The Native File System API allows web apps to save directly to files - <AUTHOR> https://web.dev/native-file-system/ <comment><USER2> There is no way this isn't going to open up massive security holes. Even if the browser puts up alert after alert, people are just going to randomly click buttons and then all of a sudden wonder why some random web app is deleting all their files and adding malware. And the spec docs aren't exactly reassuring. This is an exact quote! "This API could be used by websites to try to store and/or execute malware on the users system."

<comment><USER3> This is just a variation on <input type=file> as far as read-access is concerned.

For write access, it certainly could be used to store malware on a user's system, but so can "Save As" or clicking a link with HTTP headers that triggers a download. Basically, the "Save As" dialog from browsers have the same issues.

It is not downloading malware that is the issue, it's executing it. So unless you can trick the user into navigating to an existing binary that is normally executing on the system, and have the rights to replace it, executing is not any different that triggering the user to put something in his ~/Download directory and asking him to paste a shell command.

The API doesn't not provide a way to mark something executable, and it should block you from obtaining write access to any file already marked executable just like many mobile OSs don't let you simultaneously mark a page in memory as writable and executable.

The last one looks like a flaw, I couldn't find anything in the spec that says "thou shalt not let the user open a file marked executable for write access", although it does suggest banning access to stuff like C:/Windows, /usr, /Applications, etc.

But what really bothers me is people making uninformed comments. Rather than knee jerk trigger anytime any browser API is changed without fully reading the spec and then actually pointing out any weaknesses, we get the same low signal commentaries.

So again, browsers already allow unaware users to be tricked with bog standard fileupload form elements and Save As dialogs. This just breaks a hardcoded high level UI into smaller reusable parts, and it actually adds more concerns over security than the original 1997 spec for file upload and save.

<comment><USER4> It's important not to forget about drive-by DLL injection when making the "execution is the problem" argument.

Lots of executables on Windows link to DLLs that are not protected by the "KnownDLLs" protection. This means that if you can save a malicious DLL next to that executable you can make a perfectly legitimate executable run malicious code.

I haven't read into the API yet to determine how it protects against this, but it's definitely more nuanced than the argument you're making.

<comment><USER5> > _This means that if you can save a malicious DLL next to that executable you > can make a perfectly legitimate executable run malicious code._

Some people install browsers onto a USB drive -- or even run a browser directly from their Downloads directory. Such people are easy targets for this type of thing.

<comment><USER6> Running a browser from the downloads directory is unlikely to work correctly on macOS.

<comment><USER7> It's funny you say this, because I did exactly this yesterday. I downloaded chromium and forgot I had not yet dragged it to my applications folder and I was running it for a few hours out of my downloads folder.

<comment><USER6> Google Chrome ships in a DMG, doesn't it? This means that if it is running out if your downloads folder, it's not subject to the things that would mess it up because you dragged it there.

<comment><USER8> I think Chromium does get shipped as a normal executable, it's only Chrome which gets released as DMG.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Browsers having unfettered access to users files is something which should be mitigated against on all platforms, not fleshed out into an ill-conceived feature, it goes in complete contrary to browser sandboxing efforts in Chrome itself for different process types (renderer/gpu/utility), but also work like OpenBSD has done with pledge(2)/unveil(2).

On OpenBSD, all processes of chromium, including the main browser process are tightly pledged and unveiled by default, write access to the users home directory is limited to only a few paths (~/Downloads), and a few config directories. As a consequence, users are rather forcibly taught safer usage pattern of copying files into the unveiled paths when uploading, which as Bob Beck alludes to in his slides below, is a reasonable compromise to every website having access to your ssh keys.

[https://www.openbsd.org/papers/bsdcan2019-unveil/mgp00022.ht...](https://www.openbsd.org/papers/bsdcan2019-unveil/mgp00022.html)

[https://github.com/openbsd/ports/tree/master/www/chromium/fi...](https://github.com/openbsd/ports/tree/master/www/chromium/files#:~:text=unveil.main)

<comment><USER10> The histrionics here are astounding considering they're about a _Save As_ dialog.

<comment><USER11> It appears I could use this to ask a victim to "select your downloads folder" to save files to and then steal or overwrite any file in it.

<comment><USER12> If the permissions system in place is clear and potent enough, I don't see the problem.

You can also ask people to simply download and install an app that can do whatever it wants.

It's 2020 and we still can't build web apps that can read and write to local files. Browsers are no longer useful just for reading text.

<comment><USER11> The permissions system seems to be granular with respect to whatever was selected - if you select a directory you have full access to everything in it. Theoretically the permission system requires explicit approval, but if you see the security system with the user I think it presents more risk to users than before.

Previously if you wanted filesystem control you had to trick a user into downloading something. With this API, it seems like it would be easier to con unsuspecting users into granting permissions they aren't aware they're granting.

</comment></comment></comment></comment></comment><comment><USER13> There is a comment on this by Martin Thomson, Mozilla Distinguished Engineer, member of Internet Architecture Board:

"But my initial assessment is that the protections described in the spec are inadequate and I am of the opinion that this should be marked _harmful._ " [0]

[0] [https://github.com/mozilla/standards- positions/issues/154#is...](https://github.com/mozilla/standards- positions/issues/154#issuecomment-668923566)

[1] Specification Positions [https://mozilla.github.io/standards- positions/#native-file-s...](https://mozilla.github.io/standards- positions/#native-file-system)

<comment><USER14> The points brought up by @cromwellian in [https://news.ycombinator.com/item?id=24416738](https://news.ycombinator.com/item?id=24416738) are important in the context of the present comment, too.

<comment><USER13> cromwellian > "But what really bothers me is people making uninformed comments. Rather than knee jerk trigger anytime any browser API is changed without fully reading the spec and then actually pointing out any weaknesses, we get the same low signal commentaries."

This may sound dumb too, but I expect my browser just show me web. When I reset my browser (and IP address), I expect a clean slate, and with this API I won't get it. When I install apps, I use very different due diligence. Without clean slate after resetting my browser, I'd have to change my browsing habits radically [0].

A side note, DNS over HTTP (DoH) bothers me too, spec is silent about setting cookies, DoT is cleaner in this regard.

[0] [https://en.wikipedia.org/wiki/Chilling_effect](https://en.wikipedia.org/wiki/Chilling_effect)

<comment><USER15> > When I reset my browser (and IP address), I expect a clean slate, and with > this API I won't get it.

Browsers don't currently give you that, and never have. You can download files, and these files remain on your system even if you re-install your browser.

> This may sound dumb too, but I expect my browser just show me web.

Browsers are just a sandbox for running applications that are downloaded over the network. Some applications need web cam access, some need access to files on your system, some need geolocation, and so on. Browsers let you choose what permissions to give applications. Because of this, you're completely free to let your browser just "show you the web" in whatever sense you like.

</comment></comment></comment></comment><comment><USER16> I'm gonna throw an unpopular opinion out there: The real issue is not that phones or browsers have too much capabilities but rather that people fundamentally don't understand how to use computers. Locking things down and removing features doesn't really solve the problem just like wrapping your child in bubble wrap before crossing the street instead of teaching it to look both ways for cars doesn't solve the problem. Digitalization is being sold as a land of opportunities but no one ever tells people what the software they're using is actually capable of and how to control it. And that's why people vote for digital elections and accept all permissions and cookies and shrug mass surveillance off with "they know everything about me anyways".

<comment><USER17> But then the solution becomes: stop using computers, because the kind of sophistication required is out of reach for a very large part of the population. So, computers will stay part of everyday life. Making the interface simple and predictable, and locking features that can be abused may be fighting the symptom, but it's better than nothing.

<comment><USER18> > So, computers will stay part of everyday life

I don't think this is a guarantee. Already most people's primary computing device is their phone; there are households where everyone has a phone and a couple iPads and no PC; and iPads or Android tablets seem to be fairly common as POS terminals and kiosk devices.

PCs will definitely always be around for serious content creation and heavy work; but the group "very large part of the population" is also the group that is less and less likely to own a PC or use one other than at work or for school.

<comment><USER17> Tablets and phones are computers, IMO. They're still general purpose machines. For many tasks, their interfaces are less confusing than a desktop's interface, which is progress, but when it comes to web apps, there's no difference, and especially phones can be really clumsy.

Not using computers would be falling back to paper forms and mail.

</comment></comment></comment></comment><comment><USER19> As much as they try to add security to this feature it inherently breaks out of the "sandbox" concept of the browser and scares me.

<comment><AUTHOR> nowadays' security is that you have to manually grant permission, which for most people, esp non-technical people, they will normally just press Y, so yeah, the default sandbox protection will be gone for most people.

<comment><USER3> You have to do more than just hit 'Y', you have to navigate in a file chooser and pick the file to save, or write.

<comment><USER20> Sure why not, let me just create a blog post, with exact steps on how to make your windows more colorfull, and make users inject my DLLs into filesystem. The user will do exactly if i give him exact copy paste paths and commands. And voila.

<comment><USER3> You can do the same exact thing without this API, so what's your point? How do you think most call center scams work? By asking the user to download an executable that owns their system and run it.

<comment> yjftsjthsd-h It's possible for this to reduce steps / make the exploit process easier, and to do so without the "download this file and run it" step that should trigger a red flag to people.

</comment></comment></comment></comment></comment></comment><comment><USER21> We've been trialling the Native File System API in our PWA Construct 3 (a browser based game editor - [https://www.construct.net](https://www.construct.net)).

I think it's absolutely fantastic, and users love it too - it gives them exactly what they expect from IDE-style software in the browser, such as "Save as" to any location on disk, and the ability to use folder-based projects (that are spread across multiple files).

The security concerns are obviously important but I'm pretty confident it's largely mitigated through the permissions model (which is similar to one Windows Store apps use). Also as noted elsewhere, existing web features already allowed reading files and even entire directories; the writing files part is new, and you cannot choose system directories, or ask for too much (e.g. root of the user directory).

So in short I think this is great news for the web and a big step towards allowing web apps to reach parity with desktop/native apps, while managing to do it in a reasonably safe way.

<comment><USER22> > Also as noted elsewhere, existing web features already allowed reading files > and even entire directories;

None of theses access are persistent though.

> the writing files part is new, and you cannot choose system directories, or > ask for too much

If only that was enough.. there's plenty of important file outside of what will be defined as "system directories" by whoever define them.

I love particularly this part of the documentation:

> Another risk factor is that of ransomware attacks. The limitations described > above regarding blocking access to certain sensitive directories helps limit > the damage such an attack can do. Additionally user agents can grant write > access to files at whatever granularity they deem appropriate.

They are perfectly aware of the risk, yet completely ignore it. At least it won't be whatever the browser define as "sensitive directories".

</comment></comment><comment><USER23> It seems like I can replace an Electron app which only needs (a part) of File System access to browser.

<comment><USER24> Precisely. You'll also gain the ability to update your apps cheaply (via the web) and bonus security points by not being beholden to Electron updates.

<comment><USER25> more like "you won't have a choice but to always use the newest version of the app"

<comment><USER25> I get that you dislike electron, but that doesn't take away from the truth: don't like the latest version of an app? too bad, you just have to get used to it or stop using it

<comment><USER26> What a ridiculously user-hostile attitude. It's not about Electron, it's about the loss of control. It's one of the big problems with any sort of forced- update software delivery: Web apps, SaaS, snaps, etc. The new version drops a feature I need? "Too bad." The new version doesn't work right on my computer? "Too bad." The new version has a bug that is blocking my work? "Too bad."

</comment></comment></comment></comment></comment><comment><USER27> Reminds me of the old ActiveX days - I wrote a whole WYSIWYG website editor using the ActiveX component that let you read/write files.

I mean that was fun for a young budding developer, but I can see the major security issues with this. I really hope this has been thought through.

I can imagine this being another one of those popups that constantly appear on websites - are certain files protected like your hosts file or does it rely upon the access level of the user running the browser?

</comment><comment><USER28> Might not be appreciated opinion here but Personally, I think, the web starts to get feature parity in some way with Adobe Flash. Flash could do most of this back in the day and now the web is getting it too.

<comment><USER29> Absolutely. It feels like we're finally almost back to the level of functionality browsers had in 2010 with Flash/Java Applets.

</comment></comment><comment><USER30> It's not clear to me how the Native File System API relates to the existing File System API.

[https://developer.mozilla.org/en- US/docs/Web/API/FileSystem](https://developer.mozilla.org/en- US/docs/Web/API/FileSystem)

Is Google proposing this as a replacement? As a supplement?

I made heavy use of the FileSystem API in a cross platform educational application a few years ago, tripping over a really hairy memory leak bug in Webkit along the way. By the end of that project the API had been deprecated, but apparently now it isn't any more and instead it's experimental? I have no idea what that means.

<comment><USER14> The old File System API interface will not grant you access to the users filesystem. Instead you will have a "virtual drive" within the browser sandbox. The Native File System API gives you access to the actual file system.

<comment><USER30> Ah, yes that makes sense. Thanks for clearing it up.

</comment></comment></comment><comment><USER31> Ok, so first, tell me how to block it.

Running firefox in a container?

<comment> yjftsjthsd-h Sounds like there's a flag in Chrome for the moment. After that, yeah some sort of container or sandbox seems like a good idea (TBH I'd argue that it's a good idea regardless of this change). I named some options at [https://news.ycombinator.com/item?id=24421622](https://news.ycombinator.com/item?id=24421622)

</comment></comment><comment><USER32> Serious question. Since this is going to be enabled by default by Chrome 86, is there any way to block Javascript from using the API? Or force it to ask for permissions? Because it seems like anything that uses the API by default has full access to my filesystem (at least based on the demo on that page). That seems insane. I don't even want anything JS-based to _see_ my filesystem. That's a huge breach of privacy.

<comment> yjftsjthsd-h Not exactly what you're asking, but some thoughts:

* There is, for the moment, a flag to disable it, right?

* You could probably just have noscript/umatrix block JS outright (yes, I know this is overkill)

* Sibling comment is probably right in that Firefox is likely to not implement this immediately, if at all.

* You could also do it from the outside by sandboxing the whole browser; this is a somewhat poor mitigation (ex. leaves your Downloads directory wide open), but it could help.

<comment><USER33> There's also Luminous[1], which can allow blocking individual JS events (eventAddListener and handleEvent calls). Something like that could also be extended to allow blocking of other API calls.

[1][https://gbaptista.github.io/luminous/doc/en- US/](https://gbaptista.github.io/luminous/doc/en-US/)

</comment></comment></comment><comment><USER34> I read over the document and the security considerations don't seem super clear. If I find an XSS on Cloud 9 or some other web-based IDE that users are likely to grant directory permissions to, I can ransomware every file in that directory without requiring extra permissions?

In other words, granting this permission is effectively the same level of severity as downloading and running an app.

Am I missing some extra consideration here?

</comment><comment><USER35> Were there users that were asking for this feature?

</comment><comment><USER36> I'd feel safer if all applications could only access files tagged with an unique ID for the application.

But then applications will start asking access for all of $HOME and we're back to square one

<comment><USER37> Create separate user for every application and run it under that user.

</comment></comment><comment><USER38> > Chrome 86 Enables the Native File System API by Default

Not only is this not the source title, but this information nowhere in the linked article.

It's _true_ , but the linked article only very indirectly suggests the possibility in that the most recent origin trial ends in Chrome 85.

The Chromium blog post on 86 does indicate this directly: [https://blog.chromium.org/2020/09/chrome-86-improved- focus-h...](https://blog.chromium.org/2020/09/chrome-86-improved-focus- highlighting.html?m=1)

<comment><USER39> There's some things in 86 that are even more interesting imo, mainly FTP support is finally being removed. Crazy that something so integral to the early web is now not even worth supporting in the browser.

<comment><USER40> Hmm. I used ftp in the browser yesterday. We have a large forest fire here which led me to look at detailed maps the incident team produce showing burn boundaries etc. These are published via ftp.

</comment></comment></comment><comment><USER41> Every time Chrome adds a new API it is nearly always abused by ad networks and tracking companies to fingerprint users.

If you're bored one day you should consider reverse engineering some ad network code. You'll be stunned at the insidious practices used.

<comment><USER24> We made sure that the activation of the API is gated by:

1) User Activation checks 2) When access to the file system is requested, a File Picker is necessary 3) When the API is in use, there are plenty of indication that it's being used

We put a lot of thought in Privacy and Security, as we do for all APIs.

<comment> or-gate > We put a lot of thought in Privacy and Security, as we do for all APIs.

but somehow, data is heavily harvested thru browsers(chrome), apps(android). Do you even test your APIs with a sample audience, like real tech ignorant people and see how they are blind to all those and just click yes, and don't care?

<comment><USER42> Data is easily harvested in Firefox and Safari too

<comment><USER20> Exactly, the focus must be on trying to mitigate it, not make it more easier.

<comment><USER42> Should they block online email providers too because someone might send a phishing email?

<comment><USER20> Yeah so there are few dozens of ways people are getting spammed, why not lets add more ways. Here's an Idea let me write a blog post on how to make windows look cooler and ask my 12YO user to point me to their windows directory and let me use my API to inject my DLLs, none of the defenders of this API are not estimating the level of social engineering, and how dumb users can be, and also the reason why Android failed in terms of privacy.

<comment><USER42> You forgot to read the part where they will block certain directories, and your 12 year old could easily install malware or give out his password, and Android did't fail in terms of privacy. Apple has failed by locking you into a closed-source ecosystem. Android is open source and has a lot of options, and a lot of open source apps you can review yourself and pick the best cryptography algorithms for password management, etc.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER43> Inevitable.

I've been saying for 10+ years that browsers will integrate more and more into the OS until they become another layer that users aren't even aware of. Sort of like Electron. Imagine web apps that can render native widgets and show up in the taskbar separately.

This is just another inevitable step towards that. The only concern is how secure this will be, and from the sounds of it, the answer is not very. Still, it's inevitable that some form of this will become popular.

</comment><comment><USER44> Just when you thought nothing could be dumber than WebUSB....

</comment><comment><USER42> Finally, we can have a local markdown editor with live preview. I just hope it can read files and folders in a particular directory as well, with permission of course.

<comment><USER45> Not sure why you would say that. Maybe try some vscode extensions such as "Markdown Preview Enhanced" or "Markdown All In One"? Those works both offline and local.

<comment><USER42> VS Code sucks and if I were to go the route of a different app there are lot better options out there for markdown editing. This feature has a lot of amazing potential, but some people like the Apple-model so much that they'd prefer only being told what they are allowed to do.

<comment><USER46>
        This feature has a lot of amazing potential

Lots of potential for abuse, especially. Any API introduced into an industry- controlling browser granting too many local privileges seems absolutely wild given that the Internet's full of people trying new and creative ways to scam, hack, or otherwise inconvenience end users.

As someone with professional experience in web security, this API is like a nightmare come true.

<comment><USER47> This is "Open File" and "Save File" taken API form. Right now web apps can already read and save files with uploads and downloads. This just allows the user to pass a file descriptor to the app rather than a copy of the file's contents.</comment></comment></comment></comment></comment>


SXSW threatens international artists with deportation over unofficial shows - <AUTHOR> http://www.avclub.com/article/sxsw-threatens-international-artists-deportation-p-251394 <comment><USER2> This language obviously wasn't run by a lawyer or anything. "Revoked passport" is really not a thing that the US is capable of doing to citizens of other countries. They also get the name of CBP wrong.

What a weirdly sloppy and threatening contract.

<comment><AUTHOR> From what I understand via second hand comments (some from the AV Club itself) it may be standard Guest Worker Visa type boilerplate. At least at the core. Now, whether SXSW turned up the volume to make a point / wipe-their-hands- clean is probably a bit more for conjecture.

A good number of bands drop in to Dallas if they're playing SXSW, but I don't know if that option or this new highlighted tone might have any affect.

Honestly unless a band is really being courted / funded by somebody with deep pockets, I don't know how the band would show up to Austin / the US just for one show. I mean, for most international bands, I'd hope for their sake they're already here on Guest Worker Visas for their music act. I do know Pogo from Australia learned the hard way via the IRS...

But, I don't say this lightly, there's probably a good number of bands being flown in by corporate interests just for SXSW bragging rights so maybe this actually has teeth. I mean, it's not an "indie darling" anymore. It's the kind of place where they have acts playing on a stage that is an oversized Doritos vending machine[1], and caught so much flack for it they finally dialed some things down. Like using Homeless people as WiFi spots[2].

[1] [http://www.brooklynvegan.com/files/img/music2/doritosjacked....](http://www.brooklynvegan.com/files/img/music2/doritosjacked.jpg)

[2] [http://www.npr.org/sections/thetwo- way/2012/03/13/148506762/...](http://www.npr.org/sections/thetwo- way/2012/03/13/148506762/turning-homeless-men-into-wifi-hotspots-at-sxsw- ignites-debate)</comment></comment>


The next step in presentation design and sharing? - <AUTHOR> Presentation decks are a great way to communicate and share ideas. Imagine a tool mixing the share-ability of Google Slides, with the power of native apps like Keynote or PowerPoint. Up to the expert features of Sketch. Through the integration power of Slack.
Please meet Ludus One. We aim at solving the equation, by being the single destination for content creation and sharing. We gather the best of the web in a simple and intuitive tool for everyone - especially professional designers and marketeers.
www.ludus.one <comment><USER2> awesome vision!

<comment><USER3> Thanks! :-)</comment></comment>


"So what's your number?" ... "I don't do cellphones" - <AUTHOR> http://musings.navchatterji.com/post/128106472/so-whats-your-number-i-dont-do-cellphones <comment><USER2> Interesting enough but his "exercise in simplicity sans cell phone" hardly seemed an exercise in simplicity, nor one without a "cell phone" (just replaced with another digital device).

<comment><AUTHOR> Agreed, could have been termed as an exercise to reduce noise. Thought it was interesting none the less.</comment></comment>


Driverless Mercedes E-Class sedan set for sale in March 2016 - <AUTHOR> http://www.wearobo.com/2015/06/upcoming-mercedes-benz-e-class-sedan.html

<comment><USER2> I understand the logic behind shutting off the system if the driver takes their hands off the wheel, so as to put the responsibility and fault on the driver.

But what about fallbacks for the driver's error? When I think about the dangers of allowing living beings to drive two ton death machines, I think about: brain aneurysms, drunk drivers, and falling asleep at the wheel.

I guess we're still a few years away from consumer self-driving systems.</comment>


The Last of the Zoroastrians - <AUTHOR> https://www.theguardian.com/world/2020/aug/06/last-of-the-zoroastrians-parsis-mumbai-india-ancient-religion <comment><USER2> Very nice piece. Enjoyed that, learned alot.</comment>


Why Combinator? Should You Join Paul Graham's Gang For The Gifted? - <AUTHOR> http://onstartups.com/home/tabid/3339/bid/1319/Why-Combinator-Should-You-Join-Paul-Graham-s-Gang-For-The-Gifted.aspx <comment><USER2> The "gifted" is a little misleading. We're pretty explicit that we think succeeding in a startup depends more on determination than intelligence. Oddly enough, though, "gang" is on the mark. One of the unexpected consequences of funding large batches of startups is that they form a fairly tough peer-to- peer mesh to help one another.

<comment><USER3> So, does the gang have a hand signal?

<comment><USER2> Probably the finger-wag:

<http://www.flickr.com/photos/socialmoth/405509951>

(Rtm started it.)

<comment><USER4> _shudder_

I just don't get people who use segway without trying to make a joke. Is walking so hard?

</comment></comment></comment></comment><comment><USER5> "Teams vs. Individuals: YC leans strongly towards selecting startups that two or more founders. I'm a strong advocate of this myself as I believe that having two or more founders in an early-stage startup significantly improves the chances of success. By explicitly stating this requirement, YC forces early-stage entrepreneurs to find co-founders. This is a good thing as if there's a problem with finding a co-founder, that's an early signal of a problem (either with the founder or the idea or both), and everyone's better off knowing that sooner rather than later."

I am trying to understand why he is trying to discourage single founders in contrast with YC that is not doing that. If someone is determined to commit to his ideas, then not founding a co-founder will not discourage him. And its better than leaving your ideas completely.

We know it's hard more than anyone who hasn't experienced it. I just don't understand the absolute attack towards single founder from his side. He should know that if someone decided to take the single founder route he is absolute aware of the effects of the choice.

And if it's hard to be single founder, its better than finding someone who you are not aware of his real character and passions.

I dont like it that in order to differentiate themselves or not, from the fear of copying themseleves (some "journalists") and from saying the exact word of someone, they use some point of reference to later exagerate it. And I am reffering to the phrase "explicitly..." who is contrary to what YC sais i think..

I don't really like the writer's attitude attacking his readers -- am I the only one here?

<comment><USER6> _"I don't really like the writer's attitude attacking his readers -- am I the only one here?"_

Surely you're being a bit sensitive because this topic hits so close to home. Try not being so defensive, sometimes the last thing you want to hear is just what you need.

You may be discouraged, but I don't think he's _trying_ to do that. He just happens to agree with almost everyone I've heard from on this issue. Feel free to prove yourself as an exception, no one has said it's impossible.

Maybe collecting a list of single-founder companies would be inspirational for you? Here's some off the top of my head: Brad Fitzpatrick/LiveJournal, Markus Frind/PlentyOfFish, Mark Fletcher/ONElist.

<comment><USER5> I was honest responding to an honest attack.

I can't believe he wasn't aware and expecting single founders would read the article. I accept opinions. I don't accept misrepresentations of opinions.

I prefer sounding hard than being silent.

circa 2007 "The ideal company would have two or three founders. We'll consider those with four or five. We're very reluctant to accept one-person companies, though we have accepted a couple." <http://ycombinator.com/s2007.html>

<comment><USER7> I must be missing it. To help me understand the error in my ways, can you:

a) identify specifically the part where I attacked?

b) cite where my position on the issue tried to be a statement of fact that was wrong.

Truth is: I do _believe_ (as do many others) that having more than one founder increases of success. PG has gone on record as saying he won't fund startups with just one founder. Neither of these is factually incorrect. I could be wrong to believe it, but the statement of fact that I believe it is true.

<comment><USER5> a)the use of "explicitly": means absolutely--categorically

"there's a problem with finding a co-founder, that's an early signal of a problem (either with the founder or the idea or both),"

b) the fact that YC states they funded single founders is contrary to what you refer to

I never said that is not better to have more people.

<comment><USER7> Got it. Fair enough.

</comment></comment></comment></comment></comment></comment><comment><USER8> Gang for the gifted? I kinda thought of Y Combinator as a School of Rock for web entrepreneurs. ("One great website can change the world!")

<comment><USER9> _' School of Rock for web entrepreneurs.'_

I cracked up reading this (after having seen a repeat of it) & also because pg's post really does puts the 'gifted' quote from the original post into perspective. You've got to have the 'determination' to build the best damn product (performance) you can.

</comment></comment><comment><USER3> "I think YC leans a bit too heavily towards the 'build it and they will come' model and for inexperienced entrepreneurs (just about all of the YC founders), this can distort reality."

MSPW != field of dreams.

What YC actually says is that MSPW is more important than monetization.

<comment><USER2> or more precisely, harder

<comment><USER3> oops. yay for clear thinking :-)

</comment></comment></comment><comment><USER10> I do agree that one of the great things that YC brings to the table are early users, who are willing to try thing sout and point out the problems.

The people who are spending time following YC companies are the ones who are more likely to give the site a shot- They're also often people who CARE about UI, Ease of use, and the other features that teams often Need reminding about.

Having 10 e-mails in the morning yelling that the new change makes things tougher, or that the background color causes eye-bleeding helps to avoid a Myspace-like situation.

Having the "Right" first users is crucial, and YC helps bring them (As does Reddit, if you're up to making it there, but that's a tough crowd at times.)

</comment><comment><USER11> "7. Projects vs. Businesses: Personally, I think YC is... not really concerned with selecting what may... become "real" companies... I think YC leans a bit too heavily towards the "build it and they will come" model..."

I'm not sure he understands the YCs' insight that startups with lots of happy users almost always succeed financially, one way or the other - the only things that kills them are founder fights, and major blunders, etc.

<comment><USER7> Well, I could argue (and will) that the two are not mutually exclusive. Startups that think at least a wee bit about how to build a business may earn themselves more runway and hence have higher chances of ultimately building something users will love.

<comment><USER12> I have never met a YC company that wasn't thinking about how to build a business.

The key thing to understand is that if problem A is 100 times harder than problem B, and problem A is critical to success, then you should spend a lot of time worrying about problem A. In this case, problem A is building something that people will want to use. If you fail at that, then none of the other problems matter, because you have failed.

</comment></comment></comment><comment><USER13> I think with Internet based companies, it is kind of counterproductive to focus on monetization at an early stage. This is because many innovative web companies tend to change the economics of how people make money in an industry. The best example of this is Google, that is shaking up the software industry by practically giving software away but earning revenue through advertising.

Changing industries requires a lot of industry clout, which I think YC gives its budding companies, freeing them to concentrate on designing good products that create value. If the product is really good and creates real value, the industry will reshape itself somehow to reward the entrepreneurs.

</comment><comment><USER14> Dharmesh is a smart guy and I enjoy his blog entries, but I just don't see eye-to-eye with him on #7 (Projects vs. Businesses).

We're not business people (most of us); we're just trying to create cool things and subsequently be freed from the shackles of the nine-to-five life. The great thing about Internet entrepreneurship is that it's relatively easy to get off the ground, and subsequently we can create products that are solutions and not immediately worry about the business model. It doesn't hurt to keep it in mind, but we don't have to let it weigh us down. I mean, search wasn't the best business to begin with.

<comment><USER7> Thanks for the compliment. I've struggled with articulating my position on this issue, and still haven't nailed it yet. Here's another pass:

I completely get the fact that projects are not a bad thing. Most of the best businesses actually started out as projects.

It makes total sense for me that startups should pursue building something people want (and make that the focus). However, a subset of these are projects that seek to build something people want AND that they will pay for. I'd further argue that within this particular subset of ideas, the optimal choice might be to build something people will pay for from the get go. In these cases, it would be sub-optimal to simply strive to build something people want.

I guess what I'm trying to say is that in some situations, trying to find the problem that people want solved AND will pay for ends up putting the startup on the right idea wheresa if they simply tried to build something people want, they may wind up in the wrong place.

Not all software is best served by creating something that will be subsidized by another activity (like advertising). I think it's jumping too quickly to that assumption that I think has the chance of being misguided. Sometimes the right answer is building something that people will part with money for and you have to start with that end in mind to really get there.

</comment></comment><comment><USER6> _"I think there's some value to actually thinking about business models earlier in the process. Simply identifying market opportunity (i.e. how do you make money)"_

I think at least it's a valuable exercise to imagine that you're not going to have a free version of your product. Imagine that you're actually _selling_ it to a real customer. Would you be embarrassed to say it costs money? How would support work differently? How about uptime? Who would actually pay?

I'm not sure that's necessary in all cases, but it does seem to raise a lot of interesting questions useful for self-examination.

</comment><comment><USER15> I'd like to hear from those who "consciously chose not to apply at all". So far it seems that if you're going to build a typical web startup, then being funded by pg is always a net positive... I'm more interested in learning about the other ways of doing it.

</comment><comment><USER16> I like the play on words, anyway.</comment>


TikTok traders are pumping joke cryptocurrency Dogecoin–and the price is up 95% - <AUTHOR> https://fortune.com/2020/07/09/tiktok-dogecoin-challenge/ <comment><USER2> The crypto pump and dump scams are still going on? Can't crypto currency just mature or go away now?

</comment><comment><USER3> That's the worst cookie permission screen I've seen. My god it's awful.

<comment><USER4> The worst so far !! I was going to comment section just to comment that !!

<comment><USER5> I'm not sure but I think commenting on site formatting or design is no longer allowed on HN.</comment></comment></comment>


Ask HN: Hiring managers, what do you look for in a junior dev? - <AUTHOR> What does 0-3 years of experience mean to you? Are you hoping to retain them for a long time? Do you prefer exposure to certain technology? How do you measure "willingness to learn" during the hiring process? <comment><USER2> \- what does 0-3 years of experience mean to me?

I assume this is in the context of "0-3 years of experience is specified in the job description". Answer: nothing. There's very little in common between a new graduate with 0 experience and someone who's worked in the field for 3 years. To answer the implied question: 0-1 year of experience means that I will have to teach you how to code, write documentation, test, use Git (not in the narrow sense of git add / commit but managing branches, merging, creating PRs), follow a requirement document, work in a team, and generally not pee on the rug. At 2 years of experience or more, I expect the puppy training to be done.

\- Am I hoping to retain them for a long time?

Ideally, yes. Since it'll take 6-12 months for them to learn their craft (which implies a fair bit of involvement from myself and the lead dev), I would be sorely annoyed if they quit right after the ramp-up period. But salary inflation being what it is, it's a very real possibility. I try to stave this off by giving more responsibility gradually and making sure there's always something new to learn (of course, this only reinforces their market value and hence the temptation to jump ship for a big raise). Realistically, I consider 2 years to be a minimum and 3 years to be a good tenure.

\- Do I prefer exposure to certain technology?

Not necessarily looking for a given technology or language, but for a certain well-roundedness. I like seeing candidates who have worked with more than 1 language, ideally with different paradigms (imperative / functional, low-level / higher-level). Ideally some front and some back experience, even if it's only a portfolio webpage for the front and toying around with Twitter APIs or setting up a Django project for the back. This makes me more confident that the candidate will be able to pick up our particular stack, and can be trained to work on different components. Any knowledge of how things work under the hood (ie what does the compiler do, how does the request get from the client to the server, how do you host a service on AWS, why is it a good idea to use https and sanitize your inputs...) is a nice bonus.

\- How do I measure "willingness to learn" during the hiring process?

I test what the candidate knows of their favorite programming language internals; what they know of the broader ecosystem (network, security, infrastructure, etc). This tells me if they're naturally curious about topics which should be of direct interest to them, or if they just copy/paste the first answer from SO. And obviously the basics: have they looked at our website, do they know the company, did they read up on the stack we use if they haven't used it before (this is literally in the job description), etc.</comment>


Ask HN: If I've already taught myself to code, should I still get my CS degree? - <AUTHOR> I'm roughly 2 years into my CS degree, which basically means I've just completely all of the mandatory prerequisite courses. At this point, I can write software in multiple languages, across multiple platforms. I've taught myself everything I've needed to know about Software Engineering, and if it didn't feel so mandatory to get a job then I would drop out of school right now.<p>Fortunately, I do have a full scholarship, so I'm not going in debt. But I still dont know if this is even worth 2 more years of my time. <comment><USER2> In the coming months, you are likely to face the ugliest labor market in living memory. A lack of degree and real world experience means you're looking at even more difficulties.

Given that you have a scholarship, you'd be unwise not to snag the credential.

Also, it does not need to be a waste of time. Don't do the bare minimums. Push yourself. Take the hardest relevant classes you can find. Dig deep into any topics that interest you.

Finally, focus very hard on getting internships. In a grim market, you will be needing both the resume entries and the job leads that those can provide.

<comment><USER3> You don't need a CS degree to become a professional developer.

<comment><USER2> Correct, and I never claimed otherwise.

Whether you have a credential becomes less important the more experience you have. There will always be silly companies that do a hard-filter on degree, but you can have a perfectly happy and successful career without them.

But winter has come.

Available positions will become way more competitive, with more people chasing after few opportunities. It may be unfair, but the combination of no degree and no experience will be a large handicap.

</comment></comment></comment><comment><USER4> " _I 've taught myself everything I've needed to know about Software Engineering_"

I respectfully suggest that you haven't (taught yourself everything you need to know). Not a criticism, we all thought we knew everything at that age, LOL.

Besides the credential, the value of college is that you "forces you to eat your vegetables". By that I mean you will learn about things that you aren't really interested in (at the time at least) or aren't as interesting as something else, but will be valuable later.

BTW: In case you also know everything you need to know about women, you can email me your wisdom. At 58, I still haven't figured them out. :-)

<comment><USER5> Nothing in the above specifically indicates that the writer is a man.

<comment><USER6> Nor does it specifically indicate heterosexual :)

... but the tone is a better match for a young straight man.

<comment><USER5> A gay guy can still "know about women" (a phrase which to me is a dog whistle anyway). And the assumption based on tone is what I was trying to point out.

</comment></comment></comment></comment><comment><USER7> Being able to code is a bit of a funny goal, because it doesn't actually make you good at either software development, or academic CS. While coding is certainly required to be a professional software dev, it is just one aspect of a far more complex industry. Likewise, it is just one aspect of academic CS.

So the answer of whether you should continue is completely dependent on your goals. You certainly could step out into industry, learn the rest, and be successful. Or stick with school, and in 2 years have a wider selection of options of where you can take your life.

During the last recession (2008), most devs I knew found a place they were happy staying in for a few years and rode it out. If it were me, I'd ride out your CS degree, and in 2 years when business starts to return to normal, you have an array of choices in front of you. Frankly, that is always the advice I give my own kids - if you are unsure what path to take, take the one that does not limit your options.

</comment><comment><USER8> I think you should finish the degree. For two reasons you have a scholarship / can do it without taking on debt and with recent events the job market will be tough for everyone.

I have a bachelors in a non-STEM field, and am self-taught (been working for ~5 yrs now, a few years as an IC and then now been an engineering manager for almost 2 years). I manage people who have bachelors/masters in computer science, and having the degree both grants you more job security and leeway in negotiating better compensation (I've seen qualified people without a degree get passed up/not been compensated as fairly for their skills). My company has a 'education benefit' so I've been looking to go back into school to get my masters in software engineering - maybe this is the year. But in my opinion/perspective, the degree opens up so many more degrees compared to if you didn't have it.

</comment><comment><USER9> A major global recession is the time when the opportunity cost of schooling is lowest.

Plus a with a lot of more experienced engineers suddenly out of work and on the job market, it's going to be extremely difficult to find work at entry level just now. Not having a degree will only exacerbate that.

That said, in the long run getting the Bachelors will be more important than getting the CS degree specifically. If you want to get a CS minor while majoring in something else, it may be worth considering.

</comment><comment><USER10> If you really believe theres nothing more to be learned in those two years left then absolutely drop out but remember that everyone who didn't will have those extra two years and the qualification that proves they actually know what they're talking about. And you'll probably be working with those people.

</comment><comment><USER11> Yes. Absolutely. While you may very well have long-term success without a degree, in a lot of industries a lack of a degree limits your upward mobility. I work with some very talented and experienced individuals who are self- taught. They are paid very well and are well-respected. However, they've also reached the upper bounds of their career. I also work with people who may be slightly less knowledgeable about the specifics when compared to those self- taught individuals, but they are the ones who get promoted and have no limit to their career potential. Why? They have a college degree, often a Master's. It has very little to do with coding experience. In most cases it has to do with everything ELSE that you learn in college. Problem solving in areas you may not be familiar with; "learning how to learn"; understanding different viewpoints or unrelated subject matter. College helps you to become a more well-rounded individual and, more importantly, a better LEARNER. All the people I hear saying that college is a waste of money and useless are missing the point and are limiting themselves.

</comment><comment><USER12> Yes you should. I learned development on my own and, yes, I landed lots of jobs. However there are barriers:

\- without a cs degree several avenues of kernel development

\- ditto distributed systems

\- anything with a strong quantitative basis

\- formal tools/tooling

\- specialty data structures and algorithms

Will be beyond reach. You simply won't be able to cope. I went on to get a mathematics degree and that saved my bacon when older and had needs beyond a paying gig (read family and house).

Do not under estimate the need to write clearly. On above topics bubbles and arrows don't cut it. You need to write papers, and/or formally model if you want to communicate and prove non trivial results.

Learning languages is one thing. Having a deep understanding of the libraries that come with the language (simple example: STL) is also quite important.

Finally given a choice between a guy with a degree and a guy without ... The guy with shows he/she can finish something of difficulty in four years. This is not to say MIT grads are always better. But a degree is better than none.

</comment><comment><USER13> Definitely stick out the degree. I was once in a similar situation.

By the time I started college I had already been programming for 6 years. I was self-taught and worked full-time (60+ hrs) as a programmer while pursuing my degree (accounting information systems because I wanted to understand the underbelly of business and I was arrogant enough to think CS wouldn't teach me anything).

While everywhere I've worked, I've been promoted and identified as a high performer, I still lack many CS aspects I wish I had gotten with a CS degree. I've even thought heavily about going back for a MS in CS, but the opportunity cost is very high for me at this point.

Based on my experiences (both good and bad) the one thing I would have changed would be to go back, set my ego aside and try to learn everything I could in the CS degree. Knowing it's not about the coding, but rather the deep and wide CS concepts I was to learn.

</comment><comment><USER14> As a web developer I have rarely, almost never, been impressed with the technical capabilities of developers who rely on their CS education more than independent experience outside of work. I have known many developers with a CS education from a good school who are duds and several excellent developers without any college.

My recommendation is to stay the course if you plan on achieving a master's education in computer science otherwise you are just wasting your time and money. While that one line on your resume is helpful it would be better spent on a different major.

Edit: I read that you have a full scholarship. Stay course anyways because you don't have the financial burden of tuition. But understand a good CS education is not enough to make you a good developer. Good developers produce good software.

</comment><comment><USER15> I went into college able to write software in multiple languages across multiple platforms. I also skipped a bunch of prereqs and got the other mandatory courses out of the way quickly.

But I learned a ton in my 4 years of CS classes, and would have kept learning a lot if I stayed for a couple extra years, I'm sure. I'll tell you that it was eye-opening to go from setting the curve in a mandatory class to struggling to keep up in a topics class.

It depends on what your school offers, but if you can cherry-pick quality classes for the remaining two years, I'd say it's worth it unless a time- sensitive career opportunity comes along (e.g. founding a company). Or do a second degree with your free time if you're not that interested in CS.

</comment><comment><USER16> Coding and the concepts taught in a CS course aren't necessarily the same. I think you should choose education if you have a wish to learn what CS courses teach including but not limited to:

\- Algorithm optimization

\- Logic Gates

\- Cryptography

\- Compilers

\- Assembly

Further studies are available to those who exist in school programs if you wish to get a higher level degree and do the research associated with it.

That said, I don't think you necessarily need this to code.

Lastly, if it's about a job, a degree will most certainly help you get thru a blind first filter. However, it is definitely possible to show your work and experience without as well thru open source contributions and the like — so this really is a choice you'll have to make.

If it was me with these options, I would go to school for free with the scholarship and work on open source projects simultaneously.

</comment><comment><USER17> I have CS degree and what i feel is if you already taught yourself code, you passed step 1, but I think to go to next level please focus on more Algorithm Analysis part first example Coursera -> [https://www.coursera.org/specializations/algorithms](https://www.coursera.org/specializations/algorithms). It will take a while if you have full-time job but consistency is what it matters. Once you comfortable with those concept then move to more advance distributed system areas.

</comment><comment><USER18> From a practical standpoint, having a degree will make moving abroad easier. For example, the EU Blue Card scheme in Germany (which I'm on) requires a degree related to my job. I'm sure other countries have simar rules as well since most immigration laws are still operating under this "degree = well- educated professional" mentality.

Also there's never an end to learrning in practically any subject, and that is especially true in the world of CS.

</comment><comment><USER19> I'd opt for a Math or Physics minor. The more you can intersect with different fields, the more you stand out in applications. Wheel and deal some projects on the side if that isn't your jam.

Also in general, college is about growth and experimentation. Having a degree is definitely useful, but not enjoying getting a degree sounds like an awful waste of time.

</comment><comment><USER20> 2 years is not that much. I'd say do it. I don't have a degree and it never bothered me in any way until I wanted to have a (self-sponsored) working visa in another country. Lack of degree meant I'd have to pay roughly 10x the taxes to qualify.

</comment><comment><USER21> As others have said probably not the best time to be looking for a job. If you get one at a stable company go for it.

</comment><comment><USER22> > But I still dont know if this is even worth 2 more years of my time.

Yes! 20 years from now, without education, you will hit a glass ceiling. Do it, finish it. It might seem today as a waste of time but that title after finishing the degree will go a long way later in your life.

</comment><comment> a-saleh a) double-check if there is something that would require you having a degree. I.e. you probably don't want to pursue PHD, but visa-requrements have degree

b) doublecheck if you want to pursue something that requires to be student, i.e. internship, scholarship, e.t.c. I started working for a company as an intern during my studies and after a while it was reasonably easy to upgrade to part-time employment and later on full-time employment.

c) I don't know what are your costs. I am from europe, so I studied for free. If you are taking on more and more debt, your cost-benefit analisys might be different.

</comment><comment><USER23> 2 years, eh? There's a common misconception that "sophomore" is greek for "wise fool". Consider that.

</comment><comment><USER24> Hey I have to make a recommendation for this - [https://www.rezi.io/covid-19-job-relief/](https://www.rezi.io/covid-19-job- relief/)

We are opening our software for all affected job seekers. If you have any questions about your resume, just let me know

</comment><comment><USER25> Get a degree in a real subject like math, physics, chemistry... The prereqs are probably the same.</comment>


Hack your drinks at the theater - <AUTHOR> http://www.wired.com/science/discoveries/magazine/16-10/st_ice

<comment><USER2> OK, so firstly, "choosing the best out of three options" really doesn't count as "hacking", especially when the best option turns out to be the default.

Secondly, what a terrible experiment. Even if you accept the premise that coldness vs corn syrup is a worthwhile tradeoff, they don't even mention how long they waited before taking the temperature measurement. A temperature vs time graph might make this article worthwhile.

And now, if you'll excuse me, I'm going to go and "hack" my morning coffee, by asking for a cappucino sans live skunk.

<comment><USER3> _if you'll excuse me, I'm going to go and "hack" my morning coffee, by asking for a cappucino sans live skunk._

I do recall an interesting post making the rounds a while back about hacking Starbucks' cappuccino. The premise was this: Starbucks has tall, grande, and venti sizes posted on its menus, but if you ask for a short dry cappuccino, you save money and get a better drink.

That seems to fit the spirit of hacking a cappuccino :-)

</comment></comment><comment><USER4> Reactions:

Seeing YC tag: "Ohh, I wonder how they're going to get free soda? It better not be something dumb like 'bring a Nalgene, get a large soda, and share!' Might almost maybe (but probably not) justify going to the theater."

Seeing Wired title: "Ohh, I bet theaters are finally providing 'frozen soda' as ice cubes, so the drink doesn't dilute. Or maybe someone brought in soda- cubes for their favorite flavor? But that would probably melt...this should be interesting."

Reading article: "Stupid."

After writing comment: "You know, there's more 'theater soda hacking' in that comment than there was in that entire article."

</comment><comment><USER5> Seriously? 3 pictures, poor use of 'Hack', and posted to YC News? The end result being "don't put too much ice in your drink"? This is one of the few times I could downvote.

<comment><USER3> Well, for some people it is the case that choosing the personally optimal product configuration from the set of options provided by a vendor is considered hacking, even if it does not present a new phenomenon nor does it represent an unexpected benefit.

Personally, I think that anyone over the age of seven has figured out that there is a lot more soda in the cup if you skip the ice, but it is colder if you include some ice.

I'm more surprised at Wired than I am at this getting posted here. When did Wired become this Tired?

</comment></comment><comment><USER6> The diagram pulled a Verizon and has 1.42 cents in the last image instead of $1.42 or 142 cents.

</comment><comment><USER7> This is a hack? Seriously, why don't we as a community distance ourselves from this crap?

<comment><USER8> I hacked my mornings by making sure that the bed gets lots of early sunshine.

I hacked my grocery shopping by buying stuff that's on sale.

I hack my gas mileage by coasting down hills. (Truck has a clutch.)

...Ugh. I'm getting sick to my stomach just writing this.

Every moronic, mundane use of the word diminishes the artistry that it used to represent.

<comment><USER7> Ah, found it:

"At this juncture, I wish to apologize and formally atone for any role 43 Folders or I have had in popularizing 'hack' as the preferred nomenclature for unmedicated knowledge workers dicking around with their 'productivity system' all day. 43 Folders regrets the error." - Merlin Mann, "Four Years" (<http://www.43folders.com/2008/09/08/four-years>)

</comment></comment></comment><comment><USER9> Like more corn syrup for the money is a good thing. It's not exactly good for you. The optimum concentration of corn syrup is either 0M or as little as it takes to satisfy you, which means that you should take as much ice as you want. Unless your goal is to "hack" your insulin receptors.</comment>


Fundamentals of Neuroscience from Harvard EdX - <AUTHOR> http://www.mcb80x.org/#prettyPhoto <comment><USER2> I took this course (part 1 of 3) last year and passed it with about 90%. It left me with a question in the back of my mind about whether this is a very watered down version of the actual Harvard course (I hope it isn't) or if they're just that good at teaching it. Because there is never a stumbling in understanding something, the course just flows naturally from one lecture to another and you get immersed into it all the way through. If I recall correctly I saw all the lectures during 1 or 2 evenings and did the final exam a week or so later and surprisingly the material was retained in my head.

<comment><USER3> speaking from some experience in putting together and running a mooc class (as well as non-mooc classes), they are very watered down versions of their original courses. after a lot of soul-searching, I think that the world is better for having these classes, but I can't imagine how they could replace or supplant the previous model. from my perspective, the things that add the most value to a college class, in educational value, inherently do not scale.

<comment><USER2> The one big positive side to MOOCs is that they offer breadth (even if it's somewhat watered down). My own real life academic curriculum is 90% pure math, with programming and theoretical physics covering the other 10%, and having a wide range of interesting and diverse MOOCs lets you see what else is out there :)

<comment><USER3> true! because the lectures are delivered asynchronously you can survey a broad amount of material. again, I definitely think that the world is a better place for having available courseware, but you shouldn't let the brand name of the professors institution (harvard, MIT, stanford, etc) fool you - it is still watered down. it has to be.

</comment></comment></comment></comment><comment><USER4> I wish they wouldn't say that it's free. It's not free if you have to hand over a bunch of your information in order to see the content.

</comment><comment><USER5> Is it worth paying money to get certified on an online course ? Do employers consider it?

I was thinking of paying for the Data Science course.

<comment><USER6> I can't imagine a situation where taking a MMOC would positively impact an employer's thoughts about someone, at least not in a meaningful way (I'm sure it shows some general level of motivation).

IMO for these things it's better to view them purely as self enrichment

</comment></comment><comment><USER7> Are these people trying to sell me something? Weird aesthetic for an online course outline.

<comment><USER8> Yes, these people are trying to sell you their version of knowledge about neuroscience (nothing negative about that). There are too many online courses now and course creators have to compete for student's time and attention. And this is an absolutely wonderful development.</comment></comment>


Deploying a serverless webpage using AWS, which apparently is hard, somehow - <AUTHOR> https://blog.jordan.matelsky.com/serverless-site/ <comment><USER2> Try Google Cloud Run, super easy

<comment><AUTHOR> Really like GCR, I've used it on a few projects. I thought about using Lambdas to serve this as well, but wanted to have zero moving parts (i.e. why spin up a whole cloud function if I can avoid it?). I also very much did not expect this to be a Process!

Even with Cloud Run et al, you still have to think about about subdomain routing. So it cuts out all of the garbage w.r.t s3 redirects, but, e.g. DNS and CloudFront (or router-cache equivalent in your cloud provider of choice) are still on the table.

For simple things like this, I'd honestly just recommend Zappa + Lambdas over a more complicated platform like Cloud Run, running a simple Flask server, serverlessly. But... Moving parts. So... See above. I digress.</comment></comment>


Seth's Blog: Firefox is missing the point - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2008/09/firefox-is-miss.html <comment><USER3> No. That's missing the point. It's got to stop. Social features are great for some things. Social features are not great if you shoe-horn them in a totally inappropriate way that doesn't add value. Life is better for me and the vast majority of its users if FireFox doesn't add pointless social features that I won't use anyway. I don't want to see people's ratings for sites, see grouped recommendations or communicate with other FireFox users. The people who do want this functionality can install extensions, and those extensions largely already exist.

Besides, this may mean I need to rewrite Halo's Law ("Every site expands until it becomes a social network, those that don't are replaced by those that do").

<comment><USER4> Maybe it's just me and the people I know, but the real value of firefox - other than the obvious advantages over IE - is the plugin functionality.

So when Google Chrome came out, I immediately thought of it as a IE killer - not a Firefox killer. I'm almost scared for them to start providing plugin support/features/etc as it could just end up being Firefox.

Have you ever blogged about Halo's Law?

<comment><USER5> This is off topic, but I'll bite.

Chrome isn't an IE killer, its a Firefox killer. Why? because Chrome (like IE) is a chosen browser. IE is a default.

Most Firefox users have chosen to use it. Downloaded it. Installed it. Tried it & use it. Most IE users have not.*

Once someone is making a choice, you can reach her. Say 'but wait there's more.' IE users aren't even going to _know_ about Chrome. They won't ever be consciously deciding between browsers. If they are, resistance to change is a big factor. If Chrome becomes demonstrably better choice, it will be chosen. But only by those making a choice. Everyone else isn't listening.

So basically FF users make a choice & Chrome gets to make its pitch. IE users don't. Product similarity has nothing to do with it. Its market similarity that runs this show.

*Obviously some IE users made a choice. They're in the FF category.

<comment><USER4> Wow great points. I don't know this with any certainty (I'm not a Google insider or anything), but I'm willing to bet that Chrome is going to become more of a default browser. Google didn't market Firefox near as aggressively as they could of. And with Android coming out, Google will decide the default browser. There's a lot more mobile devices out there than PCs.

<comment><USER5> That's what I was thinking as I wrote it.

</comment></comment></comment></comment></comment><comment><USER6> Actually I think that Seth misses the point as well. I don't care whether other people wear the same clothes as me. I recommend because I like.

Firefox's response to Chrome should be not adding new features but removing existing ones, or, at least, redesigning them to make the UI even easier.

<comment><USER7> Actually I think that Seth _routinely_ misses the point.

He's a great marketeer, but he's not a product manager anymore than a usability specialist.

<comment><USER8> Agreed. He's shown that he can take anything, even crap, and figure out how to sell it better. I think that this example WOULD sell Firefox, for instance. However, I find that a lot of his stuff IS crap, and marketing doesn't fix that. Squidoo, for instance, is terrible and pointless, even if it IS on the Alexa 500 (and I'll never know WHY it is, for that matter).

Frankly, I'd prefer Firefox NOT market itself and focus on making itself the best browser it can be. It's not good enough right now to create good marketing, so it shouldn't bother.

<comment><USER9> If you've ever looked at some of these 3rd string Internet marketers (the ones that mostly sell ebooks or talk about adsense arbitrage) you'll eventually see some non-expert talking about SEO and one of the first things they'll mention is Squidoo.

I think it is because Squidoo gives people a platform to put whatever contextual text they want in, with outbound links that provide link-juice to whatever site/affiliate link they want.

If you ask me, it feels more like a spam blog that has multiple authors that can sign up at anytime - but that is just my opinion.

<comment><USER8> That's an opinion that I share. Squidoo really does have a skeevy feel to it. And after a year of reading Seth's blog, I had to unsubscribe because his writing had the same skeevy feel. I want to get users because I've got the best product out there, not because I'm marketing myself the best.

<comment><USER9> Well I've never met Seth so my opinion of him is based only what I've read, but I'm not entirely sure I can pin down what it is about him that perplexes me...

Sometimes he seems to have fairly interesting advice and insight on various topics and at other times I've considered that these are the ramblings of a delusional man. I really don't think I can make an apt judgement of him, so perhaps that is why I keep reading? Maybe he is a genius in disguise.

That being said, he reminds me of someone I know and if he is anything like this person, then I think we all have something to be worried about.

<comment><USER8> Nah. He's no genius. Genius is controversial and abrupt. Seth Godin is almost certainly bright, but that's about it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> _So, Firefox needs to add functionality that makes the surfing experience better for all users when more users use Firefox._

Totally. I have a couple ideas. One is to improve the Javascript library so that richer and more responsive applications can be written.

Another would be to pull the rendering components into their own processes so that I don't lose N tabs of state when one plugin decides to lose its mind. Getting a multiple-core performance boost would be gravy here, too.

Firefox got pretty good mileage out of being just a browser. URL in, rendered page out. Chrome stands to do the same thing to Firefox that Firefox did to IE, in that it represents a clean, simple, technically enhanced browser.

Google has come out and said "here is some stuff, please just copy it and put it in yours", and they'd be walking a really fine antitrust line for dubious benefit if they actually did have a large market share.

 _But the response to Chrome shouldn't be to launch new features._

I'm assuming this doesn't mean "add no features at all" because the rest of his article would make no sense in that context. I can only imagine that it means "the FF team's response to Chrome shouldn't be back end, technical features". (Sorry if I've built a straw man here, but I really can't figure out what else this could mean in this context.)

Why does nobody take the Chrome release and comic at face value? What causes this idiocy in the echo chamber saying GOOGLE is the NEW MICROSOFT, it's BROWSER WAR! Don't copy the FAST JAVASCRIPT it's a TRAP! Deploy TAG CLOUDS!

I'm completely mystified and would love to have someone explain this to me.

</comment><comment><USER11> I think i missed his point. Maybe I'm retarded, but i didn't get what he was saying. Did he compare Firefox to fashion, religion, and an obsolete communication device?

<comment><USER5> Yes he did. That part of the post makes sense.

He's encouraging FF to have an in-built mechanism for giving users incentive to recommend something, anything. What he proposes is bad.

</comment></comment><comment><USER12> 'I'm a devoted FF user, and have been forever.'

That's interesting, as according to Wikipedia version 1.0 of Firefox was released in February 2004. [1]

'But the response to Chrome shouldn't be to launch new features.'

Which new features are these?

'Here's the problem/challenge: when your friends switch to Firefox, your life doesn't get better.'

No, but when _you_ switch to Firefox _your_ life gets better. How many products or services are sold on the basis of making other people's lives better? Exactly one - charities.

'And the key to growing any piece of software (or just about any product or service, actually) is the opposite. People will recommend something if adoption improves their lives.'

Er, what?

'Fax machines?'

What machines? Fax machines? Oh, you mean version 2.0 of the telegraph?

'Life is better for me if you have one.'

The phrase you're looking for is 'network effect'. [2]

'Fashion? Life is better for me if I'm not the only one wearing this.'

Yes, everyone knows that a woman _loves_ turning up to a party and seeing another woman wearing the same dress as her.

'Religious sect? Life is better for me if I'm not the only one in the building.'

Unless you're a hermit.

'So, Firefox needs to add functionality that makes the surfing experience better for all users when more users use Firefox.'

Say what?

'There are many ways to do this, and you can invent more than I ever could. Systems that allow for rating pages, or grouping them, or communicating (but only with FF users).'

Haven't you heard of the 'any browser' campaign? [3]

[1] <http://en.wikipedia.org/wiki/Mozilla_Firefox#History>

[2] <http://en.wikipedia.org/wiki/Network_effect>

[3] <http://www.anybrowser.org/campaign/>

<comment><USER9> _How many products or services are sold on the basis of making other people's lives better? Exactly one - <USER2>

+Christmas, it's all about The Spirit of Consumerism... oops I mean giving - It's only 4 months til Christmas, make sure you've bought all those presents for everyone otherwise a magical fat man won't climb down your chimney and leave boxes full of non-biodegradable plastic wrapped in non-recyclable coloured paper under your tacky dead disco tree.

... I think the earlier it starts every year, the more of cynical I become.

</comment></comment><comment><USER13> Godin's desire to boost Firefox is laudable but...

(1) Flock made a Firefox heavy on social features, which hasn't caught fire; and..

(2) Potential social network-effect features are better constructed as services or websites than browser functionality; and...

(3) Even if the functionality needs a browser-based component, to implement that in an "only with FF users" manner would be counter to the open mission of Mozilla.

</comment><comment><USER14> Wow... that's incredibly awful advice.

</comment><comment><USER15> Maybe I missed the point, but this article doesn't explicitly say 'social features'. It simply says that the firefox community is bettered by more people using it. Granted social features are the first that come time mind, but I can imagine some others.

* A standard platform for whatever plugins you like * Aggregated usage data

</comment><comment><USER16> So his idea is to add a addon-like functionality to the browser itself? ...

</comment><comment><USER17> I guess nobody clued this guy in on extensions. As Firefox gains more marketshare, it also gains more extension developers and users. It also allows the web to advance. That is the aggregated benefit of more marketshare for Firefox. The social features this guy recommends belong in extensions, and, incidentally, extensions with that functionality already exist.

I think the "social media" obsession has gone on long enough. I was so sick of "social [x]" for everything (social laundromat finder, wee!) more than a year ago, when's it going to wear out?

</comment><comment><USER18> Seth's Blog: If there's a point here, you _will_ miss it.

Anyone care to explain what on hell he was arguing for?

<comment><USER9> _I'm a devoted FF user, and have been forever. But the response to Chrome shouldn't be to launch new features._

 _So, Firefox needs to add functionality that makes the surfing experience better for all users when more users use Firefox._

 _There are many ways to do this_

Ok, so checklist for all you budding developers out there. 1) No additional features allowed. 2) Add new functionality that doesn't exist yet. 3) Come up with several solutions to achieve this.

Got it? Good.</comment></comment>


The new Secure Password Hashing API in PHP 5.5 - <AUTHOR> https://gist.github.com/3707231 <comment><USER2> Defaults to bcrypt with a cost factor of 10. A totally sane default. The interface is clear, simple, and easy to audit for. This is a definite step forward.

<comment><USER3> Auditing bcrypt (OpenBSD Blowfish) hashed passwords with JtR is much less satisfying than auditing md5 hashed passwords ;) Joking aside, I agree that this is a good move in the right direction.

<comment><USER2> Yeah, I'm just saying, the new standard password hash has a simple function signature; it's now easy to take a new PHP codebase and quickly check it to see if they're doing something wacky with passwords.

</comment></comment></comment><comment><USER3> During the Defcon password cracking contest this year, there were 5,150 bcrypt hashes. In 48 hours, only 76 of them were cracked. In contrast, there were 8,544 plain sha1 hashes, 4,111 of those were cracked. You can see the full list of hash types and how many were cracked here:

<http://contest-2012.korelogic.com/stats.html>

This is probably the premier password cracking contest in the world. I placed 7th overall and was first to crack most of the TrueCrypt volumes and I despise attempting to crack bcrypt hashes (most sane people do). You really have to try and crack them for yourself to fully appreciate how difficult and slow they are to attack.

<comment><USER4> Were most people using rainbow tables or brute forcing do crack the hashes?

<comment><USER5> The point of bcrypt is you can't use a rainbow table.

<comment><USER2> No modern hash function, including "salted SHA" _and Unix crypt()_ is vulnerable to "rainbow tables". Rainbow tables work exclusively against the dumbest possible hashing schemes.

Bcrypt isn't a defense against "rainbow tables"; the hash function bcrypt supplanted (PHK's MD5 crypt) was also not "rainbow-table-able".

<comment><USER6> Correct me if I'm wrong but couldn't you construct rainbow tables for any hash function which takes a single input (including salted SHA, if the salt is the same for all passwords)?

Of course, you'd need a seriously large set of passwords on your hands for it to be worth the effort, but it could be done right?

(Possibly worth mentioning, possibly not, that if your salts are _extremely_ weak then the combined hash might show up in regular rainbow tables, whether your salts are unique or not - it seems unlikely this would ever happen in practice though)

<comment><USER7> The point of rainbow tables is that you can pre-calculate them. I wrote some myself for fun, and it does take a while to build stuff up.

Even if someone was dumb enough to use the same salt everywhere, once you know that you would just start brute-forcing, not building a rainbow table for the joy of searching it. (Unless you are into that like me.)

<comment><USER8> It's a fun academic exercise, but Google seems to be a better rainbow table than anyone can construct on their own. Search for hashes. The results are frightening.

<comment><USER6> That's a lookup table, not a rainbow table, strictly speaking.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> For clarity, the current and new ways to use bcrypt in PHP:

        // pre-5.5
        $salt = substr(strtr(base64_encode(openssl_random_pseudo_bytes(16)), ['+' => '.']), 0, 22);
        $hash = crypt($password, '$2a$10$'.$salt);

        $match = crypt($password, $hash) == $hash;

        // post-5.5
        $hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 10]);
        $match = password_verify($password, $hash);

Brilliant effort and should really help to ensure password security on the web.

<comment><AUTHOR> Just to clarify a bit more: Usually you need more (a lot more) code than this on pre 5.5. In particular you can't normally assume that `openssl_random_pseudo_bytes` is available. Instead you'll go through various entropy sources (typically `mcrypt_create_iv`, `/dev/urandom`, maybe COM, with fallback to `mt_rand`).

People often get the salt generation wrong, e.g. by just using a substring of `md5(mt_rand())`, which is obviously wrong (in several respects) :/

<comment><USER10> I know this is a dumb question, but I haven't found a great answer to it yet: why does it matter how the salt is generated, so long as its done on a per- user basis?

If the salt is allowed to be "less than secret" (by which I mean it can be stored in plain-text, not that it should be published on your website), then what does it matter if it's "pretty random" versus "cryptographically random"?

What's wrong with something like this:

        $salt_length = 22;
        $cost_factor = 10;

        $lower   = range('a', 'z');
        $upper   = range('A', 'Z');
        $numeric = range('0', '9');
        $special = array('/', '.');

        $salt_chars = array_merge(
                        $lower,
                        $upper,
                        $numeric,
                        $special
                      );
        $char_count = count($salt_chars);

        $salt = '';
        for ($i = 0; $i < $salt_length; $i++) {
          $salt += $salt_chars[mt_rand(0, $char_count -1)];
        }

        $hash = crypt(
                  $password,
                  '$2a$' . $cost_factor . '$' . $salt
                );

<comment><USER11> I did a breakdown on a similar snippet here: [http://www.reddit.com/r/PHP/comments/zrprk/the_new_secure_pa...](http://www.reddit.com/r/PHP/comments/zrprk/the_new_secure_password_hashing_api_in_php_55/c67cw8z)

But for this case, the salt generation is much better (assuming that `mt_rand` is a good enough source of entropy, which may or may not be the case).

The rest definitely applies though.

In short, you're using the wrong algorithm ($2y$ is the better one, the one you're using has a known bug). You're not checking for errors from `crypt()` prior to storing the hash. So you can wind up significantly messing up your database and potentially leaving it in a worse state than if you just used `md5($password)`... And the minor note about timing attacks...

Not to mention that you currently have an issue in your code (it needs to be .= for a string, not +=)...

<comment><USER10> > But for this case, the salt generation is much better

This is the only question I was asking, and you haven't really addressed it in any detail. The reddit comment you linked was replying to some obviously bad code. I mean, limiting your salt to use only 16 possible characters? Really?

> _you're using the wrong algorithm ($2y$ is the better one, the one you're > using has a known bug)_

I didn't know about that bug until just after writing my last comment (don't worry, I don't do this for a living). I just used `2a` because that's a) the example I see most often, and b) that's what was used in this HN comment thread.

The security fix notice[1] linked from the manual page for crypt() mentions that `2a`, on systems where `2y` is available, has countermeasures to try to combat the vulnerability for newly generated hashes, and even says "if the app prefers security and correctness over backwards compatibility, no action is needed - just upgrade to new PHP and use its new behavior (with $2a$)" which doesn't make it sound like it's a huge issue to use `2a` on newer installs, just that you should prefer `2y` where possible.

That said, I'll make a note to use the new one since it _is_ superior. I do find your comment that "if you're on too old of a PHP version to use that (5.3.7 IIRC), then don't even talk about security..." to be needlessly flippant. You don't even bother to offer an alternative to the poor bastards that are stuck on older versions.

> _You're not checking for errors from `crypt()` prior to storing the hash._

It's example code, not production code. Maybe I should have made that clearer, but I thought it would be pretty obvious.

> _And the minor note about timing attacks..._

What's the timing attack on my (non-production, air code)? Your comment on timing in the reddit comment was about verification, which my code doesn't mention.

> _Not to mention that you currently have an issue in your code (it needs to > be .= for a string, not +=)..._

That's just a stupid typo/brain fart. I didn't actually run this; it's just "air code".

\---

Can you elaborate more on the salt generation specifically, since that's all I was really trying to ask here? Is the point of using a more cryptographically secure RNG just to make it more likely that each new salt will be unique? How important is absolute uniqueness?

If you could also elaborate on the problems with mt_rand() while you're at it, I'd appreciate it. The only thing the manual mentions, as big a problem as it may be on its own, is that it prefers even numbers on 64-bit systems in certain configurations. Is there more to it than that?

I'm not a PHP pro, as should be clear by now, so I appreciate any information you can pass along. I'm just trying to learn.

[1] <http://www.php.net/security/crypt_blowfish.php>

<comment><USER11> > This is the only question I was asking, and you haven't really addressed it > in any detail.

I thought you meant the function in its entirety.

So, to your specific point, it's not _bad_. That doesn't mean it can't be improved upon.

For example, `mt_rand()` is susceptible to certain types of seed poisoning attacks. That's because the state that it uses is process specific. So when running PHP in a case similar to what happens with mod_php, that state is shared among all php instances (just like with APC). What that means is that the security and randomness of your usage depends on everyone else's usage. So if someone calls `mt_srand()` in one app over and over with the same value, your randomness can be thrown out of the window.

Now, that's a very significant edge case with very limited attack potential. However, when it comes to security if there's a better way, why not use it. And in this case, there is (/dev/urandom). Just read from that source (via fopen, via mcrypt_create_iv, via openssl_random_pseudo_bytes, etc).

I'd much rather edge on the safer side as long as there are not significant downsides...

As far as 2a vs 2y, I would stick with 2y unless you have a very good reason for sticking with 2a.

As far as the error checking, I thought it was worth mentioning, since it seems that $hash = crypt(...) is all you need, when in reality it isn't. Which goes to further my point that crypt() is too difficult to use out of the box...

> That's just a stupid typo/brain fart.

I realize that. I was just pointing it out.

> That said, I'll make a note to use the new one since it is superior. I do > find your comment that "if you're on too old of a PHP version to use that > (5.3.7 IIRC), then don't even talk about security..." to be needlessly > flippant. You don't even bother to offer an alternative to the poor bastards > that are stuck on older versions.

Correct. Because older versions have fairly significant vulnerabilities associated with them. Two major DOS vulnerabilities come to mind. Is the comment flippant? Perhaps. Does that make it wrong? No...

And as far as "offer an alternative to the poor bastards that are stuck on older versions", there are plenty of those. PHPass supports PHP all the way back to like 4.2... If you need a password hashing algorithm for an unsupported version (or 5.3.x < 5.3.7), just use that.

Which actually brings me to the entire point (I don't need to tell you, just making the point again). Just use a library for this. It may seem easy to just do it yourself, but there's a lot to it. Just use a library and be done with it. There's no reason to re-implement it every time...

Hope that helps...

<comment><USER10> Thanks, that helps a lot.

I apologize if I got a bit crass in my earlier comment. I think the Wil Wheaton's Guide To Depression post has me a bit sensitive today. I probably took the worst view of your comments and got annoyed over my own warped perception.

I probably should just use a library for this, but I've been in a pretty "reinvent the wheel to learn about wheels" mode with the thing that I'm building (the latest in a series of projects which continue to elude actual completion). I even started writing a framework a while back, before switching to CodeIgniter since it's widely used and easy (before switching back to writing a framework after getting annoyed fighting CI... kidding).

Since there's likely only ever going to be a single user for this thing, I doubt the password implementation actually matters much, but it's certainly going to be a debate for a day or two.

Thanks again.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> This is great news. One of the things that PHP has been lacking for some time is easy to use secure password hashing. You'll still have instances where developers are either too lazy, forget or don't learn these new methods and the same problems will occur.

It's great to see the PHP team thinking ahead, and I completely understand and agree with why they chose procedural over an object oriented approach to implementing the new functionality: ease of use.

Next step I hope is some kind of native support for web sockets, I'm tired of using third party libraries that don't implement a web socket server correctly. That would be an amazing feature.

<comment><USER8> As much as the PHP team is thinking ahead and working hard, there's a ton of inertia in the PHP community that will take another decade to overcome.

The one thing that would help the PHP community immensely is nuking w3schools from orbit. It's like a museum of bad ideas that somehow is the first place people end up when looking to learn PHP.

</comment></comment><comment><USER13> A standard API with sane defaults is an excellent idea for a language with so many developers of varying competencies.

<comment><USER14> Considering that this will make password-related code much shorter and more readable, I think it's a good idea regardless of what level of competence you expect from the developers.

<comment><USER15> I'll take "more secure" over short and readable any day.

<comment><USER13> In some cases short and readable ends up as "more secure" by virtue of being implemented correctly.

<comment><USER16> Or in this case; short and readable _is_ more secure because attack vectors, like generation of salts, are wrapped inside the new API.

</comment></comment></comment></comment></comment><comment><USER17> So you are supposed to md5 the results of the password_hash() function before storing them in a database right?

<comment><USER18> Don't forget double rot13.

<comment><USER3> For those who may not get this joke:

# One rot13

$ echo test | wm --rot13 --words stdin

grfg

# Double rot13

$ echo test | wm --rot13 --words stdin | wm --rot13 --words stdin

test

</comment></comment></comment><comment><USER19> Very nice. I'm surprised, though, that they didn't go the OOP route, since they're transitioning a lot of other core procedural functions to objects. Even if it would be a super-simple class interface (almost to the point of not being strictly necessary), it would at least be consistent with the general drift of next-gen PHP.

<comment><USER11> I wanted to go down the OOP route initially. Then I decided against it for a number of reasons. Here's a breakdown of that reasoning... [http://www.reddit.com/r/PHP/comments/zrprk/the_new_secure_pa...](http://www.reddit.com/r/PHP/comments/zrprk/the_new_secure_password_hashing_api_in_php_55/c677yu2)

Additionally, the general drift hasn't been towards OOP within PHP. Some OOP libraries are being added, but the core remains largely procedural (and doesn't appear to be shifting significantly yet). It's taking the (very logical IMHO) route of "Does this make sense to be OOP". If the answer is yes, then it goes in as a class structure. If not, it goes in procedurally.

I did not feel it made sense to make this a class, and as such I did not...

</comment></comment><comment><USER20> This is a great step forward. I wish it was in an object rather than globally scoped methods, but it's nice to have.

Also, in case you didn't know, you can use bcrypt with PHP5.3 and the crypt() function. It's not as user friendly as this, but you can do it.

<comment><USER11> Here's an explanation of my rationale for not making it an object instead of a function: [http://www.reddit.com/r/PHP/comments/zrprk/the_new_secure_pa...](http://www.reddit.com/r/PHP/comments/zrprk/the_new_secure_password_hashing_api_in_php_55/c677yu2)

Here's the last paragraph (in case it's TLDR, or you don't want to click through):

> So in short (or not), I just felt that there's room for this API and things > like PasswordLib to live side by side. And I will continue to maintain that > project in the long run. But for the generic use-case, I felt that an OOP > API was too much risk for not enough gain for a core implementation. With > that said, if you can come up with a clean API, I'd be all ears and willing > to consider implementing it. But for now, this is the better alternative > IMHO...

</comment></comment><comment><USER21> Seems bizarre to me that hash_pbkdf2() has also been accepted, was authored by the same author, and provides for "better"* hashing than bcrypt(), and yet isn't the PASSWORD_DEFAULT or, indeed, even an option for the secure password hashing algorithm. wtf?

* In the crypto community, "better" usually refers to how long an algorithm has been around, how well reviewed & used it is, and how bug-free it's been. Looking at all of these, PBKDF2 is clearly superior to bcrypt, which has had significant bugs, isn't as widely deployed, etc.

<https://wiki.php.net/rfc/hash_pbkdf2> <http://en.wikipedia.org/wiki/PBKDF2>

<comment><USER22> [EDIT: tptacek is right. Listen to tptacek.]

PBKDF2 isn't necessarily better than bcrypt. But yes, it's a good choice.

<comment><USER2> PBKDF2 is objectively worse than bcrypt, but the difference between them isn't meaningful. The only meaningful choice in password hashes is between PBKDF2/bcrypt and scrypt, which is hardened against gate-level-optimized attacks.

</comment></comment></comment><comment><USER23> Wow, that actually is very useful. Looking forward to using it.

</comment><comment><USER24> I was using Marco Arment's class Bcrypt before: <https://gist.github.com/1053158>

This is a nice improvement.

</comment><comment><USER25> I think <http://crackstation.net/hashing-security.htm> is better.

<comment><USER26> Have you even read that? It recommends bcrypt too: <http://crackstation.net/hashing-security.htm#faq>

<comment><USER25> Oups, my mistake. I thought that md5 was used by default by the new API (I made a quick read) but you are all right ! Tiredness can be deceptive... But it's still a good website where I learned to make secure password hashing for the first time.

</comment></comment></comment><comment><USER3> Is this officially part pf PHP 5.5 or just an RFC that ___might_ __be included in PHP 5.5?

<comment><AUTHOR> The RFC was accepted. So it will be in PHP 5.5 (unless some serious flaw with it comes to light in the meantime).</comment></comment>