Firefox's Trusted Recursive Resolver DNS feature is dangerous - <AUTHOR> https://blog.ungleich.ch/en-us/cms/blog/2018/08/04/mozillas-new-dns-resolution-is-dangerous/ <comment><USER2> DNS over HTTPS is a great idea. There's nothing wrong with the protocol or Mozilla's implementation of it. This article is all about Mozilla's default choice for a DNS provider. I think Cloudflare is actually a reasonable choice though I'm not a big fan of their annoying captchas that I get served whenever I use vpns.

There's nothing sneaky going on here; which the article seems to imply.

Currently there is no UI to configure any of this yet (other than about:config) but you can trivially select any DNS provider that implements this in the same place where you turn this on. The relevant setting is network.trr.uri. Also, you need to opt in to this to turn it on so you'd be reviewing this setting as well. Also you can configure how this is used, how and when it falls back to normal DNS, etc.

You can run your own server if you want; or use the one from your provider if/when they implement this. For obvious reasons, there are not a lot of usable servers yet but it seems Google has implemented this as well. So I assume they plan to roll this out for Chrome at some point.

The premise of this article seems to be that you should trust your provider to do DNS and do it well. I'm sorry to say but for the vast majority of providers I have experience with the opposite is the case. I've had providers redirect dns failures to advertising pages in the past, shitty performance (600 ms or worse), and generally trying to rip me off with bad network infrastructure related outages while charging me a premium for bandwidth clearly not delivered via obviously very congested infrastructure. I have no reason whatsoever to trust them, at all. The less they can learn from my traffic the better.

<comment><USER3> The article doesn't suggest there's something sneaky going on. The article is suggesting that Mozilla are choosing to share your DNS queries with a third party service by default, which is exactly what they're doing. It's not about them choosing Cloudflare in particular, it's about them choosing any particular service by default. And the article's argument that, if you have to choose somebody to share this data with, it might as well be the people you already share it with, seems pretty valid to me.

edit: I have to point out that the article has backed away from the claim that this will be enabled by default in September. Looking at the Mozilla blog, they mention wanting to enable this by default but have no actual plan to do so (and more crucially doesn't discuss at all what sort of form it would have to be in for them to enable it by default, it may look nothing like the cloudflare-default we're discussing here).

<comment><USER4> The default applies currently if you enable an experimental feature. They hammered out a tight privacy agreement for one service and use that as default while this is stabilized. You can pick any other resolver if you prefer. Seems a legit way of handling this.

> And the article's argument that, if you have to choose somebody to share > this data with, it might as well be the people you already share it with, > seems pretty valid to me.

The whole point of HTTPS and DNS-over-HTTPS is to not share any data at all with your provider. It's not entirely working right now due to SNI being plaintext, but work is being done on that, too. So that's really not a good argument.

<comment><USER5> Cloudflare is an US company, their privacy statement is worth zero to most Firefox users.

<comment><USER6> I believe Mozillas goal is to use the collective bargaining power of it's user-base to get favorable terms and conditions from vendors like cloudflare.

This could include 3rd party reviews, etc.. Who knows?

<comment><USER7> That wouldn't stop legal threats. Per Core Secrets leak, NSA/FBI both pay for and force backdoors in U.S. companies' products. They also share that information with other enforcement organizations per other leaks. Cloudfare are in a position to monitor lots of network activity. I'd be quie surprised if they weren't already backdoored.

If NSA/FBI aren't in one's threat profile, one might also be concerned about a court order over something having to do with copyright or patents. Damages for those can be huge. There's both legal and technical firms dedicated to pouring through data for evidence of patent infringements. Many licensing "agreements" start with evidence they find. I don't know much more about this. My wild guess is that _they_ often start with tips from disgruntled workers or maybe those leaving for competitors.

These are main, three threats I'd be concerned about if sharing what I did with a U.S.-based provider. Double true for me given I'm in the jurisdiction of the enforcement agencies.

<comment><USER8> Cloudflare publishes transparency reports [https://www.cloudflare.com/transparency/](https://www.cloudflare.com/transparency/)

It also promises not to store your IP associated with the DNS requests [https://developers.cloudflare.com/184.108.40.206/commitment-to- priv...](https://developers.cloudflare.com/22.214.171.124/commitment-to- privacy/privacy-policy/firefox/) so the law enforcement would have to ask Cloudflare to install a wiretap device.

If you're this worried about being traced, it's probably best not to disclose your IP address at all [https://blog.cloudflare.com/welcome-hidden- resolver/](https://blog.cloudflare.com/welcome-hidden-resolver/)

<comment><USER6> And they would have to hide such a wiretap device from auditors.

Moreover, cloudflare would be in a legal minefield since Mozilla would likely have standing to sue, if cloudflare violates its own terms of service.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> > _My local ISP seems more trustworthy to me than a big US-based corporate > which acts under the guise of a selfless privacy rights defender._

I have never trusted any local ISP. They're commonly expressly allowed by law to share roughly whatever they like about you†, _and they are known to do so_.

Cloudflare has at least promised not to be evil, and is to be audited annually concerning it. If they desire to be evil I have no doubt they could wangle it, but I still trust them _way_ more than I trust any ISP, because they're already _known_ to be evil under these definitions.

\----

† (This is a gross simplification, but it's broadly true enough in most countries.)

<comment><USER10> Cloudfare can promise what they want, they can still be subject to warrantless spying by US agencies and not disclose anything about it.

<comment><USER11> And lets not forget that their CEO will arbitrarily censor and stop serving people he doesn't like. He's done it before. He'll do it again. Cloudflare has already lost my trust.

<comment><USER12> In his blog post on that, he said pretty clearly that he doesn't want and should not have this power. [https://blog.cloudflare.com/why-we-terminated- daily-stormer/](https://blog.cloudflare.com/why-we-terminated-daily-stormer/)

(Disclosure: I work for Cloudflare.)

<comment><USER11> But he does and does. And now in the Perfect 10 lawsuit against your company it's biting you in the ass. Now you have to censor everything. Good going.

</comment></comment></comment></comment></comment><comment><USER13> The article is incorrect.

1\. TRR is not turned on by default. To turn it on, you need to go to about:config and set network.trr.mode to something other than 0 or 5.

2\. Even if trr.mode is turned on, you need to go in and set the DOH server at network.trr.uri. The default is blank. You can set it to any publicly known DOH server ([https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly- av...](https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-available- servers)), or even your own.

3\. The article doesn't talk about how your ISP can use DNS to censor your result - very common, for example, in a country like India where the court orders certain sites taken down. Mozilla's DOH solves this.

<comment> orbital-decay The first sentence of the article is about TRR/DOH being turned on by default in the next patch.

<comment><USER13> Can you point to a Mozilla announcement that says they'll turn on DOH by default in a regular non-experimental non-nightly release?

This is what Mozilla says in their DOH blog:

Our second effort focuses on building a default configuration for DoH servers that puts privacy first.

We are running a shield study where some Nightly users will participate in one or more experiments to help us build out a secure, cloud-based service that handles DoH requests. All Nightly users will receive an in-product notification about these studies.

Cloudflare is our partner for these experiments. When a shield study is active, Nightly Firefox will automatically use Cloudflare's secure DNS over HTTPS service (though we aren't using the famous 184.108.40.206 address). The first study will test whether DoH's performance is up to the task.

<comment><USER14> > Can you point to a Mozilla announcement that says they'll turn on DOH by > default in a regular non-experimental non-nightly release?

Right on their blog ([https://hacks.mozilla.org/2018/05/a-cartoon-intro-to- dns-ove...](https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over- https/)), quoted by the article:

"We'd like to turn this on as the default for all of our users. We believe that every one of our users deserves this privacy and security, no matter if they understand DNS leaks or not."

<comment><USER15> That is not an intent-to-ship email on the dev-platform mailing list.

</comment></comment></comment></comment></comment><comment><USER16> The article lacks instructions about disabling it or using some other DOH resolvers.

about:config -> search for network.trr -> set network.trr.mode = 5 to completely disable it (I do not recommend this)

The curl wiki has a list of DOH servers: [https://github.com/curl/curl/wiki/DNS-over- HTTPS](https://github.com/curl/curl/wiki/DNS-over-HTTPS)

It should also point to "the other side of the story", the benefits of DOH over classic DNS resolving, for example [https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns- ove...](https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/)

<comment><USER17> Thanks for the hint! We added that to our blog entry - please let us know if it sounds right to you.

<comment><USER18> The default is already off[1] though...

Mozilla has stated plans to _eventually_ turn it on by default[2] but I have yet to see any timeline or details of what the default config will actually be. Your article seems to assert that it will be on by default in FF62, where did Mozilla ever say this? Everything I have read seems to indicate that FF62 is just adding support, which is off by default, and requires a change to about:config to enable in the first place.

[1] [https://gist.github.com/bagder/5e29101079e9ac78920ba2fc718ac...](https://gist.github.com/bagder/5e29101079e9ac78920ba2fc718aceec)

[2] [https://blog.nightly.mozilla.org/2018/06/01/improving-dns- pr...](https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in- firefox/)

</comment></comment></comment><comment><USER19> I'm not looking forward to this.

I use internal DNS for stuff I'm running at home (e.g., a NAS, Home Assistant, etc). I don't want to go back to the bad old days of having to remember what IP addresses go with what service.

My girlfriend is not going to like it when Pi-Hole magically stops working because Firefox doesn't respect the DNS settings that are served by DHCP.

My employer uses internal DNS for internal services. The helpdesk is going to have a fun time as Firefoxes across the organization get updated. It also doesn't help that a large number of users are BYOD users, so enforcing certain Firefox settings is a no-go.

Sure, there's instructions to fix it, but it should never be broken like this in the first place.

EDIT:

The article has been updated - it now shows a screenshot from Mozilla's blog[0] which says:

> We'll use the default resolver, as we do now, but we'll also send the > request to Cloudflare's DoH resolver. Then we'll compare the two to make > sure that everything is working as we expect.

Cloudflare is going to have a huge list of internal stuff used by Firefox Nightly users, and Mozilla is going to have huge insights into how many people use things like Pi-Hole, internal DNS servers, split DNS servers (e.g., BIND Views), etc. And they're going to be analyzing this data in order to determine how well DNS-over-HTTPS works.

I'm not sure if this is better or worse than I initially thought it was.

[0] [https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns- ove...](https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/)

<comment><USER20> > Cloudflare is going to have a huge list of internal stuff used by Firefox > Nightly users

By Firefox Nightly users who agree to be in the study, yes?

</comment></comment><comment><USER21> First, I have to say that I love cloudflare, but the last thing we need is the centralization of all our DNS resolution to them. Please Mozilla, don't give anyone too much power.

And if DNS over HTTPS is the way to go (which might be), _give the user a choice_. There are 3 public resolvers already offering DNS over HTTPS:

      Google[1] (was the first one to support it)
      CloudFlare[2]
      CleanBrowsing[3] (for security and/or adult filtering)

And hopefully Quad9 will join the list soon. I hope this doesn't become a "search engine" war that the company that pays more becomes the chosen DNS. Please Mozilla, don't do that.

* 1: [https://developers.google.com/speed/public-dns/docs/dns-over...](https://developers.google.com/speed/public-dns/docs/dns-over-https)

* 2: [https://developers.cloudflare.com/126.96.36.199/dns-over-https/](https://developers.cloudflare.com/126.96.36.199/dns-over-https/)

* 3: [https://cleanbrowsing.org/dnsoverhttps](https://cleanbrowsing.org/dnsoverhttps)

</comment><comment><USER22> What about if you have private DNS servers that has sites that cloudflare does not have? For example internal intranets etc?

So mozilla will not work at all in that case?

<comment><USER23> I think as far as browsers are concerned, there are no private DNS names anymore for a good while already - either everyone on the internet knows your DNS or it doesn't exist.

See the similar problem with TLS certificates...

(edit) Ok, that was indeed put more dramatically than necessary. My point is that private DNS names seem to be heavily discouraged by browsers _default_ configurations.

You can change both the DNS resolver as well as install custom CAs - however, this has to be done again for each client. If you want to have your sites visited by clients that you don't administrate, you're out of luck.

(warning - rant follows) The direction browser vendors would like the ecosystem to move also seems quite clear to me - there is a strong push to get everyone on HTTPS, at the same time CAs are themselves increasingly regulated by browser vendors and cannot hand out certificates for IPs and private DNS names anymore. Now the next step seems to be DNS. If that is not a platformisation of the web, I don't know what is.

<comment><USER17> Can only heavily disagree with this one. The reason why BIND has views is because bigger organisation (like universities) employ different views depending on whether you are internal or external.

<comment><USER23> But this is the exact point. With DoH active by default (and no custom configuration set), every instance of Firefox will appear to be querying your DNS from outside, no matter if the machine is inside the LAN or not.

</comment></comment></comment></comment><comment><USER24> More information: [https://blog.nightly.mozilla.org/2018/06/01/improving-dns- pr...](https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in- firefox/)

According to this page:

\- you can already test this right now

\- you can provide your own server

And some more: [https://en.wikipedia.org/wiki/DNS_over_HTTPS](https://en.wikipedia.org/wiki/DNS_over_HTTPS)

<comment><USER25> > \- you can provide your own server

Nobody will do this except for maybe 5 individuals and a few dozen cooperations simply because there are no other public DoH servers around.

<comment><USER26> Many already run their own resolvers, so providing DNS-over-HTTPS proxy is not a problem.

What is THE problem, is configuring the browser. No one is going to reconfigure their browser after each connection to a different network. There's a reason why we moved from static configuration towards DHCP, which can configure network-specific settings. DNS is a network-specific setting, and Mozilla is breaking it.

<comment><USER27> Split horizon was always a bad hack, there has always been alternatives. DoH could be used on the default DNS servers too, there is value of encrypted DNS on LAN as well.

<comment><USER26> > Split horizon was always a bad hack, there has always been alternatives.

I always see this repeated as a mantra, but never it's rationale. No company is going to advertise their internal infrastructure needlessly. There's no upside in the world knowing that your _kdc._tcp.company.com is 192.168.10.20; but there are downsides.

> DoH could be used on the default DNS servers too, there is value of > encrypted DNS on LAN as well.

Sure, but hardcoding or statically-configuring the value is not the way. LANs need to have their DHCP tags respected. If one of them is "use this URL for DoH-server", that's fine.

</comment></comment></comment></comment></comment><comment><USER28> > And your ISP knows where you connect to anyways. So the data or information > generated by their DNS server provides no additional information to them.

This is not correct. Your ISP only knows what IP you are connecting to and that is not enough in general. E.g. Cloudflare.

<comment><USER29> With SNI they also know the domain you're connecting to.

<comment><USER30> There are people working on encrypted SNI: [https://huitema.wordpress.com/2017/09/12/cracking-the-sni- en...](https://huitema.wordpress.com/2017/09/12/cracking-the-sni-encryption- nut/) it'll take some time, but we'll get there hopefull soon.

<comment><USER29> Good point, but it's not here now. It is however better than the old days where you needed your own IP address to do TLS/HTTPS.

</comment></comment></comment></comment><comment><USER31> I rather use a DNS cloud that promises to wipe logs every 24 hours than a DNS server of an ISP who is guaranteed to spy on me.

<comment><USER32> There are many public DNS providers those promise to not logs DNS queries. I don't know precisely but if Mozilla forces user to use Cloudflare DNS is the deal breaker.

<comment><USER4> They don't. It's the default if you choose to enable the feature, but there are other compatible DNS providers, pick any that suits you (or just don't enable the feature and keep doing what you're doing now)

</comment></comment></comment><comment><USER33> Well, you have to trust _some_ third party. Personally, I think Cloudflare's DNS is pretty trustworthy based on what we know. It's WAY better than sending unencrypted DNS requests to arbitrary network-dependent third parties, in my opinion.

If you gravely fear Cloudflare for some reason, Google also provides a DNS over HTTPS server, along with a couple others. You can probably set Firefox to use that.

But if we we're OK treating this as insensitive data not needing encryption before, worrying about trusting third parties is not even the beginning of the problem.

</comment><comment><USER34> There are many countries where ISPs are obliged by law to spy on users, and retain logs for many years. DNS manipulation also used as a cheap censorship mechanism. So Cloudflare easily can be a better option for hundreds of millions if not billions of people. As a rule, local actors present way more serious threat compared to US agencies for majority of the planet's population. That said, Mozilla, of course, must be very transparent with such big changes, and explain them to users not using just "more secure" wording.

<comment><USER5> So data is safest in the country with the largest spying budget and the most spies. Not convinced.

<comment><USER34> You are refuting the statement I never made. There's no such thing as general threat. So who's data? If you are Julian Assange you should be afraid of US spying agencies, but if you are an Uzbekistani dissident it's your gov't repressive machine you should care about, and tracking possibilities of your direct adversary will be diminished with the discussed Mozilla's move. If you are an average Joe in a small town you may find it safer to trust faraway commercial entity rather then your neighbor's nephew who works in a local ISP.

</comment></comment></comment><comment><USER35> I use Cloudflare's resolver, but I actually agree with this. I don't want every device in my local network ignoring my Pi hole or my custom DNS entries, I don't want the device of everyone in my country being subject to surveillance requests from the NSA (and Cloudflare is legally (if you call warrantless wiretaps legal) required to comply), and I don't like the centralization this brings.

If I recall correctly, this also breaks geographical-based DNS resolution?

<comment><USER36> > I don't want the device of everyone in my country being subject to > surveillance requests from the NSA (and Cloudflare is legally (if you call > warrantless wiretaps legal) required to comply), and I don't like the > centralization this brings.

Agreed that this introduces additional centralization. Maybe Mozilla could work to with other third parties in different jurisdictions to see if there's interest to spin up additional DOH servers. That said, if your threat model includes the NSA then this would probably be far from sufficient.

<comment><USER35> As always, it's not "the NSA is targeting me specifically", it's "they're doing dragnet surveillance for potentially 'interesting' data and who knows how they'll choose to harass me".

There is literally no single country in the world I would like my data sent to than the US. Even China is preferable.

</comment></comment></comment><comment><USER23> For reference, the privacy agreement between Cloudflare and Mozilla: [https://developers.cloudflare.com/220.127.116.11/commitment-to- priv...](https://developers.cloudflare.com/220.127.116.11/commitment-to- privacy/privacy-policy/firefox/)

<comment><USER37> Great, all your data is stored for 24 hours and then collected in "anonymised" form for further processing and "internal research"! Also no mention of penalties, either for Cloudflare as a company or the responsible employees (starting with the CEO) in case of a violation. And no notice period of any time should Cloudflare decide to change those terms and have thousands of browsers still pointed at its resolvers.

Why would this make Cloudflare appear remotely trustworthy?

<comment><USER38> It's a legally binding contract between Cloudflare and Mozilla. If Cloudflare were to violate it, Mozilla could sue and a judge would determine the penalties for Cloudflare. There should be some rough guidelines written into law as well.

And we're definitely not talking about small amounts. Cloudflare violating it would result in Mozilla violating the privacy of millions, which can be interpreted as significant damages to the citizens. They're also both situated in California, so privacy will be valued by a judge. Given Mozilla's public image as a privacy-friendly organization, they could also push charges for damaging that image.

That penalty + the damage to Cloudflare's own reputation, I cannot imagine they would survive.

<comment><USER23> Note also:

> _Cloudflare will also collect and store the following information as part of > its permanent logs. [...]

\- Aggregate list of all domain names requested_

So while they might not associate it with a person, they _will_ collect all domain names they get and store them for their own purposes.

<comment><USER39> restricted to: "solely to improve the performance of Cloudflare Resolver for Firefox and to assist us in debugging efforts if an issue arises"

</comment></comment></comment></comment></comment><comment><USER40> Nothing against Cloudflare, but I don't think it is good in general for the Internet that they are getting so critical.

For them this sounds like a good deal (is money involved here?). Having more control of DNS should mean they can provide better service for their customers.

<comment><USER25> > For them this sounds like a good deal (is money involved here?).

There is a lot of money involved. When you resolve DNS only over Cloudflare, all Cloudflare sites will have a much lower DNS resolution time than any domain that is not hosted by CF's DNS service. CF can also do geo DNS more efficiently, potentially saving millions in edge nodes.

</comment></comment><comment><USER23> So yet another step to centralize security with browsers and override any descisions of local admins. Great...

</comment><comment><USER41> Where exactly Firefox/Mozilla people say that they plan to enable it by default?

</comment><comment><USER42> Sigh. Mozilla had just made Firefox usable again... And now good reasons for leaving it again are coming up.

<comment><USER43> So what is the alternative? Chrome, edge, and Vivaldi?

<comment><USER44> I've been using Brave. It's beta quality software but works surprisingly well.

<comment><USER42> Brave on Android is the way to go. Literally the best browser.

</comment></comment></comment></comment><comment><USER5> Most important point from the article

"Let's stop here for the moment and repeat: With Mozilla's change, any (US) government agency can basically trace you down." \- with ease I might add.

</comment><comment><USER45> I was thinking about this issue. Once this feature is on by default, all Firefox DNS query goes through the Cloudflare, a for-profit company which resides on US whose government is infamous for spying everything.

My conclusion is, what's the difference?

Currently, Cloudflare is one of the major CDN in the world and most traffics goes through them.

Even worse, by it's nature, Cloudflare and most of the CDNs are practically doing MITM attack so they can cache the data. For that, HTTPS isn't that secure the most browser vendor want us believe to be. The rise of CDN cause serious single point of failure but most of us don't worry about it like DNS.

To solve this problem, we need to invent completely decentralized new network that doesn't relies on the current Internet even at the physical layer. Probably fallback to the level such that we carry storage by foot or pickup dead drops.

</comment><comment><USER46> I don't like the way Cloudflare is centralizing everything, but I would use Cloudflare any day over my ISP. Seriously, fuck my ISP.

I would support this feature on the condition that users are able to choose which DNS service to use by default, especially as more public DNS services begin to adopt DoH. Developers like us will also need the ability to use /etc/hosts or route queries to a local instance of dnsmasq.

Obviously there's a switch somewhere in about:config, because Firefox is also involved with the Tor project which requires the ability to route DNS queries through Tor. This switch should be accessible to the user, just like the choice of default search provider.

</comment><comment><USER17> The Internet is not made for centralisation!

<comment><USER47> The internet has decentralized architecture underneath but the model is being abandoned because traffic volumes are too high for the naive decentralized architecture.

Today 60% of the global internet traffic goes trough CDN's. In 2021 it will be over 70% in 2021 (over 90% in North America). There is whole "internet cache" industry standing between clients and servers.

When you connect to some site in the internet, most of the data comes from some of these: Google CDN,,MaxCDN, Akamai, MS/Azure CDN, Limelight, EdgeCast, Amazon CDN, Coudfare,Rackspace, Incapsula, ...

The issue here is not decentralization vs centralization, it's about browser selecting something for a user as a default.

<comment><USER48> You cannot compare CDN with DNS which does not require high traffic volumes nor expensive servers.

The issue is pervasive laying of trust into "benevolent" third parties, CA's apparently are not enough and we now must have Trusted Recursive Resolvers, too. And it's more and more difficult to set up alternative infrastructure which does not rely on them.

<comment><USER47> >You cannot compare CDN with DNS

I didn't compare them.

</comment></comment></comment></comment><comment><USER49> This proposal introduces a lot of complexity. It requires JSON parsing, HTTP and TLS. A bug in one of these components could is likely to occur.

In contrast, DNS is very simple and can be implemented with a lot less code.

<comment><USER50> The JSON/HTTP protocol may be more complex than DNS, but Firefox is likely to already have a very good implementation. TLS is new, but important.

</comment></comment><comment><USER51> I think it's a nice feature to have but it has to be opt-in, you can't set the precedent that it's fine for a web browser to hijack your web traffic, even if it's for a good reason.

</comment><comment><USER52> To be honest I think it's great news. I would much rather trust Cloudflare to handle my (encrypted) DNS than my ISP. I'm based in the U.K and there are very few ISPs that have private DNS - you often hear stories of (U.K) ISPs selling data out the backdoor to comply with things like the Investigatory Powers Act[1].

[1] [https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016](https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016)

But besides Mozilla's efforts, I am careful not to browse anything political using a vanilla ISP. Anything sensitive is browsed with Tor for anonymity. I only use a VPN for routing traffic over hostile networks like public wifi hotspots / Starbucks wifi. A VPN is not inherently private but a VPN does have its uses, like for viewing geo-locked content (Like the 'This video is unavailable in your country' scenario).

Also for further research if you want to know more about 'trusted' Internet: [https://www.youtube.com/watch?v=a4UXnZaunJQ](https://www.youtube.com/watch?v=a4UXnZaunJQ)

</comment><comment><USER5> The US has the largest spying budget and the most spies.

And FF thinks it makes it more secure for me if the transfer all my browsing meta data to the US.

I don't think so.

</comment><comment><USER53> That s just a feature. You can choose not to use it. Why so much noise?

<comment><USER54> As I understand it that's even the default choice, and CloudFlare is just the provider they're currently testing this with for those who do choose and do not configure their own provider.

<comment><USER17> The point is though that users won't change their defaults. When Mozilla sets the default to Cloudflare, > 99.9% of the users will use it.

<comment><USER54> So the default is that this is off. If and when that changes, the question that should be relevant is whether the majority of those users is better served with CloudFlare than their ISP, given their threat model.

</comment></comment></comment></comment><comment><USER55> I know my ISP is required by govt to log all meta data (websites, IPs, email headers). If I'm not using a VPN, it's all logged. Encrypted SNI is coming, but without encrypted DNS it's all still logged. So it seems like a net win, even if cloudflare is logging everything.

Too bad dnscurve hasn't taken off more.

<comment><USER56> But you don't need to depend on cloudflare here. If you have a VPN you can also tunnel your DNS lookups to a custom resolver through the VPN.

</comment></comment><comment><USER57> Sorry if this is off topic but where does DNS over https leave my pi hole?

Is it possible (in the future) to do dns over https from my router to the pihole and then dns over https from the pihole to Google or Cisco open DNS?

How would it work? Wouldn't the router need to trust the https certificate that my pihole presents? Thank you!

<comment><USER17> That would work. DoH is "just" a replacement for UDP in this context. However when Mozilla changes the default to DoH of Cloudflare, you will need to manually change all firefox installations.

<comment><USER58> Other posters on this thread point out that Firefox has no plans to make it a default.

</comment></comment></comment><comment><USER59> This feature will break dns-based geo-lookup, so as a user I might get directed to services that are 130ms away from me instead of 1-5ms. For any client application, this will likely have strong negative effects on user experience.

<comment><USER3> I somewhat doubt cloudflare have overlooked that

<comment><USER59> It seems like you are right. On the company's pages I find "... Instead of doing this, Cloudflare will make the request from one of their own IP addresses near the user. This provides geolocation without tying it to a particular user. ".

Still, my concern is that this is no longer a function of the technology, but by a service that is maintained by one company, limited to the coverage that they provide in different parts of the world.

</comment></comment></comment><comment><USER60> I think he forgot to write the part about how it is dangerous or not 'more secure in general' after explaining why it is for the average user who is likely to connect to any open wifi network without setting static DNS.

</comment><comment><USER61> I don't understand why so many people are critical of people being wary about how a company deals with our data, especially one in Mozilla's position. Did all of you sleep through the past twenty years?

</comment><comment><USER62> The only point in this is that mozzilla will apply it as a default, which then is retracted at the end.

As of now this only serve to start a flamewars over all the drama people have with mozzilla

</comment><comment><USER63> As a man in a country where constant censoring is performed by the government this movement at least make it harder for the gov censor/monitor people.

<comment><USER17> Which country is that?

</comment></comment><comment><USER64> Just because what you're doing is private doesn't mean it's secure. Just because what you're doing is secure doesn't mean it's private.

No whistleblower should ever just expect that doing things the normal way is private or safe for them. If you wear a tinfoil hat, you need an entirely different operational language than typical users have, because your needs are totally different.

<comment><USER65> Privacy improves security for everybody. If an attacker can read all your DNS lookups then it's easier for them to target a spear-phishing attack against you.

<comment><USER64> Privacy _may_ improve security, but usually not. It is a sometimes unintended consequence.

If I want to tell you a secret, I will bring you into a private room. Now we have privacy. If someone wants to listen in on our conversation, they will plant a bug in that room, or listen through the wall. To remain secure, I must add security countermeasures to prevent the bugs from transmitting, or extra noise to make being overheard difficult.

Your ISP's DNS might be more private, but if an attacker can poison your ISP's DNS cache (it has happened to me on my ISP) you won't be more secure. It's more secure to use a hardened DNS service, which is usually not local. But yes, this could be a minor privacy concern with a big enough attacker.

Just because you add privacy does not mean you added security. Just like because you add security does not mean you have privacy.

So please be honest about the motives for things like this. If you want more privacy, say so. Don't say it's a security problem when it's not.

</comment></comment></comment><comment><USER66> Does anyone know about this website? I am skeptical of a .ch domain criticizing something that would make censorship harder.

</comment><comment><USER58> I suppose a small upside to this is it will prompt some people to look into how trustworthy their ISP's DNS is.

</comment><comment><USER56> If you don't trust local ISPs the solution is not to put your eggs into the cloudflare basket which could then be plundered by the NSA fox.

Instead tunnel all traffic to some rented box in a jurisdiction _of your choice_ and then run your own DNS resolver either in your home network or on that box.

</comment><comment><USER67> It really comes down to if it's going to be a silent default or a verbose opt- in.

Anyone got a link to this announcement?

</comment><comment><USER68> > The Domain Name System (DNS) is a service used in converting a computer's > host name or a Top-Level Domain (TLD) into an IP address

Hostnames and TLDs are different concepts in DNS. It is a mistake to conflate them.

TLDs are the top level (rightmost) part of domain names, such as specifically "com" in "example.com".

</comment><comment><USER5> Updated:

"We wrote in a previous version that "the next Mozilla patch in September" will enable DoH by default. We corrected that part as it is not clearly stated on Mozilla's blog, as can be seen in the screenshot below."

</comment><comment><USER69> While developing, I hack my /etc/hosts to point at a local dev environment. Is this to say that Firefox would ignore that as well?

</comment><comment><USER70> I imagine this has a lot of potential to break things on corporate intranets. Or does TRR have some kind of mechanism to check for that?

</comment><comment><USER71> Seems like my decision to migrate off Firefox was the right one.

</comment><comment><USER72> I think it's a great option for people who can't trust their isp. I've been using it in nightly for a month or so and it works nicely.

Making it default would be controversial though. Right now it's opt in.

</comment><comment><USER17> If you agree and think it's dangerous, help us to spread the word on twitter [https://twitter.com/ungleich/status/1026041643340845057](https://twitter.com/ungleich/status/1026041643340845057) \- maybe it helps to make Mozilla rethink this "feature".

<comment><USER73> Think what is dangerous? Encrypted DNS? Choosing a DNS provider you don't like for an experimental feature because the support that feature? Trying to make the web safer and less creepy?

I think you have a fundamental misunderstanding of what is this experiment is configured the way it is and you're just being a Chicken Little.

</comment></comment><comment><USER74> Why would Google's own Mozilla do this... unless Google is planning to buy Cloudflare.

</comment><comment><USER75> dont touch my dns settings, srsly!</comment>


What has Covid-19 taught you? - <AUTHOR> Hello everyone!
It has taught me to be grateful about food that I get to eat, no matter how less it seems or how bland it tastes; that we do not require veggies to stay alive, we can very well survive on cereals and pulses and that even 1-2 meals are enough; that I should cut unnecessary costs on subscriptions and plan more on emergency funds.
So what has Covid-19 taught you? <comment><USER2> This whole thing taught me to re-evaluate what's important. What's the point of life, filling the pockets of tycoons, or spending time with family.

I will no longer believe in the mission of a company. Any job is actually a glorified McDonalds position. You come in spend your 8 hours and go home to your family.

<comment><AUTHOR> Very well put. That's one thing I'm still figuring out!

</comment></comment><comment><USER3> I'm exercising more, eating less, reducing my overhead / expenses. Also, I still hate working, even if it's from home. This is a good trial run for early retirement...

</comment><comment><USER4> We all could save so much more time by working from home. I've cut my 2 hour commute from to 0 hrs.

<comment><AUTHOR> We all could but that's not gonna last for ever! However, we could urge companies to at least have WFH on Fridays! It's gonna help us employees (saving our commute time, gas/parking fees, etc for a day) but more often than not, they don't care about that, so we need to tell them how it's gonna profit them. Maybe save on electricity for a day? Food costs?</comment></comment>


Apple and Broadcom ordered to pay $1.1B to Caltech over patents - <AUTHOR> https://news.sky.com/story/apple-and-its-wifi-chip-company-broadcom-ordered-to-pay-11bn-to-university-over-iphone-patents-11921401 <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=22189092](https://news.ycombinator.com/item?id=22189092).</comment>


The Lobster Programming Language - <AUTHOR> http://strlen.com/lobster/ <comment><USER2> Hi, author of the language here.

Not a great time for HN exposure, as I just added a lot of new functionality, but none of that is documented yet :) But hey, all publicity is good publicity?

For those interested, some recent things that have been happening:

\- Compile time reference counting. This does an analysis similar to the Rust borrow checker to infer lifetimes, but unlike Rust doesn't make the programmer jump through hoops.

\- "Inline" structs: structs are allocated in their parent, and come at zero overhead compared to individual variables, which is particularly useful for Lobster's heavy use of 2d & 3d vector types.

\- Multi-threading that uses separate memory spaces, meaning individual threads can run at max speed with no GIL overhead etc.

\- A WebAssembly backend is being worked on.

\- A lot of optimization work to make the language run faster.

For reference, it has been on HN before, as early as 2013 ([https://news.ycombinator.com/item?id=5904430](https://news.ycombinator.com/item?id=5904430)), but it has changed a TON since then (e.g. it was a dynamically typed language, now it is statically typed, with flow sensitive type inference).

<comment><USER3> Would you mind elaborating on the "compile time reference counting"? Is this new? How does it handle cycles?

<comment><USER2> It is so new I haven't even documented it yet.. hence why I said the timing for this HN post isn't great.

So imagine the current implementation does a lifetime analysis somewhat similar to Rust, but then where Rust would error out, this implementation simply inserts a runtime refc increase. This gets rid of most runtime refc overhead without the programmer needing to be clever about it.

Then, I intend to add an optional type annotation that gets you the Rust behavior, for those cases where you want maximum control. I don't think its the right default though.

The algorithm is more lenient than Rust, since I don't have any shared memory concurrency for example.

I intend to write up more thorough details about the algorithm, but again, haven't gotten to it.

It does not handle cycles. If you create cycles that you do not manually break, you'll get a cycle report at program exit that prints the kind of values that weren't reclaimed. You're then expected to fix your code accordingly :)

<comment><USER4> This at first glance actually looks similar to [http://liu.diva- portal.org/smash/get/diva2:20899/FULLTEXT01....](http://liu.diva- portal.org/smash/get/diva2:20899/FULLTEXT01.pdf)

And this style of static analysis has been taken even further by Luc Blaeser: [http://concurrency.ch/Content/publications/Blaeser_Component...](http://concurrency.ch/Content/publications/Blaeser_Component_Operating_System_PLOS_2007.pdf)

The cycle checker I'll have to have a look at - I'd like to crib parts of it for an OS I'm trying to cobble together. Your project looks very interesting, thanks!

<comment><USER2> Thanks for those, I hadn't seen them. The Ritzau paper indeed appears to be doing something very similar, where in 5.2 he describes "inner references" whose lifetime is bounded by the outer one, I call that "borrowing", where the outer definition (the owner) gets locked from mutation during the borrow.

What I do is a bit more involved though, as for every language construct I indicate if it wants to own or borrow its children (and wether it wants the parent to own or borrow), to remove maximum refcounts, also for cases which are not simply variables. Again, I will describe this in detail.

The second paper I don't see how it relates to what I am doing.

</comment></comment></comment></comment></comment><comment><USER5> Major reason why many game engines used to have native core and then some kind of "scripting" language for game logic (think Unreal Engine before 3, but many engines are similar) is that then you can trivially serialize the simulation state (ie. save game) and even run the whole thing as either lock-step, forward predicted or fully distributed network game without much effort on the part of whoever is writing the "scripting language" part of the game code.

<comment><USER2> Agreed, those are nice benefits. But there are also huge downsides, in the sense that you're writing all the glue code in the wrong language :) The amount of speed of iteration you get from having your entire engine + game's structure in a friendlier language is impressive (in my experience).

Also doing savegames by just serializing the entire scripting VM may work in some cases, but can also be problematic, since you're mixing ephemeral data with gameplay state. Last U3 engine game I worked on had explicit savegame serialization :)

<comment><USER5> My point is that having scripting VM that is explicitly designed for game logic allows you to serialize only the relevant state. And if the whole system is designed correctly you can also do checkpointing and streaming replication essentially of the game state for free. This buys you things like rendering thread that is decoupled from the simulation (just draw the snapshot of state that was current on the start of rendering iteration), non-synchronized joins of multiplayer players (send serialized checkpoint and do stream the changes until the client catches up) and so on.

<comment><USER2> I agree, for that level of integration you want a "gameplay scripting system", whereas Lobster is more of a general purpose programming language that happens to be a nice starting point for simple games & engines. I don't think in its current form it is a great language for a large AAA team anyway, because of its heavy reliance on type inference and lack of separate compilation.

The language could of course be adopted to these use cases, it simply hasn't, so far.

Doing simulation on a separate thread from main/rendering is something it is already set up to do (multi-threading uses separate memory spaces so it is easy to ensure there's no data races between the two).

</comment></comment></comment></comment><comment><USER6> I use Haxe which is a

Haxe is an open source toolkit based on a modern, high level, strictly typed programming language, a cross-compiler, a complete cross-platform standard library and ways to access each platform's native capabilities.

what would be the benefit for using Lobster since I can work directly with each OS with a great scripting language built in?

[https://haxe.org](https://haxe.org)

<comment><USER2> Haxe can translate to an impressive set of languages and platforms, so if that is your main need, I'd say, stay with Haxe.

Haxe and Lobster are very different programming languages however, so you may prefer one over the other purely for the language design.

If you like portability, Lobster already runs on 3 desktop OSes, 2 mobile ones, and the web, using either VM, C++ or soon WebAssembly modes. While not as extensive as Haxe it is pretty good :)

</comment></comment><comment><USER7> Did you create a VM that is several times faster than Python's, for a static typed language thats as productive as a dynamic language, with true multithreading? How did you outdo entire language communities?

<comment><USER8> I'm a huge proponent of typed languages, but there's no way that a statically typed language could be as productive as Python (with current type systems technology). For example, just the Pandas library offers incredible flexibility (often dynamically based on the arguments that different functions get) that I've yet to see replicated in a static language.

<comment><USER9> My experience is that you start out very productive not being weighed down by having to satisfy the type checker... but programs tend to grow over time and you end up regretting it. When you have a medium to large codebase in a dynamically typed language it gets to be more of a hindrance than a help.

<comment><USER8> I agree, but my point was rather that you _can 't_ typecheck Pandas (or a similarly complex library). Gradual typing for the win!

</comment></comment></comment></comment><comment><USER10> I don't really see the point in using Python syntax and then throwing in a handful of random differences that don't have anything to do with the domain you're working in. Syntax level support for vector operations or for shader interopability I would get. Making for loops follow some randomly different syntax, I don't see the point of that.

<comment><USER2> It is not intended to be Python compatible, it merely has indentation based syntax that is similar.

The cases where it differs from Python are actually for good reason: unlike Python that only has built-in control structures, here any function can look like if/for/while if it takes a lambda body.

<comment><USER11> This seems like a cool way to make an ad hoc dsl. I'm not a game programmer but I imagine it could be useful.

<comment><USER12> _This seems like a cool way to make an ad hoc dsl. I 'm not a game programmer but I imagine it could be useful_

Smalltalker here. Being able to pass in lambdas very casually is a _great_ way of producing an ad hoc DSL. Imagine a custom control structure which does a database transaction. Just implement a function!

<comment><USER2> Yup, this style of programming I use all the time in Lobster.

</comment></comment></comment></comment></comment><comment><USER13> This reminds me of processing. [https://processing.org/](https://processing.org/)

<comment><USER14> Exactly.

</comment></comment><comment><USER15> This looks really fun: [https://github.com/aardappel/lobster/blob/master/lobster/sam...](https://github.com/aardappel/lobster/blob/master/lobster/samples/lazy_py_triples.lobster)

Are the generators implemented entirely in user space using continuation passing style? And the coroutine function turns it into something pausable?

Edit: I can't wrap my head around how return returns out of all the generators

<comment><USER2> So the non-coroutine case of that code are all regular functions, without using CPS or anything. The only special feature Lobster has is that when you write "return" it will return out of the lexically enclosing named function, not the function whose body it sits in (which can be an anonymous function). This mean return is implemented by unwinding stack frames until it gets to the named function, almost like a lightweight version of exception handling. It also can't resume these functions, like you typically can in languages that support CPS.

Now the co-routine functionality takes an existing higher order function, and compiles it such that the call to the function argument instead does a yield. These are really regular co-routines that are implemented by copying stack frames off and onto the stack upon yield and resume. I just thought being able to share code between HOFs and co-routines was cute, since they often express the same patterns. Why would you write an iteration twice?

</comment></comment><comment><USER16> I am an old Amiga user Vic-20, A1000, A500, etc., so I am a fan of the author.

I tried running the sierpinski example with a pre-compiled Windows .exe that I placed in the lobster root directory, and it gives me this error: "can't open file: stdtype.lobster".

I placed lobster and lobster/modules in my path, and it still throws the same error. I am assuming I need to build the .exe myself due to some incompatibility with the master branch and this older .exe?

I like a self-contained game PL. I use Raylib for that type of experience right now, but I like the concepts here. Thanks!

EDIT: copied modules to root of lobster, and now I get:

"stdtype.lobster(8): error: end of file expected, found: <"

I tried an included test file and a copy/paste of the sierpinski example, and both throw this error.

<comment><USER2> Sorry, I need to do better at "getting started" documentation. The exe needs to be placed in the "lobster" dir under the root. It searches for "includes" relative to itself.

Not sure about the error involving "<".. are the executable and the data from the same version of Lobster? Open an issue on github or email me for more help :)

<comment><USER16> I'll build it as the site suggests, since I am using a binary from the release with the master branch modules. I'll follow up on github. Thanks!

</comment></comment></comment><comment><USER17> Is the first example's last line:

      var i = find [ 1, 2, 3 ]: _ > r

the same as?:

      var i = find ([ 1, 2, 3 ]) a: a > r

i.e. argument parantheses are optional for one argument; and _ is an implicit argument for a block.

Would multiple functions arguments be done just with parentheses, like this?:

      var i = find [ 1, 2, 3 ] (: _ > r), (: _ < r)

Seems like the syntactic generality of lisp or haskell, with the predictability of performance of C. EDIT I see it's as fast as non-JIT Lua... are there any features that prevent it from theoretically approaching the speed of C?

PS: small detail, but that's got to be the best for-loop I've ever seen.

<comment><USER2> Yes, those are equivalent.

Multiple function arguments require a keyword in the caller, much like "else" introduces the second function argument in an if-then-else. So if "find" would take two functions, one for even and one for odd list elements, it would look like: "var i = find_even_odd [ 1, 2, 3 ]: _ > r odd: _ > r"

There are no features that prevent it from "approaching" C's speed, merely a question of implementation work. The language started out as very high level, so code generation needs to be improved to not do as many things at runtime as it currently does. The language semantics are totally able to be within 1.5x of C.

<comment><USER17> Fantastic, thanks.

The many uses of : syntax are intriguing - lambdas, functions, control, python-style structure, data, globals. I reckon you've established it works in all cases, but I'm not yet familiar enough to see that for myself.

For initial adoption, I wonder if more regular sample code, without the special-case abbreviations, might be more effective? (Followed by the short version.) OTOH, maybe at this early stage it's best to select for developers interested/capable enough to handle it!

EDIT if : is used for both blocks and code structure, could everything be one- line (or is \n significant?) Not great style, but helps in understanding the syntax. Maybe returns and vars need their own lines?

      def find(xs, fun): for(xs) x, i: if fun(x): return i return -1

      var r = 2 var i = find [ 1, 2, 3 ]: _ > r

<comment><USER2> Yes, ":" appears a bit overloaded, though many of those cases are actually one and the same.

What would be more regular sample code? Do you mean just writing "find([ 1, 2, 3 ]) x: x > r" with explicit () and explicit variables? I agree that is easier to read, though the extreme terseness is also a feature..

Yes, everything can be one line, but in this case it would look a bit ugly:

def find(xs, fun): (for(xs) x, i: if fun(x): return i); return -1

<comment><USER17> > Do you mean just writing "find([ 1, 2, 3 ]) x: x > r" with explicit () and > explicit variables? I agree that is easier to read, though the extreme > terseness is also a feature..

Yes, amd yes it depends on the purpose. For learning, it can be impossible to parse; redundancy helps distinguish parts and provides a check you got it right.

OTOH for showcasing features, IMHO, the generality of : is a more impressive feature to demo.

Anyway, it's certainly intriguing! And maybe that's the true purpose of showcase code...

</comment></comment></comment></comment></comment><comment><USER18> Very personal opinion and matter of taste: Many lambda syntaxes are a bit weird.

        map(my_array)element:element*2 //lobster
        my_array.map{|element|element*2} //ruby
        Arrays.stream(my_array).map(element -> element*2).collect(something list something)  //java?

Lobster feels a bit unbalanced. Ruby has "pipes" which are a bit confusing substitute parentheses. Java has the cool arrow syntax but otherwise it feels very glued on. (edited and fixed, thanks for the comment)

<comment><USER2> Your Lobster version has a stray comma, it is: map(my_array) element: element * 2

Note how if you write this example with multiple statements instead of "elements * 2", suddenly the Lobster syntax looks a lot more consistent, and the Ruby example doesn't look that great as it looks completely different from the built-in for loop.

<comment><USER19> No-one uses the built-in for loop in Ruby though. Instead, everyone uses the each method which looks the same as map.

That said, the Ruby syntax can be a bit bulky. Your syntax feels pretty clean TBH.

</comment></comment></comment><comment><USER20> Really stupid question here, but how do I start compiling Lobster programs on my machine (Windows or Linux)?

<comment><USER2> There are some releases which come with pre-built exes for e.g Windows: [https://github.com/aardappel/lobster/releases](https://github.com/aardappel/lobster/releases)

I'd highly recommend you build it yourself though, which can be done rather easily with VS (2019) on Windows or CMake on Linux. On Windows just press build in release mode and you're done. More notes here: [https://htmlpreview.github.io/?https://raw.githubusercontent...](https://htmlpreview.github.io/?https://raw.githubusercontent.com/aardappel/lobster/master/lobster/docs/implementation.html)

Then cd lobster && lobster samples/pythtree.lobster for example should run something. Or see here how to use from command line or from your fav editor: [http://htmlpreview.github.io/?https://github.com/aardappel/l...](http://htmlpreview.github.io/?https://github.com/aardappel/lobster/blob/master/lobster/docs/README_FIRST.html)

<comment><USER20> Cheers!

</comment></comment></comment><comment><USER21> This reminds me of the language used in Godot Engine, maybe talk to them and use this in the engine?

<comment><USER2> Hah, that would be a pretty good fit, yes.

</comment></comment><comment><USER22> I enjoyed playing Cube based games, editing maps live and whatnot. Will check this out too!

<comment><USER2> Thanks, let me know what you think :)

</comment></comment><comment><USER23> I really like the inclusion of basic graphics routines. Not a lot of languages include these out of the box and it's something I've really missed since I first started toying with programming in QBasic.

<comment><USER9> It's kind of surprising to me that the language is directly tied into OpenGL given that it's a cutting-edge experimental new language and that seems more the domain of Vulkan.

<comment><USER2> It's not tied to, it is implemented in it. I could swap out the rendering code for Vulkan, an no Lobster users would need to change anything.

Also, have you actually programmed in Vulkan? Even a simple primitive can be hundreds of lines of setup code. In Lobster they're often a single line. A direct mapping would not make sense.

</comment></comment></comment><comment><USER24> 000000128039 000000128034 000000128039 000000128034 000000128034 000000128034 000000128039 000000128008 000000128039 000000128008 000000128013 000000128039 000000128013 000000128034 000000128039 000000128034

</comment><comment><USER25> Oh this looks rather nice. I'll have to take a look at this.

</comment><comment><USER26> Why choosing 'value' as a keyword for types? Super odd

<comment><USER2> I've actually since changed that to be more conventional. Now the "inline" by- value objects are called "structs" and the regular by reference objects are called "classes" much like C#

</comment></comment><comment><USER27> > Discuss things in the google+ community

google+?

</comment><comment><USER28> Yeah, cool Google+ community.

</comment><comment><USER29> Portable python for games...? Does it compile and run natively?

<comment><USER2> It's not Python.. it just has a similar syntax.

You currently run it either as a bytecode VM (which is rather fast and runs on any platform), or you can translate it to C++ if you want an additional speed boost.</comment></comment>


How I manage and monitor docker with seagull - <AUTHOR> http://slides.com/tobychan/how-i-manage

<comment><AUTHOR> We're using Web UI to manage and monitor docker. It's the better way for developers and I'm glad to share the presentation with you :)</comment>


Ask HN: How do I get a job in software? - <AUTHOR>

I have a PhD in Electrical Engineering and I spent 2 more years as a postdoc working on optical imaging and microscopy. I was fairly successful but I was never really engaged which I attributed to being in academy. So I switched to industry and realize that the jobs in this field are not what I want to do. Now looking back to find out what I like doing, I realize that the times I was having fun was when I was writing code, doing computation and solving problems related to that.
Most of my coding is in Matlab which is not used in software industry. I have been doing some side projects on Python and I got fairly good at it. I can also find my way around in Javascript, SQL, noSQL (redis). I used Java as an undergrad.
How can I accelerate the process of getting a job as a software guy aside from doing side projects and showcasing it? I would like to get a job ASAP as I can learn much faster if I do it full time.
PS. I am in SF Bay Area FWIW <comment><USER2> Matlab could be really good to get into research or 'data science' roles, I don't think it's a particularly common skill, but can be very good for more mathematical research oriented coding. Given your background you might want to focus much more on the mathematical side of development, perhaps look at machine learning roles as I'm sure you'll find machine learning easier to pick up than many people.

<comment><AUTHOR> I agree that ML or data science would be feasible. I am working on data science/machine learning as well, I have taken classes from coursera and trying to work on it on the side. As I mentioned above, my progress is slow as most of my time is spent on my day job. It is hard to tell if I am on the right track without working in the field. Thank you for your suggestions.

</comment></comment><comment><USER3> You can probably find something if you are flexible on salary. It's unlikely a solid shop will hire you for anything above junior level. I have a MS in Engineering and can relate. As a suggestion, don't jump into SE just yet. Use your still-fresh STEM skills to make a lateral jump within Academia. In the 10 years since school, I have lost many of my skills in Math and Statistics. I traded them in for applied engineering skills. In retrospect, my Math and Stats background, when combined with programming (different from Software Engineering) would have been much more interesting work. The field of big-data and analytics is growing and your PhD equips you well for it. Consider looking for a short-term opportunity (1-2years), where you can keep your math sharp. It should be something where you are proximal to good developers and expected to be learning SE practices while working as a subject matter expert (SME) to developers. In a position like this, depending on location, you might even enjoy a higher standard of living, than you would as a junior engineer. Do that for a few years, and when you're ready, you can jump from there.

<comment><AUTHOR> Thank you for your input. A situation "where I am proximal to good developers and expected to be learning SE practices while working as a subject matter expert (SME) to developers" would be the perfect solution for me. It is just difficult to find.

I am flexible on salary besides junior devs are already making same or more than me as a hardware guy.

<comment><USER4> I would also recommend to be careful where you take a job: do you want to use your quick mind to build APIs or SQL queries, or do you want to be doing something more innovative like machine learning, or building codecs, crytography or working with data streams. There are some great companies out there (like Matasano for example), who will train you on the job in some pretty awesome areas.</comment></comment></comment>


A $50k Mac Pro Just Was Defeated by 6k Google Chrome Tabs - <AUTHOR> https://www.inc.com/jason-aten/a-50000-mac-pro-just-was-defeated-by-6000-google-chrome-tabs.html <comment><USER2> Another time-wasting ad-heavy article, with a misleading clickbait title. I'll save you a click.

Any powerful computer will succumb to a set number of Chrome tabs with a finite amount of memory + swap space. This is more or less of a stress-test to the reader and 1 TB of RAM is more than enough for 99% of PC/Mac users and perhaps you might need to control yourself if you have such number of tabs open anyway.

Move along now, Nothing interesting to see here.</comment>


Ask HN: Individual print/mail as a service offerings? - <AUTHOR>

I am looking for a company that would make it easy for me to get letters printed, and mailed for me, rather than my having to buy envelopes, stamps, and write addresses, etc..  I'm looking for individual mails (to extended family) not bulk mailing or anything like that.  Being able to easily support/print quality color photos in the letter (like I can do at home) is a must.<p>Any suggestions? <comment><USER2> [https://www.quora.com/Application-Programming-Interfaces- API...](https://www.quora.com/Application-Programming-Interfaces-API/What-are- the-best-Postal-snail-mail-send-and-receive-APIs)

[http://www.postalmethods.com/postal-api](http://www.postalmethods.com/postal- api)

<comment><AUTHOR> Thanks! FWIW PostalMethod's seems more business focused, and to use a PDF I have to setup the addresses on the PDF itself, since they use a clear windowed envelope. Great for an invoice, less great for a letter to my grandmother:( I will keep looking though.</comment></comment>


Ask HN: Will I be exposed to more risk from this share transfer? - <AUTHOR> My company is about to be shut down. One of the shareholders is asking to transfer all his shares to me(his investors of his company is asking him to do so). Are there any negative repercussions on my end that can arise from this (ie. owning more shares of a soon to be defunct company)?<p>Additional Info: The company does owe a little bit of debt to several private investors.
I own about 40% of the company. <comment><USER2> _" Are there any negative repercussions on my end that can arise from this?"_

If they're doing it for fraudulent purposes (e.g., trying to cheat their creditors, or the IRS), you could be committing a crime. You really should be asking a lawyer, not HN.

</comment><comment><USER3> I see no situation in which this would work out for the better. I'd be wary.</comment>


Ask HN: What is the best blog/article you read on internet? - <AUTHOR> <comment><USER2> I love Wait But Why's post on AI:

[https://waitbutwhy.com/2015/01/artificial-intelligence- revol...](https://waitbutwhy.com/2015/01/artificial-intelligence- revolution-1.html)

<comment><USER3> This one is great ! But you could as well post half of Wait But Why posts - it's really one of the most interesting blogs on the web.

I love this one more though (much shorter, but makes you think, and once you start thinking about it seriously...): [https://waitbutwhy.com/2016/10/100-blocks- day.html](https://waitbutwhy.com/2016/10/100-blocks-day.html)

</comment></comment><comment><USER4> There is not speed limit:

[https://sivers.org/kimo](https://sivers.org/kimo)

<comment><USER5> This is an amazing article that I had read a few years back. Incidentally, I had tried many combinations of keywords to find it again but no avail. Thanks to you, my search is finally over.

</comment></comment><comment><USER6> [https://www.gwern.net](https://www.gwern.net)

Gwern is an independent researcher who studies... a lot of things. He's documented some of the history of the dark web, blogs about his nootropics experience and, perhaps most notably, predicted that bitcoin might reach $10,000... in 2011.

[https://thelastpsychiatrist.com](https://thelastpsychiatrist.com)

The blogs that aspire to follow in TLP's footsteps are legion.

</comment><comment><USER7> [https://www.ribbonfarm.com/2009/10/07/the-gervais- principle-...](https://www.ribbonfarm.com/2009/10/07/the-gervais-principle-or- the-office-according-to-the-office/)

Reading this in middle management at a bank was illuminating.

<comment><USER8> I read through those while working at a Fortune 500 company. It sounded so close to truth, like the author was observing the same interactions I saw. Turns out he was at the same company at one point.

The fact that those stand the test of time and resonate with so many people working in large organizations really helps with perspective.

</comment></comment><comment><USER9> Slate Star Codex is a foundational blog for me. "I Can Tolerate Anything Except the Outgroup" is a good place to start: [https://slatestarcodex.com/2014/09/30/i-can-tolerate- anythin...](https://slatestarcodex.com/2014/09/30/i-can-tolerate-anything- except-the-outgroup/)

Then the rest of the best-of: [https://slatestarcodex.com/about/](https://slatestarcodex.com/about/)

Lately I've been obsessed with Samzdat on Seeing Like a State: [https://samzdat.com/2017/05/22/man-as-a-rationalist- animal/](https://samzdat.com/2017/05/22/man-as-a-rationalist-animal/)

</comment><comment><USER10> Interfluidity, for instance this [https://www.interfluidity.com/v2/3487.html](https://www.interfluidity.com/v2/3487.html)

</comment><comment><USER11> [https://dailystoic.com/seneca/](https://dailystoic.com/seneca/)

</comment><comment><USER12> The Truth About Cars. Product Management, strategy, and product-market-fit are not isolated to software, and we're frankly not very good at them compared to 100 year old companies.

Watching Tesla show the faults in the SV way of doing things has been really fascinating, for example.

</comment><comment><USER13> maybe subjective, but its pure gold.. [https://scottlocklin.wordpress.com/](https://scottlocklin.wordpress.com/)

</comment><comment><USER14> Simo Ahava is an absolute legend for anything google tag manager / google analytics related. No other site is even remotely close.

[https://www.simoahava.com/](https://www.simoahava.com/)</comment>


NSA Files Decoded: What the revelations mean for you - <AUTHOR> http://www.theguardian.com/world/interactive/2013/nov/01/snowden-nsa-files-surveillance-revelations-decoded <comment><USER2> Woah. This is a pretty cool reactive article. It's the first one that I've personally encountered which reacts like it's supposed to, engaging me as I read.

Congratulations to whoever put this together, it was very well done.

<comment><USER3> Yeah, very well designed and with proper HTML video.

<comment><USER4> This might be the coolest news article layout I've seen...It's awesome to see HTML5 video used in an unobtrusive, classy way like this.

I was also excited to see they're using Video.js, with a super subtle theme that matches the rest of the site (when controls are showing). Really well done.

<comment><USER3> Since most news and media sites are plagued by buggy Flash video players which barely if ever work for me on Linux, this in contrast was really refreshing.

</comment></comment></comment></comment><comment><USER5> This guy, Stewart Baker:

"You ask me proofs that it works, I can show you proofs that the lack of it really fails"

That is so flawed from a logic point of view that I won't even bother.

"We can't be transparent .. we have to get comfortable with the idea that we're delegating to somebody.."

There are two things here: 1) Most people agree that we can't talk about the details of implementation of a strategy agreed to by the US people to defend our country. The problem is that the mass surveillance that we've heard of in the last 5 months is not exactly a "detail of implementation" is it? It's a whole gods damn strategy that the US people didn't directly agree to. (Now yes, it's a democracy, we elected representatives who agreed to this. So what? Our constitution doesn't give full power to our representatives. If they didn't think for a second that a question of that magnitude might require some public debate, they are wrong, period).

2) He talks about trust. The problem is that trust is not something that you just ask for. If you are corrupt, lie, cheat, and all around screw up for long enough, people will stop trusting you.

<comment><USER6> > "You ask me proofs that it works, I can show you proofs that the lack of it > really fails"

> That is so flawed from a logic point of view that I won't even bother.

Well, I don't blame you; trying to disprove _p ⇒ q ∴ ¬q ⇒ ¬p_ would probably cost you some embarrassment.

<comment><USER5> Please, do replace "p" and "q" with whatever you had in mind then meditate on the meaning of "=>". If you still don't get it refer to doctoboggan's counter- example.

<comment><USER7> Maybe it's something along the lines of "an effective security mechanism implies safety; if there is no safety then it follows that no effective security mechanism is in place"

</comment></comment></comment></comment><comment><USER8> The description about Feinstein is wrong. She didn't backtrack about anything. She's only pretending to do it, while passing Newspeak bills with backdoors that codify and legalize NSA's mass spying.

[https://www.eff.org/deeplinks/2013/10/sen-feinsteins-nsa- bil...](https://www.eff.org/deeplinks/2013/10/sen-feinsteins-nsa-bill-will- codify-and-extend-mass-surveillance)

Feinstein has done nothing but help the NSA so far. She's not going to just stop because she suddenly developed a conscience. I wish Californians would just recall her, because otherwise we're stuck with her and her pro- surveillance state bias until 2018. Maybe it wouldn't be so bad, if she wasn't also the head of the Intelligence Committee, and having tremendous power in the Senate to continue things as they are.

<comment><USER9> This is the same lawmaker who wanted to ban "the shoulder thing that goes up". She should have been laughed out of office long ago, but for some reason enough people love this authoritarian idiot enough to keep her in office since 1992. It boggles the mind.

<comment><USER10> In a two party system, being in office a long time isn't necessarily a sign of being loved by your constituents, it can just be a sign of being disliked less than the alternatives that get offered when elections come around.

And there's few political organizations in the country better at producing candidates unacceptable to the the statewide constituency they are offered to than the Republican Party of California.

<comment><USER11> Feinstein (and Pelosi, also pro-NSA and representing _San Francisco_ of all places) could easily be removed from office via a primary challenge. Doesn't necessarily need to be a Republican opponent.

<comment><USER9> So, can CA do it? Doesn't Silicon Valley have enough clout to throw behind a candidate who will stand for privacy, rights, innovation, etc.?

<comment><USER11> Dear God I hope so, but it's going to take politically-connected heavy hitters to care about it and I don't see that happening.

For instance, it's baffling to me that Ron Conway doesn't care about this issue, given his entire portfolio is internet startups. I think Arrington was right to call him out on that.

</comment></comment></comment></comment></comment></comment><comment><USER12> With these NSA revelations, I feel like there is still an elephant in the room nobody has yet started talking about...

THIS DATA CAN BE USED TO UNDERMINE YOUR STARTUP.

It's not just privacy we should be concerned about. It's our economy.

Whether it is corporations willfully collaborating in secret with the government or government secretly infiltrating corporations - either way, this presents a serious opportunity for exploitation of the public marketplace.

Because with this amount of data, the NSA has a goldmine of business intelligence that it can put to 'strategic use' via third-party 'partners' who can actively participate in the market; ie- COMPETE WITH YOU.

This is unfair and a terrible flaw in an economic system.

<comment><USER13> This is exactly what Brazil is so upset about [http://rt.com/news/us-spied- brazil-oil-588/](http://rt.com/news/us-spied-brazil-oil-588/)

And really if you have the data, why not?

</comment></comment><comment><USER14> Totally aside from the content, this is a really good example of effective design of long-form exposition in the medium of a web browser. Designed for the affordances of the screen, without sacrificing in-depth textual content.

<comment><USER15> I found myself only watching the videos while I am usually more attracted to text than video. So I question the effectiveness of it. Maybe others noticed the same behaviour?

</comment></comment><comment><USER16> It's very nicely made. I love how instead of hijacking scroll, it "plays with" the scroll, turning the videos off and on.

<comment><USER17> Only the first video played for me on Linux/Firefox nightly, and Readability choked on it.

<comment><USER18> Videos not auto-playing but can be started OK. The fibre optic graphic not working. Other content apparently accessible.

gNewSense 3.0 / Iceweasel 3.5.16

Text can be captured using

        w3m http://www.theguardian.com/world/interactive/2013/nov/01/snowden-nsa-files-surveillance-revelations-decoded > nsa.txt

for those having problems with readability

</comment></comment></comment><comment><USER19> This reminds me of newspapers in Harry Potter.

</comment><comment><USER20> Why are so many people persuaded by arguments of the form, "It doesn't matter what the government knows if you have nothing to hide?"

I'm not questioning why the NSA uses this argument -- clearly, they use it because it works -- people are persuaded by it. What I'm asking is, why does it work?

<comment><USER21> Just World fallacy: the belief that things happen for a reason, that bad things happen to those who deserve it, and that the world is ultimately fair.

That is, they prefer to believe the government is a superhuman entity that has everyone's best interests at heart, rather than facing the reality that it's made up of fallible, selfish humans who are only interested in covering their own asses.

</comment></comment><comment><USER22> The only thing I am disappointed is no subtitles/transcripts for the videos. Unless I overlooked it?

<comment><USER23> I concur. Accessibility takes a backseat yet again.

</comment></comment><comment><USER24> Not sure if I have seen such an elaborated article about a subject ever. Remarkable.

<comment><USER25> I really don't want to distract people from the matter at hand: NSA's massive spying dragnet.

With that said, you haven't seen the Snow Fall article by the NYTimes? [1]

[1]: [http://www.nytimes.com/projects/2012/snow- fall/#/?part=tunne...](http://www.nytimes.com/projects/2012/snow- fall/#/?part=tunnel-creek)

</comment></comment><comment><USER26> Excellent! I'm excited about mixed media articles getting better and better!

One small tweak I would make is to have the video start playing not when it's in the middle but closer to the top of the page.

Reason is, I find myself distracted by listening to the guys speak before I finish reading the text.

<comment><USER27> The problem I have is that on my smallish (13"? Not too small) monitor, the top and bottom of the video are always very close to the top and bottom of the viewport. On a 24" monitor it would be better, but I found watching the videos to feel very claustrophobic.

<comment><USER6> > 13"? Not too small

It's 2013, and size matters. Thirteen inches, for an article like this one, is too small.

</comment></comment></comment><comment><USER28> Can someone explain why, if I change the slider to indicate that I have only one friend, the number of "friends of friends" is 163? Is my only friend really so popular?

<comment><USER29> Because they say that each person has 190 friends on average based on a Facebook data survey linked just below that vis.

</comment></comment><comment><USER30> Really liked the TOR visualization.

<comment><USER31> And the PGP one too, I think it is the clearest explanation I've seen of public key encription.

<comment><USER32> There's also this easy to understand youtube video: [http://www.youtube.com/watch?v=3QnD2c4Xovk](http://www.youtube.com/watch?v=3QnD2c4Xovk)</comment></comment></comment>


Apple's libc shells out to Perl to implement wordexp - <AUTHOR> https://github.com/Apple-FOSS-Mirror/Libc/blob/2ca2ae74647714acfc18674c3114b1a5d3325d7d/gen/wordexp.c#L192 <comment><USER2> This is source code from 2011. Checking [http://opensource.apple.com](http://opensource.apple.com) will show that it's not longer implemented this way in 10.10.

Here's the current implementation: [http://opensource.apple.com/source/Libc/Libc-1044.1.2/gen/Fr...](http://opensource.apple.com/source/Libc/Libc-1044.1.2/gen/FreeBSD/wordexp.c)

<comment><USER3> The current one is a derivative of NetBSD's implementation (where it shells out to use a sh builtin)

<comment><USER4> License-wise:

\- this piece of code is 2BSD-licensed

\- it calls out to /bin/sh

\- on OS X, /bin/sh is hardlinked to /bin/bash

\- OS X's bash is GPLv2

Forking to shell is the only way to reuse bash's code. More often than not I really wish _sh_ were not _bash_.

<comment><USER5> "Forking to shell is the only way to reuse bash's code."

well, the other obvius way is to license this piece of code as GPLv2.

<comment><USER6> AFAIK this is THE reason for GPL. So that you either release your code and contribute to open source or suffer from slower access methods.

<comment><USER7> The BSDs doesn't ship with bash and their wordexp shelling out to /bin/sh doesn't suffer, so I don't see how this is a reason for the GPL.

<comment><USER6> Probably I've written it not clearly enough: "Reason for GPL not allowing you to use code in your own programs, but allowing use through exec: you either release your code and contribute to open source or suffer from slower access methods."

<comment><USER7> ahh, ok; that's clearer

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> As it's already written in the manual...

[http://linux.die.net/man/3/wordexp](http://linux.die.net/man/3/wordexp)

wordexp, wordfree - perform word expansion like a posix-shell

So, the implementer decided to take the short route, and just spawn a shell which, essentially, gets passed the input data to wordexp(), to do the work. But, of course, having something that starts with such a comment...

/* XXX this is _not_ designed to be fast (...) wordexp is also rife with security "challenges", unless you pass it WRDE_NOCMD it _must_ support subshell expansion, and even if you don't beause it has to support so much of the standard shell (all the odd little variable expansion options for example) it is hard to do without a subshell). It is probably just plan a Bad Idea to call in anything setuid, or executing remotely. */

...in your standard C library wasn't such a smart idea to start with. Scroll down, there are many more gems in the comments!

Sometimes it's better to just implement it as

            void wordexp() {
                    fprintf(stderr,"wordexp() is a security nightmare. Not implemented.\n");
                    assert(0);
            }

or decide to deliberately only implement a safe subset of the full functionality specified (e.g. only ~user-homedir expansion and $VARIABLES), to at least cover the common use-cases without creating a security nightmare.

(EDIT: typos)

<comment><USER9> _Scroll down, there are many more gems in the comments!_

...and what a spelling errors:

"This kludge is needed because /bin/sh seems to set IFS to the defualt even if you have set it; We also can't just ignore it because it is hard/unplesent to code around or even a potential security problem because the test suiete explicitly checks to make sure setting IFS 'works'"

ESR writes about sloppy spelling: "Write in clear, grammatical, correctly- spelled language. We've found by experience that people who are careless and sloppy writers are usually also careless and sloppy at thinking and coding (often enough to bet on, anyway)."

<comment><USER10> ESR hasn't been a role model for anything related to programming since, like, 1998.

</comment></comment></comment><comment><USER11> Here is a vulnerability in the current version [1] for your amusement:

        #include <wordexp.h>
        #include <stdio.h>
        int main() {
            wordexp_t we;
            char *s = "$(($(sleep 10)))";
            printf("->%d\n", wordexp(s, &we, WRDE_NOCMD));
        }

(Since the manual page strongly recommends not trusting wordexp with untrusted input even with WRDE_NOCMD, and based on a code search the function is rarely used in the first place, I don't think it's really sensitive.)

[http://opensource.apple.com/source/Libc/Libc-1044.1.2/gen/Fr...](http://opensource.apple.com/source/Libc/Libc-1044.1.2/gen/FreeBSD/wordexp.c)

</comment><comment><USER12> Well, you are warned: /* XXX this is _not_ designed to be fast */

<comment><USER13> Performance is the least of my worries here. I'd be more worried about security, and plain dependency management.

I mean, let's say this libc thing is supposed to be installed in quite a lot of systems, are we really sure that perl thing is installed in _all_ of those systems? And what if, by some crazy coincidence, perl happens to depend on libc?

<comment> vertex-four > I mean, let's say this libc thing is supposed to be installed in quite a lot > of systems

Apple's libc is not an independent thing to them - it's a part of OSX and iOS. You're not supposed to be able to take it out and use it for other things.

<comment><USER13> Fair enough.

</comment></comment></comment></comment><comment><USER14> Sorry, I don't have a Mac to check, but does the OSX build of Perl depend on libc?

Also, that code seems to be from 2008 (or at least that's the latest year in the copyright header) despite the commit being from 2012. Does anyone know if this has been updated? Inserting a NUL byte between each word, and at the end doesn't sound like it requires Perl...

<comment><USER15> > otool -L /usr/bin/perl

/usr/bin/perl:

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 1151.14.0)

/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1213.0.0)

<comment><USER14> Thanks, much appreciated.

I thought there may be some strange cyclic dependency going on, but it seems not.

<comment><USER16> It would only be a problem if that specific perl command (perl -e 'print join(chr(0), @ARGV), chr(0)' \-- args....) or the shell invoking it depended on wordexp(). Recursion is fine as long as it terminates.

</comment></comment></comment></comment><comment><USER17> They appear to be using a "wordexp-helper" in Yosemite. I found this in /usr/lib/system/libsystem_c.dylib (and no references to perl).

        [ $# -gt 0 ] && export IFS="$1";/usr/lib/system/wordexp-helper

<comment><USER2> Source to wordexp-helper here: [http://opensource.apple.com/source/system_cmds/system_cmds-6...](http://opensource.apple.com/source/system_cmds/system_cmds-643.1.1/wordexp- helper.tproj/wordexp-helper.c)

Also the source to the Yosemite implementation is available at: [http://opensource.apple.com/source/Libc/Libc-1044.1.2/gen/Fr...](http://opensource.apple.com/source/Libc/Libc-1044.1.2/gen/FreeBSD/wordexp.c)

</comment></comment><comment><USER18> sometimes you have to get shit done

<comment><USER19> > sometimes you have to get shit done

And Apple have always been masters in selling polished, nicely packages shit as the most advanced technology ever conceived.

<comment><USER20> With respect, is there evidence to support your claim?

My direct experience is that I have received value far in excess of what I have had to pay for the Apple products and services I have purchased over the years.

For example, I'm typing this reply on my PowerBook, which I use all day, every day in my work. I also have my iPhone with me constantly, and use it heavily.

Finally, the Apple brand was said to be worth about $104.7B vs. $62.8B for Microsoft in 2014. [1]

So, I am not saying you are wrong, only that I think some evidence would be helpful in making your case.

[1] [http://bgr.com/2014/03/19/apple-vs-google-vs-microsoft- brand...](http://bgr.com/2014/03/19/apple-vs-google-vs-microsoft-brand-value/)

<comment><USER21> OT, but you're still using a Powerbook? That's pretty impressive. Which generation\year was it? I'm guessing you've had to swap out batteries and upgrade hard drive - have you had to modify anything else?

<comment><USER10> He meant MacBook Pro.

That said, I still have an iBook G4 from 2004 in perfect operation for mail/web/music (though one button is missing).</comment></comment></comment></comment></comment>


On Arguing - <AUTHOR> http://www.zompist.com/arguing.html

<comment><AUTHOR> "Someone (unfortunately I forget who) mentioned that the best thing an academic can have is a good enemy. Your friends will, perhaps, read through your papers and make a few comments. But only an enemy will read through an entire book, for free, finding every error and questionable statement."

That's a good point that gets no argument from me. Here on HN, we can all appreciate best those fellow participants who hold us to our facts and ask for proof of our statements. I learn a lot from HN participants like that.

Obligatory link to a Paul Graham essay on a closely related topic:

<http://paulgraham.com/trolls.html></comment>


Summaries of all 29 amicus briefs supporting Google in Oracle vs. Google appeal - <AUTHOR> https://www.project-disco.org/intellectual-property/011420-broad-support-for-google-in-the-first-round-of-supreme-court-briefing/ <comment><USER2> This is a useful guide to reading all the briefing for the Google v. Oracle lawsuit over the legality of copyright for APIs currently under review by the Supreme Court. If SCOTUS finds in favor of Oracle, the impact on the computer industry will be cataclysmic.</comment>


Ebola Is Now a Disease We Can Treat - <AUTHOR> https://www.wsj.com/articles/ebola-is-now-a-disease-we-can-treat-how-a-cure-emerged-from-a-war-zone-11572446873?mod=rsswn <comment><USER2> Clever strategy

 _Dr. Muyembe set out on his path to an Ebola treatment during the 1995 outbreak. He transferred blood from five survivors to eight patients, hoping that the antibodies that kept some people alive would keep others from dying. Seven of the patients who received the blood transfusion recovered._

<comment><USER3> I wonder what an Ethics Review Board would have to say about this...

<comment><USER4> Well lets see? It had a 90% death rate as a disease I would gladly give, receive or beg for it for myself or my child.

<comment><USER5> Note that the survivability of Ebola is much higher if you are in an hospital. Basically, if you have access to IV hydration.

</comment></comment></comment></comment><comment><USER6> Worth pointing out that there are two Ebola vaccines on the market. One is a recombinant vesticular stomavirus, VSV-EBOV, that was engineered to express an Ebola glycoprotein. It was found to be reliably efficient up to 5 days before infection in macaques. It requires only one dose to be effective, because the VSV will replicate in the host to some degree (asymptomatically) and produce a strong immune response.

There is also another 2-dose vaccine that is actually being distributed. I don't know much about it, but requiring a second dose likely means it's a protein fragment or attenuated Ebola virus, likely making it more heat stable and actually easier to distribute. Compliance is an issue, but it has proven effective in ring vaccination usage (vaccination of those around people who have contracted the disease).

There's also been some initiative to grow human Ebola antibodies in crops and distribute those as well.

As usual, the primary challenge to stopping Ebola spread is the political and social climate in the war torn DRC.

</comment><comment><USER7> What happened to the Chinese scientist who developed the Ebola cure ZMapp?

[https://www.cbc.ca/news/canada/manitoba/ebola-henipah- china-...](https://www.cbc.ca/news/canada/manitoba/ebola-henipah- china-1.5232674)

<comment><USER8> This seems to be the latest news on it:

> In August 2019, the Democratic Republic of the Congo's national health > authorities, the World Health Organization, and the National Institutes of > Health announced that they would stop using ZMapp, along with all other > Ebola treatments except REGN-EB3 and mAb114, in their ongoing clinical > trials, citing the higher mortality rates of patients not treated with REGN- > EB3 and mAb114

From [https://en.wikipedia.org/wiki/ZMapp#Use_during_the_2014%E2%8...](https://en.wikipedia.org/wiki/ZMapp#Use_during_the_2014%E2%80%9316_Ebola_outbreak_in_West_Africa)

So seems it's just used in some cases today.

</comment></comment><comment><USER9> [https://outline.com/zXFSvv](https://outline.com/zXFSvv)

<comment><USER10> Thanks! By the way, if somebody happens to know a Python (or whatever) library/example which can do a job similar to what Outline does extracting and tidying pure content from a web page - let me know please. I don't plan any mass-scraping, just want to save some stuff for myself for offline reading.

<comment><USER11> I've used this wrapper[0] for Firefox's reader mode[1], and it worked well:

[0] [https://www.npmjs.com/package/readability- wrapper](https://www.npmjs.com/package/readability-wrapper)

[1] [https://github.com/mozilla/readability](https://github.com/mozilla/readability)

</comment></comment></comment><comment><USER12> There was some news regarding the use of malariotherapy for Ebola, indicating some promise, from couple of years ago. Did not hear any more about it since then.

</comment><comment><USER13> paywall

</comment><comment><USER14> Paywall.

<comment><USER15> Just clear your site cookies and refresh.

<comment><USER16> which one lol. My browser says its using 243, just incredible.

<comment><USER15> On Firefox I just had to clear the *.wsj.com cookies and then refresh.

<comment><USER17> Also on firefox, right click "open in new private window" worked... but I don't think it always does. Maybe something to do with my ip address?

<comment><USER18> Recently some sites are using HTML5 client-side storage for their paywalls, not just cookies. Forget Me for Chrome seems to get them all, though. [https://chrome.google.com/webstore/detail/forget-me-clean- hi...](https://chrome.google.com/webstore/detail/forget-me-clean- history-c/gekpdemielcmiiiackmeoppdgaggjgda)

<comment><USER19> Also. [https://chrome.google.com/webstore/detail/clear- session/maej...](https://chrome.google.com/webstore/detail/clear- session/maejjihldgmkjlfmgpgoebepjchengka?hl=en)</comment></comment></comment></comment></comment></comment></comment>