Firefox 5 is now officially released - <AUTHOR> http://www.mozilla.com/en-US/firefox/all.html <comment><USER3> To the Mozilla developers in here:

Although I am not going to install this version on my laptop (I am a chrome guy), I would like to take the opportunity and thank you for the great work you have done for the internet users and web developers.

In the days before firefox+firebug, we were alerting all the way in order to find an undefined / unassigned variable which was causing bugs and terror.

You have made the web a better place, you have made IE a better browser, and I tend to believe, you also made chrome a better browser, and chrome developers work harder by setting the bar that high.

<comment><USER4> What I most like in the story of Firefox is how, after bringing competition to a field that had been stagnant for quite a while and after, thanks to its impressive success, reviving that field, it now benefits itself from that competition.

We are now at a time when ALL browsers, including Firefox, are getting better and better thanks in large part to the increasing competition.

It has been a great journey thus far for Firefox. My best wishes to all involved for better and better things in the future.

(Firefox user since v0.6 here. These days I also use Chrome and Chromium quite a lot, especially on Linux, but Firefox remains my main browser.)

<comment><USER5> another firefox since early beta user here. i do not remember the number of machines i installed firefox on to, but i really like that there is competition now and every version gets faster and better.

<comment><USER6> Another Netscape Navigator, err before that NSCA Mosaic user here, and yes we walked to school uphill both ways.

I love firefox but have suffered with the memory issues for _years_. Please free memory when I close tabs, or at least add a flush button so I can reclaim the 500mb it balloons to in a day or two of heavy usage.

<comment><USER7> Current Aurora builds (which will eventually become Firefox 6) have an improved about:memory page, which includes buttons that make Firefox run the garbage collector:

[http://blog.mozilla.com/nnethercote/2011/05/23/a-better- abou...](http://blog.mozilla.com/nnethercote/2011/05/23/a-better-aboutmemory- stage-1-75/)

In my experience, hitting the GC button rarely makes any detectable improvement. Right at this very moment my Firefox instance is using about 900MB of memory; hitting all three buttons in a row (garbage-collection, cycle-collection, "minimize memory usage") brings the number down to 892MB, ~750MB of which is apparently allocated to "heap-unclassified" and the JavaScript "gc-heap".

Work on reducing Firefox's memory footprint is ongoing; the most recent effort I know of is MemShrink:

<http://blog.mozilla.com/nnethercote/2011/03/10/memshrink/>

...and it's beginning to make some progress:

[http://blog.mozilla.com/nnethercote/2011/06/22/memshrink- pro...](http://blog.mozilla.com/nnethercote/2011/06/22/memshrink-progress- week-1/)

</comment></comment></comment></comment></comment><comment><USER8> This is a confusing feeling. The Firefox release mechanism makes this more frustrating than friendly.

With Chrome, my browser automatically updates for stuff like this. I never see it and always have the correct version.

For Firefox, I have to purposefully seek out the next version, and considering I'm still upgrading some of my machines to 4.0 from 3.5 (I downloaded 4.0 yesterday on one machine), this is kind of annoying.

I'm not sure a quick release schedule works quite as well if you've got to manually upgrade. I like Chrome for the same reason I sign up for automatic bill payments - I understand it's important, but I don't want to have to deal with it.

<comment><USER9> Firefox does automatically download the next version in the background. It prompts you to restart a while after the update is downloaded, but we're working on making the prompting less intrusive than it's been in the past. Also, I think you get a more intrusive prompt if the update will disable any extensions.

See this article for some of the work we're doing to make add-on compatibility work seamlessly in new versions:

[http://blog.mozilla.com/addons/2011/04/19/add-on- compatibili...](http://blog.mozilla.com/addons/2011/04/19/add-on- compatibility-rapid-releases/)

<comment><USER10> Where does it get the download? I seem to be one of the few left who _likes_ to upgrade manually—I like to give others some time to shake out the bugs first—and so I use Firefox's notifications as a reminder to go and download the file myself.

I'm running 5.0b7, and have been receiving notifications for a while (maybe 3 days?) that there was an update available; but <http://www.mozilla.com/en- US/firefox/channel> and <https://www.mozilla.com/en-US/firefox/all.html> didn't have any upgrade available until today. Is there somewhere else to look, or were my upgrade notifications erroneous?

<comment><USER11> Help -> About lets you know if there is an update and has an apply update button to start it whenever you like.

<comment><USER10> Thanks, but (while that's a sensible answer to the question) it's not quite what I wanted. I would like to be able to download the new version myself. Is it really true that, up until today, it was possible to update from 5.0b7 to 5.0 within the browser itself, but impossible to download 5.0 directly? If not ( _i.e._ , if it is possible to download 5.0 directly), then I must have been looking in the wrong places; where should I look?

<comment><USER9> I'm pretty sure there were no releases between 5.0b7 and 5.0 final, so I'm not sure why Firefox was prompting you to update. But in any case, you can download any release manually from ftp://archive.mozilla.org/pub/mozilla.org/firefox/releases/

<comment><USER10> Thanks!

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Best new feature: Multiple tab closing behavior is more like Chrome's now - <http://www.theinvisibl.com/2009/12/08/chrometabs/>

<comment><USER13> Love the Chrome-like tab closing behavior. Annoying that a tab has to have focus to get the on-tab "X" though.

(EDIT: Only when #tabs > 9 it seems. Otherwise all tabs have the "X".)

<comment><USER14> Middle click to close those tabs.

<comment><USER13> Thankfully I can as my Thinkpad has a 3rd button. The majority of laptop users won't be so lucky.

<comment><USER15> Hitting both buttons usually simulates a middle-click.

<comment><USER16> If your drivers are clever you can do it with the trackpad, too - <USER2> tapping the pad with two fingers will middle-click. Less error-prone than using the buttons.

</comment></comment></comment></comment></comment></comment><comment><USER17> Elephant in the room is the ugly and unnecessary search box. It sticks out like a sore thumb when you consider the effort Firefox has gone through to clean up the interface.

side rant: what's up with search boxes that keep your previous search term in the box. What's the point? iPad does this as well and it drives me insane. I always just manually delete the entry after searching but I shouldn't have to do that and I don't want guests to know my previous search.

<comment><USER18> I like the search box because the URL history autocomplete of the main URL bar is so much better in Firefox than any browser. I can type any part of a page title or URL (not just the start) and it goes through and finds pages from my history. I do that much more often than I search for things and so I really like having them separate.

<comment><USER19> Chrome searches your history and offers the search option, without requiring a separate search box. It doesn't force you to use the start of the URL or title, either, as far as I can tell.

<comment><USER18> It kind of does but it doesn't work nearly as well, at least in part because it clutters up the list of options with suggested searches.

<comment><USER19> I have a ton of search engines installed but it only does one suggested search in the list of options, as far as I can tell.

</comment></comment></comment></comment></comment><comment><USER20> Better than normal update experience that's still nowhere near Chrome. The Tree Style Tabs extension still works after the update...

Chrome is absolutely unusable for the amount of windows I have open at a time and Firefox doesn't crash on me as much as it used to in order to warrant having every page take up a separate process.

<comment><USER21> Have you tried enabling side tabs in Chrome? Works wonders for me.

<comment><USER22> I love Tree-Style Tabs, so had to try this out.

For anyone else who had trouble tracking down modern instructions for this:

      * Go to about:flags
      * Enable Side tabs (first option)
      * Restart Chrome
      * Right-click on a tab and chose "Use side tabs"

Not a treeview of collapsible tabs, but muchmuchmuch better than normal tab view in Chrome. Thanks for mentioning that they had this.

<comment><USER23> What version has this? I just tried 12, 13 and 14 (Canary) and I don't have that option. I have "Tab Overview" as the first thing in flags. Is this a Windows only thing, perhaps?

<comment><USER24> In osx I had to do:

         cd /Applications/Google\ Chrome.app/Contents/MacOS
         mv "Google Chrome" "Google Chrome Binary"
         echo '#!/bin/bash
         exec "${0%/*}/Google Chrome Binary" -enable-vertical-tabs "$@"' > "Google Chrome"
         chmod ugo+x "Google Chrome"

This let me start chrome with the "-enable-vertical-tabs" command line switch. Once it was started I needed to right click a tab and choose "Use Side Tabs".

<comment><USER25> Wouldn't this break after an update?

</comment></comment></comment></comment></comment></comment><comment><USER26> Release Notes: <http://www.mozilla.com/en-US/firefox/5.0/releasenotes/>

<comment><USER9> And for web developers, some more detailed notes at <https://developer.mozilla.org/en/Firefox_5_for_developers>

By the way, if you are a web developer, I strongly encourage you to use the Firefox Beta or Aurora channel:

<http://www.firefox.com/channel/>

<comment><USER27> > By the way, if you are a web developer, I strongly encourage you to use the > Firefox Beta or Aurora channel:

Sorry if this sounds harsh, but if you're really expecting a lot of professional web developers to do that, I think you're crazy.

Now that both Chrome and Firefox are on silly release schedules, we waste enough time just keeping up with the breaking changes and random UI rearrangements in day-to-day work. Who has time to spend reading yet another set of release notes every few days, when there's a good chance that nothing in them will be usable in production projects for several years anyway?

If you really want to drive progress, I implore you to stop this madness, and allow a few months for the industry to consolidate so we have some sort of standards to work with. You've made your point: the W3C is a dinosaur chasing a snail riding on a tortoise and you can go faster. But until the new technologies are standard enough that we only have to develop for them once and we can rely on that development still working in a couple of years, all your hard work is being wasted because we still have to write to the lowest common denominator.

You are the new Netscape, Microsoft are the new Microsoft, and now there are several other major browsers we all have to cope with as well. Going it alone just doesn't cut it, whichever of you does it.

<comment><USER9> Actually, one reason web developers can benefit from running pre-release browsers is that you are in the best position to _prevent_ breaking changes from happening. If a bug that breaks your web site makes it out to the 400 million people on our stable channel, then it's too late stop your users from seeing it. But if you report the bug to the vendor when it first appears in alpha or beta, you improve the chance it will be fixed before your mainstream users ever see it.

<comment><USER27> I appreciate what you're saying, but unfortunately my clients pay by the hour, and they aren't paying me to be a beta tester for your organisation. Even if I wanted to help you, it would be deeply unethical for me to do so while charging my clients for the time. And even if it weren't, please consider what a huge amount of time it would take to download and install development builds of every major browser regularly enough for this to matter. It's just not practical for me, and I don't see how it ever could be for any other professional web developer in a similar position.

Maybe if we were talking about a team of in-house developers responsible for a single application or something it would be more realistic, but not for freelancers or small agencies who get paid time and materials, which seems to be most of us these days if my experience is at all representative.

</comment></comment></comment></comment></comment><comment><USER28> Chrome user here since launch (who is also very entrenched into Chrome in terms of workflow): Ever since FF4b, I've been nearing a full switch back to Firefox, but the main deterring factor for me was performance. With FF5, the performance increase is absolutely noticeable and I commend the Mozilla team for their work. It's nearing a point where I'd like to switch back.

Now if only they can polish the Android browser a little more ;)

<comment><USER29> We are polishing Firefox Mobile, too! It is releasing in sync with desktop now.

</comment></comment><comment><USER30> Anyone using the Amazon S3 Firefox Organizer extension will be disappointed as I am to discover that it doesn't work with FF5.

EDIT: Luckily, I had a moment of intelligence and copied FF4 before installing FF5, so I would recommend doing that if you use S3Fox with any regularity.

<comment><USER31> You can probably hack the extension to support FF5. There haven't been too many changes that should affect this.

<comment><USER32> _You can probably hack the extension to support FF5. There haven't been too many changes that should affect this._

And hence the stupidity in adopting Chrome-style meaningless major version- numbers when what is released is only a minor update. I know the IT industry is highly fashion-driven, but that doesn't mean following fashions doesn't have drawbacks.

This is Firefox 4.1 at best, but released as Firefox 5 with all the needless addon breaking headaches that will bring, just because Mozilla wanted to be more "fashionate". Great job guys. Great job.

I guess this another thing we can thank the Chrome team for.

<comment><USER33> > This is Firefox 4.1 at best, but released as Firefox 5 with all the needless > addon breaking headaches that will bring

Point releases in the past have broken extension compatibility, so asking that it be 4.1 instead of 5 wouldn't necessarily have the kinds of tangible benefits that you seem to think it would.

</comment></comment></comment></comment><comment><USER34> LOVE that pinned tabs stay open after reload, without resorting to hacks like you have to with Chrome. That's about the only thing that persistently bugs me in Chrome these days. All in all, FF5 is looking really good. Way to go!

<comment><USER35> There's no "hack" to get pinned tabs to re-open in Chrome, they just do.

<comment><USER34> Only if the last window you close is the one with the pinned tabs, otherwise they're gone and there doesn't seem to be a "re-open pinned tabs" option to retrieve them either. So at this point, the only effective solution is to use the bookmark bar and avoid pinned tabs. After I erased them accidentally once, I'm not wasting time with that "feature" again.

<comment><USER35> Nope, then you go to recently closed tabs and you'll see a folder that says "6 Tabs" or whatever and clicking it will restore the window.

</comment></comment></comment></comment><comment><USER36> If I update, I'm going to have to manually edit the few extensions I actually run Firefox for to increase their "max supported version" string to 5.x. That's one downside I can see with this new release system.

<comment><USER9> Most add-ons hosted by Mozilla have already been automatically updated for 5.0 compatibility:

[http://blog.mozilla.com/addons/2011/04/19/add-on- compatibili...](http://blog.mozilla.com/addons/2011/04/19/add-on- compatibility-rapid-releases/)

<comment><USER36> Cool. Glad they thought about that situation before switching to this new release/versioning system.

</comment></comment></comment><comment><USER37> I would like to upgrade from 3.6 on the Mac, but when I tested Firefox 5 beta, it still seemed to have the same memory leak issue Firefox 4 has, i.e. I open two tabs without any add-ons and with a half hour's time Firefox is using 250+ MB of memory.

<comment><USER38> Me too, I don't like the feeling that I am now two versions behind.

</comment></comment><comment><USER39> Does it auto-upgrade, a-la Chrome?

Update, nope, it does tell you there's an upgrade, though (at least on OS X). I think the next step for the FF team is getting those cool assembly-text-diff things like Chrome has working. Until then, there's just fragmentation.

<comment><USER9> Firefox does use binary diffs for updates, and has for years:

<https://wiki.mozilla.org/Software_Update:MAR>

It downloads the update automatically, but it will prompt you to restart a while after the update is downloaded (if you haven't restarted on your own). We are actively working on making the whole process less intrusive and more seamless.

<comment><USER40> Still, Chrome's updates tend to be measured in kilobytes, and the update for Firefox 5 was a few megabytes. There's room to shrink things.

<comment><USER41> Doesn't mean it's necessary. The size of the update matters little to the end user as long as it's small and 5 megs is small for most people.

<comment><USER40> The update server was delivering the ~8mb patch at about 4kb/s this afternoon. It took me several minutes to update.

Even when update servers aren't dying under heavy load, my internet connection isn't very fast. There are many people who don't have fast connections, both in the US and elsewhere. Programs downloading things in the background render web browsing noticeably slower and make voip unusable. Update size matters.

<comment><USER41> It matters for some people, yes, like you, but for most, it simply doesn't. I did say most in my original post as well.

<comment><USER40> Glancing at stats from Point Topic[1] and Internet World Stats[2], it looks like only a quarter of the world's internet connections were broadband in 2009. If one is building software for a global user base, a fast connection is not a given for most people.

1\. (pdf) [http://broadband.cti.gr/el/download/World%20Broadband%20Stat...](http://broadband.cti.gr/el/download/World%20Broadband%20Statistics%20Q4%202009.pdf)

2\. [http://en.wikipedia.org/wiki/List_of_countries_by_number_of_...](http://en.wikipedia.org/wiki/List_of_countries_by_number_of_broadband_Internet_users)

</comment></comment></comment></comment></comment></comment></comment><comment><USER42> Next time could we get a link to the list of changes rather than a download page?

</comment><comment><USER43> Mozilla, just call it Firefox, and make it always updated to the last version.

<comment><USER9> Yes, that's our basic plan. Updates are automatic and enabled by default, and the official press release does not mention a version number anywhere:

[http://blog.mozilla.com/blog/2011/06/21/mozilla-delivers- new...](http://blog.mozilla.com/blog/2011/06/21/mozilla-delivers-new-version- of-firefox-first-web-browser-to-support-do-not-track-on-multiple-platforms/)

<comment><USER44> But does FF5 work with firebug?

<comment><USER45> FYI: On install, Firefox 5 said it was not compatible with Firebug 1.7.3 and disabled it. I happened to be sitting next to 5 or 6 Mozilla devs at the moment (open source bridge conf) and one of them told me to install Firebug fresh from the site. I downloaded and installed the 1.7.3 xpi and it worked without complaint. No idea what's up with that.

<comment><USER9> Sounds like this problem is fixed now: <https://twitter.com/#!/shaver/status/83595913628631040>

</comment></comment></comment></comment></comment><comment><USER46> OK, before I go get this, I have just one simple question: Is it as fast as Opera 11.11? I just got done bitching about how slow FF4 is on my crap PC, while Opera 11.11 is like absolute lightning on it. Why can't Firefox be that fast if Opera can?!

<comment><USER46> What, questions like that aren't allowed? I wasn't being snarky. What is it that makes Opera so fast that Firefox can't do also? EDIT: And I want to be clear too: I do not use the Turbo feature of Opera.

<comment><USER47> Opera is a lot better at being scalable from my experience. It works just as well given limited resources and scales up to being able to use all the resources of a powerhouse computer.

<comment><USER46> Why can't Firefox do the same, though, is what I'm asking. Why cut off an entire segment of low-end computers? Don't talk about bridging a digital divide while also creating one!

</comment></comment></comment></comment><comment><USER48> I was hoping to see the back button be clickable from the left edge of the screen. It's a large oversight, in my view.

<https://bugzilla.mozilla.org/show_bug.cgi?id=571454>

<comment><USER7> If you right-click on the page, "Back" is usually the first item. It's a lot quicker to get to than the Back button, even if it were clickable from the left edge of the screen.

Long ago I removed all the navigation buttons from my Firefox toolbar; I much prefer having room for larger URL and search bars.

</comment></comment><comment><USER49> For anyone who went to <http://www.mozilla.com/en-US/firefox/releases/> looking for release notes and didn't find them, here they are: <http://www.mozilla.com/en-US/firefox/5.0/releasenotes/>

And a complete list of bug fixes: [http://www.mozilla.com/en- US/firefox/5.0/releasenotes/buglis...](http://www.mozilla.com/en- US/firefox/5.0/releasenotes/buglist.html)

</comment><comment><USER50> I hope glow.mozilla.org will be back. I really loved watching those download numbers fly by :).

</comment><comment><USER51> Probably won't be trying it, I've been using FF4, and then Nightly, but the memory leakage is so hideous on FF since 3.x that i finally gave up -- after 6 hours use, FF4 and nightly would use 1GB ram, even after closing all but one simple tab. Forced browser restarts.

Chrome is where I've ended up. If FF ever get the memory leaks straightened out, I may switch back.

<comment><USER52> Mozilla has launched a dedicated group to tracking down memory usage problems: [http://www.internetnews.com/skerner/2011/06/mozilla- launches...](http://www.internetnews.com/skerner/2011/06/mozilla-launches- memshrink-eff.html)

</comment></comment><comment><USER53> Kind of nice to have Flash working again. It had stopped working for me when I upgraded to 4 (Ubuntu 64 bit). I'd tried a few suggested fixes, none of which worked, so I'd just resigned myself to having to open up Chrome any time I wanted to view something that used Flash, which isn't often, but I'm glad that issue is resolved.

<comment><USER54> Flash has been rendering badly for me on Ubuntu 64 bit since Firefox 4. It's annoying enough that I just use Chrome. Firefox 5 has the same problem, unfortunately.

<comment><USER53> Performance was fine for me, when it would work. It just wouldn't work. It kept telling me I didn't have the plug-in installed.

That said, my computer has pretty beefy specs, so that may have something to do with it.

</comment></comment></comment><comment><USER55> What the.... I just ungraded to Firefox 4 not long ago, haven't even got used to 4's interface (I use Chrome 99% of the time) and Firefox 5 is out...

I wonder what's the logic behind this release schedule

<comment><USER56> Firefox has incremented the main version number rarely up till Firefox 4, but planned to change this for 2011. An explanation of some of the benefits and drawbacks are outlined here: [http://arstechnica.com/open- source/news/2011/02/is-mozillas-...](http://arstechnica.com/open- source/news/2011/02/is-mozillas-2011-roadmap-unrealistically-ambitious.ars)

In general it is always wise to not waste too much time interpreting version numbers, as they often fail to reflect the pace of development that is actually happening. The Linux Kernel has been around forever, but only recently got bumped to 3.0rc1; Chrome on the other hand is already stable at 12.x.

<comment><USER57> From a personal marketing perspective i guess they do this version rush because the dummy "consumer" looks at a big number for comparison. Chrome started pulling big numbers to surpass IE, and now firefox is doing the same.

<comment><USER9> This is really not about marketing.

First off, Google rarely even mentions Chrome version numbers in its marketing material, and neither will Mozilla. The <http://blog.mozilla.com/> post announcing Firefox 5 does not mention the version number, and neither does the main web site at <http://firefox.com/> \- also see Chrome's release announcements at <http://chrome.blogspot.com/>

We actually care much more about delivering features and performance improvements in a timely way than about having a big number before the dot. "Just add one" is a simple rule that saves us from arguing about versions and lets us spend that time improving the browser instead.

Non-technical users rarely even know about version numbers. Meanwhile, people who have any experience in software know that version numbers are and have always been arbitrary. Neither group would be "fooled" by a higher version number, so why would we bother trying?

(Did MacOS really have "more" changes from 8 to 9 than from 10.3 to 10.4, or does Apple just really like the number 10? Did Linux stop getting major changes during the 2.4 series and suddenly start again with the release of 3.0? Is the Solaris 11 release more significant than the SunOS 5.11 release even though they are the same thing? The "real" meaning of a version number has always been whatever the developer wants it to mean.)

</comment></comment></comment></comment><comment><USER58> Is FF planning on coming out with a auto-upgrade system?

<comment><USER9> It's had one for years, and it's enabled by default. Firefox will automatically download a binary diff in the background, and apply it the next time you start the browser. If you don't restart for a while, it will eventually prompt you to restart. (Much like Chrome, except that Firefox currently uses a dialog box prompt while Chrome has a more subtle toolbar icon.)

Previously there were two types of releases: "minor" releases which were installed automatically because they contained security fixes, and "major" releases which prompted the user to choose first.

Now there will be no more "major" or "minor" releases. All new releases will be installed automatically, though I believe there is an exception if any extensions are broken by a new release. _(EDIT: I mean, if any extensions that you already have installed will be disabled by the update.)_

<comment><USER59> > auto-upgrade

he means silent.

<comment><USER60> That would be a hell of a achievement then, since Chrome doesn't have silent upgrading either. It still requires a reboot.

<comment><USER61> I don't think Chrome requires a reboot on OSX

<comment><USER60> A restart*

As in, Chrome must be closed, and restarted.

Gosh, wish I had noticed that during the edit window.

<comment><USER61> Ah, true. I guess a restart and a reboot are effectively the same on Chrome OS.

</comment></comment></comment></comment></comment></comment></comment><comment><USER62> Congratulations. My first contact with Firefox still holds the #1 position for the greatest impression a piece of software has ever made on me (sorry, Linux :) )

It was called Phoenix (0.3 ?) then and was the pinnacle of elegance compared to the uber-crappy IE and bloat-loaded Mozilla. If I remember correctly their policy then was to make every consecutive binary release _smaller_ than previous one.

</comment><comment><USER63> That looks pretty cool and I want to switch from Opera to Mozilla (can't switch to Chrome as it doesn't work in Windows 7 64bit for me) and I want to import my Opera's information to Mozilla. I click File->Import...->Opera->Next and it shows just empty field. When I try to do the same with Explorer, it works. So, what is the problem, could you give me a hand? Thank you.

</comment><comment><USER64> I need my vertical tabs on the right side of my screen, which is why I am still stuck in Firefox 3.6 land.

<comment><USER65> TreeStyleTabs is working fine for me in FF4 (and mostly did throughout the betas), does it not work on the right hand side?

<comment><USER9> And it is already marked compatible with Firefox 5, as well as Firefox 6 (currently in testing on the Aurora/alpha channel) and Firefox 7 (currently in development on the Nightly channel):

<https://addons.mozilla.org/firefox/addon/tree-style-tab/>

<comment><USER64> Alright, took the plunge. I never liked tree style tabs much in the past, but I've tweaked it abit here in Firefox 5, also got FireGestures & Firebug updated too. Good stuff, we'll see if I stick with it.

</comment></comment></comment></comment><comment><USER66> The IE team sent the Firefox team a cupcake poking fun at the new release cycle ... [http://www.geekwire.com/2011/cupcake-firefox-5-microsoft- fun...](http://www.geekwire.com/2011/cupcake-firefox-5-microsoft-fun-mozillas- rapid-release)

</comment><comment><USER67> Yes, but now I have to wait 4 months for all the extensions I'm using to update (ie, change the "maxVersion" string) to v5.

<comment><USER7> That shouldn't be necessary. addons.mozilla.org and automatically bumps the maxVersion string for extensions that don't touch features that changed in the new version.

I'm currently using an Aurora build (what will be Firefox 6), and most of my extensions are already marked compatible.

<comment><USER67> That's great! Didn't know about that change.

</comment></comment></comment><comment><USER68> App tabs seem like a pretty cool feature.

<comment><USER69> I have been using them since FF4, they are really nice.

</comment></comment><comment><USER70> Using it now. Looks the same as 4. All add-ons worked fine. Seems a little faster but that might be because my previous firefox process had been up for about 3 days and had gotten all slow.

<comment><USER71> Yes there must be some kind of memory leak or fragmentation that makes ff slow after a few days of running. I see the same thing on os x mbp.

<comment><USER72> Yes, there were a number of leak bugs fixed between 4 and 5, and the Mozilla guys are chasing after tons more. They've created a project specifically to chase down leaks and bloat issues, and you can see the various tracking bugs there:

<https://wiki.mozilla.org/Performance/MemShrink>

More fixes will be in Firefox 6 and 7, it looks like. Here's a particularly fun bloat fix that should be headed for 7:

[http://blog.mozilla.com/nnethercote/2011/06/21/you-make- what...](http://blog.mozilla.com/nnethercote/2011/06/21/you-make-what-you- measure/)

</comment></comment></comment><comment><USER73> Thanks guys, but I'm not sure how you lost to Chrome

</comment><comment><USER74> Thmbs Up Mozilla Team !!

</comment><comment><USER75> Still no flash auto-update like Chrome? Then I'm still Chrome-y!</comment>


Purely Functional Retrogames (2008) - <AUTHOR> http://prog21.dadgum.com/23.html <comment><USER2> > An open question is "Is being purely functional, even excepting I/O, > worthwhile?" Or is it, as was suggested to me via email earlier this year, > the equivalent of writing a novel without using the letter 'e'?

This is a great question. I've been playing with pure functional programming, and I also noticed that applying it to video games is very hard. In other areas, FP provides many advantages such as testability and safe parallel execution. But for simple games these are not that useful. Simple games seem very well suited for the imperative, global state model.

There is one aspect that might make FP worth it for games and it's interactive programming. The immediate feedback loop described by Bret Victor [1], with the possibility of going back and forth in time is easier to achieve with a pure functional approach.

The Elm debugger [2] is an implementation of this concept, using hot swapping and functional reactive programming it's possible to design games interactively in a very unique way that it's hardly achieved with the traditional imperative approach.

[1] [https://www.youtube.com/watch?v=PUv66718DII](https://www.youtube.com/watch?v=PUv66718DII) [2] [http://debug.elm-lang.org/](http://debug.elm-lang.org/)

<comment><USER3> > _But for simple games these are not that useful. Simple games seem very well > suited for the imperative, global state model._

Could you elaborate? I think this is one of those things we "know" which isn't necessarily so. Simple sprite-based games _can_ be written using purely functional techniques (see: [https://github.com/nikki-and-the- robots/nikki](https://github.com/nikki-and-the-robots/nikki)). It's just that it's not common to use FP languages for this.

<comment><USER2> Yeah, I know you can develop games in a purely functional fashion. My point what is the advantage of doing so, given that most resources are developed for an imperative way. I think the interactive approach taken by Elm is a very good advantage of FP for games.

</comment></comment></comment><comment><USER4> It seems at least some of the difficulties described are managed better in Haskell.

For example, rebinding to the same name (as an alternative to destructive update) can be handled conveniently and nicely via state monad and the lens library, with syntax roughly like:

      pacman.position += speed

This is still purely functional because the resulting type is roughly: State Game () which is equivalent to: (Game -> Game) (a pure function that takes a game and returns a modified game).

<comment><USER5> > This is still purely functional because the resulting type is roughly: State > Game () which is equivalent to: (Game -> Game) (a pure function that takes a > game and returns a modified game).

This is the kind of arguing that could easily be extended to C and other "impure" languages. And even the IO monad is "pure" \-- it's just values containing computations executed by the runtime (i.e. the computational side- effects are not part of the language / type system)

Using the State Monad for += syntax is no better than doing the equivalent in C.

The real enemy is _accidental state_. That is, meaningless (but significant) dependencies between conceptually independent calculations. For example:

       pacman.position += speed
       pacman.lives = ghostAt pacman.position

While updating the position based on the speed and deciding whether pacman was hit by a ghost are conceptually independent, the outcome of the above code is dependent on the order of these lines.

Instead it's often cleaner to do something along the lines of

       pacmanLives :: Pacman -> Ghosts -> Bool
       pacmanNewPosition :: Pacman -> Position
       -- use both of these functions in the update routine.
       -- Hand them the pacman from the last frame
       -- (i.e. don't "chain" the functions)

This way a dependency on the "order" of these computations is "avoided" (kind- of. There is still an order between the frames, but that is not as "accidental").

<comment><USER4> You cannot implicitly read pacman.position as a subexpression like in C, because it is an effect, and the order of effects has to be explicit in Haskell.

So it would have to look like:

      pacman.position += speed
      pos <- pacman.position
      g <- ghostAt pos
      pacman.lives .= g

Though a dead Pacman probably has no position, so it makes more sense that the last line is:

      when g (pacman .= DeadPacman)

Messing up the order because of implicitness becomes much harder.

<comment><USER5> What you say (re: subexpression) is true in Haskell. (I was of the impression that "pacman.position" wasn't valid Haskell anyway, but now I think it is. Never had a serious interest in lenses).

However that's a cosmetic issue. The point still stands: If you chain ("use the State monad"), the outcome depends on whether you update the position or the liveness first.

<comment><USER4> It does, but unlike impure languages, this ordering is not implicit in the evaluation order -- but explicit.

In the same sense, if you compose the pure functions:

      updatePacmanPosition . checkPacmanAlive

vs:

      checkPacmanAlive . updatePacmanPosition

Will exhibit the exact same issues.

The state monad merely lets you more conveniently write it more like:

      do
        updatePacmanPosition
        checkPacmanAlive

Where the do stmts are (sort-of) composed together as functions.

So the state monad here is not the issue -- it is sugar around function composition.

The issue is whether the ordering of these manipulations is explicit via data- flow or statement ordering, or whether it is implicit in evaluation order applying to shared, mutable state.

<comment><USER5> Yes, that was actually my point. State is essentially function composition. Thus I'm arguing for avoiding dependencies between conceptually independently compositions.

<comment><USER4> It's true until the composition and data flow are hidden from view because they're implicit in the shared mutable state. Also aliasing issues don't occur with the composition as they may occur in mutable state.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Two links that come to mind:

\- [https://github.com/ocharles/netwire- classics](https://github.com/ocharles/netwire-classics)

\- [https://github.com/ekmett/lens/blob/master/examples/Pong.hs](https://github.com/ekmett/lens/blob/master/examples/Pong.hs)

</comment><comment><USER7> Maybe it's just me but I find the part about structures a bit silly. So let's get rid of the big fat structs, and replace them with tuples. Nested tuples. How is that any different than a struct, apart from immutability? And it is worsened by the fact that the fields now are just indexes in a tuple/list instead of being named.

<comment><USER8> I agree that it's good to name the fields (i.e. use records or similar). The important idea is going from a big flat struct to a hierarchical one where related data is grouped together, so that you can have functions that operate on small subsets of the data. This gives you visibility over which functions touch which parts of the state, and makes those functions a lot more testable.

<comment><USER7> And having nested structures achieves the same.

<comment><USER8> Of course.

</comment></comment></comment></comment><comment><USER9> This is my pure-functional Katamari "game" (more of an outline / example, than a full-blown game):

[https://github.com/fccm/OCamlODE/blob/master/examples/katama...](https://github.com/fccm/OCamlODE/blob/master/examples/katamari.ml)

</comment><comment><USER10> This is cool. A lot of people tell us how great functional programming is (I can see the benefits of avoiding state not having side effects). But it is rare to see an article that shows how you go about designing something in that style.

</comment><comment><USER11> > _Back when I actually wrote 8-bit games, much of my code involved updating > timers and counters used for animation and special effects and so on. At the > time it made a lot of sense, given the limited math capabilities of a 6502. > In the modern world you can achieve the same by using a single clock counter > that gets incremented each frame._

So just to demonstrate an IMO elegant approach for the destructive style for updates that depend on current time values: for each update, pretend all computation happens in an instant, specifically: at the moment an event triggered an update (this could be the central game loop, user input, etc). Doing so makes it easy to keep everything synchronised; it's the abstraction Céu uses to great effect for its synchronous concurrency model[0]. The only limitation is that you need to keep your updates small and fast enough to finish before the next update is triggered, but that's a good goal to strive for anyway.

Pretending all computation happens instantly let's me use two values: a timestamp referencing to global time, and time difference with the previous time this update was triggered. Counters that get updated every time this update is triggered just increment by time difference. Counters that don't always get updated (or if different events can trigger the update) have to store the timestamp of the last update they were called, compute their own time-difference on the fly with a simple subtraction, update their value and store the new time-stamp. Very simple.

Using timers just means checking if the updated value is more than a certain value, and if so subtract that value and call another function. Basically, incremental error algorithms[1], like it is applied in Bresenham's Line Algorithm[2], but for timers instead of slopes.

(Note that this could all be written in a functional style with functions that take a current counter value and current/previous timestamp, returning a new counter value, but at that point it just feels like writing functional code imperatively)

I often use this in my Arduino code. It speeds up my programs, because calls to _millis()_ are not as cheap as referencing a global, and all we need computatationally with this approach are addition and subtraction, avoiding multiplication, division and modulo. More importantly it makes it much easier to reason about what is happening, because if all updates reference the same time-step, side effects are much more predictable.

The aforementioned Céu language really takes this style of concurrency to heart in a very elegant way.

[0] [http://www.ceu-lang.org/](http://www.ceu-lang.org/)

[1] [https://en.wikipedia.org/wiki/Glossary_of_computer_graphics#...](https://en.wikipedia.org/wiki/Glossary_of_computer_graphics#incremental_error_algorithm)

[2] [https://en.wikipedia.org/wiki/Bresenham%27s_line_algorithm](https://en.wikipedia.org/wiki/Bresenham%27s_line_algorithm)

<comment><USER12> >> _Doing so makes it easy to keep everything synchronised; it 's the abstraction Céu uses to great effect for its synchronous concurrency model[0]. The only limitation is that you need to keep your updates small and fast enough to finish before the next update is triggered, but that's a good goal to strive for anyway._

I think the usual way games typically implement more or less what you are describing but without the hard-realtime update constrains, is what is commonly referred to as a 'fixed timestep'.

It's what I used to implement the main loop of the game I'm currently working on, which has an 'action replay' function that has to be capable of producing the _exact_ same gameplay sequence based on recorded input events, which means 100% accurate, discrete and predictable updates to the game state. It's pretty cool to record some gameplay on actual hardware, then replay it in the simulator, which has completely different performance characteristics, and get a pixel-perfect reproduction of the gameplay clip :-). Extremely useful for gameplay debugging and prototyping as well.

There's a nice article here [1] that explains the concept much better than I could, so I'll just refer to that instead ;-)

[1] [http://gafferongames.com/game-physics/fix-your- timestep/](http://gafferongames.com/game-physics/fix-your-timestep/)

<comment><USER11> > _It 's pretty cool to record some gameplay on actual hardware, then replay > it in the simulator, which has completely different performance > characteristics, and get a pixel-perfect reproduction of the gameplay clip > :-). Extremely useful for gameplay debugging and prototyping as well._

Yeah, determinism in programming seriously rocks!

BTW, I think what I described was the variable delta time, not the fixed time step. That semi-fixed time-step looks pretty interesting too!</comment></comment></comment>


Show HN:Peer to peer learning - <AUTHOR> https://www.pal.co.ke/ <comment><AUTHOR> what do you think will be the future of classroom learning?do you think live streaming will replace going to school much the same way sms/emails replaced post offices?</comment>


ProcOS: scheduling atop Unikernels - <AUTHOR> https://bentrask.com/?q=hash://sha256/50ba5e38a149a2a6972e1dd1cc2215ea4d07e64fb980edabc692052c626aa43f <comment><USER2> Off topic but the hash shown piqued my interest.

The source is linked from the page - [https://github.com/btrask/stronglink](https://github.com/btrask/stronglink)

> A searchable, syncable, content-addressable notetaking system

<comment><USER3> Actually that's more interesting than not-really-unikernel thing he was thinking about.

</comment></comment><comment><USER4> > Ultimately, how practical is this idea? Well, if you were to build a secure > multiplexer, this is probably the way you'd want to build it, so that it > could be as simple (meaning reliable) and versatile as possible.

If I were to build a secure multiplexer as a unikernel, I'd still have the "configuration" at compile time only and I'd better have a damn good excuse to keep more state than the packet in transit on that instance (because someone would have to pay for the work to make the whole system consistent in the presence of buffering/caching nodes).

</comment><comment><USER5> Kinda misses the point of unikernels. The hypervisor already does all the necessary scheduling. You don't need another scheduler.

<comment><USER6> hypervisor+unikernels do sound a lot like microkernel+processes...

<comment><USER7> Unikernels are processes with a really funny system call ABI.

<comment><USER8> If you run them in qemu then this becomes very clear. Even better (or worse?) the strange system call ABI is translated into regular system calls by the qemu process.

</comment></comment></comment></comment><comment><USER9> Is this effectively describing what an init does?

<comment><USER10> I think the key difference here is that the "init" is actually the process scheduler, and each of those managed processes is actually an "init" for its own children, and so on. Kind of like running a VM inside of a VM inside of a VM inside of a VM, but with less VM-specific baggage and more process-related baggage.

</comment></comment><comment><USER11> How is it different from a microkernel?

Randomly, I think the interesting thing with unikernels is that with most modern languages being memory-safe (rust, python, java, .net, javascript) we don't need process isolation.

<comment><USER12> A micro kernel runs drivers in userland and has a "micro" ring 0 footprint. A unikernal bundles only the necessary drivers into an OS which runs only one process and basically pushes multiprocess support into the hypervisor.

His idea isn't yet fully baked, but it's basically having a userland os provide scheduling and permissions management for other os's on the machine. Which is a little odd because the hypervisor needs its own scheduler to decide what vm to run next, and switching from a vm, to the hypervisor, to the scheduler vm, to the hypervisor, to another vm sounds really inefficient. Why not have the scheduler in the hypervisor? Having a dedicated vm for permissions management sounds suspect as well, as you have to perform that same series of switches to decide whether a user is authenticated. I think what he really wants is actually a hypervisor.

In a unikernel the hypervisor provides the memory isolation instead of the os. If we don't provide memory isolation at all it would basically transform remote code execution vulnerabilities into root privilege execution. If I can find a bug in your code or the cpython runtime I can own your machine. Memory safety is just the beginning of security, not a cure all.

</comment></comment><comment><USER13> Sounds like exokernels.</comment>


An Interview With Edsger W. Dijkstra - <AUTHOR> http://cacm.acm.org/magazines/2010/8/96632-an-interview-with-edsger-w-dijkstra/fulltext <comment><USER2> _Thanks to my isolation, I would do things differently than people subjected to the standard pressures of conformity. I was a free man._

Very inspiring words...

<comment><USER3> According to <http://en.wikipedia.org/wiki/ALGOL>, a quote often attributed to Dijkstra, but actually written about Algol by C. A. R. Hoare in 1973: "Here is a language so far ahead of its time that it was not only an improvement on its predecessors but also on nearly all its successors."

</comment></comment><comment><USER4> A more funny, unabridged version of this interview: <http://www.cbi.umn.edu/oh/pdf.phtml?id=296>

</comment><comment><USER5> He's obviously made significant contributions, but I find his distain for industry off-putting. I wish we could separate computer science into theoretical v. applied research to clear up differences in the way the topic is approached.</comment>


My introduction to web world. Your suggestions to accelerate learning curve? - <AUTHOR>

I am starting my initial research work on Machine learning and Data miniing with special interest in web mining. I am doing embedded system programming since last couple of years and can program in C language. I appreciate if you can share youre views and suggestions on few areas :
a)From where should I start by programming for web i.e learning curve involve, language, plateform,books, blogs, open source projects.
b)books suggestion for mathematical (statistics & probability) foundation for web mining, machine learning.
c)How to follow latest devvelopment in web mining and web research. <comment><USER5> B)

Web Data Mining - <USER2>

The Text Mining Handbook - Sanger & Feldman

Mining the Web - <USER3>

Machine Learning - <USER4>

A) and C) are way too wide ranging for a comment here. Google is the most concise answer anyone can give. And sadly, yes, please spell check, grammar check and proof read things you post on the internet. You're clearly not a native speaker, but putting in as much effort as you can to look like one is important on the Internet.

</comment><comment><USER6> 1\. Proper grammar. 2\. Proper spelling. 3\. Proper punctuation. 4\. google

<comment><USER7> _1\. Proper grammar. 2. Proper spelling. 3. Proper punctuation_

C'mon , give the guy a break ...

<comment><AUTHOR> Thanks for your suggestions.

I understand that 'Google' is 'the answer' for my query; however I posted my query here for some specific reasons. .

I am into embedded system programming and I feel there are some right and wrong approaches to starting learning programming for embedded system. I believe I could have better utilized my time doing right stuff then wasting my time on distractions.

Similarly I consider most of audience of Hackers news is 'doers', and active practitioner of their respective field. I may get book references from Amazon but 'doer' can give a wider perspective on the subject and can greatly accelerate learning curve by sharing his learning curve.

Technological growth is exponential and best practices and process gets obsolete much faster. Cycles are getting shorter and shorter. A new learner has to be more agile and open for ideas to accelerate his learning. My intention is to have an open discussion on state of web development, web research with focus on web mining.

I am working on my 'English skills' will try to keep things clean as much as possible.</comment></comment></comment>


Top secret firm awarded contract by Russians to expose Tor browser users - <AUTHOR> http://www.networkworld.com/article/2598401/opensource-subnet/russias-bid-to-expose-users-highlights-law-enforcements-tricky-relationship-with.html#linkedin

<comment><AUTHOR> Downloaded 150 million times in the last year the surveillance evading Tor browser alarms Russia's Federal Security Service and the NSA

If internet privacy advocates such as the EFF get their way, Tor-like technologies could be employed on the open internet at some point in the future to improve personal privacy. In the meantime, internet users have two alternatives: knowingly live in an electronic fishbowl, or use the Tor browser and Onion Network.

</comment><comment><USER2> I'm sure we'll get the whole story soon from Snowden...</comment>


Ask HN: What contact management system do you use - <AUTHOR>

I need to find a good solution to my ever increasing number of biz cards I get from networking events and conferences. Do you guys use a biz card scanner? What can you recommend? What address book tool do you use?<p>Thanks <comment><USER2> I'm just a small solo dev and a Windows guy so I just use MS Outlook. It's not great but it does 80% of what I want better than any other single tool.</comment>


Your company has a knowledge debt problem - <AUTHOR> http://nathanmarz.com/blog/knowledge-debt/

<comment><USER2> The author fails to distinguish between a _debt_ (which you incur by spending what you don't have) and a mere _lack_. I don't think it's appropriate to call it "knowledge debt" when you're merely ignorant of some potentially useful technology.

The actual point of the article is simply this: It's good to know stuff, but hard to learn stuff and tempting just to continue using what you're used to; if you do that, you run the risk of remaining ignorant of something useful. Absolutely correct, of course, but why call that situation "debt"?

The author's drawing an analogy with Ward Cunningham's metaphor of "technical debt", which you incur when you deliberately do something quick-and-dirty and cause yourself pain later on. That really is an instance of debt: when you incur technical debt, you truly are making something worse in the longer run for short-term gain. But (e.g.) writing something with Java and MySQL, which you happen to be familiar with, rather than taking the opportunity to learn a new technology, is not incurring any sort of debt unless the Java/MySQL solution is actually inferior.

It might still be a dumb move for exactly the reasons the author gives. It's just the choice of metaphor I'm objecting to.

<comment><USER3> I suppose you could think of it as an opportunity cost debt. If you don't take the best opportunities, you'll end up paying for them later (and then some).

</comment></comment><comment><USER4> This is really just replacing one type of "debt" with another. It's true that if I do all my work with one toolset, I'm likely to end up not using the very latest and best tools to solve problems. However, if I regularly use different toolsets, I'm going to end up with a costly cornucopia of applications. For a medium-sized or smaller company, the choice to add another toolset should not be taken lightly.

<comment><USER3> I think it's _easier_ for smaller companies to make these kinds of changes. In big companies, there are always multiple levels of management that must be consulted to make a decision.

</comment></comment><comment><USER5> This reminds me of another article I read about "just in time" learning VS "Just in case" learning. The first is the kind of on the job training we all do to get up to speed on projects etc. The second is academic or recreational learning, that is learning without an immediate application in mind.

The author seems to think that one kind of learning is more valuable than the other. This is not the case. All jobs require a certain degree of "just in time" learning and almost all "just in case" learning can be done in a "just in time" manner.

The real question for employers should not be what kind of knowledge does this person have but rather am I willing to pay for this person to learn what they need to to do this job.</comment>


Ride, hustle, kill, repeat: the underground cycle gangs of Los Angeles - <AUTHOR> http://www.theguardian.com/cities/2015/sep/04/ride-hustle-kill-repeat-the-underground-cycle-gangs-of-los-angeles

<comment><USER2> Killing? No killing. Sounds like a pretty healthy way to get out and meet a diverse group of people.

</comment><comment> anti-shill hipsters gonna hip</comment>


Create a digital voice that sounds like you with only one minute of audio - <AUTHOR> https://lyrebird.ai/ <comment><USER2> it's not working for me. I tried Safari, pressing record does start recording but no text to read appears. It recorded fine but wouldn't "Validate". Attempted 3x. Tried Chrome, again no text appeared. Using my built-in mic (the same one Safari had just used, was inaudibly low in volume. I connected an external mic and it recorded find but, again, Validation was not successful. I hope you're having fun listening to me make stuff up to fill 30+ sentences!</comment>


Putting the Brakes on High Frequency Trading - <AUTHOR> http://www.nytimes.com/2012/10/02/opinion/putting-the-brakes-on-high-frequency-trading.html?_r=0 <comment><USER2> This article is long on inflammatory language and short on analysis or evidence.

There are plenty of real issues with HFT as currently practiced (front-running data feeds, gaming with flickering orders, dark pools, etc). However, the article ignores these real issues and suggests that liquidity itself is a bad thing (or something not worth having).

Liquidity means having the ability to transfer an asset quickly with minimal loss of value. Anyone who invests wants a liquid market -- illiquid securities are notoriously problematic.

The article is misleading. It is the absence of liquidity that is a disaster. Market crashes are what happens when liquidity dries up. Just ask anyone who was trying to sell their house last year.

As long as the rules are fair (no front-running, preferential trades, equal access, etc), every market participant adds value. Markets are auctions and auctions run best when there are active bidders.

<comment><USER3> It's fake liquidity IMO, since HF traders are only willing to take a position inbetween someone selling at one price and someone buying a bit high. The trade was going to go through without them in the middle. They are just skimming some money from the buyer, who would otherwise have a lower price at the cost of delaying a trade for half a second.

<comment><USER4> As a high-frequency trader, I can tell you right now that you are just completely incorrect. I'm staring at a screen right now where we take both sides on every order, not 'skimming some money' from people. It's obvious you have no idea what you're talking about.

I would apologize for harsh language, but I have low tolerance for people who freely speak lies of matters of which they know nothing.

<comment><USER3> If you aren't making money from having the majority of your trades inbetween two trades you are necessarily losing money. But HFT is profitable for you, which is a contradiction.

</comment></comment></comment></comment><comment><USER5> I would like to say that I was misquoted in this op-ed. I have never said that "high-speed technology was "a destructive force in the market" with "no social benefit."" I said that there is a limit to the benefit of speed, and we're finding that the latency race to 0 has found that limit.

<comment><AUTHOR> I believe this is the entire quote: "The new electronic marketplace has several structural inefficiencies. These are what have permitted HFT to become a destructive force in the market, rather than a passive liquidity providing mechanism. This should not be construed to say that all HFT is bad, but there are 2 important points to make – the structural inefficiencies present in the market have created a massive misallocation of resources into technology that provides no social benefit, and structural deficiencies in market structure have allowed for nefarious or accidental actions to disrupt the market". I agree there are some contextual problems with the citation in the article. Retrieved from [http://banking.senate.gov/public/index.cfm?FuseAction=Hearin...](http://banking.senate.gov/public/index.cfm?FuseAction=Hearings.Testimony&Hearing_ID=f8a5cef9-291d-4dd3-ad3b-10b55c86d23e&Witness_ID=e514e57c-14e7-4a29-b75d-e5531e6b1cff)

</comment></comment><comment><USER6> Is there really a problem here that's worth regulating?

They point out flash crashes as being a big problem--those flash crashes quickly correct themselves back to their "true" value (whatever that means), and the people most hurt are the people who were using bad algorithms and took risks they didn't understand, Knight Capital being a recent example.

They reference volume being much higher than it ever has been on account of hft, which is true. But what does that have to do with the bubble of the 90s? Higher volume != stock market ruin.

Then there's the small time investor getting hurt. But are they really? The whims of the market now occur because of algorithmic trading as opposed to before, when the whims of the market occurred because of--who knows? Small time investors have been winning and losing since the system was invented. Markets can and always will be fickle.

So again, what exactly is the problem here?

<comment><USER7> You have 100 shares of FOO. It is trading at $50. You bought it at $40, so you have a stop-loss order to sell it at $35. Some "liquidity provider"'s algorithm goes haywire and the price drops to $30. The exchange's "circuit breakers" halt trading or revert the trades, and then the price quickly goes back up to $50.

Unfortunately for you, your brokerage's computer saw the price drop, executed your stop-loss order, and put your shares up for sale, which were then purchased by another 'liquidity provider' (or hell, maybe even the same one that caused the value to drop in the first place). You've now lost $1500 because of HFT. _Your_ trade can't be reverted, because fuck you, that's why, but the holy "market makers" get their trades rolled back so that their rich friends don't suffer anything for their alogrithmic fail.

<comment><USER8> The real problem is that your "stop loss" is a standing order to sell, _at any price_ , if the price of your asset falls below some threshold. That is fundamentally a bad idea, and it's just this sort of trading behavior that creates liquidity crises.

<comment><USER9> No, the real problem is that one person's program broke and caused real losses for other people who were acting rationally. If you must account for a non- zero chance that some geek's algorithm will go totally batshit and lose you a bunch of money in unpredictable ways, there is a huge problem at the very core of the marketplace.

</comment></comment></comment></comment><comment><USER10> Who cares if institutional _traders_ can't figure out why the price is moving.

All traders do is arbitrage, computers are much better at spotting arbitrage opportunities than humans are. That institutional traders can't figure it out merely points to their irrelevance.

Now, on the other hand what we should be concerned about is if HFT is ruining the investment climate and since companies rarely offer their stock it almost certainly has no effect on the investment climate which looks at the macro conditions across years rather than the microclimate of the next few minutes as traders do.

The price of a stock, or the value of an index at any point in time has almost no relevance to the economy as a whole. What matters is that over long periods of time these companies deliver great value to their customers.

Lets worry about GS, et al, selling stock that doesn't exist (naked shorting) before we worry about HFT.

</comment><comment><USER11> For every trade you will incur some transaction cost. You may think that even though there is a Bid and an Ask price, you may on average get somewhere in the middle, but you don't. Your buy trades are likely to be filled on the Ask price and your sell trades are likely to be filled on the Bid price because some intermediary will get in between and pocket the spread. This has been the case, this is the case, and I haven't seen viable solutions to this what so ever.

What has changed over the past decade is who that intermediary is and how much of the spread they can steal. In 2001 New York Stock Exchange reduced the minimum listed price increments from $1/8 to $.01 . This spread used to be collected by exchange "specialists" with inherited seats on the floor for providing liquidity. The rise of alternative exchanges and computers allowed third parties to cut in to provide liquidity with smaller spreads and cutting out the specialists. These third parties are high frequency traders.

Investors are still loosing the spread on each trade they make, but it is so much less than it used to be. There are issues with the market microstructures that could be addressed, but trying to push computer generated should not be it.

I for one, never want to go back to the dark days of specialists and their $.125 and $.25 spreads.

PS. This was a discussion of the minimum transaction cost you can have. Additionally you may have to pay fees to your broker ( especially if you are retail and don't trade a lot ). If you are trading lots of shares at a clip you will also encounter costs from the market impact of your trades.

</comment><comment><USER12> Or, implement Mark Cuban's 10 US cents per trade cost idea. <http://news.ycombinator.com/item?id=2862003>

No more problem. And it could be harder to game than taxing profits after the fact...

<comment><USER13> Unintended consequences alert: read up on the UK stamp duty on UK equity trades. Goldman Sachs creates a derivative security matching the return of the underlying equity that you can trade with GS and avoid paying the stamp duty. Net result: GS makes money, less liquidity for the average investor. Rock on transaction taxes.

<comment><USER14> _Goldman Sachs creates a derivative security matching the return of the underlying equity_

So Goldman Sachs is using a loophole, how surprising.

What is your point, though? Should we not make laws that can potentially have loopholes?

</comment></comment></comment><comment><USER15> As with most things, this addresses symptoms and not the actual underlying problems. HFT have exposed all kinds of problems which existed since the inception of the various markets but only appeared recently.

For example, Regulation NMS is an important rule that was introduced to solve a major problem (ensuring price fairness in a decentralized environment) but it didn't make sense back then. However, given the physical constraints, the problems weren't apparent. Now HFT has highlighted the broken nature of the regulation. The right solution is to force a re-centralization of the exchanges, but instead of that people are pushing to stop HFT.

</comment><comment><USER16> I'm happy that there seems to be some discontent here on the substance of this article. Indeed, we perceive market 'crashes' to be negative, but in fact they (necessarily) benefit as many people as they hurt. Being able to obtain stock in a company for fewer US$ can be a good thing. And who's to say that banning algorithmic trading will prevent rapid swings in the market? They happened before algorithmic trading was here, and they will happen afterwards.

All of this rhetoric seems to be a knee-jerk reaction to something the author is incapable of grokking (no doubt due to a limited human capacity to do so).

<comment><USER3> HFT crashes do not benefit or hurt anyone, since they are rolled back.

<comment><USER16> I'm almost certain this statement is incorrect.

1) Just because a price reverts to a previous value does _not_ mean that no- one benefited or was hurt from the fact that it fell or increased in between.

2) The 'rolling back' of an HFT-prompted crash (the causal link being debatable anyway) is not guaranteed at all.

</comment></comment></comment><comment><USER17> Want less emphasis on speed? Let tick marks be less than $0.01. Market-makers are clearly willing to provide spreads of less than $0.01. Any time the price of something is artificially moved out of market equilibrium, there will be queueing (either to buy or sell the good). In this case, there is queuing to provide liquidity, and market-makers have every incentive to try and jump the queue. Instead of competing on price (they can't), they compete on speed.

</comment><comment><USER18> I don't see the point of worrying about volatility. The price moves and people don't know why. So what? I don't care if traders get heartburn - that's part of the job.

The real problem with HFT is its basic unfairness. Firms that aren't physically located near the exchanges are at a disadvantage, as well as individuals located anywhere. I like Glenn Reynolds' idea of adding a randomized delay of up to one second to every trade.

<comment><USER9> Volatility is reflected in value, which I suspect you care very much about.

<comment><USER18> I'm not sure what you mean by that. What I care about is how my asset does over the long run. If it goes up 10% today and down 10% tomorrow, I really don't care.</comment></comment></comment>


The origin of the '80s aesthetic - <AUTHOR> https://www.youtube.com/watch?v=TCI8lPvr6SM <comment><USER2> I can't quite put my finger on it, but there is something about this format that I do not like. I feel like I don't retain anything maybe? Content is good, but something about the "Vice Documentary" thing...

<comment><USER3> It reads like a random collection of facts. There's no narrative to it.

<comment><USER4> Indeed, it's incomplete. It doesn't discuss digital/CG audiovisuals, popular genres, fashion, or world events. Memphis is important and worth diving into but it's only one facet.</comment></comment></comment>


Taking Credit for Success - <AUTHOR> http://planetary.io/notes/taking-credit-for-success

<comment><USER2> I agree, but would add a caveat. I feel like many Millennials have grown up in a world where we were so afraid of failure we over-emphasized success. Everyone is a winner, everyone gets a sticker of some kind.

As many times as I see people not wallowing in their success, I see people who wallow in it way too much. A balance is really important to ensure that one success doesn't derail you or over-inflate your ego too much that you become, by consequence, more sensitive to risk and afraid to fail.

<comment><AUTHOR> I think the difference might be in giving yourself a pat on the back, as opposed to looking to everyone around you to validate your success. The 'everyone gets a sticker' mentality is totally harmful. That's why it's important to realize success on your own terms — you don't need the sticker.

</comment></comment><comment><USER3> This is excellent advice... the problem occurs when someone louder claims success for your work. It can be a bigger company, or it can simply be someone who, due to not spending any time inventing, has more time for self-promotion.

I haven't found a non-violent solution for this yet; timestamped video doesn't seem to work, nor do patents.

<comment><USER4> What works for me is accepting that my idea is out there doing it's thing (even if someone else stole it). On a plus side, if things go dramatically wrong, the fingers aren't going to point at me.

<comment><USER3> That's very zen but the fourth-fifth time you win the let's-outsmart-nature game but someone else walks away with the prize, it's frustrating.

There has to be SOME success in between failures. There has to be some recognition of success. Otherwise one goes mad.</comment></comment></comment>


US-CERT Releases IP addresses, domains, and malware signatures used by Russians - <AUTHOR> https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity <comment><USER2> Imagine if non-state actors could make relationships between any two states bitter. They could do that conceivably now. For whatever gain. For instance country A attacks third world country B. country B's sympathetic hackers hack country A from country B and force them into a confrontation. Who is working for whom? Who actually knows. We're in that sort of cyber punk era. Like for instance hackers from the Ukraine could do some shit to Russia as retaliation via attacking US targets from Russia or vice versa. Whatever two states are suspecting of each other could be exploited. Major actors have already been playing these sort of games, now they are available for pretty much anyone to exploit.

tl;dr You average Joe hacker can now potentially start wars from his mother's basement.

<comment><USER3> What's new here ? This was always the case (using foreign hacked boxes to hide your origin) only now we're bombarded by this because of using it for political show.

<comment><USER2> Not really, before you could potentially do a bit of economic damage to a company. The threat now is more real to governments as far as I can tell. It's possible for hackers to do real damage and I think that's what scares governments. And those hackers don't actually need resources to pull it off. And if you look at it from Obama's perspective. Say that it was true that this sort of thing played some part in Trump getting elected. Well that means that people like that can damage politics of a country, the most powerful country in the world, with disastrous results. They know the damage it can cause because they have used these tools, and they are scared. That's what new. They weren't scared before.

</comment></comment></comment><comment><USER4> previous discussion here

[https://news.ycombinator.com/item?id=13279600](https://news.ycombinator.com/item?id=13279600)

<comment><USER5> Worth noting as this submission has a much "stronger" title.</comment></comment>


Blockchain Is Not Going to Change the World - <AUTHOR> http://www.forbes.com/sites/francescoppola/2016/06/13/blockchain-meh/ <comment><USER2> > Anyone who has worked on payment systems – as I have – knows that a payment > system consists of two essential components: a ledger, and a means of > sending and receiving messages.

She missed the most important this a payments thing depends on: you trust the person to pay you. Without that you have nothing. The blockchain is about staking your reputation on previous work done. It's a way of saving and transferring trust.

We can and have automate ledgers and sending and receiving messages. Automating the transfer of trust: this is new. But that's difficult to recognise if you don't realise trust is involved.

</comment><comment><USER3> "Blockchain is a stripped-down payments system" no, it's more and can be used besides payments.

And nobody believes it does solve the trust issues about actual exchange for goods or service.

Biggest thing I see (but I'm not too literate on bitcoin): once it works right it can't be stopped or taxed and still fly across the world through the internet.

The blockchain is really interesting in itself, but I know little about what is possible with it. One example I love though is the "proof of prior existence". You can weave a hash in to the blockchain and than have proof you already possessed the hashed information at that time.</comment>


Yes, Cops Are Now Opening iPhones with Dead People's Fingerprints - <AUTHOR> https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-cops-are-now-opening-iphones-with-dead-peoples-fingerprints <comment><USER2> I... don't mind this? If you have a corpse and a phone, that's sort of sensible. I'd expect this to be the case, and the person is dead after all.

<comment><USER3> As long as the person didn't become dead to unlock the phone.</comment></comment>


Cryptocurrency investor robbed via his cellphone account sues AT&T for $224M - <AUTHOR> https://www.cnbc.com/2018/08/15/cryptocurrency-investor-sues-att-for-224-million-over-loss-of-digita.html <comment><USER3> I hope he wins, mainly so cell operators will perhaps take security more seriously. Not long ago, I was with T-Mobile. My username was my phone number, and the password, you could request and they'd send it to you in an email. With the climb of social media, our phone numbers are more a part of our identity than ever before, and carriers lack of security is being thrust into the spotlight.

<comment><USER4> There are of course two sides to every coin. The flip side is, cell carriers never signed up to be a secure identification mechanism. SMS wasn't designed for security, and there's little financial incentive for them to invest in those changes, i.e., they don't charge you more for secure authorization of 3rd party platforms. I think its very akin to the US Social Security Number being used as a 'secure' identification in many cases.

I imagine a world where you go into the cell store, and they demand three forms of identification including a utility bill to talk to you. I can already hear the complaints from a much larger portion of their customer base.

<comment><USER5> That's a good point in general; NIST recommends not using SMS for challenge- response authentication.

I don't know whether in this case the victim was using SMS codes, or whether the attacker used their phone number as part of a more involved attack (e.g. calling customer support and impersonating the victim). Even if you don't use SMS codes, there are a number of attacks that are opened up if someone seizes your cell phone number.

In general, however, I think it would be a good thing if service providers were held liable for damages occurring due to account breaches; that's the only way we're going to get proper account security. Schneier has written on this subject extensively, e.g. [https://www.schneier.com/essays/archives/2003/11/liability_c...](https://www.schneier.com/essays/archives/2003/11/liability_changes_ev.html).

<comment><USER6> I work in fraud prevention. While it's not yet a typical attack, it is does happen regularly.

Usually the attack is done against an individual who is known to have significant crypto assets and is using Gmail. By default if you enable 2fa on your Gmail account, sms based 2fa is activated as backup.

The attacker social engineers the phone provider to port the victims number, then resets the victims Gmail account, uses Android device manager to wipe their devices, and using the details found in Gmail they proceed to gain access to other accounts owned by the victim. The main goal being to social engineer access to services where they store crypto or to find unencrypted wallet backups in the cloud.

<comment><USER5> The previous best option I was aware of with Gmail was to add a pair of Yubikeys, then explicitly remove your cellphone from the account, to close the gap you mention.

Now there is [https://landing.google.com/advancedprotection/](https://landing.google.com/advancedprotection/), which might be a better option -- interested to know if you've got any opinions on that scheme.

</comment></comment></comment></comment></comment><comment><USER7> While I was working at a blockchain forensics company (we built one of the first AI backed block-explorers both for Bitcoin and Ethereum & our service was also used to identify the DAO hack), both myself and my boss were targeted multiple times a year with this kind of attack even though we held no crypto through the company. It seemed that just since my name was on the web with the word crypto I was a target.

To this day I have a personal phone and a revolving burner I only use for non- SMS 2FA with an unlisted number, which is kept in an EMF proof bag while not in use.

Security for this kind of thing is an absolute joke.

Granted, this guy should've known better granted the value of his holdings... Most also don't know that accounts such as Authy and other non-SMS 2FA authenticators can still be stolen if your mobile number is stolen.

However, I'm still waiting for a carrier that creates a system that can't be trivially socially engineered by bored Chinese scammers...

<comment><USER8> > Most also don't know that accounts such as Authy and other non-SMS 2FA > authenticators can still be stolen if your mobile number is stolen.

I was under the impression that apps like Authy and Google Authenticator have no connection with the telephone network/phone number. Do you have any reference that claims otherwise?

<comment><USER9> Authy specifically stores your account in the cloud and can be recovered using SMS. They have a 24 hour warning period during which the email address on file receives multiple notifications that a recovery is being attempted with the option to cancel but if someone has control over your phone number for an extended period of time they can absolutely take over your Authy account. I found this out when my Authy account was corrupted somehow and support said, hey no worries just go through the recovery process.

Google Authenticator is offline only and is not vulnerable.

<comment><USER7> I mentioned this because I know multiple people who've had authy / other authenticators compromised down the line from social engineering attacks. Even if you can be alerted, usually it's too late by the time you realize what's happened to your creds.

<comment><USER10> Did they not put a password on the Authy backup?

</comment></comment></comment></comment></comment><comment><USER11> Wasn't it like a year ago that famous YouTubers and such were getting their accounts stolen the exact same way and AT&T promised they would tighten up security measures?

<comment><USER12> Yes, you have to opt-in to this type of security

<comment><USER13> Opt-in security is the best form of security, after security by obscurity /s

<comment><USER14> I prefer both options: opt-in by obscurity.

<comment> loa-in-backup Sueing tge internet to force it to forget your number?

</comment></comment></comment></comment></comment><comment> village-idiot I'm not sure if he has any legal recourse against AT&T, but it's another example why sms based 2FA is a bad security scheme, especially if you're a high value target.

<comment><USER15> In the US it is trivial to hijack any mobile number's SMS traffic. It takes less than a minute. SMS as 2FA should never ever be used by anyone.

<comment><USER16> How does it work? Why is it so easy?

<comment><USER17> SMS is not exactly the most secure protocol. But you do not need to use SMS for 2fa, that's a misconception.

<comment><USER18> Isn't it effectively plaintext?

I don't know too much about the SMS protocol. But I do know that most protocols do start out plaintext because programmers are lazy and optimistic.

<comment> village-idiot That's one part of the problem. The other part is that it's actually quite easy to convince most cell phone carriers to change the SIM card associated with a given phone number. Once you've pulled that off hijacking the account is easy.

</comment></comment></comment></comment></comment></comment><comment><USER19> Publicity and tens of millions in Bitcoin /Ethereum++ is a bad idea. Especially since once it's gone it's gone. Hacking your account means FU money and then some, with less chance of getting caught than other crimes. So they have all the incentive in the world to take heir sweet time...even if they lost 50% laundering, it's still more than enough.

I'm all for At&t to be held responsible if they broke security protocols. They charge an arm and a leg

<comment><USER7> Having any serious amount of money and being showy or grandiose about it is asking for trouble...

Only rich morons actually need armed security as a result of their social media habits emanating from a pathetically desperate ego.

</comment></comment><comment><USER20> If Bank A makes my PIN number automatically the last 4 of my SSN, and Company B discloses that information, is Company B responsible for 9 times whatever losses I incur if my ATM is stolen?

<comment><USER21> Sure.. you can sue for whatever you want. There is no guarantee that you will be awarded the damages though.

<comment><USER22> This kind-of comment would have been clever in elementary school.

Here, you're just being a dick.

<comment><USER21> Sorry I really wasn't trying to be a dick here. The original post asked whether one party could sue instead of being responsible. It is possible that this is why my post seems childish.

The point I was trying to make was about conflating the damages being sought in a lawsuit by one party and the actual damages owed by other other in a lawsuit. I think it is pretty common practice for the plaintiff pick a high number out of somewhat thin air to prevent themselves from pricing themselves from leaving money on the table.

</comment></comment></comment></comment><comment><USER23> Are there any phone companies that have decent security practices? As far as I can tell switching is pointless because they're all awful in this regard.

<comment><USER24> That's the wrong question to ask. There are no financial institutions that have proper 2FA. I don't know of a single bank in the US that uses any standard 2FA. They all use SMS. Recently, I found that you can make paypal (US) use TOTP 2FA with a workaround. I recommend everyone to do that.

</comment></comment><comment> m-i-l Sorry for his loss, and the mobile providers do need to do something about this known attack vector. But with cryptocurrencies you need to "be you own bank", and extending his own analogy how many legitimate or long lasting banks would store USD24 million in cash in a hotel room safe?

<comment><USER25> Following this analogy, would the bank sue the builder or vault manufacturer if they gave someone a key to the vault without the bank's knowledge and it was used to rob the vault? Or might the bank sue a armored carrier for irresponsibly storing monies that were stolen in transit between banks?

Maybe you can be your own bank, but banks have to depend on external factors/entities to do what they're supposed to do as well.

<comment> m-i-l Seems reasonable, because bank vaults and armoured vehicles are designed specifically for protecting high value items. Hotel room safes on the other hand are not (in fact some even have a disclaimer advising you not to store valuables in them).

</comment></comment></comment><comment><USER26> From TFA:

> Terpin was the victim of two hacks within seven months

If indeed these were separate occurrences of breaking in through the same phone account—and the article is not definitive on this—then the punitive damages seem quite appropriate. "Fool me twice, shame on me," and all that.

</comment><comment><USER27> Given the revelation that phone number security just isn't that secure, I have changed my online accounts that allow 2FA to use a crypto key. However, I have found that most seem to only allow crypto keys in addition to a cell phone number. You can't turn it off. Has anyone else noticed this? What is the point of moving to something more secure if you can't get rid of the weak link?

<comment><USER28> Yeah it really makes you think of all the other methods you might not even know about. My bank has an mobile app to connect that I'm not using because I don't trust it, but what if it's indeed insecure and someone else exploit it...

</comment></comment><comment><USER29> I notice AT&T is quoted as saying "we dispute these allegations and look forward to presenting our case in court". It's interesting they didn't say "these allegations are baseless and without merit". I wonder if that means anything.

<comment><USER30> A "baseless allegation" is one with no evidence or reason. This guy has a reason and presumably evidence, so his allegations are not baseless.

A baseless allegation would be if I were suing AT&T for losing all my crypto investments. I have none and am not an AT&T customer.

An "allegation without merit" means no rational interpretation of the law would result in a guilty conviction of the allegations. Baseless ones are almost always without merit.

<comment><USER29> You think that lawyers _say_ an allegation is "baseless" iff it _is_ baseless? That's an interesting epistemic outlook.

<comment><USER30> No, I'm providing definitions and using myself in an example. Please do not put words in my mouth.

<comment><USER29> You provided unnecessary and unhelpful definitions, from my perspective.

I assume as axiomatic (and required by HN guidelines) that you _intended_ to be helpful and relevant, so I asked a question to determine what you were thinking.

If you do _not_ think lawyers use the "baseless" language in a totally transparent, sincere way, then I would've expected you to be more interested in when and how they do that, which is the discussion I was looking for, if any.

<comment><USER30> Wow, if that's how you really feel. Your eagerness to fall back to rules lawyering to justify your behavior instead of reflecting where our misunderstanding is and working to resolve it, is the kind of toxic online behavior I will gladly get dinged for.

I will help you and go ahead and flag all of my posts in this thread so dang and others can take moderative actions against me.

</comment></comment></comment></comment></comment></comment><comment><USER31> What kinda crappy ass crypto wallet would break if you had access to a cell phone account.

</comment><comment><USER32> How can he prove he did posses this amount of crypto currency and is not making everything up? With a system without any regulation nor oversight where you have to play your own bank, this is exactly what you've signed up for...

<comment><USER28> He still has the private keys that control addresses that can be shown from the blockchain to have had the coins until the hack.

What is harder to prove is that he doesn't also control the new addresses where the funds were transferred to.

</comment></comment><comment><USER33> I feel for him.

But couldn't they reasonably argue they are not a service for securing this kind of thing?

If i leave $224m in my car and park it in car park at my local shopping centre are they liable for $224m?

I'm not saying they're not liable to some extent.

<comment><AUTHOR> It's more he parked it at the dealership, and the dealership made a stranger a spare key to get into the car.

<comment><USER34> Even more analogously in my opinion: someone walked into the dealer, said "hey, transfer the keyless entry for my car to this fob right here" and they did.

<comment><USER35> Or that someone put out plastic-shell bike lockers, someone had a $224M stolen from one, and now they're pissed.

I suspect that metaphors aren't going to really convey this well.

</comment></comment></comment></comment><comment><USER36> I hope we see more of this. A _lot_ more. These fuckers need to hurt.

<comment><USER37> Who, phone companies or cryptocurrency investors?

<comment><USER36> well, first and foremost phone companies. But also anyone who trust phone companies to protect them

</comment></comment></comment><comment> enahs-sf I think about this a lot as the phone is a pretty obvious single point of failure for 2FA and telcos are easily pwned through basic social engineering. I struggle with removing it as an alternative though because losing your phone or 2FA device leaves you in a pretty nasty spot. Tough choice.

</comment><comment><USER38> This was a good article about how to prevent these types of attacks. [https://medium.com/@masonic_tweets/minimum-viable- security-3...](https://medium.com/@masonic_tweets/minimum-viable- security-32e61d10aee4?ref=tokendaily)

</comment><comment><USER39> Original court filing here: [https://www.greenbergglusker.com/content/uploads/2018/08/Com...](https://www.greenbergglusker.com/content/uploads/2018/08/Complaint- as-Filed-3063362-1.pdf)

</comment><comment><USER40> There's not a lot of detail in the article, but reading between the lines it seems like an attacker went to an AT&T retail location and pretended to be the plaintiff in order to re-assign the plaintiff's phone number to a new SIM card.

</comment><comment><USER41> Not getting my sympathy. Use a hardware wallet such as Trezor for God sake.

Also, in what world when he lost $24M can he sue for $224M? Entited to a 10x return because of his own neglegence. Nope!

</comment><comment><USER42> >Loses $24M in anonymous currency that's unbound by state

>Sues telecommunications conglomerate for $224M over loss

Is this guy ill or what

</comment><comment><USER43> Who the hell keeps $24M worth of crypto on a phone? I only trust open source systems, do all large transactions on fresh Linux, disable JS if I have to use the browser, never visit any unusual websites, nothing not related to the process.

</comment><comment><USER44> Phone numbers are specifically designed to serve as public identifiers.

I don't think you can expect a security mechanism that is supposed to work counter to that to work very well.

<comment><USER45> The validation mechanism is control over the phone number, not knowledge of it.

Verification by knowledge of numbers intended to remain secret (social security, credit card) is also never okay.

<comment><USER44> I'm going by the content of the story, which describes acquiring the phone number as the key issue.

> After the first hack, Terpin alleged that an impostor was able to get his > phone number from an "insider cooperating with the hacker" without an AT&T > store employee requiring him to show valid identification or provide a > required password. That phone number was later used to access Terpin's > cryptocurrency accounts, according to the complaint.

<comment><USER45> "Acquiring the phone number" means getting it mapped to the attacker's phone/SIM card. Overview of SMS hijacking (copy paste link, JWZ doesn't line HN referrer headers): [https://www.jwz.org/blog/2018/07/two-factor-auth-and- sms-hij...](https://www.jwz.org/blog/2018/07/two-factor-auth-and-sms- hijacking/)

<comment><USER44> What you say must be the real story.

It's just that the article says, "was able to get his phone number".

Getting a phone number, to me, has always had a pretty universal meaning, which is to simply learn its digits. But I suppose you must be right and they actually mean a deeper compromise.

</comment></comment></comment></comment></comment><comment><USER46> > Have your own guy impersonate you and get your $24 million stolen

> Sue At&T for $224 million

> ???

> Profit

<comment><USER35> > Go to jail for perjury.

> Lose all profit.

</comment></comment><comment><USER20> Two things that jump out:

1) $200M in punitive damages? The hack occurred in January, and the price has gone down across all cryptocurrencies substantially since then.

2) Was the password hacked? Or did the exchange allow password resets via SMS? (So negligence made 2fa really 1fa) In this situation it seems AT&T would be at most 50% responsible.

<comment><USER47> > AT&T would be at most 50% responsible

You could reduce that further by arguing AT&T aren't at fault because third- parties built authentication and identity protocols ontop of what was never guaranteed to be a secure or authenticated channel

<comment><USER48> And then increase it again by arguing that AT&T should never have made it possible for employees to do this.

<comment><USER49> And then diminish it to zero again because yes it should be possible for employees to do that. The economic value for most people of being locked out of your phone number and not being able to easily fix the problem or easily upgrade a phone exceeds the cost imposed when some of those people are morons and assume ability to receive an SMS message sent to a particular phone number is any sort of security factor.

<comment><USER48> "And then diminish it to zero again because yes it should be possible for employees to do that."

Absolutely not. It never should be possible for a single employee to do that with no checks at all.

</comment></comment></comment></comment></comment><comment><USER50> My first thought was "cryptocurrency is fundamentally not investment but speculation they don't create anything of value but squander vast ammounts. Second is that it is multileveled frustration that both phone systems are so damn insecure like the completely insecure call identification - <USER2> international efforts to track down telefraud rings are well and good a proper system would prevent most of their tricks.</comment>


The Essence of Dynamic Typing - <AUTHOR> http://daniel.yokomizo.org/2012/05/essence-of-dynamic-typing.html

<comment><USER2> Nice summary. Some extra commas would've helped.

But what I really often miss in this discussion (dynamic vs static typing), and also in this article, is that statically typed languages _fundamentally_ allow for better tool support. With modern IDEs and refactoring tools being pretty powerful weapons, this has a major impact on programmer productivity.

Of course, there is no reason why some sort of refactoring / code inspection support can't be added to dynamically typed languages, but it's certainly more difficult to make, and more error-prone.

I believe that in the next decade, this gap will widen, and that because of this, some statically typed language will be the next hip language. The current IDEs are too Windowsy for many hackers' tastes, but there is no reason for this to be so. You can have a VIM-like tool with Visual Studio-like powers.

<comment><USER3> That's if you prefer tools like Visual Studio to tools like Squeak.

That is, if you prefer your tools to perform static analysis as opposed to allowing you to inspect and modify your system while it's running.

<comment><USER2> That's a fair point which I don't know how to counter well, mostly because I know virtually nothing about the Smalltalks of this world.

That said, how can you refactor your code while it's running? Also, is dynamic typing a requirement to get tools like Squeak to work? Or could it work equally well in statically typed languages?

<comment><USER3> A small example of refactoring running code is at <http://www.youtube.com/watch?v=1kuoS796vNw>

And a more lengthy example of writing tests first, letting the code fail, and fixing things in the debugger: <http://vimeo.com/19591202>

This is kind of like writing code that doesn't exist or doesn't work, and letting the type checker guide you through the things you need to fill in. The difference is that Smalltalk is actually executing your code, so you can see actual values rather than just type errors, and it will keep trying to execute your code while you change things.

It might be possible to do something like that with static typing, but I think the real issue is that most advocates of static typing wouldn't really _want_ to mess around with programs in inconsistent states in the first place.

</comment></comment></comment></comment><comment><USER4> Small light grey code on white background. You might want to change that.</comment>