Facebook Scraps Plan for New Share Class - <AUTHOR> https://www.bloomberg.com/news/articles/2017-09-22/facebook-scraps-plan-to-create-new-class-of-shares <comment><USER2> This bit made me laugh:

"Over the past year and a half, Facebook's business has performed well and the value of our stock has grown to the point that I can fully fund our philanthropy and retain voting control of Facebook for 20 years or more,"

I don't think we will be needing Facebook to stay in touch with our friends in 20 years time, by then it should be as anachronistic as the Yellow Pages are today.

<comment><USER3> This assumes that Facebook the corporation doesn't build/buy/otherwise control the thing that replaces Facebook the web application in 20 years.

<comment><USER4> We'll see about that.

</comment></comment></comment><comment><USER5> Excellent! A founder shouldn't be able to have his cake and eat it too. Once you're a public company, you're taking public money and should be responsible to public votes.

<comment><USER6> He's still going to maintain a voting majority, just the normal way.

<comment><USER7> Yeah but a huge amount of his wealth is bound to that responsibility.

<comment><USER8> As it should be.

</comment></comment></comment></comment><comment><USER9> Can someone explain the maths to me?

His original plan was to donate 99% of his wealth to philanthropy. The problem was that would involve selling the majority of his fb shares, and he would no longer have control of the company. To solve this he would split the stock into voting and non voting rights which would allow him to sell the non voting ones and maintain control.

Now the claim is that the stock has increased so much this is no longer necessary. If I understand this correctly, that would mean that the excess shares he has over 50%, comprise 99% of his wealth, which can't be true because that excess is strictly less than 50%.

Or perhaps he's just conceded that he will actually give away control, it will just take 20 years to do so.

<comment><USER10> If I had to guess, Zuck is still planning on selling 99% of his shares over his lifetime. As part of that, he wants CZI to be funded for the next 20 years. The part of his shares over 50% (which by definition, is less than 99% of his wealth) can do that, so he is going to fund CZI from that in the immediate term.

</comment></comment><comment><USER11> _Another part of the proposal, to change the corporate charter to let the billionaire serve in government without losing control of Facebook, was also dropped, the company said._

Interesting... Because I still think Zuckerburg has a political office in his crosshairs. I wonder if this means he is putting that on the back-burner for now or if he plans to introduce an alternate proposal.

<comment><USER12> > Because I still think Zuckerburg has a political office in his crosshairs.

Would you care to explain why you would think so?

<comment><USER13> Well he was trying to get a pass from the board to let him run for office while also running FB...

</comment></comment></comment><comment><USER14> > Zuckerberg would have had to defend the move that some shareholders said > diluted their power and was decided without their interests in mind.

Since FB is so "profitable" and such an attractive stock, why is Zuckerberg so scared of what the shareholders think? Are these the big shareholders or all the shareholders? The only thing I can think of is he can lose his Chairman of the Board position.

> The decision follows a rash of technology executives creating special shares > to control their companies, and may make similar structures more difficult > to put in place in the future.

I definitely don't want to see that happening myself. If I were ever in his position, I'd like to retain control while able to sell my assets to do whatever meaningful work I want to pursue without losing my control on the big decisions. I could quit being the CEO, but not the board chairman / president of the board.

<comment><USER15> These special share classes that let the founders get all the money but lose none of the control sound like a continuation of what companies are trying to do with consumers. It seems like almost everyone is trying to say that you can only rent things anymore and no one owns shit.

It used to be if I bought electronics I could put whatever software I could get on there without the co oany fighting me, when you'd buy a tractor you could repair it yourself without needing an authorized tech, and when you bought a percentage of a company you got a vote commensurate to the percentage.

I understand the desire behind eating your cake and having it too, but I don't know why society and the government have decided that's a fine way for us all to live

<comment><USER16> If Google was owned by Wall Street and Facebook was owned by Steve Bannon (Mercer) the world might be a different place.

Everyone knows what happened to the Wright Brothers.

<comment><USER15> What does it matter if they paid for it? I'm ranting more about the rent seeking that has permeated every aspect of our society than saying one oligarch is better than the other.</comment></comment></comment></comment>


Show HN: A new blog engine for developers - <AUTHOR> https://github.com/pothibo/ecrire/

<comment><USER2> I like the features such as the partials and the no-nonsense HTML editing, but what kills it for me is the dual pane setup. I see this in many programs like markdown editors, and I cannot imagine a worse use for all that screen real estate. The reason for this, besides the raw redundancy, is that it kills the focus on writing, and forces me to look at how pretty everything I just hammered out on my keyboard looks. It causes me to second guess everything as I'm writing, and slows me down considerably. I would consider nixing the pane, replacing it with a preview button, and using the space to add either new controls, a media browser, or possibly even nothing for a more zen-like experience.

<comment><AUTHOR> I believe this (dual pane) is a personal preference that would never accomodate everyone. When I write a post, I always wonder how it looks like after 1 paragraph, to make sure I stay on the right track. The live preview gives me confidence and doesn't break my flow.

Thanks for the feedback nonetheless ;)

<comment><USER3> it is a personal preference.

some songwriters do the music and the lyrics separately.

others do them simultaneously.

some writers treat the words and the formatting independently.

others want to do them at the same time.

however, the live preview is a necessity for people who are not yet comfortable with a light-markup system (like markdown).

and it's worth noting that the desire of writers to "have it look nice" was a big part of the driving force behind wysiwyg, and if we really want to elevate people from that dark pattern, we need to use a live preview to give them their satisfaction.

-bowerbird</comment></comment></comment>


Leaked NPD(German right wing party) donors-list meets Google maps - <AUTHOR> http://maps.google.com/maps/ms?ie=UTF8&hl=de&msa=0&msid=209605995929772957059.0004a4b90d8086e514339&ll=51.727028,11.513672&spn=13.792979,39.462891&z=5

<comment><USER2> Source: <http://hop2.nn-crew.cc/npd/>

Slightly edited Google Translate:

 _First, a few words in advance. I am a proud German, I love Germany above everything, and I do everything in my power to improve the image of Germany. If politics or the law will prosecute me, my heart aches. Because if they doe, all the great words of politicians are vain. Words such as: we will not allow that brings the NPD or the right wing of our children on the wrong track. We will do everything to the NPD or the Nazis to stop them. I know my actions will provoke a broad public interest. That is exactly my goal. I want the Germans are proud of themselves and their country, of the history and achievements. The whole world envies us for our intelligence and knowledge. But ok, that is up to you. The NPD can do what they want, I basically do not care. But if there is one thing I do care about, it is our children and our youth. I will not allow the NPD to gain more influence and spread their propaganda material on school grounds. The NPD is trying to influence our most precious treasure. I am assuming that you exceed, as a reader, a certain intellectual level to understanding for what I mean by "treasure". I am not a man of great words. And for this reason I will leave it at that._

<comment><USER3> _"I am a proud German, I love Germany above everything, and I do everything in my power to improve the image of Germany."_

First step: Don't ever talk like that.

<comment><USER4> as a non-german living in germany, why?

<comment><USER3> We had some bad experiences with "Deutschland über Alles" a couple of years ago, so "proud to be a German" and things like that are frowned upon, as they evoke the wrong images.

I leave the discussion about the merits of patriotism out of this, as it really doesn't matter that much here. This is more about advertising than content, and repeating the now unsung verses of the national anthem is generally considered a bit more than just a _faux pas_ and causes legions of British reporters to perk up their ears...

<comment><USER4> i'm not sure if you're alluding to something in particular or trying to make a joke.

but saying that its frowned upon to be proud of your own country (regardless of country), is to me, not a nice thing to say. singling germany out forever because of past events is dis-ingenious.

i would say that anyone whose nose gets bent out of shape because a german says they are proud of their country probably needs to take a second look at germany, and then themselves. and if a reporter is doing this, then it is most likely just stirring the pot

<comment><USER3> It's not just patriotism and being proud of your country. It's the specific phrases. "Deutschland über Alles" (as in the original text of the hacker) is pretty tied to a specific era and best left alone as a phrase. Actually, "I'm proud to be German" as a phrase is tied to right-wing propaganda, too.

The Wikipedia article on patriotism has a nice statistic, although it's a bit old[1]. A few countries were asked how proud they were of their country, from a scale of 1 to 4. Most of them are in the 3 range (with the US leading with 3.92), Germany had a 1.37.

Again, this isn't really about what you want to express, it's how you do it. And a phrase like "Deutschland über Alles" is basically somewhat between "The South will rise again" and "White Power".

Personally, I find team jersey mentality like that a bit narcissistic, but if it floats your boat... But if you're about to improve the image of something, you shouldn't use the terminology of those you're opposing. That just makes it look like a battle between two equally wrong splinter groups of the same cause.

[1]: <http://en.wikipedia.org/wiki/Patriotism>

<comment><USER4> ok, I think I know what you're going for. My response was based on the fact that many germans feel that they cannot express their patriotism because of how other countries/people/stereotypes will view them. intentions be damned. that was one of the great things about the 2006 world cup here. that all disappeared.

I think it is safe to say that what was written in the article was done so deliberately to get a rise from people who want to be a bit "ra-ra".

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> This has been covered by the mainstream German media:

30.5.2011, Spiegel Online, Hacker kapern rechte Websites, <http://www.spiegel.de/netzwelt/web/0,1518,765784,00.html>

31.5.2011, sueddeutsche.de, Hacker kapern NPD-Webseiten, [http://www.sueddeutsche.de/digital/attacke-auf-rechte- partei...](http://www.sueddeutsche.de/digital/attacke-auf-rechte-partei- hacker-kapern-npd-webseiten-1.1103492)

The NPD response, quoted in the Spiegel article, is laughable: they talk about how their security was relatively good and that there is no such thing as 100% security rather than what they are going to do for their exposed donors. With luck, this means that they will have fewer donors in future.

Just in case the point needs spelling out: for an organisation to to administer all of its 26 websites from the same machine it stores some of its most sensitive data is not relatively good security.

<comment><USER6> Considering the number of NPD deputies who have lost their mandate because of fraud, embezzlement, theft, ... I would say that security is not exactly their primary concern.

</comment></comment><comment><USER7> Perhaps a bit off-topic:

The world will change in the coming years. Not only in Egypt & Co. but also in the west. Curious to see how the governments & elites will react. A sense of enlightenment might propagate throughout the masses. For example: Tomorrow people might no longer tolerate their government's corruption. The day after they might decide that they don't really need all the stuff they buy. How would that effect everything?

If anything, people vastly underestimate the change that the Internet represents.

<comment><USER8> The propagation of ideas is more often a function of their fecundity than their nobility.

<comment><USER7> Hm, I think that statement could be contested. But anyway, in regards to the effect the web has, one could argue that democratization has enough value to the people who are using the Internet to spread western values in their countries to go out and do something.

</comment></comment></comment><comment><USER9> First they came for the yada yada yada...

I really wish that before deploying a tactic like this against their political enemies folks would stop and consider what the world would be like if the shoe was on the other foot and their political enemies were deploying it against them.

But a seriously large number of people seem to have an attitude that "It's okay, we can do this, we're the _good_ guys".

<comment><USER10> I must agree with you; but the list itself got _so_ much exposure in the German media already, that it'd be pointless debating this collection in GoogleMaps.

In general, it's kind of a difficult topic. I agree, that votes cast should always be private. But I'm partial on donations. A scenario in which supporters of an illegal party would be prosecuted by an oppressive state is quite different from simply making it known exactly _who_ supports a _legal_ party in _any_ kind of state. As long as there is no consequence whatsoever for the donors themselves, I believe that open donations can make the political game more public, and less secretive.

Wasn't there a similar discussion in America about concealing names of donors in presidential elections? I can't remember anymore, must've been around the time Obama came to power.

</comment></comment><comment><USER11> Why is it that people support secret ballot, but not secret donation? Both are forms of political support, and making them public can in theory prevent people from expressing their true views. So why is the secrecy of one protected, but not the other?

<comment><USER12> My opinion:

In a democracy, ideally every one should have the same amount of voting power. Independent of social status, power and wealth.

Secret of vote, is there to prevent bribery and blackmail. Hence, even a poor and powerless person can vote, according to their heart.

In contrast, donations to politicians and parties, are an attempt to "buy" elections.

<comment><USER2> You could make it so that even the receiver of the donation doesn't know where the money comes from.

<comment><USER9> I heard this idea somewhere else recently, and I think it's brilliant. Instead of limiting sizes of political donations, just make it impossible to track who gave 'em. Oh sure, you can still _tell_ your favourite politician "Hey, I just gave you ten thousand dollars" but they can't possibly check.

Closing a few obvious loopholes: you should only be able to donate in certain nice round numbers ($10, $20, $50, $100, ... $10,000, $20,000) to avoid situations where you can tell a politician "Hey, the $15433.33 donation is from me" and have them confirm it. And it should be fuzzy in time, too -- politicians shouldn't know _when_ a donation came in with resolution greater than a week or so.

It's great, because people are still free to support their favourite politicians as much as they like, but with greatly decreased possibility for corruption.

Politicians will, of course, hate it, so it'll never happen.

<comment><USER2> They don't even have to know the amount of the transactions. The "campaign donation bureau" can only releases monthly balances.

</comment></comment></comment></comment></comment><comment><USER13> This is not fair - whoever has donated and whatever party he supports. For sure, we all know Germany's history and we know that we need to take care about what nationalist parties are doing. But it is not fair to publish a list of people who have donated. It is your right to stay private! To conclude: There are more severe threats: business men insuits, people who underpay workers. In Germany, the NPD is not the most serious threat.

</comment><comment><USER14> I find it fascinating with these kinds of datasets that the outliers are more likely than not errors. For example, I'm guessing that "Nevskiy Prospekt" is most likely in the non-Florida St. Petersburg.

</comment><comment><USER15> This happened with the UK's own fascist/far-right party in 2009. Twice, actually.

[http://www.guardian.co.uk/politics/2009/oct/20/bnp- membershi...](http://www.guardian.co.uk/politics/2009/oct/20/bnp-membership- list-wikileaks)

</comment><comment><USER16> I'm a little surprised that there weren't higher concentrations in areas that I usually associate with ultra-conservative views, e.g. the rural South.

<comment><USER10> The rural southern areas are conservative, not fascist — though their conservatism usually implies a bit of racism, that doesn't mean that they tend to support radical fascism. They're usually too scared to ruin their public or neighborhood image.

The "battle for the heads" ( _Kampf um die Köpfe_ in German; how the NPD's and similar right-wing institutions' propaganda battle is often referred to in German media,) targets mostly bored and disillusioned youth, and is more successful in the poorer East than it would be in the well-off South.</comment></comment>


The WSJ may have used doctored images in their anti-YouTube story [video] - <AUTHOR> https://www.youtube.com/watch?v=lM49MmzrCNc <comment><USER2> via [https://twitter.com/TrustedFlagger/status/848664259307466753](https://twitter.com/TrustedFlagger/status/848664259307466753)

".@h3h3productions messed up. The video was monetised by OmniaMediaMusic. Evidence in source code of original video." "The video was claimed due to the copyrighted content, hence the sudden drop off in ad revenue. Nothing to do with it being demonetised by YT"

<comment><USER3> So YouTube likely was showing ads for the video, but the revenue wasn't going to the uploader, rather going to [http://www.omniamedia.co/](http://www.omniamedia.co/)

There are a lot of thumbs in this pie.

</comment></comment><comment><USER4> This video is at the top of reddit, but it doesn't show any real evidence of doctored videos.

Although google prevented affiliate monetisation on the video as seen on the affiliate earning graph, they probably have some intermediate step whereby they still show ads but the affiliate doesn't get paid for them.

Secondly, where the same video was shown with multiple different ads and the same view count - youtube video view counts dont increase in real time. You can push refresh on a video a few times and you will likely get 3 different ads with the same viewcount recorded.

I wish they were doctored images, but I don't think this is evidence of that.

Also, when did social justice trolling become a business model for the WSJ? First pewdiepie, now this?

</comment><comment><USER5> The view count on videos is not updated in real time. Once a video reaches about 300 views, YouTube only updates the counter a few times a day.</comment>


Russia Terminates the Daily Stormer - <AUTHOR> http://money.cnn.com/2017/08/17/technology/business/daily-stormer-russia-domain-blocked/index.html <comment><USER2> I wonder what motivated the move, considering that Russia generally likes things that make America look bad. Plus, both the Russian govt and the daily stormer have a few things in common: they hate the LGBT community and advocate violence against people they don't agree with.

<comment><USER3> 27 million russians died because of the Nazis. I'd be surprised if they tolerated that sort of content very well only a short while later.

Source: [https://en.wikipedia.org/wiki/World_War_II_casualties#Total_...](https://en.wikipedia.org/wiki/World_War_II_casualties#Total_deaths)</comment></comment>


Claims for Cryotherapy Treatment Get New Scrutiny After a Death - <AUTHOR> http://www.nytimes.com/2015/11/06/us/cryotherapy-offers-treatment-at-300-degrees-with-little-oversight.html?action=click&module=TrendingGrid&region=TrendingTop&pgtype=collection <comment><USER2> I used to live in Poland where cryotherapy is pretty popular in sanatoria (in the European sense of the word) and did a few sessions: three minutes a day over two weeks. It certainly helped with my running injuries, especially shin splints.</comment>


I just wrote Machine Learning with TensorFlow – The code is available on GitHub - <AUTHOR> http://tensorflowbook.com/ <comment><USER2> This looks really interesting! Can't wait to get my hands on the book.</comment>


New Online Auction Site Tries to Take Advantage of eBay Vulnerability - <AUTHOR> http://www.foxbusiness.com/story/markets/innovation/new-online-auction-site-tries-advantage-ebay-vulnerability/ <comment><USER2> They are aiming too low. Internet auctions are all or nothing game. There are network effects, free alternatives, established players, all playing against them, what are they thinking?</comment>


Strikingly (W13) Launches Its Super Easy 'One-Click' Site Builder - <AUTHOR> http://techcrunch.com/2013/12/02/y-combinator-alum-strikingly-launches-its-super-easy-one-click-site-builder/

<comment><USER2> Am I the only one who's slightly suspicious of these generic-looking positive comments from just registered users?

> piscesnut 11 minutes ago | I just get my fb website in seconds. Never seen > website building that easy!

> averymor 12 minutes ago | Mission accomplished! What are you going to take > over next?

> stevelau 18 minutes ago | Wow, this is pretty cool. Nice job guys!

<comment><USER3> Nope this is pretty transparent. Come on guys, you should be better than this.

<comment><USER4> Yah. But did you notice that grumpy cat wants to connect with facebook? ;)

</comment></comment></comment><comment><USER5> Why are all these supportive comments posted by users whose account has only been created in the last 1 or 2 days and/or posted only on this thread. Also most all of them seem to be a single line long and end in a (!).

<comment><USER6> Sorry about this. We made a stupid mistake asking our friends to support us this way. Won't happen again, and sorry for making this annoying for the HN community.

</comment></comment><comment><USER7> Wow, this is pretty cool. Nice job guys!

<comment><USER6> Thanks a lot man! Definitely let us know if you have any feedback or suggestions!

</comment></comment><comment><USER8> Mission accomplished! What are you going to take over next?

<comment><USER6> Our direction is always to build the simplest website builder. We want to really deliver great quality websites for every individual. Our goal is really to improve on the quality before going too broad.

</comment></comment><comment><USER9> Always wanted to have my own website, this makes it so easy!

<comment><USER6> Thanks a lot! Definitely let us know if you have any feedback!

<comment><USER10> Fire your PR firm that is astroturfing HN?

</comment></comment></comment><comment><USER11> I just get my fb website in seconds. Never seen website building that easy!

<comment><USER6> Awesome! Definitely let us know how you think we can improve it!</comment></comment>


Deep learning to detect Covid 19 / pneumonia cough signature - <AUTHOR> Is there an opportunity to develop a prescreen to potentially detect covid 19 / pneumonia through a deep learning / ML model trained on the cough pattern in patients ? Is there a possibility of developing this capability? <comment><USER2> Checkout some work done here

[https://towardsdatascience.com/using-deep-learning-to- detect...](https://towardsdatascience.com/using-deep-learning-to-detect- ncov-19-from-x-ray-images-1a89701d1acd?gi=bbeb43ad9e1a)

<comment><AUTHOR> Good stuff here! Thinking along similar lines.. If there's data ( cough / breathing recordings) think it's worth a shot</comment></comment>


Launch an idea in 12 weeks - <AUTHOR> http://launch.puricode.com/ <comment><USER2> I don't see anything about market research, talking to customers, etc. That seems way more important than building something that nobody wants.</comment>


Show HN: My Guild Wars 2 data viz weekend experiment using D3 and SVG filters  - <AUTHOR> http://guildwars2viz.com/

<comment><USER3> As a design project it's cool. I think you did a good job and I don't mean to rain on your parade. But of course now I will. I think as a data visualization exercise, it's mostly what Tufte would call "chart junk". The graphics don't aid into understanding, and actually sort of distract you from the point. It would be a lot easier to read if the axis labels said things like "Warrior" instead of an obscure graphic, that even as a GW2 player myself, I have to think about. Also, the pie chart...pie charts are problematic for understanding data because we don't do a good job at interpreting area. A bar chart is considered more effective. Again, as a purely visual exercise, I think it looks cool.

</comment><comment><USER4> This looks nice! And I like the link between the rings and the bars.

I'm a bit thick. It took me a few minutes to realise that the rings of the circle are independent. For example, there can be female humans, all the humans are not male.

On the bar charts you start at 0% (which is good), but you don't finish at 100%, nor on a similar number. One chart finishes at about 15% and another at about 30%. So at a glance the hight of the bars looks similar. I guess the width of the bars compensates? (And the race bar chart numbers add to 99%. Is that a rounding thing?)

<comment><AUTHOR> Thanks! You're not thick, it's just that this isn't really the best visualization choice for the data since the rings are independent and not hierarchical (like in <http://mbostock.github.com/d3/ex/sunburst.html>).

You are absolutely right about the scale for the bar charts, oversight on my part which I have fixed now. The adding to 99% is a rounding error (you can see the fully number value by mousing over a bar) - thanks a ton for your feedback!

</comment></comment><comment><USER5> Very cool!

GW2 is currently my favorite game and am really surprised to see it on HN frontpage.

I'm astounded at the amount of data ANet is making available. And, how cleanly and robustly they've done it - all in JSON.

Another bit you might want to play with is their TP (Trading Post) JSON data. These guys (<http://www.gw2spidy.com>, source is on github) do a really good job, but I'm sure there are tons more things, and ideas, that can come from all that data!

Good luck!

<comment><USER6> > GW2 is currently my favorite game

How do you think it compares to GW1? I have GW1, but found it a little lonely after leaving the cities because outside the cities, the regions were instanced.

<comment><USER7> I'm quite fond of both games, but it's dangerous to directly compare them. GW1 is a Diablo style game that flirts with massive elements, whereas GW2 is much more of a traditional MMO. They certainly have plenty of things in common - <USER2> similar approach to/focus on PvP, similar action bar combat with a lot of attention paid to status effects - but they're not even really in the same genre, and GW2's focus on ad-hoc collaboration means that GW2 plays much differently moment-to-moment.

GW2 does some great things with quests, their PQ-ish Dynamic Events work well, and their huge raid-boss-y world dudes are a ton of fun. The way you can join multiple guilds and the way you are scaled down in level based on where you are makes it really easy to play with friends regardless of your individual progression. It's definitely worth a look.

</comment></comment></comment><comment><USER8> This is pretty rad. It reminds me of our designer (Joe Golike)'s master's project, visualizing the economy of WoW, also built in d3:

<http://golike.com/2.0/mmox.htm> <http://mmox.org/demo>

</comment><comment><USER9> It looks great, but I noticed that the black outline animation lags heavily behind the rest, which makes the site feel incredibly sluggish, even though it's probably only just the one animation that ruins the perception.

Great job all in all.

<comment><AUTHOR> Thanks! I removed the transition delay effect, it should appear to select it a bit faster now.

</comment></comment><comment><USER10> Very cool, my buddy has been harping me to get GW2-- Where did you get the data for this?

Cheers

<comment><AUTHOR> The data comes from a recent image published on the GuildWars official blog: <http://guildwars2viz.com/static/img/viz/gw2_data.jpg>

I just calculated the percentages based on the pixel coverage of each bar. I'll also add in on your buddy's harping - get it, it's a fun game! ;)

</comment></comment><comment><USER11> Loads slow in Firefox. Sigh.....

<comment><USER12> Why the "sigh....."?

</comment></comment><comment><USER13> Need a key for the icons.</comment>


Ask HN: Cache Invalidation API in browsers? - <AUTHOR>

Whenever we deploy a new version of a website - there are changes everywhere (CSS, JS, Images, change in HTML page layouts, etc). Currently we resort to URL manipulation (example path/to/resource?v=1, path/to/resource?v=2, etc where version is mostly a timestamp or hash, and resource is a CSS, JS or Image). Or we have to run reverse proxies and serve our site via Varnish or nginx which does the actual caching.
There are a boatload of APIs being introduced in browsers. But it would be so nice if there were a Cache Invalidation Javascript API, something like:
document.cache.invalidate(some URL pattern);
This should not immediately clear the browser cache (because it will result in stalling of rendering) - but it should simply mark the specific URLs as stale in the browser's cache. They should then be freshly fetched from the server when we request them the next time. This will result in true client-side caching and invalidation, without having to use any reverse proxies or URL hacks. This way, I can even serve all my Content pages as Cache forever, and simply invalidate them whenever there is a change in content or layout!
Could anyone explain why there is no work being done to improve client-side cache invalidation? Are there any limitations which prevent this from being done?
Edit: Typos and minor grammar <comment><USER2> An immediate thought on this- would be proxies. So it is no good relying on clearing the cache in the local browser, if it is being served a cached version from an upstream proxy server.

It is clearly a problem that needs addressing though. In our web app we have added build steps that seek out all css/js/image links and append version numbers as a query string to defeat the cache.

This works quite well, but has the disadvantage of always clearing the cache for each new release, when in reality not all items need to be cleared.

<comment><AUTHOR> Yes, I also mentioned proxies like varnish and squid, but problem is they still require a HTTP request. It would be nice if there was an API which enables us to use pure client-side cache invalidation without any extra calls.

<comment><USER2> My point is- that there may be a proxy server outside your control which is caching the content (e.g. inside a corporate network).

Unless you can invalidate the cache here as well, then clearing it in the browser is no good (I suppose you could set your cache headers to disable caching on intermediate proxy servers)

<comment><AUTHOR> Ahh, yes, I misunderstood that. That would be tricky to circumvent.</comment></comment></comment></comment>


You don't need SMS-2FA - <AUTHOR> http://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html <comment><USER2> > Unfortunately, it doesn't work like that. When a service enables SMS-2FA, an > attacker can simply move to a different service.

That argument is just nonsensical. If you're a provider, the user being compromised on some other service doesn't really matter (and there's nothing you can do to prevent it anyway). While preventing the compromise protects the platform from abuse, saves on customer support on having to help the hijacked user recover, etc. While if you're a user, obviously it's better to be hijacked on as few (and as unimportant) services as possible.

> Instead, why not simply randomly generate a good password for them, and > instruct them to write it down or save it in their web browser?

The users don't know how to save a password in the web browser. They'll lose the piece of paper. They'll be unable to log in, and effectively end up in an eternal loop of recovering their account (with SMS!) every time they log in, and getting a new password they can't remember. If you end up sending the user an SMS anyway on every log in, might as well use the version where you get to use knowledge of the password as a gating factor.

> If we spend all that good will on irritating attackers, then by the time > we're ready to actually implement a solution, developers are not going to be > interested.

I'm really not sure what this is referring to. Other than this comment, I thought Tavis was railing against forcing users to do SMS 2FA. But then it turned out that the resource he is concerned about is developer goodwill, which doesn't really make sense.

There are a few classes of developers.

1\. Huge companies with security teams that are willing to entirely implement their own authentication systems. Their goodwill is not going to be exhausted, since they're implementing what those teams think is the best for their platform's security.

2\. Companies with potentially sensitive data who outsource some or all of the authentication to some kind of identity provider or identity platform. Their goodwill won't be exhausted: they'll just expect the provider to implement whatever the best practice is at any time.

3\. Companies that don't care, and just roll their own username + password auth. They aren't going to implement SMS 2FA any more than they would implement U2F.

<comment><USER3> > > Unfortunately, it doesn't work like that. When a service enables SMS-2FA, > an attacker can simply move to a different service.

Furthermore, the suggested alternatives of U2F, WebAuthn, and FIDO would behave exactly the same! (Excluding perhaps passwordless authentication utilized by the hacked website.)

<comment><USER4> The stored credentials for WebAuthn aren't useful for impersonation. They consist of an opaque identifier useless except for triggering the verification on that particular site, and a public key which is... public.

So this (quite deliberately) renders it immune to credential stuffing.

If your system stores both WebAuthn credentials and a password (e.g. to enable cheap FIDO dongles as a second factor to the password) then the passwords could be used in a credential stuffing attack against other sites. _But_ if you don't store passwords and use WebAuthn to handle both factors (e.g. Touch ID plus physical possession of the iPhone = two factors) then you don't have any credentials that can be used by an attacker, none at all.

<comment><USER3> Maybe I'm missing something, but I think we're in agreement.

The article suggests that if a service provider unrelated to your service uses usernames & passwords, and is hacked, SMS 2FA protecting accounts on the service provider YOU run still does not prevent credential stuffing. The argument that follows this statement is nonsensical: "Well sure, they can't login to YOUR service, but they can login to other ones."

Seemingly this argument advocates the opposite of the suggestion - if you use usernames and passwords for authentication, add SMS 2FA to prevent other hacked websites from leaving your users vulnerable. (Would WebAuthn be even better than SMS 2FA? Yes!)

If I'm not the "hacked" service provider, adding WebAuthn to my service has no additional benefit when a DIFFERENT service provider is hacked (well, aside from removing SIM swap attacks from the equation.)

WebAuthn only changes the situation if you are _the site that was hacked_. But aside from this point, the article seems to discuss the case where a separate service was hacked and passwords were leaked.

</comment></comment></comment></comment><comment><USER5> I believe the arguments that SMS-2FA is not effective against phishing. (Or, at the least, I can't provide a compelling counter-argument.) But I had always thought of SMS-2FA against a more banal problem:

1\. You have a unique, long password with Foo.

2\. Oh no! They store your password in plaintext, and their security is terrible, so your username and password are part of a giant data breach from Foo.

3\. Before you know about it and can change your password, someone that is not you, who does not have access to your phone, tries to log into the account.

4\. While out living your life (or _in_ , these days), you receive an SMS from Foo, and then ignore it.

5\. There is no step 5, as no one else is getting in.

6\. Okay, fine, you caught on, and now you log in and change your password with Foo, or maybe just drop the account, because _really_.

It seems to me that SMS-2FA helps in this scenario. Am I missing something obvious?

<comment><USER6> Tavis discusses this explicitly in the article. His claim is that there will be some other service that doesn't do this so the user is still vulnerable to credential stuffing - just not on your service.

I don't fully buy the argument, but he didn't just ignore this.

More valuable, I think, is the claim that we only get so much bandwidth to educate users and that spending time educating people on unique passwords is more effective than working on sms 2fa.

<comment><USER7> Users are lazy. You can educate all you want, they will still use the same passwords everywhere, or weak passwords. You have to bake the security into your workflows, processes, and code if you want it to matter.

This is from infosec/opsec awareness training experience I get paid to provide. Not all users are lazy, mind you, but enough to be emotionally depleting. Incentives matter.

<comment><USER6> > You have to bake the security into your workflows, processes, and code if > you want it to matter.

There's a suggestion here in the article: don't let users pick their passwords. Just generate one for them and say "use your browser's password manager or write it down".

<comment><USER8> All that does is increase the locked account support tickets and drive people away.

A sticky note password attached to the screen creates another password sharing problem.

The last company I trust with my secret password is my browser. One hack away from exposing everything. That's like bring all of your important documentation with you wherever you go. If you are robbed it is better you don't have your bank code attached to the card.

<comment><USER6> You are typing your password into your browser. You must trust them with your password.

<comment><USER8> I don't trust them to store and safe guard the password.

<comment><USER9> So you're not using a password manager either?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> He's arguing not just against SMS-2FA, but against 2FA itself, and his simple solution is to "just use a strong password".

The author completely misses the point about the value of 2FA itself. I agree SMS-2FA is not good, but that doesn't mean 2FA is worthless.

<comment><USER11> I guess he was trying to specify 2FA that's NOT u2f, or other very strong options. But yeah, in principal, he's really talking about SMS, TOTP, et all. Bit of a shame, because TOTP itself is far better than SMS. It's all a sliding scale of security vs convenience.

<comment><USER12> Except it's not really a sliding scale with SMS being "easy" and U2F being "hard". U2F is SO much more convenient than either TOTP or SMS. SMS might be a little easier than TOTP, but with either one you still have to (1) find the phone, (2) unlock it, (3) hunt around for and open the app, (4) manually type the code in, often looking back and forth between the phone and webpage 2 or more times before you get it. Compare to just taping the U2F key with the side of your finger (assuming it's already plugged in, which is what I do). There's just no comparison in terms of UX between U2F and anything else I've ever seen.

<comment><USER11> Can you use the same USB key for every application you need to authenticate to?

<comment><USER4> Web sites can all just do WebAuthn. The browser will securely manage the relationship between each site and the USB key ensuring that sites can't lie to the key about who they are (which would enable phishing).

If you are happy to use this only as a second factor, the USB key can handle any number of sites without constraint. If you want "resident credentials" where the USB key can sign you in spontaneously (no need to even enter a username or email address) the key needs storage for each such credential, those on the market today hold only a relatively small number, fine for your bank but not for say Hacker News and other forum sites you might join dozens of.

For other application software it's trickier but possible, you can see that OpenSSH did this for example.

</comment></comment></comment></comment></comment><comment><USER13> Yes, it's true that SMS-based authentication has its flaws, but it's far from useless/harmful in many contexts. The same strawman arguments used here would also find TOTP "wholly ineffective" which is an absurd conclusion.

A main goal of security engineering is to increase the difficulty level for attackers. SMS authentication has demonstrated its ability to do this in a highly accessible, albeit imperfect, manner. I feel that the author severely underestimates the practical difficulties of widely deploying "Unique Passwords and U2F".

I strongly disagree with the conclusion that "SMS-2FA is not only worthless, but harmful" and highly recommend consulting a security professional before entertaining any of the arguments or following any of the suggestions in this article. I don't like leaving negative comments, but this is at best borderline misinformation that has the potential to create severe consequences.

Some more context, if you want to consider a more balanced perspective: [https://doublepulsar.com/infosecs-fantastic-fear-of- everythi...](https://doublepulsar.com/infosecs-fantastic-fear-of-everything- why-the-reddit-incident-shouldn-t-cause-infosec-to-throw-4bb3b7ea634f)

<comment><USER12> Regarding the "SMS-2FA is not only worthless, but harmful" claim, it's true, but only in the sense that widespread "lazy" SMS 2FA deployments stifle U2F, which, I believe, should just be the standard across the board[1]. Of course SMS does help, just not as much or in as many attack scenarios (and is more of a UX pain too).

[1] The common HN objection which you alluded to is "but it's so hard!" It's really not. Passwords are hard! If only I could have back all the hours I've spent trying to help my grandparents remember their passwords. I have a U2F token plugged into the side of laptop and nothing could be easier than tapping it to get in. Implementation might be hard, but come on, that's our job.

</comment></comment><comment><USER14> SMS 2-factor is wrong and bad and NIST has been yelling about this since 2016 or before. Simjacking is real and fairly commonly used in targeted attacks.

2-factor as an idea is great, and this author seems very confused.

<comment><USER15> SMS should only ever be used as a proof of investment. IE making sure a bit setting up hundreds of thousands of accounts (because they broke your CAPCHA) needs to buy tens of thousands of real phone numbers with service.

It's a one time thing at account creation and should be immediately deleted afterwards.

Real 2FA should be set up afterwards to actually protect the account. A yubikey or even a simple TOTP app is a lot of protection against account takeover. The only big weakness left at that point is the help desk.

<comment><USER16> All the arguments in the post against SMS 2FA are also arguments against TOTP

<comment><USER15> There is no help desk that can give away your TOTP secret. That's the big weakness with SMS, someone buys a phone and asks the clerk to give them your phone number.

<comment><USER6> It is a publicized weakness. In practice, phishing is scalable and social engineering isn't. And humans are shit at detecting phishing attacks.

</comment></comment></comment></comment></comment><comment><USER17> After multiple experiences where I couldn't log into an account due to not having a phone signal, I refuse to use SMS-2FA on any service. Given that I already use strong passwords, the marginal security advantages are far outweighed by the potential lack of availability.

</comment><comment><USER18> SMS 2FA exposes a person's cell phone account to attack, and the carriers aren't hardened to handle it. Jack Dorsey getting hacked proves how stupid using SMS for anything. Please, implementing this. Use FIDO U2F or TOTP. It's not that hard, my 70 year old mother has it enabled and has no issues with it.

</comment><comment><USER19> I've got the dual yubico key thing going. It seems to work fine. I don't need to pick overly complex passwords if I don't want to.

Google does this well. Yubico Security Key + they seem to monitor my logins / rate limits etc.

I deal as do many folks with relatively to extremely sensitive info (yes, also have stuff on auto-delete).

Complex passwords require a password manager - if those get updated and rooted then my yubico seems to save me again.

In fact, with yubico I have a few passwords I memorized that aren't TOO crazy long - with a 2FA hardware key you may be able to SIMPLIFY passwords and still have good security.

And the yubico is EASY! Clip it to your keychain and go.

</comment><comment><USER20> I did not get the explanation for why SMS 2FA does not work against credential stuffing. It clearly does.

<comment><USER6> He is thinking of it from the user's perspective rather than the service. If I reuse my passwords I still get owned even if some of my services use 2fa, because others won't.

It's an unusual way of thinking about it and I think the weakest part of his argument but it is interesting.

<comment><USER20> Yeah, that basically destroys his argument. If I use the same password for a random internet forum with no 2FA and my bank account with SMS 2FA, then a person, who breaks into the forum DB still can not access my money.

<comment><USER21> Problem is that attackers can take advantage of that random internet forum to take over your bank account. Plant something that you would click because it is on your account and it downloads some malware. Could come up with more scenarios probably like they could target someone else from your account and use trust you have on that forum.

But it is of course question if you are worth their time.

<comment><USER20> What you said has nothing to do with SMS 2FA, and has everything to do with user/their friends' gullibility, which still must be pretty high to click something on the forum and then also launch it.

It also is totally unrelated to credential stuffing.

We are not looking for a panacea there. If you're that gullible and your forum account is pwned, no security measures will prevent you from giving up bank details.

</comment></comment></comment></comment></comment><comment><USER22> The thing I find odd about sms 2fa is I sometimes get multiple services texting me through the same short code. Isn't that a security hole in itself? If a user recognizes a number as the "security number that texts me sometimes" and I as an attacker know this, couldn't I somehow abuse this?

For example: "Please go to x url and enter your password" -> user enters pw -> show new form with 2fa code input (and in the background, try logging into their account with the pw supplied) -> user gets another text from the same number, enters in your site -> profit???

</comment><comment><USER23> I think this misses the point... do you need your own auth at all?

Security is only as strong as the weakest link. If you have a "forgot password" that emails you a login or a "lost/changed phone" that removes the sms, don't bother even having the password or sms.

Falling back to email means you've just pushed your auth behind the email's auth. Just use it directly by using oauth with google, o365, facebook or whatever makes sense for your target audience and be done with it. If you are b2b, use saml.

</comment><comment><USER16> The prescriptions in "If you're a security conscious user..." make sense to me. If you use a unique password, sms/totp adds very little benefit.

However the section for "If you're a security conscious vendor..." doesn't make sense. Credential stuffing is so common, and sms/totp is a great tool against it. You could prevent users from setting their own passwords, but that seems a little "too different" from existing sites that it could harm usability.

</comment><comment><USER24> Okay, the argument about credential stuffing is fairly weak. 2FA on a given service makes it an ineffective attack against that service. If you have 2FA on _all_ of your services, credential stuffing won't work on any of them, so you're then immume. Moreover, not all services are identical - Email merits two distinct hardware keys, my Steam account warrants an emailed password, my BeerAdvocate account... probably doesn't need anything.

</comment><comment><USER25> It could be used to deter users from making multiple accounts. It won't stop determined spammers though.</comment>


Top Trends of 2010: Growth of eBooks & eReaders - <AUTHOR> http://www.readwriteweb.com/archives/ebooks_ereaders_top_trends_2010.php <comment></comment>


Skimming vs. Reading - <AUTHOR> http://online.wsj.com/article/SB10001424052970203914304576627182901819782.html

<comment><USER2> A very interesting article, with references to research I hadn't heard about before. One of my favorite books on reading, which deserves to be read slowly enough to comprehend everything the author is saying, is Reading in the Brain by Stanislas Dehaene.

<http://readinginthebrain.pagesperso-orange.fr/intro.htm>

What any Hacker News participant can do to get a check on appropriate reading speed for one kind of book or article or another is to test comprehension after reading, by having a friend ask questions about what you just read. Here on Hacker News, we sometimes test one another's comprehension as we discuss articles in comment threads. Many HN participants admit frankly that they skip or skim most of what is posted here, but many other HN participants help out a lot of fellow participants by their close reading of submitted articles or the comments of other participants.</comment>


Map of the world (and all individual countries) showing population density - <AUTHOR> http://www.worldpopulationatlas.org/

<comment><AUTHOR> Some direct interesting links:

* The world: <http://www.worldpopulationatlas.org/carto_world.htm>

* China: <http://www.worldpopulationatlas.org/carto_chn_hkg.htm>

* United States: <http://www.worldpopulationatlas.org/carto_usa_main.htm>

* Inidia: <http://www.worldpopulationatlas.org/carto_ind.htm>

</comment><comment><AUTHOR> A more convenient link for easy navigability: <http://www.worldmapper.org/textindex/text_index.html>

Pretty fascinating stuff! If you have other stuff like this that a data junkie like me might enjoy, please let me know!</comment>


How much do you trust IT analysts? - <AUTHOR> http://www.obxerve.com/en/article/buying-it-investment-advice/

<comment><USER2> I trust IT analysts to provide plausible arse-covering for way-outta-their- depth CTOs. Boards ought to start requiring CTOs who utter the words "But Gartner said..." to resign.</comment>


Cowboy riding a 40 meter rocket.@elonmusk - <AUTHOR> http://twitter.com/elonmusk/status/283040346538115075/photo/1 SpaceX's Grasshopper taking a test flight with a human on board. http://twitter.com/elonmusk/statuses/283034463372464129 <comment><USER2> Hilarious. Good PR, regardless if it's real or not..</comment>


Ask HN: Should co-founders receive equal pay? - <AUTHOR>

I see a lot of discussion about how one might distribute equity among co-founders, but I'm struggling with the issue of co-founder salaries.
As part of my agreement with my co-founder, I'd like to define salary 'bands' that correspond to the performance of the company: ramen-profitable, sushi for lunch, hiring a chef. (This idea came from a previous HN thread).
My question is, should my co-founder and I plan to take equal pay regardless of share allocation? (I'll hold 60%, my co-founder 40%).
My gut tells me yes (so long as we're both contributing seriously and the funds are available), but I'd appreciate feedback, esp. based on experience.
As a side note, pg mentioned in another thread that "whatever you pay yourself, you're always doing it at the expense of the stock you hold". Does that mean we should, in fact, return equity to the company as we pay ourselves? <comment><USER2> I was part of a start up with 4 guys. 1 was my former boss, the 2 others were my equals. The original idea was the former boss's idea and he was paying for a lot of the overhead (hosting, hardware, beer, etc.) We all stated what our desired salaries were. His was above the 3 of us, and I was fine with that. He brought technical and business skills to the table and I was more than happy for him to have a larger salary. This was different than the stock allocation, which was based on hours worked (before we were funded)

So if you consider you and your co-founder equals, then equal pay makes sense regardless of the ownership. If you (or him) bring more to the table, then different pay rates is also fair, assuming you both see eye to eye on this.

I'm not sure at the PG quote. I do see the benefit of investing profits back into the company which will increase the value of the company and your ownership of it.

</comment><comment><USER3> For political reasons, it's usually best to pay yourselves the same amount. Reasons for different amounts: children, loans, trust funds, etc. When you're medium successful, that may change if one of you is still CEO. For now, don't sweat it.

I interpret pg's comment to mean that any dollars that you aren't spending growing your business are doing harm to the value of your equity. Realistically, I think this means that if you achieve some degree of product market fit, it's a bad idea to pay yourselves more than you really 'need' as those dollars could be more valuable to the business.

<comment><AUTHOR> I thought I might be taking that comment too literally ;)</comment></comment>


Kids Video Game Playing Is Not About Games. It's About Unmet Psychological Needs - <AUTHOR> https://www.nirandfar.com/2018/07/kids-video-game-obsession.html <comment><USER2> This is completely true. Except not just for kids. Most people don't have anything remotely interesting going on in their lives.

Ib4 "I learned to ride a motorcycle" or "I deadlifted lol4plaet yesterday" or "I wrote an article on Angular route resolves". Great, except it's meaningless and insignificant.

To relate this back to HN - my experience with start ups is that I sit alone in a room, tired af after work, and do menial labor that may or may not have any result whatsoever and I won't know for 6 months.

</comment><comment><USER3> Source title has "...Video Game Obsession...", changing it to "...Video Game Playing..." is misleading; the content is not about how all kids game play is about unmet psychological needs in the trivial sense that all human activity is about such needs, but how while moderate play is normal, _obsessive_ gameplay is about deeper, non-game-specific psychological needs that aren't being addressed with elsewhere in the kids' lives.</comment>


Cloud Computing Instrumental in IT Recovery for 2010  - <AUTHOR> http://in.sys-con.com/node/1232970

<comment><USER2> ""Watch, too, for Amazon, to develop an application platform.""

What is AWS? AWS provides high level infrastructure like very robust message queues and file volumes that are automatically replicated. Add elastic load balancing, easy to manage EC2s, etc. and you really have much higher level components than just leasing servers.

Will Amazon try to compete with Google Apps? I don't think so.

<comment><USER3> Others are doing it.. <http://www.salesforce.com/platform/> \- I suppose it's not unreasonable to assume AWS will provide something similar (but slightly better in some way I'm guessing!)</comment></comment>


Why climate change is so hard to tackle: Our stubborn energy system - <AUTHOR> https://www.axios.com/why-climate-change-is-so-hard-to-tackle-our-stubborn-energy-system-6c8fc596-3c47-477a-82aa-cd00f063c9a0.html <comment><USER2> This content is pretty meagre.

"the world would need to slash its use of oil, natural gas and coal within 30 years"

More like 10 years, given recent IPCC reports.

"Our dependence on fossil fuels is often likened to that of cigarette smoking, but the analogy doesn't hold up.

        Smoking is an unhealthy habit some people choose to engage in, and if they choose, they can try to kick that addiction without changing their life.
        Fossil fuels are the foundation of our global economy, and it's nearly impossible to go about our lives without using them in some form."

Bad analogy begets bad analogy.</comment>


Picking the FB50 smart lock - <AUTHOR> https://icyphox.sh/blog/fb50/ <comment><USER3> I've been getting into home automation recently and I've given myself a rule: nothing cloud connected. If I can't run it off my local server, I don't want it. I have much more motivation to secure my home than any company ever will.

<comment><USER4> After my internet was cut for five days and my smart house became super dumb, I adopted that rule too.

I'd love to know what products you are using.

<comment><USER3> I don't have a lot hooked up yet, mostly just the software infrastructure. I'm building it all around Home Assistant. That integrates nicely with my Unifi network controller, which gives me presence detection (phones connecting / disconnecting). I have one Sonoff wifi switch which I reflashed to work with MQTT, mostly as a proof of concept, but now that I know it works I'll probably get a pile more. And I have a Honeywell T6 Pro thermostat (z-wave) on the way.

</comment></comment></comment><comment><USER5> > DO NOT. Ever. Buy. A smart lock. You're better off with the "dumb" ones with > keys.

Well, physical locks are not necessary harder to pick lock than electronic locks. Buy your self a pick lock set, practice a bit and be amazed how many locks you can pick.

<comment><USER6> I think you'll be surprised. You should watch some of these videos: [https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ](https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ) \- choose any one of his videos. It'll be picked in under a minute.

<comment><USER7> LPL is an amazing lock picker, anyone with this level of skill is much better off working as a locksmith or a security consultant.

Most B&E's aren't exactly executed by master thieves they aren't single pin picking your locks.

When selecting a door lock or a pad lock you should care only that it can be raked or bypassed, for bike locks you should also care that it can't be easily cut.

For the most part your door is likely going to be the weakest link as most people don't have reinforced doors and door frames.

<comment><USER8> Many people even install glass windows.

<comment><USER9> Smashing a window is unnessecary noise.

I've been burgled 4 times in my life, all 4 were either jimmied window or jimmied door (usually a screwdriver as a prying tool).

<comment><USER10> 4 times? Where do you live just out of interest?

<comment><USER9> I don't live there any more, but 3 times were Middlesbrough UK, the 4th was in Mountain View, CA.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Note that requiring a server account login before the user is allowed to manage a Bluetooth device is an explicit violation of the App Store Review Guidelines, so now that awareness is being drawn to this lock they may find themselves banned on iOS soon unless they fix it.

<comment><USER12> I dont think Apple is that hard on this. I peeked a bit the guidelines, couldn't find the section you mentioned.

<comment><USER13> [https://developer.apple.com/app- store/review/guidelines/#dat...](https://developer.apple.com/app- store/review/guidelines/#data-collection-and-storage):

 _"(v) Account Sign-In: If your app doesn't include significant account-based features, let people use it without a log-in."_

<comment><USER11> _" Apps may not require users to enter personal information to function, except when directly relevant to the core functionality of the app or required by law."_

</comment></comment></comment></comment><comment><USER14> Losing access to a lock is bad stuff. I went with a smart lock that has a physical key.

The article says don't buy a smart-lock, but the convenience of having one- time access codes, scheduled access, delivery access, and linked to a security camera make the downsides (increased attack vectors) something I'm willing to live with.

<comment><USER15> And we, on HN, can make an informed decision about that calculated risk. The general public just sees "Encrypted Android App with Smart Unlock" and thinks they are safe.

<comment><USER14> Is that any different than virtually any other cyber security issue--the general public is not well equipped to do Risk Mitigation compared to more savvy individuals?

<comment><USER16> It's a problem with the way technology scales. Previously difficult things become cheap to do at massive scales, and companies make tons of money doing it.

But it also make vulnerabilities scale in the same way - <USER2> 150,000,000 SSNs isn't much harder than 150 - and the penalties for security lapses don't scale anything like the profits that operating at these scales does.

What's the solution to that? Bigger penalties so that companies prioritize security? Require companies handling data and devices to carry insurance against huge hacks? I don't know, but we need to get somewhere better than "Ignore it because consumers generally don't understand the risks and apology letters are cheap."

The one good thing about IoT locks compared to other internet security issues is that you need physical access to do anything with it. The script kiddies spamming SSH authentication attempts at every webserver from somewhere on the other side of an ocean can't break in to your house with this. Other IoT devices like security cameras are still a concern though; a vulnerability in those could scoop up a lot of private videos.

</comment></comment></comment></comment><comment><USER17> Locks are often fairly weak against real attackers.

I enjoyed this youtube video of another smart (fingerprint?) lock being broken due to a digital reset. It has a plastic panel on the front where the fingerprint reader is. If you remove the panel with a razor blade (it's just attached with glue), it even has a reset button exposed which resets the fingerprint. [https://www.youtube.com/watch?v=uVvEkcN5tW8](https://www.youtube.com/watch?v=uVvEkcN5tW8)

<comment><USER18> LockPickingLawyer also picked the same lock in OP's post. If you search for the MicaLock on Amazon, the page says it's just a FB50.

[https://www.youtube.com/watch?v=WeCGTosv- _c](https://www.youtube.com/watch?v=WeCGTosv-_c)

</comment></comment><comment><USER4> I'm a big fan of _electronic_ locks, but I refuse to have a smart lock. I know enough about IOT and security to know that a lock with a wifi chip might as well not be there at all.

I just program a few extra codes into the lock ahead of time, and if I need to let someone in in an emergency, I just give them one of my burner codes and delete it when I get home.

I don't really need a log of every entry because the camera pointed at my door already gives me one of those. :)

<comment><USER19> Why is a WiFi lock so bad? It opens you up more, but the number of people who can hack even the most insecure example is vastly smaller than the number of people who can kick down a door or break a window. Household locks are almost always just about deterring casual criminals, and internet vulnerabilities don't move the needle much on that.

<comment><USER4> > Why is a WiFi lock so bad?

Scalability. Once you know how to pick one, you can pick them all quickly and remotely. Kicking down a door or picking a physical lock takes time and effort and exposes you to scrutiny while doing it.

<comment><USER19> Picking a lock remotely seems rather pointless.

<comment><USER20> > Picking a lock remotely seems rather pointless.

From another country, maybe.

Via WIFI? You are not more than a few hundred meters away. Doing that from across the street is much more convenient. Once they are done, they can just walk right in.

<comment><USER19> Doesn't seem very scalable. Maybe you can knock over 10x as many houses in a night as a normal criminal. Normal criminals are 1000x (at least) more numerous, so it's not a big increase in the threat.

</comment></comment></comment></comment></comment></comment><comment><USER21> Doesn't this suggest that the unlock code comes from the "cloud" and not your phone/app? So if you loose internet access you are not able to unlock? Or maybe it locally caches the key?

<comment><USER8> First, this is obviously hilariously bad from a system perspective (un- authenticated/unauthorized rebind of lock) [1]

OTOH it appears the problem is entirely server side, and could be patched/mitigated by the provider?

It still seems possible that the _lock_ is secure-ish. It _might_ conceivably have some form of anchored trust (pinned cert?) to communicate with the server - and a secure/better rekey flow could maybe be implemented?

Still sounds crazy to delegate authorization _entirely_ to the cloud (I'm guessing you can open the lock wo internet, but not re-key).

I'm not even crazy about "find my phone"-services - and that's considering the vendor typically owns the hw, the kernel _and_ can push updates (ie: all bets are off anyway).

[1] I'm also curious about the "lock code" field in the data - does the service advertise the pin if you give the correct serial/hw ID of the lock? Or something else?

</comment></comment><comment><USER22> If someone picks a "dumb lock" and steals all of your belongings, does the manufacturer have any liability? What if someone picks your "smart lock"?

<comment><USER14> Home owners insurance typically covers theft of personal belongings.

<comment><USER22> Yeah but after that? How often do insurance companies go after the "dumb" lock manufacturer? Could the same be said about "smart" lock manufacturers? I would guess that this idea of a lawsuit against one of these companies is only an issue of "when" not "if".

</comment></comment></comment><comment><USER23> So pretty much 0% security success in every smart lock I've seen attacked. (I think I've seen 5 so far, every one had nuclear dumpster fire issues.)

</comment><comment><USER20> As a rule, hardware companies are crap at writing software. If the software is risky from a security standpoint, that's even worse.</comment>


404 to 301 Plugin Considered Harmful - <AUTHOR> https://www.wordfence.com/blog/2016/08/404-301-plugin-considered-harmful/ <comment><AUTHOR> The cloaking injection malware has been present for at least 3 months: [https://plugins.trac.wordpress.org/changeset/1428395/404-to-...](https://plugins.trac.wordpress.org/changeset/1428395/404-to-301) and apparently undergone several revisions for the bot-checking/cloaking.

As I see it, there are only a few explanations for what's going on:

1\. The author added the malware on purpose (and probably should be banned from publishing plugins on wordpress.org)

2\. The author had his partner add the malware but didn't understand the code (which, if he couldn't spot the malwareness of the the obvious content replacement hooks or the eleet "?v=1337" URLs, means he probably should also be banned from publishing plugins on wordpress.org)

3\. The author rented out his wordpress.org plugin author account and didn't pay attention to what it was used for (which means he probably should also be banned from having a wordpress.org plugin publisher account)

Odd that the wordpress.org staff appears to believe this multi month adventure was "a mistake".

</comment><comment><AUTHOR> With a follow-up post too: [https://www.wordfence.com/blog/2016/08/will- always-put-custo...](https://www.wordfence.com/blog/2016/08/will-always-put- customers-community-first/)

</comment><comment><USER2> Reply from the plugin author [0]. Seems like a genuine response, but I really don't buy it. IMO he knowingly added malicious code and is playing dumb. TL;DR he shared is credentials with another developer for a "partnership". He was completely unaware of any wrongdoing, and apologizes profusely.

I made 3 mistakes:

Used same account for all commits. Misunderstood the WP guidelines about remote content loading. Did not properly verify the remote server response, frequently.

....

I apologize

For making a BIG mistake that I could have avoided easily. For making a lot of users to look for alternative plugins. For not detecting this issue by myself. To the website owners, if you are affected by this incident.

I promise,

I will never share plugin commit access to others without having my control over it. My plugins will never break any WordPress plugin guidelines. My plugins will not break into users privacy. My plugins will be up to the coding standard that WordPress suggests.

[https://thefoxe.com/blog/404-to-301-plugin-detected-by- wordf...](https://thefoxe.com/blog/404-to-301-plugin-detected-by-wordfence- here-is-what-actually-happened/)</comment>


NSA Claims Iran Learned from Western Cyberattacks - <AUTHOR> https://firstlook.org/theintercept/2015/02/10/nsa-iran-developing-sophisticated-cyber-attacks-learning-attacks/

<comment><USER2> Of course they did. Greenwald's "exclusives" are starting to border on the inane. In a year or two, when Snowden's archives are even more dated and picked through than they are now, what, exactly, will Greenwald's shtick be then?</comment>


Bacon Ipsum - <AUTHOR> https://github.com/petenelson/bacon-ipsum

<comment><USER2> It would be nice for there to be a brief sample of the text it generates in the ReadMe, or a link to a github pages where its used.

<comment><USER3> [http://baconipsum.com/](http://baconipsum.com/)

It's at the top of the readme.

</comment></comment><comment><USER4> Very nice! I was going to give my vote to the guy who cured cancer, but this has more meat to it.</comment>


Automately - A scalable web automation API for developers - <AUTHOR> http://automate.ly/

<comment><AUTHOR> Hey HN! Creator of Automately here. Although there's not much details on the site because we accepting only early access requests right now I can definitely give you a little more details. Developers will be able to write automation scripts and run them. The automation scripts are written in JavaScript using a custom API. You will be able to submit automation jobs via the Automately API. Your job will be submitted to a powerful cluster and ran as fast as possible. You will be able to interact with websites and do many many other things. Stay tuned for more details :)

</comment><comment><AUTHOR> @mailarchis had a great point :)

Example automation script:

println("Opening Google"); browser.openPage("[http://www.google.com");](http://www.google.com"\);) browser.waitForSelector("[name=q]", 2); browser.getElement("[name=q]").sendKeys("Hello World"); println(browser.getTitle());

It's not much of an example we are accepting early access requests though :) You will definitely get more details on automation scripts.

</comment><comment><USER2> Nice idea. Reminds me of Zapier.

[https://zapier.com/](https://zapier.com/)

</comment><comment><USER3> How is this different from IFTTT [0]?

[0] [https://ifttt.com/](https://ifttt.com/)

<comment><AUTHOR> Automately is going to allow developers to write their own automation scripts connecting to websites of their choice. You won't be limited to channels, just your creativity and what you can do.

</comment></comment><comment><USER4> What would be a few use cases for this?

<comment><AUTHOR> There are many things you could do with Automately! You could create new APIs that connect your services to other sites automating lots of things! For example you could create a banking API that connects developers to banking data. You could use Automately to connect to banks that offer online banking!

</comment></comment><comment><USER5> Please look at selenium webdriver And the webdriver w3c draft API

<comment><AUTHOR> Selenium of course does provide web automation technology but here at Automately we are trying to do more than that. We are trying to put web automation in the hands of developers as fast as possible and inspire them to create new things.

</comment></comment><comment><USER6> What's an automation script in this case?

<comment><AUTHOR> A simple script written in JavaScript. You write code using our automation API interacting with websites making clicks, anything you would normally do as a normal person interacting with a web browser except using JavaScript to do it! And a lot more!

<comment><USER7> Hi, I guess you can make your messaging more powerful if you add in an example automation code to show an use case.

It looks like a cool idea. All the best.</comment></comment></comment>


How Siri will change our classrooms - <AUTHOR> http://prezi.com/v10kmyn5ym97/how-siri-will-change-our-classrooms/

<comment> vezzy-fnord Oh yes, another proposed silver bullet to latch onto for improving education.

The presentation makes this out to bring very profound changes, but this is something I honestly doubt. A voice-controlled information aggregator might prove useful for quick lookups, but it won't dispense in-depth research.

It's almost as if they think Siri will make schools obsolete. Then you have the ethical conundrums of proprietary software to contemplate as well for such a core part of your curriculum.</comment>


How the 49ers Are Using Beacons to Help You Find Hot Dogs and Beer - <AUTHOR> http://techcrunch.com/2014/11/04/how-the-49ers-are-using-beacons-to-help-you-find-hot-dogs-and-beer/

<comment><USER2> Can anyone with a little more knowledge about either iBeacons or WiFi MAC Address triangulation explain how active or passive one needs to be in order to participate or opt-out of such activities? From what I understand, the iBeacons can only interact with your phone if you have a specific app installed, e.g., if you have the 49ers app installed on your phone and you have Bluetooth enabled, it listens in the background for iBeacon broadcasts and might show you the corresponding push notification that it has downloaded when you get within range of iBeacon x. At the same time, the venue can determine your location accurately down to the spacing of the beacons. What happens if you have Bluetooth enabled (but not visible) but not a venue sponsored app? Are iBeacons (or similar Bluetooth beacons) capable of mapping these users? I presume that no push notifications could occur in this case.

As for WiFi triangulation, my limited understanding is that it relies on users walking around with WiFi kept on. Can push notifications occur even if the user doesn't connect to the venue's WiFi but has a sponsored app? Is a phone's active search for familiar SSIDs enough for venue hotspots to observe the movement of MAC addresses/phones? What about a phone without a sponsored app and WiFi enabled but not connected? (I think this is the 'sunsetted' tech mentioned in the article.)

Thanks.

<comment><USER3> According to [http://nfarina.com/post/101309491728/lets-talk-about- beacons](http://nfarina.com/post/101309491728/lets-talk-about-beacons) , all iBeacons do is broadcast over bluetooth a unique id, which your phone can read silently.

From there, specific apps installed on your phone will register to specific ids to listen to, and then can send that information off to a third party if the phone is connected to the internet.

</comment></comment><comment><USER4> From the comments: _If only they 'd use these to find the damn endzone._

</comment><comment><USER5> I wish they'd use them to find an exit from the stadium that doesn't take two hours.. I know all new things have growing pains but all of the tech and logistics at Levi's has left me very disappointed thus far.

<comment><USER6> More disappointing than the team playing at Levi's?

</comment></comment><comment><USER7> I'm not commenting on the technology, but the organization itself.

They did a terrible job with that stadium. Want to know a terrible way to spend a Sunday? Staring directly into the sun watching a football game and succumbing to splitting headaches for 24 hours. They spent over $1B, they should've made the stadium a dome in that Santa Clara weather (like the stadium in Arizona) instead of positioning 75% of the crowd directly at the sun!

All the apps, beacons, and concession stand technology in the world won't keep fans in those seats during the game.

</comment><comment><USER8> Major challenge here (at a guess) is activation. The majority of the advertising/activation will come in-situ at the stadium. But 100,000 people trying to download an app over a cell network in that kind of proximity is going to be trouble. I can't even access Twitter at Stamford Bridge in London (40,000 people).

</comment><comment><USER9> Considering the scale of impact this kind of technology has the potential to have, I'm surprised at how little news there is out there on it. It will be interesting to see how it all plays out when the public figures out just how ubiquitous this little toys are going to be ...

</comment><comment><USER10> Anyone have a good source for bulk beacon purchases? I need 200+ in the next 3 months.

<comment><USER9> Gimbal can should able to do that, though I would avoid their series 10 beacons if you want the battery to last more than 2 weeks. Series 20s are a bit big (a little larger than wallet sized) and use standard AA batteries (4 each) instead of something exotic.

There's also [http://kontakt.io/](http://kontakt.io/) but they require a more exotic battery. I'm not sure about production capacity though.

<comment><USER11> I've had the same experience with battery life on the series 10 beacons as you. Haven't tried the 20 yet. What're those like as far as general battery life goes?

<comment><USER9> To tell the truth, I don't have experience with one running dead yet. We've had a few around the office for the last 4~5 months now.

</comment></comment></comment></comment><comment><USER12> Two Aruba Beacon stories on the front page of Hacker News in the same day?

<comment><USER13> I find beacons a novelty item outside of true targetted tracking ala York's "free" WiFi.

</comment></comment><comment><USER14> Now if only they could use them to find the endzone...

</comment><comment><USER15> And closest paramedic in case of heatstroke .

</comment><comment><USER16> This is innovation? Why would anyone waste their time developing this?

You know how you find beer and dogs at a stadium? Go walk the concourse! Follow the smell! Flag down a vendor!

What an utter waste of time and money.</comment>


SSL certificate error on the CloudFlare site - <AUTHOR> https://www.evernote.com/shard/s2/sh/5093447c-c999-4243-bae6-292a5a79e825/cad242ab7895c2f8fbf5f1c65e26ca75/deep/0/SSL-Error.png <comment><USER2> It appears to be presenting the one of their repertoire of expected SSL certs: [http://imgur.com/rzzG5Hz](http://imgur.com/rzzG5Hz)</comment>