take incoming published messages and pushing them into the queues that subscribed connections are popping off of. Effectively building your own fanout. So in this context, I was wondering why not just use pubsub which will handle fanout and get rid of the entire worker model.

Thanks for the reply!

</comment></comment></comment></comment></comment><comment><USER5> Maybe a bit off topic,

but is it just me or is the BaaS term just a marketing ploy, or at least unnecessary?

I think every thing is placable in the IaaS, PaaS and SaaS model.

<comment><USER6> They're not the first and they won't be the last; just search for '"as a service" -software -platform -infrastructure -saas -iaas -paas' and weep (or laugh). The "as a service" meme is begging to be parodied if it hasn't been done already.

<comment><USER7> I don't understand the business model at all.

I undertand the attraction of implementing web based "messaging" (chat) in javascript. But why wouldn't I just point that javascript back to myself ?

Why would I route the product of JS based chat through a third party when it could just communicate with the server it got the HTTP from in the first place ?

My guess is that this is for folks that don't have any control over their back end - it's just a web serving black box, and this is just some more content to paste into it. Is that about right ?

The missing piece, though, is the revenue model - the users who would generate more than 30 million messages in a month are the same users who actually might have their own back end, and the wherewithal to use it. I would think if you need to use third party javascript snippets, you're ipso facto a smaller, lower volume user ...

<comment><USER8> _The missing piece, though, is the revenue model - the users who would generate more than 30 million messages in a month are the same users who actually might have their own back end, and the wherewithal to use it_

This is true, but if you had a service with the potential to generate say 50 million messages per month would you spend $60/month and use this, or multiple thousand dollars to develop your own?

(Also, note that a big market for this is mobile, not just javascript on websites)

<comment><USER7> Ok, fair enough. I'm still wrapping my head around JSAI (javascript as infrastructure) so bear with me ...

</comment></comment></comment></comment></comment><comment><USER9> Typo on the front page:

We run our servers on Amazon Web Services and use their elastic load balancer (which is were we terminate SSL).

which is _why_ (?)

<comment><USER10> We've been bitten by EC2 instances having issues accepting incoming connections (multiple HAProxy boxes in TCP mode to an STunnel cluster), and we've never had that issue in testing with ELB. ELB also beats our failover time when we lose an EC2 machine.

But ELB is in no way a permanent part of our infrastructure (nothing is permanent) especially as we move to supporting technologies such as SPDY on spire.io or, for example for the right customer requirement, SSL throughout the network stack. We're also fond of Stud running on our internal servers. I do think ELB is the right tool for our cloud today.

<comment><USER11> Haven't you run into performance terminating SSL on ELB? For me the performance is so-so, as I'm using a 2048 bit key and it seems I hit the maximum requests per second limit pretty fast. There're a pair of threads regarding this issue on the AWS forums, where a user did a really exhaustive test of ELB and even got an Amazon engineer to really look into that issue:

<https://forums.aws.amazon.com/thread.jspa?messageID=327283> <https://forums.aws.amazon.com/thread.jspa?messageID=327715>

<comment><USER10> We're looking pretty good in AWS West 1a. The second thread you linked shows great performance from markdcorner's second load balancer -- the [https://forums.aws.amazon.com/servlet/JiveServlet/download/3...](https://forums.aws.amazon.com/servlet/JiveServlet/download/30-89413-335305-6425/Both- ELB-Latency-Avg.png) image -- vs the original ELB, which SpencerD@AWS describes as a custom ELB with some sort of customer-requested secret sauce (maybe some sort of "slow start" to some backend servers?). Indeed we have reached out to AWS a few times in the past and had some magic (at the time ciphers and removing SSL v2) done to our ELBs.

We have seen issues with performance on ELB which is why we originally went with TCP mode HAProxy on the edge of our stack to a cluster of STunnel servers, but again reliability was an issue here and our ELB performance with up to 10K rps looks great in benchmarks. Past 10K we are considering separate dispatchers behind a separate ELB. But at that point I am also tempted to, frankly, switch to our own metal.

Curious: are you comparing ELB performance vs High I/O EC2 instances (say m1.xlarge) open to the world?

<comment><USER11> Well, I didn't know you could fine tune your ELB's. In fact reading the Developer Guide ([http://awsdocs.s3.amazonaws.com/ElasticLoadBalancing/latest/...](http://awsdocs.s3.amazonaws.com/ElasticLoadBalancing/latest/elb- dg.pdf), page 46) it seems that it's now possible to choose SSL protocols and ciphers via the web interface (and I supposse also via the API).

Regarding the comparison you suggest, we are too short-handed right know not only to do this kind of comparisons but even to think to manage our own load balancers ;) Thanks for the suggestion anyway.

</comment></comment></comment></comment></comment><comment><USER12> Your chat demo is broken. <http://www.spire.io/examples/chat/>

<comment><AUTHOR> I know this is the least satisfying support answer possible, but the chat appears to be available for me right now. I'd like to help figure out the problem, can you give me some details like your OS and browser?

<comment><USER12> Opera Version: 11.62 Build: 1347 Platform: Mac OS X System: 10.7.3

[https://www.dropbox.com/s/nhqolr7q11vb4hj/Screen%20Shot%2020...](https://www.dropbox.com/s/nhqolr7q11vb4hj/Screen%20Shot%202012-05-04%20at%2010.38.54%20AM.png)

</comment></comment></comment><comment><USER13> I like the apologetics for node.js in the first section. a similar argument for why you are using jruby instead of node.js for the "backend whatchamajigs" would be nice.

<comment><USER3> The short answer is: Use of synchronous Redis calls made it easier to develop and to experiment with storage patterns.

Workers can be written in any language, which was another major design consideration. We have about a dozen types of worker right now; when we want to evaluate a new language, we can port just one. Alternatively, we can write any new worker types in an arbitrary language.

Thus we're not married to JRuby.

</comment></comment><comment><USER14> I saw a presentation on it last night and it looked pretty awesome. We're planning to use their Messaging API in our upcoming project.

<comment><AUTHOR> Cool. What are you planning to build, if you don't mind me asking?

<comment><USER14> One of our client projects involves having customer service staff talk and resolve payment issues with paying users. The messaging API means we have one less thing to worry about, allowing us to focus on handling payment resolution rather than the communication side of things.

</comment></comment></comment><comment><USER15> Software architecture stories without pictures make me sad :-(</comment>


DeleteFacebook: Perspective from Mastodon - <AUTHOR> https://medium.com/tootsuite/deletefacebook-fafdc4090307 <comment><USER2> For the life of me I can't remember where I originally read this quote, but it forever changed my perspective of FB. Paraphrased: "Facebook is 3 things: the wall, the messaging, and an automatically updating rolodex." Many apps fill 1 and/or 2, but nothing satisfies #3. There is no alternative.

For better or for worse: I want to stay in touch with people I've met in the oddest places. In the middle of bumsquash Uruguay, people who had barely ever heard of Europe, but they had Facebook. All of them. The only place on earth where this wasn't true was China, in my experience.

So, no, I won't #deletefacebook. I've stopped using it meaningfully a long time ago, but until something becomes a reliable, multi-decade spanning auto- updating rolodex, I'll have to stay here.

Mastodon will never, ever, not in a billion years fill that gap. And I don't need more alternatives for #1 and #2, so there dies that dream for me.

<comment><USER3> For #3 why not just email? There may be some marginal convenience features to FB, but email has served that purpose reliably since it was invented.

<comment><USER4> I've known several people that have changed email addresses several times in the last decade, but their FB profile has been stable and always shown the most current email address.

Some of them are less technically proficient that rely on whomever their current ISP or employer is for email. Some of them are more technically proficient and use changing email addresses as an Inbox Zero technique or as a nuclear option in spam fighting.

</comment></comment></comment><comment><USER5> Mastodon is cool technology. The problem is Facebook fills a hole that Mastodon does not. Facebook connects people in real life. Folks from varying distances are able to keep up with their friends and family. There's a built- in desire to monitor their conversations. They're rewarded with "reactions". Facebook provides value for a very large group of people.

A relatively small group of people saw a problem with Facebook. Of course they have to have some underlying goal to make money. So they set out to create a federated system anyone can host that doesn't depend on some central company that's just out to make a buck. It's a noble goal, but it solves a problem that most users of Facebook simply don't care about. It doesn't do the thing that Facebook does, so it's a non-starter.

I'd also add that Mastodon is more of a Twitter replacement than a Facebook replacement. Facebook is better at isolating your feed into your group of "friends". Mastodon is more of a river of information from folks you follow (many of whom you will never meet in real life.)

If you want to replace Facebook, first figure out what people value about Facebook and expand on that. You'll need to be better than they are (at least until people determine they're _that_ awful.) _Then_ look at how you can federate it or achieving whatever other goal you have.

<comment><USER6> _I 'd also add that Mastodon is more of a Twitter replacement than a Facebook replacement. Facebook is better at isolating your feed into your group of "friends". Mastodon is more of a river of information from folks you follow (many of whom you will never meet in real life.)_

I noticed this as well, and it's something I've come across in the past when checking out Facebook alternatives. Most seem to only be a replacement on a superficial level.

</comment></comment><comment><USER7> I'm reposting this comment because I would like to open the discussion up beyond facebook and social media and into the reality that technology has provided marketing with some pretty ridiculous tools. :

I feel like you used to be able to avoid getting swindled by ignoring the swindler, ex. close the door to the saleman, or ignore the gypsy pear salesmen at the market.

Today, marketing is engineered at such a level that it is difficult to acknowledge it's influence. That, and you are constantly bombarded by ads, either explicitly or implicitly.

I don't think I am saying anything novel. I guess I am curious what this means about society and our political systems. People with power and wealth could still be toppled when you exposed them to the truth. How in the fuck does that even come close to happening today? How do you overcome marketing that is engineered to exploit the psychological vulnerabilities you are not even aware of? How do we patch our society and governing systems from being pwned?

This isn't meant as a rant. I am curious, because to the best i can tell we don't live in a society where voting matters and we have a say in our governance.

<comment><USER8> I do not understand how anyone in 2018 finds the internet remotely usable without some form of ad blocker. This is how you ignore the modern salesman.

<comment><USER6> _I do not understand how anyone in 2018 finds the internet remotely usable without some form of ad blocker. This is how you ignore the modern salesman._

It's actually pretty simple. You just don't visit sites with ads that bother you.

<comment><USER8> EDIT: Ads bother me because they are a security hole, so you're saying I should only visits sites without them? Please.

<comment><USER6> If your point was about security then you should have stated that. It seems unhelpful to assume that someone responding to your post is a mind-reader.

<comment><USER8> If the reason the ads bother me is relevant to your point, you should have stated that.

<comment><USER6> Why would the reason ads bother you be relevant to my point. I was responding to your point about not being able to use the internet without an adblocker, which is something that's quite easy to do.

Maybe you meant to respond to a different comment thread? You seem to be confused as to the topic of this one.

<comment><USER8> Hopefully my edit makes it more clear for you.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I'm using an unfederated node of Madtodon running on a Raspberry pi with Let's Encrypt certs as a private family social network. Works well and family response has been massively positive.

You can disconnect while staying connected on your own terms.

<comment><USER10> That's intriguing. You're just hosting it at your house? How hard was it to convince your family members to try using it?

<comment><USER9> Yup, it's just lurking next to the router.

Convincing - tried it with just my partner first and smoothed out some rough edges. I then sent a group email to extended family that included a brief justification, some screen shots of it in action, a picture of the actual server, and an offer to create an account for them. Transparency, ease of use, and privacy were all important factors.

Most live far away and have griped about various facets of Facebook but felt like it was a necessary evil. This has been a good alternative for daily communication, discussions about weather and children, and so forth. The closest to game support is sharing crossword solving times with a hashtag.

</comment></comment></comment><comment><USER11> I really hope more people join mastodon or one of the other federated social networks. But it is hard to make the point that it could replace the utility of facebook (especially messenger, events, search)

<comment> rm_-rf_slash I think the utility of fb as you describe it is easy to replicate regardless of your social network structure. However, it is difficult to get past the enormous network effect advantage that existing social networks already have. Fb and twitter logos abound in any sports or news broadcast. That's the hurdle for any up-and-coming social network.

</comment></comment><comment><USER12> I think the idea that Facebook is putting democracy in peril is a bit farfetched.

<comment><USER11> while Cambridge Analytica is clearly a horrible company the idea of gathering data and building some models to better target advertisement to them is something totally normal happening all over the place. And i don't think we can really dismantel the core of online advertising because of one shady company

<comment><USER13> It's not that CA is just gathering data and using that data to target ads. That's normal. But they've also been using fake news, spy operations, honeypots, and other tactics in order to manipulate people. They've even boasted about their ability to manufacture sex scandals by sending prostitutes to a political opponent. That goes above and beyond what is "totally normal happening all over the place".

</comment></comment></comment><comment><USER14> Something I can't figure out from Mastodon's website is where and how it uses cryptography.

I fear it might all be plaintext, despite the insanity of doing that in the present post-Snowden world, rather than the appropriate end-to-end combined with point-per-point encryption.

<comment><USER15> It's not encrypted afaik at all, besides https but that would be up to the host of the instance. Where do you want the encryption to happen and how? Anyone can federate with you.

<comment><USER16> Followers-only toots and private toots are a good candidate for encryption.

<comment><USER14> They're neither "followers-only" nor "private" if there's no encryption.

Even if both me and my followers do run their own Mastodon servers.

This is terrible indeed. How is this any better than twitter? At least, for private tweets and such, they'd need a court order to get the information from twitter.

</comment></comment></comment></comment><comment><USER17> I don't care about events, but I'd like my friends and weak ties to easily be able to keep up with what's going on with me. The only alternatives I can think of is signing them up all for a mailing list, or starting a website/blog. But if I don't want my blog to be public, I'm faced with doing something like setting up a wordpress blog with membership, and asking them all to register and sign in to see my semi-private blog.

Unless there's a free / open-source blog system with a decentralized federated SSO system, where everyone can choose to friend up (probably one-way, not two- way) to follow each other's feeds? I suppose like mastodon, but for long-form or free-form writing?

<comment><USER18> Secure Scuttlebutt is this, but suffers from the same problem every non- Facebook social network does: critical mass.

<comment><USER17> Critical mass is just one of those things that will be a flaw until it isn't.

Facebook has this "decisive competitive edge" in that the fact that it is seen as the only alternative is what reinforces it being the only alternative. It's good that these other solutions are free and open source because most commercial competition would dry up and fail.

But for these things that bump along and grow slowly in a sustainable way, they might actually approach an inflection point where things will snowball. At least I hope so!

</comment></comment></comment><comment><USER19> If you're thinking about using Mastodon, the CounterSocial[1] instance is worth considering. It's run by "The Jester"[2][3], who has experience running secure/hardened systems, and who takes more of an active role in countering bad actors.

[1] [https://counter.social/about](https://counter.social/about) [2] [https://en.wikipedia.org/wiki/The_Jester_(hacktivist)](https://en.wikipedia.org/wiki/The_Jester_\(hacktivist\)) [3] [https://keybase.io/th3j35t3r](https://keybase.io/th3j35t3r)

<comment><USER20> It's an instance that promotes U.S. hegemony, imperialism and exceptionalism. It's an instance that i.e. brands Iran as hostile, but doesn't acknowledge our hostility towards them etc.

No thanks!

</comment></comment><comment><USER21> Facebook is just the tip of the iceberg. If a fully featured app or service is free, then you are the product. Collecting and selling user information is pervasive.

<comment><USER22> >If a fully featured app or service is free, then you are the product.

Depends on the business model. Wikipedia, for example, is a non-profit.

You can also theoretically have a public benefit corporation that is structured to protect data privacy, but I don't know of any.

<comment><USER23> Mozilla?

<comment><USER22> I think Mozilla has some weird structure where it's a non-profit foundation that happens fully own a for-profit corporation. I'm not an expert on the topic, though, so maybe that counts? Probably depends on the state where it's incorporated.

The only big PBCs I've ever heard of were hospitals and private colleges. But you are right that the way Mozilla is set up, it is focused more on pushing the technology and mission of the foundation forward rather than on delivering share price increases or dividends to shareholders.

</comment></comment></comment></comment><comment><USER24> Sounds good in principle but how would mastodon scale to billions of accounts and maintain data centers around the world?

<comment><USER25> The main Mastodon instance probably can't do that. But then I think you're missing the point of a distributed social network.

<comment><USER24> Makes sense. But how can a user validate a mastodon instance is not malicious?

<comment><USER26> Reputation! And I don't mean some convoluted algorithmic scoring system.

Most people seem to find out about Mastodon from someone, and that someone suggests the instance they're on. That's why a lot of artists end up on Mastodon.art, for example. So far, the admin has a good reputation for being consistent about updates and keeping the community engaged.

People keep trying to find some technological heuristic to establish trust, like requiring legal names or some kind of scoring system. So far, it's even worse because people encode all their cognitive biases into it and none of the mental models or processes people develop for checking those biases.

<comment><USER24> An instance could have good reputation and still be malicious in terms of privacy and what is done with your data.

In this sense, trusting a Mastodon instance with your data is the same as trusting a Bitcoin exchange with your money. Bitcoin is decentralized too, that doesn't make Bitcoin exchanges trustworthy.

<comment><USER20> In the end you have to trust somebody. If you can't trust your instance admin, you can run your own, (even single-user),instance, however that still doesn't protect you from your host provider being malicious etc.

</comment></comment></comment></comment></comment></comment><comment><USER27> So I question the sustainability of these platforms? How are they supported when they have sufficient mass? If they aren't gathering data on users and selling ads then how are they generating revenue?

<comment><USER28> Decentralized platforms aren't a business. The decentralized model scales remarkably well for a very small cost because there are hundreds (or thousands!) of instances that run at a small scale and communicate with the broader network. Many volunteers run small instances that cost only a few dollars a month to maintain and are often supported by donations from the users of that instance. You can even run your own instance if you want. Even if one instance fails the network as a whole doesn't even feel it. The financial model is totally different and very sustainable, much more so than the proprietary model even.

<comment><USER29> If I am reading fb history correctly they had a business (apple and party poker ads) even when they were distributed (one server and mysql db per school).

<comment><USER30> They were never distributed _as a business_ , even if they were distributed as a product or as a tech stack. Mastodon allows unconnected people and organizations to make hugely disparate investments in "connection technology" with potentially very different business models. Server A may require a monthly subscription from each of its clients, Server B may be getting micropayments from 0.001% of its clients, server C may be running completely free just for somebody's close friends. All these financial models can coexist on the same platform.

</comment></comment></comment></comment><comment><USER31> LOL at the popup I get.

"You've read over 3 articles this month. Let's make it official. Log in with Facebook or Google."

<comment><USER32> Comments like yours are tiring an meaningless.

Facebook and Google have their tentacles in nearly _everything_. If you want to get a message out, it's going to intersect with their platforms in some way, even if you're directly criticizing them. AFAIK, there are no purist corners at this time that attract enough eyeballs.

<comment><USER31> "Tiring and meaningless" eh? As opposed to your meaningful and engaging strawman reply?

Even if it were true that an essay or article couldn't be disseminated effectively without Facebook getting involved at some point, it doesn't mean that readers must be burdened with a popup that asks them to log in to Facebook before viewing.

<comment><USER32> It seems nearly _every single post_ where someone suggests people delete their Facebook accounts always has some comment pointing out that the NYT, or Medium, or whatever the article was published has a Facebook share widget or something like that.

IMHO, those comments might as well be "First Post!" for all they add.

> it doesn't mean that readers must be burdened with a popup that asks them to > log in to Facebook before viewing.

The first step to that world is getting people off Facebook so it's not so ubiquitous that making a request like that seems reasonable.

<comment><USER33> This comment thread is taking place on site with no (obvious or well known) google or facebook integrations.

Honest question, do you think the same content with same title with a different domain rather than 'medium.com' could not reach similar popularity on HN?

Any comment pointing out hypocrisy is valuable and interesting in my opinion. I prefer to disregard the opinions of hypocrites.

<comment><USER32> > Any comment pointing out hypocrisy is valuable and interesting in my > opinion. I prefer to disregard the opinions of hypocrites.

That's actually a pretty closed minded position. I don't think there's a single person who isn't a hypocrite in some small way, even ascetics living alone in the desert. You'll disregard all of them?

Hypocrisy doesn't logically invalidate anyone's arguments or positions, those need to be evaluated on their own. If they make good points but fail to live up to them, it only demonstrates their own personal moral failings.

But I think it's also a mistake to count "publishing something about deleting Facebook on a website with a Facebook integration" as hypocrisy. Authors _usually_ aren't the ones making implementation decisions of the platforms the publish on, and are probably not even aware of most of them.

> Honest question, do you think the same content with same title with a > different domain rather than 'medium.com' could not reach similar popularity > on HN?

HN isn't the world.

I think it's a waste of time for an author to make the avoidance of publishing platforms with Facebook integrations a priority. It would be an act of foolish, unpragmatic purism, akin to a lot of the stuff Richard Stallman does. It's more important that they argue persuasively and widely to convince the implementors to avoid such integrations.

</comment></comment></comment></comment></comment></comment><comment><USER34> As far as I've seen, this doesn't provide new information, so it just reads to me like "Developer of startup social media platform agrees with bandwagon: please consumers, stop using the product of our biggest competitor"

<comment><USER20> Mastodon is an open-source, distributed project, there is no commercial interest to scale in it per se.

<comment><USER34> Why do I see so much shilling for it on HN?

<comment><USER20> Perhaps because it's something distinctively different than the typical HN posts of startup X raising 5 trillion series G funding and Musk going to Andromeda in 2003?

</comment></comment></comment></comment><comment><USER35> Mastodon can't be considered a real alternative unless you have a solution for all the child porn on some of the most popular instances.

<comment><USER16> "Defederate with pawoo"

There you go

<comment><USER26> I think this was what prompted the finer-grained federation controls. Most instances at least block its images now and/or mute it.

</comment></comment></comment><comment><USER36> How do people feel about using Facebook's technology like React in light of all this controversy? Is there any concern that there is cross over between the data harvesting and the engineering behind React etc.?

<comment><USER37> Its a JavaScript library used for providing an abstraction over DOM manipulation, and is open source. It doesn't phone home to facebook with your mother's maiden name, and it doesn't have a single line of network code in its source code. Worse that could happen is facebook stops supporting it for some reason and a lot of engineering talent dedicated to it evaporates.

</comment></comment><comment><USER38> > Mastodon [...] No real name policies

Lacking a very rarefied community capable of self-moderation, like this site has or some specialized reddits and forums, the no-real-name becomes a major drawback. A minority of douche-bags will generate a majority of noise and will come to shape that world in their image.

This is quite visible when browsing Mastodon instances, many of which look like a crossbreed of 4chan with Myspace. Most accounts don't have a real picture. The fact people assumed their real identities, cared about what they said and did, and that you could find real people knowing only their name was one of the key ingredients to the success of early Facebook.

Furthermore, the whole "no data collected" has any value from the perspective of the user only when using real names. Otherwise, I really couldn't care less about data attached to an anonymous account.

<comment><USER39> The real name policy doesn't seem to stop duplicate accounts, bots, and spammers on FaceBook or Twitter, it just ensures they have vaguely human names.

<comment><USER38> That's quite a different issue, is it not? The spam bots come because the social network is successful, as they will come to any other network regardless of real name policy.

What I'm saying is that anonymous accounts will prevent that success in the first place, because of the behavior of non-spam users. At least for a mass market product most regular folk would want to use, like Facebook.</comment></comment></comment>


How Do You Effectively Interview Engineers? - <AUTHOR> https://www.linkedin.com/pulse/how-do-you-evaluate-engineers-taylor-berghane/ <comment><USER2> Don't. 3 months test on the job shows - if they leave your toxic environment.

</comment><comment> java-man Don't whiteboard them.

</comment><comment><USER3> Don't use LinkedIn?</comment>


American Workers Say Internet Makes Them More Productive - <AUTHOR> http://bits.blogs.nytimes.com/2014/12/30/american-workers-say-internet-makes-them-more-productive/?ref=technology&_r=0

<comment><USER2> > the research did uncover a few unexpected insights... Only 4 percent of > those surveyed said social media like Facebook, Twitter and LinkedIn were > "very important" to their jobs.

I'm gonna guess that 96% of people would say that this result was completely expected.

</comment><comment><USER3> Define "productive." I define it as the marginal value added by a unit of labor input. Otherwise, productivity is just a feeling.

<comment><USER4> For the purposes of this article; I'm not sure if it matters how we define productivity; only whether the Internet makes us "more" productive.

I define productivity as being to finish something. I believe the Internet helps me--a a programmer--produce more efficiently.

Some of that is social networks, because I'm hooked up to 400 or so programmers on twitter and often they can answer a simple question quicker than a Google search [despite the fact that I usually only go to Twitter to complain about my problem not to look for a solution].

Sites like StackOverflow--or even personal blogs--have saved me days or even weeks accomplishing "non-routine" tasks from consuming Twitter feeds to communicating with LDAP to securing a server with ColdFusion on it. I can accomplish such tasks more quickly by relying on the the knowledge of others; as opposed to having to discover it all myself.

[Repeat last paragraph for things like libraries and frameworks whose circulation would be much more limited without Internet access]

</comment></comment><comment><USER5> I guess this post deserves a productivity/self-assessment chart in the spirit of this one: [https://news.ycombinator.com/item?id=8802454](https://news.ycombinator.com/item?id=8802454)</comment>


Platform Preview gives Web developers first taste of IE9 - <AUTHOR> http://arstechnica.com/microsoft/news/2010/03/platform-preview-gives-web-developers-first-taste-of-ie9.ars

<comment><USER2> I'm impressed be the preview. I can't wait for all of the simple things in FF and Webkit to be standard! Their SVG demo is amazingly fast. Their approach is really rather smart, it does make sense to focus more on the speed of drawing visual elements than raw JavaScript computing power. On the SVG drawing and bing maps demo Firefox and Chrome can't quite keep up.</comment>


Interesting Infographics - <AUTHOR> http://li3.in/1AHDPlC

<comment><AUTHOR> People post me more infographics that has amazed you</comment>