(n+1)sec – a protocol for distributed multiparty chat encryption - <AUTHOR> https://equalit.ie/introducing-n1sec-a-protocol-for-distributed-multiparty-chat-encryption/ <comment><USER2> Some of you might recognize NCC Group, the company that performed the cryptographic review. They acquired Matasano, tptacek's prior company. Collectively they have some of the most talented pentesters and cryptographic analysts.

It's a safe bet that the (n+1)sec protocol has an excellent security rating on the basis that they only found one low-severity issue and two informational issues during the analysis.

[https://github.com/equalitie/np1sec/raw/master/doc/NCC_Group...](https://github.com/equalitie/np1sec/raw/master/doc/NCC_Group_Equalitie_N1Sec_Report_2017-07-21_v1.pdf)

Note the caveat:

 _NCC Group reviewed the full specification, however, only the portions of the library that lined up with the protocol were reviewed. NCC Group did not perform a line-by-line review of the entire library. Additionally, the review focused on the library and not a chat client implementing the library._

This means that the theory is sound, but the library itself wasn't actually pentested. That isn't an indication that there are problems -- just that no one has looked for them yet. As a specific example: [https://github.com/equalitie/np1sec/blob/05b73b506b83be9724c...](https://github.com/equalitie/np1sec/blob/05b73b506b83be9724c61bdd46973eee96fa2e31/src/message.cc#L159-L162) It sounds like assessing memory errors was outside the scope of the security review, so it seems unlikely that anyone was thinking about questions like "is there a way for an attacker to trick buffer.size() into becoming -1 and DoSing the system?" It was focused mostly on the mathematical soundness of the cryptosystem.

It's extraordinarily expensive to schedule a two-week pentest, but implementation errors are far more commonly exploited than attacking the properties of a cryptosystem directly. It might be good to schedule an additional pentest if possible.

That said, this is mostly incidental. Congrats on shipping!

<comment><USER3> How much is extraordinarily expensive?

<comment><USER2> I wouldn't be surprised if this cryptographic review cost $40k without breaking a sweat.

There's an interesting blog post just waiting to be written about _why_ this makes sense. It's something you have to experience as an insider to understand. It's why most attempts at creating a startup to do it cheaply at scale have failed, for example. It ends up a nice consulting business for those lone-wolf pentesters, but not a startup. If you're going to be a startup like Matasano you have to be up front about the cost and not compete _primarily_ on cost.

The reason this pricing structure makes sense is because there are two aspects to security: 1. being secure, 2. security theater. Critically, both are valuable, and dismissing #2 is a mistake.

If something goes wrong, you need that security audit document to fall back on. NCC Group's reputation is at stake. When they say there is only one low severity finding and some info findings, what they're really saying is that a bad guy has to be smarter than the reviewers Alex Bladucci, Jake Meredith and Andy Lee working together to break your system for two solid weeks. And even then the bad guy might get lucky or genuinely _be_ smarter.

That's 10 days that they cannot do anything else. You can see that if you have 100 clients in your pipeline, this quickly becomes a problem. It's why Matasano didn't fall over when they started reaching this scale -- their recruitment challenges ensured they had the talent to meet the demand. Literally anyone off the street could do them and become a pentester.

Corollary: If you're going to review 100 companies' codebases, you either need to raise the price to shocking levels, or you need to recruit a small pentester army. NCC's strategy for the latter seems to be to buy them all. With effective results.

As a dev, you'll recognize the classic problem here: you can't have a baby in less than 9 months, no matter how much you try to shift the schedule around. It takes two people two weeks to pentest a client. And if you don't have two people working to break a codebase/cryptosystem for two weeks, I would be very hesitant to call it secure. It takes almost a week to get your mind into a state where you understand the target well enough to exploit it in creative ways. (There are usually lots of easier un-creative exploits lurking though, so that week is typically still productive.)

My $40k number might be off by $20k in either direction, but it's fundamentally a shocking number. The salespeoples' job is to make people understand the value. And to capture the big companies, who can afford to do pentests every release cycle.

That leaves a massive gap that seems like an opportunity: YC startups. They've only recently gotten enough investment in the initial stages where spending that amount of money can make some kind of sense. Spending 10% of your runway is incredibly scary. I've spent a long time thinking of how to resolve this problem without much success. For example, I'd be available to do it less expensively, but I'm one person. If something goes wrong, you can't say "well sillysaurus pentested us." I've thought about starting a company to do this, but then you're back to square one: competing on price alone. That inevitably devolves into a consulting business, not a startup. And even then you won't be able to keep those kinds of prices that low for very long.

So what do you do if you want to create a startup to fill this gap? Make tools, and let the tools do the work. Sadly, this is about as easy as making that sufficiently smart compiler that we've been working on for the last 60 years. You could argue that there is value in letting an automated tool scan your codebase, and that maybe you could throw deep learning at the problem to achieve some success. Maybe. I have an xss.txt file that contains exploits that work on almost every client I throw them at. But occasionally you'll run into a situation where it works, but only with a twist. And those twists seem very hard to automate. Pentesting is as creative as programming, so when you claim you can make a startup to solve "the security problem" (aka nobody can afford it), what you're saying is you either have a way to recruit lots of pentesters or you've figured out how to automate a field that relies on creativity at its core.

<comment><USER4> $40k doesn't seem particularly shocking to me. If you have a team of 5 working on developing the thing that'd be roughly what your own team cost you for 2 weeks anyway (counting salary, benefits, leave, equipment, office space and overheads).

<comment><USER5> You're effectively hiring highly trained engineers to join your team for 2 weeks at that price. People who read and break crypto every day and who've been doing that for a fairly large amount of big companies and for various kind of projects.

</comment></comment></comment></comment></comment><comment><USER6> Matrix also has an OTR-like multi-party encryption scheme based on the Axolotl ratchet called Olm[1]. It also went through an NCC security audit[2]. I believe it has many of the same features as (n+1)sec, so I'm a little confused why they said

> Now that a _first protocol_ for secure distributed multiparty chat exists

are they not aware of Olm, or do they not think it provides the same guarantees?

[1]: [https://git.matrix.org/git/olm/about/](https://git.matrix.org/git/olm/about/) [2]: [https://www.nccgroup.trust/us/our-research/matrix-olm- crypto...](https://www.nccgroup.trust/us/our-research/matrix-olm- cryptographic-review/)

<comment><USER7> (n+1)sec attempts to address the issue of transcript consistency, which is completely out of scope for megolm. Though, it puts additional requirements on the chart room, in particular "members of the chat room receive the same chat events in the same order". I wonder how well this works in practice; does XMPP chat rooms usually ensure this or not; what about flaky internet connection, etc.

<comment><USER8> The protocol itself could implement an ITC, with deterministic rules for concurrent events, and thus have an identical ordering for all members. It would make sense to make this as an extra layer on top of the core protocol when using distribution mechanics that cannot guarantee ordering (which is most of them).

</comment></comment></comment><comment><USER9> From this[1] answer on the IT Security StackExchange site:

> N+1Sec is a similar protocol [to multi-party OTR, which requires > participants to be online at all times to renegotiate keying material] with > some improvements. Note that these protocols have a lot of algorithmic > complexity and tend to scale badly, especially when you add latency into the > mix.

It's unclear to me, though I can hardly imagine it being the case, whether this protocol requires all participants to be online at all times. The quoted answer surely sounds like it has that drawback, which is why I never really considered it as an option (leaving the Signal Protocol with "server-side fan- out" as the only good option).

If it does not have that drawback, having another protocol is a great thing, assuming what Wire says is true regarding OpenWhisperSystems trying to get millions from them for implementing a supposedly open source protocol.[2]

[1] [https://security.stackexchange.com/a/127331/10863](https://security.stackexchange.com/a/127331/10863)

[2] [https://medium.com/@wireapp/axolotl-and- proteus-788519b186a7](https://medium.com/@wireapp/axolotl-and- proteus-788519b186a7)

<comment><USER10> Skimming the protocol specification it seems like they renegotiate a subession whenever someone joins or leaves a group.

> The quoted answer surely sounds like it has that drawback

For IRC you would probably run this on a bouncer, which is essentially always- on even if the device from which you access the bouncer is not. Of course this only works for people who have the technical skill to configure one in the first place.

<comment><USER11> Not sure what you mean by a sub-session but my perusal suggests an entirely new conversation key is negotiated by current participants when those participants change. The spec doesn't say anything about requiring everyone to be online but I think it's implied. It may be that not everyone has to be online at the same time (which would just delay the negotiation IIUC) which is interesting but I wonder what would happen if an offline participate rejoins and doesn't get a full transcript from when they were last online with the carrier. Sounds entirely possible for an IRC/XMPP carrier with people not using bouncers.

<comment><USER12> I also think that it's implied, maybe like Telegram Private Chat - when you need to wait the peer to go online before complete the key exchange.

However when scale to a group with N peers.. we need to wait all of them, maybe they do waking up the peer's via Silent Notification or something like that..

Yeah it's a real fight usability vs security.

</comment></comment></comment></comment><comment><AUTHOR> How does it compare to OMEMO? Here is what the page says about OMEMO (aka Signal Protocol): "It is an incredibly powerful solution but it is reliant on asynchronous communication and is therefore also dependent on the messaging platform — a central server that can become a single point of failure (or metadata collection)." But AFAIK OMEMO works with XMPP even with federation. What are they talking about?

Well, XEP-0384 [1] says users must publish their keys via PEP (personal eventing protocol), but that is to allow sending messages when recipient is offline. And it does not leak more metadata that already leaks during actual message transmission. [1] [https://xmpp.org/extensions/xep-0384.html](https://xmpp.org/extensions/xep-0384.html)

<comment><USER7> OMEMO ensures neither room consistency nor transcript consistency. In fact, last time I checked you could easily send different transcript to different participants (for example by simply not providing them decryption key or providing an incorrect one; some clients do not provide any feedback to the user that something is going wrong).

<comment><USER13> One of the more frustrating aspects of some clients like Gajim is that you can be in a multiparty chat, but there's no way to tell why OMEMO isn't working. You're probably missing somebody's keys, but unless you go spelunking through debug logs you're never going to know. And good luck if one of the members of the memberlist rarely signs in, then you'll never get his key thus rendering OMEMO useless!

<comment><USER14> What I think is even more frustrating is that OMEMO is not required by default. I try to communicate with a group of people without WhatsApp, but I'm not in a position to tell them each which options to check, and what to look for. That's too much hassle for them. That's why I think Jabber/XMPP is lost.

Encryption must be on by default. Better if there is no option of unencrypted communication at all. Go get a debug build for that.

Receiving receipts and reading receipts are a must. It must be on by default. Communication always goes two ways. I had enough situations where one couldn't be sure if the other person has read an urgent info and whether the situation needed escalation.

Account information must be hidden, if the system is not decentralized. People don't want to remember account names and passwords. Get device specific keys, or whatever. Just hide it from the user, unless they want to look at it. People don't want to hear about servers.

</comment></comment></comment></comment><comment><USER15> In reality, the most important thing isn't really the protocol, but how to market it.

We've had open, standard, (some also federated) IM protocols that were on-par with proprietary ones at the time multiple times in the past.

The problem has always been the same: no mainstream adoption, only nerds use it, they stagnate, and a few years later, they're behind what mainstream proprietary apps use. What we really really need to work on is how to get the general population to adopt these things rather than Facebook's next IM. And _that_ 's the really hard part!

<comment><USER16> This is part of what makes Signal exciting - great crypto backed by a lot of security folks, yes, but also mindshare and adoption, even among not traditionally security minded users. I've seen a wave of "X is now on Signal!" roll through my contact list in the past year or so.

<comment><USER17> Sadly the trend seems to go backwards with people around me, since many enthusiastically jumped to Signal and now are leaving again to more reliable messengers.

<comment><USER5> Can attest to that, most crypto and security groups I'm in have moved to WhatsApp for group messaging.

In any case, people tend to be less concerned about security in group messaging since you tend to trust the group less.

One-to-one discussions are still done over Signal for the most part.

</comment></comment></comment></comment><comment><USER18> I fail to see how this is a major improvement over OMEMO? OMEMO is also an asynchronous multi-party chat algorithm, except it's already widely adopted by clients on several different platforms (Android, iOS, Windows, Mac) and has also received a significant amount of attention from security researchers.

OMEMO's cryptographic security has already been audited as well: [https://conversations.im/omemo/audit.pdf](https://conversations.im/omemo/audit.pdf) . I should know as we (Pacific Research Alliance) funded the audit of OMEMO ;) . Auditing merely the protocol seems a little problematic, it's quite rare for vulnerabilities to be in an encryption protocol itself and much more common for it to be in the implementation. There doesn't seem to be any application which actually implements this library right now, let alone a network capable of supporting it. In OMEMO's case we also audited the OMEMO implementation in Conversations where it was originally conceived.

The only difference I can tell from their website is "Room consistency: Group chat participants are confident that they are in the same room". This seems like a pretty niche area to be concerned about, and in practice can be solved by a properly secured network. Although I am no cryptographer I believe OMEMO may offer the same quality as well, because all the messages must be encrypted for each participant, so at worst you could fake an identical room with identical participants, which doesn't really seem like a valid security problem.

While I love to see new research and further development into this area, it seems this is a little late to the party.

<comment><USER19> I would argue that the reason protocol errors are perceived to be "quite rare" is because the security guarantees that many (most?) security protocols offer are usually under-specified, if at all. When auditing protocols, analysts often have to infer what properties a user might expect.

A great example of this would be [1], where a number of ISO-standardised authentication protocols failed to give even the most basic authentication properties. And this kind of issue isn't limited to ISO - the same kinds of issues appeared when analysing TLS, Signal, and others.

The problem is that implementation errors are usually more clearly violations of confidentiality (i.e. it is obvious that an attacker is able to access something they weren't supposed to) - so they are generally held to be more valuable - and hence more eyes spend time looking for them.

(Disclaimer: I am doing a PhD in this field with Prof Cas Cremers, which might bias my views on this subject a little)

1\. [http://www.cs.ox.ac.uk/people/cas.cremers/downloads/papers/B...](http://www.cs.ox.ac.uk/people/cas.cremers/downloads/papers/BCM2013-iso9798-JCS.pdf)

<comment><USER7> What issue do you refer to in context of Signal protocol?

<comment><USER19> Sorry, I didn't make myself clear there. Under-specified security properties. Although they (and TLS, honestly) do a better job than others, in their protocol documentation they really don't go to any lengths to describe what actual security the protocol provides - just that it is "secure". This makes verifying these protocols nigh impossible - and usually you end up with the analyst having to reverse-engineer what security properties they think the designers wanted the protocol to ensure.

</comment></comment></comment></comment><comment><USER20> I've been looking for a secure alternative to IRC. Looking through this:

Is there a way to turn off forward secrecy? For many uses cases you don't want it. I guess you can always add a way after the fact (e.g. by including previous key in each new message)

> New participants cannot join a channel without approval of all existing > participants. Participants know the exact set of participants in the channel > at all times.

This seems problematic for anything more than a trivial number of participants.

<comment><USER6> > I've been looking for a secure alternative to IRC. Looking through this:

Have you looked at Matrix[1]? It's federated, also has multiparty OTR-like encryption, supports multiple devices for each user (with granular trust). And they have many different clients. It also synchronises your chat history.

> Is there a way to turn off forward secrecy? For many uses cases you don't > want it. I guess you can always add a way after the fact (e.g. by including > previous key in each new message)

I believe that you'd always want forward secrecy for any transmitted information. However, you could do what Signal does by storing all of your messages with a single encryption key (so you don't store all of the historic keys, which would be bad).

[1]: [https://matrix.org/](https://matrix.org/)

<comment><USER20> > Have you looked at Matrix

Yes I have.

Have been working on a kubernetes setup for it last week infact: [http://github.com/hashbang/kubernetes- matrix](http://github.com/hashbang/kubernetes-matrix)

<comment><USER6> Cool, I might spin that up on my local Kubernetes cluster. I was thinking about how hard it would be to self-host a Matrix server (I didn't see any k8s configurations published, and their Docker setup is questionable).

</comment></comment></comment></comment><comment><USER21> "Forward secrecy" is listed as a feature. I've heard of "perfect forward secrecy" \-- is there a distinction between the two?

<comment><USER22> It's a bad idea to use the perfect term, because "oh it has perfect secrecy! that will keep my data safe no matter what!"

<comment><USER21> Yeah good point; that could be misleading to average people.

Reminds me of when I once did a short gig at a place where the differently- clued owner had purchased some "BackUPS(TM)" brand backup power battery devices. Of course these have absolutely nothing whatsoever to do with data backup, but he was very satisfied with himself that he had checked off the requisite checkbox for data backups.

</comment></comment></comment><comment><USER23> Congrats to Dmitri and all the folks who have been working on this for a long time. Also kudos to the Open Tech Fund for getting behind it.

</comment><comment><USER24> Anybody knows how whatsapp does it currently?

<comment><USER5> They use Whisper Systems specs:

* [https://whispersystems.org/docs/specifications/x3dh/](https://whispersystems.org/docs/specifications/x3dh/)

* [https://whispersystems.org/docs/specifications/doubleratchet...](https://whispersystems.org/docs/specifications/doubleratchet/)

</comment></comment><comment><USER25> Great.

Now just implement a client using web technologies and distribute it embedded in a standalone seperate chromium client.</comment>


What If Everybody Didn't Have to Work to Get Paid? - <AUTHOR> http://www.theatlantic.com/business/archive/2015/05/what-if-everybody-didnt-have-to-work-to-get-paid/393428/?utm_source=QuartzFB&single_page=true <comment><USER2> Little known fact: Milton Friedman supported basic income concept as an improvement over the welfare state.

</comment><comment><USER3> I would argue that the minds of quit a lot of people would implode :)</comment>


MISP improved model to expire indicators based on custom models - <AUTHOR> https://www.misp-project.org/2019/09/12/Decaying-Of-Indicators.html <comment><USER2> The headline could use some work, I bet nobody knows what MISP is, or what kind of indicators these are.</comment>


Ask HN: Old online fiction story on superman/crypto/PGP? - <AUTHOR> Prob 15y ago or so I read a "story" online about cryptography and how to use pgp and similar tools.
It was half a tech howto, half a fiction story about superman, with a bad guy using crypto to defeat the superhero.
I don't seem to be able to find it anymore, does anyone remember this or anything similar? <comment><USER2> Maybe this (has mentions of Superman in the comments)?

[http://ask-leo.com/what_does_begin_pgp_signed_message_mean.h...](http://ask- leo.com/what_does_begin_pgp_signed_message_mean.html)

<comment><AUTHOR> Ehm, no... but thank you. It was more of a longer story, with several fiction chapters interleaved by how-tos. The title was something like kryptonite, but I don't remember if it was spelled the "superman" way or like crypto...</comment></comment>


Javascript in Firefox faster then chrome - <AUTHOR> http://www.arewefastyet.com/?hn=1

<comment><USER2> This might sound senile, but I'll be more impressed with a browser implementing javascript/css in a way that doesn't make me have to remember how to write code for it's specific way of calling things. I don't want to have to write more code just to make average features work in your browser.

I'll trade milliseconds of load time for that any day</comment>


The Coming Information Totalitarianism in China - <AUTHOR> http://seeingredinchina.com/2013/04/06/the-coming-information-totalitarianism-in-china-by-mo-zhixu/

<comment><USER2> So what does it mean when the United States government has advocated for a real name system on the Internet? Are they attempting to use that as a means for wielding information totalitarianism here in the United States? Is information another form of freedom for which we must fight?</comment>


Direct Multipart Uploads to S3 in Rails - <AUTHOR> http://blog.bitcast.io/post/43001057745/direct-multipart-uploads-to-s3-in-rails

<comment><USER2> I've tried looking for something exactly like this before to no avail. Really awesome assuming it can deliver!

That said, being more transparent in the Readme on Github about the browsers that are currently supported and that plan to be supported would be appreciated. Blob is only Chrome 21+, Firefox 13+ and IE 10+ according to MDN (<https://developer.mozilla.org/en-US/docs/DOM/Blob>), and judging by the "FileBlob API is not supported" comment under the TODO section, there isn't any backwards compatibility yet. How far back are you planning on supporting?

<comment><AUTHOR> Really glad you find it useful, and you're completely right that I need a section on compatibility. The nice thing is that for browsers that don't support Blobs, Amazon allows you to just upload the file as one giant chunk with the same multipart API. I'm not absolutely sure yet (I still need to do some testing), but this should mean that browsers versions as far back as IE 5 will work - only basic XHR compatibility will be required to function. I'm planning on covering as many browsers as possible, I just haven't found a great way to go about this yet. Is there a better option than <http://spoon.net/browsers/>?

<comment><USER3> I would also look at <http://testling.com/> and <https://saucelabs.com/>. Not sure which is best for this kind of testing, but those are two more I'm aware of.

</comment></comment></comment><comment><USER4> This looks like a very useful gem, I wish I found it a week ago!

I ended up using filepicker.io, and am quite happy with that now. But this gem could be good for people that don't want to rely on a third-party (although I still recommend trying filepicker.io)

</comment><comment><USER5> I'm sure this is more a question about S3 than the gem itself, but can you provide any info about security risks, who can upload, where they can upload to, etc.? e.g.: what's to stop someone from uploading a ton of files to your bucket if they have direct access to it?

<comment><USER6> I'm not sure with this library, but with other solutions you have a handshake endpoint on your server which creates a time-limited, single use token. The browser hits your server which then creates a key on S3 and sends it back to the client. The client can then use said key to upload on S3. Might be good to use SSL along with this.

</comment></comment><comment><USER7> Congratulations on this gem. This is a need that was not filled. I had thought about this, but our requirements changed.

BTW, the text does not scale up. And anyone have the name of the website that reformats a page with good CSS, just for future reference.

<comment><USER8> Readability?

<comment><USER7> Readability seems to require a login and an account, etc. There is one that you can just paste the URL and it displays it with different CSS and formatting. I should have bookmarked it.</comment></comment></comment>


Malware must die – these people work for your good - <AUTHOR> http://www.informationsecuritybuzz.com/calling-malware-fighters/

<comment><USER2> " The problem of viruses is temporary and will be solved in two years. " – John McAfee, 1988

<comment><USER3> John McAfee smokes too many drugs...´Me, 2014´</comment></comment>


Goodbye Google Cloud, Hello Digital Ocean - <AUTHOR> https://lugassy.net/goodbye-google-cloud-hello-digital-ocean-a4ca1c8b7ac8 <comment><USER3> I'm a bit surprised by the replies talking about serving millions of requests a second, or needing ultra-consistent packet latency. Perhaps most of the HN demo is working for companies that operate at that scale.

But the OP is talking about running dozens of servers, not hundreds or thousands. My own modest apps have held up to the traffic from being #1 on reddit and not fallen over, never been null routed or nerfed by DO, and served hundreds of millions of requests and hundreds of TBs of data. I have nothing but good things to say about DO.

I have no experience running apps at the "millions of requests a second" scale, and I'm willing to accept DO might be a bad choice at that level. But what percentage of apps will ever reach that scale?

<comment><USER4> >>> I'm a bit surprised by the replies talking about serving millions of requests a second, or needing ultra-consistent packet latency. Perhaps most of the HN demo is working for companies that operate at that scale.

There is a high concentration of serious professionals on HN running world class operations. There is also a large amount of startup and single man operations who would hate to write a $100 check.

The thing is, one can only be on one side. Then the other side has nothing valuable to say to you, all their advice is misplaced.

So, to answer your question. It's stupid to ask what apps will reach a large scale. You're either at large scale already or you are not. Obviously, the article is only intended for small scale operations (actually, the entire article is just a generic ad, digitalocean has a nice affiliate program).

</comment></comment><comment><USER5> I think this is called maturity. GCP finally knows who the target customer is, and they're building features for them. DO has really nice and simple UI, but try to spin 5,000 servers and you will see what a hot mess it is.

GCP shines at a very large scale. For us, what makes the difference, is the spending predictability and massive discounts coming from running preemptible servers or simply committing to certain usage.

GCP is not as service rich as AWS, but most of the offered services are capable of withstanding incredible loads. In our case, while running on tens of thousands of mostly preemptible servers[0], we couldn't pull this off anywhere else (trust me, we've tried).

It's great to know which service works for your loads and make the best of it.

[0] [https://news.ycombinator.com/item?id=13726224](https://news.ycombinator.com/item?id=13726224)

<comment><USER6> +1 you said what I was going to say. GCP probably doesn't want the business of small web sites and portals. I think that under Diane Green they have a clear vision of who their target (large/huge) customer base should be and what they need to do to attract those customers.

For small projects, especially when I am paying the bills, it is difficult to beat OVH and DigitalOcean on costs.

That said, GCP is still my favorite provider, largely because using GCP makes me a little nostalgic for the time I worked as a contractor at Google - <USER2> enjoyed their infrastructure.

<comment><USER5> I hear you. Miss most of the tools and infrastructure every day since I left. I was ecstatic when they made PubSub available to everyone. Wish they would expose more of the internal services, especially Colossus, Dremel, Borg, ...

<comment><USER7> dremel = bigquery, borg = GKE.

<comment><USER5> Yes, those are using the technologies underneath the hood, but are not them itself. I would like to have access to them directly as I would like to build other things at top of them

<comment><USER7> not really. BigQuery is for all intents and purposes an instance of Dremel running for cloud users. And GKE is effectively a clone of borg, rather than an instance of it- which is great. It sounds like what you want is a job at Google...

<comment><USER5> Oh really. Then please add some vectors to BigQuery and run the query on it.

<comment><USER7> I'm sorry, I don't know what you mean, by vector? Do you meant a repeated proto field (which models a vector)?

<comment><USER5> Anything from a matrix to a tensor. For instance you want to store all SIFT points and run comparison.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> More of a rant.

There's time you need more flexibility. I'm serving 1.2MM requests per second from 3 GCP regions, managing instances and GKE clusters with terraform, and I cannot see how could I possibly set that up in a resilient fashion with DigitalOcean.

I think DO is perfect for certain scale apps. You usually care about UI things mostly when you spin up couple servers; but when you operate hundreds of machines you need automation.

GCP has it's quirks, e.g. * 130k connections/core limit due to conntrack, * lower networking throughput compared to AWS (16Gbps on GCP vs 25Gbps on AWS), * no support for enhanced networking (haven't tested recent Andromeda 2.1 yet, though) * no way to attach more than 8 local SSDs (arguably a good thing) * etc

So does AWS, so does DO and you have to pick what's best for your project. One thing I like in general here is competition that makes all of those services better.

EDIT: Fix conntrack typo

<comment><USER9> What do you do that serves 1.2mm requests / second?

I don't disbelieve you, I'm just wondering what type of site that is since English Wikipedia is several orders of magnitude lower than that.

<comment><USER8> Ads, one of the most shitshow industries in the world.

<comment><USER10> So Google built a platform that is excellent for running ad networks. It seems so obvious now.

<comment><USER4> Ads are a super intensive workload with super low margin. It'd be more correct to say that google built a very efficient platform that can run anything. Well, anything easier than ad, so almost anything.

</comment></comment></comment></comment></comment><comment><USER11> Let's not forget how great DO's support is too.

Even if you're only operating at 1x $5/month droplet (their lowest instance type), you'll still get top grade email support included with your plan.

Getting a response in a few hours is almost guaranteed and often times they'll even help you debug problems that go beyond the scope of their infrastructure.

Compare that to something like AWS which charge you an extra $29/month minimum (or 3% of your AWS bill) to speak to an entry level support person through email.

</comment><comment><USER12> "Goodbye cloud, hello nice UI for VPS hosting".

If Google's own premium speedy network, anycast IP, global load balancing and security features bring no benefit to your web operations, then your math might be right.

If you need your LB to handle 10s of millions of HTTP/S requests per minute, then what other choices do you have other than Google?

F/W default "Everything within a project should allowed"? Sorry, but no way.

Not familiar with other DO capabilities, but cloud platform is not just about a VPS available throu REST API, it is way far beyond.

<comment><USER13> > If you need your LB to handle 10s of millions of HTTP/S requests per minute, > then what other choices do you have other than Google?

The same options every business that needed them has done for decades? Renting dedicated servers én masse, colocating, or running own datacenters? And doing this in multiple countries?

What I'd suggest for a start is renting dedicated servers or colocating in a few places (EU-Central, US east, US west), and running on that.

Dedicated servers, even with having to maintain them, are always cheaper than GCP. Even more so is the network traffic.

I've started with dedicated servers with a few European hosters myself where I'd be able to get servers and traffic for 40€ a month that would have cost me upwards of 14'000€ a month with GCP, AWS or Azure (180TB+ traffic per month, I don't have the exact numbers again, but I used each service's cost calculator for this). Sure, if I want high quality networking, I'd have to pay another 360€ per month extra with these hosters, but that's still cheap enough that it means I can basically run a 180TB/month serving service on a hobbyists budget.

<comment><USER12> Dedicated servers == constanct cost. Many cases, you reach peak times for several hours per week/day. With GCP scale up and super fast, and when done, tearing down and saving money.

Also, from my experience, when you reach a certain level of operations, you discuss with Google sales team and you get a significant discount for bandwidth.

<comment><USER14> We're well past that point (with AWS) and we get a meaningful discount, but it's in no way competitive on a per-TB or per-Gbps basis with a dedicated colo.

It's also higher quality of service IMO. When AWS gets their daily DDoS traffic, they manage it and we never notice nor care. With smaller colo providers, they are much cheaper, but if your neighbor is getting DDoS'd, you notice it. I assume Azure and GCP are similar.

<comment><USER13> With regards to DDoS: that's something where OVH has surprised me well in the past, I've been a target once or twice, but they automatically handled all the upstream issues, and thanks to their hardware firewalls, I could filter the traffic before it hit my server.

On Twitter, the OVH CEO claimed that they've previously had servers targeted with 1.1Tbps DDoS, and still managed to keep that user's site working.

</comment></comment></comment></comment></comment><comment><USER15> >What has gone wrong with GCP? It was trying to be AWS. Too complex and feature-rich instead of simple and feature-complete.

Yeah no. GCP is a direct competitor to AWS, so of course Google needs (at least partly) to match Amazon's product lineup. The argument of this post boils down to "GCP should be like DO", i.e. less services and a slicker UI, but Google won't win over AWS customers with that.

<comment><USER16> Indeed. Further to that, there are already a lot of DO-like hosting platforms out there but fewer AWS-like solutions targeting enterprise. So why would Google target a crowded market when they have the resources to target enterprise.

Also to offer my own anecdotal experiences using DO. I find it highly inflexible when I need to do anything more granular. Sure it's easy for deploying a standard build, but anything that falls slightly outside of DO's remit quickly becomes more trouble than it's worth. Where as AWS (and similar) might intimidate new comers with it's scale and complexity but that flexibility can also be a godsend.

</comment></comment><comment><USER17> Good luck with DO, the last time I checked they still shut down your instances as you hit sustained 300Mbps incoming traffic [0]. Could never work with a service that weak on the policy side. Also remember the disaster with surge [1].

[0]: [https://www.digitalocean.com/community/questions/extra- bandw...](https://www.digitalocean.com/community/questions/extra-bandwidth- what-will-happen)

[1]: [https://motherboard.vice.com/en_us/article/qkj35w/nra- compla...](https://motherboard.vice.com/en_us/article/qkj35w/nra-complaint- takes-down-38000-websites)

</comment><comment><USER18> AWS, Azure and GCP instances are completely different to Linode, DO, Vultr, etc... With the first three you get dependable performance characteristics with minimal variation (excluding t* EC2), this is the exact thing you need to do reliable horizontal scaling. Linode and Vultr and DigitalOcean etc.. are great for the price point but if I'm CPU bound and about to scale the identical service to N boxes then it's a poor choice.

As someone pointed out you have Lightsail if you want Linode/DO from AWS. 3.2.1... lets have cliche AWS/GCP/Azure is ridiculously expensive based on some undefined VPS memory/cpu details, hey virtual core!, and let's not forget the usual HE.net / Cogent / Level3 quote of 10Gig for $2000 and work out real bandwidth from there.. :rolleyes:

<comment><AUTHOR> didn't get your last remark re bandwidth. If 1TB alone costs $90 at both GCP/AWS, how is 3TB + 2 CPU instance for $20 is a poor choice?

<comment><USER18> You're getting 2 (or X) virtual cores - which means absolutely nothing and can vary from minute to mintue / hour to hour - Linode was even giving 8 virtual cores with the cheapest plan 2/3 years ago. Virtual cores on Linode/DO/Vultr are shared/contended, basically undefined in terms of lower bound performance - you are at the mercy of other tenants - and there's a lot more tenants in the building too (where number of tenants is exponentially more than physical cores), so I maintain if your CPU bound and horizontal scaling these are poor choices. The cost of provisioning high performance networking is very real, Linode/DO/Vultr don't expect 98% of their customers to use anything close to 1TB and this nicely fit with the idea that they are poor choice for horizontal scaling - hence why AWS Lightsail isn't a threat to main cloud offerings. If you're just getting start and no where near the limit of single node then fine, I even use Linode for a few clients myself "Bandwidth: 39GB Used, 13961GB Remaining, 14000GB Quota ".

<comment><USER19> Did you know that DigitalOcean provides "High CPU" droplets?

<comment><USER18> Interesting, I missed this announcement. This is definitely a step in the right direction to competing for CPU bound workloads. "Achieve up to 4x more CPU performance on High CPU vs Standard Droplets." I guess we can take this to mean that standard droplets virtual CPUs are contended at 4:1 - I would of thought it be higher.

<comment><USER20> You should also check out Vultr's dedicated core plans [1]. I have ~50 instances running on Vultr and CPU performance / unixbench scores are significantly better than DO and Lightsail's similar sized instances.

[1] [https://www.vultr.com/pricing/dedicatedcloud/](https://www.vultr.com/pricing/dedicatedcloud/)

</comment></comment></comment></comment></comment></comment><comment><USER21> We were also impressed with DO's GUI and easy of use. We setup a few monitor servers on their network to measure uptime, latency, packet loss and similar metrics since we deal with audio streaming over UDP. Suffice it to say, it was a mess. So many micro-timeouts and tons of packet loss in small bursts.

For prototypes and small projects dealing mainly in TCP and if uptime is not really important then DO is great. For us, we stick to AWS / GCP for the bulk of our load including dev/testing etc as we want to have the environment as similar to prod as possible.

</comment><comment><USER22> > Private network is available, unmetered.

It's not private. It's internal and shared with all other customers at the same data center location. I wouldn't be surprise if this misleading marketing resulted in lots of accidentally exposes services.

</comment><comment><USER23> Huh. I have zero experience with using cloud services, but I'm a bit surprised by the complexity of _both_ of those UIs. I always assumed it was way simpler than that. Like, I thought it was as simple as using a command-line tool, like "docker run <myprogram>" but "cloud run.." As there any cloud services like that? Where you just specify your environment and CPU features you need etc from a single console command?

<comment><USER24> You could spin up a server with just one AWS CLI command (and most likely google console, but I have no experience with it). As you said, just specify the server spec in the command option. Though, AWS CLI is very verbose with their commands, imo.

Anything more complex, such as weaving several server under one VPC with a load balancer and routing configuration, I'd recommend checking out terraform. It also supports multiple cloud providers.

<comment><USER25> There's also an Azure CLI. You can spin up a Docker Container in one line:

az container create --name mycontainer --image microsoft/aci-helloworld --resource-group myResourceGroup --ip-address public --ports 80

</comment></comment></comment><comment><USER26> So he basically uses ec2 equivalent service and is complaining about the existence of other services.

<comment><AUTHOR> yes. except DO bandwidth is $0.006 instead of $0.09/GB. am I paying extra for the sole existence of other services?

<comment><USER16> The high bandwidth is because with cloud services like AWS and Google Cloud you'd be serving most traffic from either object storage (like S3) or their CDN. Both of which are in the same region as the DO bandwidth figure you quoted. This not only reduces your compute bandwidth costs but also drastically improves your application performance when under load (and as an added bonus you also reduce your compute CPU costs since they're not serving up static content).

I've found even some relatively simple infrastructures (2x web servers, 1x database server + some extra caching services), AWS actually worked out cheaper than Digital Ocean. The problem is you'd have to approach hosting on platforms like AWS slightly differently than you'd approach hosting on the likes of Digital Ocean. But once you start scaling your application, you'll soon find that you'll want to adopt the aforementioned topology anyway regardless of arguments about AWS/Google/etc vs Digital Ocean.

<comment><AUTHOR> S3 is $0.023/GB (still x4 higher), plus $0.004 per 10K requests CloudFront is $0.085/GB, plus $0.0075-$0.01 per 10K requests) GCP is $0.08-0.12/GB (same for all services), plus $5 per 1M requests) And who says most of the bandwidth goes towards static assets? 99% of our requests are dynamic (thus the NodeJS frontends)

<comment><USER16> _> And who says most of the bandwidth goes towards static assets?_

It obviously depends on the application but generally you'd expect that to be the case for web sites (ie not services that act only as an API backend).

 _> 99% of our requests are dynamic (thus the NodeJS frontends)_

I don't know your business so you might be transferring more dynamic data rather than static but your argument here doesn't help explain your business as you're mixing metaphors. eg most of our requests are dynamic as well but JSON APIs will generally return smaller chunks of data compared to an image. So in real bandwidth terms on our application, more data is transferred for static content rather than dynamic. None of the static content touches our web servers though. In fact a fair amount of the dynamic content doesn't either since a lot of that isn't user specific so is served from caching services.

If you don't mind me asking, how much bandwidth you transfer each month? Even taking the above into account, our bandwidth costs (which is nothing compared to when we self-hosted) gets dwarfed by our computing costs (VMs and DB).

By the way, how are you finding node.js for your workload? I find it a weird choice if 99% of your requests are dynamic based on bottlenecks I've experienced when deploying test systems on it. But I ask about your experiences because I've not used node.js for anything at scale (ie just a few thousand requests a second).

<comment><USER13> I'm not the one you responded to, but, I wanted to share my data:

I've had months where I've transferred above 180TB of data, at an overall cost of below 40€ in that month, with dedicated servers at a European hoster.

</comment></comment></comment></comment></comment></comment><comment><USER27> If you want a (free) digital-ocean like interface on top of GCP checkout our Bitnami launchpad [https://google.bitnami.com](https://google.bitnami.com)

</comment><comment><USER19> The only thing that vps attracted me is the pricing of bandwidth.</comment>


Cracking WordPress passwords with 20 lines of Go - <AUTHOR> https://frenxi.com/cracking-wordpress-password-hash/ <comment><USER2> > _Cracking WordPress passwords with 20 lines of Go_

The original title is actually _"WordPress passwords, explained and cracked"_.

It seems Frenxi _—the author—_ added "… with 20 lines of Go" in the post submission simply to appeal to the masses of Hacker News who often upvote links based on keywords more than the content of the article. Per the Hacker News Guidelines [1] → _"[…] please use the original title, unless it is misleading or linkbait; don 't editorialize."_

Go has nothing to do here except the author decided to write the brute force password cracker in it. The program could have been written in any other programming language without losing anything. Honestly, I am disappointed. They didn't even try to make an interesting cracking program, the program doesn't even have goroutines which one would expect from a tool that is trying to brute force a solution.

[1] [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER3> Maybe the interesting thing about it is that it doesn't require any interesting techniques to crack WP passwords? That seems interesting (although unsurprising having an early career background in PHP and WP) to me.

<comment><USER4> Given a password database, and the password check algorithm, this sort of dictionary or brute force approach is just a loop, regardless of the algorithm used because that's factored out.

Worse algorithms can offer the possibility of an exciting optimisation, especially for bulk cracking (e.g. Microsoft's LanMan Hash) - but that's not happening here.

In the case of this algorithm you could get a boost by vectorising to run on a GPU, memory hard pessimisation defeats that and this password hash doesn't offer it, again this Go program doesn't do that either.

For any human memorable password scheme, "Guess until you get lucky" is potentially viable and that's all this does, so it's almost the least interesting case.

</comment></comment></comment><comment><USER5> I reckon this is a relatively simple explanation & demo of how simple it is to crack passwords if you have access to both a database dump of salted passwords, provided the password itself is relatively easily guessable (present in some dictionary of candidate passwords).

In terms of performance --

> At the moment, it processes 100K attempts in about 2 minutes on a small VPS.

It is a bit hard to compare performance without knowing what the `hashloop` parameter was set to for each attempt for that benchmark. Assuming that the hashloop parameter is set to `8192` aka `(1 << strings.Index(itoa64, "B"))` as in the blog post, then this approach is computing about 6.83 md5 mega-hashes (MH) / sec.

For a 30,000x speedup for brute forcing md5: hashcat + 8x GPUs can hit something like 200 GH / sec of md5:

[https://hashcat.net/hashcat/](https://hashcat.net/hashcat/)

[https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...](https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40)

</comment><comment><USER6> When I read "Bcrypt is known to be a stronger hashing method compared to md5" it is blatantly clear the author have missed the _entire point_ of the phpass library. [https://www.openwall.com/phpass/](https://www.openwall.com/phpass/) to quote

> The approach of using multiple iterations to purposefully increase the > computational cost of testing a password

The author has shown that a hashing function can be attacked by using a dictionary attack... well, yes, of course. But the library is not inherently weak just because of that. Yes, you can write it in 20 lines of Go but -- you'd need to benchmark the attack against other hashes. Just because the md5() primitive is used as _part_ of the algorithm doesn't make the whole shebang weak.

The question always is how long it takes to find clear text which gets hashed to a certain value.

<comment><USER7> It's 2020 and password-cracking is done on GPUs nowadays. The multiple rounds of PHPass do nothing against the speed of modern GPUs. You need a password hash that also requires a lot of RAM to compute to limit parallelism, like argon2 or scrypt.

<comment><USER8> It's 2020 use OpenID Connect or any other "federated/delegated authentication" or anything else you may think off that doesn't forces you to store passwords.

</comment></comment></comment><comment><AUTHOR> Hey Folks, author here!

The post is just supposed to be a plain-text explanation of WordPress hashes, and the script is an explanatory POC.

As I mentioned, of course, there are more solid solutions out there but that's not the point.

Regarding the title, it was not supposed to be a clickbait. I just changed it to a more appropriate one :)

Hope you can take something good out of it.

Cheers, everybody!

</comment><comment><USER9> >2020/05/30 12:44:15 Executed in 0.000221

oh wow, i guess that would've taken years to execute had i written it in c#.

</comment><comment><USER10> Why does WordPress use md5? I understand that salting improves things quite a bit, but still.

Doesn't password_hash() use bcrypt by default? Why not use it?

<comment><USER11> [https://github.com/roots/wp-password-bcrypt#the- problem](https://github.com/roots/wp-password-bcrypt#the-problem)

<comment><USER10> Nice, I'm glad such plug-in exists. My question is why hasn't WP core adopted bcrypt yet. MD5 has been insecure for ages.

</comment></comment></comment><comment><USER12> Cracking isn't usually something that takes a lot of code, just a lot of time

</comment><comment><USER13> Why not Rust?

</comment><comment><USER14> Realize that the attacker must first possess the user/password database for this to work. This is because the author takes the salt from that information. Without the salt, it will take much longer to brute force... even though it's md5 hashed.

<comment><USER15> How is he getting the salt from the database?

<comment><USER5> this corresponds to sad scenario where the database itself is leaked and the attacker has access to it. the blog describes how the salt is stored as prefix to each hash.</comment></comment></comment>


Bill Gates Talks Philanthropy, Microsoft, and Taxes - <AUTHOR> https://www.youtube.com/watch?v=_15DReQKbt8 <comment><USER2> That host really needs to stop fiddling with his seat.

Honestly that must be the most uncomfortable chair of all time.

<comment><AUTHOR> They have really uncomfortable chair.

<comment><USER2> Welp, looks like the neural net was about correct.</comment></comment></comment>


Objective-C on Windows - <AUTHOR> http://www.drunkenprogrammerblog.blogspot.com/ <comment><AUTHOR> What is not clear for me, after reading this post, is if I could use Objective-C 2.0 in GNUstep. Otherwise I suppose I could just buy a Mac.

</comment><comment><USER2> You can't use the new features of Objective-C 2 in GNUstep, at least not with the default Windows installation. I didn't tried on Linux.</comment>


Top 4 Browsers for Linux with Good and Bad - <AUTHOR> http://www.linuxandubuntu.com/home/top-4-browsers-for-linux-with-good-and-bad

<comment><USER2> Site blocked at my work, anyone update me with the article? or at least what the 4 browsers were.

<comment><USER3> Chrome, Firefox, Opera, Vivaldi.

<comment><USER2> Awesome to see Opera on the list since that is my browser.

However I have never heard of Vivaldi, will have to check it out.</comment></comment></comment>


Police Overwhelmingly Responsible for Attacking Journalists - <AUTHOR> https://theintercept.com/2020/06/04/journalists-attacked-police-george-floyd-protests/ <comment><USER2> It seems an odd, self-defeating choice, for police to attack journalists who are documenting a protest against police brutality, doesn't it?

It makes you wonder, if they are so willing to attack someone who is obviously broadcasting the attack, with clearly marked "Press" identification, how they are likely to act when there is less scrutiny...

<comment><AUTHOR> A similar question could be raised about why they're overwhelmingly brutalizing and arresting (not necessarily in that order) peaceful protesters rather than "looters" who even when they're not actually undercover cops are allowed to loot without interference. We know the police are not smart or well-organized enough to have some sort of national master plan. So, either these choices reflect local incentives that are intelligible to officers on the scene but not to us on the outside, or their decision process is so degraded that they don't possess the ability to act in even their own best interests. Can we please just fire all these clowns already?

</comment></comment><comment><AUTHOR> This is an interesting study in HN ranking penalties. Two hours in, there are 25 points and we haven't sniffed the front page. Currently ranked #126. Meanwhile links of similar vintage with 5, 15, 12, 6, and 6 points are at #9, #11, #17, #20, and #28 respectively. b^) I guess we're lucky not to be flagged out of existence.

<comment><USER3> I think it also factors in the velocity of upvotes. I.e., I've seen things with 3 upvotes make the front page, presumably because they happened very rapidly.

<comment><AUTHOR> Velocity is change over time, right? 25 votes divided by 2 hours is greater than 6 votes divided by 2 hours: velocity is not the explanation. The explanation is either an inherent penalty on "theintercept.com", which I wouldn't even fault given their over-the-top Russiagating and their sordid history of burning confidential sources, or as seems more likely we have a lot of bootlickers on HN who are overusing the "flag" button.</comment></comment></comment>


Digg Dialog - <AUTHOR> http://digg.com/2015/dialog-launch-blog-post <comment><USER2> Didn't they already try this with Digg Dialogg (note the double g), somewhere in 2008? I remember it being some sort of AMA with celebrities in which the highest voted questions got actually asked to the celebrity by the interviewer.</comment>


Latest Firefox rolls out Enhanced Tracking Protection 2.0 - <AUTHOR> https://blog.mozilla.org/blog/2020/08/04/latest-firefox-rolls-out-enhanced-tracking-protection-2-0-blocking-redirect-trackers-by-default/ <comment><USER2> My friend who works in an adtech company:

"Protip: Use Firefox instead of Chrome. We get very little data from Firefox users"

<comment><USER3> Even less data if you use uBlock Origin and possibly uMatrix (which is very high maintenance, but also reveals the utter insanity of the web).

Without an adblocker the internet is such a slow heap of trash that I'd never go back to not using one. This is also one of the main reasons I use my iPhone so little, since it doesn't really have any way to adblock.

<comment><USER4> The only downside is that product managers who rely on third-party analytics to decide what platforms are relevant will never see Firefox+uBlock users as relevant. I've had to argue this at multiple companies; fortunately at some places multiple developers used uBlock so it wasn't as hard as making the case alone.

<comment><USER5> > fortunately at some places multiple developers used uBlock so it wasn't as > hard as making the case alone.

Is adblocking not common? Every tech literate person I know uses an ad blocker. I'd say about 30-40% of millennials I know use them, most using ADB or uBlock Origin.

Every time I see someone using a browser with ads I forget what a nightmare the internet is.

<comment><USER6> Anecdotal, but I've pushed close friends who are reasonably technical to install an ad blocker. Without my urging, they wouldn't have had one at all. When I come across someone who doesn't adblock, it surprises me, but it really shouldn't, as it seems most people don't have an ad blocker.

<comment><USER7> I still don't use an ad blocker. I know all the arguments for ad blocking and I agree with many of them. I know what difference it makes in terms of performance and annoyance.

But I just can't bring myself to indiscriminately block all ads, knowing how important they are as a funding source for the websites I use.

There's only one thing that destroys privacy even more thoroughly than ad targeting: payment.

<comment><USER8> > There's only one thing that destroys privacy even more thoroughly than ad > targeting: payment.

I disagree with this. Maybe you can elaborate?

If I am paying for a service then there is no incentive to mine my personal data for revenue. It's a mutually beneficial transaction. And there are plenty of ways to hide your personal information (even your name) when paying for something (e.g. using a service like privacy.com).

<comment><USER9> My understanding is that the mentality is "they paid us, we have their data, we're keeping it for future leads, we could get a new line of revenue by turning that into a product."

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I'm happy to see stuff like this.

I'd be even happier if the tricks to get video to play were somehow canceled.

I have adblocker and video blockers, but somehow, news sites have a video that plays. If I scroll off the page, the video pops out into the lower right hand of the page and resumes playing, even if the big version of the video at the top of the page was stopped /paused (which it is by default), and it needs to be stopped again. On mobile (Android) this is a double nightmare, even in Firefox, because the little video has a tiny little X, and somehow my finger doesn't ever hit X the first time. I can plug in a USB-A connector in the right way faster than I can press that little X.

Is there an explanation for this, and am I the only one?

<comment><USER11> Isn't the small video in the corner a feature actually implemented in Firefox itself (picture-in-picture) and nothing to do with the web page? If so then that seems doubly bad!

<comment><USER12> Firefox doesn't force it. The feature is that you have the option to pull the embedded video into a non static location within your browser window.

So you could allow the video to play in view while you scroll through the remainder of the page.

</comment></comment></comment><comment><USER13> I've been a user since they first split from Netscape. Very happy to see continued efforts in this project. Congrats folks! I'm glad you exist.

Related: I don't know if this applies to other platforms, but the newest version of FireFox on FreeBSD (79.0,1) generates errors on every website you visit stating insufficient security. (including google & mozilla.org) This is somehow related to not having a virus scanner installed or something.

This is the about:config setting to disable that:

network.http.spdy.enabled.http2=false

<comment><USER14> I'm running the same version of Firefox on FreeBSD (firefox-79.0,1) and I don't see this (with http2=true). I'm running 13-current (r363668) and using the 12-stable quarterly packages (FreeBSD:12:amd64/quarterly)

<comment><USER13> I'm running 12.1-RELEASE-p5 [quarterly], so that's interesting. We should be overlapping somewhat.

I inclined to believe that it's just my luck. You need somebody to find edge- case bugs? I'm your stooge.

<comment><USER14> I hear that. The latest update to kde / plasma5 changed something enough that it took me 4 logins before I got a task manager. Dealing with these these super disruptive / breaking kde changes only a few times a year are why I run the stable packages rather than the -current packages. I think I'm just going to give up and switch to lxde

<comment><USER13> Not to be too much of an old-fart, but I gave up on kde after they moved away from 3.5. I've tried every major release since 4 came out and I keep not liking it.

I do really enjoy some of the apps, but I'm fully in the i3 camp for several years now.

<comment> yjftsjthsd-h Did you ever try [https://www.trinitydesktop.org/](https://www.trinitydesktop.org/) ?

</comment></comment></comment></comment></comment></comment><comment><USER15> > Latest Firefox rolls out Enhanced Tracking Protection 2.0; blocking redirect > trackers by default

Isnt that what is used with Google Search? For example if you go here:

[https://www.google.com/search?q=sunday](https://www.google.com/search?q=sunday)

the first result appears to be:

[https://en.wikipedia.org/wiki/Sunday](https://en.wikipedia.org/wiki/Sunday)

but its really:

[https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...](https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiE45DBuoTrAhUJP60KHb- LAgcQFjAAegQIAhAB&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FSunday&usg=AOvVaw3AEEL2UuDK8DJPu1wtWera)

<comment><USER16> More details here[0], but in short, they'll "block them" by deleting cookies and site data of redirect trackers every 24h, preventing long term profile building, while not breaking the redirects.

There's also a "Google search link fix" recommended extension that fixes those URLs (replaces [https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...](https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiE45DBuoTrAhUJP60KHb- LAgcQFjAAegQIAhAB&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FSunday&usg=AOvVaw3AEEL2UuDK8DJPu1wtWera) to [https://en.wikipedia.org/wiki/Sunday](https://en.wikipedia.org/wiki/Sunday) in your example). Also available for Chrome and Opera.

[0] [https://developer.mozilla.org/en- US/docs/Mozilla/Firefox/Pri...](https://developer.mozilla.org/en- US/docs/Mozilla/Firefox/Privacy/Redirect_Tracking_Protection)

<comment><USER17> Deleting redirect cookies is a wonderful step forward in improving privacy.

I'm now concerned that companies would attempt to circumvent this by profiling users via fingerprinting through canvas, screen resolution, user agent and other means.

I wonder how such profiling can be minimized / eliminated ?

<comment><USER18> As of January [1], it looks like Firefox enabled fingerprinting protection by default. Expert users may have overridden settings in various ways that could prevent those protections from being active. To verify, at Preferences > Privacy > Tracking Protection (about:preferences#privacy), make sure you've selected an option that includes Fingerprinting protection.

[1] [https://blog.mozilla.org/firefox/how-to-block- fingerprinting...](https://blog.mozilla.org/firefox/how-to-block- fingerprinting-with-firefox/)

<comment><USER19> Note that _I think_ this blocking is done not by detecting a site doing it, but instead by using block lists: Firefox has a list of sites where third- party resources, including JS that would do canvas fingerprinting, will be blocked.

As I understand it, this is different from the various "resistFingerprinting" ("RFP") settings in about:config, which will work on every site (and are notorious for breaking things). Ditto CanvasBlocker, which AFAIK runs on every site.

I got this info from one of the links in the informative post you cited: [https://blog.mozilla.org/security/2020/01/07/firefox-72-fing...](https://blog.mozilla.org/security/2020/01/07/firefox-72-fingerprinting/)

<comment><USER18> Yeah, I definitely wouldn't enable resistFingerprinting for anyone I'm responsible for providing tech support to! If y'all want to experiment with it, go ahead, but be prepared to be angry at your browser and/or websites as things mysteriously break without explanation.

</comment></comment></comment></comment></comment></comment><comment><USER20> I keep encouraging people to use Firefox over the others. My efforts keep failing. Mozilla's focus on privacy is important and should be to others. People have been burned in the past and are willing to give up privacy for something that just works. The irony.

<comment><USER21> Do people think Firefox doesn't work? I've noticed zero difference between using Firefox and Chrome and I've used both daily for five years or so.

<comment><USER22> Google has an incredible walled garden of apps and things that 'just' work together seamlessly. I remember switching from FF to Chrome years ago as Chrome was measurably faster. The staying power was using Google's entire suite of apps with Chrome. Things like copying and pasting without formatting or searching for strings all contribute to stickiness.

<comment><USER23> I have to frequently open Google Meet in Chrome because other users can't see my screen while screen sharing using Firefox.

<comment><USER24> Interestingly, when we had lockdown in my country I tried using Google Meets in Chrome and it just shat itself. Switched to Firefox and Meets worked so much better in Firefox. Very strange...

</comment></comment></comment></comment></comment><comment><USER25> This is fantastic. I never liked the cookies sticking around forever, and managing them manually was a massive pain if you wanted to keep some of them.

Not to mention Firefox is usually brought to its knees when trying to delete large segments of History/Cookies at once.

<comment> ainar-g > This is fantastic. I never liked the cookies sticking around forever, and > managing them manually was a massive pain if you wanted to keep some of > them.

You might like the CookieAutoDelete plugin[1]. It's a recommended plugin which allows you to set a list of domains and domain patterns which retain their cookies while others are deleted. I've been using it for a couple of months now, and I love it.

[1] [https://addons.mozilla.org/en-GB/firefox/addon/cookie- autode...](https://addons.mozilla.org/en-GB/firefox/addon/cookie-autodelete/)

<comment><USER26> CookieAutoDelete has some fatal flaws. It doesn't delete indexeddb, for instance. Also, if you're a tab hoarder it simply doesn't work for the common sites you visit. Temporary containers[1] is a much better option, as it uses firefox's container tabs to provide much tighter isolation.

[1] [https://addons.mozilla.org/en-US/firefox/addon/temporary- con...](https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/)

<comment><USER27> I recommend Forget Me Not as an alternative.

[https://github.com/Lusito/forget-me-not/](https://github.com/Lusito/forget- me-not/)

</comment></comment></comment></comment><comment><USER26> Can we talk about how google isn't affected by any sort of mainstream tracking protection? They're not going to be affected by this, because you visit google domains (directly or indirectly) multiple times daily. They're also not affected by blacklists, because they own recaptcha, and that's explicitly whitelisted in in popular blocking lists.

</comment><comment><USER28> Off topic, but every time I see an article like this I load up Firefox and try it out to see how it has progressed. I inevitably stop using it, and this time I decided to introspect and see why. It turns out that it's mouse wheel scrolling doesn't feel as snappy as other browsers, and for some reason it bothers me a lot. I'm going to try changing the scroll wheel settings and see if I can stick with it.

<comment><USER29> that's funny because in chrome i hate the scrolling because it doesn't have the middle mouse click autoscroll feature and all the "solutions" to fix that are janky webextensions.

<comment><USER30> Chrome has autoscroll here, on Windows.

What platform do you use?

<comment><USER29> mac os... they may have added it since i stopped using it. but i like firefox more for it not being google

</comment></comment></comment></comment><comment><USER31> I'm trying to get myself to finally switch to Firefox thanks to this post. But I'm having problems with ctrl +/\- changing of font sizes. In Chrome, that setting affects one domain only. Here I'm getting confused because I open a new tab and the font is tiny or huge, even sometimes on sites I've never visited before. Ctrl 0 fixes it but then I seem to reset sites that I do want enlarged (like HN). What's the logic here? I haven't figured out the steps to reproduce this, it seems random.

<comment><USER32> I've had the same experience! Well sort of, I think it's related to the experimental zoom I enabled. Trying to track down how to reproduce so I can open a bug, but it's sporadic for me. Other than that, I'm pretty happy with the browser

<comment><USER31> I've possibly figured it out. If you scroll quickly and while the inertia carries the scrolling onwards hit ctrl+w to close the tab, it'll resize the next tab that gains focus. Presumably that's because ctrl is held down and it's scrolling, even though the scrolling is only from inertia. Obviously scrolling shouldn't carry over to the new tab, so it does look like a bug. Moreover, it also resizes the website of the tab you just closed.

Guess I need to submit a bug report.

Edit: apparently Bugzilla requires passwords longer than 10 characters - wow! At least the that's the error I got (password too short) when I tried to sign up. Seems excessive.

</comment></comment></comment><comment><USER33> I'm a fan of ETP, except it breaks a lot of sites that use embeds.

For example, sites that use Twitter or Instagram [1] embeds won't show the embeds. And there's no way, as far as I can tell, to whitelist those.

The only solution is to whitelist the sites that have embeds, but that ends up enabling all the tracking and stuff you don't want.

[1] [https://bugzilla.mozilla.org/show_bug.cgi?id=1446243](https://bugzilla.mozilla.org/show_bug.cgi?id=1446243)

<comment><USER34> Pretty sure that embeds enable all the tracking stuff you don't want, too.

<comment><USER35> Yes.

Embeds aren't broken, they just appear text only.

When you block twitter embeds , you can't like the tweet without opening the tweet in a separate tab.

You can't do both. Either have the like functionality, or block it.

</comment></comment></comment><comment><USER36> I'm really happy to be using Firefox again. I had abandoned it in favor of Chrome around 2014 because of how sluggish it had been getting. They really got it together with the quantum update though in my opinion. It still gets outperformed by Chrome (especially in the javascript department), but it's not a big enough difference to be a deal breaker for me, and I like feeling like I'm doing my small part to help combat Chrome's growing monopoly.

</comment><comment><USER37> The only browser we can trust today. Glad to see they're making privacy online a priority, on top of an already amazing browser I use regularly and exclusively both on Linux and iOS.

<comment><USER38> Honest question, what's wrong with Safari, that you can not trust it?

<comment><USER39> It's not open source, how can you trust it?

<comment><USER38> I thought Webkit, the core engine is open source. Or, are you saying Webkit != Safari?

<comment><USER40> Safari can use Webkit, but Webkit isn't Safari. Basically, if Webkit = Safari, then anything using Webkit would also be equally safe.

</comment></comment></comment></comment></comment><comment><USER41> I understand: cookies are deleted every 24 hours unless you've visited the site before in the last 45 days.

Does this mean if I visit a site twice the cookie stays but otherwise it's gone in 24 hours?

<comment><USER42> I think it means that 3rd party cookies will be deleted in 24 hours unless you visited the site of origin in the last 45 days.

So if you get a 3rd party cookie from www.marketingsite.com, but never visited that site, it will be deleted in 24 hours. But if you get a 3rd party cookie from facebook, and you're a semi-active facebook user, the cookie will be kept.

<comment><USER41> I don't think it's only third party cookies. But all cookies if you've only visited the site once once in 24 hours.

The article mentions you get redirected to a website before going to your destination, so the third-party cookie is no longer 'third' but 'first' since you (unbeknownst to you) visited the site.

<comment><USER42> Looks like we're both not entirely correct (and probably both skipped the security blog posts!).

In the security blog post, they explicitly say "An origin will be cleared if it [...] is classified as a tracker in our Tracking Protection list" and "[has] No origin with the same base domain (eTLD+1) has a user-interaction permission".

So it's not a catch-all for any and all redirect trackers, just those Mozilla knows about, and whitelists trackers that are first-party in spirit. I do wish they didn't frame it as "we're blocking redirect trackers" but instead as "we extended our tracking blacklist to include known redirect trackers, unless we have a good reason to think you allow them".

</comment></comment></comment></comment><comment><USER43> Unfortunately, even with Enhanced Tracking Protection 2.0 you can still be tracked by using ETags. There are extensions for Firefox that block ETag tracking, but I haven't reviewed a specific extension sufficiently to recommend one.

<comment><USER35> Remove Etags with the CleanURL addons. Just turn off everything else it does, if you only want to remove ETag.

Clean URL cleans many links. No utm_source, no amazon trackers, no google/yandex changing links just right before you click it. It has adblock built in, so turn it off if you already have an adblocker.

You can also do it with [https://addons.mozilla.org/en- US/firefox/addon/netflix-party...](https://addons.mozilla.org/en- US/firefox/addon/netflix-party-for-firefox/)

<comment><USER44> Wow first time I read about etag tracking. The creativity of adtech companies is really impressive

<comment><USER35> Yeah. Almost every site uses it now.

Check whether you can be tracked here - [https://hinternesch.com/page1](https://hinternesch.com/page1)

Visit the site. Then clear cookies and history (don't touch cache) . Then return and you will get the same ID, provided you are not using any extension that removes the E-Tags.

I learnt about the possibilities of Etags from here - [https://privacy- formula.com/reader/no-cookies-no-problem-usi...](https://privacy- formula.com/reader/no-cookies-no-problem-using-etags-for-user-tracking/)

</comment></comment></comment></comment><comment><USER45> [https://support.mozilla.org/en-US/kb/how-do-you-use- leanplum...](https://support.mozilla.org/en-US/kb/how-do-you-use-leanplum- firefox)

> What data is collected and sent to the Leanplum backend?

> Leanplum tracks events such as when a user loads bookmarks, opens a new tab, > opens a Pocket trending story, clears data, saves a password and login, > takes a screenshot, downloads media, interacts with a search URL or signs in > to a Firefox Account.

</comment><comment><USER46> Honestly the best thing you can do is use Firefox and set the browser settings to "Never remember history". This deletes everything in the cache, cookies, etc every time your browser closes. Drawbacks - you have to log back in to every site every time you relaunch the browser. But then these cookies and tracking methods do not follow you around.

</comment><comment><USER47> Hopefully this will make affiliate-link based sites like Wirecutter change their ways. I dont mind them earning affiliate money but I can't even click a link at Wirecutter anymore since their bounce redirect to Amazon or wherever is totally blocked by my DNS settings originally via AdGuard now via nextdns.io

<comment><USER48> Can you add an exception for the site? It seems like a slightly inconsistent position that you don't mind them earning affiliate money yet you're actively blocking them from doing so.

<comment><USER49> it seems the objection is to unearned affiliate revenue (for any purchases at amazon for some period just for visiting wirecutter), not earned affiliate revenue (by clicking on a product you intend to buy), which is consistent and fair.

<comment><USER50> What you described sounds like cookie stuffing and is almost certainly prohibited by Amazon and any competently run affiliate network/program.

<comment><USER49> yup, that's it. i couldn't recall the name for the practice, so thanks for that!

</comment></comment></comment></comment></comment><comment><USER51> I love Firefox as an alternative to Chrome but I hate how it goes of its way to be as cumbersome as possible.

Witness this example of the most terrible UI ever; how frustratingly convoluted it is to delete specific cookies:

1: Open Preferences

2: Search "cookies"

3: See a bunch of cluttered stuff

4: Scroll all the way down to "Cookies and Site Data"

5: Click "Clear Data"

6: Oops, that's not it. Cancel and try "Manage Data"

7: Search "google" for example (to avoid their crappy tactic of signing you into Search when you sign into YouTube or Gmail, but that's another story)

8: Click "Remove All Shown"

9: Click "Save Changes"

10: Get hit with a modal alert in your face showing you the list of changes to confirm.

11: Click "Remove"

[https://i.imgur.com/QrE4EH3.gif](https://i.imgur.com/QrE4EH3.gif)

<comment><USER52> It isn't great but imho it's better than Chrome which confuses me each time and feels super limited:

1\. Open settings

2\. Privacy and security

3\. Scroll down to find the tiny "See all cookies and site data"

4\. Use the search box for the site you want

5\. Then you only have the option of removing everything from that site?? There's a little X icon to the right of each cookie but clicking it does nothing

Unless there's a better way I haven't seen (I use chrome infrequently)

</comment></comment><comment><USER53> Surprisingly extensive article from Brave[1] from Aug 2018 -- two years ago! About redirect tracking, it says this:

> Brave's policy of disallowing any third party state by default makes it > already more privacy-preserving than ITP 2.0 in regards to third party > redirection-based tracking. Brave users however may benefit from an ITP-like > protection from first-party trackers, although their number is small.

Apparently Safari had ITP, a similar type of redirect tracking mitigation, for some time.

1\. [https://brave.com/redirection-based- tracking/](https://brave.com/redirection-based-tracking/)

</comment><comment><USER54> Nice. Firefox has making some great improvements recently.

</comment><comment><USER55> Add those add-ons:

[https://addons.mozilla.org/en-US/firefox/addon/canvas- finger...](https://addons.mozilla.org/en-US/firefox/addon/canvas-fingerprint- defender)

[https://addons.mozilla.org/en-US/firefox/addon/webgl- fingerp...](https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerprint- defender)

[https://addons.mozilla.org/en-US/firefox/addon/font- fingerpr...](https://addons.mozilla.org/en-US/firefox/addon/font-fingerprint- defender)

[https://addons.mozilla.org/en-US/firefox/addon/audioctx- fing...](https://addons.mozilla.org/en-US/firefox/addon/audioctx-fingerprint- defender)

I would really love to have more addins like this, doing one thing and doing it good. They will kill fingerprinting and as a proof, I was downvoted the next moment i posted the links.

<comment><USER56> Not sure that's the reason why you were downvoted.

Perhaps (I am trying to guess) it would have been more helpful to explain why these four add-ons, individually, are so necessary. Or perhaps a more expanded comment on why you picked these, and what effect they provide.

</comment></comment><comment><USER57> Another option is to always delete cookies and site data when you close Firefox and set exceptions for the few sites you care about. If you are like me and only start Firefox once or twice a day this prevents too much annoyance while limiting cookie based tracking.

Also, Mozilla should really think about what is wrong with the statement "Since we enabled ETP by default, we've blocked 3.4 trillion tracking cookies." I imagine most people who care about tracking would like to not be tracked by anyone, not just anyone other than Mozilla.

</comment><comment><USER58> From reading the comments, it sounds like the only real choice is the Tor Browser if you want to be anonymous, or just accept all of it and use your device's native browser for best performance.

What I'd be interested to know is if all of this anti-tracking technology matters if you just isolate domains by using containers. My guess is that Google and company have so many tracking domains that containers have no impact on that, at least 3rd party. But it seems like part of a real solution.

</comment><comment><USER59> I wish Apple realised that more competition in browsers on iOS is better for the user and they shouldn't be greedy about it. How wonderful would it be to have proper Firefox in iOS.

<comment><USER60> I use Firefox on iOS. It has some tracking protection. Probably not the full- fat version of desktop Firefox, but I find it to be more tolerable than Safari on iOS.

</comment></comment><comment><USER61> Epic games seems to be using captchas for ue4 accounts that break for Firefox users who are using tracking protection. Not a complaint against Firefox, just very annoyed by game dev in general for privacy reasons.

\- more or less forced to use windows for development / to access marketplace content \- have to modify engine source code to disable analytics \- have to use Chrome to access their sites and dashboards

I really miss my old Linux setup

</comment><comment><USER62> What if cookies were opt in? E.g. blocked by default everywhere unless you decide to allow them, same as access to the webcam for example.

<comment><USER63> Side benefit: It helps a ton with testing changes instead of clearing everything and starting over!

</comment></comment><comment><USER64> I want to switch to Firefox, but of all things, its tab management is keeping me away. On my last try, I gave up after five minutes because I couldn't see all my open tabs at once (had to scroll). Does anyone know of an extension or setting I can use to force Chrome-like tab behavior, where all tabs are shown at once regardless of how small they become?

<comment><USER65> I use tree style tabs, which is amazing for tab hoarders like me: [https://addons.mozilla.org/en-US/firefox/addon/tree-style- ta...](https://addons.mozilla.org/en-US/firefox/addon/tree-style-tab/)

<comment><USER64> Do you still have to navigate? Like, click or scroll or whatever, to get between tabs? I'm looking for a UI that shows me all my tabs, all at once, no clicks/scrolling/navigation required.

</comment></comment></comment><comment><USER66> Mozilla are the Good Girls and Good Guys of the Internet! They do the right thing. Its also quite easy to see who are the bad actors.

</comment><comment><USER67> I think Firefox's first order of business should be to focus on making it as good as Chrome first, then focus on other things. I can do all the blocking I want on Chrome with extensions. I cannot make Firefox fast, or work well with the touchpad with any extension.

</comment><comment><USER68> I think we should buy either windows or apple based computers instead of chromebooks because the former allows us to install Firefox while the latter does not allow that. I tried Firefox recently and I really liked it.

</comment><comment><USER69> I don't quite understand. The latest version of FF is 79.0, released on July 28. This article is dated Aug 4. So is Mozilla going to remotely activate ETP 2.0 for users of FF 79 without requiring an update?

</comment><comment><USER70> I'm on the latest Firefox and it's allowing a Set-Cookie with the Secure flag over http (for localhost). This seems wrong to me, but maybe it's allowed for localhost specifically? Anyone else experience this?

<comment><USER71> Yes. localhost is considered a Secure Context via [https://w3c.github.io/webappsec-secure- contexts/#potentially...](https://w3c.github.io/webappsec-secure- contexts/#potentially-trustworthy-origin) \- This is intentional to testing APIs which require a Secure Context easier to use during development. E.g., ServiceWorkers.

</comment></comment><comment><USER72> Will this be enough to trigger the Google captcha punishment on every site I go to? I already run into that more than I'd like.

</comment><comment><USER73> Nice improvements! Firefox keeps delivering! But Chrome browser market share is now up on 71% while Firefox is down to 7.3% :(

<comment><USER74> How is that market share determined? Is it by looking at data from tracking?

Those tracking numbers will reduce, the more that Firefox cracks down on it.

User agents hitting server logs are probably more accurate now.

<comment><USER75> Maybe via user agent headers.

</comment></comment></comment><comment><USER76> Does this mean that data from actively visited sites (first-party) will be automatically deleted 45 days after the last visit?

</comment><comment><USER77> Recently Amazon starts to ask for OTP every time I open its website. Is it due to the new tracking protection feature?

</comment><comment><USER43> If you can tolerate it, I recommend using Temporary Containers as a supercharged version of Enhanced Tracking Protection.

</comment><comment><USER78> If only I can get Chromecast working on Firefox. I would never touch Chrome ever again.

<comment><USER79> I mean, you would still be touching chrome, as Chromecast devices are well, running Chrome... but your point is taken

</comment></comment><comment><USER80> What stops trackers from using local storage on redirects instead?

</comment><comment><USER81> This sounds very similar to Safari blocking/deleting cookies?

</comment><comment><USER82> So which version of Firefox will have this feature?

<comment><USER18> The post says that it's being rolled out gradually on Release channel, so as long as you haven't blocked automatic updates in various ways, you'll get it soon (assuming that the rollout continues without any significant issues being uncovered that halt it).

Presumably if you want to run ahead of that, there's ways to get it early via Beta or Nightly channels, but I don't know what those are.

</comment></comment><comment><USER83> Qutebrowser with a Firefox backend would be nice.

<comment> The-Compiler Still waiting for Servo or [https://mozilla.github.io/geckoview/](https://mozilla.github.io/geckoview/) to be usable as a library on desktop platforms. Unfortunately, that hasn't happened so far...

</comment></comment><comment><USER84> meanwhile I typed a draft of an email with links in it and 2 seconds after saving it got an email from Mozilla saying "stop sending yourself links via email!". I'm not OK with that.

</comment><comment><USER85> It all seems pretty pointless when every tracker tracks you by IP address and the only real way to defeat this is to use Tor, which BTW is blocked on an ever-growing list of sites.

<comment><USER86> IP is a much coarser level of tracking, for most people.

GCNAT, roaming (WiFi <-> mobile), shared networks (NAT/IPv6 Privacy Addresses). All of these things mean you can't be sure you're tracking the _same_ person, unlike with cookies.

</comment></comment><comment><USER87> i switched to firefox after using chrome for close to a decade and it's been a breath of fresh air -- very excited and congrats on the launch!

</comment><comment><USER88> Why should I trust Firefox with this "enhanced tracking protection 2.0", when Mozilla gets their funding from Google just to be the default search engine?

</comment><comment><USER89> I never understood this feature. Why not use an addon instead? Ublock origin for example is much better compared to the firefox tracking protection.

<comment><USER90> Because the default should be to block tracking. We just shouldn't allow it. Imagine someone telling you a popup blocker (something even IE8 had standard) should be acquire separately.

<comment><USER91> I agree with parent though, Firefox should just ship with uBlock Origin installed. I think putting privacy features in the hands of a third-party prevents some poor choices being made due to several conflicts of interest browser vendors have.

<comment><USER92> Luckily, Mozilla is a non-profit organization. Their interests do not conflict with protecting their users.

But it makes you wonder, if other browser vendors' interests do conflict with ad blocking, why would they ship with uBlock Origin? They would want to control what most people do by controlling the defaults. The vast majority of users never change the default settings.

<comment><USER93> Mozilla is a non-profit that _owns_ a for-profit corporation which makes Firefox. And their funding largely comes from Google paying them to keep Google as the default search.

There's not a mission-level conflict-of-interest, but there's a practical one. Until they can somehow be funded directly by users, Firefox will have this tension of "don't piss off Google or other referral partners, even if that means going against the users' interests". They won't serve the users well by losing all their funding and then dying.

This situation is why Firefox and Mozilla aren't just everything they could be in terms of completely aligned with users.

</comment></comment></comment></comment></comment><comment><USER94> I'm waiting for it to get so good that it becomes effective at removing the ads Mozilla added to the new tab page.

<comment><USER95> Firefox > Preferences > Home > New Windows and Tabs (very first option!) > Homepage and New Windows, New Tabs > Blank Page

I like that Firefox Home is the default option because you as the user are offered something. If you don't like it, you say no, go to the settings page, and are never offered it again. If you do like it or don't mind it, you keep it. Win-win.

If Firefox Home wasn't on by default, those that might have preferred it wouldn't know what they're missing. It seems difficult to think someone would actually prefer ads but if there's some engagement, then that speaks for itself.

<comment><USER96> The default option should be "show options", letting you choose with _one click_ between Blank, Mozilla Ads, Your Recent/Favorite Pages, and a custom URL or set of URLs.

There are 6 levels to your process above. Imagine being tech-illiterate and asked to navigate that - or, maybe easier, imagine trying to dictate that process to someone you know who is tech-illiterate over the phone. Even if you know exactly what to do, it might go something like this:

> _" You saw an ad you don't like on a new tab of The Internet? OK, what you > need to do to fix that is set the New Tab preference to Blank. Click the > Firefox menu - no, it doesn't have the familiar File/Edit/Help menu bar, it > uses a hamburger menu - the stack of three horizontal lines - in the top > right. Something about a library? No, that's supposed to be a bookshelf > icon, it has vertical lines, you want the horizontal lines to its right. The > menu went away? Make sure to single-click the menu, not double-click. Look > in that menu for something named Settings ... not Customize, no, that's kind > of like settings but different, oh yeah, it was called Preferences. In > Preferences, look for the Home section ... shouldn't have to scroll, it's in > the menu to the left ... yeah, that's a menu, it's just separated by > whitespace instead of a line. On the Home preferences screen, there's a > drop-down box for New Tabs, click that dropdown and set it to Blank. Great, > you're all set. Talk to you later. Bye!"_ Ring - _" Hey again - it didn't > work? You closed and reopened Firefox and the ads were still there? Oh, > right, that gives you a new window, not a new tab. Let's go back through the > menus one more time, it was just above the New Tabs dropdown, yeah, we were > just there. Click the three horizontal lines for the Firefox menu...."_

It's disingenuous to say that those who prefer the ads might not know what they're missing, even more disingenuous to say "you're offered something". No, with ad tech, the user is the product being offered to the advertisers, and I expect that more people don't know how to turn it off or that turning it off is a thing you can do than that like being advertised to.

<comment><USER97> >There are 6 levels to your process above

Hit options -> Click dropdown of "new tab" field and select "Blank page". 2 steps.

If the parent post is being disingenuous with their point, yours is as equally disingenuous by being an incredibly over-complicated deconstruction of hitting options and reading 2 fields down.

If they have to be walked through finding the options menu (half your paragraph is about opening the options menu, really?), they are going to have difficulties with every browser and every option -- including understanding what a "custom URL or set of URLs" is.

>"Oh a URL? That's the address thing you see at the top. Oh but it's not shown completely in some browsers. And, if you want multiple URLs you have to use the pipe operator symbol. Oh, the pipe operator? Look above your enter key. No, not the one on the number pad, the other one near the backspace." Etc..

<comment><USER95> My mistake, I was on a Mac and I intuitively look for app settings in the main menu bar, which is what I was describing. I should have looked up the process on other platforms to determine if it was just as intuitive</comment></comment></comment></comment></comment>


Tower Defense Framework - <AUTHOR> http://pytower.simpsus.de/

<comment><USER2> Thanks a lot for that link and the idea. It looks very easy to implement a tower defense game with this framework. That's a good idea for teaching, I think. The real problem with noob coders is that most easy problems are not very interesting to solve while learning, but the interesting ones are too complex for beginners.

</comment><comment><USER3> Would someone with experience in Python please look at the code of this framework and say whether it is good to learn from?

<comment><USER4> Had a quick look at a few source files in:

[http://bazaar.launchpad.net/~pytower- heros/pytower/main/file...](http://bazaar.launchpad.net/~pytower- heros/pytower/main/files/head%3A/pyTower/)

The code looks readable, very well commented and it appears that game objects are split into appropriate classes and modules.

Go for it.

</comment></comment><comment><USER5> _"With the success of this game genre on the flash platform, the next step is to bring this awesomeness to your home desktop."_

Shouldn't that be the other way around?

<comment><USER6> Actually, this started on the desktop. More specifically, inside Warcraft 3?

<comment><USER7> According to Wikipedia:

<http://en.wikipedia.org/wiki/Tower_defense>

 _Tower defense finds its roots in the strategy classic Rampart, an arcade game from 1990. The game involved defending a castle by placing cannons, and making repairs between several rounds of attacks.[6][7] By the new millennium, tower defense games began to appear in user-created maps for StarCraft, Age of Empires II, and WarCraft III._

<comment><USER8> Technically StarCraft had only turret, cannon (, lurker, marine, etc) and sunken colony defense maps...

</comment></comment></comment></comment><comment><USER9> What usage does this have other than for learning purposes?

I don't think "Tower Defense" games are that complex that you can't roll your own using something like pygame, and it seems like whatever you could do with a "framework" like that you could just as easily do by modifying an existing open source TD game.

</comment><comment><USER10> (Comment so I can easily find this again.)

<comment><AUTHOR> if you vote on a post you should be able to find it here <http://news.ycombinator.com/saved?id=oditogre></comment></comment>