Mandoc: becoming the main BSD manual toolbox [pdf] - <AUTHOR> http://www.openbsd.org/papers/bsdcan15-mandoc.pdf <comment><USER2> As the author of a fairly popular manual viewer for iOS[1], I was shocked when building the documents at the state of the tools and the availability of documentation for man. You would think that such a widely used command would have tonnes of information, formatting tools, parsing libraries, etc, plus articles and such - but surprisingly, there isn't that much available. Of the libraries that I found, many of them only supported certain formats or had strange bugs.

So, any improvements made to man are very much welcomed! I do feel, however, that a new format might be the best way to go - possibly something based loosely on Markdown or (my personal preference) JSON. I feel that if we had a more structured manpage format, we could do a lot more with it. I was hoping in my app, for example, to be able to pull out commands (e.g. enter "ls -lh" and it'll highlight the information for "-l" and "-h".) It is possible ([http://explainshell.com/](http://explainshell.com/) does it really nicely) but it would be far easier with a nicely structured format.

[1] [https://itunes.apple.com/us/app/manuals-linux-bsd- manpages/i...](https://itunes.apple.com/us/app/manuals-linux-bsd- manpages/id957578357?ls=1&mt=8)

<comment><USER3> > So, any improvements made to man are very much welcomed! I do feel, however, > that a new format might be the best way to go

This is actually already the case. The original man(7) language (actually a set of macros for troff) has been around since the early 70s and was part of Unix since the beginning. It's a simple language but entirely presentation‐focused, so it's not helpful for semantic manipulation.

Modern manpages should be written in mdoc(7), another troff macro set that's both more semantic and more expressive than man(7). mdoc(7) was first developed in 1989 for BSD and has been the standard documentation format there ever since, and is fairly common in Linux software as well (although there's still a large contingent using the old, non‐semantic man(7) macros).

A lot of mandoc's power comes from the semantic ability of mdoc(7) manpages, including the ability to search by flags/options/environment variables/whatever, and the ability to convert to semantic HTML5. Ingo didn't cover so much of that in this talk, but he has in some other talks:

[http://www.openbsd.org/papers/eurobsdcon2014-mandoc- slides.p...](http://www.openbsd.org/papers/eurobsdcon2014-mandoc-slides.pdf) [http://www.openbsd.org/papers/bsdcan14-mandoc.pdf](http://www.openbsd.org/papers/bsdcan14-mandoc.pdf) [http://www.openbsd.org/papers/bsdcan11-mandoc- openbsd.html](http://www.openbsd.org/papers/bsdcan11-mandoc-openbsd.html)

</comment></comment><comment><USER4> The memory-unsafety bugs they found through fuzzing is worrying for newly written code.

It really shows that you should try to avoid writing C code when possible.

<comment><USER5> Hmm, I think OS level syscall restriction is also a good mitigation for simple programs. Things like [https://en.wikipedia.org/wiki/Seccomp](https://en.wikipedia.org/wiki/Seccomp).

<comment><USER6> How popular is Seccomp? I know Chrome uses it, but I'm not familiar with many other programs outside of sandboxing software.

<comment><USER5> Things like gzip or tar or compilers should use it imo. They are programs which just read from one file descriptor and write to another.</comment></comment></comment></comment>


Hands-on: getting work done with Google's new Aura interface for Chrome OS - <AUTHOR> http://arstechnica.com/gadgets/reviews/2012/04/hands-on-getting-work-done-with-googles-new-aura-interface-for-chrome-os.ars <comment><USER2> Google; if only you could make the chromeos something we hackers might play with on our desks. Or make it a cloud desktop.. Currently too much dependence for a couple of models from Samsung, Acer etc seems the hard way.</comment>


The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies (2018) - <AUTHOR> https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies <comment><AUTHOR> Reposting here. Over 15 months later, still no concrete evidence, no retraction, no apology.

<comment><USER2> I wonder how many people are upvoting you because they think China is evil and will believe any thing that confirms their belief or they actually know Bloomberg has no evidence.</comment></comment>


A Computer Science Degree DoesnaEURXt Hurt (Much) - <AUTHOR> http://www.leahculver.com/2007/05/30/a-computer-science-degree-doesnt-hurt-much/ <comment><USER2> More or less content-free blog post.

<comment><AUTHOR> _"... More or less content-free blog post ..."_

James, how?

I can see a couple of good messages here. The first, in a market where there is a lack of lead developers. It shows one path, that one person took to get the knowledge & tools needed to create a product. The second is the _"where are all the chick developers? ... they can't handle, 'tech stuff', etc ..."_ needs to be put into proper context. They are around if you care to look & seem to be doing an ok job ~ <http://pownce.com/></comment></comment>


Pills that kill: why are thousands dying from fentanyl abuse? - <AUTHOR> https://www.theguardian.com/global/2016/dec/11/pills-that-kill-why-are-thousands-dying-from-fentanyl-abuse- <comment><AUTHOR> _Even as Americans are getting their heads around fentanyl, it is being eclipsed. In September, the DEA issued a warning about the rise of a fentanyl variant that is 100 times more powerful – carfentanil, a drug used to tranquilise elephants._

Wait! Fentanly is 50 times more potent than heroin and 100 times more potent than morphine, but carfentanil is 100 times more potent than fentanyl, and folks are still taking it.

That's nuts, just freakign nuts.

<comment><USER2> I'm never sure why per-unit potency gets mentioned by media articles about narcotic drugs. It's not like someone taking a gram of heroin would go and take a gram of carfentanil.

<comment><USER3> It is important when the lethal dose starts being measured in the range of 5 micrograms, well below the ability of an unaided human to discern.

<comment><USER2> Drug users aren't measuring out micrograms from a vial of pure medication. It'll be in a solution or pill form.

<comment><USER3> you're missing the point so hard it's crazy. drugs that are lethal in the single microgram range can not be safely handled outside of an actual laboratory with rigiorous safety standards and techniques.

It doesn't matter what form it reaches the end user in when every step of the production process has the potential for invisible lethal mistakes due to the slightest lapse of attention or proceedure- and that assumes the original dosage proceedure was designed correctly.

</comment></comment></comment></comment></comment><comment><AUTHOR> _But it is likely she was getting the pills from Mexican cartels using ingredients from labs in China where production of fentanyl's ingredients is legal._

If ingredients for fentanyl originates from China, are the chinese abusing it like we do here?

<comment><USER4> With the rise of the middle class in China, illicit drug usage has risen along with it.

[http://www.dw.com/en/china-fighting-uphill-battle-in-war- on-...](http://www.dw.com/en/china-fighting-uphill-battle-in-war-on- drugs/a-19072445)</comment></comment>


Haskell Luminary Simon Peyton Jones to be Knighted - <AUTHOR> https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/269031/New-Year-Honours-2014-PM-list.pdf

<comment><USER2> The words Simon, Peyton and Jones are in this document, but not in that order.

<comment><USER3> They appear in that order, but with many other words between.

</comment></comment><comment><USER4> His name is not in the linked document.

<comment><USER5> There's probably a Monad joke here somewhere.

<comment><USER3> More likely a laziness joke.</comment></comment></comment>


Bin Ladin's Bookshelf - <AUTHOR> http://www.odni.gov/index.php/resources/bin-laden-bookshelf

<comment><USER2> Does anyone else think this declassification is a response to Seymour Hersch's LRB article about how the official story about ObL's killing is false?

I mean, if the US government can declassify part of bin Laden's bookshelf, that means that SEAL TEAM SIX actually did recover piles of docs and disks from Abottabad. Hey, Hersch is wrong!

How can this revelation be taken at face value? How can it be verified?</comment>


In-N-Out sues startup DoorDash, says burger delivery is a trademark violation - <AUTHOR> http://arstechnica.com/tech-policy/2015/11/in-n-out-sues-startup-doordash-says-burger-delivery-is-a-trademark-violation/ <comment><USER2> There's some more discussion here: [https://news.ycombinator.com/item?id=10551312](https://news.ycombinator.com/item?id=10551312)

</comment><comment><USER3> IMNAL, but it seems that In-N-Out is correct here. There are a couple of exceptions [1] in trademark law for using logos without permission:

1\. your use is for informational or editorial purposes (for instance, you use the trademark as part of an article or story)

2\. your use is part of accurate comparative product statements.

That being said, there's nothing stopping DoorDash from buying food from In-N- Out and delivering it to people. They just can't use the logo.

[1]: [http://www.nolo.com/legal-encyclopedia/when-you-need- permiss...](http://www.nolo.com/legal-encyclopedia/when-you-need-permission- use-trademarks.html)

<comment><USER4> > That being said, there's nothing stopping DoorDash from buying food from In- > N-Out and delivering it to people. They just can't use the logo.

If DoorDash is buying food and selling it to customers, then there are two areas where I can see problems, aside from the trademark issue:

(1) Storing, transporting, and selling food to customers is fairly regulated and requires inspection and permits. Does DoorDash have these?

(2) Even if DoorDash was legally permitted to _sell_ food at retail, the places DoorDash is getting food from are themselves in the retail food trade but not generally in the wholesale trade; if DoorDash is a reseller, then selling _to_ DoorDash is wholesale food trade, which is regulated differently, and by different agencies. The places DoorDash is _buying_ food are, one would expect, generally _not_ properly permitted to _sell_ to resellers.

(IIRC, normal restaurant delivery services are contracted with the restaurants, which not only handles trademark issues, but also structures the transaction as a sale by the restaurant to the consumer -- where the delivery service may act as a contracted payment intermediary -- with the delivery service then being paid by the restaurant for delivering the food to the customer.)

<comment><USER5> _Storing, transporting, and selling food to customers is fairly regulated and requires inspection and permits. Does DoorDash have these?_

The question is, do the folks who actually perform the deliveries?

DD is using the same trick Uber uses: they hire drivers but classify them as "contractors", which conveniently abstracts all the risk away from DD. So, just like Uber, if there are issues with transport and so forth, it's the driver's problem.

Of course, as with Uber, this is probably an illegal violation of federal labor regulations, as the employees are misclassified, and so they're likely to get nailed in a class action lawsuit, but...

 _the places DoorDash is getting food from are themselves in the retail food trade but not generally in the wholesale trade_

See above. I'm not sure your characterization, here, actually represents how DD legally does business.

<comment><USER4> > DD is using the same trick Uber uses: they hire drivers but classify them as > "contractors", which conveniently abstracts all the risk away from DD. If > there are issues with transport and so forth, it's the driver's problem.

Its worth noting that that trick hasn't been completely legally successful for Uber, and even if the employer/contractor distinction breaks in DD's favor, that doesn't necessarily mean that the contractor and not DD is on the hook for all the food sales and distribution rules.

And, even if it does, that doesn't really solve the question of the legality of the operation, just whether it is DD or its deliverers whose actions would be prohibited by the non-trademark rules. But if DD deliverers were to start being targeted for enforcement actions, it would rapidly make it harder for DD to get deliverers.

</comment></comment></comment></comment><comment><USER6> When I worked at TaskRabbit I made an In-N-Out delivery site ([https://news.ycombinator.com/item?id=4306834](https://news.ycombinator.com/item?id=4306834)). It ran for a week or two before In-N-Out got wise and sent a C&D. We found out at the time that they already had a long history of fighting delivery services.

It starts to bring up questions of personal liberty... can I hire someone (TaskRabbit, DoorDash) to do something on my behalf (buy In-N-Out), and act as my agent? And does In-N-Out have any basis for preventing me from doing that?

<comment><USER7> Also corporate liberty. Does In-N-Out have the right to refuse to sell to DoorDash couriers?

<comment><USER8> Yes.

Assuming it's only because they are doordash couriers, and not for any protected reason (race, gender, etc. In CA, even unconventional dress is protected).

Note, however, that if companies conspired together to refuse service to doordash couriers, that would be an antitrust violation known as "concerted refusal to deal".

<comment><USER9> I agree, but it would probably only be an antitrust issue if they refused to deal with DoorDash _specifcally_ ; if they maintained a clearing house for blocking _everyone_ who resold their goods without permission, that would probably be okay, right?

At the same time, good luck trying to determine which orders are DoorDash...

</comment></comment></comment></comment><comment> o0-0o Look, anyone that has every been to in-n-out, or any other fresh burger place, knows that the food tastes worse after a few minutes. why would in-n-out want there food delivered, when it will arrive in a poor state. obviously, in-n-out wants their food to be the best. delivered fries and burgers are not that great.

</comment><comment><AUTHOR> >In-N-Out attorneys claim that DoorDash uses an "Imitation Logo" of In-N-Out on its website.

The logos look nothing alike.

<comment><USER10> at the bottom of the site is a bunch of logos of the companies they buy from - the in n out logo used to be there

</comment></comment><comment><USER11> _Lawyers for In-N-Out say DoorDash 's delivery vehicles aren't compliant with the California Retail Food Code, and In-N-Out would never authorize DoorDash "or any other entity to deliver its food products to consumers without the necessary food handling licenses and food safety procedures in place."_

This, to me, seems like a valid concern. The folks at In-N-Out take the freshness of their food very seriously. If someone gets sick from an In-N-Out burger delivered by DoorDash, it's not unreasonable to assume this will have negative consequences for In-N-Out's reputation, not just DoorDash's.

Related: How is DoorDash getting away with delivering food and not complying with California's retail food code? That seems like a really bad idea.

</comment><comment><USER12> Okay, replace it with a note: "We tried to deliver In-n-Out, but they sued us. We're happy to deliver burgers from their competitor, $name!"

</comment><comment><USER13> This at first seems frivolous but after considering it I have to side with In- N-Out. Consumers may think this company is an authorized/official delivery service for In-N-Out, and if In-N-Out can't be certain of the quality of the service that's going to possibly reflect badly on them.

</comment><comment><USER14> When I first moved to the west coast, I was lead to believe that In-N-Out was actually good. Instead, I paid a lot of money for ~McDonald's quality food, and it took longer to get it.

Now I'm to believe people want this delivered? I supposed if you really needed to squeeze the last bit of edibility out of the food, sure, but I feel like the doordash premium makes this a fool's game.

<comment><USER15> "~McDonald's quality"?? If you mean within an order of magnitude, then I suppose yes. Neither is the French Laundry. For me In-N-Out is clearly superior. In fact, I use them vs McDonalds as an example to show my kids what happens when Wall St. gets in charge of a business. One presumes that a long time ago McDonalds did make food of equal quality to In-n-Out but decades of squeezing out that extra 0.1% of profit margin every month has an effect.

</comment></comment><comment><USER16> The short term profits were not worth what this lawsuit will cost them.

</comment><comment><USER17> Interesting way to get DoorDash to negotiate a favorable deal with In-N-Out.

<comment><USER16> I don't think that's the case.</comment></comment>


A directory of Netflix's "secret" categories - <AUTHOR> http://netflixcodes.me/ <comment><USER2> It would be nice if Netflix made it easier to browse content rather than choosing what categories to display and show to you.

It can get stuck thinking your really like a genre, and the recommendation engine can penalize you too much for too many likes or dislikes.

Now that the website is a bit more focused towards streaming-on-computer it's somewhat harder to browse and prepare a queue.

It feels that some content is cheaper to stream and it wants to present that content first, and also that they don't really want you to be aware of the size of the catalog either.

Tempting to go back to DVD plan for a while, really, which I would do if the US Post Office was remotely reliable. If only there was a way to rent-stream BlueRay/DVD ISOs securely to a Netflix app, and have their whole catalog legally available and not bifurcated into streaming and non-streaming, that would be really cool.

<comment><USER3> > It would be nice if Netflix made it easier to browse content ...

It would be even better if they fixed recommendations. If you do not use a web browser - ie use Roku, Chromecast, Android etc - then you cannot mark something as "not interested". So it keeps showing you the same thing over and over again, that you do not want to watch. Makes the service seem dumb and hostile. Don't get me started on them showing you stuff you already watched and don't need in the prime positions for recommendations - it is already watched.

Even more bizarre is how they predict how many stars you'll give something, which seems fairly good. And then go ahead and recommend items with few predicted stars.

I'm almost convinced that all their developers only use desktops and browsers, so they don't even realise what they do to those on other platforms.

<comment><USER4> > Even more bizarre is how they predict how many stars you'll give something, > which seems fairly good. _And then go ahead and recommend items with few > predicted stars_

To play the devils' advocate

* It's good for the user because their algorithm is not perfect and you might actually enjoy the 'few predicted stars' movie

* It's good for the algorithm because it allows fine-tuning in the cases of false-negatives and adds more data points

* having only high predicted stars in your list will probably move your Overton window on what's good/bad.

<comment><USER3> There is no need for a devil's advocate argument - having some diversity in recommendations is good for many reasons. But they they need to start by getting the base recommendations done well, and then mixing in the diversity. Sadly they fail dismally at the former.

</comment></comment></comment></comment><comment><USER5> It'd be nice if these categories weren't hidden, but at this point, the Netflix UI has gotten so useless that if the service was a little more expensive, it wouldn't be worth the price. Basic UI features that I'd expect from even an alpha quality service like filtering by star rating simply don't exist. Up until today and this post, proper categories did not exist. The whole Netflix UI experience has consisted of scrolling through endless lists of garbage to occasionally find one or two interesting movies/shows. And when I say garbage, I really mean garbage: movies with one or two stars, deservingly so.

I understand that if Netflix allowed filtering by star rating they might only list a few hundred 4 and 5 star movies across the whole service, but it'd be best to let the consumer decide how to deal with that fact rather than hiding everything in a giant pile of shit. I find their star ratings to be very close to accurate and this is the strength of the service. Unfortunately, their discovery UI is so horrific, it negates any strength Netflix has otherwise. If I know what I want to watch, Netflix is great, otherwise I prepare for half an hour of scrolling the same bullshit list of crap looking for anything decent and ultimately giving up.

<comment><USER6> Not sure if I'm crazy here, but I thought that the star ratings they show on the UI are their prediction of how much __you __will like the movie (i.e., they think you will give this movie 2 stars).

Anyone know?

</comment></comment><comment><USER7> The best shows are those that don't fit a particular category, or that grow to move between categories. Lots of great british TV bounces between comedy and drama (sherlock, cuffs). Some American shows cannot be pinned to a specific age range (simpsons). I still laugh when I see TopGear listed as "informational/other" by my cable company.

Also ... (i just noticed)

Australian Movies 5230 Belgian Movies 262 Korean Movies 5685 Latin American Movies 1613 Middle Eastern Movies 5875 New Zealand Movies

No Canada? No Canada comedy, no Canada movies, nothing? Belgian but not Canadian? Look to the end of your favorite shows. Look for the "Canadian film tax credit" statement before saying there aren't any canadian shows.

<comment><USER8> Maybe Netflix is claiming Trailer Park Boys now. That is totally Canadian. It's not a rocket appliance.

<comment><USER9> Wasn't Red Green on Netflix at one point, too?

<comment><USER10> I can't remember, but it's all on youtube now: [https://www.youtube.com/user/RedGreenTV](https://www.youtube.com/user/RedGreenTV)

<comment><USER11> Well, thank you for that. Growing up in Michigan, we had a bit of Canadian cross-over stuff [1], and I saw quite a bit of that show back in the era before on-demand. We never really had cable. Definitely some good hacker-esque skits in there, though I never felt the shows as a whole quite gelled in their overarching plots.

[1]: Double the Olympics coverage being the best. Curling is overmocked. It is mockable, yes, but it is overmocked.

<comment><USER12> In the... 2010, it was, Olympic games, NBC, the official broadcaster in the U.S., had so "sliced and diced" its presentation that I found its main coverage unwatchable. However, on one of its lesser affiliates, it was carrying... "second or third tier", per its judgement, sports coverage largely intact.

One particular item on it, that I ran across just by chance channel-surfing, was coverage of the women's curling. Complete games, quietly but informatively commentated. This introduced me to curling (beyond a passing "stones on ice" familiarity), and I ended up really enjoying it. To boot, it came down to Canada versus Sweden in a rather exciting set of rounds of elimination.

Some of it can be fairly parochial and/or simple, but the CBC et al. also put out some pretty good stuff. Including items that don't try to be more than they are, but do an excellent job at that.

Hopefully, under Trudeau et al., they will be released from the manufactured chokehold that has been squeezing the life out of them. And, any force that cuts down crap such as the ueber-commercialization of the Olympics, I welcome.

<comment><USER13> I started watching curling during the 2014 games and learned to love it. Haven't watched it since, but I'm definitely looking forward to 2018!

PS: Completely disagree with your assessment of the CBC and their operation under Harper's premiership, but such is life. Just wanted it noted.

<comment><USER12> Well, I'm not too familiar with the CBC. And I hear more of the radio side than I see the TV side. Where, I seem to recall similar budget restrictions, personnel jiggering, et al. lately as has been attempted with PBS, NPR, etc. in the U.S.

But, maybe my off-the-cuff impression is wrong.

Regardless, cheers!

P.S. Perhaps I should further qualify that "not too familiar." Maybe I'm nonetheless more familiar with it than many in the U.S.

Anyway, I have really enjoyed some of what they put out. Older, but perhaps one of the best examples I can think of, right now: The 1980's adaptations of Lucy Maud Montgomery's "Anne of Green Gables" and "Anne of Avonlea".

[https://en.wikipedia.org/wiki/Anne_of_Green_Gables_%281985_f...](https://en.wikipedia.org/wiki/Anne_of_Green_Gables_%281985_film%29)

Every summer, I'm close enough to the border to get one of their channels for a week. And I enjoy having a look in on the news and Canadian culture, from their perspective.

I support that notion, that countries have a national broadcasting service. Particularly with the dominance of U.S. and "generic" commercial media, a place on the airwaves or wire that provides for a more prominent presentation of domestic culture, among other things.

Oh, and I'll add, some of the First Nations programming I've happened to catch has been pretty interesting, too.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I don't understand Netflix's aversion to letting me find shows I'm interested in. It's so hard to just browse the full catalog, even by really general categories like "Action" or "Comedy". When I pull up the Netflix app on my console all I get are 20-25 movies in each category, plus my Queue and a few recommendations.

<comment><USER14> It seems that they're trying to prevent users from realizing how light their catalog really is.

<comment><USER15> I dunno...I find the selection to easily surpass what I'd find available on basic cable on any given day. If it cost $30-50/mo (or whatever they charge for a pretty basic cable package these days) I'd reconsider but for under $10/mo I find it to fill that gap of "something to flick through and find something I wouldn't mind watching" quite nicely.

<comment><USER14> Don't get me wrong. I'm a subscriber and will likely continue to be. I agree that Netflix is a better deal for the consumer than most cable packages, but they're constantly competing for content with Hulu, Amazon, HBO, YouTube, etc.

<comment><USER9> YouTube and Twitch have grown to become about 90% of my video consumption. The increasingly cheap pro-sumer quality A/V equipment and software have made the production values go up significantly in recent years, making the regular production of high-quality shows much more viable.

<comment><USER14> Any recommendations? :)

<comment><USER9> Oh it's really all about personal preference. I mostly subscribe to tech news & reviews and "let's play" type gaming content, along with some cooking/woodworking/metalworking stuff. Off the top of my head I mostly watch MKBHD, Tested, Cinemassacre, CynicalBrit, Lazy Game Reviews, Frank Howarth, and enough smaller channels to fill in the gaps.

Edit: Oh and LinusTechTips, I can't believe how long it took me to get on board with that channel.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Most of these categories _aren 't_ 'hidden'.

If you select one of the main genres on Netflix, almost all of them will then have a "sub-genre" picker which, as far as I can tell, includes most if not all of these.

Sure, this site lets you see them all at once without having to choose a parent genre first, but it doesn't seem like that big of deal.

<comment><USER17> It is easier to browse this list than it is to browse a Netflix genre...

</comment></comment><comment><USER18> There's a whole lot more than the OP lists. Things like [http://www.netflix.com/browse/genre/5614](http://www.netflix.com/browse/genre/5614) "Movies starring Kyle MacLachlan" and [http://www.netflix.com/browse/genre/5612](http://www.netflix.com/browse/genre/5612) "Comedies from the 1920s".

</comment><comment><USER19> | Satanic Stories 6998

What a missed opportunity.

</comment><comment><USER20> many more:

[http://ogres-crypt.com/public/NetFlix-Streaming-Genres2.html](http://ogres- crypt.com/public/NetFlix-Streaming-Genres2.html)

</comment><comment><USER21> I've always longed for better filtering/sorting options on the home screen. Currently I believe you have to go into one of the category screens to have sorting options.

My other pet peeve with Netflix is the duplication of content across several of the home screen categories. Some are almost identical at times, just in different orders.

<comment><USER22> I would love to sort on rating, and I've never seen a way to do that. It would be the single biggest thing that would increase my use of Netflix.

<comment><USER23> Yep, I dream of setting a ">200 ratings under 4 stars" type filter. Would make finding new films much easier.

</comment></comment></comment><comment><USER24> Just by guessing a couple numbers I found more: Goofy Crime Movies: [http://www.netflix.com/browse/genre/10001](http://www.netflix.com/browse/genre/10001)

<comment><USER25> Nice. I'm surprised someone hasn't setup a script to enumerate them all. The ids all seem less than 6 digits

</comment></comment><comment><USER26> Netflix Secret Categories are also available in Simkl for Netflix Chrome extension [https://chrome.google.com/webstore/detail/simkl-for- netflix-...](https://chrome.google.com/webstore/detail/simkl-for-netflix-hulu- cr/dbpjfmehfpcgmlpfnfilcnhbckmecmca) with random Netflix search and watched\to watch filters

</comment><comment><USER27> Can someone explain what this is? Non-netflix user here.

<comment><USER28> As you can see from other comments here, the Netflix UI is quite bad. This is a list of categories that many people feel the UI hides from them, in that they're hard to find. If you use Netflix on your computer you can use this list to access those sub-categories.

</comment></comment><comment><USER29> I got existed for: "Dark Comedies 869". Man its difficult to find these kinds of movies. Unfortunately there was not 869 of them but just 6. I have seen them all. One of them was amazing; "Sightseers" if anyone wants a movie tip.

<comment><USER30> I get 28 results for Dark Comedies. Do you want me to share the list with you?

<comment><USER31> probably different country. you can use moreflicks.com to see what country has what show/movie

</comment></comment></comment><comment><USER32> Nice! I've missed this since Netflix started to dumb-down the list of categories displayed for a movie a while back.

</comment><comment><USER33> Eh, anyone here by chance who knows how to watch the Avengers movies and the Men in Black movies in Germany? They don't appear in the catalog, but searching shows "Based on The Avengers" and the other MCU films, for example.

<comment><USER34> Check Reddit Netflix subreddit there are a bunch of ways of getting the full catalog there is a neat software which makes it seamless although a regular vpn is just as good

</comment></comment><comment><USER35> Time for a Chrome extension.

</comment><comment><USER36> Should have removed the ?ref=producthunt , since this posted on Hacker News.

<comment><USER37> Good point. Done.</comment></comment>


Html 2 pdf rendering with phantomjs - <AUTHOR> http://big-elephants.com/2012-12/pdf-rendering-with-phantomjs/

<comment><USER2> Nice write up... I think one thing to keep in mind is that generating a PDF this way is great but is making a browser based request - so it's good to avoid doing this within the scope of an existing request. When possible, put the generation into a background queue and email the results or poll for the result... At least if your in unicorn rails stack</comment>


The Bitter Legacy of Mickey Mouse - <AUTHOR> http://www.theamericanconservative.com/the-bitter-legacy-of-mickey-mouse/

<comment><USER2> Unz's archive of periodicals (<http://www.unz.org>) is really something. Its UI looks archaic, but the technology works surprisingly well and a tremendous wealth of content is hosted there. The whole thing is a significant public service.

One wishes more rich people turned into people like Ron Unz. He continues to impress as an uncategorizable scholar and journalist, working on what interests him and uncovering significant (if controversial) things. And _TAC_ is one of the best periodicals of its type.

<comment><USER3> Could you say more about TAC? I'd love to find more US conservative voices (as opposed to, say, radical reactionaries, theocrats, or cheerleaders for Team Republican) so that I can better balance my media input.

<comment><USER2> With respect to anigbrowl and [deleted], who probably know more than I do, I think "paleoconservative" might not be the best label for _TAC_ , even though some of their authors might use it. They're ideologically pretty loosely formed, and as a group give me the sense of something new evolving rather than of something old returning. What I have found them consistently to be is (1) anti-imperialist (or anti-interventionist if you don't believe there's an empire) and (2) intelligent. A few of their junior bloggers are too prolific to be on average very good. But people like Daniel Larison, Dan McCarthy, and Scott McConnell write consistently thoughtful pieces. They also publish serious authors that get little attention elsewhere, like Andrew Bacevich. Then there are Unz's own pieces which keep getting more interesting. But those are an off-to-the-side eclectic sort of thing.

They also stand outside MSM consensus in a way that has genuine integrity. Consider Eric Margolis' cover story from their inaugural issue (Oct 2002), a blistering critique of the impending Iraq War that got almost everything right. Not everything—in retrospect, he arguably overemphasized oil—but the piece was a truth-speaking deviation from the groupthink and propaganda that dominated that period. [http://www.theamericanconservative.com/articles/iraq- invasio...](http://www.theamericanconservative.com/articles/iraq-invasion-the- road-to-folly/). I think most people would be pretty proud now to have launched a magazine with that in 2002.

Basically, they've established themselves as freethinking conservatives who have nothing to do either with the decadence of party conservatism or the fanaticism of the right-wing base. That's what makes them valuable and worth reading—such voices are needed. Not that I agree with all they say, of course.

(By the way, if you have time for podcast-type thingies, I've found a couple of other sources that are surprisingly good. But I'll save that for some other off-topic thread :) Or you're welcome to email me if you'd like to discuss any of this offline.)

</comment></comment></comment><comment><USER4> I wish we could consider different terms for the different aspects of copyright. Copyright is not a single right--it is a bundle of rights. In the US (whose law I will use for all of this comment), for instance, it includes:

• The rights to make and distribute copies,

• The rights to make and distribute derivative works,

• The rights to publicly perform and display works.

The power to even have Federal copyright law comes from this grant of power in the Constitution:

       To promote the Progress of Science and useful Arts, by securing
       for limited Times to Authors and Inventors the exclusive Right
       to their respective Writings and Discoveries.

That gives a purpose for the power (promoting science--which is used in its archaic meaning, which means knowledge, rather than its modern meaning, which is what once was called natural philosophy), and also the mechanism by which it is to be exercised (giving authors a limited monopoly).

Shorter terms promote progress by making works more widely available, but longer terms ALSO promote progress by letting authors make more money which improves things on the supply side, so setting the term requires balancing these, and I see no reason that the optimal setting for, say, copying should be expected to be the same as the optimal setting for, say, making derivative works.

I also see no reason the term needs to be the same for different types of works. Music, literature, movies, and computer software are very different so why would we expect that a term that is good for music when it comes to balancing wide distribution vs. author incentive to also be good for literature, moves, and software?

<comment><USER5> > I also see no reason the term needs to be the same for different types of > works. Music, literature, movies, and computer software are very different > so why would we expect that a term that is good for music when it comes to > balancing wide distribution vs. author incentive to also be good for > literature, moves, and software?

The problem is that attempting to categorize works might be futile. Eg. chiptunes (a form of music) originally were software written for the sound chips. Would they fall under "software" or "music" category?

</comment></comment><comment><USER6> Why not follow the same system as domains? Allow for yearly renewal of copyrights. Failure to renew moves the item into the public doman regardless if it has been 2 or 200 years.

The net-effect could be interesting; articles would move into the public domain fairly rapidly (why pay to maintain the copyright of an article from fifteen years ago about Y2K?) and established bodies of work with huge corporate incentives would stay copyrighted for decades.

Disney want's to keep their mouse until the sun burns out and I couldn't care less. All these other works that are now in legal limbo because of that is what bothers me.

<comment><USER7> I have an idea myself to solve this;

Unregistered works, are granted 10 years of protection, then either must be registered or become public domain.

For individuals, After registration, Artist Lifetime, then renewal every 5 years thereafter.

For corporate owned/created work, registration good for 30 years, and renewal every 5 years thereafter. Possibly, work must be kept in commercial availability somewhere in the 5 year cycle or you potentially could be challenged for the right to renew.

I like this system because it solves something I see as a serous problem, abandoned works.

<comment><USER8> Before Mickey mouse and similar ilk came along, copyright was 7 years. 7.

No copyright which includes anyone's lifetime (and most copyrights are held by corporations anyway) can be deemed reasonable in an age where information and culture moves 100s of times faster than it did when the term was 7 years.

<comment><USER3> I think individual copyright is reasonable for one's lifetime. I'd be ticked if somebody used my photos from 10 years ago for profit.

Corporate or collective works, though, I agree. I think a 7-year expiration would be fine. I expect that approximately zero investment decisions on new movies or TV shows turn on the money they expect to make in year 8. And even without copyright, modern studios are adept at producing new versions and higher-end editions that would get new 7-year terms.

<comment><USER9> > I think individual copyright is reasonable for one's lifetime.

What is individual copyright? It becomes debased if you are saying it cannot be sold to corporations. Lifetime is a ridiculous capricious standard.

<comment><USER3> I'm ok with saying it can't be sold. Note that a lot of writers, for example, don't sell copyright outright. They instead license somebody to be, say, the US hardback and paperback publisher for their work.

A lifetime standard is only as capricious as life itself. Given that the laws are made to serve human needs, I'm ok with it drawing a distinction between serving living ones and dead ones.

</comment></comment></comment></comment></comment></comment><comment><USER10> Disney's stance on this is incredible when you consider that they have profitted greatly on the back of public domain works.

<comment><USER11> It makes sense in that context, though. Clearly, Disney knows what profit can be enjoyed from a public domain work, and wouldn't want others to profit on the back of their property. Besides, Disney is a red harring in the article - because of Disney's desire to protect their most iconic character, the author can't read some old magazines online.

</comment></comment><comment><USER12> I've thought that all intellectual properties (patents, trademarks, copyrights) should pay property tax, else it goes into the public domain. Values are assessed just as with real estate. Mickey Mouse will end up costing more than my crude sketch. But that may change if my character starts to become popular.

Basically, if you are making money on the property, you will be able to afford the tax. If the property is valueless, then you stop paying the tax, and it goes into the public domain.

<comment><USER13> While nice in theory, there's no way I can see that working in practice. With real property there are comparable sales and the like, which can be reasonably accurate - if another townhouse in the same complex sold for $x one month, $x is pretty good estimate of the other values in the complex. Even this gets tricky when you get out to a more rural area like wear I live, and the only other sales are significantly larger or smaller houses.

I'm not even sure how you could do comparable sales for intellectual property. Yeah, Disney's publicly traded, but imagine an trying to assess the value of an asset owned by a privately held company that doesn't have to disclose any financial information.

And even if you could assess values, look at the mess of property taxes in California with Prop. 13.

<comment><USER14> I think you could address that if you pay taxes based on a declared worth $X with the provision that anyone can exercise the option to buy the intellectual property from you for $X or you can reassess at a higher price/move your IP to the public domain.

The problem with this is that the creators of marketable and valuable IP could not exercise creative control of their IP without paying a tax on the market value of their IP even if they don't make money on it. Not sure about that.

I'm not buying into this idea at all, just adding a perspective.

<comment><USER13> That might work for the likes of disney, but seems like it could be really unfair to smaller copyright holders. Suppose I write a successful novel, and that the "IP tax" is 1%. If I value it at $10m, my yearly tax is going to be untenable at $100k, but that $10m is a rounding error for a large studio that wants the movie rights. Yeah, I realize you could tweak the numbers, but I think it's a valid objection.

One approach I have heard that might work is that you get some amount of time of free copyright (20, 30, 50 years), and then have an increasing copyright- registration fee for each year or extension period beyond that, up to some maximum term. It could either increase linearly or exponentially, or someplace in between. I'm not entirely sure it would work, but I think the idea has some merit.

</comment></comment></comment></comment><comment><USER15> Something I was just reminded of. Now that Disney owns StarWars, I wonder what will happen to fan videos? Will they pursue them aggressively?

</comment><comment><USER16> The cynic in me thinks the current system is acceptable. Everything is copyrighted forever and everything is freely available on The Pirate Bay anyway.

<comment><USER17> I don't like the situation because authors doesn't get an honest compensation for their work and you can't easily create new works based on old copyrighted oeuvre.

I think it would be in the interest of the public that you have a more limited in time copyright and after a certain delay an obligation to let other creator reuse assets with a compensation schema that allows new creations.</comment></comment>


Intel 'Skylake' launch schedule revealed: CPUs to arrive in August - <AUTHOR> http://www.kitguru.net/components/cpu/anton-shilov/complete-intel-skylake-launch-schedule-revealed-chips-to-be-showcased-in-august/

<comment><USER2> Another step closer to the point where CPUs and GPUs will be unified.

32 SIMD registers holding 512 bits each. Ability to process 1024 bits (128 bytes, and even more in some scenarios) in a _single_ clock cycle. Sounds more and more like a GPU to me.</comment>


Google pulling China CNNIC CA from its products - <AUTHOR> http://googleonlinesecurity.blogspot.com/2015/03/maintaining-digital-certificate-security.html?m=1 <comment><USER2> This is what should happen when a CA does something insecure. Kick them out and make an example out of them. If you don't the whole system is worthless.

Ex: [http://en.wikipedia.org/wiki/Comodo_Group#2011_breach_incide...](http://en.wikipedia.org/wiki/Comodo_Group#2011_breach_incident) Nothing happened after this breach, which was a shame.

<comment><USER3> > If you don't the whole system is worthless.

The whole system is worthless and it should be replaced with something more like bitcoin. I don't really trust any certificate issuer more than I trust self issued certificate.

<comment><USER4> >it should be replaced with something more like bitcoin.

What does that even mean?

<comment><USER3> Basically it means that I think that hierarchical trust doesn't work for me. Instead of bank buying certificate from some authority I'm supposed to trust I'd rather infer that this certificate is associated with this domain because it's written in some form of blockchain, unalterable and verified by multiple parties.

Honestly I have no idea how the current system is purported to work. And I just don't know what certificate is supposed to prove? That someone at some point in time had 100$ to spend on a cert? How's that more secure than self signed cert?

Why browser warns about self-signed and not about others? All thing seems to me to be more of a security theatre and money making scheme than actual trust system that reflects reality in any way.

<comment><USER5> because web-of-trust-models worked so great for PGP/GPG. In theory that's great, but how can I confirm that the cert in the chain is indeed for google.com. Because it's trusted by chrome which I downloaded from google.com (or at least a machine pretending to be google.com) or because my computer- illiterate friends trust it? Or because my OS trusts that cert?

I agree that the current system is broken, but I fail to see how a distributed system magically fixes this, most notably the issue of bootstrapping trust. I foresee that the distributed model moves to a more centralized model where we trust apple, microsoft, ubuntu.

<comment><USER6> There's lots of newer research on trust-based systems that could be applicable here, e.g. a game-theoretic approach where entities are gauged based on ratings over repeated transactions. Think iterated prisoner's dilemma crossed with PageRank, which effectively wards against many types of collusion including simple sybil attacks. Most of it hasn't been validated in the real world on any scale, but I believe it is possible to do quite a bit better than we have seen - the only web-of-trust stuff I've seen in practice is ancient compared to the state of research.

One outstanding problem that comes to mind is certificate revocation when you have lost control of the private keys. I think a multi-sig solution could probably mitigate this to a fair extent, so you still have some level of pseudo-trust between entities and a way to effectively call someone up and say, "hey, I screwed up and need to kill this thing".

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> It's a short update, but I can make it shorter:

After a short, limited grace period, Google won't honor the recently compromised Chinese CNNIC CA cert anymore, and won't reconsider until they implement Certificate Transparency.

</comment><comment><USER7> Good riddance.

We really need a "zero tolerance" system for CAs: As soon as you fuck up, you're out. There has been too much forgiveness and too little enforcement so far. Browser vendors, especially those with deep pockets such as Google, Apple, and Microsoft, should not be afraid to leverage their influence to make rogue CAs go out of business. Seriously, there are too many CAs already. 90% of them need to go bankrupt asap.

We also need some way to restrict what certificates "less trustworthy" CAs can sign. Even if CNNIC is one day reinstated, I wouldn't want them to sign any certificate for any domain that doesn't end with .cn. Ditto for various other government-sponsored CAs, which my browser also seems to trust for whatever reason. Even if TLS as we know it has no mechanism to enforce such restrictions, nothing stops browsers from doing it on their own.

<comment><USER8> > As soon as you fuck up, you're out.

You would have no CA's then. I love when people criticize others without offering a anything in return.

<comment><USER9> No, GP actually has a point. Once you do things like this, you're out. Once you're out, you become a nobody.

Of course, you can reapply to get in (haha, good luck getting a response from Mozilla before a couple of years) but you have to start from scratch all over again. This puts a tangible cost to shenanigans. I highly doubt Verisign would be caught making the mistake these guys did.

<comment><USER10> Not a good comparison technically, but everyone makes mistakes. And the 2010 event was promulgated by "untrustworthy" employees. The system is risky, and change will have to come sooner or later.

[http://www.reuters.com/article/2012/02/02/us-hacking- verisig...](http://www.reuters.com/article/2012/02/02/us-hacking-verisign- idUSTRE8110Z820120202)

<comment><USER11> CAs are supposed to be in the business of trust. We are supposed to hold them to the highest standard of machine trust. If they screw up and fix the error in a matter of hours or days... alright. But CAs who charge money for making certificates need to earn our dollars.

Sure, everyone makes mistakes. And if you're in the business of trust, you find ways to uncover and correct those mistakes. Also, you insure against those mistakes, and some of that insurance buys another set of eyes.

</comment></comment></comment></comment></comment><comment><USER12> CNNIC has responded: [http://www1.cnnic.cn/AU/MediaC/Announcement/201504/t20150402...](http://www1.cnnic.cn/AU/MediaC/Announcement/201504/t20150402_52049.htm)

> 1\. The decision that Google has made is unacceptable and unintelligible to > CNNIC, and meanwhile CNNIC sincerely urge that Google would take users' > rights and interests into full consideration.

> 2\. For the users that CNNIC has already issued the certificates to, we > guarantee that your lawful rights and interests will not be affected.

<comment><USER13> > The decision that Google has made is unacceptable and unintelligible to > CNNIC

Deciding to not let a company, with the ability to MITM users worldwide, that did not have systems in place to avoid misuse, continue to have that ability?

They also seem to be under the conception that they're in a position to accept or not accept the outcome. That's now this works.

If only CNNIC took being a CA as seriously as they do writing angry press releases.

<comment><USER13> > That's now this works.

Correcting self: that's /not how/ this works.

</comment></comment></comment><comment><USER14> Glad to see this happening - I removed CNNIC from my machines back in Feb - [https://github.com/sammcj/delete-unknown-root- ca](https://github.com/sammcj/delete-unknown-root-ca)

<comment><USER15> Is there a readily accessible list of the CAs you're deleting? Ah, it's in the shell script itself, and there are just four of them. And this looks to be specific to Mac OS X only -- /System/Library/Keychains is _not_ a frequently encountered path on, say, Windows, Linux, or BSD (non-Mac) boxen.

How does this work, e.g., on systems which install root CAs from standard packages? I think you'll find you'll need to 1) re-run the script and 2) that you're not getting the benefit of _retaining_ the root but flagging it as _untrusted_.

I just posted on _flagging_ the CNNIC root as untrusted in Debian. That's better than _deleting_ the CA, as it should now show as _negative_ trust if I'm grokkign things properly.

<comment><USER14> As the readme says: 'Also removes any user trust settings for each certificate'.

It's not intended as patch or fix for the CA system which is broken by design - merely something that I was interested in trying.

</comment></comment></comment><comment><USER16> This is what I hoped would happen when we learned about the malicious intermediate: [https://news.ycombinator.com/item?id=9254899](https://news.ycombinator.com/item?id=9254899)

We need to send CAs a strong signal that the trust (and license to print money that comes along with it) we put into then hinges on them behaving properly. Making sure that their intermediaries do the same is obviously part of the deal.

We must make it very clear to CAs that hiding behind intermediaries is not an acceptable strategy to escape their responsibilities.

</comment><comment><USER17> Can't think of a better response than this.

I'm only mildly supportive of Certificate Transparency, but would definitely like it to "have its day in court." Hopefully CNNIC deploys CT and reapplies to Google for inclusion, but either way it will be interesting. I love it when things get put to the test.

<comment><USER18> > Hopefully CNNIC deploys CT

What are the odds they'll do this? I'd bet extremely high.

<comment><USER19> CNNIC is a joke, don't put any hope to them please.

<comment><USER20> No, it is not a joke. Seriously, it was one of the major manufacturers of malware (CNNIC中文上网, with rootkit included) in China.

<comment><USER19> Yes. But don't put hope to CNNIC as don't put hope to China government. They don't need google accept them because there are a lot companies provide browsers in China.

</comment></comment></comment></comment></comment><comment><USER21> From the original part: "MCS Holdings on the basis that MCS would only issue certificates for domains that they had registered"

I don't understand why this would be allowed. Like, doesn't this break the entire concept of a CA if the CA will allow third parties to issue certs? I understand the need for corp MITM but that's best done by pushing out your own CA. And I understand the desire for a company to have its own self-managed CA system that's publicly trusted. But that simply cannot require the CA to put any trust into the other company; there's gotta be technical measures. That's why I'm confused as to why it matters if an HSM was used or not. Can someone enlighten me on what's going on?

<comment><USER22> It's just an organizational decision. CNNIC is super trustworthy to a lot of people. It's so many people, in fact, that they can't possibly verify all of the sites these people want to visit. So instead of burdening CNNIC with verifying the identity of every single site that wants a cert that their users will trust, CNNIC will just verify some other CAs as being trustworthy enough to do the job.

Personally, I think I should trust the hardware or OS manufacturer to pick exactly who is trustworthy enough to certify websites, since I'm trusting them that my computer is doing what it looks like it's doing anyway.

<comment><USER23> > CNNIC is super trustworthy to a lot of people

No, CNNIC is not even trustworthy among Chinese Internet users.

CNNIC invented tons of rootkit adware and spyware. It has a very bad reputation. Google for 3721 中文网址 if you are interested

Although it claims to be a neutral non-profit organization, it does have multiple for-profit business lines.

In the past CNNIC belongs to China Academy of Science, but now it's just a puppet under ruling Party's control[1][2].

[1]: [http://en.wikipedia.org/wiki/Central_Leading_Group_for_Inter...](http://en.wikipedia.org/wiki/Central_Leading_Group_for_Internet_Security_and_Informatization)

[2]: News in Chinese [http://tech.gmw.cn/2014-12/27/content_14311910.htm](http://tech.gmw.cn/2014-12/27/content_14311910.htm)

<comment><USER24> > CNNIC is not even trustworthy among Chinese Internet users.

Oh? Then why did Firefox, Google, Microsoft, Apple, etc. trust their root certificate? I know hating on China is all the rage, but something isn't making sense here...

> Google for 3721 中文网址 if you are interested

Just did. Got nothing. Are you referring to [1]? I'm not seeing what that has to do with CNNIC.

1\. [https://en.wikipedia.org/wiki/Yahoo!_Assistant](https://en.wikipedia.org/wiki/Yahoo!_Assistant)

<comment><USER23> > Oh? Then why did Firefox, Google, Microsoft, Apple, etc. trust their root > certificate?

Mozilla no longer trust CNNIC.

[https://blog.mozilla.org/security/2015/04/02/distrusting- new...](https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic- certificates/)

<comment><USER24> Yes, hence my using the past tense. I do not see how "CNNIC is [not trustworthy]" is compatible with "Firefox, Google, Apple, and Microsoft trusted their certificates until MCS Holding screwed up some corporate network's https-interception implementation".

In particular, was there any evidence of any mis-deeds by the CNNIC before what MCS Holding did? Anything at all aside from "they are a Chinese and that is bad" FUD? Have they ever issued a certificate used to MITM the communications of political dissidents, for example?

</comment></comment></comment></comment></comment></comment><comment><USER25> MCS has a very sloppy response: [http://www.mcsholding.com/MCSResponse.aspx](http://www.mcsholding.com/MCSResponse.aspx)

<comment><USER26> Sloppy on multiple levels.

The poor English doesn't inspire a lot of confidence in the company. I realize the company is from an area of the world that is not generally English- speaking, but geez, to respond to something as serious as this surely you can run your blog response by at least one native speaker to sanity check it before posting it.

But worse than that is the story they are seemingly trying to sell is that this is one random dude's fuckup -- which may very well be true, but that this could happen as the result of one random dude's fuckup speaks volumes about lack of much-needed process to deal with this sort of certificate responsibility.

<comment><USER27> I think the main problem with giving it to someone else to sanity check is that if your own English isn't good, you'll have a hard time gauging someone else's English speaking skills.

I wouldn't be surprised if they did give it to someone who they thought spoke English well.

</comment></comment></comment><comment><USER28> Wonder if Mozilla will follow suit: [https://bugzilla.mozilla.org/show_bug.cgi?id=542689](https://bugzilla.mozilla.org/show_bug.cgi?id=542689)

<comment><USER29> The Mozilla root program currently has a similar plan proposed, with a final decision pending in the next day or so.

[https://groups.google.com/forum/#!topic/mozilla.dev.security...](https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/czwlDNbwHXM)

</comment></comment><comment><USER30> Why should we trust browser authors with their CA list (google, firefox, etc...)? PKI should be rethought because in its current form we are relying heavily on their trust. Sadly to the average user have no clue what's going on.

<comment><USER31> Read the root certificate inclusion policy of your vendors. In the end it comes down to how much you trust the vendor to implement the policy faithfully and whether you agree with the policy itself.

Google [https://www.chromium.org/Home/chromium-security/root-ca- poli...](https://www.chromium.org/Home/chromium-security/root-ca-policy)

Microsoft [http://social.technet.microsoft.com/wiki/contents/articles/3...](http://social.technet.microsoft.com/wiki/contents/articles/3281.introduction- to-the-microsoft-root-certificate-program.aspx)

Apple [http://www.apple.com/certificateauthority/ca_program.html](http://www.apple.com/certificateauthority/ca_program.html)

Mozilla [https://www.mozilla.org/en- US/about/governance/policies/secu...](https://www.mozilla.org/en- US/about/governance/policies/security-group/certs/policy/inclusion/)

From a cursory look Ubuntu seems to mirror Mozilla cert store.

<comment><USER30> I understand. But the fact that I need to trust the vendor and the CAs is a broken concept.

<comment><USER31> Yet it works with way over five nines confidence. Despite all its faults, the system works decently.

I would myself prefer DANE being used, because it's IMHO sounder technically, but we'll possibly have the same issue with registrars doing a sloppy job than we have with CA, so not sure that it would actually be a win...

<comment><USER32> DANE has its own issues though: by itself, even if you're using DNSSEC with it (as you ought to be), you're essentially shifting trust from CAs to registry operators, your DNS service provider, and whoever operates the root zone.

</comment></comment></comment></comment></comment><comment><USER33> I just had an epiphany , when thinking about what role are those big companies playing now in our democracy, in the most general sense.

I think what google is doing there is a kind of "fact checking" ( this text on this page is really coming from this site), which means they're playing the role of a media counter power (in the sense of judiciary power, political power, and media). What's funny is that they don't need google news to play that role. Only a browser and a security policy is enough.

<comment><USER34> Google is the single most important factor in modern democracy as information is power. Hence "Don't be evil."

</comment></comment><comment><USER15> Debian, Ubuntu, and derived systems can flag CNNIC )if they've installed the 'ca-certificates' package) as untrusted themselves using /etc/ca- certificate.conf:

[https://www.reddit.com/r/debian/comments/3167je/blacklisting...](https://www.reddit.com/r/debian/comments/3167je/blacklisting_ca_certs_cnnic_root_revoked_by_google/)

</comment><comment><USER35> We really need to clean up the CAs. Hopefully once the lets encrypt guys gets to be operational we can nuke the rest, in a similar way to how Chrome is sunsetting the old encryption standards.

</comment><comment><USER36> This is just an alarming sign that the entire SSL business is broken. It was exploited so many times by western agencies and also by criminals that it should be clear to everybody that this workflow is broken. This action from Google is an example of double standards. There are CAs from three letter friends in some of the tools we are using today so they can silently mitm attack your SSL traffic. I don't see Google rushing to fix the underlying problem and just trying to mess with China.

<comment><USER37> Re: 3 letter friends CAs, I believe it. Sort of have to do that, given their operating goal of being able to read everything at will. Its low-hanging fruit, and the only real reason to continue with such a centralized authority- based scheme is to support that type of thing.

<comment><USER36> Well, I would agree with you if this opportunity could not be exploited by malicious organizations.

</comment></comment></comment><comment><USER38> This is the right move. It had to escalate compared to ANSSI case, because back then the claim was "this is the last time".

<comment><USER39> Yea, they claimed that they were going to take years to comply with the BRs. They ended up limiting it to French TLDs. It seems that they are finally phasing out this CA now.

</comment></comment><comment><USER40> I've no idea about the business of Certificate Authorities. Are they non- profits (like other Internet infrastructure organisations, data centers etc) or corporations?

How much, financially, would this action by Google affect the CNNIC CA?

<comment><USER41> They are corporations. Their most important asset is trust, which they need to keep by not signing certificates that can be used for malicious purposes.

The action by Google will definately impact this CA. As soon as this root certificate is no longer trusted, all Chrome users will see big warnings as soon as they visit a website that has a SSL certificate that is signed by them. I don't know the exact market share of Chrome, but I have no doubt it is large enough to make current customers of CCNIC switch to a different CA.

</comment></comment><comment><USER42> What does this mean: "...nor do we believe the misissued certificates were used outside the limited scope of MCS Holdings' test network,..."

If the certificates were used only in a test (private?) network, how did Google find out?

<comment><USER21> I believe Chrome will report back when it finds an improperly issued certificate.

<comment> ryan-c [https://scotthelme.co.uk/hpkp-http-public-key- pinning/](https://scotthelme.co.uk/hpkp-http-public-key-pinning/)

Chrome also preloads HPKP information for many sites.

It's interesting to note that certificates signed by a locally installed CA (e.g. an org's MitM proxy CA) will be considered acceptable. If MCS had just made their own private root CA and deployed it to their machines there wouldn't have been an issue.

<comment><USER43> They weren't even trying to do that, is the saddest part. They were trying to be a real CA, but they weren't trying to MITM. (It's common practice for new / young CAs to chain their CA cert off a more established CA.)

They just, for some reason, decided that they wanted to store their cert on a Palo Alto Networks device that supported MITMing as a feature, and accidentally turned on MITM mode and plugged someone's laptop into it.

The intended use case of that feature on that device is in fact to hand it a private intermediate, not a publicly-trusted intermediate.

<comment><USER44> "accidentally".

Playing loose and fast with a CA key and installing it on random devices like this speaks volumes about their understanding and respect of the world wide CA system.

</comment></comment></comment></comment></comment><comment><USER45> Does this mean Chrome on iOS will reject these certs? It's a bit unclear. I know they have to use the Safari rendering engine but I'm curious if there are any other internals at play here.

<comment><USER43> I believe iOS lets you specify your own validation callback. (For instance, I think best practice is for a random app on iOS, that only connects to its own servers for an API, to manually pin the public key and a backup public key for the server or at best a handful of CAs, instead of trusting the entire set of root CAs.) I don't know how extensively Chrome is using that feature.

</comment></comment><comment><USER46> Well done! I hope Google would do the same when related to NSA and other 3 letters agencies.

when was the last time Google made headline of hn for its technology?

</comment><comment><USER47> Does anyone have a list of all typical root CAs and where they are issued from? Are there any other CAs that can be used in rogue ways?

I see a "Hongkong Post Root CA" which I assume can also be used this way?

</comment><comment><USER48> Thanks for the reminder to recheck my certs. I manually wiped CNNIC (among others) when the news first broke, and with today's Firefox update, I'll check again.

<comment><USER49> You can't just "wipe" a Root CA on Windows - you have to explicitly untrust it.

<comment><USER39> Open certmgr.msc and put the certificate into the "Untrusted Certificates" store.

<comment><USER50> I don't remember deleting it, but also can't find one that seems to be from CNNIC.

Does anyone keep a list of ones they personally like to mark as Untrusted, which doesn't break [too many] sites?

<comment><USER51> Windows downloads root certs just in time.

<comment><USER50> Yes, of course! So now I need to figure out how I can add a thumbprint to a Untrusted Cert store...

</comment></comment></comment></comment></comment></comment><comment><USER52> China versus Google. Let me get the popcorn.

</comment><comment><USER23> what about wosign?

<comment><USER53> I've distrusted the CNNIC roots in my browsers but left WoSign alone for now. Is there any indication that they should also be distrusted?

<comment><USER54> When there is a indication, it would be too late.

<comment><USER39> WoSign is actually a separate commercial CA though as far as I know.</comment></comment></comment></comment>


Observables & Data Binding in Web UI - <AUTHOR> http://www.dartlang.org/web-ui/observables/

<comment><AUTHOR> This is just brilliant :)</comment>


Ops in the serverless world: monitoring, logging, config management - <AUTHOR> https://medium.com/@theburningmonk/yubls-road-to-serverless-part-3-ops-6c82139bb7ee <comment><USER2> "serverless technologies have significantly simplified the skills and tools required to fulfil the ops responsibilities"

This article sure does a good job of disputing its own premise. There's plenty of Ops going on here. The fact that you have to reinvent a bunch of infrastructure, procedures, standards, and workflow doesn't mean you aren't doing Ops.

<comment><USER3> Yes it feels like the AWS Lambda for everything choice really worked against them

</comment></comment><comment><USER4> He ends up being so tightly tied to Amazon it's scary to me.

"You can scale all you want, servers are not your problem anymore!"

 _proceeds to build a million dollar business_

"That'll be <way too many $$> and you got nowhere to run, now that all those clients of yours depend on our service"

 _proceeds to pay insane amounts of $$ while rewriting in serverful_

Is there any standard in the serverless world as to what they accept and how they work?

<comment><USER5> > Is there any standard in the serverless world

Numerous companies depend on s3. Along the way open-source solutions have been built, as well as competitive solution that are API-compatible.

We're seeing the same in serverless. Frameworks that are moving toward multi- cloud, competitive solutions, etc. While not totally portable, you can take much of your code with you. You'd do the same if you had a standard Rails app running on an easy-deploy solution like Heroku and had to move to Digital Ocean. In other words, the potential for vendor lock-in is a problem that we've been created patterns to solve for many years.

>> That'll be <way too many $$> and you got nowhere to run

That makes for a great conspiracy theory but AWS has never done anything remotely like that. Through the history of the service they continue to bring down the price on their various offerings. Not sure what makes Lambda the piece they'd abandon all that for (insert evil laugh) world domination.

<comment><USER6> >That makes for a great conspiracy theory but AWS has never done anything remotely like that.

Just last year they changed the support model to be a percentage of your AWS spend, as opposed to the previous flat rate. They even had the audacity to dress it up as a straight-up price drop.

[https://aws.amazon.com/about-aws/whats-new/2016/07/aws- suppo...](https://aws.amazon.com/about-aws/whats-new/2016/07/aws-support- announces-update-to-developer-support-plan/)

Imagine you're an organization spending 100k/mo on AWS and your monthly support line item goes from $50 to $3000. Oh and by the way, the free support tier cannot create technical support requests.

<comment><USER7> Did any firm that spends $100k/month not realize that they were underpaying for support at $50?

<comment><USER8> If I'm spending six figures on your product I expect at least a certain amount of support to be free.

<comment><USER9> You expect wrong. Standard support fees are usually in ranges of 10-20% of the price that you are paying for the product. And it makes sense - costs of providing support are not constant why should their price be?

</comment></comment></comment></comment></comment></comment><comment><USER10> because Conway's law tells us that having an ops team is the surefire way to end up with a set of operational procedures/processes, tools and infrastructure whose complexity will in turn justify the existence of said ops team.

bwhahahaahaha

turn devs loose in production and you will soon realize stability is a good thing

</comment><comment><USER3> Yubl is a failed company: Social networking app Yubl shuts down despite £16m investment, [http://www.businessofapps.com/social-networking-app-yubl- shu...](http://www.businessofapps.com/social-networking-app-yubl- shuts-16m-investment/)

Nothing about this setup feels lean. Why did they build their own feed technology instead of using an open source or hosted solution?

Why did they use Lambda for everything, and invest a crazy amount of effort into making it work well? Their job was to prove their ability to acquire users, they didn't need to innovate on the tech side by using Lambda for everything.

It feels like a lack of focus. I admire how Unsplash is so clear about what the goal is and where their team can add most value: [https://medium.com/unsplash-unfiltered/scaling-unsplash- with...](https://medium.com/unsplash-unfiltered/scaling-unsplash-with-a-small- team-fbdd55571906)

<comment><USER11> > we decided to write our own using API Gateway, Lambda and DynamoDB because: > ... even running consul with 2 nodes (you need some redundancy for > production) it is still order of magnitude more expensive

Engineering time is free, of course.

</comment></comment><comment><USER12> Do NOT use Lambda for production at scale. [pic]

[https://twitter.com/JamiesonBecker/status/802185522139582464](https://twitter.com/JamiesonBecker/status/802185522139582464)

<comment><USER13> I'm having trouble reproducing your math. Can you be more specific on how you got (30.5 * 86,400) in your equation? Using this calculator I can't reproduce your cost: [https://s3.amazonaws.com/lambda-tools/pricing- calculator.htm...](https://s3.amazonaws.com/lambda-tools/pricing- calculator.html#). What is your execution time and memory on each lambda?

Edit: I'm guessing 86,400 seconds in a day and ~30.5 days in a month. If so you're using lambda wrong. You should not keep a lambda running forever rather treat each lambda as a short living function that responds to an API request and avoid calling async operations during the execution of it.

<comment><USER14> Please see Pricing Example 1 on [https://aws.amazon.com/lambda/pricing/](https://aws.amazon.com/lambda/pricing/). That's Amazon's own pricing example using typical values.

30.5 is the average number of days in a month. (365/12)

86,400 is the number of seconds in a day.

So, in other words, based on the very example shown on the Lambda pricing page, 3 million requests in a month is only 1.14 per second.

A single bare-bones t2.nano instance can easily handle that, but let's pretend that it's very, very spikey... so you need 10 nano's. (Of course, let's also pretend that you're constantly using them all, and autoscaling doesn't exist.) A nano can probably easily handle 100 req/s in even the slowest API framework (and certainly the languages supported by lambda), so that's where the rest of the numbers came from.

So, in other words, a cluster that easily handles 1,000 req/s would cost around $67/month, vs $1,600 and change for Lambda. Their very own example proves that it's far from cheap.

The worst part is that as scale increases, the cost disparity increases linearly. Recipe for disaster.

But, again, it's very useful for small things. (AWS certified Solutions Architect and I don't really touch lambda except for things that aren't worth running a whole server for.)

<comment><USER13> Makes sense. Thanks for explaining.

For scaling a lambda it might make sense to run your lambdas on EC2 using this: [https://github.com/lambci/docker- lambda](https://github.com/lambci/docker-lambda). (But at that point you loose the 'NoOps' benefit of lambda and I can't imagine you'd get similar performance to just running a Node Server or the like.)

<comment><USER14> This looks cool! thanks for pointing it out!

</comment></comment></comment></comment></comment><comment><USER15> Self-congratulatory drivel. I read with interest until he name-dropped his company. (Hint: they have since shut down).

<comment><USER3> The article could have started with that. While we should have been working on proving out our ability to acquire and retain users, we had some fun with AWS Lambda instead.

In all fairness, probably not the author's fault, but something that went wrong higher up in the organization.

</comment></comment><comment><USER16> > a global.CONTEXT object (which works because nodejs is single-threaded)

If that's true, then it sounds to me like AWS Lambda is being grossly inefficient, handling only one request at a time in a given Node.js process. Am I correct about that?

<comment><USER17> I think it's kind of the whole point. The instance of the application exists to service one request and then goes away. How many instances there are scales with the number of requests.

And if you have an unpredictable workload, that may be the most cost effective and responsive solution.

<comment><USER18> Well, if a server could take more than one request and also scale horizontally, that would be so much more efficient.

I am sure it has been done before. /s

</comment></comment></comment><comment><USER19> What about audits in a serverless world? How do you approach that?

<comment><USER20> Serious question. What are you auditing? You have access to all of your code and data and everything else seems like it would be up to your provider.

Wouldn't you know up front when you're choosing a stack whether they meet your compliance demands?

<comment><USER21> > Wouldn't you know up front when you're choosing a stack whether they meet > your compliance demands?

The number of actors in industries with particularly notable compliance requirements (like HIPAA) that have internally very weak, inaccurate, ideas of the actual requirements and who discover the pracctical meaning of key elements both long after they've been in force and long after they've relied on an inaccurate understanding is, well, non-negligible.

</comment></comment></comment><comment><USER22> Curious he does not mention the hosted elasticsearch+kibana on Amazon. Even integrates with cloudwatch and lambda to pull in the data.

<comment><USER23> We just migrated off AWS ES to elastic.co this week even though we pay for AWS support(and this try to centralize on it).

For basic use cases it might be fine, but AWS ES doesn't support X Pack, lags behind official releases, and I even recall it being more expensive once you setup production level ES domains since master nodes are paid for separately. XPack is huge as far as solving headaches with ES, even for the authentication management alone.

<comment><USER24> Whoops. We just decided to try out AES for a new project we're in the early stages of spinning up. I'd be curious to hear any more details about the two options should you have the time to spare.

We use Terraform to provision our stack though and it seems that the Elastic Cloud doesn't have any programmatic configuration options. How does your team orchestrate your elasticsearch cluster(s)?

EDIT: I should clarify, our use case is not ELK, it's search over a modest data set.

<comment><USER23> We were using Cloudformation templates via Serverless since the ES domain was tightly integrated with the Lambdas we were deploying. Today we'd probably use SAM with the same CF templates ([https://github.com/awslabs/serverless- application-model/blob...](https://github.com/awslabs/serverless-application- model/blob/master/README.md)) to keep things simple.

We're pretty write heavy/low read with a comparatively small data set (~50GB expected over 4 months). I know ES can be tuned for that use case to improve index throughput at the cost of slower searching but I never tried setting it up on AES (I'm guessing it'd go in the CF-Template).

One challenge with elastic.co is there's no equivalent to Amazons ElasticsearchDestinationFirehose. We were putting data into a Firehose which batched, backed up to S3 and accounted for failures via a Lambda but elastic.co is giving you "raw" ES instances, so you need to handle those usecases.

You could probably write a Kinesis stream that replicated that functionality(and from what I understand Firehose came to be because that's exactly what people were doing), but we control the devices uploading to the Lambda, so we had the devices act as the buffer (increased send thresholds, and propagated failures to send to ES to our devices which retry automatically) and sent a duplicate record to an S3DestinationFirehose for backup and replaying data

<comment><USER25> Might I ask how you bootstrap your CloudFormation setup? Do you set up all IAM accounts via CloudFormation on the root account, or do you use something else for that? What do you run your CloudFormation templates on, dev machines or something on AWS?

I'm currently tasked with getting a SaaS application onto Amazon and picking it up as I go along, mostly just from the docs. It's been very hard to find high-level overviews of ways to use AWS's ops tools like CloudFormation, most articles I've found are about one specific API and not about architecturing AWS apps.

<comment><USER23> Serverless gets its own user that has the permissions needed to apply our CF templates, then the templates define the IAM roles. But I guess depending on the structure of your team and deploy that can be an issue, since having the serverless credentials = being able to create and assign IAMs. For example, if those credentials are in your CI, now giving someone access to your CI also gives them access to an AWS user who's practically a "superuser" (although tbh, I'm not sure how much of a problem that is since access to CI is already a pretty big deal).

We run serverless (which in turn applies the CF templates) on Jenkins instead of locally (which also helps automate passing the correct stage and parameters). I guess the equivalent without serverless would be just be using aws-cli, since serverless doesn't do anything special to the CF templates

There was a great webinar on production deployments with SAM (which you could replace with CF) via CodePipeline, but I can't seem to find the slides for it anywhere. If we "did it again" we'd probably use CodePipline/CodeBuild(We just used Jenkins because we didn't really have a chance to look at other options)

<comment><USER25> Thanks for the advice, I think I'm going the CodePipeline/CodeBuild route :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> "skills and efforts required to fulfill the ops responsibilities do not justify the need for such specialization." You just pay someone else to do it; get over yourself.

<comment><USER27> About 10 words prior to the quote you cited and objected to, the author says, "no ops specialization in my organization."

I'd conclude that the author realizes they're paying someone else to do it and is rationally choosing not to employ those specialists in their org.

<comment><USER28> Not to speak for the parent, but it seems to me that paying for "ops specialization" is different, exactly the opposite even, from "ops specialization isn't needed."

<comment><USER27> "Isn't needed [anywhere]" is also different from "isn't needed in my organization" which is how I read the author's words.

In context, the quote is:

"NoOps to me, means no ops specialization in my organization — ie. no dedicated ops team — because the skills and efforts required to fulfill the ops responsibilities do not justify the need for such specialization. As an organization it's in your best interest to delay such specialization for as long as you can"

That's not downplaying the value of ops, IMO.</comment></comment></comment></comment>


Ask HN: Why some websites ask for "username" but actually wait "email"? - <AUTHOR>

Isn't it a bad UX? Even MailChimp does that and everytime I get confused. Is there any specific reason? <comment><USER2> They use your email address AS a username.

My guess is it's just an oversight. I notice a number use a "Username/Email" label, whether or not you have a separate username or not.

<comment><AUTHOR> GoDaddy is another example. It asks for "Username" first and if you fail to login it asks for "Username or Customer ID".</comment></comment>


Show HN: Hubot script to access IRC channel topic through HTTP - <AUTHOR> http://hackatron.org/2013/01/25/irc-channel-topic-http-api-using-hubot.html

<comment><AUTHOR> Direct link to the script: [https://github.com/hackatron/hackatron- hubot/blob/master/scr...](https://github.com/hackatron/hackatron- hubot/blob/master/scripts/irc-topic.coffee)</comment>


A thousand pounds of dynamite (2014) - <AUTHOR> https://magazine.atavist.com/a-thousand-pounds-of-dynamite <comment><USER2> This article about the same occurrence is better constructed, because it doesn't start with the perpetrators; it starts with the bomb.

[https://www.damninteresting.com/the-zero-armed- bandit/](https://www.damninteresting.com/the-zero-armed-bandit/)

</comment><comment><USER3> I'm interested in the Atavist Magazine itself. An evolution of the magazine industry. From its About-Us, it looks like it's a side project for its editors. Given the labor put into this article, Atavist appears to pay traditional investigative-journalism fees for its stories. Supported by subscription.

</comment><comment><USER4> Podcast with the author: [http://swordandscale.com/sword-and-scale- episode-70/](http://swordandscale.com/sword-and-scale-episode-70/)

</comment><comment><USER5> This is probably one of the better long form articles I've read in a long time. Completely captivated me

<comment><USER6> I disagree. It is exceedingly long, and there was no indication about what it was even going to be about. I wasn't able to decide if it was worth investing all of the time required to read it, so I decided not to.

Someone else in this thread posted this article, which does it right. There's a one-liner summary at the top and everything: [https://www.damninteresting.com/the-zero-armed- bandit/](https://www.damninteresting.com/the-zero-armed-bandit/)

</comment></comment><comment><USER7> The decency of the FBI (never thought you'd read that phrase, right?) toward the sons/brothers amazes me. If I got caught up in something like this I would fully expect the FBI to make my life hell and escalate the situation possibly resulting in bullet holes in members of my family. I guess times were different back then or maybe you get treated nicer when you have information they want.

</comment><comment><USER8> Why is it that I can't even read the first sentence before being pestered with a "sign up for our..." May I have some time to evaluate you offering so I can make an informed choice?

<comment><USER9> For years now I have had a policy of instantly closing any tab which treats me that way. I don't even close/cancel the overlay, I just close the tab and leave.</comment></comment>


Loophole land—where crimes can't be prosecuted - <AUTHOR> http://loststates.blogspot.in/2011/08/loophole-landwhere-crimes-cant-be.html

<comment><AUTHOR> Relevant good reddit discussion.[1]

[1][http://www.reddit.com/r/todayilearned/comments/pu75n/til_the...](http://www.reddit.com/r/todayilearned/comments/pu75n/til_there_is_a_50_square_mile_stretch_of_idaho/)</comment>