Amazon CloudFront - Support For Dynamic Content - <AUTHOR> http://aws.typepad.com/aws/2012/05/amazon-cloudfront-support-for-dynamic-content.html <comment><USER3> We got burned by CloudFront about 18 months ago... we were serving our static assets (CSS, JS etc) through CloudFront and had bug reports from some users in eastern europe (I forget where, it might have been Slovenia) that our site was displaying without CSS. I got them to check and they couldn't load CSS for GitHub (which used CloudFront) either. We went back to serving directly from S3.

It's an infuriating bug, because I can't see how we could confirm that this kind of thing isn't an issue any more. I'd love to go back to CloudFront but I'm just not confident that it will reach all of our users.

<comment><AUTHOR> Please feel free to send me some details (address is in my profile) and I'll pass it along to the team.

<comment><USER3> I've emailed you. For anyone else who's interested, here's the support email we got (back in January 2011 it turns out):

> The following URLs fail to load: > > <http://cdn.lanyrd.net/css/core.221dbc4b.min.css> > > <http://cdn.lanyrd.net/js/jquery-1.4.3.min.97be02d1.min.js> > > <http://cdn.lanyrd.net/js/jquery.jplayer.min.72d89d00.min.js> > > <http://cdn.lanyrd.net/js/lang.ENG.4f594a71.min.js> > > <http://cdn.lanyrd.net/js/global.f0851851.min.js> > This is on the basic > page - <http://lanyrd.com/services/badges/>. As far as I can tell, no files > from the domain cdn.lanyrd.net will load. > > Also, it seems the Lanyrd.com > site doesn't can't load any resources from the CDN domain as well - <USER2> > homepage is totally broken for me. > > Oh, and I'm situated in Slovenia, if > that helps.

I replied and asked them to run "host" and "ping" against cdn.lanyrd.net and they sent back the following:

> Host cdn.lanyrd.net not found: 3(NXDOMAIN) > ping:unknown host > cdn.lanyrd.net

I also had an incident a few months later where our assets failed to load for a period for me sitting at my desk in London - GitHub's assets were affected as well, which lead me to suspect it was a CloudFront failure. Unfortunately I don't have any notes from that.

<comment><USER4> How do you know that wasn't your DNS provider having troubles there? Should have had them do `dig` to see if it was a DNS issue on your end instead of blaming Amazon right off the bat...

<comment><USER3> It could well have been (that's why I'm sharing the details: so people can make their own mind up). Like I said, this was over a year ago so it's pretty hard to debug-in-hindsight.

<comment><USER4> Starting with "We got burned by CloudFront..." seems a little harsh when the only piece of actual data you have could just as easily point at your own DNS provider rather than Amazon's systems...

</comment></comment></comment></comment></comment></comment><comment><USER5> Still no gzip support, though. I had to jump through some hoops to get this to work by posting duplicate files that were gzipped ahead of time that respond to all requests with static headers saying the content is gzipped. It works, but it'd be a LOT better if cloudfront could do that for us.

<comment><USER6> Rackspace Cloud Files supports this. The file "test_javascript.js" was saved non-compressed. It works the other way, too (compressed->uncompressed if the client doesn't support compression):

        $ curl -i http://d.not.mn/test_javascript.js
        $ curl -i -H "Accept-Encoding: gzip" http://d.not.mn/test_javascript.js

This isn't trying to take away from their announcement. I'm always impressed by Amazon's ability to rapidly deliver features.

<comment><USER7> Rackspace cloud files didn't have origin pull last time I checked. Without origin pull asset serving via cdn is a pain to setup and maintain.

<comment><USER6> True. Your content needs to be in Cloud Files, not on your own server. The storage and cdn services are tied together into the product. They have not been separated to allow the CDN on top of any arbitrary endpoint.

I don't see the requirement of storing the data in cloud files as a very heavy burden, but I'm not the most unbiased source on that.

</comment></comment></comment></comment><comment><USER8> It sounds like being able to run a bunch of Varnish servers to cache stuff at edge locations around the world. I wonder if it really works that way or do you have to change your web app a lot to work with it?

<comment><USER9> If that's what you're after you might want to check out Fastly. We're a CDN entirely based on Varnish, with all the features that implies.

</comment></comment><comment><USER10> _If you set the TTL for a particular origin to 0, CloudFront will still cache the content from that origin. It will then make a GET request with an If- Modified-Since header, thereby giving the origin a chance to signal that CloudFront can continue to use the cached content if it hasn't changed at the origin._

I wonder how well this works for content that is truly dynamic. Seems like it would necessarily be slower for those pages that change on every request.

<comment><USER11> I bet they use a grace period, like Varnish does. The grace period would let the cache serve stale data for a few seconds or more while the if-modified- since call is made, and if necessary, the cache refreshed.

<comment><USER12> I don't think that's what the post said. Doing so would break the semantics of the 0 second cache time. They must wait for your 304 Not Modified response before serving from their cache.

</comment></comment></comment><comment><USER13> Supporting the query string as part of the cache key is big news for CF users.

Thanks a lot.

</comment><comment><USER14> Hrmm....the more and more that Amazon rolls out these services is the more and more tempted I am to go full-hog on AWS.

I only use S3 now - and Heroku - but I am excited about where this will continue going.

The future looks bright and I can't wait until the right application comes along for me to build it on top of a fully scalable infrastructure that I only have to pay as I use.

<comment><USER15> Don't.

My suggestion for almost all businesses is to use AWS for S3, SQS, SWF etc and then get dedicated/VPS servers in the same data center. I actually get faster ping times to SQS from my dedicated server than from EC2 (both in US-East).

EC2 is the biggest ripoff going around. And all the other AWS services are some of the most awesome going around.

<comment><USER16> What are some good dedicated hosting options in US-east? I've tried looking them up but the info is usually buried deep in the hoster's site where it's impossible to find.

<comment><USER17> Try burst.net

OVH should have their east coast data centre open for customers in August. [http://www.datacenterknowledge.com/archives/2012/04/30/europ...](http://www.datacenterknowledge.com/archives/2012/04/30/european- giant-ovh-to-enter-us-hosting-market/) I am an alpha testing and their service is great. They are not just a data centre that leases bandwidth from others. They are an internet backbone with ownership in back haul fibre. They are big enough to add 290gbps to their network in days. [http://forum.ovh.co.uk/showpost.php?p=42216&postcount=66](http://forum.ovh.co.uk/showpost.php?p=42216&postcount=66)

Most of the links are 10gbps so it is just a simple hardware upgrade to 40gbps or 100gbps.

</comment></comment></comment></comment><comment><USER18> Blah, still no mention of SSL CNAME support.

<comment><USER19> This cannot be reliably done with Windows XP in the wild.

<http://en.wikipedia.org/wiki/Server_Name_Indication>

Essentially, the cloudfront server doesn't know the certificate to present.

</comment></comment><comment><USER20> I have been messing around with caching and combining files quite a bit over the last few days, mainly since the latency between myself and my webserver really add up, especially as the number of files I need to transfer increases.

The difference between San Diego and Chicago, or San Diego and New York, when I compare it to running my application locally, makes me really want some kind of quantum instant communication. But since we don't have that, I really would like something like a CloudFront. Pretty much for every single application or web page that I make, I would actually like to have that.

Actually, I think it would be better if everyone and every web site had that, a way that sites could automatically be cached in servers local to everyone's city. Wouldn't that be nice?

Which reminded me of the whole concept of content-centric networking.

Here is one related project that I found: <http://code.google.com/p/haggle/>

<http://en.wikipedia.org/wiki/Content-centric_networking>

The hard part about this is that to really be effective it probably means really changing the way things work. It is tough to ease into it.

This could also help with reducing the amount of data that needed to be transferred. Maybe we could figure out a way so that every website in the world would be compressed referencing a very large global dictionary that was shared on every client (or possibly partitioned for local clusters, but that is more complicated..)

Regardless of the level of compression, it would still probably be possible to distribute quite a lot of the trending web content to be cached locally. Maybe it could be a bit like a torrent client for people's desktops, or maybe web application servers could have an installed program that participates in the distribution system and also publishes to it.

Maybe it could be a browser extension or just userscript (Greasemonkey) (probably has to be an extension) that would cache and distribute web pages you view. So for example as we are clicking on Hacker News headlines we are caching those pages on our local machines. Then when another person who has the same script/extension installed clicks on that headline, it will first check his local peers, and if I am in the same city and have that file already, I can give him all of the content in a fraction of the time. If a lot of people used that extension, the web would be much faster, and it would solve a lot of problems.

I wonder if there isn't already a system like that. I mean there are probably RSS feeds that come off of Hacker News and Reddit, and a reader could actually precache all of that content. But more comprehensively, I bet there is quite a bit of content that large numbers of say programmers are constantly accessing, that could benefit from that type of system.

Can we make something like a gzip but not limited to within 32kb or anything, instead it is a giant dictionary that is a GB in size with all of the most common sequences for all of the software engineering web sites that are popular today. Then instead of sending a request to San Francisco or Chicago, I can just send a request to a guy less than a mile away who also happens to be interested in Node.js or whatever.

Maybe something like <http://en.wikipedia.org/wiki/Freenet> or an open source CDN.

Or something like this [http://en.wikipedia.org/wiki/Osiris_(Serverless_Portal_Syste...](http://en.wikipedia.org/wiki/Osiris_\(Serverless_Portal_System\))

<http://www.osiris-sps.org/download/>

<comment><USER21> "Actually, I think it would be better if everyone and every web site had that, a way that sites could automatically be cached in servers local to everyone's city. Wouldn't that be nice?"

HTTP over NNTP. I see a great need…

<comment><USER22> Aren't ISPs already doing that? (the caching part)

</comment></comment></comment><comment><USER23> I assume that this means that versioning of CSS / JS files now works - one of the problems I've experienced with Cloudfront is updating files that don't normally change very often (eg CSS). As Cloudfront doesn't support query strings, changing version number of the following didn't work: stylesheet.css?ver=201200505, but now it should.

<comment><USER4> We've just been using mod_rewrite to rewrite stylesheet_([0-9]+).css to stylesheet.css for our CloudFront stuff. Our build scripts pop in the file modification time, so CF sees a new URL any time we update a file.</comment></comment>


Near-room-temperature superconductivity in hydrogen sulfide - <AUTHOR> http://www.nature.com/am/journal/v8/n1/full/am2015147a.html <comment><USER2> Previous discussions:

[https://news.ycombinator.com/item?id=8729762](https://news.ycombinator.com/item?id=8729762)

[https://news.ycombinator.com/item?id=10077187](https://news.ycombinator.com/item?id=10077187)

</comment><comment><USER3> The lowest natural temperature ever directly recorded at ground level on Earth is −89.2 °C. (Google, copy-paste). So we're now talking about superconductors that could exist in certain conditions on the earth without human intervention. That's pretty amazing.

Now we just need to figure out how to make it work somewhere a bit warmer.

<comment><USER4> Except they couldn't, because they require tremendous pressure. But it's still amazing.

</comment></comment><comment><USER5> As soon as one reads "1.5 million atmospheres" one realizes this is clickbaity science.

Is this cool, in the geekiest way possible? Yeah.

Is it "near room temperature"? Hell, it's not only not even temperate, it's not even arctic.

And only when the pressure is well beyond Venusian.

</comment><comment><USER6> From the article: "...hydrogen sulfide under a pressure of 1.5 million atmospheres exhibits phonon-mediated superconductivity at 203 K".

So, yes, dry-ice level temperature, but incredibly high pressure.

<comment><USER7> Just curious, as I'm not a physicist, what's the definition of "near room temperature"? Because 203 k = -97F/-70C.

<comment><USER4> Superconductors exhibit superconductivity in temperature of 30K and less.

High-temperature superconductors exhibit that effect in temperature 90-130K.

Having all that, 200K is really close to room temperature.

[https://en.wikipedia.org/wiki/High- temperature_superconducti...](https://en.wikipedia.org/wiki/High- temperature_superconductivity)</comment></comment></comment>


Tesla Co-Founder: Electric Cars with 500+ Mile Range by 2020 - <AUTHOR> http://www.treehugger.com/files/2010/08/tesla-co-founder-martin-eberhard-electric-cars-batteries-500-miles-10-years.php

<comment><USER2> Sub 15 minute recharge time would be more welcome.</comment>


Why can't I find a good IDE? - <AUTHOR> http://ryanwaggoner.com/2010/10/my-fruitless-search-for-an-ide/ <comment><USER2> > if you want dark themes, you have to go through every language you use and > set all the colors for each text type (comments, selected, functions, etc). > This requires probably 300 clicks for each language. (...) what am I missing

I'd change colors for one language, check where the settings are saved (Linux: probably some dot something folder in your home folder) change ONE color for every other language, see how those are stored and write a script (I'd probably use Perl or Python, feel free to use anything else if it's faster for you) to "fill in the blanks" for the rest. I think I can do this very fast, matter of only a few minutes, and I'd save the scripts for any other occasion (or maybe saving a resulting color settings section is enough).

I don't use Eclipse, but I guess it's doable as I describe.

Alternatively, if I wouldn't be able to use script for some reason (binary stored settings?) I'd simply change the colors for the language I want to use at that moment. I'd postpone changing anything else until I need that something else. There's big chance that it would result in one language configured every other day, and that some languages that I think I'd need never get configured as I haven't had to really use them from Eclipse or whatever.

</comment><comment><USER3> TextMate IS the all-in-one champ.

The question should be which language-specific IDEs are so good they're worth deviating for.</comment>


A gaming console on a stick. - <AUTHOR> http://www.kickstarter.com/projects/872297630/gamestick-the-most-portable-tv-games-console-ever?ref=home_popular

<comment><USER2> It seems that this device will be inevitably compared to the OUYA, another "open-source" Android game console. The only major difference in hardware, form-factor aside, is that this uses an Amlogic 8726-MX SoC rather than the Tegra3 T33 used in the OUYA. It's hard to make a direct comparison, but the Tegra3 has more cores and is clocked slightly faster. I have heard some grumbling over the OUYA's specs, though, so I imagine the GameStick will leave devs no happier.

While having more devices in this category will increase fragmentation, I imagine that "porting" an OUYA game to this or vice versa would only take a few hours (or less) in most cases- more potential buyers is good news for anyone seriously considering selling games for the OUYA. The only real difference between the devices from a programmer's perspective may be how they handle gamepad input.</comment>


Tesla Says It's the Future of Cars. Did GM Prove It Right? - <AUTHOR> http://fortune.com/2018/11/27/tesla-future-cars-gms-restructuring-prove-right/ <comment><AUTHOR> I think that Tesla is really shaping the future of the automobile as well as the automobile industry. GM is the latest example but I think that Ford and others are really starting to take notice and change their ways. However, given the history of the industry I'm not sure an old-school car company can change it's stripes any more than the coach builders could 100 years ago.

Best quote of the article: "For her part, Barra (GM CEO) told the AP that the company needs more coders now, and fewer mechanical engineers. "The vehicle has become much more software-oriented," she said. "We still need many technical resources in the company." On Twitter, GM also pushed back at critics of its restructuring, saying it will add "technical and engineering jobs that will support the future of mobility.""</comment>


Show HN: Interactive Conway's Game of Life with good graphics (MIT License) - <AUTHOR> http://symbolflux.com/conwayz/ <comment><AUTHOR> There's also a write up of the project if you scroll down. It was written with three.js and uses raymarching to create the visuals.

If you hold shift it pauses the simulation and allows you to toggle cells on/off for live experimentation—just let go of shift to resume.</comment>


Statistical Mechanics: Entropy, Order Parameters, and Complexity (free ebook) - <AUTHOR> http://pages.physics.cornell.edu/sethna/StatMech/

<comment><USER2> Humanity has generated too much information for me to absorb. I'll never be able to learn it all. There, I finally admitted it.

<comment><AUTHOR> Same here :-( I would need a 1000 years to learn all the things and work on all the projects I would like to. Since I only have 50 years or so left (if I am lucky) on this 3rd rock from the Sun, I will have to choose the top 2% of cool things on my long list and stick to those...

<comment><USER3> There's a startup idea there you know :P

<comment><AUTHOR> <http://en.wikipedia.org/wiki/Methuselah_Mouse_Prize>

I wish I were a mouse ;-)

</comment></comment></comment></comment><comment><USER4> I've a print copy of this, the content is quite good but rather marred by the annoying typsetting everything is all jammed in right up to the marigns (something which is sadly true across this whole series of great books).

The problems however are absolutely fantastic, a great mix of computational and theoretical which go from half an hours fun to really unanswered problems. Fun fun fun! I highly recommend trying them and referring to the text as needed.

<comment><USER5> Ehh, memories… I have yet to finish that book.

Dirac said, _"follow mathematical idea wherever it leads"_. When I first opened ths book years ago, unpublished draft then, I just skimmed the ToC, checked a few problems and then to my horror encountered that interesting approach to restricted three–body problem (nicely wrapped as the "Jupiter" problem in the book). I was horrified because I had a lead on that too… and there – it's all in textbooks. That situation allowed no relaxed wackiness in my thinking about it anymore, I had to formulate my thoughts. 'I need more math', I thought. When I finally digged out of that rabbit hole I found myself learned in dynamical systems, ergodic theory, harmonic analysis, spectral theory, operator algebras, homology, algebraic topology, and constructive renormalization, and in numerical methods, symbolic dynamics, symbolic algebra, Grobner bases and group cohomology and applied algebraic geometry, and then Hopf algebra of Connes–Kreimer computable renormalization and, uh, followed Connes the way up to motivic integration… (ok. ok. I'm done enumerating now) at which point I lost all interest in physics and turned mathematician.

All that not to mention intersection of algebra and topology of statistical mechanics with coding theory and infromation theory which led me to machine learning (which is just statistics btw).

I'm unsure what the moral is. That was not healthy. (OTOH, mathematicians have high life expectancy, routinely living up to 90, gauging from AMS Notices obituareis).

</comment></comment><comment><USER6> Stat mech is basically the math of 'complex systems'. Evolution, neural processes, economics --- it's all coming out as stat mech in one way or another. Thus familiarity with stat mech is important if you have any interest in these areas.

</comment><comment><USER7> Nothing like a little light reading before bed ;)

/math guy

<comment><AUTHOR> Give this one a try, too:

<http://www.stanford.edu/~montanar/BOOK/book.html></comment></comment>


Malware that uses USB drives to covertly jump airgaps - <AUTHOR> http://arstechnica.com/security/2016/08/meet-usbee-the-malware-that-uses-usb-drives-to-covertly-jump-airgaps/ <comment><USER2> My use for an air-gapped machine is for a personal CA (certificate authority). I'm using a RPi2 for this (no wifi). Proceedure: 1\. Download all the software needed for the CA (possibly getting compromised packages). 2\. Disconnect from the network, setup the CA. 3\. Setup an intermediate CA on a YubiKey. 4\. Turn off RPi2 and store micro-SD card with CA secrets in a safe. 5\. If CA needed in the future, only plug in "CA" micro-SD when RPi is not connected to the network. 6\. Since the CA is never in a machine connected to a network, even if the RPi2 is compromised (assuming it's not the secret generation) the secrets aren't leaked.

However, with this attack, or a similar one, maybe my laptop is also compromised and the RPi2 can exfiltrate to the laptop (which is nearby and connected to the network). Perhaps via toggling the caps-lock LED on the keyboard (at a high rate with low duty cycle so it's invisible to the eye) or via the monitor cable. Security is "fun"

</comment><comment><USER3> An interesting new variant of what you might call "active TEMPEST": a program running on the target machine that changes its EM emission spectrum. Of course, if you can plug a thumbdrive into an airgapped machine and get a radio reciever within a few feet of it I really wouldn't call it "airgapped" enough. You might as well just write to the USB drive.

Maybe could be made to work with mice and keyboards, which have nice long cable antennas. They're supposed to be shielded but are often poor.

Play along at home: [http://www.icrobotics.co.uk/wiki/index.php/Turning_the_Raspb...](http://www.icrobotics.co.uk/wiki/index.php/Turning_the_Raspberry_Pi_Into_an_FM_Transmitter)

<comment><USER4> Replace "few feet" with "up to about 100 m" for a properly designed EM signal and high sensitivity directional antennas.

</comment></comment><comment><USER5> > As Ars has noted in previous coverage, the techniques are theoretically > effective, but their utility in real-world situations is limited. That's > because the computers they target still must be infected by malware. If the > computers aren't connected to the Internet, the compromise is likely to be > extremely difficult and would most likely require the help of a malicious > insider, who very well may have easier ways to obtain data stored on the > machine.

Nonetheless, an interesting technique. Is it even possible to have a useful workstation these days without _any_ USB devices?

<comment><USER6> > Is it even possible to have a useful workstation these days without any USB > devices

All my gear is on the network these days. The only USB device I regularly plug is in a dumb 5V fan from the dollar store... I imagine these days it's more possible than ever.

Air-gapped computers (which is what this seems to be targeting) on the other hand are surely going to do all their data transfer over USB.

<comment><USER7> You have a networked keyboard/mouse?

<comment><USER8> Well, it's possible they have something like Synergy installed to control multiple machines, maybe.

Or else, perhaps they're talking about headless machines where it's just a box with power and ethernet.

<comment><USER7> I could see Synergy for a workstation, but eventually one of the turtles on the way down will most likely have a keyboard/mouse connected to USB. Headless for servers certainly.

<comment><USER9> Bluetooth - that's a network. Not to mention, my laptop has no external KB or mouse.

<comment><USER10> A lot of laptops present the keyboard and touchpad/whatever as internally connected USB devices.

So, if you want to disable USB by epoxying the externally facing connectors, that might work, but it means you can't do things like completely disable support at the BIOS or kernel level if you want those things to still work.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> 9 foot range, 26 feet if you have a hard drive with a USB cable plugged in.

Doesn't work with thumbdrives.

More importantly, the airgapped computer _needs to be already compromised_ before the attack can occur, and you must have write access to the drive.

While they show an Ubuntu machine next to the compromised machine, there is no signs that the malware works under ubuntu.

Neat research, but limited utility.

<comment><USER12> Also, the transfer rate is 80 bytes per second.

<comment><USER4> Plenty for sending out a password. For extra ownage, exploit the OHCI DMA to get memory access to anything.

Heck, it is easier to just connect a prepared radio with hardware exploit.

<comment><USER12> Right, but you won't be pulling down classified PDF's in any reasonable time. If you have access to the machine to run code, I don't see why you need "a password" particularly.

I thought the purpose was extracting information.

</comment></comment></comment></comment><comment><USER13> This isn't any new research. It is believed this (air gap) is one of the ways Stuxnet spread many years ago [1]

[1] [https://www.wired.com/2014/12/hacker-lexicon-air- gap/](https://www.wired.com/2014/12/hacker-lexicon-air-gap/)

<comment><USER14> The article says that Stuxnet spread to target machines by using files on infected USB drives. This is different, data is transmitted from an off-the- shelf drive via electromagnetic interference.</comment></comment>


Gagarin was not the first man to fly to space. Just the first to live. - <AUTHOR> http://english.pravda.ru/accidents/2001/04/12/3502.html <comment><USER2> "The unluckiest russian was Yuri Gagarin: he circled around the earth and landed back in the soviet union." (french humorist Coluche)

</comment><comment><AUTHOR> Stunning.

<comment><USER3> Hard to take it seriously when some of the articles linked on that page have headlines like "Dog gives birth to ugly mutant creature" and "Aliens caught on tape for the first time." Weekly World News called, they want their articles back.

See <http://www.lostcosmonauts.com/> for less tabloidy information.

<comment><USER4> True or not, this is a persistent rumour, going all the way back to the 60s. Wikipedia, naturally, has the full rundown ([http://en.wikipedia.org/wiki/Soviet_space_program_conspiracy...](http://en.wikipedia.org/wiki/Soviet_space_program_conspiracy_accusations)).

But in brief: this is just one of a range cosmonaut conspiracy theories which put the 'moon landings were faked' crowd to shame. They're also much more widely believed than their US counterparts (not without reason). This one maybe not so much - but a decent percentage of Russians believe Yuri Gagarin was bumped off by the authorities.

Also, if you hadn't noticed, the article's from way back in 2001.</comment></comment></comment>


Scientists invent new way to control light, critical for next gen fast computing - <AUTHOR> http://phys.org/news/2015-03-scientists-critical-gen-super-fast.html <comment><USER2> Next, make it squishy and stick some quartz on it.</comment>


A New Front – Can the Pentagon do business with Silicon Valley? - <AUTHOR> https://story.californiasunday.com/military-tech-silicon-valley <comment><USER2> Posted yesterday: [https://news.ycombinator.com/item?id=10244714](https://news.ycombinator.com/item?id=10244714)</comment>


Why I feel like a fraud - <AUTHOR> http://blog.asmartbear.com/self-doubt-fraud.html <comment><USER2> _Holy shit._

I thought this was just me. I spend a lot of time churning on this.

I'm a little shell-shocked at the revelation that others feel this way too. I wish I had something more compelling to contribute than catharsis, but... wow, thanks for (re-)submitting this.

<comment><USER3> Me too, for what it is worth. At least three times this year half my brain was screaming "They're going to find out _any second now!_. Flee, flee!"

It all worked out.

<comment><USER2> "They're going to find out any second now!"

That's really it, isn't it? The whole thing just boils down to an odd, amorphous _they_ capable of seeing straight through you if you happen to give them half a chance.

I wish I could understand the source of this better.

<comment><USER4> I like this feeling. It makes you try harder, just in case someone comes looking.

</comment></comment></comment></comment><comment><USER5> I think a particular quote from Sh#t my dad says will resonate here.

"That woman was sexy… Out of your league? Son. Let women figure out why they won't screw you, don't do it for them."

Let customers find out if your product is shitty. They won't buy it if it is.

<comment><USER6> Offtopic: why did you self-censor the first "shit" but not the second "shit"?

<comment><USER7> Assuming he's referring to the book version, he's just mirroring the book title's self censorship.

</comment></comment></comment><comment><USER8> Wow, I had no idea such feelings were so common. I've largely felt like this for the last couple years, as I've gone from "that weird kid that does something with computers" to "startup founder" (and now back in a real job again, which has been an odd (and refreshing) adjustment, but that's a subject for a post of its own). While I can recognize that I'm doing cool things, I just don't feel like it's that big a deal; when someone acts like something is actually a big deal, I feel like I'm overselling it. Hard to explain, but it's nice to see that I'm not the only one in the community that feels this way.

</comment><comment><USER9> Just because there's a name for feeling like a fraud even if you aren't one, doesn't meant you aren't one! I felt like a fraud in graduate school and it turned out I was one.

<comment><USER10> You were an actual fraud? By what definition? [edit: I wonder if you were really a fraud, or are just feeling down on yourself.]

<comment><USER9> Well, I dropped out after 1.5 years :).

<comment><USER10> You're not a fraud. You changed your mind. It's OK to do that.

</comment></comment></comment></comment><comment><USER11> There is no "typical entrepreneur".

If you look at wall street traders, Fortune 500 CEO's and other populations that have been through intense selection processes you'll find very homogeneous populations.

If you look at entrepreneurs, you'll find confident people, anxious people, short people, tall people, thin people, fat people -- all kinds of people. That's because entrepreneurs select themselves rather than being selected by a bunch of people who want to select other people like themselves.

<comment><USER12> Well, I think it's fair to say all entrepreneurs are persistent, but that's about it.

<comment><USER11> I was talking with a professor about my work on the bus last night and mentioned that having faith in what I'm doing is what makes me possible to do it.

He shared that he's a born-again Christian and he's thought about faith is important in what he does, since you've never got any guarantee that a research project is going to be successful.

I'm a pagan, so I like the Japanese word "Haruhi" which means "full of spirit." (It's been popularized in the U.S. by a post-modern recent anime which I can't decide if I like or not.) But it's an important thing. For the idea I'm working on, I find that being "Haruhi" makes me invincible... I used to be a terribly anxious person but I believe in what I'm doing so much that nothing bothers me.

Quite funny, my business plan from the very beginning assumed that the system I was building would soon become more than the sum of it's parts, but I was quite amazed to see it happen... For me it's a miracle.

</comment></comment></comment><comment><USER13> I sometimes feel that I wasted all my years because I was developing quite diverse applications, so I am not an expert of anything. For example I am writing a Java to Scala translator now. I hate that I was dealing with completely other topics when I could have done Phd in programming languages and could have worked on compilers all the time. There is a company founded in 1995 working on source code analysis, translation, etc... I felt the same way when I developed a 3D game, when I developed Java web apps at my workplace, etc... I feel that I am not an expert of anything. That if I gave a lot of time to one topic (years) then I would be much much better than I am now. I feel like a fraud because I have to pretend that I am a specialized expert of one topic, but in reality I am a jack-of-all-trades programmer.

<comment><USER14> Being a generalist isn't always an easy sell, but we can be uniquely valuable in a small shop that lacks an army of specialists. Just since last year I've been called on to document several protocols for partners, design and back- test a Bayesian estimator, troubleshoot a balky load balancer using only a tcpdump (it was reusing port numbers too aggressively), sleaze together some last-minute map/reduce analytics feeding Excel graphs, and track down regressions caused by bad svn merges. Nobody sane would put all of that in one job description (nominally I maintain a soft realtime Java app server), yet someone had to do it, and there I was. As a specialist I'd worry about only getting asymptotically better at solving one problem which could become irrelevant.

Actually it's the stuff I'm _supposed_ to know how to do where I feel like a fraud, because I compare the imaginary progress of an idealized version of myself to what I've actually accomplished. When I'm handling one of these tasks from left field, everyone knows I'm winging it, and that makes success sweeter.

</comment></comment><comment><USER15> "All men are frauds. The only difference between them is that some admit it. I myself deny it." --H. L. Mencken

</comment><comment><USER16> I often feel like other people are frauds. I call this Taleb syndrome.

</comment><comment><USER17> Here's a little secret:

Nobody really knows what they are doing; they're just winging it, more or less.

That's not to mean extremely talented people aren't doing some amazing things, it means that there is no documented pattern to follow that once completed equals success. It also means that you can in fact be as good or better at every "expert" in your chosen field, and that many of the people reading this probably already are.

Everyone is using a blank piece of paper, and everyone is painting their own portrait their own way. Knowing how to both create demand and deliver a _perceived_ value is much more valuable than whatever it is you are actually doing to deliver the product. There is nothing fraudulent about it. Every mechanic is a genius to a person that has never seen a car.

</comment><comment><USER18> I definitely feel like a fraud all the time. In meetings someone will introduce me as an information security expert and it makes my blood run cold. I keep thinking to myself, "This isn't rocket science, it's just common sense surely?" but bizarrely there are still developers out there who haven't heard of input validation, bounds checking or even how to do authorisation properly.

I worked out the other day that I've been doing this job for about 12 years. There's that whole 10,000 hours thing when it comes to being an expert, and I think I've put in several times that but I certainly don't feel like an expert in anything. If anything I keep expecting someone to turn up and point out blatant flaws in everything I say, but somehow it doesn't happen.

</comment><comment><USER19> I struggle with this often: I KNOW I'm not as smart/talented/capable as other people think I am, especially at programming. I haven't been programming for that long, and it takes me an hour to write something that should take me 10 minutes to write.

However, my skills continue to amaze my peers (who are all non-technical) and they think I'm a genius because I can build a web site with a login form, or register a domain name.

It's really hard to reconcile the two things, especially since, eventually I will be a 'real' programmer, but I still won't think I'm any good.

That being said, it drives me crazy when people call themselves an 'expert' in everything. Just because you read a book, and wrote a few blog posts doesn't make you an expert!

<comment><USER10> _Just because you read a book, and wrote a few blog posts doesn't make you an expert!_

Or it does make you an expert, but "expert" doesn't mean what we think it means. ;-)

<comment><USER20> My dad always said that "x is an unknown quantity, and a spurt is a drip under pressure".

I tend to take self-professed "experts" with a grain of salt.

</comment></comment></comment><comment><USER21> "First you get your Bachelor's degree, and you think you know everything."

"Then, you get your Master's, and you realize you don't know anything."

"Then you get your Doctorate, and you find out that _nobody_ knows anything."

<comment><USER22> > Then you get your Doctorate, and you find out that nobody knows anything.

Took me about 3 months to figure out why the java class I was taking was so screwed up. The professor had never seen Object Oriented Programming (or Java) before. He was staying one chapter ahead of the class and picking assignments that required his domain expertise to complete.

As annoying as it was to find out, I still learned a useful bit of Java. Took me years (and learning ruby) to actually grok objects correctly.

<comment><USER23> Teachers are often just-in-time learners too.

<comment><USER22> I don't really have a problem with that in most cases. This case was a little special because I don't think the professor grasped OOP during my time in college. (Had him for a few of my classes)

Not grasping OOP makes using Java a tad difficult.

</comment></comment></comment></comment><comment><USER24> hn rerun. Orignal thread with comments:

<http://news.ycombinator.com/item?id=1059985>

<comment><USER25> Sometimes good posts are worth rerunning.

<comment><USER26> I certainly agree, but linking to the previous comments is also valuable. He didn't call it a dupe, he called it a rerun. I think that's appropriate.

</comment></comment></comment><comment><USER27> I often feel this way too. The hardest is when you are up in front of a room of people who are there to see you because you are an "expert".

Every misstatement or generalization feels like a punch in the face as soon as it leaves the lips. Even worse, sometimes there's a person in the crowd who takes pleasure in calling out the "expert". Even after days of research and practice for a single hour long talk this person is what I fear the most.

<comment><USER28> You can tell them that you will discuss it after the meeting or just say you don't know. Most people will laugh when you say you don't know and think you are cool.

</comment></comment><comment><USER29> I like this idea that if you don't feel like an imposter, you're probably not challenging yourself enough. It rings true with my experience starting a blog without much design or web experience (<http://wayofthescholar.com>) and diving into neuroscience research without any neuroscience background. The most I feel like a fraud, the more I'm forced to find smart ways to figure out where I'm at and where I need to head next.

</comment><comment><USER30> Actually the Impostor syndrome has another positive side: it prevents over- confidence and preserves a degree of humility.

Self-doubt can also make you a more likable person, especially if you are successful.

</comment><comment><USER31> Ignorance is very scary. I went to TEDxBrooklyn this weekend, and heard Richard Saul Wurman say that he lives by embracing his ignorance, because it is the only unlimited resource he has. I think that the only way to overcome this self-doubt is to accept that you will never overcome it, and make it part of your confidence to be doubtful.

</comment><comment><USER32> It's funny, even writing an essay about this very topic hasn't made the occasional feeling cease. Though, since then, I feel much better equipped to deal with it and get on with my day.

[http://jangosteve.com/post/380926251/no-one-knows-what- theyr...](http://jangosteve.com/post/380926251/no-one-knows-what-theyre-doing)

<comment><USER33> Thanks for that post, excellent.

It's quite comforting, yet scary at the same time, to realise that the stuff you know you don't know is probably going to grow throughout your life, but that this is a good thing! Because it beats the hell out of not knowing what you don't know. Although I wonder if that would lead to a simpler life sometimes.

</comment></comment><comment><USER34> I think experts are people who know they don't know much. Humility.

</comment><comment><USER35> What scares me most is, when I find someone sharing the same feelings on these lines as me, and yet being far more productive then I am. This is when it gets really scary, and the little voice inside your head screams, "dude, you ARE a fraud".

But, at whatever level, we all have to fight it for the rest of our lives. :)

</comment><comment><USER36> I often feel that I lack the delusion to build a premier company. I try to build a great product, but I can usually point out to other companies that do an element of what I do better. Perhaps no more SWOT analyses.

Such a weird balance that a startup founder must create.

</comment><comment><USER37> I sympathise entirely with this post. I too didn't realise that it was a common way of thinking until I saw this a while back:

<http://xkcd.com/616/>

One day they'll expose me!

</comment><comment><USER38> I used to feel this way for first 6 years of my career when I was working for other people and doing pretty well. But to myself I used to think - am I really good.

But ever since I became an entrpr I feel totally natural & confident in doing what I m doing. I guess its also about are you really you are totally passionate about. If yes - you are to absorbed in it that you dont have time for these things

</comment><comment><USER39> There was a really good episode of "This Week in Startups" a while back with a psychologist who talked about this phenomenon: [http://thisweekin.com/thisweekin-startups/twist- episode-21-w...](http://thisweekin.com/thisweekin-startups/twist- episode-21-with-mark-goulston-bonus-3/)

</comment><comment><USER40> Ok great article, also read the wikipedia entry...

Now, anyone has resources on overcoming this beyond just a few bullet points?

</comment><comment><USER41> This reminds me of <http://news.ycombinator.com/item?id=1902892> , in a way.

I wonder if it's the obsession with metrics that makes engineers act in such a self-deprecating manner? I know I certainly do this, too...

</comment><comment><USER42> HN is teaching me that I'm not so abnormal. Amazing.

</comment><comment><USER43> I think anyone who experiences some success sort of feel like a fraud. I know I do. I think it's a common thing.

<comment><USER44> <http://en.wikipedia.org/wiki/Impostor_syndrome>

</comment></comment><comment><USER45> > I would explain how my tool cuts code review time in half, but was that > actually true or had I just repeated the argument so many times that I > stopped questioning it?

Am I missing something here? He says he feels like a fraud but if he's telling people something that he doesn't know to be true.. that's not 'imposter syndrome', it really is more like fraud.

</comment><comment><USER46> Just get an SSL certificate for your site, you will instantly feel a lot more legit!

</comment><comment><USER47> Isn't this the Dunning-Kruger effect in action? Illusory inferiority, etc...</comment>


Programming Is Forgetting: Toward a New Hacker Ethic - <AUTHOR> http://opentranscripts.org/transcript/programming-forgetting-new-hacker-ethic/ <comment><USER2> Insightful. (I read the transcript rather than watching the video and it made a huge difference because that afforded me time to pause and think). Good stuff.</comment>


Ask HN: Page load performance  monitoring tools - <AUTHOR>

So I'm looking to put together a suite of tools put together some metrics of page load performance for my company's sites.  I already know about:<p>* www.webpagetest.org * www.yottaa.com * Google analytics has some meaningful stuff * Internal tools for back-end performance (number/time of database hits, etc)<p>What other tools should I be looking at to gather a comprehensive set of metrics? <comment><USER2> We use NewRelic to see everything from the bottom up: <http://newrelic.com/>

It's really easy to use, comprehensive and they have a 14day trial.

I also like yslow: <http://developer.yahoo.com/yslow/>

It's good for quick checks.

</comment><comment><USER3> I've been working on a tool for doing simultaneous page-load measurements and back-end profiling. Here's a paper my supervisor and I published on it: [http://portal.acm.org.cyber.usask.ca/citation.cfm?id=1958746...](http://portal.acm.org.cyber.usask.ca/citation.cfm?id=1958746.1958783&coll=DL&dl=ACM&CFID=36607375&CFTOKEN=97842304)

Depending on your environment, we could talk about getting you a copy to try out. It's ... a little rough around the edges, but I've found it quite useful.

</comment><comment><USER4> I can't speak to it's effectiveness, but I have this site bookmarked to use soon on one of my projects: <https://www.blamestella.com/>

</comment><comment><USER5> I was at a web speed optimization meetup and we used this tool: <http://www.webpagetest.org/>

It was pretty neat and VERY useful.

<comment><USER6> yeah we use this too, can't believe the amount of stuff they let you do for free. You can even generate video showing your site verses your competitors loading at 0.5 fps.

</comment></comment><comment><USER7> We use NewRelic <http://newrelic.com> and Pingdom <http://pingdom.com>.

</comment><comment><USER8> Here are a couple.

      * Browsermob
      * Pingdom (tools.pingdom.com)
      * blitz.io
      * http://loadimpact.com/

HTH

</comment><comment><USER9> try <http://websiteoptimization.com/services/analyze/></comment>


Ask HN: What is the point of behavioral interview questions? - <AUTHOR> Questions of the type - tell me about a time you got into an argument with you manager. Clearly there is more to the question than is being asked for, probably expecting things like how you resolved the situation and what you learned from it. But aren't a lot of people, and perhaps especially engineers, bad at on-the-spot communication about non-technical topics that require nuance when presenting? That's not to say that communication is not a valuable skill, but I can't help feel that behavior questions are a poor test for it. You could for example ask them to prepare a presentation on a project they've worked on, or a presentation on the pros and cons of whatever. So the behavioral questions aren't simply testing your communication but probably more so your previous behavior. Except that's not the case either, they are testing your ability to talk about your previous behavior. Which means you can practice what to say for those questions moving them into a category that feels too much like a test to see if the monkey will dance as expected.<p>Except that also sounds ridiculous, at least to some extent. What is the real intent behind behavioral questions? <comment><USER2> It's a way to filter out the really 'out there' people. Say your example of a disagreement with your manager. You may have all kinds of reasonable points. The next guy could come back with 'I slashed his tires' or 'I decided to call out for a week'.

Clearly, the second guy should be throwing up red flags. However, it can be hard to uncover that type of thing if you were to only ask technical questions.

</comment><comment><USER3> Oh boy, am I triggered! I recently spent some time looking for a new job and went through a number of terrible interviews that involved psychological behavioral assessment tests.

I don't think it was a coincidence that all of the really bad interviews/companies I've had also made extensive use of psychological evaluation/behavioral analysis questions. These things seem to go hand-in- hand.

To directly answer your question, I think the real intent behind behavioral questions is that there wasn't any intent, or much thought. People who ask these kinds of questions often ask them because they just googled for things like "how to conduct an interview", and "questions to ask during an interview". They found websites with examples of terrible psychological evaluation questions, but they don't really know why they are asking them or what they were supposed to get out the question.

What your are seeing here is monkey mimicry. Look at all the companies and hiring managers that have been mimicking what they _think_ is great advice they got from how Big-Company-X (google/facebook/stanford/et-cetera) about how to hire great people. Remember all those stupid brain teaser tests?

In the few cases where some train of intelligent thought lead to someone asking these silly questions, they usually just want to push you a little to find out if they can make you snap easily, or get frustrated. This is an important and desirable trait in abusive workplaces because the employer doesn't want someone who is going to raise their hand and say, "excuse me, that's not right". Of course, it's important in good workplaces too, because they don't want someone who is overtly aggressive or displays an inability to be flexible in stressful situations, or gets easily flustered.

Think of the scene early on in the movie Blade Runner. (But try not to think about the fact that the position being interviewed for was a waste disposal job). Don't pull a Leon Kowalski in the interview.

The hiring process is a sieve; a gateway filter. What kinds of people are being let through, and what kinds of people are being filtered out by this style of hiring process? Paying attention to this will often gift you an awful lot of insight into how the company operates and what kinds of people you would potentially be working with.

There are other, more clever, ways of figuring out the behavioral profile of a potential worker without subjecting them to an abusive and insulting interrogatory, but they almost always take more time and effort, and really, who has time for that?

The most significant problem I have with psycho analysis questions is that if the interviewer is not qualified to interpret the results of their experiment, then that's a serious problem. And, how many of the HR goons you've met do you think have a degree in psychology, or have been training in interpreting the results of a psychological evaluation? None at all ever? Yea me too.

It's not entirely their fault. Hiring people is really hard! Even if you do put the candidate through a series of exhaustive tests and have qualified staff to administer and evaluate those tests, the result is still that sometimes it just doesn't work out, or the candidate ends up leaving for a better job after a few months.

For me, I turn the whole situation around. Behavioral analysis questions are a valuable source of information about the company. They are usually a display of mediocrity and thoughtlessness (but not always!), and those are usually not the kinds of organizations I want to work in.

If an interviewer asks me "Tell me about a time you got into an argument with you manager.", I like to turn it around at them and watch how they react: "I don't make it a point to get into arguments with my co-workers. What happens at work is business, and I don't let it get personal. But it really troubles me that you are so terribly concerned about conflicts in your workplace. What is going on in your organization that is promoting this kind of behavior between staff?" "What kind of manager promotes conflicts and argument rather than engaging in de-escalation and consensus-building, and is that the kind of management I should expect to be working with in your organization?"

The above is written a little aggressively(it's all about the in-person delivery), but doing this has it been super effective for me. People don't realize that they are projecting the toxicity and problems of their workplace in their questions.

At the very least, when it's all over, ask the interviewer why they were asking you these questions, and what they expected to get out of it. If they don't have an answer or seem offended that you would dare ask, then you've got your answer: RUN AWAY.

Remember that behavioral assessments are evaluating: >Communication/verbal skills >Listening ability >Attitude >Ability to play the submit-to-my- authority game

Good luck in your next interview!

</comment><comment><USER4> Having been on the recruiter side, it's very simple why we regularly ask behavioral questions. It's because we want to make sure your behavior is appropriate.

As you said, communication is a necessary skill. Even in a world where email, text, etc are becoming normal means of communication, you need to be able to clearly communicate on a regular basis, extemporaneously and face-to-face with another person. Your ability to communicate your weaknesses and strengths well in an interview is absolutely essential to anyone during the hiring process. Quite frankly, most companies don't care if you're the absolute best in your technical field - if you can't match the culture of the office, you're only suited to remote freelancing - if that! Remember that HR has to constantly cover themselves - every employee is (potentially) a liability waiting to happen; if they hire someone who contributes to a negative/toxic work environment or is a sexual harassment risk (either as victim or aggressor), they're likely going to be fired for introducing that risk to the company. You have to tell HR in language they understand and can quantify that you are not a lawsuit risk.

The point is definitely not about prepared presentation, it's about being able to work and exist with other human beings like what HR calls "a normal person" \- which is really a person with no negative qualities that will potentially endanger the company. Believe me, I've had a few red-flag interviews where the person came off very rude when I asked them about their personal and professional weaknesses; or when they had an issue with a manager. I've also had interviews that felt 'weird' because the person seemed to fixate on the gender of each of his previous managers.

Also, realize that some of these questions inform how interviewers view your references. If you list a certain manager as a reference, you're likely to be asked about a time you had a frustrating experience with that specific person as a manager - oh, and as a side note, if you're asked for three references in a tech field, do everything in your power to include one opposite-sex individual. When we call to confirm the reference, we will in turn ask the reference about that same incident with you as an employee - what happened, what caused the situation, and how it was resolved. We can't do a proper 360 evaluation on you, but we can certainly try to see a more full picture from the people you mention as references and their answers to questions about your conduct.

Your technical skills are either there at the level the employer's needed level, or they aren't - in the latter case you got filtered either by the ATS or someone like I used to be. It's the interpersonal skills which aren't well- described by a resume.

One other thing - "He's a great guy and really good at resolving interpersonal challenges" is a stronger internal selling point from a recruiter to an HR hiring manager than you'd immediately think. Remember, the default for the company is that you're too expensive - some recruiters (internal and third- party) have to justify not offshoring a role before they can even begin suggesting candidates. If you're not going to contribute to the office positively and the HR manager thinks you're going to be a challenge or a danger, you will not get hired.

<comment><AUTHOR> Thanks for the reply!

"The point is definitely not about prepared presentation" \- to me this doesn't ring true at all, but I am sure it depends on the person who is getting interviewed. When I'm asked about times I've argued with my manager nothing really stands out but I'm sure that's not an acceptable answer either. Of course there are disagreements but they have never resolved to any serious argument or escalated to involving HR and even if they had I think it would be prudent to avoid talking about them. So I end up having to make up BS about something but now I'm the territory of exaggerating some minor disagreement and what I learned from it and it ends up sounding insincere. So the only way to avoid it is to prepare something for a lot of situations and to some extent rehearse before the interview. I've never had any significant interpersonal issues and I've been in the industry for six years. Most of the questions just leave me in a confused mumbling state as to me they sound a little ridiculous but at the same time I'm not allowed to just say, "no I've never had that as a problem".

<comment><USER4> If I was the one asking the question, I would avoid using the word "argument", in all honest. It would be more like, "Tell me about a situation where you and your manager disagreed. How did you work to resolve it?"

Arguing is conflict, and destructive behavior - HR people don't want that because it leads to headaches (at best). Arguing leads to "toxic" workplaces which lead to lawsuits. On the other hand, disagreement is natural, common, and sometimes essential to growth. So the interviewer should be asking about times you disagreed with another person and then worked to resolve it between you two without HR - rather than a time you came into conflict with a coworker.</comment></comment></comment>


Why TLS 1.3 isn't in browsers yet - <AUTHOR> https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet/ <comment><USER2> The ossification phenomenon happens to all sorts of APIs. Consider stat(2): all hell would break loose if we introduced another file type for st_mode. I'm a fan of keeping things "well oiled" by exercising extension points that are supposed to keep working.

That said, I wish we would be more willing to force these rusted joints to open, breakage be damned. Breaking 3% of the web sounds like a lot, but it's not that much, especially considering that anyone broken will very quickly upgrade.

By using elaborate workarounds described in the article, we recognize and reward the worst technical practices. The author may not want to cast blame, but I do.

<comment><USER3> Web breakage is a Prisoner's Dilemma. Unless all major vendors agree to break the same thing at the same time, the one that "defects" to being compatible with garbage will seem more reliable to users. Remember, most users don't know what TLS is, but they care whether the page they wanted to see opens "fine" or shows scary errors.

We've been there with CSS box model, DOM levels, (X)HTML(5), and CSS prefixes. There have been some cases of cooperation, e.g. SHA-1 certs and kicking of bad CAs, but most of the time browser vendors only "break" things gradually and only when it affects < 0.1%.

<comment><USER4> > We've been there with CSS box model, DOM levels, (X)HTML(5), and CSS > prefixes.

Other examples:

Content-Type. There were a few years where many sites were misconfigured to serve virtually every non-HTML file as text/plain. IE, deviating from the HTTP spec, always used its own algorithm to detect the actual file type and thus "worked", whereas Netscape (and later Mozilla) respected the header and would display "garbage".

Windows-1252 mojibake. Various Windows-based authoring tools simply used the native Windows code page 1252 to encode their text in HTML files, which were then claimed to be encoded as ASCII or ISO 8859-1. This led to documents that _mostly_ looked correct but would have garbage sprinkled around due to added punctuation in Windows-1252 (primarily the distinct open/close quotes and em- dashes, if memory serves). IE of course handled these "correctly", i.e. interpreted ASCII or ISO 8859-1 to mean Windows-1252. I think this behavior is now specified by HTML5 under certain conditions.

<comment><USER5> > IE of course handled these "correctly", i.e. interpreted ASCII or ISO 8859-1 > to mean Windows-1252. I think this behavior is now specified by HTML5 under > certain conditions.

You can leave out "under certain conditions", whatwg just plain specifies the "iso-8859-1" label identifies the windows-1252 encoding [1]

[1] [https://encoding.spec.whatwg.org/#names-and- labels](https://encoding.spec.whatwg.org/#names-and-labels)

</comment></comment></comment></comment><comment><USER6> "Middleboxes" is a pretty chicken shit definition of what are essentially appliances that, at best, allow companies to spy on employees and at worst enable despotic governments to target and crush dissent. My security should not have to wait for the devices that seek to violate it.

<comment><USER7> "Spy on employees" = Monitor the network activity of a sensitive, private business network.

I'll give the same spiel I give every time proxies come up: I am a donor to EFF, friend of privacy and the 4th amendment and I love the ACLU. I also recognize the legitimacy and importance of MITM proxies that inspect the content of SSL on a corporate network. It's not despotic to deploy company assets with company root CA certs that proxy TLS traffic to make sure a random employee isn't uploading credit card data to Box.

<comment><USER8> > make sure a random employee isn't uploading credit card data to Box

Except you aren't making sure, and there are many ways sensitive data can be exported. Let's be honest with ourselves here, these measures are often implemented under the guise of security but really are just liability and risk reduction approaches. The practical security benefit is very low IME, especially considering the burdens these measures put on employees' ability to work their best (and, as this article points out, burdens on others as well).

<comment><USER7> Which is harder for a call center employee or server admin?

1) Upload a file via GDrive or Box 2) base64 encode the data andsend it to a remote DNS server over the course of several days via TXT record requests

As another poster says, it's all about reduction of risk. It's about balance. And on a corporate network that owns the workstation and server configuration, running a root CA cert and installing it in a gold load is pretty easy for the level of inspection and prevention it provides.

This is not the end all of security, either. It's one of many steps.

<comment><USER8> I think it's mostly security theater without significant benefits. There are many parallels with the TSA here. It's not about ease of implementation as much as it's about employee trust. We shouldn't pretend that it doesn't also scoop up personal communications. Or you can say absolutely no personal communications using the computer you use for 8 hours a day if you're that type of person. Many SMBs survive without these measures, yet somehow they're sold as requirements by those with IT departments and the means. I hope "byopc" and remote work become more popular.

<comment><USER7> >Or you can say absolutely no personal communications using the computer you use for 8 hours a day

Exactly. It's a company resource. Most people seem to have / can afford a mobile device with cel/Wifi connectivity. Why should you feel so privileged to go to reddit, Gmail, Box, etc. on a bank network?

</comment></comment></comment></comment></comment></comment><comment><USER9> This article doesn't explain why they have so much trouble with versioning a protocol that is quite a lot simpler than many IP protocols that work. They shouldn't need GREASE, because anybody implementing TLS should be testing against a dedicated server, identified in the RFC, that connects as a client and jiggles all the knobs.

What, no conformance testing address is in the RFC? There's your problem right there.

To the conspiracy-minded among us, it is clear that "some people" don't want progress on encrypted communications, and know just what percentage of devices need to be intolerant of progress to stall adoption of fixes. Making browsers treat dropped connections as part of the protocol was very convenient for "those people". I.e., this is not (significantly) a matter of incompetent implementers, this is an enemy attack. Deployment plans that assume good faith by all parties fail under enemy attack.

As with everything cryptographic, a threat model is essential. Deployment is as much a part of the system and attack surface as the ciphers.

<comment><USER10> > What, no conformance testing address is in the RFC? There's your problem > right there.

The vast majority of RFCs don't have conformance testing suites. IETF focuses on interoperability testing, which demonstrates that independent implementations work together for the major use cases, it doesn't test all the edge cases (such as future version negotiation) that a good conformance test would.

Creating and maintaining a conformance test is an order of magnitude more work than creating or maintaining a specification.

Someone has to be willing to expend the effort, and that usually means it has to make economic sense, and it rarely does.

And even when it does, in order to gain funding it often has to be licensed on commercial terms, which puts it out of reach of a lot of open source projects and smaller commercial implementors. (Even many large companies wouldn't pay for a test suite unless customers start putting it in RFPs.)

NIST used to maintain a whole bunch of free conformance test suites (CGM, COBOL, FORTRAN, PHIGS, POSIX, SQL), but the US government decided to stop paying for that.

<comment><USER11> The WHATWG and the W3C have been moving in a very different direction, treating testing as a major part of spec development, because the goal is to get implementations of the specifications, and how do you determine that if not by testing.

[https://blog.whatwg.org/improving- interoperability](https://blog.whatwg.org/improving-interoperability) is a post from the WHATWG side about this, and the outcome isn't just the direct "it's easier to write code against tests" but also "it's easier to notice when the spec changes" (because you now get a failing test).

<comment><USER12> Usually IETF WG members do testing and implementation (they run their modified version somewhere), but no information about that becomes part of the standard.

</comment></comment></comment></comment><comment><USER13> > When presented with a client hello with version 3.4, a large percentage of > TLS 1.2-capable servers would disconnect instead of replying with 3.3.

As someone who has implemented a ton of protocols, I honestly don't understand how anyone even does something this stupid.

<comment><USER14> It's the "fail closed" principle in action: if I don't understand it, it must be malicious, so the connection should be rejected as swiftly as possible.

Also seen in firewalls which drop all ICMP packets ("the only real-world use of ICMP is ping floods, right?"), breaking PMTUD.

<comment><USER15> But this isn't fail-closed. The specification allows for newer versions. The problem is, you are supposed to spit back the version you actually support instead of disconnecting. I don't understand how this can be interpreted as anything but non-compliance of the standard.

<comment><USER16> I would say that technically it's complaint because there's nothing saying a server can't tear down a connection whenever it wants.

Our InfoSec friends are rightfully suspicious of 'weird' looking packets and data from clients. It's one of the few ways to catch/stop zero day vulns. It does make things difficult when legitimate traffic is caught in the crossfire but such is the nature of most security practices.

</comment></comment></comment></comment><comment><USER17> Ugh, why did they have to use Flash...

[https://tls13.mitm.watch/](https://tls13.mitm.watch/)

I know they mention it here:

> It uses Adobe Flash, because that's the only widespread cross-platform way > to get access to raw sockets from a browser.

But there's really no other way???

<comment><USER18> That's actually a huge annoyance of mine. There's no stable, cross-platform web API to get raw sockets, and I'm not sure why.

<comment><USER19> Imagine if every webpage (JavaScript) could open sockets to any location and port - sounds like a significant security issue.

<comment><USER20> They essentially can via the WebRTC api, albeit in a more cumbersome way. There's nothing inherently insecure about it and the onus rests on the serving party and the browser itself to ensure no foul play is happening.

<comment><USER21> Doesn't WebRTC have a handshake protocol to ensure that the other end expects the WebRTC media stream?

<comment><USER20> If you allow a browser to open sockets to random places, it's the exact same principle! The onus is on the listener to ensure that the people communicating respect the agreed upon protocol.

<comment><USER22> Then every browser could be used to send spam. It would be horrible. Imagine that every person who visits a compromised page immediately started sending spam emails over smtp. Or spam irc messages.

<comment><USER18> Flash could do that, and yet I've never heard of it as a problem.

<comment><USER23> Generally is not a problem, as Flash needs to check a file called "crossdomain.xml" that is served from the destination server, which specifies how Flash can communicate with it.

[http://www.adobe.com/devnet/articles/crossdomain_policy_file...](http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Sigh. I'm leading an effort to cleanup TLS company wide and it's a nightmare.

I get why some people want middleboxes but honestly, I'd rather TLS1.3 take the opportunity to clean things up instead of coming up with workarounds for fallback.

</comment><comment><USER25> >>> To help support this discussion with data, we built a tool to help check if your network is compatible with TLS 1.3: [https://tls13.mitm.watch/](https://tls13.mitm.watch/)

The name is so terrible that I can't tell if it's a malware or a porn site.

If anyone from cloudflare is reading, please host your project on something legit. tls13test.cloudflare.com or whatever.

<comment><USER26> The downside of hosting things all in the same domain is that cookies are shared between them, so a vulnerability in one site (e.g. XSS) leads to compromise of all sites. Choosing different domains means they are sandboxed and safe from each other.

Any domain name could be used to host porn. But not any domain name can get linked from a cloudflare blog. I think the fact that it's linked from cloudflare's blog should indicate that it's fine.

<comment><USER27> > The downside of hosting things all in the same domain is that cookies are > shared between them, so a vulnerability in one site (e.g. XSS) leads to > compromise of all sites. Choosing different domains means they are sandboxed > and safe from each other.

I believe this is incorrect. Cookies should only be shared (by default) if the domain matches exactly, which is why it's best practice to use a www subdomain instead of the domain alone. For example, www.example.com cookies will not be shared with test.example.com by default, though this can be enabled. See here for a fuller explanation: [https://stackoverflow.com/a/23086139](https://stackoverflow.com/a/23086139)

<comment><USER28> It is incorrect. Read why personal github pages (username.github.com) moved to github.io (username.github.io)

[https://github.com/blog/1452-new-github-pages-domain- github-...](https://github.com/blog/1452-new-github-pages-domain-github-io)

<comment><USER12> That only allows writing cookies, but still the separation via a completely different domain is best practice.

</comment></comment></comment></comment></comment><comment><USER29> > There is no signal to developers that an implementation is flawed, and so > mistakes can happen without being noticed. That is, until a new version of > the protocol is deployed and your implementation fails, but by then the code > is deployed and it could take years for everyone to upgrade.

> If a protocol is designed with a flexible structure, but that flexibility is > never used in practice, some implementation is going to assume it is > constant.

Perhaps this is a naive thought. I remember several years ago Mozilla announced its experimental browser rendering engine (Servo) passed Acid 2 tests [1]. So why can't we come together and create such standard tests so that server implementers and middlebox implementers are encouraged to include them as part of their QA score?

I know this is an optional. There is no mandate, but it sounds like a start. Isn't there some network vendor organization the major players are part of?

[1]: [https://research.mozilla.org/2014/04/17/another-big- mileston...](https://research.mozilla.org/2014/04/17/another-big-milestone- for-servo-acid2/)

</comment><comment><USER30> I say: Just break middleboxes. Do it well. Red padlock "TLS connection downgraded because middlebox".

This shit shouldn't exist in the first place. Routers shouldn't look past the layer 3 headers of the packet.

</comment><comment><USER31> To me it sounds like reenabling the fallback with trying TLS1.2 after TLS1.3 fails for a connection would be the best solution to gradually upgrade all devices.

<comment><USER32> The article says "Browsers did not want to re-enable the insecure downgrade and fight the uphill battle of oiling the protocol negotiation joint again for the next half-decade." So I guess the natural solution to that is making the TLS protocol a User-Agent-esque nightmare of compatibility patches and pretending to support something you don't which surely WONT come back to bite them in the ass years down the line...

<comment> wav-part 1.2 is still secure. This downgrading/oiling is simple and works for all future versions.

TLS is already so complex and ASN.1 makes xml look like c-struct. This begs the question: why would anyone want to make a crypto overly complex ?

</comment></comment></comment><comment><USER33> site down for maintenance.. cache: [http://webcache.googleusercontent.com/search?q=cache:BQlyePw...](http://webcache.googleusercontent.com/search?q=cache:BQlyePwWdUoJ:blog.cloudflare.com/why- tls-1-3-isnt-in-browsers-yet/)

</comment><comment><USER25> Meanwhile, still supporting TLS 1.0 because of office 2010.

</comment><comment><USER34> It hasn't even been released yet.

<comment><USER19> This is essentially explaining why it hasn't been released.

</comment></comment><comment> wav-part I dont get the crisis. If 3% disconnect with 1.3, then retry again with secure 1.2. Its only a performence penalty for those 3%. Its obviously less than lets-talk-about-it penalty.

<comment><USER35> The article calls this "insecure downgrade" \- which is not just the performance penalty you say it is, it's also a security penalty that's been previously (ab)used via POODLE. It's also code that's been removed and would need re-implementing, re-testing, etc.

The only crisis the article mentions - in passing at that - is when they tried to roll out 1.3 initially and things broke outright at alarmingly high rates. Whoever wrote the article appears to be a fan of discussing things before they turn into crisises.

<comment> wav-part Hows downgrading to _secure 1.2_ insecure ? Regarding sslv3, why would client ever use it, downgrade/POODLE or not ?

This is literally very simple, few lines of patch. Its basically tls server discovery.

Its a crisis when a upgrade makes 3% webservers stop working.

<comment><USER36> It means anyone with a MitM position gets to decide you don't have TLS 1.3 . At that point, why even have TLS 1.3? It's not protecting you anymore than TLS 1.2 is.

<comment> wav-part > _It means anyone with a MitM position gets to decide you don 't have TLS > 1.3._

So what ? 1.2 is not weak. Connection is still secure.

Also MITM still gets to decide whether to have tls or not. Then "Why even have tls ?". If MITM is blocking a protocol (or higher version, which is equivalent), then there is nothing to be done.

<comment><USER36> HSTS was created specifically to prevent the MITM from downgrading HTTPS to HTTP.

As for MITM blocking a protocol, that is a noticeable situation, and one that does not give the attacker any control over the cryptography used on sensitive data. A downgrade attack is very different from blocking a protocol. The user doesn't notice, and the attacker gains some control over the cryptography used.

In the end, what sense does it make to have a TLS version an attacker can opt out of? All you get is defence against passive MitM. Until we aren't safe against those passive MitM with TLS 1.2 it makes no sense to rush TLS 1.3. Especially because that rush would really hurt when it turns our TLS 1.2 is insecure, at which point the rushed solution becomes vulnerable to all active MitM attacks.

Now consider, what level of access to infrastructure only allows for passive MitM?

<comment> wav-part > _The user doesn 't notice, and the attacker gains some control over the > cryptography used._

In my case user will because the tls client wont accept insecure version request. Connection broken. Client will notify the user of server still using a insecure version.

I think this might be the misunderstanding: A good client/server never establish/accept insecure versions.

Yes MITM gets to pick but if he picks insecure version, there is no connection.

POODLE was never attack on the protocol but poor implementations.

<comment><USER37> One misunderstanding is that you are accepting as fact that TLS 1.2 is secure, when it's entirely plausible that one or more state actors already know that not to be the case.

There's no magic light that goes on when the NSA breaks TLS 1.2 so that we know to stop trusting it.</comment></comment></comment></comment></comment></comment></comment></comment>


Metal drinking straw fatally impales woman through her eye after fall - <AUTHOR> https://www.usatoday.com/story/news/world/2019/07/09/metal-drinking-straw-fatally-impales-woman-england/1684768001/ <comment><USER2> I've suddenly seen this pop up all over the place and it has me thinking - what is so important about this story?

By all means, it's very sad and the loss of a loved one is terrible.

I just cant help but think about all of the other people who are impaled by unusual objects and why this case is gaining international traction?

People have been impaled, in the same fashion, by pens and pencils, scissors, forks, and I'm sure a whole host of other objects.

So is it the straw that makes it so news worthy? The cynical part of me wonders if it's because it's an _eco-friendly_ straw? If so, why is that?

Either way, I have empathy for the friends and family. I just fail to see why this is international news.</comment>


How to design and order your own custom Arduino shield in 10 minutes - <AUTHOR> http://blog.circuits.io/post/34159982502/in-this-video-karel-demonstrates-how-to-build-a

<comment><USER2> Nice tutorial, well done Karel!! The new component tool with the octopart integration is easy to use and I love the fact that you can download the datascheet of every component directly. Thats another item on the feature wish list that can be marked as done :D

<comment><USER3> Thanks for the Gyro module!

Indeed one item down and thousands to go ;) Next up is DRC!

</comment></comment><comment><USER4> That's what I wited for. An application that is easy to handle and good!</comment>