Small ads sex trafficking: the battle against Backpage - <AUTHOR> https://www.theguardian.com/global-development/2017/jul/02/fight-for-my-daughter-battle-against-backpage-child-sex-trafficking <comment><USER3> Backpage sound pretty evil here, any argument about prostitution can be ignored entirely:

 _Backpage was focused on getting as many ads posted as possible. It instructed moderators to edit ads and strip out the code words used by pimps to indicate that the person in the ad was a child.

Words such as "Lolita", "fresh" and "amber alert"... were edited out and the ads posted.

In one subpoenaed email believed to be from Backpage management, moderators were instructed: "If in doubt about underage: the process for now should be to accept the ad"_

(I added formatting for clarity)

<comment><USER4> Oof. Penny-wise, pound-sociopathic. I wonder how high up this went? I mean, "management" could be just a low-level moderation supervisor barely above the "moderator" role themselves, or could be somebody just under the C-levels.

<comment><USER5> It was absolutely at the top of the company.

See the photo caption: "In court: (from left) Carl Ferrer, James Larkin, Andrew Padilla and Michael Lacey are sworn-in prior to testifying before the Senate earlier this year. Photograph: Cliff Owen/AP" \-- these people knew Backpage was being used to traffic children to be raped, and they fought in court to be allowed to continue to do so.

The _I am Jane Doe_ film is a good documentary that covers the events.

<comment><USER6> That Backpage's C-suite appeared in court does not somehow imply that they were willingly complicit in child abuse. However, the fact that they plead the Fifth does look pretty damning. While it can't be used against them in a court of law, the court of public opinion is a different matter entirely.

</comment></comment></comment></comment><comment><USER7> Nice of them to not even bother including any of the sex workers' rights groups who can talk about the facilities for making safer arrangements that backpage provided or about how rare actual child enslavement is and how often they're found because the customers report them because that wasn't what they wanted to pay for.

This is basically a PR piece for the puritan/radfem lobby that hates sex workers on principle and has allied itself with NGOs whose budgets depend on vastly inflating the problem and ignoring the fact that under the current system law enforcement are usually more dangerous to the workers than anybody else :(

<comment><USER4> There has to be a place to draw the line - if somebody is running a child prostitution ring under your nose on your property, then you've failed in your responsibilities as a business owner.

Too many software companies these days operate as "dumb pipes" and are allowed to wash their hands of their responsibilities as middle-men for unthinkable crimes. Whether it's Amazon selling lead-laden baby-toys (and then blame ephemeral Chinese companies for the problem) or classified pages being a storefront for child-prostitutes, or social media being a vector for harassment and threats:

If you own the venue and you profit off of its use, you have a responsibility to not facilitate crime.

<comment><USER8> One of the big issues is that as soon as you delve into content-censoring, then the law makes you liable for _everything_ (from child abuse to libel). The law takes an all-or-nothing approach.

For example, think about what YouTube would be like if every video had to be manually vetted by a real person before it was uploaded.

That said, if someone points out illegal things happening on your site (e.g. the mother pointing out the photos of her 13-year-old daughter), and you _still_ do nothing, that is an issue.

<comment><USER9> Easy workaround: don't censor anything but set up an automated tip generator to the authorities if certain keywords are present in the ad.

I had a file upload service for a while (files.ww.com) and in spite of the very clearly worded warning pedophiles would attempt to use the service and a couple of them (and their buddies) found themselves in more trouble than they ever wished they had. I still got sick of it though and shut the whole thing down but it worked just dandy as a honeypot. The guy at the Dutch vice squad that was my contact died, I'm full of respect for people that will step into this junk to combat it, that can't be easy on the senses. He was called in to deal with the case of a childcare center in Amsterdam where a bunch of sub- humans had been abusing children as young as _19 days old_ (I wish I was making that up) to make videos in order to sell online.

Disgusting doesn't begin to describe it.

[https://en.wikipedia.org/wiki/Amsterdam_sex_crimes_case](https://en.wikipedia.org/wiki/Amsterdam_sex_crimes_case)

Please be warned that this is not a pleasant page to read.

<comment><USER10> I read an article a few years ago about some of the people who work to identify child pornography victims. One of the quotes stuck with me when one of the investigators talked about some of their worst cases where they've literally watched these children grow over the course of _years_ through the images of them that's shared online. People talk about maintaining your distance, but I don't know if that's even possible in that kind of situation. The idea of going into work everyday, knowing that there's even the slightest possibility that you'll find new images of a child you haven't been able to identify or save for the bulk of their childhood, is a mental challenge I can't even begin to comprehend.

</comment></comment></comment></comment></comment><comment><USER11> > "I called Backpage dozens of times asking them to take down those photos, > that my daughter was just a child and that what had been done to her was a > crime," says Kubiiki. "They refused and said if I didn't pay for it, they > couldn't take it down. In the end they just stopped returning my calls."

Man, I get the argument for free speech, but at least donate the profit from those listings to charity, and respond with empathy & take listings down when the actual mother calls you. He's already been arrested - literally nobody benefits from it staying up.

That's still a place I wouldn't want to be in, but at least you can argue a couple benefits like e.g. being able to catch some of the traffickers that would otherwise have gone deeper underground.

> Kubiiki's anger at Backpage grew and grew.

Historically, creating Warmaiden mothers whose life goal is to take you down ends badly. It's the only reason the Senate even cared about the issue.

<comment><USER12> Yes, this is very surprising. There was no reason for backpage not to remove the listing and refusing to do so could only lead to a lot more problems for Backpage.

</comment></comment><comment><USER13> Mary Mazzio:

"...But the thing that shocked me most about making this film was that those guys who ran Backpage, back in the day they were rabble-raising libertarians, yet, at some point, my view is that maybe the money became so outrageously intoxicating, perhaps there was this notion that the sale of children was simply collateral damage."

I'm a little unclear about what she was expecting. To my knowledge, libertarians are not find of enforcing their morals on others.

<comment><USER8> Maybe she was confusing "radical libertarians" with "radical liberals?"

<comment><USER14> a radical libertarian would basically be an entrepreneurial anarchist - <USER2> what would a radical liberal look like.

<comment><USER15> john brown

</comment></comment></comment></comment><comment><USER16> Should not cops, like, read this website too and do a raid everybody they seen someone offer themself nearby while looking teenage?

The major problem in our society is that police and detectives cost us a lot of money but basically do nothing. The only thing really saving us is that people of XXI century are unbelievably benign.

<comment><USER17> I understand the problem is basically understaffing. You don't have enough workforce to spend the time tracking these people down then actually doing something about it. It's the reason burglaries and bank robberies go unsolved until you have multiple occurrences and enough people see footage on the news.

<comment><USER16> I understand the problem is wrong priorities, where cops are engaged in busy work so they have no time to fight the actual crime.

Said busy work often concerns imaginary crime, like going after weed consumers or "computer pirates".

Often the system is either dysfunctional, and avoids crime, or crooked, and works to cover up crime.

</comment></comment></comment><comment><USER18> The core of the problem here is the fact that prostitution is illegal. If you legalize it, you can regulate it, and take steps to prevent human trafficking and child prostitution. The vast majority of clients will happily go through the legitimate channels and buy from licensed providers. A small minority will continue to trade in children through shady services, but the smaller volume will make it much easier for law enforcement to tackle.

</comment><comment><USER9> Everything you create online has abuse potential, I found that out the hard way with the whole streaming webcam thing. But it is how you deal with that abuse potential that makes all the difference, these guys appear to have done that in the most cynical way possible: by allowing their website to be used to commit terrible crimes against minors with internal policies explicitly geared towards enabling.

This should not - in my opinion - stop at a fine or some kind of slap on the wrist but should be factored under aiding and abetting and should come with jail time for those involved. If that's what it takes to get people to take this stuff serious then so be it.

<comment><USER19> BP doesn't do anything that couldn't be facilitated by a P2P system. If someone built a P2P classifieds app - should the developer be responsible for everything listed?

I think policing should fall 100% on the police. If something is illegal to upload or illegal to download - that's the responsibility of the end user - not the ISP, or the router manufacturer, or the SSL issuer, or the OSS contributors.

<comment><USER9> > BP doesn't do anything that couldn't be facilitated by a P2P system.

Indeed.

> If someone built a P2P classifieds app - should the developer be responsible > for everything listed?

No, but that is not the case here. I don't see how you could monetize a p2p system so that the creator of the software would profit of it but would not have a way to shut down illegal content, either requires some central system.

<comment><USER19> The backend could be powered by an app-coin issued by developers during an ICO.

I could see an argument for criminalizing decentralized architectures because "think of the children".

<comment><USER9> I know you´re trying real hard to do that but again: that is not the case here. So maybe stick to what is really happening rather than to imagine what you think might happen?

<comment><USER19> You made the hypothetical point that "Everything you create online has abuse potential" and concluded "it is how you deal with that abuse potential that makes all the difference".

I'm simply making the point that creators have no moral obligation to police how people abuse their creation.

So here's what will happen: BP will be shut down. The service providers and clientele will move to system that's more distributed and harder to track down. LE will chalk this up to a win, BP execs will get punished, and children will continue to be abused except tracking them down will be more difficult.

<comment><USER9> People doing illegal stuff will use whatever means they can get their hands on to do their illegal stuff. Giving them an easy to find platform means more illegal stuff is done, not less so adding a barrier will cut down the amount of abuse at the expense of making it harder to track them down.

It's a tough choice but rewarding the enabling of crimes like these is entirely the wrong signal, it makes it seem as if this is normal and acceptable which it never should be.

The other side of the coin is that the operators probably already use multiple sources for their 'customers' (I use the word loosely, you might as well read co-criminals for it), and that shutting this one down will only cut off a portion of the hydra that has visibility in the otherwise respectable part of the world. Punishing the customers of child prostitution while at the same time legalizing the regular form goes another step in the right direction, but may not be acceptable in all political climates.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> Backpage actions look bad and it may very well be that they deserve a serious fine or prison time for the management.

However, it was not through Backpage that their child was abducted. Instead, without Backpage, they might have never gotten their child back.

As a father, if Backpage is closed, I wouldn't feel any safer for my kid.

</comment><comment><USER4> > America's largest classified website, was to buy a fridge. The second time > she sold some clothes.

I've never heard of backpage as anything _but_ prostitution. Are there regions where it won out over Kijiji and CraigsList for buy and sell classifieds?

</comment><comment><USER21> > But the thing that shocked me most about making this film was that those > guys who ran Backpage, back in the day they were rabble-raising > libertarians, yet, at some point, my view is that maybe the money became so > outrageously intoxicating, perhaps there was this notion that the sale of > children was simply collateral damage.

</comment><comment><USER22> Really services like Backpage make the work if finding kidnapped people much easier. This has been going on long before there was a backpage.com site, but before the internet these women were forced to walk the streets and the likely hood of this woman finding her daughter back in the 1980s would have been almost nil. It's a double edged sword but if I were in law enforcement I would see Backpage as a valuable intelligence asset.

<comment><USER23> Did you read the article? They were editing posts that were obviously offering minors, and then allowing them, so as to profit from the post.</comment></comment>


Face it - You are Addicted to Success - <AUTHOR> http://online.wsj.com/article/SB123423234983566171.html Excellent excellent introspective piece! <comment><USER2> I wonder sometimes if the business world of the Internet is diverse enough to be considered "changing careers" if you move from one type of online business/service to another.

Example, from a web consultant to a startup founder.

<comment><USER3> Sure, I made two simultaneous changes in the last year and a half, with each one helping to make the other happen: went from a jack-of-all-trades front end dev to a usability-focused designer, and from never having been at a startup to focusing almost exclusively on them (and working with earlier and earlier stage startups as I went on).

It was definitely a rocky road but helped keep things fresh and I like where I am a lot more now.

<comment><USER4> but you're still basically a software developer (or designer, not sure what you mean by 'front end dev'), no? You could call it an extra step on your career, but I don't think that's a 'career change' (you didn't go from designer to lawyer - or from consultant to enterpreneur, like the example given)

</comment></comment></comment><comment><AUTHOR> A career change, imo, would be anything that requires a significant amount of 'new' skills though this piece is all about how we should be less dependent on professional occupation</comment>


Awesome Web Development Tools and Resources - <AUTHOR> https://www.keycdn.com/blog/web-development-tools/ <comment><USER2> I'd restore the title to begin with "100+". In other words, this attempts to be a categorized list of just about everything out there. Jump to the Summary at the bottom:

 _As you can see there are hundreds of web development tools and resources available to help streamline your development workflow and hopefully aid you in being more productive…_

Don't go there looking for insight, discussion, or help in deciding what to use for your next project. But do bookmark it as a reference perhaps.

<comment><USER3> I don't know for sure, but as someone who has had many submissions edited for title, I think the mods do edits like this because it makes the story look less like a listicle.

Even though I think this is a useful article, I agree that it's probably better to use the actual title. If a sub is getting voted up a lot like this one is, then it's confirmation that it's not a Buzzfeed-like listicle with thin content.

</comment></comment><comment><USER4> Nice article, but they missed PostgreSQL among the databases. I'm using it in half of the web apps I develop for customers.

<comment><USER5> Yep came here to say exactly this except it's all customers for us.

</comment></comment><comment><USER6> [http://aurelia.io/](http://aurelia.io/)

[https://babeljs.io/](https://babeljs.io/)

[https://www.polymer-project.org/1.0/](https://www.polymer-project.org/1.0/)

[https://karma-runner.github.io/0.13/index.html](https://karma- runner.github.io/0.13/index.html)

[http://www.protractortest.org/](http://www.protractortest.org/)

[https://cucumber.io/](https://cucumber.io/)

[http://es6-features.org/](http://es6-features.org/)

[http://webcomponents.org/](http://webcomponents.org/)

[https://www.jetbrains.com/](https://www.jetbrains.com/) [the most amazing IDEs]

<comment><USER7> Add Webpack ([https://webpack.github.io/](https://webpack.github.io/)) to this list

Also Jest, Jasmine, Mocha, Selenium. I mean, unit and integration testing were entirely stripped from the list in the link.

Nexus for local NPM repo (if you don't want to publish publicly, or pay a ton to make it private).

And you should probably learn a bit of Maven if you're on a Java stack so you can figure out how shit actually comes together on the page.

The joys of front end.

<comment><USER6> Well Karma uses Jasmine and Protractor uses Selenium. Protractor can be used beyond Angular too. Good point about about Nexus, I forgot about any code repos altogether, Bitbucket is private, free and awesome. I am seeing more use of JSPM too.

Honorable mention for sophisticated animations: [http://greensock.com/](http://greensock.com/)

And then there's the missing mentions about the plethora of mobile app bootstraps such as phonegap.

As complex as the frontend has become, C++ development requires a much more sophisticated set of skills and use of frameworks IMO. I do like that frontend work can require some decent engineering chops now, although it shrinks the talent pool considerably, for the present time at least. I personally look forward to the day jQuery DIAF now that much of the DOM API is standardized. Although it is extremely useful, it's a tight coupling that I'd rather do without.

</comment></comment></comment><comment><USER8> From a quick glance, this list claims CSS is front-end, mixes browser javascript frameworks with backend frameworks, mentions Ruby as a framework, lists outdated frameworks like CodeIgniter, doesn't include Vagrant under local dev environments... Not something I'd trust.

</comment><comment><USER9> Under editors, I'd include Brackets. Really enjoying it.

</comment><comment><USER10> Also need to add developer tools like Prefix.io, Glimpse, Rack mini profiler and others for various languages. These tools are a must have for all web developers.

</comment><comment><USER11> No bourbon neat and postgres? Astounding.</comment>


A threading riddle - <AUTHOR> http://dgoldblatt.com/a-threading-riddle.html

<comment><USER2>
        import Control.Concurrent.STM
        import Control.Monad
        import Data.Vector

        type VecInts = Vector (TVar Int)

        newVecInts :: Int -> STM (VecInts)
        newVecInts s = generateM s (\_ -> newTVar 0)

        modifyVI :: VecInts -> Int -> Int -> STM ()
        modifyVI vi pos val = do
          writeTVar (vi ! pos) val

        waitUntilEqual :: VecInts -> Int -> Int -> STM ()
        waitUntilEqual vi p1 p2 = do
          a <- readTVar (vi ! p1)
          b <- readTVar (vi ! p2)
          when (a /= b) retry

<comment><USER3> I'm not familiar with the semantics of software transactional memory, but doesn't this violate the "don't busy-loop" requirement? Is the retrying logic smart enough to set up some kind of watch on the values, or does it just run continuously until satisfied?

<comment><USER2> > Is the retrying logic smart enough to set up some kind of watch on the > values

Yes. It only retries when one of the referenced values is updated.

This does violate the rule "only use mutexes and condition variables", and perhaps the rule added at the end "you can't read the values" (comparing memory without reading from memory seems like quite a trick!).

<comment><USER3> The "you can't read the values" note is referring to the API exposed to callers, not internal restrictions on the implementation.

<comment><USER4> Are you sure? That doesn't seem to match with the wording:

> There's _no way_ to read the values from the array, only to set them and > compare them for equality

(emphasis mine). That seems to me to mean literally what it says; that you can query two values for equality, but, either way, have no information about what the values _are_.

EDIT: From the horse's mouth ([https://news.ycombinator.com/item?id=9801189](https://news.ycombinator.com/item?id=9801189)), I'm wrong.

<comment><AUTHOR> My bad; Strilanc's interpretation is correct. I updated the wording to hopefully be a little clearer.

<comment><USER4> Thanks! While you're here, is oconnore ([https://news.ycombinator.com/item?id=9800705](https://news.ycombinator.com/item?id=9800705) )'s solution legal according to your rules?

EDIT: Also, the wording

> There's no way to _read_ the values from the array, only to set them and > compare them for equality

seems unchanged.

<comment><AUTHOR> I think his solution is a little bit tongue in cheek - it shows how much easier it is to solve using transactional memory compared to low-level concurrency primitives. So it cheats by using very powerful techniques instead of the very weak ones that the post says to use. You couldn't use his solution in C++ for instance, because C++ doesn't come with garbage collection or transactional memory.

<comment><USER4> I see; I don't know enough about concurrency to recognise the tongue-in-cheek- ness (or whatever). Thanks for explaining!

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> My c++ solution: [https://gist.github.com/anonymous/7e6cc8f58e9cde1b6fda](https://gist.github.com/anonymous/7e6cc8f58e9cde1b6fda)

I believe it follows all of the requirements. There is one glaring flaw which is that it uses a condition variable per 'wait_until_equal' call, though it uses only N mutexes. So this doesn't fall under the N^2 primitives (in the case of many waits), though its unclear to me if thats an official rule.

Im happy to listen to feedback or if someone sees an error.

<comment><AUTHOR> Looks good to me; that's essentially the solution I had in mind (though, I think you have a race on NintBucket::waiters in modify and append_cv). Using a custom two-mutex lock class and condition_variable_any is particularly clever, I hadn't thought of that.

I just published my solution, which uses a similar strategy: [http://dgoldblatt.com/a-threading-riddle- solution.html](http://dgoldblatt.com/a-threading-riddle-solution.html)

I don't think of this as violating the N^2 primitives rule; the solution is still linear in the size of the problem its facing (it only uses K condition variables for K threads, so even if K is bigger than N^2, it's still morally in the scope of the problem).

<comment><USER5> Ah, yep I see the race. Here is a fix: [https://gist.github.com/sdab/d7ba036b2b7f4b5626cd](https://gist.github.com/sdab/d7ba036b2b7f4b5626cd)

Thanks for the puzzle, its hard to find good concurrency problems.

Edit: Looked through your solution. You are right, we thought of similar things. I started out by wanting a multi condition variable, but didnt want to implement it :). I ended up getting something similar in a roundabout way.

</comment></comment></comment><comment><USER6> This is an example of why I see node.js having more value in its single- threaded async architecture than in its capacity to use the same programming language on client and server.

More generally, when you discover a tricky problem that would make a good interview question, oftentimes there's an architectural decision that would eliminate the problem.

<comment><USER2>
        var a = [0, 0, 0];

        // Accept input from user
        function modify(i, v) {
          a[i] = v;
          // ...
        }

        // Trigger an event when two values are equal
        function waitUntil(i, j) {
          return new Promise(function(res, rej) {
            // ?
          });
        }

<comment><USER6>
      var EventEmitter = require('events').EventEmitter;
      var Promise = require('promise');

      function Answer() {
        var values = [];
        var emitters = [];

        this.modify = function(index, value) {
            values[index] = value;
            if (emitters[index]) {
                emitters[index].emit('modified');
            }
        };

        this.waitUntilEqual = function(index1, index2) {
            return new Promise(function(resolve) {
                if (!emitters[index1]) {
                    emitters[index1] = new EventEmitter();
                }
                if (!emitters[index2]) {
                    emitters[index2] = new EventEmitter();
                }
                function compare() {
                    if (values[index1] === values[index2]) {
                        resolve();
                    }
                }
                emitters[index1].on('modified', compare);
                emitters[index2].on('modified', compare);
            });
        };
      }

      var check = new Answer();
      check.waitUntilEqual(0, 1).then(function () {   console.log('equal'); });
      check.modify(0, 'x');
      check.modify(1, 'x');

<comment><USER2> Nice job! But I thought you said this problem would be eliminated by the architecture of Node.js? This appears to be longer and more complex than the fully parallel and concurrent Haskell solution.

<comment><USER6> It eliminates having to think about race conditions. It doesn't automatically mean concise code.</comment></comment></comment></comment></comment>


HEY's Gemfile - <AUTHOR> https://gist.github.com/dhh/782fb925b57450da28c1e15656779556 <comment><USER2> I tried the service recently and was pleasantly surprised to discover that every single page is server rendered and yet the experience is snappier than any modern SPA out there.</comment>


Chromium devs want the browser to talk to devices directly via TCP,UDP - <AUTHOR> https://www.theregister.com/2020/08/22/chromium_devs_raw_sockets? <comment><USER2> Chrome's monopoly is going to be worse than the IE days. Microsoft was more negligent than intentional. Google has been waiting for the day for a decade.

Look at what happened to Android. Google play services started out innocent, now it's half the OS. And "safety net", like the "patriot" act, is the nail in the coffin.

Buckle in bois for some good old fashioned monopoly fun

<comment><USER3> Yeah, rename IETF to GETF (Google Engineering Task Force). The only thing that prevents total domination today is iOS with its WebKit only policy.

<comment><USER4> It's quite ironic when one company's anti-competitive behavior paradoxically results in them preventing another company from achieving total monoculture domination.

<comment><USER5> Seriously this. Ironically Apple defends us from monopoly, maybe accidentally.

</comment></comment></comment></comment><comment><USER3> > Google senior staff software engineer Alex Russell said, "Note that this > capability is already available to Chrome Apps and Extensions and in no > scenario will we be handing it out like candy to any website that asks > nicely"

So websites will have to apply and get Google approval?

<comment><USER6> "Chrome Apps"??

You mean the things they've been talking about deprecating _since 2016_?

[https://blog.chromium.org/2016/08/from-chrome-apps-to- web.ht...](https://blog.chromium.org/2016/08/from-chrome-apps-to-web.html)

<comment><USER7> PWAs have replaced Chrome apps, hence why Microsoft and Google are making them as powerful as native apps, specially if packaged via the store, which even exposes native APIs as browser extensions.

<comment><USER8> Cross platform "native APIs" I hope?

Also whats "in it" for Google and Microsoft to promote PWAs, ie what would make them withdraw their support to PWAs?

<comment><USER7> Depends, cross platform native like APIs are one thing.

The other is when an application is packaged for the store, the native APIs are automatically made available, no need for you to manually write any FFI.

This how it used to work for old Edge, and Edge Chromium might eventually get something similar.

[https://docs.microsoft.com/en-us/microsoft- edge/progressive-...](https://docs.microsoft.com/en-us/microsoft- edge/progressive-web-apps-edgehtml/windows-features)

And on Android,

[https://developers.google.com/web/android/trusted-web- activi...](https://developers.google.com/web/android/trusted-web-activity)

</comment></comment></comment></comment></comment><comment><USER9> A lot of the security concerns listed in the article, while entirely valid, would be mitigated by a combination of a permissions check similar to the ones that already exist for things like the Clipboard API and a UI element to show what connections are in use and sending data.

Any issues that exist about using it for DDoS attacks already exist for the available network request APIs.

<comment><USER10> Mitigated how? Websites are going to force users to click "allow."

<comment><USER9> _Websites are going to force users to click "allow."_

That's a bit strong. A website can't _force_ a user to anything. The point is that to use the feature _nefariously_ without the user knowing it's happening is relatively easy to prevent by putting the feature behind a permissions flag. If the user actively _wants_ a website to be able to make connections they can say yes.

If the user doesn't know then they ought to be saying no, but really they won't and they'll say yes if the warning isn't scary enough. The browser vendors could also do things like throttling connections or asking for permission again if things look too weird.

<comment><USER11> Most people I know just click "yes" on all popups until the website starts working. In between every other website asking for notification/location permissions and a huge pile of GDPR popups (which are actively hostile towards users that attempt to opt-out), we've managed to condition web users into _routinely_ agreeing to give up their privacy and security. Hooray.

<comment><USER3> > Most people I know just click "yes" on all popups until the website starts > working

This. Defaults matter. You cannot introduce a privacy sensitive feature just with a permission dialog box. You must expect that most users just click through, and continue to protect those "dumb" users.

</comment></comment></comment></comment></comment><comment><USER10> This proposal would make ebay's job of port scanning their users a lot easier.

[https://news.ycombinator.com/item?id=23436775](https://news.ycombinator.com/item?id=23436775)

</comment><comment><USER12> Some thoughts

The design proposal doesn't say one way or the other, but I guess/hope this would be plumbing through to the underlying OS IP stack, otherwise your browser would need to obtain its own IP address. The source repo for this is called raw-sockets but nothing implies that's what they would actually use/require; raw sockets usually require root.

The proposed API is just to open sockets. Does this mean all these non-HTTP protocols are going to be implemented separately? Will they ship with Chromium, or are we looking at web sites sending down a bunch of wasm-compiled protocol implementations? Honestly, the developer thread was really enthusiastic but didn't seem to account for the vast gulf between "can open a tcp socket" and "functional mail client".

It's interesting that in the security mitigations section of the explainer doc, the author is explicit that listening for incoming connections is not part of the proposal _yet_. The developer thread is full of ideas that would require incoming connections (DHT specifically) though. Also, the idea that this unlocks communication with legacy systems seems counter to the idea that hostnames resolving private addresses won't work. I guess you get around this by making your app have connection profiles (common with RDP, Chrome OS SSH app does this, etc.).

I think this makes the most sense if you consider a web browser to actually be a rich UI toolkit that happens to speak HTTP. Should these developers get to write other network clients with CSS/JS frontends, or not?

<comment><USER13> > Should these developers get to write other network clients with CSS/JS > frontends, or not?

Google is wrecking web standards with their IE6 browser, shoving it full of unrelated crap to make their jobs easier and then strong-arming everyone to pretend they actually followed a process. Chrome sync, Web MIDI or the fact WebRTC shipped with a zero day firmly baked into a draft spec that couldn't be fixed for years. Ok Google.

</comment></comment><comment><USER14> Welcome to Chrome monopoly. Show as off as u are doing opensource (yeah 90% opensource) but hide DRM , do some weird trick to make YouTube fast using some shadow/hidden api, spread ads like malware using extension manifest v3 . Look at Andriod how hard it is to use ad blocker.

</comment><comment><USER15> This would be great if it could be done sanely, but it can't. A quick example would be making an ntp background service in wasm that can sync time for group video playback.</comment>


Very frank and honest FAQ given by a hosting provider. - <AUTHOR> https://www.nearlyfreespeech.net/about/faq#Easy

<comment><AUTHOR> NearlyFreeSpeech is a host that takes an interesting tact. You're not promised a massive (and oversold) plan that you may never fully utilize; instead, you're billed incrementally based on usage. If you're hosting a simple personal landing page site to showcase your resume and some place you can be found online, you may never pay more than a buck or two a month for the tiny amount of resources you use. NearlyFreeSpeech isn't the easiest personal web host to get started with—they say as much in their FAQ file, where not a single "one-click" web setup application is to be found—but the prices are rock bottom and you'll be out less than a cup of coffee a month for a simple personal web site.

</comment><comment><USER2> I call BS: <http://www.gandi.net/no-bullshit></comment>


The Hidden Damage From Geomagnetic Storms - <AUTHOR> https://medium.com/the-physics-arxiv-blog/insurance-claim-data-reveals-the-hidden-damage-from-geomagnetic-storms-df5c2e4d895e

<comment><AUTHOR> I really love this kind of lateral thinking to uncover evidence of another phenomena.</comment>


Father and Daughter Convicted for $100M Fraudulent Tax Refund Scheme - <AUTHOR> https://www.justice.gov/usao-sdfl/pr/fort-lauderdale-father-and-daughter-convicted-trial-involvement-100-million-fraudulent <comment><USER2> Earlier part of the story: [https://www.justice.gov/usao-sdfl/pr/daughter- father-charged...](https://www.justice.gov/usao-sdfl/pr/daughter-father- charged-filing-lottery-ticket-tax-refund-claims-seeking-175-million)

Submitted article was [http://www.idahoreporter.com/2019/florida-man- got-3-4-millio...](http://www.idahoreporter.com/2019/florida-man- got-3-4-million-in-tax-refunds-from-irs-after-claiming-to-win-lottery-he- never-won-authorities-say/) ("Man got $3.4M in tax refunds from IRS after claiming to win lottery he never won"). Changed via [https://news.ycombinator.com/item?id=21873501](https://news.ycombinator.com/item?id=21873501).

</comment><comment><USER3> Tax refund fraud is big business.

These two are not very smart. The smarter criminals steal someone's identity, file a fraudulent tax form using their identity, steal the refund, and then let that poor soul deal with the IRS when it comes after them to get their money back.

If you ever try to file and get a notice that you already filed, jump on it right away because you may have been targeted.

<comment><USER4> You'd better be a Mother Russia citizen and have a way to transfer funds there since there's no extradition. Otherwise they'll spend 100X your fraud to get you.

But I guess, years pass by the time a human looks at it

<comment><USER5> It took 100m of fraud to get caught. Would they have gotten away with 1m?

<comment><USER6> Everything about what they did was not well thought out. The way to do this scam with far less risk is with a stolen identity. They had the fraudulent refunds deposed into their own personal accounts and even tried to take the money and run after they knew for a fact the IRS had already caught them.

That said on $100mil of claims, the IRS only paid out 2.4% of that. At that rate, a $1mil claim nets you only $24K. I don't think I would fuck with the IRS for any amount of money (easier ways to steal I think) but for the risk a $2.4mil payout sounds a lot more plausible of a motivation than $24K does.

<comment><USER7> The question is whether the 2.4% was smooth across all filings, or whether it was 100% of the first million, 50% of the next million, etc as the computer system flagged things as unusual.

</comment></comment></comment></comment></comment><comment><USER8> I'm surprised at the large sums of money the IRS was willing to send out with essentially zero validation.

These people were claiming they had paid the IRS millions of dollars and were due massive refunds, but there is nothing in place to check what the IRS has _actually_ received from individuals before cutting 6-7 figure checks?

<comment><USER9> There are lots and lots of legitimate refunds of this quantity. IRS doesn't have enough resources to look too hard at each one of them, as the wait time for refunds would then be unacceptable.

<comment><USER10> No matter the quantities and amounts, any system or process where "I payed you X give it back" results in performing a payment without checking the assertion is fundamentally flawed.

If you can't prove the assertion don't make the payment, no matter how many months that means people might have to wait.

<comment><USER11> Eh, I see this as a form of eventual consistency.

</comment></comment></comment></comment><comment><USER12> The IRS is starved for funds. The powers at be (wealthy) wouldn't benefit from aggressive enforcement of tax law.

[https://www.propublica.org/article/how-the-irs-was- gutted](https://www.propublica.org/article/how-the-irs-was-gutted)

<comment><USER13> Sorry, but it's not the "wealthy" who are robbing us blind. There are tax cheats across all socio-economic levels.

For example a full 50 percent of people who took the "first time home buyers tax credit" did so fraudulently:

See: [https://www.npr.org/templates/story/story.php?storyId=114008...](https://www.npr.org/templates/story/story.php?storyId=114008700)

"In a recent audit, George's office highlighted nearly $500 million in homebuyer tax credits claimed by people who don't appear to qualify."

and

[https://media.npr.org/assets/news/2009/10/22/tigta.pdf](https://media.npr.org/assets/news/2009/10/22/tigta.pdf)

People in prison who didn't even own houses were applying for and getting the credit:

[https://www.npr.org/templates/story/story.php?storyId=128053...](https://www.npr.org/templates/story/story.php?storyId=128053710)

[https://www.eitc.irs.gov/tax-preparer-toolkit/frequently- ask...](https://www.eitc.irs.gov/tax-preparer-toolkit/frequently-asked- questions/fraud/fraud)

IRS has data that 26 percent are, to put it nicely, claimed "in error". No wealthy people are doing this. It's impossible.

<comment><USER14> $500 million is less than 2 dollars per person. If I forget to declare the 6 dollars that my neighbor paid me to feed his dog one day last week, I have committed more tax fraud than you have just brought up.

You either have no capacity to understand economics at the scale of the US government, or you're intentionally misrepresenting it.

<comment><USER13> Each individual committing this fraud has stolen between 2 and 8 thousand dollars. I don't think that's OK.

</comment></comment></comment></comment><comment><USER15> Still paid out with no other corroborating anything. Makes you wonder how often this happens with people that actually have money, and could turn around and say woops.

"According to the affidavit, K. Edmonson filed a fraudulent tax return in September 2017 seeking a refund of approximately $725,111. The return contained false and fraudulent claims that K. Edmonson had paid a substantial amount of withholding taxes. The IRS did not receive corresponding forms to support the claimed payments. Despite the false nature of the tax return, on January 28, 2018, the Department of Treasury mailed a tax refund check to K. Edmonson for $734,266.27 (including $9,036.27 in interest). Shortly thereafter, K. Edmonson deposited this tax refund check into his bank account."

<comment><USER16> Could the IRS have done this to get a larger conviction based on him actually taking the money?

Rather than just a charge of committing fraud on the tax returns, it's also now an added charge of stealing the money.

</comment></comment><comment><USER17> It will never cease to amaze me that the US DOJ and media publish full names. In The Netherlands, only the first name and the first letter of the last name will be made public—and the full name could remain a secret for many years.

<comment><USER18> That amazes me too, especially since people might still be innocent.

They do this in other countries too. Like Belgium, where after the Zaventum airport bombings the wrong guy was arrested as 'the terrorist with the hat that got away'. His full name published all over the place. His life destroyed now, lost girlfriend, friends, job, etc. Plus Belgium police keeps arresting him to nail him for something, anything really, to make good for their initial blunder.

<comment><USER19> It has to do with the concept of government transparency. In the US, from what I understand, the founders of the country feared secret courts issuing secret sentences for secret reasons.

So the idea is that almost all government stuff is public information. It's why FOIAs are so powerful. Literally anyone can ask the government to open up it's docs on virtually anything as long as national security isn't involved (and this is abused, but to a degree only) it has to comply.

Now, such a tool will inevitably have good and bad. Just as having private court cases will also.

Personally I think we need to create a privacy reform similar to the Civil Rights act of 1964 to address this and many other concerns. I'm simply explaining the thought process where our current tradition came from.

Florida actually has much broader public information laws than the rest of the country. That's why you see so many 'Florida man' stories. My understanding is FL takes it a step further than just being public, they publish much of it by default, making it easy for reporters to sift through and find headlines.

<comment><USER20> The Florida laws are colloquially known as the sunshine laws. And it's not just public records. It also includes pretty much all meetings between officials, even informal ones. And it also includes judicial records, which is why Robert Kraft's defense cares so much about suppressing the video from his case.

[https://en.m.wikipedia.org/wiki/Freedom_of_information_legis...](https://en.m.wikipedia.org/wiki/Freedom_of_information_legislation_%28Florida%29)

</comment></comment></comment></comment><comment><USER21> Wait, so they report earning some large amount of money, and claim they overpaid taxes on that? And then get a refund?

... is that seriously all it took?

<comment><USER22> The IRS accepts most statements made regarding facts on return unless there is clear error, in particular because refunds are due (per statute) much faster than the IRS is able to gather all relevant information on whether it is factually owed or not in some edge cases.

The backstopping function is that stealing from the IRS is a really bad idea because you'll probably be interacting with them the rest of your life and because you probably want access to the US financial system at some point.

<comment><USER23> > The backstopping function is that stealing from the IRS is a really bad idea > because you'll probably be interacting with them the rest of your life

Unless you are a foreign criminal stealing a US citizen's identity, in which case you don't care a hoot about their future relationship with the IRS.

</comment></comment></comment><comment><USER24> Related Topic:

You have to Paid Tax for Winning Lottery in US? Assuming that is how the Refund is taking place because of prior tax paid.

What other countries have similar law? I was always under the impression Lotto is free from Income tax, at least that is the case in UK and AUS.

The _tax_ system in US, judging from reading online media, especially with filing tax, credit, etc are so complex and felt so foreign to many abroad, where really dont have to do much.

<comment><USER25> In the US, all the lotteries are run by states, not the feds. The state has no standing to forgive your taxes due to the federal government. So one would also have to pay federal income tax on lottery winnings.

From there it varies by state. Some states tax the winnings (e.g. New York), others do not (e.g. California) and some states of course do not have income tax at all.

<comment><USER24> Arh I see. That make sense, Thank You.

( Not sure what's with the downvote )

</comment></comment></comment><comment><USER26> 65 years for tax fraud? I mean, it's scummy, sure, but that long? First degree, premeditated murderers get less...

</comment><comment><USER27> Is this a real site? It looks fake, and the writing is super weird.

Here's the DOJ version:

[https://www.justice.gov/usao-sdfl/pr/daughter-father- charged...](https://www.justice.gov/usao-sdfl/pr/daughter-father-charged- filing-lottery-ticket-tax-refund-claims-seeking-175-million)

It has more information, is better written, and is from April.

<comment><USER2> Ok, changed to that from [http://www.idahoreporter.com/2019/florida-man- got-3-4-millio...](http://www.idahoreporter.com/2019/florida-man- got-3-4-million-in-tax-refunds-from-irs-after-claiming-to-win-lottery-he- never-won-authorities-say/). Thanks!

<comment><USER28> It really should be [https://www.justice.gov/usao-sdfl/pr/fort-lauderdale- father-...](https://www.justice.gov/usao-sdfl/pr/fort-lauderdale-father-and- daughter-convicted-trial-involvement-100-million-fraudulent), because he was convicted a few days ago.

<comment><USER2> We'll change to that above and point to the previous link. Thanks!

<comment><USER29> A meta question, but why was everything from the comments to the title initially attributing everything to the man? The 35 year old woman spent twice many years doing this, claimed 2.4 millions compared to the 0.7 million that the man did.

Even ordering the father before the daughter looks odd but it is at least the original title, but the whole thing looked out of place here on HN.

<comment><USER2> I don't know, but let's not fly too close to the black hole of gender flamewar.

<comment><USER29> It was a failure in communication on my part to frame it as a question as that indeed only lead to flamewars. My intent was to simply voice criticism of the fact that it happened and that it seemed to go on unnoticed for a fairly long time.</comment></comment></comment></comment></comment></comment></comment>


Free Terminal, Git, HTML, CSS, and JavaScript Courses - <AUTHOR> https://www.rithmschool.com/free-courses <comment><USER2> The article on Git doesn't even cover the basics covered in Atlassian's "Getting started" Git tutorial.

[https://www.atlassian.com/git/tutorials/](https://www.atlassian.com/git/tutorials/)

Then there's the unexplainable lesson estimates, where a tutorial consisting of 3 sections, each comprisiing a dozen paragraphs and couple of commands typed in a terminal, somehow is expected to take 2-3 hours to finish.

Anyone interested in Gi can do much better with a simple google search on Git tutorials. Even wikibooks has better content than this site.

</comment><comment><USER3> This is a great free resource, progression makes a lot of sense and it doesn't hold your hand too much. I tried the HTML and CSS one and it rocks!

</comment><comment><USER4> Love it, I'd say it preps beginners well. Got an idea for when the advanced stuff will be out?

</comment><comment><USER5> Great stuff!</comment>


French Minister of Interior – Uber Activity Prohibited - <AUTHOR> https://twitter.com/afpfr/status/614153363656052736/photo/1 <comment><USER2> Not sure if anyone has been watching the international news but the Paris UberPOP launch is going very badly.

Related news: [http://www.telegraph.co.uk/news/worldnews/europe/france/1169...](http://www.telegraph.co.uk/news/worldnews/europe/france/11698444/Courtney- Love-attacked-by-anti-Uber-protesters-in-Paris.html)</comment>


Reddit AMA WithLee Byron, Previous Data Scientist  Facebook Codmentor- 5/5 - <AUTHOR> https://www.codementor.io/ama/1237952640/facebook-react-contributer-lee-byron?utm_source=hackernews&utm_medium=link&utm_campaign=Lee%20Byron

<comment><USER2> > We're so eager to start using [Relay] that we've made our own internal > polyfill called Delay - as in, Delay as long as possible until Relay is > released!

Technically this is a prolly fill, but that is a great name!

</comment><comment><AUTHOR> Correction! This is not a Reddit AMA, it is a Codementor AMA. RSVP at: [https://www.codementor.io/ama/1237952640/facebook-react- cont...](https://www.codementor.io/ama/1237952640/facebook-react-contributer- lee-byron)</comment>


Cleaning up bad bots (and the climate) - <AUTHOR> https://blog.cloudflare.com/cleaning-up-bad-bots/ <comment><USER2> This could be really interesting, we are currently using some custom bot detection techniques that also try to slow down / crash chrome headless and such, but it would be nice if we could just use this new Cloudflare service and stop worrying about maintaining it.

I have a few questions, though:

1\. How does this work with mobile apps / single page applications APIs? I'm worried this would block legitimate users

2\. Is it possible to enable/disable this feature on URLs patterns using page rules? I'm not seeing the option right now

3\. Do blocked requests end up in the firewall logs? If so, how do we filter for it? Specific rule id?

4\. Is there a way to enable it in log mode in order to evaluate the impact it would have?

</comment><comment><USER3> Nice work.

Hopefully this doesn't get flagged to death by bots on here, as is often the case for a story with climate in the title (particularly if it hits the front page). That would be far too ironic.

<comment><USER4> They'll probably be grumpier about the bad bots thing.</comment></comment>


Generating quines in Ruby - <AUTHOR> http://blog.chaps.io/2015/10/01/generating-quines-in-ruby.html <comment><USER2> If you haven't done it, I highly recommend trying to write a quine without looking at any answers. I wrote maybe the most gross one possible ([http://scpike.com/2013/10/19/a-ruby- quine.html](http://scpike.com/2013/10/19/a-ruby-quine.html)) but it was still a really cool aha moment when I got it working.</comment>


Do You Really Know CORS? - <AUTHOR> http://performantcode.com/web/do-you-really-know-cors <comment><USER3> This is an awesome overview! But don't take it as all encompassing, it doesn't go into some of the more esoteric edge cases with CORS, like:

* either an unreleased safari version, or the most recent version will send preflight requests even if the request meets the spec (like if the Accept-Language is set to something they don't like).

* If you use the ReadableStream API with fetch in the browser, a preflight will be sent.

* If there are any events attached on the XMLHttpRequestUpload.upload listener, it will cause a preflight

* cross-domain @font-face urls, images drawn to a canvas using the drawImage stuff, and some webGL things will also obey CORS

* the crossorigin attribute will be required for cross-origin linked images or css, or the response will be opaque and js won't have access to anything about it.

* if you mess up CORS stuff, you get opaque responses, and opaque responses are "viral", so they can cause entire canvas elements to become "blacklisted" and extremely restricted.

I feel like I've cut my teeth on this API more than most, and I still feel like I'm only scratching the surface!

<comment><USER4> The entire webstack is such a broken mess of inconsistencies and thousands of hidden traps that can render the entire thing insecure.

People moan about C yet I find the web stack greatly more painful to write because you didn't even have control over the compiler following standards strictly (where stuff has even been standardised).

I really do wish we worked together to create a new standard for building and deploying documents and applications over the internet because this HTML (and all its supporting technologies) is an experiment that has gone bad. Id preferably want something that doesn't allow each browser to interpret the specifications differently and absolutely something that isn't controlled by Google (they would obviously need input but the last thing we need is another AMP).

Of course it will never happen, but one can dream / rant nonetheless.

<comment><USER5> The web is the state it's in because it's a no-mans-land between warring proprietary vendors. Any one of Apple, Microsoft, or Google (even secondary players like Amazon, Oracle, or Valve) would much prefer a world in which they had the dominant platform and could get a 30% cut and arbitrary veto over all software written for that platform.

<comment><USER4> The problem you describe does exist but I respectfully disagree that's the reason why writing web applications has become as cumbersome as it has. I think the issue there is more down to standards authorities being glacially slow to recognise the change in demands. This has obviously allowed a situation where browser vendors such as Microsoft and Google have felt they needed to run amok just to offer many of the features developers were asking for (and to an extent, consumers too since end users were lured in by prettier and more interactive sites).

There have been other examples in history where programming languages used to differ - sometimes even significantly - depending on which compiler / platform you were targeting and where a standards body later stepped in to create a basic subset of said language that should be universal across all dialects (please note they cannot enforce this). In those instances that has lead to code to become greatly more portable.

To some extent, this is now happening with the web as well; however my secondary point to the complaint about differing outputs between browsers is that I believe HTML et al is a lousy way to design applications from the outset. That definitely is not a problem created by warring proprietary vendors or slow revisions of standards but rather just an artefact of technology evolving past it's original purpose yet still having to retain backwards compatibility. Maybe the time has come that we need a second language for the web so we have HTML et al for legacy applications, blogs and other stuff that is following some of the original visions of the web, but have a new language for web applications and anything that requires a stronger security model.

</comment></comment></comment></comment><comment><USER6> I'm ideologically against third party on the web because it is a privacy nightmare. But I'm in the system that I'm in, and I don't take on fights that aren't possible to win, so barring my becoming a billionaire I've kinda just accepted that third party is here for at least a little while and I'm not going to refuse to use ads and analytics. Except on my personal website, that gets to stay cool.

That said, CORS is the only thing about third party that I actually like. It's secure by default. That the ensure header and accept header are different things is amazing. I know all about the performance issues[0], but I'm ok with it in the right context.

[0] It's kinda funny how against the herd I am here. I think it is shitty that the preflight sometimes _doesn 't_ happen. It's so weird to me that we carved out exceptions for this and seems like an otherwise secure-by-default system should have come with the guaranteed preflight.

<comment><USER7> CORS is not necessarily about third parties.

It's common to have app.example.org point to a CDN and api.example.org point to an API.

And CORS implementation is terrible. The server has to transmit validation rules for the browser to enforce (with vendor specific caching differences), rather than just enforcing access itself.

The reason it's implemented this way is because of the organic evolution of web security.

<comment><USER8> > rather than just enforcing access itself.

Could you elaborate on that? I can't picture the alternative you're suggesting.

<comment><USER7> The alternative is for the idea agent to send the Origin header on all requests.

Then the server responds with 200 or 403.

<comment><USER9> The people with the security problem are the users of browsers, and the browser vendors have a solution to solve that problem built into the browser. If they didn't enforce it at the browser level, the owners of the servers would have little incentive to enforce CORS and most just wouldn't. See https adoption.

<comment><USER10> Bingo. I still kind of wish there was an ability to make the browser invoke some kind of request that servers would reject by default (e.g. with a non- standard HTTP method) that could combine the preflight check and the request while still making servers that don't anticipate CORS blanch and not take any dangerous actions. But the browser security model is complex and messy enough as it is, so I doubt it's worth it.

</comment></comment></comment></comment></comment></comment><comment><USER11> One idea that the article doesn't convey well, in my opinion, is that the Same-Origin Policy only prevents the browser from _reading_ the response from an HTTP server to third-party host, but it doesn't prevent the request from being issued in a first place. The CORS headers are merely a way for the server to indicate to the browser whether it is allowed to read the response of not, but it doesn't protect the server from anything.

Especially, setting the "Access-Control-Allow-Credentials" header to true means that a client which sent a request with a cookie is allowed to read the result, but whether the request is sent with a cookie or not, and will be treated as such by the server, is entirely up to the client.

So although malicious.com cannot read the details of bank.com using AJAX, it can definitely send a POST request to trigger the transfer from the user's account to a malicious account using the user's cookie (blindly so).

This is the reason proper CSRF protection must be implemented by the server, independently of whether CORS is enabled or not.

<comment><USER12> This is not entirely true. The preflight's role is exactly to prevent a post request to be sent to the server. There is no preflight only in particular cases.

<comment><USER11> This is entirely false. POST requests with headers set automatically by the user agent aren't preflight-ed. There is a preflight only in particular cases.

</comment></comment></comment><comment><USER13> I recently implemented a feature that depends on CORS and I don't see anything in this article that adds any value over Mozilla's thorough CORS docs.[1]

If you're writing an article on CORS today I also think you should mention recent CORS developments such as Cross-Origin Read Blocking (CORB)[2] and features on the horizon such as Cross-Origin-Resource-Policy, Cross-Origin- Window-Policy, etc. that in light of Spectre, Meltdown etc. are meant to help plug speculative execution holes.[3]

[1]: [https://developer.mozilla.org/en- US/docs/Web/HTTP/CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)

[2]: [https://www.chromium.org/Home/chromium-security/corb-for- dev...](https://www.chromium.org/Home/chromium-security/corb-for-developers)

[3]: [https://www.arturjanc.com/cross-origin- infoleaks.pdf](https://www.arturjanc.com/cross-origin-infoleaks.pdf)

</comment><comment><USER14> > _performantcode.com took too long to respond. ERR_CONNECTION_TIMED_OUT_

Too ironic not to mention.

</comment><comment><USER15> I love CORS. I wouldn't be able to provide the level of security with my API that I do because of it. Without CORS, I don't believe my API design would be practically possible due to the security risks.

If I have access to the Fetch API, I can tell the browser to send the user's cookie cross-origin and I can validate the request based on the origin. This allows for interesting authentication scenarios without the need for explicit client-user consent pages.

<comment><USER16> >and I can validate the request based on the origin

Are you talking about the HTTP referer? That's easily spoofable and can't be relied on server-side. The same-origin policy and all the CORS security is implemented in the browser itself, not in HTTP.

If you need to be certain that a request originated from your own page and not another domain you need to use a CSRF token.

<comment><USER15> I'm talking about the Origin header, which is present on XHR requests and cannot be assigned by code. A CSRF token is not necessary if you require Origin because the origin is not sent with standard HTML forms.

<comment><USER17> It can be inside of insecure browsers, you're not any more secure than you were before after CORS.

<comment><USER15> Users with insecure browsers are subjecting themselves to security vulnerabilities, not me. In this case, the service just wouldn't work for them. Not overly worried about those users because they represent a diminishingly small portion of our user base.

<comment><USER17> The problem is that you can be unaware. It's also not tracked as a metric. Nobody knows how large or small it is.

Also, it's easily bypassed.

</comment></comment></comment></comment></comment></comment><comment><USER18> I never really understood why we have CORS. I mean, the problem with CSRF is that some random page can trick your browser into adding its authentication token to a request which does not originate from the authenticated page. So why the do we need the server to tell the browser that it should not send requests from other origins?

In my opinion, it would have been much better to improve the browsers to not include cookies in 3rd party requests automatically (only when they are explicitly specified via JS for example). It should have solved the issue equally well, without introducing some bulky server-side security feature to remote control browsers.

<comment><USER19> Ya I generally think CORS is a waste of time. It would have been better to provide a hash of the file we're linking to and trust that rather than where it came from. Which is precisely what Subresource Integrity (SRI) does:

[https://en.wikipedia.org/wiki/Subresource_Integrity](https://en.wikipedia.org/wiki/Subresource_Integrity)

Sadly even though this is an obvious concept and trivial to implement, it took them over 20 years since the web came out to get it in most browsers. The cost to society of having thousands of copies of the same commonly used files (like jQuery) hosted locally on countless servers rather than having a centrally hosted version already cached from previously visited sites is staggering to contemplate. I'd really like to know who was behind the holdup on deploying SRI.

<comment><USER20> CORS is about a lot more than just static assets. SRI does not replace CORS.

</comment></comment></comment><comment><USER21> CORS is a technical subsidy granted to (sloppy) users of cookie authentication. I've never worked on a project where it was anything other than an annoying hoop to jump through.

<comment><USER22> When has "subsidy" become the go-to narrative to argue against any sort of deference to real-world usage?

You could just as easily frame CORS as "antibiotics for the people who dared to leave their house".

(There's also a no-true-scotsman fallacy going on in your argument)

<comment><USER21> More like "mandatory medical testing at the airport because some people don't vaccinate" from my perspective.

It's a "subsidy" because we all have to spend time on it, even though lots of people don't receive any benefit from it. It's not intolerable, the Web is based on community standards and responds to community needs, and I'm fine with that. But I'm always on the losing end of this one so I'm going to say so.

</comment></comment></comment><comment><USER23> Im curious how many newer JS+API applications still use browser cookies as a means of authenticating API requests and how prevalent cookie usage still is for these types of applications?

JWT/tokens + Local/session storage + adding fetch headers seems like the best way as long as you don't run untrusted JS.

<comment><USER24> "as long as you don't run untrusted JS" is a surprisingly tough hurdle to hit, even for very experienced developers.

What is your reason for preferring JWT + localStorage for authentication and session handling? I'm genuinely curious, as httpOnly cookies strike me as better in every meaningful way.

</comment></comment><comment><USER25> Mirror: [https://web.archive.org/web/20181004000006/http://performant...](https://web.archive.org/web/20181004000006/http://performantcode.com/web/do- you-really-know-cors)

<comment><USER26> You the MPV!

</comment></comment><comment><USER27> Had to deal with a firewall that filtered all unknown/"new" HTTP headers. This included CORS.

A PITA to find the reason why Firefox wouldn't use the Google fonts.

<comment> crooked-v That kind of crapware is why I'm increasingly glad that the http specs are moving towards being completely illegible to middleware boxes.

<comment><USER28> How would http be any harder for middleware than app-layer? If both linked to libhttp.c, couldn't they each get the full parsing/reading/writing - <USER2> proxy or server?

<comment> crooked-v Being able to parse HTTP doesn't get anywhere when you can't actually get at the contents because they're encrypted (as with all major HTTP2 implementations).

<comment><USER27> [https://www.howtoforge.com/filtering-https-traffic-with- squi...](https://www.howtoforge.com/filtering-https-traffic-with-squid)

[http://www.watchguard.com/help/docs/wsm/xtm_11/en- us/content...](http://www.watchguard.com/help/docs/wsm/xtm_11/en- us/content/en-us/certificates/cert_https_proxy_resign_c.html)

</comment></comment></comment></comment></comment><comment><USER29> This is really an informative article. We've recently stumbled across this issues and all other pages I could google did not explain it as clearly as this page.

<comment><USER30> My experience was the same as yours, resources explaining things assumed technical knowledge far beyond my level or were not very clear. This was a very well put-together article.

My only contribution to the discussion is that if you get a CORS error where you wouldn't expect it, the problem might not be a CORS issue. I spent the better part of a weekend trying to debug why a request to a Google API wasn't working and why I was seeing a CORS error (same thing worked fine on another system). Turns out, it wasn't the same thing, my url had a typo...

<comment><USER31> You may also enjoy [https://hackernoon.com/im-harvesting-credit-card-numbers- and...](https://hackernoon.com/im-harvesting-credit-card-numbers-and- passwords-from-your-site-here-s-how-9a8cb347c5b5)

</comment></comment></comment><comment><USER32> Why not just include the Origin on all cross-origin requests? Then the server could deny/allow it without the need for preflight.

<comment><USER33> I would be concerned about the privacy implication of it. Imagine if the browser sent the origin to widely used CDNs, or to Google Fonts, and that people didn't actually block Google domains on their browsers.

Also, this would not be secure by default, because you would have to change the default behavior of the server to block cross origin requests.

<comment><USER34> Browsers already send the referer header on all those CDN requests, provided that the CDN is loaded over https. If anything, the origin contains less information.

</comment></comment></comment><comment><USER35> How do you prevent people proxying your API via a node service?

This is something I could never get my head around with CORS - what's the point of whitelisting origins if getting around the whitelist is nothing more than an inconvenience?

<comment><USER36> CORS is mostly used to prevent attacks from a browser script on a non- whitelisted website (CSRF etc.).

To prevent someone abusing your API otherwise, use an authentication method.

</comment></comment><comment><USER37> I built out [https://github.com/krakenjs/fetch- robot](https://github.com/krakenjs/fetch-robot) to avoid some of the esoteric issues around CORS endpoints -- and to avoid the performance hit of that preflight request.

It acts as a `fetch` implementation that allows you to declare cross-origin policies in advance, then channel the requests through an iframe which enforces those policies.

</comment><comment><USER38> Here's one question that's always bugged me - What's stopping a malicious user from sending an HTTP request from any API client like Postman, or even Curl from the CL? Something like a post with: {transferTo: myAccountId, amount: 1000000000}?

Obviously in any nontrivial web app it would fail because of authentication issues, but if a server doesn't do ANY sort of security checking, that should work, no? Does that mean that the onus is on the server developer of mybank.com? And if so, what would stop the malicious request from working on any server developed before the existence of CORS?

<comment><USER39> Server is supposed to check authentication/authorization through some method.

If HTTP, that's done via setting some information in the request headers, be it a cookie, or basic auth, or token auth, or similar.

CORS is done by the browser - to not allow certain requests to be made (In case you are accidentally executing malicious javascript code). The server tells the browser via the CORS headers which requests are ok to make.

</comment></comment><comment><USER40> My only experience with CORS has been when trying to access api.foo.com from a web page on foo.com, and then getting denied. Then I messed with the settings on api.foo.com trying to get it to allow access from foo.com, and then I gave up and just configured the load balancer on foo.com to proxy requests to foo.com/api to api.foo.com.

So far it's only gotten in my way as a developer. But it's there to protect users, not me. So at the end of the day, I'm glad it's there as a way to somewhat prevent people from tricking my users into hitting my api with malicious requests.

<comment><USER41> You have it backwards. This type of request was not possible at all before CORS, CORS is what allows you to make it possible.

</comment></comment><comment><USER42> very nice article. I thought I understood CORS but learned some new things:

* not all cross origin requests need to be preflighted * to use credentials, server needs to explicitly allow credentials to be sent from client

</comment><comment><USER43> No... I don't despite my best efforts to be diligent about learning it. :( It's a workaround for a bunch of compromises we made where the cure is almost not worth the pain.

</comment><comment><USER44> > Do You Really Know CORS?

Of course I don't, nobody does.

</comment><comment><USER45> I know it well enough that changing to a custom mime-type like "text/x-myapp- foo" is a solution that gets around CORS and pre-flight as well in the latest version of Chrome.

<comment><USER3> Are you sure? That's a pretty insane security issue if it's true!

Content-Type should only be allowed to be `application/x-www-form-urlencoded`, `multipart/form-data`, or `text/plain` to be allowed without preflight.

Edit: I can't reproduce this on Chrome 69.0.3497.100 (Official Build) (64-bit). Setting the Content-Type to anything other than the above with a POST request will cause an OPTIONS preflight, even when using your example.

<comment><USER45> I'm using 69.0.3497.81. Make sure your server accepts the header... after changing I stopped seeing OPTIONS requests in my server logs, not that it measurably improved the speed of the SPA. It was several months ago I made the change and FF behavior is definitely different (more relaxed?) than Chrome when it comes to CORS.

<comment><USER46> There's caching for successful preflights; maybe it's involved here?

</comment></comment></comment></comment><comment><USER47> Please explain why browsers can't request and use any url as a regular curl command does (I'm explicit talking about request without sending browser cookies)

<comment><USER48>
        curl http://192.168.1.1/

Every site you visit would have unauthenticated read access to internal servers on your LAN, such as your router's home page.

<comment><USER49> Or your printers admin interface. Or your NAS.

</comment></comment></comment><comment><USER50> You think you know CORS, and then your users visit your site with the Edge browser...

</comment><comment><USER51> I tend to use jsonp to get out the cors restriction time to time

<comment><USER52> But jsonp have to be supported by your extern API.

</comment></comment><comment><USER53> the link is not working for me. Is there an alternative link.

<comment><USER54> [https://dzone.com/articles/do-you-really-know- cors](https://dzone.com/articles/do-you-really-know-cors)

</comment></comment><comment><USER55> I don't know CORS that well, but like any dev worth their weight in salt I know how to get around it:

\- iframe \- domain js hack \- reverse proxy \- http header

What else? Referrer Policies await.

<comment><USER56> I agree, the only thing I have ever found with CORS is that it makes it difficult for people who don't consider it when planning out servers should run. It goes like this:

\- Just use my API...

\- I tried, please enable CORS.

\- What's CORS?

I find it frustrating that this seems to be the default for most servers. I think it should be opt in and not opt out.

<comment><USER41> In order to make it opt-in you'd need to disable cookies by default (at least for auth) or else you get massive pwnage by default.

</comment></comment></comment><comment><USER57> I am very upset that no one said "Of CORS I do!"</comment>


What new gtld are you hoping for? - <AUTHOR>

Are you interested in the new gtlds? if you are which ones are you looking at getting or investing in? <comment><USER2> internet.today</comment>


Moonlight towers - <AUTHOR> https://en.wikipedia.org/wiki/Moonlight_tower

<comment><USER2> I always love passing a moontower, in part for its history, and in part for its role as the subject of a great Dazed and Confused quote: "Party at the moontower!" So evocative of old, sleepy Austin.</comment>


If Trump Is Down in the Polls, Why Do So Many Americans Think He'll Win? - <AUTHOR> https://fivethirtyeight.com/features/if-trump-is-down-in-the-polls-why-do-so-many-americans-think-hell-win/ <comment><AUTHOR> A few interesting insights/theories in this (FiveThirtyEight weekly political chat transcript):

\- _the polls had Clinton as the likely winner in 2016 and Trump won — so, of course, some people are wary of the polls again._ , in other words, "once bitten, twice shy".

\- _there's also a sense that Trump is Teflon politically_

\- _... the reporting that Trump staffers X or Y or various senators or GOP strategists think Trump is in trouble tells us little. I read those stories from May to October 2016, and they often turn out to be wrong._

\- _... events still matter at the margins, and the margins could be decisive, considering Trump won because of about 78,000 votes in three states in 2016._

But, sadly, the bottom line for me is:

 _... people are correct to be uncertain about the election. We are still six months out._</comment>


Memory Deduplication: The Curse That Keeps on Giving - <AUTHOR> https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/8022.html <comment><AUTHOR> i will add the video link as soon as it appears here : [http://download.mette.org/videos/33c3/](http://download.mette.org/videos/33c3/)

<comment><USER2> When that happens you should consider submitting that link as its own story.

<comment><AUTHOR> done: [https://news.ycombinator.com/item?id=13283545](https://news.ycombinator.com/item?id=13283545)</comment></comment></comment>


NYC isn't catching the Valley anytime soon: Reflections on Startup School - <AUTHOR> http://blog.tutorspree.com/post/12165674875/nyc-isnt-silicon-valley

<comment><USER2> A big issue is that finance continues to draw the bright, ambitious and the greedy away.

Somebody who founds a company worth $5 billion is royalty in Silicon Valley. Around Wall Street you'll find fresh-faced kids with nothing more than degrees from Andover and Yale running hedge funds bigger than that. Much more money for much less work, risk and accomplishment.

You just can't make enough money from startups to impress people in NYC.

Other than that I'll say that NYC has the most formal dress code of anywhere I've been. You can show up in "hacker costume" that includes clean denim and a t-shirt that fits in any town other than NYC. In NYC, people ~will~ hold it against you if you don't wear a button down, tie and all that.

My motto is "when in rome", but it's not an attitude that's welcoming of tech talent.

<comment><USER3> Funny, I don't know what NYC you experienced, but the one I live in has a much wider variety of people than the types you've mentioned.

I know plenty of people that go to work in jeans and a t-shirt, and no one holds it against them. Personally, I prefer to dress a little bit nicer; not to mention that (other than during the summer), the weather dictates the dress code to a large extent.

I could go on with more counter examples, but the point is, you have a very narrow view of what NYC is actually like.

* P.S., re: Coffee: Try the Ace Hotel lobby on 29th between Broadway and 5th. There is an independently-run Stumptown Coffee shop attached (best coffee in NYC) and I'm there virtually every Sunday working on my laptop. With their free wifi. Along with about 20 other people doing the same thing.

<comment><USER4> I just have to say, the best coffee in NYC is actually La Colombe on Lafayette and Prince. I will buy you a cup if you haven't tried it ;)

<comment><USER5> I'm gonna go with Gimme coffe. But stumptown is decent as well. La Colombe is a little too bitter for my taste ;)

<comment><USER6> We at blip have been frequenting gimme!, but less so since Bowery Coffee opened on Houston. You should really check that out, it's great.

<comment><USER7> Nope the best place is the The Pulp and The Bean in brooklyn. Ask for the Dieci :)

</comment></comment></comment></comment></comment></comment><comment><USER8> > P.S. - Cheap and accessible fiber. Come on NYC, we need that if we're going > to win.

Fiber coverage is pretty good now. Many buildings still don't have it, but it's in most neighborhoods; my girlfriend has Fios and she's way out in Queens, but I don't have it down in the East Village 'cause it isn't run into my building yet. That said, fiber isn't the only game in town -- Roadrunner in NYC has DOCSIS 3, and $100 gets you a 50Mbit connection, which I absolutely adore.

<comment><USER9> Yeah I have verizon fios in the lower east side(albeit a new building) its probably the fastest internet i've seen. You can either move to a building with it or get a virtual office in the city that has fiber. Don't think its a big limiting factor in nyc.

</comment></comment><comment><USER10> whenever i read comments about nyc's best developers ultimately being sucked into the vortex of finance, i want to gag.

i can only assume that these commenters haven't spent much quality time here (or in finance - which is, for the most part, _not_ glamorous, but rather soul-sucking)...or they have spent some time here and have a very limited view of the city.

nyc is more than just wall street, "silicon alley" and midtown. i've worked in several places (boston, london, atlanta, san fran)...and i've never come across as rich a mixture of people who "make stuff" as i have in brooklyn.

on a related note: it'll be interesting if stanford ends up winning the bid to open a campus in NYC. (i think the navy yard location would be perfect!)

btw, great coffee (and serendipity-friendly) spots in brooklyn: gorilla, cafe grumpy, ...a new place called rucola (serves stumptown), and many many more.

<comment><USER11> Seeing as this is the top comment, could someone please back up this argument beyond personal anecdote? At least the people arguing the other direction are pointing at actual companies.

<comment><USER10> i'll throw down a few off the top of my head: foursquare, 10gen, etsy, a cool one called makerbot, stackoverflow, etc, etc., etc. ...but there are lots of little guys you probably haven't heard of yet popping out of columbia/nyu or the great design schools like pratt/etc. or coming out of the larger companies around here. it's actually an exciting time to be in the city...

listen, i love the valley. ...i just want people to know that _my_ nyc is a creative and fun one. ...and you can live a happy/rich/fascinating existence here without touching a line of fintech code.

<comment><USER11> And you've gotten your point across nicely. But that's not the conversation here. It's whether it can catch up to the Valley anytime soon, a different question entirely than whether there are cool little companies scattered around. Here in San Francisco, you end up inside a tech company if you so much as sneeze. Twitter is moving across the street from my apartment. When I walk to get a sandwich I pass by several world-class tech companies and a dozen startups. New York isn't even in the same league. Maybe someday it will be... I hope so!

<comment><USER10> good points...i definitely get chills (in a good way) going down 101 or walking around soma, etc., feeling the energy of the tech companies all around me. it was definitely a motivating factor when i worked there. (lo those many years ago.)

(btw, the other comments seem to focus more on the mythical finance vortex here, which i'd love to debunk someday...hence the sidetrack.)

as for being in the "same league," i guess i dunno know what that means, really - from the perspective of a person trying to get an idea off the ground. (and i write this having started/sold one myself, been an early member of a company that went public, been part of a flame-out...and been through plenty of ups and downs over my startup-oriented tech career).

both have great access to capital...great engineers...pently of startups (not a smattering) and plenty of spots for serendipitous meetings with interesting people (we got plenty 'o those). ...i think the rest is pointless d#ck measuring when it comes down to it. any location is really what u make of it anyway - as long as you're not in a _bad_ one.

don't get me wrong, i'd love to just bump into ron conway or PG at my local coffee spot. perhaps they'd visit the good people of brooklyn someday...over a latte with a side of capacitors at the local hacker collective. ;-)

</comment></comment></comment></comment></comment><comment><USER12> Bottom line: In SV people who make stuff are respected. In NYC people who make money are respected.

Obviously this is not true 100% across the board, but anyone who has experienced both cities will immediately grok what I'm talking about.

<comment><USER13> That sometimes true and you've hit the head on the nail in some cases -- but it also depends on what you're making. NYC really respects creatives -- be they actors or designers or writers in a way that you wouldn't see in the valley.In fact while Hollywood respects the hit making skills of creatives, I think NYC is unique in respecting creativity itself.

<comment><USER14> I agree - NYC definitely respects _flamboyantly_ creative people, who are just as interested in making their image as in making their art (for whatever value of art), but "hackers" don't really seem to fit that mould.

</comment></comment></comment><comment><USER15> Re: "Coffee Klatch."

Sure, we need more of these around. I'm just happy there's a place like this that fits the bill right in my neighborhood. It's more of a cafe than a coffee shop, but that didn't stop the owner from putting dual power plugs in between every couple of seats at the bar. And getting a darn fast wifi connection.

That they make some of the best drip coffee in the area, and serve brunch 7 days a week, combined with affordable prices...

The owner has a coffee shop too, but it's too cramped to work in all day. He recognized that people were starting to try to do that there - and kept it in mind when he opened up this cafe. During a typical weekday, the bar is filled with people with laptops open.

<comment><USER16> Where is this? Been looking for a decent coffee shop/cafe to work in for a while now.

<comment><USER5> I always see a bunch of people w/ laptops at the Bar at Cocoa bar: <http://www.yelp.com/biz/cocoa-bar-new-york>

Also there's usually a couple laptops out at Coyi Cafe up the streeet on Ave B.

Though I do agree that there's a shortage of good spots to hang out w/ a laptop for a few hours during the week daytime.

(not that this has any effect in my mind as to whether NY is better than SF for startups, but whatever)

</comment></comment></comment><comment><USER17> I think Austin is the next tech hub. The weather is better than NYC, vibrant food scene, large pool of talent/graduating students, readily available cheap/24hr food and coffee (especially near campus).

<comment><USER18> I just got to Austin, and may be leaving at the beginning of the year, but as a city, the place is unreal. It's now bigger than San Francisco, but still feels like a town, which I prefer... Nothing like the Valley, but they say 2011 was kind of a watershed moment for the Austin tech scene with three web- based companies going public (shift away from enterprise tech). We'll see how that goes back into the ecosystem...

</comment></comment><comment><USER19> _Walk into a coffee shop in Palo Alto (say…Coupa). Pull out your computer, open your gmail or git or twitter. Now leave and try another shop. And another. Go try that in NYC before researching exactly which shop has WiFi._

This is easier to do in Williamsburg, Brooklyn than Palo Alto

edit: to prove the point, here's the free wifi list from yelp for wburg and greenpoint just to show how common it is

<http://bit.ly/uAEJhd>

</comment><comment><USER20> I've lived in both NY and Silicon Valley. I think the best description of the difference in mentality is:

In NYC, if you can make a million dollars cool, but it's even better if you screw somebody out of a million at the same time. In Silicon Valley, if you make a million dollars cool, but it's even better if you help somebody else make a million at the same time.

<comment><USER10> honestly, do these people look like they want to screw you out of your first million?

<http://hackerspaces.org/wiki/NYC_Resistor>

;-)

look at all those happy/helpful people, ready to volunteer their time and emotional shares to help you get your project off the ground. (and this is only one great hacker spot in the city.)

in my experience (~10 years in manhattan+brooklyn)...these are the kinds of people/groups that are here...looking to build stuff and have fun.

...but, of course, in a place as large as this, you'll find all types. (as you do in the valley too, really.)

</comment></comment><comment><USER21> _Walk into a coffee shop in Palo Alto (say…Coupa). Pull out your computer, open your gmail or git or twitter. Go try that in NYC before researching exactly which shop has WiFi._

Interesting point. Was at Coupa just this weekend. Couldn't get Wifi :)

<comment><USER22> Yeah they turn it off on the weekend to encourage conversation, but if you ask real nice sometimes you can get 'em to turn it on.

<comment><AUTHOR> And you can usually pull in a signal from Old Pro...

<comment><USER22> Never had luck with that one. Maybe it's the aluminum mac body? Anyway, I got an N1 and that has pretty much solved this for me worldwide.

</comment></comment></comment></comment><comment><USER23> could someone explain to me why it's relevant for ny startups to have billboards? i just don't understand that point at all.

<comment><USER24> It reflects the cultural value of the environment.

</comment></comment><comment><USER25> I haven't found NYC Wifi to be a problem. Just the other day I was in Penn and got an emergency phone call. I just hopped into Stackbucks and did my thing with no problems at all. While there was no seating, the Wifi was just fine.

Now, if you're looking for a place to work you might want to look into co- working instead. In NYC the shops just can't afford to have you sitting there taking up space all day for $10 worth of coffee.

</comment><comment><USER26> Other than how it affects your chance of success, this seems a little silly. #1 #2 .. who cares? Why get all tribal about your city? There are tons of industries here in NYC, so if you are targeting your offering to larger businesses, then there are worse places than NYC to be close to your customers. If not, and you are doing 'Social Toilet' or whatever, then it might make sense to go elsewhere.

</comment><comment><USER27> Ramen profitable in NYC is lame compared to elsewhere. That's why it's not going to happen. End of story.

Now, I could totally see Jersey getting Valleyish if it weren't for the stigma of Jersey.

</comment><comment><USER28> "Coffee Klatch"

I'm struggling to find a coffee shop in San Francisco that has unlimited wifi and stays open late, where late >= midnight. Suggestions?

<comment><USER29> Starbucks at Laurel Height is open 24hr (California and Laurel St, <http://www.yelp.com/biz/starbucks-san-francisco-132>).

It is hard to find seats before midnight, as it is full of students, but it is as nice as a starbucks get.

Since it is so popular, starbucks tried to open another 24hr location close by, but there was a lot of opposition from local coffee places, so they didn't get a permit.

</comment></comment><comment><USER30> Re: fiber. I wonder how much of this has to do with NYC's older infrastructure. Does Boston boast better access?

<comment><USER31> Does it matter so much, when you can put your servers in a local co-lo facility which will have fiber terminations for the big ISPs? As long as your office has reliable connections, I don't see the problem.

</comment></comment><comment><USER32> NYC needs a consumer startup to go big. Think a company the with the size and popularity of FB but based %100 in nyc. Right now we got nothing.

<comment><USER33> We do have Tumblr, Etsy, and Foursquare - but I agree, a Facebook size company coming out of New York would do wonders for the ecosystem.

<comment><USER34> > We do have Tumblr, Etsy, and Foursquare...

But would you know that if you weren't already plugged into the tech scene? I don't recall seeing a sign outside of Foursquare's building. Etsy had a handmade sign taped to some windows you couldn't see from the street unless you knew to look for it. 111 8th Ave doesn't have a big Google sign out front. There's no big Vimeo or OkCupid, etc., etc., signs outside IAC's headquarters. I don't believe Tumblr has a sign out front. In fact, the only tech company sign I recall seeing on the side of a building in NYC was Squarespace before they moved (I don't know if their new place has a sign). Compare that to walking around Soma or driving down the 101.

Most people probably have no idea there are well-known tech companies based here.

<comment><USER32> There are also a few well known blogs based here namely, Engadget and Mashable.</comment></comment></comment></comment>


Architecture of the Mouse Brain Synaptome: Neuron - <AUTHOR> https://www.cell.com/neuron/fulltext/S0896-6273(18)30581-6# <comment><AUTHOR> To progress from insect brain maps to this within a few months is nothing short of amazing. I realize that these projects were started some time ago, but now I wonder how long until we have a full map of the human brain?</comment>