"Why does Chrome not have a good tab management system built in?" - <AUTHOR> https://plus.google.com/+PatrickMcFarlandDiablo-D3/posts/L3w3ck596LF <comment><USER2> I'm pretty certain the Chrome PMs actively decided long ago that people who use lots of tabs make up too small of a population to support in-browser with special features. The featureset has worsened with time, moving from correct rendering of more than one horizontal page of tabs (but infinitely compressing them to the point that you cannot click on any specific one) to an obvious graphical bug (rendering tab handles behind the + button and then off the right edge of the screen), to today: no graphics glitch, it is just impossible to tell you have more than a certain number of tabs. They're there, just without any indication at all.

I know those things because I frequently have >200 tabs open, and have done so for many years. But I'm not surprised that it would be considered too niche to fix, because the reactions of most people (among a fairly tech-savvy sample of people looking at my web browser) go to the point of making comments about their surprise at how many tabs are open on my screen. It just isn't very common behaviour.

During the 'graphical glitch' era, I was an intern on the WebKit team at Google and asked about the bug, and some people knowingly chuckled and said, "yeah, that isn't something that's going to be fixed soon." I imagine it was also a tough bug.

Anyway, it would still be cool to support better tab features.

<comment><USER3> I'm genuinely curious as to the thought process of having that many tabs open. I often feel like I'm missing something when I see people doing it. Is is the muscle memory of knowing where each tab is? If so, how does that work when you move to a device that has a different resolution?

<comment><USER4> Well for me i generally have about 10 tabs "pinned" that are always there, always in the same place, and always open. That is in my "general" window which i also browse reddit/hn and other sites on.

[http://i.imgur.com/FBXmBqh.png](http://i.imgur.com/FBXmBqh.png)

Then i have a second window which i use for work. That generally has a few work-specific tabs (work email, time tracking, trello, etc...) which are always pinned, plus a few "general work" tabs which i'm using.

Then i like to open a new window for each project i'm working on. So i've got one right now working on integrating node.js with our 80's language. That window has about 15 tabs from the node manual as well as the 80's language manual and some stuff about dlls in windows.

Then i have a window for my personal project i'm currently working on. It has the github repo, travis.ci, coveralls, and sauce-labs pinned, as well as the handful of tabs that i'm currently using in that project (research, test tabs, various other crap).

It totals to about 4 windows, and about 100-200 tabs total depending on how busy i am any given day.

I don't bookmark or close them because i don't have to, and while some of the pinned tabs are important, many of them are just where i left off and aren't really bookmark-worthy.

<comment><USER5> Having multiple tabs per window seems reasonable - I have ten open in my "work" window, and seven (three pinned) in my "personal" one - but when I see someone with a single browser with a hundred tabs open, I always wonder what their workflow and brain are like.

I think that's probably what mscrivo was curious about.

<comment><USER6> Data point:

I often end up with many (read, ~100? Varies widely.) tabs open.

I work like a priority queue. When I'm reading something, and see something interesting as a link, I open it in a new background tab and keep reading the current thing. Then go to the most interesting/relevant/time-sensitive tab I have open and read that. Repeat. ( while not que.isEmpty(): que.pushAll(que.popBest().getChildren()) ) This adds up quickly.

For example, with HN I tend to browse the entire front pages (active / standard) / my user threads before I actually start reading links / comment pages. And when I'm reading a comment page I tend to open comments to reply to in a new tab to get back to them later.

Ditto, if I'm coding something unfamiliar I often find myself looking up things recursively. Oh, here's two options to do thing A I need to do. Oh look, option A requires things B and C. Oh look, B requires D. This is sounding too complex, close tabs for things A/B/C and try option 2 instead. Etc.

Realistically, I only need at max two or three tabs actually loaded at once _most_ of the time - but at the same time I want things to be loaded before I get to them, and I _do not_ want to lose data from unloading pages. Lazarus helps, but there are pages that still lose data on reloads.

</comment></comment></comment></comment></comment><comment><USER7> Yeah, it's not going to happen. I've known people at both Mozilla and Chrome and the data shows heavy tabbers are in the extreme minority. I've run informal surveys and heavy tabbing has around ~30% penetration in the extreme techy circles which is why everyone thinks everyone else is doing it and it needs to be fixed.

Out in the wild though, it's something like, 95% of people never have more than 10 tabs open and 99% of people never have more than 20 tabs open. Don't quote me on the exact figures but those are in the ballpark of correct. It's hard to justify building a feature set for less than 1% of your users.

<comment><USER8> They should not underestimate the value of power users though. How many regular users does a power user influence in browser choice? I don't know but I suspect it's high and has a lot to do with the early FF to Chrome migration.

Besides that with the # of people using browsers a tiny minority can actually still be a huge # of users.

</comment></comment><comment><USER9> Firefox has this feature and it's great. Mozilla should be promoting the hell out of Tab Groups instead of shit like Pocket.

<comment><USER10> I've really been blown away by Firefox lately, it's looking better and better. I'm still not confident enough to make it my primary browser for dev though; Chrome's dev tools are just amazing.

<comment><USER11> Chrome's dev tools are the only thing keeping me with it. I use Firefox at home, and the dev tools have improved lots over the last year, but there are a few small annoyances compared to Chrome.

<comment><USER12> I switched to Safari recently for my main browsing. My life has significantly improved. Chrome was just too damn slow, and I always stayed with it because I thought I needed the extensions and the features that Safari lacked, and that Chrome iOS was better.

Turned out I didn't, and Safari has lots of great features that are well thought through.

I still use Chrome for web dev, but it only runs a single tab with the web app I'm working on.

Try new things! :)

</comment></comment></comment></comment><comment><USER13> I'm curious about the UX for such a feature, I'd presume it would be a nightmare to get right:

\- How would a user quickly set the category on a tab?

\- I would presume that a user would only want to categorize things once the browser becomes unwieldy. How could it be done in bulk?

\- Where would the UI elements for this go? Considering that Chrome strives to be minimalistic.

\- How would the categories be communicated to the user?

\- _I should be able to tell Chrome "Hi, [... snip ...]"_ How?

I'm fairly certain that this idea has been mulled over multiple times, even by Google. The problem isn't having the idea in the first place, it's the implementation. I think that if someone wanted Google to "steal" this, they would need to approach them with viable mockups demonstrating an elegant solution that fits in with the spirit of Chrome.

<comment><USER14> Time and parent alone would be a good start.

</comment></comment><comment><USER15> Opera 12 and before had this feature. You could save all open tabs/windows as a stored session with a name of your choice, then reopen it later.

Allowed you to have as many sessions as you wanted, though much of the time, I would end up realizing most of those tabs weren't that important and just delete the session later.

[http://help.opera.com/Windows/12.10/en/sessions.html](http://help.opera.com/Windows/12.10/en/sessions.html)

</comment><comment><USER16> The Chrome extension Spaces is close to that: [https://chrome.google.com/webstore/detail/spaces/cenkmofngpo...](https://chrome.google.com/webstore/detail/spaces/cenkmofngpohdnkbjdpilgpmbiiljjim)

</comment><comment><USER17> Usually when I have this issue in Chrome I just Bookmark -> Bookmark All Tabs -> Create a New Folder "Project A" do the same for "Project B". When I need to get back I open all the tabs in the Project x folder.

If you are on a Mac you can go a step further and create different desktops for different projects, the only draw back is if you accidentally Cmd + Q an app that is open on multiple desktops.

<comment><USER18> Bookmark all tabs is good but it doesn't update as you carry on with the project.

</comment></comment><comment><USER19> Tabs Outliner[1] is great for this. It's lacking sync (an extra top layer in the tree for each device would make sense), but other than that, it is fantastic, and has really reduced my memory usage back to normal levels. It allows you to suspend entire windows, and quickly browse all tabs. Allows for unlimited* levels of named trees/notes/windows/tabs. It does however NOT save the state of the page, only the URL.

When the Chrome Sidebar API[2] is implemented, I'm sure it will only get better, as the need for an extra window should no longer be necessary.

Here's a video overview of its features: [https://www.youtube.com/watch?v=OqjcrfKjobY](https://www.youtube.com/watch?v=OqjcrfKjobY)

* I haven't reached the maximum yet...

[1]: [https://chrome.google.com/webstore/detail/tabs- outliner/eggk...](https://chrome.google.com/webstore/detail/tabs- outliner/eggkanocgddhmamlbiijnphhppkpkmkl?hl=en)

[2]: [https://code.google.com/p/chromium/issues/detail?id=51084](https://code.google.com/p/chromium/issues/detail?id=51084)

<comment><USER12> Checked out Tabs Outliner a few years back. Too complex for me. But it feels like once you get the hang of it, it might be useful if you fear losing those golden tab gems.

IMHO you always come across more tabs than you ever have a chance to read. And you'll always get back to them again when you actually need them via Google search.

I would love a tab sidebar. This might make Firefox worth checking out.

</comment></comment><comment><USER20> Talking about tabs, I am really curious why links which get opened in new tabs don't feature a working back button. It really bothers me when reading an article that contains a lot of references, I open them, each one on a new tab, read through each one of them and then can't get back to the old one (I usually resort for Ctrl+Shift+T too many times).

</comment><comment><USER21> [https://www.one-tab.com/](https://www.one-tab.com/)

<comment><USER22> I've been appreciating The Great Suspender extension; [https://chrome.google.com/webstore/detail/the-great- suspende...](https://chrome.google.com/webstore/detail/the-great- suspender/klbibkeccnjlkjkiokjodocebajanakg?hl=en)

</comment></comment><comment><USER23> Comment already says it on the google plus page, but tab groups in firefox already do this.

</comment><comment> jack-r-abbit People keep talking about "power tab users" are in the minority. But you don't need to be a power tab user to want better tab management. I usually only have 10-15 tabs open but I really wish Chrome let me manage them better. Chrome has that setting to reopen the last tabs used when you close the browser. But it often gets confused when multiple windows are open. It only remembers the tabs of the last window closed. I feel like once every couple weeks I find myself re-opening/re-pinning my main tabs. I'd love to be able to just store/open a group of tabs I want to use.

</comment><comment><AUTHOR> I'd like to thank everyone who responded here. I'm now aware of OneTab, but their support for cross-syncing isn't done yet, and it doesn't help in the (somewhat degenerate case) of Chrome on Android (which always seems to be left behind when you're doing cool stuff).

Solving this with an extension seems suboptimal when Google may already have an internal unreleased project that does what I want.

If OneTab (or Spaces, another similar extension) could sync across my computers, this would probably be 90% of what I requested.

</comment><comment><USER24> Because it's the perfect example of a power user feature. Nothing wrong with that, just that it's the kind of thing that browser extensions are made for.

</comment><comment><USER25> I don't usually have more than 30 tabs open, my problem is separating them by 'topic'.

To a degree I can solve that with different browsers or profiles, but when clicking a link on irc or in a mail or twitter it always opens in the default browser.

My main gripe there's no way to have real context switches there, then again maybe I would just have to find a way to send a certain tab to a certain browser instance with a keyboard shortcut...

</comment><comment><USER26> I made a simple and effectve extension for that, because none of the existing ones worked for me or were spoiled with analytics / phoning home.

Manage Tabs - [https://chrome.google.com/webstore/detail/manage- tabs/kijdih...](https://chrome.google.com/webstore/detail/manage- tabs/kijdiheabofhiihcebgpeelmgfmcogel)

</comment><comment><USER27> I open one window per project, and use a good windows manager (awesome wm ^_^) and it works like a charm.

But then people don't want to use a tiling windows management because it's too hard to learn...

</comment><comment><USER14> Tabbed browsing itself is a band-aid over miserable browser document and state management.

Bookmarks are both too painful to manage or navigate (and despite both limitations, I use them extensively). Tabs address the situation of "I want to read this but not right now". Chrome's implementation makes managing, prioritizing, and relating tabs all but impossible.

The larger problem is that the entire browser paradigm is approaching its end- of-life date, and what is now "the browser" almost certainly wants to be four distinct classes of application:

* Reader: a document-oriented applicaton with commenting, bookmarking, newsfeed, bibliographic management, annotation, and commenting capabilities. A bit lof the love-child of the original Web browser model, eBook reader, RSS/Atom feed, Readability or similar "simplified Web" presentation tool, Usenet newsreader, and tools such as Zotero or Calibre. Actually, Zotero, Calibre, or an eBook reader might well assume this role.

* A generalized application platform. A cross between current "full-featured" browsers and mobile development environments. Likely based on the concept of downloading the App framework only when it updates, containing it within a sandboxed runtime, and interacting with cloud-based services as needed.

* A dedicated commerce platform. Firewalled from other uses, increasing both privacy and security, with purchase, order-fulfillment, and related functions offered securely. Possibly growing out of a dedicated commerce app, e.g., Amazon or iTunes.

* A dedicated media player. Rather than having dozens of videos and audio players scattered among browser tabs, a single application which can enqueue, play, and/or schedule playback. VLC is closest to this, and has many of the features I'd like, though none of the stability. youtube-dl, local filesystem storage, and mplayer are my usual solution these days.

[https://www.reddit.com/r/dredmorbius/comments/256lxu/tabbed_...](https://www.reddit.com/r/dredmorbius/comments/256lxu/tabbed_browsing_a_lousy_bandaid_over_poor_browser/)

Yes, I've heard the "but heavy tab users are a minority case".

Answering that:

1\. They're power users. Power users are a minority case. They're also a strong influencer community, and they lead migrations. Google Chrome (as with much else at Google) is no longer _attractive_ , it's simply _not sufficiently repulsive_. But it's a tool people are using because they perceive either alternatives or siwtching costs as insufficiently better. That can change rapidly.

2\. If you make something sufficiently painful, well, _NO SHIT._ People will tend to avoid it if they can. Power user's _can 't_ avoid it, and _will_ find alternatives, eventually.

It's not even a matter of "oh, I'll get around to reading that stuff. It's that the state of tab management, on top of memory issues with Chrome, is so fucking abysmal that I cannot sort out what the fuck is in tabs, or how they're related.

Eventually the session crashes and I start over, but there's _always_ painful state loss involved.

Why do I still use Chrome? Stylebot + Developer Tools. The state of Web design is so fucking abysmal that I've got 1700+ local stylesheets applied to various websites that I'd have to port and load somehow in Stylish on Firefox. And ... as annoying as other bits of Chrome are, the Developer Tools are decent, so fixing fucked-up Web design's a tad easier. And given the option of wanting to stab my eyes out staring at crap pages or dealing with Chrome's utterly fucked up memory and tab management ... tabs win, just barely.

But love Chrome? Who the fuck are you kidding?

</comment><comment><USER28> New Window. Right click on a bookmark folder. Open all bookmarks.

</comment><comment><USER29> should check out vivaldi browser. has built in tab groups.

</comment><comment><USER30> I don't like this idea at all. It looks a lot like Activities in KDE. I think it's very complex for the average user to understand. It should be done as an extension instead.</comment>


This working group has failed - <AUTHOR> https://www.ietf.org/mail-archive/web/tls/current/msg10598.html

<comment><USER2> Specs designed by committee usually fail when they produce just the "paper" and no reference implementation. Look at W3C, which consistently failed to develop their own reference browser. The same seems true for TLS, actual implementations are too complicated because the committee paid no attention to this. A positive example is MP3, where everyone just copied the reference codec in the beginning.

<comment><USER3> A good example here would be C++. Look at how long it took for C++11 to be implemented, but now at least two compilers are feature complete (gcc + clang) and now they're on schedule to be feature complete for C++1y[1], with implementation + specification in sync.

[1] [http://clang.llvm.org/cxx_status.html#cxx14](http://clang.llvm.org/cxx_status.html#cxx14)

<comment><USER4> It also helps that C++ doesn't have nearly the number of implementers in position to screw stuff up. Unlike any number of webservers, SSL libraries, load-balancers, firewalls, proxies, etc.

How many C++11 compilers are there? This support matrix[1] seems to indicate there are 2 compilers in the lead, with 5 providing fairly decent coverage. How popular is XLC++?

And anyways, adding another compiler is something you choose to do, and usually run a bit of tests for, right? Unlike networking protocols where it's invisible to you that someone has some idiotic inspection hardware that segfaults on certain packets and drops your connection.

Edit: Also, even if two compilers are feature complete, it doesn't mean they implement the features in perfectly compatible ways, right?

1: [https://wiki.apache.org/stdcxx/C%2B%2B0xCompilerSupport](https://wiki.apache.org/stdcxx/C%2B%2B0xCompilerSupport)

</comment></comment></comment><comment><USER4> Here's an interesting post about TLS compatibility[1]. I guess it explains why no browsers have had TLS 1.2 on by default for such a long time.

" To add to this discussion about protocol version intolerance, I've been tracking this problem in my SSL Pulse data set (SSL servers from the Alexa top 1 million).

Here's what I have for November:

      Total servers: 163,587

      TLS 1.0 intolerance        9
      TLS 1.1 intolerance    1,388
      TLS 1.2 intolerance    1,448 (~ 0.9%)
      TLS 1.3 intolerance   17,840 (~10.9%)
      TLS 2.98 intolerance 122,698 (~75.0%)

      Long handshake intolerance: 4,795 (~2.9%)

"

1: [https://www.ietf.org/mail- archive/web/tls/current/msg10657.h...](https://www.ietf.org/mail- archive/web/tls/current/msg10657.html)

<comment><USER5> There's a trade-off to be made. On the one hand browser users would like every page to "just work". On the other hand they want secure connections to actually be secure.

If those .9% of websites break in the latest versions of firefox, chrome, and IE they are more likely to be fixed than if they are coddled through some workaround or even worse by holding back general progress. The former is better for web security. On the other hand, people who want to go to those websites in the meantime will be inconvenienced.

Perhaps a compromise is to build the workaround, but put in an interstitial scare screen. That might generate the desirable social pressure on the website owner without making it impossible to visit.

<comment><USER6> > On the other hand, people who want to go to those websites in the meantime > will be inconvenienced.

…and they may well move to another browser which doesn't support TLS/1.2, or stay on an out-of-date (insecure!) version of the browser, which doesn't help web security either.

</comment></comment></comment><comment><USER7> Looks like it's down.

Cache: [http://webcache.googleusercontent.com/search?q=cache:https:/...](http://webcache.googleusercontent.com/search?q=cache:https://www.ietf.org/mail- archive/web/tls/current/msg10598.html&hl=en&strip=1)

</comment><comment><USER8> Given recent revelations, one has to wonder if the working group merely failed by itself or was given a substantial nudge in that direction by someone who wanted TLS to be insecure.

<comment><USER4> Apart from specific contributions by the NSA (if any?), is it hard to believe people screwed up? Look at HTML standards and what a mess that is. Hell, look at HTTP and the insane stuff in that spec.

I'm guessing spec writing is much harder than one might assume, especially if you're not writing elegant code to implement the protocol at the same time. Committees only make things worse, and the IETF RFC format doesn't help either. (Reading the SCSI specs, by comparison, with their nice graphical diagrams, is much cleaner - not that a simple RFC can't convey the same info, but nice diagrams do really help.)

Extensibility is something people get wrong all the time - the TLS 1.2 issue seems to be that enabling TLS 1.2 ends up breaking lots of users.

Without someone familiar with the subject pointing out exact contributions (I'd assume repeated issues raised by the same group of people), normal incompetence is more than enough to explain things, isn't it?

<comment><USER6> Spec writing is only half the challenge (and arguably a relatively easy one!).

A big problem with HTML and HTTP is the fact that error handling has always been undefined (the current HTML spec is the first real attempt to define error handling!) — so different people implement different things, and then when you end up with a single implementation with ~90% marketshare, everyone has to reverse-engineer that (and probably not perfectly!). Combine this with the fact that the majority of implementers of HTML and (to a only slightly less extent) HTTP are web developers who just want to get stuff working — they've never read a page of the spec in their life. So, guess what, they end up relying upon client's error-handling (typically the intersection of clients they care about — which when IE had 90%+ marketshare was often just IE, then see above about reverse-engineering).

The other big problem is the lack of generic test suites for the standards — far too often each implementer ends up writing their own tests, and then not sharing them (the IETF still has no real general infrastructure for hosting testsuites for RFCs!). At least around the W3C, there's been a relatively large movement in the past three years or thereabouts towards developing shared testsuites, in large part down to various Microsoft and Opera people (myself included, in the early days, as a disclaimer) and several WG chairs (trying to push specs to REC — which nowadays requires two interoperable implementations, and hence practically a testsuite), so things are at least slowly changing there. But there's still a lot of work to be done — and it's one area where improvements can have large effects, as it increases the consistency of all implementations, and makes it easier for smaller, and newer, competitors to enter the market.

</comment></comment></comment><comment><USER9> Following the thread, the TLS 1.2 spec was completed in 2008, but it wasn't supported in OpenSSL until mid-2012 - so anything that depends on OpenSSL had to wait until at least then, then go through the implentation and reshipping, then trickle on down to the end vendors. And with no-one using TLS 1.2 or having a need for it because it wasn't available, it was back-burnered by the browsers.

The follow-up comments paint a much fuller picture of why things are delayed, where the failures are, and what's going on.

<comment><USER8> If you read the follow-ups, it's not just that no-one used TLS 1.2 because it wasn't available, enabling support for it actually broke stuff for end users[1] - and the browser developers knew this was almost certain to be the case even without looking, because it almost always is.

Also, as the linked email points out, we shouldn't have needed TLS 1.2 in the first place in order to be secure. It was already known at the time TLS 1.0 was designed that they were doing things in ways likely to be insecure for no good reason, but they did it anyway.

[1] [https://www.ietf.org/mail- archive/web/tls/current/msg10614.h...](https://www.ietf.org/mail- archive/web/tls/current/msg10614.html)

<comment><USER10> Buggy Middleboxes broke. They're increasingly preventing deployment of new protocols and apps on the internet.

</comment></comment></comment><comment><USER11> Maybe making things more intelligible would help instead of using language that is extremely obfuscated and confusing, and unaccompanied by any actual mathematics?

Take this sentence from the email for instance:

"Even AES-GCM got screwed up: nonces should be counters, but all implementations make them random, introducing an artificial birthday bound issue due to truncation in the standard."

I have no idea WTF this means, but let's go over it:

nonce: I know this is a randomly generated number that can be only used once -- now why should it be a counter? No idea.

"but all implementations make them random": wait, aren't they supposed to be random by definition? According to the above line though, they are supposed to be random. Damn, what I knew must be wrong. I wonder if this person on the internet has submitted some sort of explanation about this somewhere.

'artificial birthday bound issue': Assuming this refers to the birthday attack ([http://en.wikipedia.org/wiki/Birthday_attack](http://en.wikipedia.org/wiki/Birthday_attack)). Why is it "artificial"? Can we see some mathematical proofs attached please? I sort of get the idea here -- because the nonce is random, it is vulnerable to being recreated after a certain number of attempts, but there is nothing concrete attached here. Or I could be totally wrong in this interpretation. God knows, and maybe this chap.

"...due to truncation in the standard." \-- Do you mean some sort of _mathematical_ truncation, i.e. "my number was truncated to 16 bits", or truncation of the standard itself "the last section of the standard was removed"? Please be clear.

Same goes for most things related to crypto -- if you want stuff like TLS to be examined by more eyeballs and find more bugs, you have to first try and make it more accessible. The sentences above are, in my opinion, a complete communication failure.

<comment><USER12> If you choose a random nonce then it follows that a nonce could be randomly reused. If there are N possible nonces this will happen on average after approximately sqrt(N) packets. If you use a counter as a nonce it will only repeat after N packets, no matter what.

For some algorithms a simple incremented value is all that's needed "1, 2, 3, ..." but this means an attacker seeing only two packets can at least estimate how quickly packets are being sent. However, if you encrypt this stream of incrementing numbers with a constant symmetric key you get the best of both worlds: a nonce stream that looks random but is guaranteed not to repeat until after each possible value has been used. Usually when crypto people talk about a "counter" this is the technique they're referring to.

<comment><USER11> Thanks! Perfect explanation of the 'counter' term, makes sense. :) Upvoted.</comment></comment></comment>


Tesla Shares Fall as It Fails to Make It into S&P 500 Index - <AUTHOR> https://www.nytimes.com/reuters/2020/09/08/business/08reuters-tesla-stocks.html <comment><USER8> I never thought about how a stock ends up on the Index before! Apparently it's by committee:

[https://en.wikipedia.org/wiki/S%26P_500_Index#Selection_crit...](https://en.wikipedia.org/wiki/S%26P_500_Index#Selection_criteria)

"When considering the eligibility of a new addition, the committee assesses the company's merit using eight primary criteria: market capitalization, liquidity, domicile, public float, Global Industry Classification Standard and representation of the industries in the economy of the United States, financial viability, length of time publicly traded, and stock exchange."

<comment><USER9> Actual reason is Tesla has multiple class shares: [https://www.dividend.com/news/2017/11/03/companies- multiple-...](https://www.dividend.com/news/2017/11/03/companies-multiple- share-class-structures-cannot-be-part-sp-500/)

"On July 31 [2017], S&P Dow Jones Indices, the outfit that oversees the S&P 500 and its constituency, announced that it would take steps to exclude companies with multiple share class structures. ... The move comes amid blowback from investors who have complained about company practices that are designed to keep majority, or total, voting control in the hands of its management and founders"

<comment><USER10> This is very interesting. However, it doesn't appear this rule is applied consistently as Facebook is in the S&P500 and is probably the most infamous example of a multi-class share structure.

<comment><USER11> Facebook is grandfathered in, having been added in 2013. Although the linked article says the following:

> Companies with multiple share classes already in one of the indices will > have until September 2022 to change their structures or face removal.

<comment><USER12> That's not S&P -- that's FTSE Russell [1]:

> For existing constituents, the rule will apply with effect from September > 2022, thus affording a five year grandfathering period to allow constituent > companies to change their capital structure if they so wish.

From my reading, S&P has not yet announced a similar policy.

[1] [https://research.ftserussell.com/products/downloads/FTSE_Rus...](https://research.ftserussell.com/products/downloads/FTSE_Russell_Voting_Rights_Consultation_Next_Steps.pdf)

</comment></comment></comment></comment></comment><comment><USER13> I am reminded of Elon Musk's tweet [1] a mere _three months_ ago, when the stock rose from an already hard to believe [2] $80 to an incredible $140 (adjusted for split):

 _Tesla stock price is too high imo_

And yet people still piled onto this stock. As if they knew something Musk didn't.

[1] [https://twitter.com/elonmusk/status/1256239815256797184](https://twitter.com/elonmusk/status/1256239815256797184)

[2] Hard to believe given actual revenues and projected revenue growth

<comment><USER14> That tweet was actually intended to hide the message of the split. You can see that it was sent on 5/1 at 8:11. The 5:1 split was announced on 8/11.

<comment><USER15> That's some advanced numerology right here...

Is Elon Musk really sending hidden messages using tweet times? Has he done it before?

<comment><USER16> > advanced numerology

Or just, you know, good old search engine optimization. I'd assume this is widely done in marketing/PR.

<comment><USER17> It's hard to believe any marketing team has control over Musk's twitter, given things like his bragging about overthrowing the Bolivia government.

<comment><USER18> "Ok, today as a viral marketing plan we're going to get our boss in trouble with the SEC."

</comment></comment></comment></comment></comment></comment><comment><USER19> That was the reason why it fell? In that case looks liem they made the right decision not to include it. Any stock that moves 20% on this kind of decision is fundamentally flawed.

<comment><USER20> TSLA shares fell back to levels not seen since August 17th, _3 entire weeks ago_. In the meantime, the company confirmed that it sold $5Billion of additional shares into the market last week. It's not just the S&P news, IMO.

Disclaimer: I am short $TSLA since about 2 weeks ago, because I can't wrap my head around the valuation and near parabolic move short-term. I do think that they are more valuable than some other large automakers, but probably not more than all of them put together. :)

<comment><USER21> > Disclaimer: I am short $TSLA since about 2 weeks ago

How/where did you get shares to short? At what margin interest rate are you having to pay?

<comment><USER22> he's probably using puts

<comment><USER20> No. I'm outright shorting the shares. Implied volatility is so high now as to make buying options fairly unattractive for medium and long-term bets.

<comment><USER21> Say you want to short $10,000 worth of TSLA shares, what kind of margin interest rate are you paying? Is it 8%/yr?

<comment><USER20> I've held the shares short for short enough time that I haven't gotten tagged with any charges yet to give you actuals. The interest is super-low in any case, so when you're shorting shares that have moved parabolically, you're probably not worried about whether the borrow is 1% or 4% per year (or at least I'm not).

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> The vauation on this stock is still insane. They were valued 2x of Toyota and VW. Will they ever make as many cars or be as profitable as those companies?

<comment><USER24> Even if you assume tesla is only making cars (they're doing more than that), why is no one asking why existing car companies are making so little? Why is apple worth $2 trillion based on a phone, while car manufacturers making something even more valuable than a phone, are only ~25% of that combined (excluding Tesla)? It's because traditional car companies are terrible at capturing the value they create. They're wasting a ton of money on expensive ads competing with each other. They outsource their entire supply chain, giving profit away to suppliers. They have dealer networks they are beholden to which eats into their margins. They don't upsell high-margin software add- ons to existing customers. They innovate slowly and reluctantly. Companies that aren't good at turning a profit don't tend to be worth much.

When was the last time you saw a Tesla ad on TV? When was the last time you saw Toyota or Ford sell a $7,000 driver assist upgrade or a $2,000 speed upgrade (both delivered over-the-air and instantly)? When was the last time you saw a Tesla dealer and not a store where you just go buy a Tesla like an iPhone? Tesla has the chance to dominate the car the way Apple dominates the smartphone and capture an enormous amount of value in the process, way more than any traditional car company has been able to.

<comment><USER25> Apple should not be used as an example. They are a company that lives off Marketing and gets away with anti-consumer and anti-developer practices. They are somewhat unique in that sense.

It's better to compare an automotive giant with a different tech giant.

Or Tesla with another big brand/marketing car company like Audi, BMW.

The boring reality is that it's a bubble.

<comment><USER24> Ok, let's compare with Amazon then. They are also able to capture an enormous amount of value despite being in a very competitive industry (retail). They also are doing other things beyond retail (AWS).

It can be both a bubble and people can also be failing to make the right comparisons. Apple and Amazon have both been in bubble territory before. Eventually their valuations were justified.

</comment></comment></comment></comment><comment><USER26> These kinds of phenomena make me slightly worried about the long-term viability of index funds as an investing strategy.

There is absolutely nothing about this information that reflects on Tesla's value as a company, or its business prospects. And, while there's certainly some intrinsic value in an S&P 500 listing - as an advertising device, if nothing else - it's hard to imagine that it's worth $50bn. That leaves me worrying that what's really going on here is that index investors have created a large arbitrage opportunity that people were trying to exploit.

<comment><USER18> Why does this make you worry about index funds? Assuming you invest in a well diversified fund, the more of the market you invest in, the less one securities shenanigans matter.

<comment><USER26> A lot of people are just piled onto S&P 500 index funds, often because that's the only passive option offered by their 401(k) plan.

<comment><USER18> In that case it's really just one index fund - the one that matches the S&P, and not index funds in general. I'm not sure why you use this as evidence of the S&P being an issue as they explicitly excluded that TSLA craziness.

<comment><USER26> We seem to be running afoul of the is-ought problem here. I'm not talking about how things ought to work. I'm inclined to agree with you on that front, but it's also not the concern I'm raising. I'm saying that this craziness strikes me as an indication that how things are actually working may not be how they ought to work. Or at least not how they ought to work according to the advice that's being given to countless retail investors.

<comment><USER18> But I'm still confused - the TSLA craziness is specifically excluded from index funds. If you had money in TSLA chances are you put it there yourself outside of an index fund and certainly not one that was S&P 500 focused (which is apparently the default choice).

<comment><USER26> The big pop and big drop around the S&P 500 decision is not just TSLA craziness. It's also S&P 500 craziness - people were, I'm guessing, speculating on the expected effect that an S&P 500 listing would have on demand for TSLA shares.

Or, to put it another way, I think we just saw another indication that the S&P 500 index is not immune to Goodhart's Law.

<comment><USER27> Think it's more that there are lots of less sophisticated investors in on TSLA. Inclusion in the SP500 does not usually send a stock to the moon because it's already priced in.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> Is that a bad thing? Tesla's consumer base is not large or diverse enough to be representative of the national economy or population.

<comment><USER29> Tesla sells globally, literally operates the largest car charging network in the world, they have stores and service centers all over the globe. They the major players in EV in all major EV markets, US, Europe, China.

There is absolutely no reason to exclude them based on your criteria.

And also, there is no evidence that these stock prices changes are related to S&P 500 at all. It doesn't really matter for Tesla if they are in the S&P 500.

Edit:

What the hell is it with downvoting? Tesla is a global 24.58 billion USD revenue company. There is LITERALLY no indication in the S&P guidelines that Tesla doesn't fulfill some requirement. That's a simple fact no matter if you like Tesla or not.

Again, I couldn't care less if Tesla is in the S&P500 or not, but there is no series argument against it.

<comment><USER30> > They the major players in EV in all major EV markets, US, Europe, China.

[https://insideevs.com/news/442139/norway-etron-eqc-sales- aug...](https://insideevs.com/news/442139/norway-etron-eqc-sales-august-2020/)

In a more mature EV market like Norway where there's actual competition and consumer choice, Tesla isn't doing so hot. From the article:

        Audi e-tron - <USER2>
        Mercedes-Benz EQC - <USER3>
        Polestar 2 - 504 (according to separate source)
        Volkswagen e-Golf - N/A (511 total with ICE; mostly BEV)
        Hyundai Kona Electric - N/A (413 total with ICE; mostly BEV)
        MG ZS EV - <USER4>
        Nissan LEAF - <USER5>
        Tesla Model 3 - 264 (total Tesla brand: 348)
        Renault ZOE - <USER6>
        BMW i3 - <USER7>

That's about a 7% market share (edit: New car sales in Norway, August, 2020) for Model 3, 9% for all Tesla models combined.

If the VW group is already outselling Tesla in Norway 5 to 1 just in the BEV category, how can Tesla's market cap be 4 times higher than VW's? It fundamentally doesn't make sense.

<comment><USER29> Using one month of data from one small country is honestly the most embarrassing argument I have ever seen on Hacker News.

<comment><USER30> New BEV car sales January to August 2020 in Germany:

Tesla: 10.6%

VW Group: 35.3%

Tesla had a fantastic first mover advantage, they're not making bad cars, but they're not special anymore. And in the real world, with competition, they're simply not stacking up very well. The trend is pretty clear to me. The stock market obviously disagrees, though.

<comment><USER29> Tesla is 28% full EV market and if you include Plug-in hybrids (you shouldn't) its 20% of the global market in the first half of 2020 and they have been improving their global market share consistently over the last couple years. But don't let real evidence stop you form selecting specific data samples that prove your point you want to make.

No company in its right mind could hold 30% of the total car market, but what is actually surprising is that unlike many analysis's predicted, their global market share has been going up. Maybe the next round of Tesla killer is finally gone do something.

You are comparing Tesla to the largest auto maker in its home market during a global pandemic where Tesla has to export their car from California (yes they are insane enough to build cars in California) and they have to pay tariffs.

Tesla is building a gigantic factory in the middle of Europe until then Tesla will not have the market leading position in Europe while all European companies dumb their vehicles in Europe first. I still expect Tesla to big a significant junk of the European market going forward.

<comment><USER31> OP points real evidence for BEV.

<comment><USER29> [https://cleantechnica.com/2020/08/15/tesla-had-28-of- worlds-...](https://cleantechnica.com/2020/08/15/tesla-had-28-of-worlds-fully- electric-vehicle-sales-in-1st-half-of-2020/)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> Is the SP500 reshuffle each month? Why Tesla inclusion was expected this month rather than next or previous?

</comment><comment><USER33> >Shares of Etsy, which have more than doubled this year, were up about 1% in premarket trading, while Teradyne and Catalent were lower.

Shouldn't they all be up? Or was this already priced in?

<comment><USER27> Anything that should be in the index shouldn't be affected too much by being added to the index otherwise it was under / over valued in the first place.

</comment></comment><comment><USER34> Tesla shares might be falling for other reasons. Not being profitable for years and years is one reason why this might be happening.

<comment><USER35> Or just retail investors cashing out of an absurd, unjustified bubble

<comment><USER34> Another reasonable explanation.

</comment></comment></comment><comment><USER36> Am I the only one that thinks this is fundamentally unfair? What's the point of having inclusion guidelines if you can just change them willy nilly to suit your own agenda?

We need a more algorithmic index, not one ruled by one central committee.

Wonder if there's an ETF that simply does market cap weighting and just picks top public companies by valuation.

<comment><USER37> > What's the point of having inclusion guidelines if you can just change them > willy nilly to suit your own agenda?

You said it yourself: they're _guide_ lines. I'm glad there are humans in the loop to exercise judgement when the guidelines may be giving a funny results.

> We need a more algorithmic index, not one ruled by one central committee.

IIRC, there already are many "algorithmic indexes", but they're not the S&P500 and there's no reason for the S&P500 to be one.

<comment><USER36> You just happen to agree with this one, so you find reasons to justify it like "exercising judgement".

What if they exclude a company because of political ties to communist regimes? Or ESG concerns? To me neither of these is acceptable. I would be pretty annoyed if Exxon was excluded from SP500 because they contribute to Global Warming.

Go pick another index is not a defensible position when I'm criticizing the index's policies specifically. Yet to hear good reasons for why a committee "exercising judgement" is a good thing for the average investor.</comment></comment></comment>


Persona makes signing in easy for Gmail users - <AUTHOR> http://identity.mozilla.com/post/57712756801/persona-makes-signing-in-easy-for-gmail-users <comment><USER2> The problem with persona is that it sends the same identifier to all websites (nominally your email address). That makes it super-easy for those websites to feed your activity to a central tracker like DoubleClick which will consolidate all usage information from all DoubleClick affiliated websites.

Persona would be a lot more privacy-preserving if it generated a unique identifier for each website. A "persona" for each website instead of one persona for the entire interwebz. Since the system is mostly automated it shouldn't be that hard to add one extra layer of indirection.

It might even be possible to shoe-horn it in to the current protocol with just a little bit extra on the browser and identity provider sides, but no change on the website code.

If anyone has actually done that, please post, I'd like to hear about it. Availability of that functionality would sway me to start using Persona and probably anyone else who is worried about spreading their email adddress far and wide across the internet.

<comment><AUTHOR> Persona isn't a panacea. If websites collude, and you use the same address on each site, then they'll be able to correlate their user tables.

That's identical to the status quo, and fixing it is not one of Persona's explicit goals.

We're very consciously trying to hit a pragmatic middle ground that moves the web closer to user empowerment, without being so different as to hinder adoption. Consider: if you're already collecting email addresses for your users, you can immediately start using Persona without changing any of your assumptions about your data model. It's portable and it dovetails into current practices.

However, it _is_ technically possible to do what you want right now, so long as you have your own domain and write a small browser extension. Longer term, we're currently working with a partner on a possible extension to the provider protocol which would make it easier to implement that sort of "directed identity."

</comment></comment><comment><USER3> I've seen a few demos of this. The developer story is great.

Easy to integrate, no need to worry about screwing up storing passwords and you are not abdicating authentication to some evil or possibly evil in the future, company.

<comment><USER4> Not trying to troll or anything, but how do we know Mozilla won't be evil in the future? I'm sure you could find people who thought that about Google back in the day, they seem to now be routinely called out for questionable evils.

<comment><USER5> AFAIK Right now there are two things that Mozilla controls.

1) login.persona.org that takes care of authentication

2) a JavaScript shim that developers add to their sites to get the login button to work.

Persona is designed in such a way that reliance on Mozilla will be phased out as email providers take care of #1 and as browsers start to implement #2. As of now I think FireFox is the only browser that has #2 baked in.

<comment><USER6> Not clear to me why we would trust "email providers" to do a great (i.e. well- implemented, secure, etc.) job at providing authentication services.

<comment><USER7> Then pick someone who does convince you, or run your own authentication. The point is that it is designed to be decentralised.

</comment></comment></comment></comment></comment><comment><USER8> I hope there will soon be a way to `apt-get install mozilla-persona` on a personal server. That would seriously help the deployment a really decentralized Persona.

<comment><USER9> Tell me more!

Do you want Persona authentication on your website or do you want a deamon that is an identity provider for your personal domain?

What language or platform would be ideal?

<comment><USER10> I want to be my own identity provider, which ever web technology, php, ruby, python, JavaScript.

<comment><USER9> This is a NodeJS personal project that I use to host my identity: [https://github.com/ozten/hostedpersona](https://github.com/ozten/hostedpersona)

[https://ozten.com/.well-known/browserid](https://ozten.com/.well- known/browserid) (a static website) delegates to [https://hostedpersona.me/.well- known/browserid](https://hostedpersona.me/.well-known/browserid) which I run on an ec2 instance.

This clearly isn't as polished as aptitude install, but feel free to fork and play.

<comment><USER11> I wrote a service so you don't have to do any of that: [https://persowna.net/](https://persowna.net/)

Just add the .well-known file to your site, and that's it.

EDIT: Actually, I might just open-source this and keep the hosted version for people who want convenience.

<comment><USER12> Side note, Your font differs on [https://persowna.net/pricing/](https://persowna.net/pricing/) and [https://persowna.net/](https://persowna.net/) for the logotype.

Awesome job on the site!

<comment><USER11> Oops, good catch! Thanks!

EDIT: This is really odd, it's the exact same HTML/CSS, yet a different typeface. Weird.

EDIT 2: It would help if I had actually included the font in the header. Thanks again :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Really excited for this. Password authentication is an absolute disaster on the Internet, and despite at least 8 years of development solutions like OpenID are not succeeding fast enough. Mozilla Persona looks really promising. Sure wish there were a Chrome extension for it!

<comment><AUTHOR> There isn't a Firefox extension yet, either. :) JavaScript polyfills are fun!

(Persona works on all major browsers, save MobileIE and Chrome for iOS. Fixes are in the works for those two.)

</comment></comment><comment><USER14> I wish Hacker News used Persona.

<comment><USER15> It used some another (failed?) provider before (which connected accounts to Gmail, Yahoo, etc.)

<comment><AUTHOR> HN was using Clickpass (YC Summer 07), which was acquired and shuttered by Janrain early last year. Amusingly enough, Stack Overflow still has a (broken) Clickpass button on its login page.

If I recall correctly, Clickpass was a centralized OpenID proxy, whereas Persona is trying to bootstrap a fully decentralized protocol. We don't want to even be able to track you. :)

[Edit: Corrected YC cohort. Thanks wamatt!]

<comment><USER16> "Amusingly enough, Stack Overflow still has a (broken) Clickpass button on its login page."

Where? I can't see it.

<comment><AUTHOR> The button was removed a few hours ago: [http://meta.stackoverflow.com/questions/192501/remove- obsole...](http://meta.stackoverflow.com/questions/192501/remove-obsolete- clickpass-login-option)

</comment></comment></comment></comment></comment><comment><USER17> The only bad thing with this new Gmail integration is that it gets _more_ annoying if you have multiple Gmail accounts, or aren't logged in to the Gmail account you want to use.

And some things, like using firstname.lastname@example.com doesn't work at all.

<comment><AUTHOR> firstname.lastname@example.com should absolutely work -- please file a bug if not: [https://github.com/mozilla/browserid- sideshow/issues/new](https://github.com/mozilla/browserid-sideshow/issues/new)

<comment><USER17> Huh - it does work, as you say. I guess I misremembered.

EDIT: Now I remember my use case.

My email is actually firstname.lastname@example.com, and so I want to sign in with the same randomstring every time. Previously when signing in to Persona with my Gmail email address it would suggest all alternatives, and I'd choose the appropriate one. Now it logs in with Gmail directly instead.

Of course, this is such an edge case that it's probably not worth doing anything about. And I can simply sign into Persona with email@example.com for the previous functionality.

<comment><USER17> Yet another use case that's more difficult now: I use email@example.com for some sites where I expect to get lots of spam, and then forward email based on some filters.

<comment><AUTHOR> We'll switch from proxying via OpenID to OAuth 2 in the next few months, which will make that seamless again thanks to the `login_hint` option to Google's OAuth endpoint.

</comment></comment></comment></comment></comment><comment><USER18> I'm looking forward to when their LDAP adapter [1] is ready for prime-time so that we can use it internally for our own email addresses. I'm curious if the GMail adapter would work if you host your company email at google?

[1] [https://github.com/mozilla/vinz- clortho/](https://github.com/mozilla/vinz-clortho/)

<comment><AUTHOR> We're using Vinz Clortho in production right now (try to log in as firstname.lastname@example.com and you'll be prompted for my LDAP password).

It's not super generalizable, but if you're interested in rolling it out on your end, ping our mailing list ([https://lists.mozilla.org/listinfo/dev- identity](https://lists.mozilla.org/listinfo/dev-identity)) and we're happy to support you while you get that going.

A generic Google Apps bridge is somewhat tricky, but we're really interested in prototyping it over the next few months.

</comment></comment><comment><USER19> If you just wanna try it:

[http://myfavoritebeer.org/](http://myfavoritebeer.org/)

and put your gmail in the box :)

</comment><comment><USER20> It doesn't work with google apps, unfortunately.

Which is completely logical when I think about it since persona would not use the mx record to find the identity provider.

<comment><USER21> Actually, why not?

Looking for that "aspmx.l.google.com" entry in the MX record would let them know, with a high degree of certainty, that Google is the login authority for that particular email address.

Is there something I'm missing?

<comment><USER22> There's the /.well-known/browserid [1] file that can be used to delegate a domain to another identity provider.

The main thing is that while Persona talks about email verification, the protocol doesn't require that email handling exists. Just that a server vouches for the existence of a user@host, so using MX records wouldn't be 'correct' even if it would be a useful heuristic for google apps domains.

There has been talk of using SRV records, but it looks like the .well- known/browserid file will be the recommended way to do things.

[1] [https://developer.mozilla.org/en- US/docs/Mozilla/Persona/.we...](https://developer.mozilla.org/en- US/docs/Mozilla/Persona/.well-known-browserid)

</comment></comment></comment><comment> workhere-io If you're interested in integrating Persona into your website, I've made a couple of examples of how to do it:

[https://github.com/workhere-io/personaexamples](https://github.com/workhere- io/personaexamples)

There's also a demo that shows how Persona works (doesn't save any of your info):

[http://personaexamples.workhere.io/](http://personaexamples.workhere.io/)

</comment><comment><USER23> This seems like it just adds another click for gmail/yahoo users? I don't understand. Added another step to the login process and I think I'll have to change around some of my javascript to prevent returning users from "magically" authenticating after Persona gets around to authenticating them.

Weird. Oh well. Can't bitch much with a free service can I?

<comment><USER24> They replaced the step where you had to enter your "Persona password" with one click confirming your gmail credentials to Persona. You have to do it just once.

(And not even once per website, just once in a lifetime.)

</comment></comment><comment><USER25> If anyone wants to hear more about Persona and lives around the Edinburgh (Scotland) area then please feel free to pop along to a talk that one of the Persona developers is giving. [https://edpug2013aug.eventbrite.co.uk/?ref=ecal](https://edpug2013aug.eventbrite.co.uk/?ref=ecal)

</comment><comment><USER26> I'm really glad they finally added this. Persona is a great way to login and better for developers and users.

<comment><USER27> What is the benefit of this (from a developer/website perspective) over using OpenID? I can't really see the difference... obviously I'm missing something fundamental...

<comment><AUTHOR> The main things are ubiquity, ease of use, and privacy.

\- Persona works with any email address. This means you can reach anyone that hits your site, without forcing them to sign up with a third party provider.

\- I can answer the question "what email address do you want to log in with?" I can't answer the question "what is your OpenID?" nor can I remember which of the 13 buttons on Stack Overflow I used last.

\- OpenID requires phoning home with every login transaction. Persona explicitly does not. Your provider doesn't get to learn where you are logging in.

Edit: Put another way, can you tell me what your Google OpenID URL is without cheating? Can most people? If not, then you're only able to select a provider from a predetermined whitelist on each website. That undermines your ability to self-identify, self-assert, and choose who you trust. The open web deserves better.

<comment> X-Istence [http://profiles.google.com/xistence/](http://profiles.google.com/xistence/)

Or that was my Google OpenID at one point, not sure if it still acts like one or not.

<comment><USER28> While the HN community understood that, my mother was _never_ going to grasp the idea of ownership of a URL as a login credentials. Many people don't even understand URLs and just Google for everything they want.

Email addresses have been used as login credentials for a while, so people are used to that. The explanation of Persona might be a little weird, but it's not as totally disabling to a nontechnical user as being asked to sign in with OpenID.

</comment></comment></comment></comment></comment><comment><USER29> 1\. Why the popup window?

2\. Are developers permitted to strip the Persona branding - to make the login process seem to flow with the current website - not a bolt on?

3\. Would you consider including tiny profile icon links next to the button itself, to facilitate single-click profile sign-on/switch?

<comment><AUTHOR> > _1\. Why the popup window?_

Persona follows the LIFD architecture: [http://www.open- mike.org/entry/lifding-the-web](http://www.open-mike.org/entry/lifding-the- web)

Popups allow us to create a nice messaging channel between the shim / localstorage at persona.org and the website the user is trying to log into, without losing their state on that website.

> _2\. Are developers permitted to strip the Persona branding - to make the > login process seem to flow with the current website - not a bolt on?_

Sure. Brand it however you want. "Sign in with your email" converts best. The popup will always follow the same basic form, but you are able to add your logo, a human readable name, and a background color to influence its design: [http://identity.mozilla.com/post/55796551587/persona-a- login...](http://identity.mozilla.com/post/55796551587/persona-a-login-that- matches-your-site)

Check out the login on [https://see.drupalpersona.me](https://see.drupalpersona.me) [https://webmaker.org](https://webmaker.org) and [https://ting.com](https://ting.com) for examples.

> _3\. Would you consider including tiny profile icon links next to the button > itself, to facilitate single-click profile sign-on /switch?_

Our UX folks are actively experimenting with this. Look for Ryan Feeley's posts on the dev-identity mailing list for some explorations.

</comment></comment><comment><USER30> Does this mean that Google implemented a Persona endpoint for Gmail, or that Mozilla is now using OpenID (or whatever it is Google uses now) to piggyback on Google's existing login mechanisms?

<comment><AUTHOR> Croikle's right. This is using Google's public OpenID endpoint to validate your email address, and bootstrap a Persona certificate. We did this independently of Google, though we are in informal contact with the relevant folks on that side of the Valley.

</comment></comment><comment><USER31> Can someone explain the security implications of Persona? In what ways is it more or less secure than other authentication mechanisms (username/password, two factor auth, etc)? Thanks!

<comment><USER32> Persona is basically just public-key cryptography, but with a nice interface on top.

What you're really doing when you sign in to your identity provider is getting a certificate, signed by them, and containing a serialized public key (from a keypair generated and stored in your browser).

What you're really doing when "signing in" to a Persona-enabled site is sending them the certificate and a signed assertion, and letting them check all the signatures (public key in the certificate verifies the signature on the assertion, and the provider's public key is obtained to verify the signature on the certificate).

The only entity involved in this who needs to get a password from you is the identity provider, and password auth isn't required for that; it's just an easy and common way to do it. Sites you log into using Persona never ask for, see, or store a password for you.

The certificates are transient (they expire within 24 hours). The assertions generated by your browser are transient (they expire within 5 minutes). The keypairs generated and stored by your browser can be transient (you don't need to use the same keypair each time you sign in to your identity provider), and are tied to a specific email address and browser instance.

The whole thing is also designed to be decentralized. For most people, for now, Mozilla is the identity provider, but you can run your own (relatively easy) or use a trusted third-party provider. All that matters in a provider is that it speaks the protocol.

This means that comparing Persona to "password authentication" or "two-factor auth" is not really a useful question; your provider can use any mechanism you both agree on to verify you and give you a certificate. Though the immediate big win is, of course, that if there's a password involved, only the provider ever handles it, so you don't have to worry about a bunch of sites' password- storage practices, and you may not even have to worry about your provider's (if your provider doesn't use passwords to verify you).

The provider also doesn't know what sites you're signing in to with Persona; they don't receive the assertion from the site you sign into, they just provide a copy of their public key so the site can complete verification.

</comment></comment><comment><USER33> Ok, that is a big deal.

Must add that to velruse.

</comment><comment><USER34> This worries me a little. Perhaps because I don't fully understand what's going on under the bonnet. When I give a website my email address, some communication must happen between that website and persona. So there's some centralised persona server sending auth tokens back and forth between websites that use persona api? Am I misunderstanding?

If that's not the case, then what, exactly, information does website X have about me now that I have 'logged in using persona'?

<comment><USER28> I had this misunderstanding also, but if I understand it correctly...

Basically a site using Persona tries to send you to your email provider to authenticate. If your email provider is running Persona, you'll authenticate through them, and the email provider sends a token back confirming your identity.

Mozilla is the default identity provider for people whose email providers don't run Persona (yet). Once the project gains widespread adoption, Mozilla won't be processing much if any authentications because they'll be distributed to email providers.

Also it will in theory work as a browser extension, so your email provider sends your _browser_ the token, and your browser sends the token to the websites you log in to. So your email provider doesn't know where you're logging in.

<comment><USER34> >Also it will in theory work as a browser extension, so your email provider sends your browser the token, and your browser sends the token to the websites you log in to. So your email provider doesn't know where you're logging in.

I don't understand this. Presumably there's nothing stopping Website X sending both: a) my email address; and b) Website X's URL.

Scenario: Joe Bloggs tries to log in to www.SiteThatSellsCars.com using Persona. Joe enters his email address. SiteThatSellsCars sends Joe's email address and "www.SiteThatSellsCars.com" to Joe's ISP. This translates to SiteThatSellsCars saying, "Hey, Joe's ISP, Joe is looking to buy a car, you should send him a metric shit-load of car adverts. He might not like it, but whatever. Thanks for the $20!". Then Joe's ISP replies with, "I sent Joe a token to his browser so he thinks he still has his privacy, but fuck him. Every customer you tell us about, we'll give you $20."

Perhaps I am being cynical.

<comment><USER35> The site doesn't send anything at all to the identity provider. Your browser sends an authentication requests to the identity provider and relay it the site it wants to log into.

The site then checks the request is really signed by the identity provider and lets the user in.

The identity provider knows two things:

\- You asked to log in somewhere \- At least one person logged to site X because site X asked for its public key

</comment></comment></comment></comment><comment><USER36> Congratulations to the team!

</comment><comment><USER37> Still annoying I have to type in my email address even though I'm already logged in to Gmail. With OpenID I just click a Google icon, some auth clicks, and I'm done. With this I have to type in my email and do some auth clicks.

<comment><USER38> Isn't this more of an issue with the current browser you're using? As in, once fully implemented in the browser you won't be prompted to enter it at all. Also, my understanding was that your session information isn't passed along (privacy feature), so it would have no clue you're logged in elsewhere.

</comment></comment><comment><USER39> I like idea of Persona, but the idea of requiring emails prevents me from ever implementing it. There are plenty of places where I need an identity system, but don't want to force users to fork over their email address.

<comment><USER40> You almost always want their email address so that you can email them a password reset link in case they forget their password, which is even more important on smaller obscure sites where that's bound to happen.

<comment><USER39> If users don't want to provide an email (and then can't reset their password), that should be their prerogative.

<comment><USER41> As a user who doesn't want to provide my personal email to random services, I have a throwaway email on a different provider with a gibberish username. Given that signing up for 99% of services _already_ requires an email account (or a Facebook/Twitter login, which themselves require a verified email address), Persona is no less onerous.

</comment></comment></comment></comment><comment><USER42> Someone still needs to solve the "what verifier do I use problem" in a decentralized way, or we're going to see Persona follow OAuth and be dominated by Google, Facebook, and Twitter accounts.

<comment><AUTHOR> I think Persona _does_ solve that, or at least, is designed to. Could you say more about what you're thinking?

(Persona always prompts you with a _completely free-form_ email input field and routes you to the appropriate provider based on that.)

<comment><USER42> You haven't reached the "verifier" step yet, which is step 4 [https://developer.mozilla.org/en- US/docs/Mozilla/Persona/Qui...](https://developer.mozilla.org/en- US/docs/Mozilla/Persona/Quick_Setup)

<comment><AUTHOR> Oh, that. It's completely possible to do all of the verification locally, so you don't have to talk to our hosted verifier. We're working on building libraries to make that easier, but we still want to tweak our data formats a little bit before recommending local verification.

In particular, we're watching the IETF's JOSE family of standards pretty closely.

</comment></comment></comment></comment><comment><USER43> So...that means instead of someone knowing my password to get into xyz website, they can easily just use persona which in a few clicks will let them into my account?

<comment><AUTHOR> Sure, if they're logged into your Gmail account at the same time. At which point it's already game over. :)

<comment><USER43> Touche sir.

</comment></comment></comment><comment><USER44> I prefer Lastpass and dont see a need to centralize login solutions. In fact, every time you centralize something, it becomes vulnerable.

<comment><USER7> The point of Persona is decentralising logins.

</comment></comment><comment><USER45> A company build upon a work-around. I think this is a new level of epic cruft.</comment>


Matlab's First Customer - <AUTHOR> http://people.maths.ox.ac.uk/trefethen/honours.html <comment><USER2> A bit off topic tidbit:

Early Matlab version(s) had an interesting Easter egg. Once when frustrated with the learning on the REPL, I typed "fuck you" and the console spit out "your place or mine?" instead of an error that I was so used to.

<comment><USER3> Another little easter egg: typing "why" will return a randomly generated answer.

<comment><USER4> also imagesc with no arguments (used to at least) return an upside down picture of some person. This led to some confusion in our lab at some point.

<comment><USER5> This Easter egg is responsible for one of the most terrifying evenings of my life.

My first project in grad school was a visual perception experiment, written in Matlab. People were shown images that were either just noise (think static or clouds) or noise + a very faint shape, and asked to report which was which. The goal was to analyze the noise patterns associated with each response to identify how people recognize shapes (e.g., do you need all four corners to recognize a + sign).

I tested the task on myself first. It's fairly late, maybe 9:30 or 10pm, when I finally get everything running just so. Sitting in our pitch-dark testing room, in the middle of a deserted floor of a medical school, I run the analysis code. I'm expecting to see some simple shapes emerge from the processed noise; I think I used crosses, triangles, and Gabors as targets.

Instead, however, window after window pops up with the creepy, distorted face of that child. I was tired, hungry, and had just seen _The Ring_ , so I did the obvious thing: I slammed the laptop shut and high-tailed it home.

The next morning, my labmate helped me figure out that I had written imagesc somewhere, instead of images, the variable that contained my results.

TL;DR: Typo terrified me.

<comment><USER6> I WASN'T THE ONLY ONE!

</comment></comment></comment></comment></comment><comment><USER7> As far as I know he bought that license for one of his student at the time, Alan Edelman, who then ended up co-creating the Julia language.

<comment><USER8> Interesting, how did you come across this very _specific_ bit of trivia?

<comment><USER9> Alan Edelman has done a lot of talks, so if I had to guess, he mentions it somewhere in one of those. But I have no actual clue.

<comment><USER10> He does mention this.

</comment></comment></comment></comment><comment><USER11> He ought to add to that list "finder of mistakes in Feynman lectures"

</comment><comment><USER12> I really hope that's listed in chronological order, because otherwise he's throwing serious shade at the Royal Society.

Edit: I checked it out- Matlab has been around since 1984, and Prof Trefethen was made FRS in 2005. Safe.

<comment><USER13> Not necessarily. As a UK professor in numerical analysis, being an FRS is practically a given. I'd be more proud of the MATLAB one if it was me.</comment></comment>


Choose VPS for privacy concerned website - <AUTHOR>

Hi hackers,
I'm looking for good hosting company with data centers around the globe.
My biggest concerned with amazon, that they can easily shut you down, as they did with wikileaks.
My questions, are here anyone familiar with ovh.com Or have another provider in mind, that provide good hosting for privacy concerned website with decent bandwidth and without breaking the bank?
Thank you <comment><AUTHOR> Thanks, I'm currently using linode. They are all good services, until you don't cause any trouble. By saying trouble, I mean DMCA letter or simple subpoena and they will shut you without giving a second thought if this request even legitimate. It's not that my service will violate any of it, but I'm looking for at least fair treatment. And in this case DO almost the same as linode in my opinion.

<comment><USER2> If it's some sort leniency for grey area content - then that's a different topic. You could try offshore VPS's - but they're liable to pull the plug on your box on a whim, and for no reason.

Why not load balance the site on a tonne of different servers (by different companies) scattered around the globe? Build in some redundancy? Play whack-a- mole with DMCA takedowns?

<comment><AUTHOR> I thought about it. When balance php servers will not be a problem, problem will be with database.

</comment></comment></comment><comment><USER2> Aside from the obvious Digital Ocean, there is Atlantic who offer VPS's for $0.99 per month.

[https://www.atlantic.net/](https://www.atlantic.net/)

BTW - If you sign up for Digital Ocean, use my referral code: [http://myshar.es/1ojAsbb](http://myshar.es/1ojAsbb)

</comment><comment><USER3> How about Digital Ocean?

I have used them for the past year and have been happy.

There is also Vultr.com, a digital ocean clone that has worked well for me.

Ramnode and Prometheus are reliable.</comment>


CS Degree vs Coding Bootcamp vs Self-Taught - <AUTHOR> https://mariohoyos.io/CS-Degree-VS-Coding-Bootcamp-VS-Self-Taught <comment><USER2> These are not necessarily mutually exclusive. A Coding Bootcamp will give you the main points about one area of coding (Inverted T shaped learning). Self- taught will give you in-depth knowledge but only about the areas you've studied and worked (pitchfork or Y shaped learning). College will give you a solid grounding in basic fundamentals and techniques to help you learn better. Less and less, but a college degree is still a gatekeeping criteria for some jobs.</comment>


Microsoft expands its support for Docker containers - <AUTHOR> https://techcrunch.com/2016/06/21/microsoft-expands-its-support-for-docker-containers/ <comment><USER2> AKA "Microsoft appropriates Docker Developers for their platform"</comment>


Life in Raqqa, Capital of ISIS - <AUTHOR> http://www.nytimes.com/2015/11/22/world/middleeast/isis-wives-and-enforcers-in-syria-recount-collaboration-anguish-and-escape.html <comment><USER2> Islamic State is like a 6th Century Medieval Arabia broadcasting it's Reality Horror Shows on 21st Century technology - HD videos and live internet.

If you really want to know what life in Raqqa is like, head over to [http://www.raqqa-sl.com/en/](http://www.raqqa-sl.com/en/) the official website of the "Raqqa Is Being Slaughtered Silently" a campaign launched by a group of non-violent activists in Raqqa to expose the atrocities committed by The regime of Bashar Al-Assad and terrorist extremist group " the Islamic State of Iraq and Syria ISIS toward the civilian populations if the city.</comment>


A database of errors detected by PVS-Studio is available on viva64 website - <AUTHOR> http://www.viva64.com/en/examples/

<comment><AUTHOR> Collection of errors can be used by you for the research, writing papers, studying typical programming errors and so on.</comment>


Hacking a Network Attached Storage (NAS) - <AUTHOR> http://dev.emcelettronica.com/hacking-network-attached-storage-nas <comment><AUTHOR> The Network-Attached Storage or NAS was designed for the enterprise file sharing services. Now the consumer NAS (Network-attached Storage) has integrated many additional features including BT/eMule downloading, digital media server and video surveillance.</comment>


Ask HN: I'm sick of college, any recommendation? - <AUTHOR>

Okay, to put things in perspective, I'm a 23yo Computer Science student, dropped out from college last year after been studying for three years; the reason: got fed up with all the innecesary work that had to be done... spent to much time caring for grades, knowing I could be doing something with much more value, incompetent proffesors "teaching" things that they didn't even understand, those proffesors being in the positon of assigning me a grade... Some proffesors gave me an F even I knew so much more than they did; actually in regard this "proffesor" situation, I went to talk with the computer science chairman who acknowledged the situation, but it took so much time to get  each of faulty the proffesors fired, and they were to much.
This year, I started attending college again (different one), and have two more years pending to get that paper that says "I'm an engineer".Sadly, even though it's a different school, situation is starting to look like a deja-vu, and I'm actually starting to see with despise, and aversion the whole "university experience", and could almost state like an axiom in my reality that "college sucks".
I'm pretty confused... should I endure this sick pain, product of tolerating this crap,just in order to get my degree?(I only want it for the supposed doors that it opens). Should I just take as many subjects as I can, so I can finish with this painful experience the fastest I can, without any consideration of the grades I get? How important are the grades in getting those "doors" open, or getting into a Ph.D program? Can't I get into a Ph.D program just by demonstrating my competence, and not having to comply with the "system"(and subsequently wasting my time)? Can just my work (research publications,conferences, open source hacks, books I've written) get me into a research program, without having the degree?
Sidenotes that could help understand more my context: I'm poor, I have to work in order to provide myself, and pay for school tuition. I do research in artificial intelligence. <comment><USER2> _How important are the grades in getting those "doors" open, or getting into a Ph.D program?_

I don't know what doors you refer to. I've never had a problem getting a job, and I never attended a university (I went to a handful of community colleges for various fun topics, but never got a degree...but having a degree from a good university would certainly help me if I wanted to work at Google or Microsoft or similar). A Ph.D program? Why would you want to go the Ph.D route if you _hate_ academia? This doesn't even make a little bit of sense to me.

 _Can't I get into a Ph.D program just by demonstrating my competence, and not having to comply with the "system"(and subsequently wasting my time)?_

I'm still not getting this. It's sounding like your dream in life is to be a Ph.D working in academia for all of your days. And, yet, you've stated that you hate college. This doesn't make sense.

Why do you want to get into a Ph.D program? I'm not saying you _shouldn't_ do a Ph.D, I'm just having a real hard time wrapping my head around the idea of someone who hates college seemingly dreaming of being in college for 6 to 8 years to obtain a Ph.D.

I think you've gotta do some soul-searching here. What is it you want out of life? If a life of research and academia and publishing is what you want, then yes, you need to go to college. You need to go to college for many more years. That is the price of admission to that life. But, given that that life is kinda just continuing the college experience (only you answer to deans and the board of directors and students rather than answering to professors), I don't see how that could possibly be your real goal.

So, what is your real goal? You tell us that, and we (being a pretty diverse set of hackers and nerds) can probably lend you reasonably good advice on how to get there.

</comment><comment><USER3> My suggestion to you is simple: if you want to do artificial intelligence research then do it. Make a website. Self-publish. Promote yourself. If you are truly brilliant (as you seem to think you are) then you will be noticed. There are always positions for hard working brilliant people.

It's also worth saying that the majority of groundbreaking research being done these days is being done in the private sector. These people care less about degrees than results. Prove you can produce and you won't find it difficult to obtain employment.

While you research you can work just about anywhere - you don't need access to much to do research - a library, a computer, a notebook. Being poor is actually a good thing for research - money causes distraction. Most grad students are dirt poor.

As a side note, I think we're all a bit confused by your story. What is the "crap" you are tolerating? If you really know all of it already, shouldn't it all be easy? I think that perhaps some of the issues you are experiencing may have something to do with poor communication more than anything else. Most professors are willing to work with you on a more challenging project if the given project is elementary and boring to you.

</comment><comment><USER4> Stick it out, if it's only 2 years.

Don't take refuge in the "I'm smarter than all of them, they just don't understand me" excuse. Take what is offered, and learn what you can, where you can.

It may not seem like it now, but 2 years is a really, really, short time in your life.

If you're bored, spend more time on interesting projects, but also spend enough time on your coursework to get decent (though maybe not top) grades.

I started University 3 years early (skipped 3 grades). I failed out in my last year. Generally, I really liked my uni experience, but I regret not finishing.

I've never had a problem getting a job. However, the lack of a degree has been an obstacle in getting US work permits for some sweet companies.

You know how older people will tell you that the years pass quicker and quicker? It's true. One or two years is just a minuscule amount of time in your life. Don't fail to do something because you're impatient, and it'll "take a year". In ten years, it still won't be done, and you'll have "wasted" at least a year in between doing other things.

</comment><comment><USER5> Life is tough, you're going to have to do things that are boring when you get a job as well. Might as well learn how to deal with it now.

That being said, I'm not entirely convinced this isn't a troll. If you're not trolling, I'd recommend spell checking your post; especially the parts where you talk about knowing more than your "proffesors".

</comment><comment><USER6> Why would you possibly think a PhD is a good idea if you find your current situation full of unnecessary work? Do you think a PhD program is going to be some huge difference (hint: it's not)

And depending on where you live (US?) just having an engineering degree doesn't let you call yourself "an engineer"... you need a PE for that (add more years).

</comment><comment><USER7> _Some proffesors gave me an F even I knew so much more than they did_

How can you be sure that you knew much more than your professors knew? What kind of communication did you have with those professors before you received a grade of F?

<comment><AUTHOR> Sorry, by not be giving more details... It's just that it would take so much time to describe the whole situation. Chairman asked me the same, I just gave punctual facts, and proved them. Chairman acknowledged situation, and fired some of the proffesors.

<comment><USER6> Wow I would love to know what school "fired" professors because some failing student was complaining...

Got a link to back that up?

</comment></comment></comment><comment><USER8> I know very well how you feel. I cannot give concrete advice, since I'm in a different part of the world and the context doesn't apply, but it sounds all too familiar.

What I can say is that a job and a PhD are completely different paths. Both have advantages and satisfactions, but they require different things. If you want a job, grades most likely don't matter. This I can safely say about any free market economy, especially in this field. But for a PhD... at least where I'm from, what matters most is having your personal professor guiding you. Whatever he says goes.</comment>


Why Jinja is not Django and why Django should have a look at it - <AUTHOR> http://lucumr.pocoo.org/2008/9/16/why-jinja-is-not-django-and-why-django-should-have-a-look-at-it

<comment><AUTHOR> I've been using Django for a while and have two major complaints:

1) newforms sometimes takes some serious wrestling to make co-operative

2) The template system bites!

We plan to move to Jinja2 after we finally launch something. However, the biggest blocker for us is lack of auto-escaping.

</comment><comment><USER2> From the article: "I am not a compiler guy."

It shows. Queryset performance is completely divorced from the performance of the template engine as querysets are coded natively in python and just called from the AST evaluator. Also, code generation is incredibly complex (at least compared to an AST evaluator) so unless you convert to something _much much_ faster like machine-code, it's usually not worth the effort (which considering Django's speed relative to other frameworks seems to be the case).

Sorry. Some myths about AST compilers grate at me sometimes.

<comment><AUTHOR> I'm more interested in the lexing/parsing problems and how they apply to writing custom tags. It is also nice to have a more complete expression language. I don't really buy into the strict logic separation argument, but then again my team is composed entirely of Python programmers.

<comment><USER2> Frankly, lexing and parsing is boring. Custom tags can be easily accounted for by treating them as a symbol as is done in other programming languages.</comment></comment></comment>


CIA crisis as facial recognition makes it difficult for spies to maintain cover - <AUTHOR> https://www.dailymail.co.uk/news/article-7837767/CIA-faces-crisis-intelligence-gathering-digital-footprints.html <comment><USER2> Well, also the leakage of nearly all information on everyone with a clearance:

[https://www.businessinsider.com/cia-spies-in-china-may- have-...](https://www.businessinsider.com/cia-spies-in-china-may-have-had- cover-blown-from-opm-hack-2015-7)

Edit: You may have heard that the CIA did not trust OPM, but, once you have a list of everyone with a clearance that _is_ in the OPM databases, you have good grounds for assuming anyone missing, who _should_ have a clearance, is a spy.

</comment><comment><USER3> Please can we not have the daily mail as a source. It is not trustworthy or authoritative

<comment><USER4> I came to say the very same thing!

</comment></comment><comment><USER5> I feel almost as bad about the CIA going dark as I do about the FBI supposedly going dark: not at all. You reap what you sow, you arrogant bastards.

</comment><comment><USER6> If interested, Yahoo News explains this in depth: [https://news.yahoo.com/shattered-inside-the-secret-battle- to...](https://news.yahoo.com/shattered-inside-the-secret-battle-to-save- americas-undercover-spies-in-the-digital-age-100029026.html)

</comment><comment><USER7> As if the CIA wouldn't have ways to workaround it? How can we believe Dailymail?

<comment><USER8> [https://www.youtube.com/watch?v=JASUsVY5YJ8](https://www.youtube.com/watch?v=JASUsVY5YJ8)</comment></comment>


The $200 programming font - <AUTHOR> http://thenextweb.com/creativity/2016/02/10/operator-is-a-200-font-designed-exclusively-for-developers/ <comment><AUTHOR> Screenshot in action: [https://d31td5fkd89rr1.cloudfront.net/assets/images/blog/ope...](https://d31td5fkd89rr1.cloudfront.net/assets/images/blog/operator_ide2.png)</comment>