Still Why No HTTPS? - <AUTHOR> https://www.troyhunt.com/still-why-no-https/ <comment><USER3> 1\. The requirement to involve a 3rd party certificate authority is a needless power grab. Giving in ends the hope that it will ever get changed.

2\. There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message which will make them think there are security issued with your website.

3\. Downloading and running code from a 4th, or 5th party and giving it access to your config files is not "more secure".

4\. The culture of fear around HTTPS, meaning only the "most secure" or "newest" protocols and cipher suites are to be used. This prevents older clients from working, where HTTP works just fine.

5\. HTTPS is needlessly complex making it hard to implement. There have been several security vulnerabilities introduced simply by its use.

6\. If you can't comply with the OpenSSL license, implementing it yourself is a hopeless endevour.

SSL was developed by corporations, for corporations. If you want some security feature to be applicable to the wider Internet, it needs to be community driven and community focused. Logging in to my server over SSH has far more security implications than accessing the website running on it over HTTPS. Yet, somehow, we managed to get SSH out there and accepted by the community without the need for Certificate Authorities.

<comment><USER4> > The requirement to involve a 3rd party certificate authority is a needless > power grab. Giving in ends the hope that it will ever get changed.

Genuinely curious - what alternatives do you have in mind? Are there any WoT models that interest you more?

> There is currently only one free cert provider, if there are ever issues > with it, your users will see a scary error message

Isn't this the point?

> Downloading and running code from a 4th, or 5th party and giving it access > to your config files is not "more secure".

Could you elaborate? Have you written your whole stack from scratch? You are running millions of lines of code that you will never read but have been implemented by other parties.

> HTTPS is needlessly complex making it hard to implement.

Isn't this done with robust battle-tested libraries and built-in support in modern languages?

\---

Mainly I'm just wondering why you're letting perfect be the enemy of good. There's always room for improvement in everything, but I don't think user privacy is a reasonable sacrifice to make.

> Giving in ends the hope that it will ever get changed.

Abstaining from HTTPS won't be seen by anyone as a protest, but as incompetency, whether you find that justifiable or not.

<comment><USER5> DNSSEC is superior to both PKI and WOT. It's basically free. It makes chains of accountability transparent (hint: it's the dots in the URL). It provides the benefits of hierarchical trust except with democratic control, and is operated on film in public ceremonies.

We don't have a robust understanding of who exactly operates PKI, but we do know that it's de facto governed by a company on Charleston Road, since CAs only have their root keys listed in things like web browsers at their pleasure. We also know that Charleston Road rewards CAs for their loyalty by red-zoning and down-ranking the folks who don't buy their products. Products which should ideally be deprecated, since SSL with PKI is much less secure.

Can anyone guess who's stymied progress in Internet security, by knuckle- dragging on DNSSEC interoperation? It reminds me of the days of Microsoft refusing to implement W3C standards. Shame on you, folks who work on Charleston Road and don't speak up. You can dominate the Internet all you like, but at least let it be free at its foundation.

<comment><USER6> Who's knuckle-dragging on DNSSEC interop? The entire Internet community. It's been almost 25 years, and 3 major revisions of the protocol, and still it has almost no adoption --- virtually none of the most commonly queried zones are signed. Why is that? Because DNSSEC is awful.

Obviously, you can't replace "SSL with PKI" (you mean TLS, and/or the WebPKI) with DNSSEC, because DNSSEC doesn't encrypt anything. Whether or not you enact the ritual of adding signature records to your DNS zone, you will still need the TLS protocol to actually do anything securely, and the TLS protocol will still not need the DNS in order to authenticate connections.

Instead, what DNSSEC (DANE, really) hopes to do is replace LetsEncrypt, which is not "basically" but instead "actually" free, with CAs run by TLD owners. Who owns the most important TLDs on the Internet? The Five Eyes governments and China. Good plan!

<comment><USER5> What we mean by DNS security is that when you visit your bank's website, you know it's actually your bank. We're less concerned about concealing DNS queries from routers and more concerned about preventing them from forging responses. Eavesdropping won't empty your bank account. Spoofing can, and encryption doesn't matter if the remote endpoint isn't authentic.

Right now you need to ping Google's servers each time you visit a website to ask if it's safe. We love Google but they're a private company that can do anything they want. If you feel comfortable with them being the source of truth for names on the Internet, then the problem is solved.

Most of us would prefer it be controlled by ICANN which is a non-profit, not controlled by any one government, that lets anyone from around the world who cares enough participate show up and take part in Internet governance. Controlling names was the purpose they were founded to serve. I say let them.

<comment><USER6> DNSSEC doesn't protect your bank account. Your bank uses TLS to establish connections with you, and TLS is authenticated, and does not rely on the DNS when establishing connections.

DNSSEC is in fact controlled by world governments, who have de facto authority over the most important TLDs. When a CA misbehaves, Google and Mozilla can revoke them, as they've done with some of the largest and most popular CAs. You can't revoke .COM or .IO.

</comment></comment></comment></comment></comment></comment><comment><USER7> Why do browsers punish non-verified certs much harder than no-cert?

If I want to quickly host my page and use encryption, then I have go through all that hustle to make it work. Perhaps allow use of self-signed certificates on same level as http instead of blocking my website.

<comment><USER8> Since there's no way to distinguish a non-verified (self-signed or not) certificate from an attack, browsers have to treat them identically to an attack (otherwise an attacker would simply pretend to be a non-verified certificate, to get the more lenient treatment).

On the other hand, a no-cert (unencrypted) connection _can_ be distinguished from an attack on an encrypted connection: the browser knows _a priori_ (through the protocol in the URL) that the connection _is_ supposed to be unencrypted.

<comment><USER9> I think the point here is that there's also no way to distinguish a http request from an attack.

It's fair enough to an argue that a self-signed cert could be an attack, but so could any http request.

> _a no-cert (unencrypted) connection can be distinguished from an attack on > an encrypted connection: the browser knows a priori (through the protocol in > the URL) that the connection is supposed to be unencrypted._

I don't understand how that allows one to distinguish it from an attack. Knowing that a connection is supposed to be unencrypted is just equivalent to knowing that a connection could be under attack.

<comment><USER10> Rightly punishing the connection for having the trappings of security when it actually lacks it doesn't mean we need to punish openly insecure traffic. End users have been told time and again that http is insecure, and so it's fine to leave it. End users should also be able to trust that https means secure without having to distinguish between secure and secure unless I'm being mitm'd and needing to understand what any of that means.

<comment><USER11> Most end users have no idea what HTTPS is. They've just been (incorrectly) taught that the padlock means it's secure. Disable the padlock for self-signed HTTPS, and disable the CA-signed HTTPS-only features, and it becomes strictly better than HTTP.

<comment><USER12> Especially because there is no way to MITM a connection with perfect-forward- secrecy only if it ends up serving a self-signed certificate, because the connection first negotiates an ephemeral key with which everything, including the certificate, will be encrypted.

This means that with eSNI and at least one CA-signed cert on the IP, any attacker runs the risk of having to spoof the CA-signed certificate.

<comment><USER13> A sophisticated attacker might know that you were going to connect to a self- signed site, though. Interestingly though, private DNS (DoH, etc.) might help further shroud this fact from the attacker.

All in all, I'd say that the browser should still throw up a full-page warning because of the implications of TOFU, but it can be one where the "continue to site" option is clearly shown even to a naïve user, and not hidden behind a spoiler.

<comment><USER12> Then maybe fall back to DANE and thus restrict this to zones signed with more than 1024bit RSA?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Because there is only one free certificate provider (lets encrypt) and it does not allow wildcard certificates via server authentification.

Having the DNS credentials laying around on the server is not a good idea. So creating wildcard certs via letsencrypt is a huge pain in the ass.

If a webmaster has control over somedomain.com I think that is enough to assume he has control over *.somedomain.com. So I think letsencrypt should allow wildcards to the owner of somedomain.com without dabbling with the DNS.

The way things are now, I don't use ssl for my smaller projects at smallproject123.mydomain.com because I don't want the hassle of yet another cronjob and I sometimes don't want the subdomain to go into a public registry (where all certificates go these days).

<comment><USER15> AWS certificates are free. Cloudflare will also put SSL in front of your origin for free.

So if you're using AWS you get it for free. Or you can slap CloudFront or Cloudflare in front of your origin.

I think the barrier is low enough that I SSL all the things (including my small side projects).

<comment><USER16> > AWS certificates are free.

"Free", but you can only use them on AWS stuff. AWS makes it nice and easy (and does a bunch behind the scenes for you). Part of that behind-the-scenes is that they have control of the private key on their side. You want to use the AWS generated cert locally, or on another provider, too bad.

<comment><USER15> You're right, but it's pretty simple to slap CloudFront (or Cloudflare) ahead of those origins if you need to in a pinch. I don't work for Amazon (and have no dog in the fight) but I am a fan of AWS. And if you're ever using AWS for anything, there's no reason to _not_ use their free certs.

Someone else mentioned Azure having a similar offering (I've never played with Azure so I can't speak to it). And if 2/3 of the providers offer it, I'd imagine GCP will at some point as well.

I love how easy it's becoming to launch SSL. LetsEncrypt did a lot to make it mainstream. I've never used LE but I am grateful for their impact on our industry.

</comment></comment></comment></comment><comment><USER17> The article says googletagmanager.com has HSTS preloading. But it doesn't.

This is easily testable. I view the website in both Chrome and Firefox, and it's http, not https.

Sure googletagmanager.com is in the preload list, but it doesn't have "mode": "force-https". It just has certificate pinning, not HSTS.

</comment><comment><USER18> Because HTTPS is not as easy as HTTP.

Sure there is Let's Encrypt and if you are facing Internet you are probably good to go.

If you are on an internal network, then good luck. You need to build a PKI, and then put into your devices the right certificate so that it is trusted.

If it was simpler, Apache would sing out its "It works!" in HTTPS and not HTTP.

<comment><USER19> Let's Encrypt works on internal networks too.

Fun fact: TLS doesn't require certificates, and some browsers even used to support HTTPS in these TLS modes many moons ago. See eg [https://security.stackexchange.com/questions/23024/can- diffi...](https://security.stackexchange.com/questions/23024/can-diffie- hellman-anonymous-be-used-as-a-cipher-for-ssl-for-one-way-certifiate#23025)

<comment><USER18> Ah? That's good to know!

How to set this up on a domain which is not connected to Internet? How is the check done?

<comment><USER20> It's not easy but iirc you can do it with a DNS-01 challenge, if your internal domain name is valid (doesn't have to resolve to anything though).

<comment><USER18> The problem is that I also have domains which are completely internal, not known/resolvable outside

<comment><USER21> This is probably a bad idea and I'd recommend migrating off such names as a background task.

Realistically you can't entirely deconflict these names. So you always have a risk of shadowing names from the public Internet.

The public CAs spent years in denial over this (yes they used to sell publicly trusted certs for "private" names, this is now prohibited). Create internal.example.com and things get easier. To the extent security by obscurity is worth trying it's just as available this way (split horizon DNS etcetera)

<comment><USER22> > Realistically you can't entirely deconflict these names. So you always have > a risk of shadowing names from the public Internet.

It's totally save and legitimate for ycombinator to use secret.ycombinator.com on their intranet without telling anything about it to the outside internet.

<comment><USER21> Those are names you own, and a CA will happily issue you certs for those names (but Let's Encrypt won't without a DNS record saying the name at least exists)

The grandparent was, as I understand it, talking about names they don't own, for which you've no assurance somebody else won't own them (on the public Internet) tomorrow. This used to be very common, decades ago Microsoft even advised corporations to do it for their AD, but it's a bad idea.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> There is one "good" reason against https: handshakes take enormous amounts of CPU, relatively speaking. It's quite easy tp DoS server by skipping the expensive part on your end. You can load a core with 10~30Mbit@2k rps if your not even optimized.

Whereas the same server could tank 40k rps HTTP requests.

<comment><USER23> Do you have a source on that? Quite a few people seem to disagree: [https://istlsfastyet.com/](https://istlsfastyet.com/)

<comment><USER24> In my testing for high-throughput scenarios like copies over ssh/rsync/https/smb (i tried them all) in every case encryption was a big hit to throughput. hardware assistance (built into the CPU) helped a lot but it was still a massive boost to shut off encryption - saving literal minutes on every bulk transfer, multiple transfers per day.

For the average case it probably doesn't matter, and you can optimize it, but I think it is totally understandable that the average novice could end up with bad https performance if only because the defaults are bad or they made a mistake. If hardware assist for the handshake and/or transfer crypto is shut off (or unavailable, on lower-spec CPUs) your perf is going to tank real hard.

I ended up using ssh configured to use the weakest (fastest) crypto possible, because disabling crypto entirely was no longer an option. I controlled the entire network end to end so no real risk there - but obviously a dangerous tool to provide for insecure links.

Also worth keeping in mind that there are production scenarios now where people are pushing 1gb+ of data to all their servers on every deploy - <USER2> among others when Facebook compiles their entire site the executable is something like a gigabyte that needs to be pushed to thousands of frontends. If you're doing that over encrypted ssh you're wasting cycles which means wasting power and you're wasting that power on thousands of machines at once. Same would apply if the nodes pull the new executable down over HTTPS.

<comment><USER25> How long ago was this — and how fast was your network? On hardware less than a decade old you shouldn't be seeing that unless you're talking about 10+Gb networking.

<comment><USER24> A year ago in my development VMs, it was the difference between like 40MB/s throughput and 200+

</comment></comment></comment></comment></comment><comment><USER26> My biggest gripe with the current de facto recommended approach (even mandated in HSTS) is that you need to redirect to https from untrusted http.

So you are being forced to either not serve http, or to condition users to trust MITM-able redirect. How many people will notice a typoed redirect to an https page with a good certificate?

The solution is simple: browsers should default to https, and fall back to http if unavailable. Sure, some sites have broken https endpoints, but browsers have enforced crazier shit recently.

<comment><USER27> That's what HSTS is for - you set a HSTS policy, and the browser will remember this site for a certain time you can set (usually 1-2 years).

And going further, you can enable HSTS preloading, meaning the next release of browsers is going to hardcode your website as always and only ever going to be used with HTTPS.

See for example my domain [https://hstspreload.org/?domain=kuschku.de](https://hstspreload.org/?domain=kuschku.de), which is currently in the preload lists of all major browsers including Chrome, Firefox, Edge and even Internet Explorer.

I also deploy the same for mail submission with forced STS, and several other protocols.

<comment><USER26> Right, so HSTS will protect a visitor who has visited your web site at most max-age ago using that particular browser and device.

Or, as I stated, for preload, you have to either not have HTTP at all, or have a redirect to HTTPS: it should be clear from my above post why I think a redirect is a bad idea. I also dislike turning off HTTP for those that don't have any other option.

To me it seems that browsers just switching to https-by-default and http-as- fallback is a much simpler, better, backwards-compatible change that should just work. What am I missing and why do you feel HSTS is a good idea compared to that?

<comment><USER27> Because some websites serve something different on 443 and 80, and you won't get the right result by visiting 443.

The preload list allows you to specifically say that for your own website clients should always use HTTPS, which is a good solution, as it means no one is ever going to visit kuschku.de on port 80, except for curl and dev tools, for which the redirect is useful.

<comment><USER26> I disagree with the claim that it's better for a web site to implement HSTS than to fix whatever they are serving on 443.

But to each their own.

<comment><USER27> It's possible for me, today, to implement HSTS, and have my site served securely everywhere, today.

Browsers can't set 443 as default, because _other_ websites are broken, _other_ websites I can't fix and the browsers can't fix either.

<comment><USER26> We have differing views of "everywhere, today": you acknowledged yourself there are cases where it won't happen, it's just how much we think that's important where we differ. That's ok, I appreciate your point and thanks for spending the time to explain.

As for what browsers can or cannot do, they also can't introduce DNS-over- http, introduce stricter cookie policies breaking a bunch of web sites, or reduce effectiveness of ad-blockers, drop flash, or... Sure, defaulting to https is too high a bar (not expressing an opinion on any of those — eg. good riddance to Flash :) — but browsers can and have done stuff that's just as bad, forcing web site creators to adapt their web sites).

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> "gnu.org" is on the list marked as a Chinese website...

<comment><USER29> There are some other confusing ones as well.

nature.com is marked as Chinese, as are nginx.org and ntp.org.

example.com is Indian in the list as is the now defunct dmoz.org.

I don't understand the methodology behind the country assignments at all…

<comment><USER30> Weirdly nature.com seems to actually redirect to https, as does zara.com, lenovo.com, genuis.com, and senate.gov. Is this list stale, or did no one spot-check this?

<comment><USER31> Yes, senate.gov in particular:

% curl -I senate.gov HTTP/1.1 301 Moved Permanently Server: AkamaiGHost Content-Length: 0 Location: [http://www.senate.gov/](http://www.senate.gov/) Date: Tue, 17 Dec 2019 10:37:04 GMT Connection: keep-alive

% curl -I www.senate.gov HTTP/1.1 301 Moved Permanently Server: Apache Location: [https://www.senate.gov/](https://www.senate.gov/) Content-Length: 231 Content-Type: text/html; charset=iso-8859-1 Date: Tue, 17 Dec 2019 10:37:08 GMT Connection: keep-alive

It seems to meet the requirement for exclusion from the list. Data updated 16 Dec 2019, so I don't think it's stale.

I've also checked from Australian and a European connection, so I don't think it's a regional thing. The other genuis.com doesn't work for me, the other sites redirect and set a cookie.

<comment><USER32> If you're trying to get senate.gov onto the HSTS preload list, you have to redirect [http://senate.gov](http://senate.gov) to [https://senate.gov](https://senate.gov) before [https://www.senate.gov](https://www.senate.gov)

Maybe their tester applies the same criteria - although to me that feels a bit unfair...

</comment></comment></comment></comment></comment><comment><USER33> One annoyance with this system, from the linked webpage:

>an expectation that a site responds to an HTTP request over the insecure scheme with either a 301 or 302

Doing things this way is the final nail in the coffin for Internet Explorer 6, since IE6 does not use any version of SSL which is considered secure here in 2019. And, yes, I have seen in people the real world still using ancient Internet Explorer 6 as recently as 2015, and Windows XP as recently as 2017.

Which is why I instead do the http → https redirection with Javascript: I make sure the client isn't using an ancient version of Internet Explorer, then use Javascript to move them to the https version of my website. This way, anyone using a modern secure browser gets redirected to the https site, while people using ancient IE can still use my site over http.

(No, I do not make any real attempt to have my HTML or CSS be compatible with IE6, except with [https://samiam.org/resume/](https://samiam.org/resume/) and I am glad the nonsense about "pixel perfect" and Flash websites is a thing of the past with mobile everywhere)

<comment><USER12> Be aware that blocking scripts from insecure connections is something you'd usually want to do...

<comment><USER33> "usually" being the operative word. I'm not quite ready to throw IE6 (Internet Explorer 6) and all http-only browsers completely under a bus yet.

</comment></comment></comment><comment><USER34> Preloads list is an absolute kludge that does not and will never scale and creates a huge deal of problems and works only for specific browsers.

The task is not as simple as using DNS to store strict https flags(as DNS can be manipulated by intermediary), but hardcoding the lists in the browsers and keeping the lists in the chrome's code is definitely not a solution.

<comment><USER27> The goal is to slowly move higher levels into that list.

e.g. in the past it was just domains and subdomains.

Today there are already some TLDs on the list themselves.

</comment></comment><comment><USER35> I mostly have port 80 egress traffic blocked on Little Snitch. The web is painful to use like that but gives you an idea of the sorry state of websites.

A lot of websites just don't serve over HTTPS, or serve them with domains whose CN or SAN don't match the host.

Many that do support https have links that downgrade you back to http on the same domain.

<comment><USER36> How do you use public Wi-Fi with captive portals?

<comment><USER37> Allowing [http://captive.apple.com](http://captive.apple.com) should make macOS's captive portal auth window work.

<comment><USER38> If you block port 80, you'll never get to the part where you do URL filtering in the first place.

(And also the redirection thing.)

<comment><USER37> I mean whitelist port 80 for captive.apple.com. Sorry if that wasn't clear.

macOS has a background daemon which automatically hits captive.apple.com on connection to a WiFi network, to detect if it's behind a captive portal (and opens up a browser window to let you complete the flow, if it gets a 302). So that much should work even if you block egress port 80 but whitelist captive.apple.com.

...that is, assuming the portal to which you get redirected would be served over https, but I guess that isn't a given either.

</comment></comment></comment></comment></comment><comment><USER39> One thing that surprised me was how hard it was to set up https https redirects for websites on aws and Google cloud. I needed too set up a load balancer to do https.

The redirects are also hard, I have a static site using Google storage and I have to create a server instance and redirect from there because it's not possible to do an automatic redirect. I don't know why the big cloud hosting providers aren't cooperating to make full https implementation easier.

</comment><comment><USER40> Recently an OpenShift cluster I admin went down because of long-lived certs not being rotated in time. There are many clients, servers, nodes, services, and configs involved, so rotating is non-trivial, so of course it's automated, and of course because it's not tested regularly, the automation just doesn't work after a while. Using the automation only seems to make things worse, and getting everything working again ends up taking days.

PKI is technically the best practice for these systems, but it's also the most fragile and complicated. At a certain point, if the security model is so complex that it becomes hard to reason about, it's arguable that it's no longer a secure model, to say nothing of operational reliability.

I also have a whole rant about how some business models and government regulations _literally require inspecting TLS certs of critical transport streams_ , and how the protocols are designed only to prevent this, and all the many problems this presents as a result, but I don't think most people care about those concerns.

Oh, and gentle reminder that there are _still_ 100% effective attacks that allow automated generation of valid certs for domains you don't control. It doesn't happen frequently (that we know of) but it has happened multiple times in the past decade, so just having a secure connection to a website doesn't mean it's actually secure.

</comment><comment><USER41> Is it still the case that when you think you connect in https to a website, only the segment to cloudflare is encrypted and the segment cloudflare to the web server might not be?

<comment><USER42> Yes, that's SSL termination. Generally this happens at the CDN, load balancer or proxy (e.g. nginx used as a cache) layer and is pretty common since the fleet of servers handling the request after being routed are in a private network. With CF, the request from CF to the origin is over a public network and it will depend on how the user has configured their CF setup as to whether or not that hand-off is then encrypted. If they are doing SSL termination in CF, then it won't be encrypted from CF to the origin server.

</comment></comment><comment><USER43> The biggest problem with forcing everything HTTPS is a false sense of security & trust that this gives to none-techie users.

Security of the data transfer layer does not mean can or should trust the website you are visiting.

Just because a website has a padlock does not mean it is trust worthy and you can hand over your CC details.

[https://www.amazon.somethiing.other.co/greatDiscount](https://www.amazon.somethiing.other.co/greatDiscount) may look great to some!

<comment><USER44> If we migrate to HTTPS everywhere we can get rid of HTTP for general use and switch to a different UI, where HTTPS websites don't have any special icon but HTTP ones get a warning icon.

It's already effectively how password form submissions work in many browsers.

<comment><USER45> You can't have HTTPS everywhere until we can get HTTPS for IoT devices. My router doesn't serve it's configuration screen via HTTPS. How could it? I have to connect to it to configure it before it's on the internet.

Same with my IoT cameras and all the various local apps I run that can start a web server. Heck, my iPhone has tons of apps that start webservers for uploading data since iPhone's file sync sucks so bad.

We need a solution to HTTPS for devices inside home networks.

<comment><USER44> I agree that having an elegant and secure solution to enable HTTPS on non- internet-facing equipment would be nice. I work mainly on embedded devices and all my admin interfaces are over HTTP because there's simply no way to ship a certificate that would work anywhere. It would be nice if you could easily deploy self-signed certificates that would only work for local addresses and only for specific devices, although of course doing that securely and with good UI would be tricky.

In the meantime having big warnings when connecting to these ad-hoc web interfaces makes sense I think, since they can effectively easily be spoofed and MitM'd (LANs are not always secure in the first place so it makes sense to warn the user not to reuse a sensitive password for instance). It's annoying for us embedded devs but I think it's for the greater good.

</comment></comment></comment></comment><comment><USER46> Maybe I'm wrong, but I feel SSL has a downside of relying on more centralization. If a visitor to my totally-static webpage wants to bypass that layer and request the http version directly, I'm going to let them. (Obviously not excited about the idea of being mitm'd but it's not a security risk, so leave that tradeoff up to the visitor).

<comment><USER47> [https://doesmysiteneedhttps.com/](https://doesmysiteneedhttps.com/)

MITM can do _anything_ to your site, so your totally-static site may not be static any more at the victim's end. It may be a site collecting private details, attacking the browser, or using the victim to attack other sites.

Your static HTTP site is a network vulnerability and a blank slate for the attacker.

<comment><USER48> So then disable javascript for http sites

<comment><USER49> That won't do anything. If someone can Man-in-the-Middle you, then they can easily forge a 302 redirection to a malicious web page that could be HTTPS.

</comment></comment></comment></comment><comment><USER50> One _potentially_ good reason to not force SSL: [https://meyerweb.com/eric/thoughts/2018/08/07/securing- sites...](https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites-made- them-less-accessible/)

TL;DR: Secure websites can make the web less accessible for those who rely on metered satellite internet (and I'm sure plenty of other cases).

<comment><USER51> Trading security for convenience is rarely a good idea. The rest of the world should not conform the to failures of certain areas to provide internet.

<comment><USER50> I see your point. But we trade security for convenience 24/7/365\. We could all have bulletproof glass in our homes, personal security cameras everywhere, backup generators, panic rooms, etc, but we don't, because it's not convenient (and I know the expense is primarily what makes it not convenient, but I think it's still a valid argument).

Providing access to Wikipedia over http to people in third world countries may be worth the risk of someone MITMing the site with propaganda.

The suggestion is only to give some users the option.

<comment><USER52> Mitm with propaganda is the least of the worries. Full on exploit code is.

The fact is as an ecosystem develops completely increases. Lifeforms in that ecosystem have to spend more time and effort protecting themselves from outside attacks as time progresses.

</comment></comment></comment></comment><comment> onion-soup Because it's always pain in the ass to set it up and then renew?

<comment><USER53> How exactly is it a pain in the ass?

\- If you are hosting a simple static page or blog, your hosting provider probably has Let's Encrypt plugin.

\- If you have your own VPS, Caddy has you covered with file serving, fastcgi support for PHP, and proxying to (g)unicorn/nodejs/Go/.NET, and has HTTPS enabled by default.

\- If you have more advanced setup (e.g. containers), traefik supports HTTPS with just a few lines of configuration.

\- If you are big enough to afford cloud, it takes a few lines of Terraform code to provision certificate for load balancers (speaking for AWS, and assuming others have similar solutions).

For other cases (e.g. lots of traffic with custom haproxy/nginx/etc. setup), you are probably smart enough to find out how to enable Let's Encrypt support.

<comment><USER54> 1) Not everything is running bare Apache. In fact, some services might have some rather strange web-driven GUI (or, more interestingly, curses-like) that requires you to carefully load a certificate, a CSR, and so forth in a somewhat arcane manner. Some pretty niche serving exists out there and I have had to deal with a bunch of them, to the point where I had to write extensive documentation on keeping the certificates up to date on each separate weird service. Many of these services have a "no user-servicable parts inside, your warranty will be voided ..." clauses in the service contract which deter spelunking.

2) Some services require wildcards, like proxies.

3) Some organizations have, due to someone far away making strange decisions, policies about certificate authorities, and people to audit for compliance. Therefore, a cert costs money and, for a site which is purely informational, that's a hard sell.

4) Because we're not running on a hosting provider, a VPS, containers, or cloud.

5) Because not everyone wants to deal with some combination of the above every three months due to Let's Encrypt's expiration policy.

<comment><USER26> I generally run apache/nginx in front of most things for SSL termination — this allows you to simplify SSL setup significantly.

</comment></comment></comment></comment><comment><USER55> I consider myself young, but I've been around long enough to to rely on One True Service Provider for anything.

And "Let's Encrypt" is not an answer to "HTTPS is not free". It's not. We all are going to see our projects outlive Let's Encrypt (or their free tier).

In the end, nothing is secure. A dedicated attacker _will_ find a way, given enough resources. Any security measure is just a deterrent.

My deterrent is that it's not worth MITM'ing my personal website with, like, 10 monthly visitors. (The reader might gasp that I lock my bicycle with a chain that can be snapped in a second, and that a strong enough human can probably bash my home door in).

Anyway. It's almost 2020, and if you are still advocating on moving the entirety of the Web to reliance on Big Centrally Good Guys, I really don't know what else to say to you.

</comment><comment><USER56> Because it's hard and a pain.

Sure, depending on your setup it's easy, but for a lot of setups it isn't. Instead of trying to say HTTPS is easy and shame everybody who isn't doing it more efforts should be diverted into creating an actual fully encrypted network that doesn't need CAs.

<comment><USER56> What actually happens when you try to force HTTPS over the internet: you centralize it, you make it harder for the small player, hobbyist, personal homepage guy, and make it easier for the big corporation.

</comment></comment><comment><USER57> It isn't just web sites. Many software repos still use http or native rsync. Some would argue that you validate the packages with GPG, but you would be amazed if you saw how many people install the GPG public key from the same mirror they download software from.

<comment><USER58> Gradle, granted they're fixing it.

[https://blog.gradle.org/decommissioning- http](https://blog.gradle.org/decommissioning-http)

</comment></comment><comment><USER59> Had to access an EOL device and couldn't browse the web because of all ended certificates...

</comment><comment><USER60> I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up.

I'm guessing people aren't as lucky as I am to be running on newer machines and such.

I mean it even edits your nginx files to redirect http to https if you agree. It's not hard.

<comment><USER61> I'm fine with people who think it's too hard...

What i cannot stand is people who can do it, but refuse to out of laziness. Or because they want their content to be insecure on purpose.

This applies mostly to big orgs, so indie devs can have some leeway if it's too hard to implement.

<comment><USER62> > _i cannot stand is people who can do it, but refuse to out of laziness_

(Raises guilty hand)

I run a couple of sites on my hosted server that are still http. They both sit behind a varnish setup and to be honest I just have not found the time to get it done. Usually when I mess with my configurations I lose a week to troubleshooting stupid stuff and I just can't bring myself to do it.

<comment><USER61> Hey at least you aren't running a fortune 500 with millions of users (You aren't right?)

<comment><USER62> haha, right. They're really just hobby projects, almost entirely read-only.

</comment></comment></comment></comment></comment><comment><USER63> To provide a real-time solution to for printer hitches, get in touch with the experts of printer service. All technicians are well-trained and have years of skills to resolve the glitches. [https://printerhelpcenter.com/replace- brother-drum-error-mes...](https://printerhelpcenter.com/replace-brother-drum- error-message/) [https://printerhelpcenter.com/how-to-fix-canon-printer- error...](https://printerhelpcenter.com/how-to-fix-canon-printer-error-b200/)

</comment><comment><USER64> Downvote time: Why HTTPS?

I made my own security: [http://talk.binarytask.com](http://talk.binarytask.com)

<comment><USER65> Do you have a description of how you made your own security and what it provides?

<comment><USER64> Last time I described it here on HN there was confusion.

It's just "single serving server salt" (try saying that fast 3 times) sent to "client for secret hashing" and then "sent back to server again", so it's insecure on registration (just like all security with MITM without common pre- shared secret) but after that it's pretty rock solid, even quantum safe. Requires two request/responses per auth. though.

This tech is nothing new and has been used by many big actors since forever. It's simpler that public/private encryption because it only requires hashing math to work.

It should be my choice to use whatever encryption I want without having google scare away my customers with "Not Secure".

<comment><USER26> But "common pre-shared secret" (well, public key allowing verification that there is a trusted secret being used) is at the root of https security today (a preset list of root certificates distributed with OSes/browsers).

If someone presents as your web site to a first time visitor (or a previous visitor but on a new device), there is no way for them to really trust your web site. Basically, it's the equivalent of you using self-signed certs, and likely even worse because there are more attack vectors even outside the initial connection.

<comment><USER64> Can you explain how root certificates makes anything secure? Why can't you just hack the root cert store on the local computer f.ex.?

There must be a million attack vectors to that system too, with a lot of attackers working on them since the payout is good when everyone uses the same system?

Even if it makes sense, since all governmental offices and some corporations have their own; doesn't that make you skeptic of that kind of centralized security?

I'd rather take my risks with something I can understand, modify and improve; than using what everyone else uses.

And again: It should be MY choice! Not googles, now I have to compile my own browser, which takes like 24 hours on a modern home PC!!!

<comment><USER26> You are conflating multiple things.

If you are on an untrusted device (eg. someone _else_ could have hacked the root cert store in the OS/browser), all bets are off: they could have also just hacked the browser to drop any and all warnings and to always display a green padlock icon.

If you are talking about someone else hacking your machine, well, then it's pretty much the same: they can get most stuff by adding keyloggers, screen recorders and just scraping your disk for useful data.

If you are on a trusted device, you can "hack" the root cert store all you want to add root certificates you trust. As long as _you_ trust them, no trust has been lost.

Root certificates are not really "centralized": they are issued by different CAs, and different browsers trust different root CAs too, and it was even more prominent in the past where you had some certs "work" in only some browsers. Still, there are multiple recognised attack vectors there as well (each individual CA, their certificate issuing servers which have access to the root or intermediate signing cert, browsers and OSes and their trusted-CA components...), and the big difference is that the attack vectors are known and heavily monitored.

PGP/GPG keyrings were basically the same approach without the root certificates, and the (in)famous signing parties did not bring a trust level that is ultimately needed on the internet today. I would love to see a development in that direction (one could say it was an early consensus- building approach on who to trust), but we are not there yet.

It certainly is your choice to how you want to protect yourself and your web site visitors, and it's your web site visitors' choice whether they want to trust you with their data (for instance, I personally would recommend you to set up a self-signed cert and add that root cert to your keyring for services that you plan to only access yourself through untrusted networks).

Except that most people won't understand where the risks are in either approach, and that's half the battle.

</comment></comment></comment></comment></comment></comment><comment><USER66> Many of us have to host our websites on shared hosts that does not support HTTPS freely, HTTPS costs money in the third world

</comment><comment><USER67> Am I missing something?

Lots of US sites on their NO HTTPS list come up in Safari as HTTPS. Rutgers.edu for example.

</comment><comment><USER36> I have a reason not to use https.

I host a single site on a host (so, no login, subject name or path information to leak), which only contains details how to connect to my irc server at the same address.

If the message is altered then the most pain anyone will have is connecting somewhere else for the first time. (They won't be automatically logging in if they're using this page).

Why does everything need to be TLS? It feels like a cargo cult. A requirement: "because!"

In other scenarios it's worth modelling threats and I agree that it's good to err on the side of caution but aside from the modification of my connection information there's no good tangible reason to incur an overhead in administration.

Although it should be noted; part of the reason that web server even exists is to do letsencrypt for a globally geobalanced irc network.

<comment><USER68> > _Why does everything need to be TLS? It feels like a cargo cult. A > requirement: "because!"_

Traditionally, people have only encrypted things that are deemed sensitive (logins, money, health). However, when the majority of traffic is non- encrypted, actually ciphered data is very noticeable to anyone monitoring the network, and it screams " _look at me! I am important!_ ".

However, when >90% of traffic of the Internet is encrypted, then there is no 'extra' information to be gained from that fact. If further forces any surveillance program to expend extra resources to either trying decrypting everything, or choose to only focus on those people that it actually deems important, instead of wholesale surveillance of the entire population.

Further, encrypting content prevents it from being modified, reducing your potential to be leverage against:

> _The Great Cannon of China is an Internet attack tool that is used to launch > distributed denial-of-service attacks on websites by performing a man-in- > the-middle attack on large amounts of web traffic and injecting code which > causes the end-user 's web browsers to flood traffic to targeted > websites.[1]_

* [https://en.wikipedia.org/wiki/Great_Cannon](https://en.wikipedia.org/wiki/Great_Cannon)

* [https://citizenlab.ca/2015/04/chinas-great-cannon/](https://citizenlab.ca/2015/04/chinas-great-cannon/)

<comment><USER36> "herd immunity" is a good argument; but herd immunity exists for outliers. The people who for some reason cannot get a vaccine, yet they are not exposed to the hypothetical disease because everyone they are surrounded by is immune.

That's kinda my argument, not that https is bad. I agree with widespread adoption and taking it as a default even for a static page.

But in my environment I have many dozens of nodes and idk where letsencrypt is going to come in because of geobalanced DNS. I also serve many domains with this project so I don't have the nice DNS-01 ACME verification features because not all DNS providers have an API.

So I have a web server on each node, which reverse proxies .well-known/ to some central server that runs certbot. Then I distribute those certs outwards to those nodes.

It goes against certain sysadmin principles about transportation of private key materials, but it's what works.

But; given that architecture which caters for a latency sensitive product; letsencrypt is a serious overhead. To the point where I'm considering going back to 2y paid certs.

<comment><USER68> > _I also serve many domains with this project so I don 't have the nice > DNS-01 ACME verification features because not all DNS providers have an > API._

Are you aware of using ACME DNS aliasing with CNAMEs?

* [https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...](https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation)

* [https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode](https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode)

* [https://dan.langille.org/2019/02/01/acme-domain-alias-mode/](https://dan.langille.org/2019/02/01/acme-domain-alias-mode/)

My work's DNS provider does not have a handy API, so if we want a cert for the internal-only _foo.example.com_ , we point __acme-challenge.foo_ to __acme- challenge.foo.dnstest.example.com_. And the NS server for the _dnstest.example.com_ lives in our DMZ and is only there to answer ACME queries from Let's Encrypt. We set up some scripting to allow updates to the NS server via _nsupdate_.

And there are ACME clients written specifically around the idea of having the client run on a different system than the web server:

* [https://github.com/srvrco/getssl](https://github.com/srvrco/getssl)

</comment></comment></comment></comment><comment><USER69> i still use [https://neverssl.com](https://neverssl.com) daily. I hope it never goes away.

<comment><USER70> Intentional that your link is https?

<comment><USER69> ha, no i think HN did that automatically? I wrote http without s

</comment></comment></comment><comment><USER71> Service workers are a poor replacement for the shared HTTP cache, since the cache will not be shared among users.

<comment><USER72> I apologize for not having a source, but browsers are actually looking into disabling shared caches between sites because of side-channel attacks.

</comment></comment><comment><USER48> Ability to write my own HTTP server from scratch. Content is for downloading and use offline.

</comment><comment><USER73> As long as the worlds greatest surveillance system continues to be given deliberate access to the plaintext, I will continue not caring about HTTPS for websites that don't have users logging into an account or submitting forms.

</comment><comment><USER74> I clicked through to the list of sites. Embarrassing to see that mit.edu is not https by default! The same institution invented Kerberos. Come on MIT, fix this please.

</comment><comment><USER45> what is about that site's low contrast. My eyes can barely focus

</comment><comment><USER75> Without HSTS preload anyone on your local network can arp/dns spoof your traffic, MITM you, and automatically inject malicious javascript (cryptominers, credential-stealers, etc.), access all of the page content, and manipulate the page or response.

If you are connecting to a "Free Public WiFi" and the malicious actor is the one broadcasting the access-point; it's even easier to MITM you.

Without Cert & Key Pinning your employee laptop can be MITM by corporate to eavesdrop on all of your HTTPS traffic. The browser will show that the connection is secure, but it isn't. When you pin the cert and key - even with a compromised corporate computer - the insecure site warning will show and you'll be alerted to the fuckery.

> Doing things this way is the final nail in the coffin for Internet Explorer > 6

\- Fucking great! Nothing else to say here.

> handshakes take enormous amounts of CPU

\- This is vastly overstated (enormous?). Also, this is called a tradeoff. Security isn't free in time, money, or performance.

> Preloads list is an absolute kludge that does not and will never scale... > and works only for specific browser

\- The preload list, right now, is 10.6mb and contains 90,862 entries. This seems to function and scale just fine. Seeding your browser with known values is really the best way to do this until 99.X% of web traffic is provided over HTTPS... Also Chrome, Firefox, Safari, IE/Edge, and Opera make up 98% of all browser traffic today and they have all supported this standard for years.

> The biggest problem with forcing everything HTTPS is a false sense of > security.

\- Defense in depth. Layering security controls is the only way to go. Also; this is some crazy mental gymnastics to take the position "wearing a seatbelt is a false sense of security because you can still crash".

> Because it's hard and a pain.

\- Feeling that pain is offset onto the attackers trying to compromise your site. If you don't feel the pain; they don't either.

> Secure websites can make the web less accessible for those who rely on > metered satellite internet... TLS 1.3 with 1-RTT should improve this > situation.

\- Even if your entire business depended upon delivering data to metered satellite internet users; the risk outweighs the cost when not encrypting your traffic. WARNING: DON'T IMPLEMENT 0-RTT OR 1-RTT WITHOUT UNDERSTANDING YOUR APPLICATION-SPECIFIC REQUIREMENTS. You can really fuck this up by not properly managing tokens between your webserver and application layer. Not recommended.

> I don't get it. With Lets Encrypt, it's like one or two lines to get > everything set up.

\- True, but it get's confusing really fast if you don't 100% match the certbot use-case.

> HTTPS is not an obligation.

\- For 99% of people running businesses; it is.

> Recently an OpenShift cluster I admin went down because of long-lived certs > not being rotated in time.

\- If you have had certbot running for a long time I would suggest you check your server logs TODAY and make sure your cron job is still working correctly. Recently there was a change with the certbot acme version requirement and your reissue might be failing. Seriously, take a quick look right now.

> Because frankly, I neither trust letsencrypt nor the certificate authority > system in general... but won't help against industrial (e)spionage

\- Places tinfoil hat on... you're not wrong.

</comment><comment><USER76> Because even Certbot is a massive pain to setup if you're not using a very generic setup

</comment><comment><USER77> HTTPS is not an obligation. Most people believe it's a must these days, but it's not. There is a nice rebuttal of Troy's arguments on N-gate (via webcache as direct links from HN end up in an endless pseudo-captcha):

[http://webcache.googleusercontent.com/search?q=cache:t_oVSNu...](http://webcache.googleusercontent.com/search?q=cache:t_oVSNuTvIgJ:n-gate.com/software/+&cd=1&hl=en&ct=clnk&gl=pl)

</comment><comment><USER61> Some websites adamantly insist they did not need HTTPS because they are purely static.

[https://www.troyhunt.com/heres-why-your-static-website- needs...](https://www.troyhunt.com/heres-why-your-static-website-needs-https/)

The same website to my surprise has an article on why this is faulty reasoning.

<comment><USER78> Our asshat twin n-gate has something to say about this

> Horseshit. Users must keep themselves safe. Software can't ever do that for > you. Users are on their own to ensure they use a quality web client, on a > computer they're reasonably sure is well-maintained, over an internet > connection that is not run by people who hate them. None of the packets I > send out are unsafe, so my site does not need HTTPS.

> None of those things are my problem. If people don't want to see my site > with random trash inserted into it, they can choose not to access it through > broken and/or compromised networks. If other website operators are concerned > about this sort of thing, they are free to use HTTPS, but I have no reason > to do so. Encryption should be available to anyone who wants to serve > encrypted content, but I have no interest in using it for my website. It's a > shame that people are using web browsers (note: not my website, but > BROWSERS) as attack vectors. The legions of browser programmers employed by > Mozilla, Google, Apple, and Microsoft should do something about that. It's > not my flaw to fix, because it's a problem with the clients. My site does > not need HTTPS.

> Earlier you recommended letsencrypt, and now suddenly you want me to pick a > competent certificate authority? The only reason they didn't leak my info > already is because my site does not need HTTPS.

> Obviously my site does not display ads; as has [been pointed > out][[https://news.ycombinator.com/item?id=14666391](https://news.ycombinator.com/item?id=14666391)], > It does not even appear to be monetized. This is because I have a real job > and the entire web ad industry can fuck itself off a cliff. So, while mixed- > content warnings are pretty obnoxious, my site does not need HTTPS.

[http://n-gate.com/software/2017/](http://n-gate.com/software/2017/)

<comment><USER79> Can't read the article because the captcha won't load, but this reply doesn't make any sense. What can the browsers do without the cooperation of the server? You don't really need encryption to deal with that specific problem, but you do need signatures, which means you need a certificate anyway. It's quite a strange attitude toward the problem.

<comment><USER80> The captcha is because you come with a Referer of news.ycombinator.com. Try opening the website in Private Mode.

</comment></comment></comment></comment><comment><USER81> Because frankly, I neither trust letsencrypt nor the certificate authority system in general. This might prevent eavesdropping in your coffee shop wifi, but won't help against industrial spionage powered by three-letter-agencies who probably control some of these authorities.

<comment><USER40> This feels a bit like saying, I'm not going to use a traditional wood beam and shingled roof for my house, because it won't help against a meteor.</comment></comment>


Experiments in Pyrlang with RPython - <AUTHOR> http://morepypy.blogspot.com/2015/02/experiments-in-pyrlang-with-rpython.html

<comment><USER2> I for one would LOVE to be able to write Erlang with a pythonic syntax.

<comment><USER3> Even though I've made my peace with it, I can understand not being a fan of Erlang's syntax. That said, Erlang is _really different_ in some important ways, and it's pretty important to keep that in mind. Perhaps something like Elixir is a good compromise?

<comment><USER2> Well to be honest I enjoy writing Erlang as it is. But there is something about python -- the language, the flow, the imports, the speed, the tools -- which makes it a pure joy to work with</comment></comment></comment>


My afternoon project. A roommate match site using Meyers-Briggs.  - <AUTHOR> http://roomiematch.co

<comment><USER2> Meyers-Briggs is hardly proven science. Nor is it sure that matching by Meyers-Briggs score will find roommates who are compatible. <http://en.wikipedia.org/wiki/Myers-Briggs_Type_Indicator>

<comment><USER3> What "proven science" is there for matching potential roommates? If there is no such, perhaps Meyers-Briggs is the best available non-proven science.

</comment></comment><comment><USER4> Saw this on Reddit earlier. I don't think this is the right approach to solving this problem although it is a niche that could use solving.

<comment><AUTHOR> Definitely a problem that needs solving. Craigslist isn't getting the job done, so I took a few assumptions and put something out there. Curious what your thoughts are? I'm always looking for feedback.</comment></comment>


HabitRPG – A free habit-building app that treats your life like a game - <AUTHOR> https://habitrpg.com/

<comment><USER2> [https://hn.algolia.com/?q=habitrpg#!/story/forever/0/habitrp...](https://hn.algolia.com/?q=habitrpg#!/story/forever/0/habitrpg)

</comment><comment><USER3> I've been using HabitRPG on a daily basis since April and overall I find it useful. Things I like:

\- by far the thing I like the most is the streak counter on the dailies. It's quite rewarding to see you've done your morning light workout 120+ days in a row -- there's just no chance that you are gonna break that chain just so that you nap 10 more minutes!

\- low management overhead - I usually spend 1-2 minutes on the website

\- character gamification: getting random food and pet drops and critical chance for gold rewards; upgrading items with that gold -- all of these are completely useless :) but even so, these things do give you a tiny mental push to do that extra remaining task. Health and Experience points have similar effects -- I've had days where my character was low health and it was getting towards the end of the day (you lose health if you missed some dailies), which made me consider whether I could quickly achieve one of the remaining tasks

\- distinction between daily tasks that are a 'must' and habits that are 'nice to have' but I don't want to do every day.

I don't use the social aspect of it, so I cannot comment on that.

<comment><USER4> Same for me. There is no way that I'm going to break my 96 streak in "cleaning up kitchen after kids breakfast", so my wife can reliably find the kitchen clean every day and I have a routine to start the day productively rather than going through Reddit.

</comment></comment><comment><USER5> There seems to be some recurring popular methods for habit formation and many diffent apps. Each product has its own branding and different twist but the most common themes seem to be (1)"not breaking the chain" (2) precommitments/accountability/public shaming (3)positive feedback of some sort - positive messages or gamification.

This is not a bad set of methods - there is some (varying) evidence to suggest that each of these is effective in improving habit adherence. However, there are loads more facts about habits that don't necessarily fit into this paradigm so neatly:

\- Automaticity does not start to level of for a routine until at least a minimum of 20 days for quite a simple task, and it can be many times longer for more effortful tasks (like doing a daily workout). Average was 60 days but with a very high variance ([http://onlinelibrary.wiley.com/doi/10.1002/ejsp.674/abstract...](http://onlinelibrary.wiley.com/doi/10.1002/ejsp.674/abstract;jsessionid=F5E9F5BFC7933360C8C73C2E062575D9.f01t03) )

\- A single failed repetition "breaking the chain" does not have any effect on the development of automaticity of the behaviour, only repeated failures tend have a negative effect \- It has been suggested that it is much more difficult to try to build multiple habits in parallel rather than serially (although I cannot quite find an authoritative source just now)

\- Habits have a structure: Cue -> Routine -> Reward. It is useful to understand the conditions and motivation for a routine before trying to replace it (substitution approach)

\- Furthermore, if trying to establish a new habit to reach a goal you might find that there is no intrinsic reward in the routine. It will be very difficult to keep up the routine like that, and it may often be better to look for a different way to achieve the same goal

\- Habit formation can in some cases be thought of as a rewiring of the instinctive valuation system. For example a resolution to eat healthily might be helped more by giving yourself more exposure to delicious meals consisting of mainly vegetables, than by a purely willpower-oriented method

For these reasons - I tend now to think "less is more".It should be more about focusing on one or two correct habits and continually reevaluating them than to rely on a plethora of different external motivators to get you to do a dozen different things every day

</comment><comment><USER6> I can't quite see why this type of thing is so in favour at the moment. I also find it slightly disquieting (although admittedly that's got a lot to do with episode 2 of Black Mirror - [http://en.wikipedia.org/wiki/List_of_Black_Mirror_episodes](http://en.wikipedia.org/wiki/List_of_Black_Mirror_episodes) ).

It just seems like an unnecessary abstraction of willpower - if one already doesn't have the willpower to (for example) limit one's drinking, what is a cutesy game going to bring to the table? I mean, what's to stop me adding "smoke five cigs" or "drink an extra beer" to the list of habits in this particular example?

<comment><USER7> I'll put your question into more concrete terms. I've tried this sort of software before. I didn't cheat at it. However, every time I've tried it, after the first month, I usually have several bright red messages indicating how badly I'm failing at life. I then stop using the app, because it doesn't tell me anything I don't know.

The apps all seem to be based on the idea of not breaking the streak. While that's great when you have a streak of successes, it's frustrating when you have a streak of failures.

<comment><USER8> If you have a streak of failures, wipe the slate clean and start with something smaller and simpler. For severe cases, it might be necessary to start with something as simple as "brush your teeth 1x a day" and NOTHING else. This can seem ridiculously juvenile, but I wasted years of my life making little progress because I thought small things were too trivial to be worth getting good at.

</comment></comment></comment><comment><USER9> It's open source, too [https://github.com/HabitRPG/habitrpg](https://github.com/HabitRPG/habitrpg)

<comment><USER10> I wish someone would have forked it with a different theme (something like default bootstrap text only instead of the 90's RPG look).

</comment></comment><comment><USER11> We have deployed HabitRPG at work and use it to manage our sprints.

As far as we know, it's not really free and open source. There is hidden stuff to enable "Diamonds" the item that lets you do every single fun thing in this game.

So we have developped The HabbitRPG Black Market. It integrates into habbit RPG and lets you buy diamonds: [https://github.com/titilambert/Habit-Black- Market](https://github.com/titilambert/Habit-Black-Market)

I may be wrong and it may just be badly documented.

</comment><comment><USER12> I am surprised how many of those habit-building apps completely ignore that there is a weekend.

I've been using Commit for a while and - because I am a bit lazy in that regard - committed to tracking my time properly every day (instead of as a bunch after 2-3 days). (I usually keep a note around)

Now, I obviously don't do that on a weekend, but it still breaks my streak all the time, which makes the streak kind of moot.

I have the same issue with GH streaks: I would enjoy if the whole system was more lenient, allowing days off the chore.

<comment><AUTHOR> HabitRPG allows you to pick weekdays on which your daily activities are active, so the weekend is actually covered. What I do miss is having tasks that are weekly or monthly.

<comment><USER12> Huh? I looked around but didn't find that. Thanks!

<comment><AUTHOR> Once you create the daily, click the little pen on the right, and the item will expand and show a configuration, with the active days, among others.

</comment></comment></comment></comment><comment><USER13> I quite enjoy "my life" the rpg. I could do without the grinding for items though. Also, my characters appearance is frankly ridiculous and I have failed to find a way of customizing it. I'm starting to think I picked the wrong class to begin with.

</comment><comment><USER14> Looks very interesting!

One thing:

> If your health drops too low, you die and lose some of the progress you've > made.

I think when losing some of the progress, I would just give up on the game. Real life would already be negative, so I wouldn't need something negative to happen in the game as well, so the easiest improvement at that point is to stop the game :).

<comment><USER4> _> I think when losing some of the progress, I would just give up on the game._

I don't think anybody really dies while he's actually playing, in the sense that you can easily salvage your character at any point by just deleting all tasks.

The point of the game is to motivate you into doing chores; a low health bar should give you the motivation to reassess your priorities, get a reality check, and rearrange your tasks so that they can be dealt with more realistically. If you can't do it right away, take a rest in the Tavern and come back later with a better plan and a simpler approach: chuck all the "deep red" items, and start with ONE OR TWO VERY SIMPLE TASKS you can reliably achieve. Once you've got your health back, get more adventurous and start adding hard stuff back in, slowly.

In most RPGs, if you can't defeat a monster, there is no point in immolating yourself; it's better to run, hide, grind out easier enemies, and come back when you've leveled up. The real-life equivalent is a honest reality check about what you can and cannot do right away.

</comment></comment><comment><USER15> Advertising FB authentication and then telling me in the Android app how I need to copy big strings from a webpage.

Bad UX ;)

</comment><comment><USER16> As a feedback: the German copy text ... does the job. Someone on the team had German in school? Quick job from fiverr.com?

Graphics and UI look nice and engaging.

Philosophically, I'd consider that our society, our generation is already living way more quantified and optimized than any previous generation: Technology provides the numbers, the internet lets us compare ourselves with the very best at anything.

With this game, you are also holding the carrot on the stick for yourself - Leonardo DaVinci or Elon Musk didn't have to do that - something _else_ made them do what they did.

Without meaning to trash your app entirely, I'd suggest

\- focus on that one task that _really_ moves things forward (instead of doing push for secondary points)

\- staying alert for the effect of the (self-)optimization - megatrend on employees, children etc.

</comment><comment><AUTHOR> I just thought I would post this here, I am not involved with the project but I have been using it for a while, and I think it is a very nice example of gamification being used for good. I am not even usually into role playing games but I have genuinely managed to get myself excited about levelling up my character and collecting gear.

</comment><comment><USER17> Being Beethoven [0] is another habit building iOS app. The idea is that you adopt daily habits and rituals from the most effective and creative people in the world. At the moment they have Richard Feynman, Lev Landau, Elon Musk, Bruce Lee, Bill Gates, etc.

[0] [https://itunes.apple.com/app/being-beethoven-adopt- daily/id9...](https://itunes.apple.com/app/being-beethoven-adopt- daily/id908987642?mt=8).

</comment><comment><USER18> Chains.cc[0] is another tool which on the same lines of making it easier to build habits. It does not have any gamification elements, but it is still a simple and nice app for tracking habits. Wish they had an Android app though!

[0] - [https://chains.cc/](https://chains.cc/)

<comment><USER8> They still don't have an Android app? Damnit, I stopped using it because they didn't have one, and that was like, a year ago.</comment></comment>


Mailpile - <AUTHOR> https://www.mailpile.is/

<comment><USER2> Previous discussions:

[https://news.ycombinator.com/item?id=8315086](https://news.ycombinator.com/item?id=8315086)

[https://news.ycombinator.com/item?id=7162299](https://news.ycombinator.com/item?id=7162299)

[https://hn.algolia.com/?query=mailpile&sort=byPopularity&pre...](https://hn.algolia.com/?query=mailpile&sort=byPopularity&prefix&page=0&dateRange=all&type=story)

</comment><comment><USER3> So, it reloads the whole page on every email view? I don't mean to pick nits, but that's a pretty big disappointment, in terms of UI responsiveness. It's "double-click wait double-click wait double-click wait"; I expect email to be really freaking fast. My local mail clients (Geary and Thunderbird are my preference) are fast. One of my webmail clients is fast (GMail); the webmail project I help maintain (Usermin) isn't particularly fast, but it's a lot faster than this (and only reloads the mail div or frame, depending on the theme in use).

I understand the desire for a more secure mail client...but, I'm not sure this is dramatically more secure than existing mail clients that support mail encryption (all of the ones I've mentioned above support GPG encryption, except GMail, maybe?). Admittedly this client seems to support encryption of the entire mail store, which _is_ cool, and something I should think about adding to Usermin.

I'm afraid this project put out a lot more hype than was warranted. They've been at this for how long?

<comment><USER4> The UI will become more AJAXy before 1.0, we're doing it progressively instead of making the whole thing JS only. So we get the UI working as a static page, and then progressively enhance. If you want to see it in action, you can try `plugins/load autoajax` on the CLI and see a lot of things go much, much faster. It's not done though, so lots of functionality breaks, which is why it is not yet the default.

Regarding the security stuff - supporting GPG is one thing. Making it usable is an entirely different beast, one which most mail clients have more or less failed at so far.

Sorry you feel disappointed (or are you just pissing on the competition?), but it turns out that this project is actually a rather large task.

We've been working roughly full time for about a year and a half, most of the time with one programmer (myself) for all the low level tech stuff (security, mail handling, packaging, you name it) and one person to do UI design and interface work. Life got in the way of our third team member contributing a lot of code, I'm afraid.

<comment><USER3> _Sorry you feel disappointed (or are you just pissing on the competition?)_

No, it's not the competition thing at all, though I can see how it might seem that way. I've been following Mailpile for a while with interest. We ship several installers for open source mail clients, and we even donate to some of them and contribute patches to them.

It's kind of an accident of history that we make a mail client; there wasn't anything comparable at the time Usermin came into existence (and on some fronts still isn't, due to Usermin's broader feature set, covering things like uploading and downloading files, file management, database access, system password changes, various types of user configuration, etc.). We don't really spend enough time on it for it to be an awesome mail client, and we don't have a good UI developer on-board, and we get excited when we can ship something else that is more awesome. Most of our users prefer Roundcube to anything else we support, and we're OK with that. If Mailpile becomes awesome, we'd be OK with our users liking it more than Usermin for most use cases.

I hope it wasn't too discouraging to read my criticism. It wasn't intended to be disheartening, though I guess I was harsh at the end (I've been following it so long, and with such enthusiasm, I'm a little frustrated it isn't awesome yet). I do think you'd be well-served to fight harder to get the UI really _right_ and really _fast_ , right out of the gate, before widespread usage. We're in the midst of UI growing pains (and really have been our whole existence as a project; Webmin is ugly as hell, but does so much more than anything else in its space that it still gets downloaded a shit ton, but it would make a lot of people happier if it also looked nice and felt nice to use).

</comment></comment></comment><comment><USER5> I'm not sure where you'd run this. Most cloud compute providers intentionally list their network blocks on blacklists to reduce their attractiveness to spammers. Some consumer-class broadband providers do the same and some even block inbound port 25. There's also the issue of reputation-based classification of incoming email at the major providers--you may not do well against those measures using this.

<comment><USER6> Mailpie seems to be a webmail client, and only that. Thus, inbound blocking doesn't matter, only outbound.

</comment></comment><comment><USER7> There is a folder in bookmark bar named "Web Shiz" in the screenshot

</comment><comment><USER8> Fire your designer

<comment><USER2> Comments like this are not welcome on Hacker News. Please try harder to follow the site guidelines:

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

[https://news.ycombinator.com/newswelcome.html](https://news.ycombinator.com/newswelcome.html)

[https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

<comment><USER4> Yes, I'd love to get some constructive criticism to work with (we do listen), but that's not helpful.</comment></comment></comment>


Devver: Closing up shop - <AUTHOR> http://devver.net/blog/2010/04/closing-up-shop/

<comment><USER2> I hate to see another TechStars company fold. I was pulling for you.

</comment><comment><USER3> I had a chance to meet the devver guys, both very engaging and intelligent people. I know shutting down devver has to be incredibly painful, but I'm sure they'll put the lessons learned to great use in the near future.

All the best to both of you guys.

</comment><comment><USER4> Wow, this is an awesome service I wish I knew about previously.

Are there open source alternatives? Our full suite can take considerable time to run, and it would be amazing to reduce that time.</comment>


Before the Garden Gnome, the Ornamental Hermit - <AUTHOR> http://www.atlasobscura.com/articles/the-history-of-hermits-in-gardens

<comment><USER2> What a terrible job to have: seven years of living in a shack, not talking to anyone, not allowed to wash yourself or cut your fingernails.

Fortunately it appears not all hermit employers were so draconian. This sounds like an interesting form of entertainment:

 _" You pull a bell, and gain admittance. The hermit is generally in a sitting posture, with a table before him, on which is a skull, the emblem of mortality, an hour-glass, a book and a pair of spectacles. The venerable bare- footed Father, whose name is Francis (if awake) always rises up at the approach of strangers. He seems about 90 years of age, yet has all his sense to admiration. He is tolerably conversant, and far from being unpolite."_

I'm now hoping for a smartphone app called _Hermit_ , which does exactly what is described above. The "tolerably conversant" 90-year-old sounds like a fun kind of AI to write. Compared to the stuff I do on a phone in idle moments, chatting with a simulated hermit while contemplating a _memento mori_ desktop seems positively useful.

<comment><USER3> Indeed, that paragraph seems to describe every caretaker of every minor out- of-the-way historical landmark ever.

</comment></comment><comment><USER4> With mentioning Tom Stoppard's play "Arcadia" here: [http://en.m.wikipedia.org/wiki/Arcadia_(play)](http://en.m.wikipedia.org/wiki/Arcadia_\(play\))

Lots of hermit and general landscape architecture intrigue, and a character based on young Ada Lovelace.

<comment><USER5> ...and a (deliberate) mistranslation of "et in Arcadia ego". I saw it when it opened in '93 and it made a big impression on me. Stoppard is the Stephenson of the stage.

<comment><USER6> I can't tell if this is meant to praise or insult Tom Stoppard.

<comment><USER5> Wow, no, it was meant as praise! He's sly, clever, witty... just what I like.

If you have seen the play, you'll see what I meant about the deliberate misuse of the phrase. Most people without a classical education misunderstand and misuse the phrase (and have for centuries) which Stopard slyly twisted for comic effect. (OK, it's snobbish, but really, any domain-intensive joke is snobbish to people who aren't fluent in the domain. You can make such a joke without mocking the people who don't get it.)

The point is to highlight in an amusing way the way memes mutate.

For example the book "The Ugly American" made a really important point about foreign aid, anticommunism etc...but people read the title and used the phrase completely backwards. OK, the new meaning also makes sense but completely misses the important point made by the book.

Or people who use the phrase "the third world" and don't realize it's a French Revolution reference. Which causes them to make useful retroformations like "the second world" which sound ontologically bizarre but actually perfectly sensible if you can forget where the term came from.

And speaking of "et in Arcadia ego"...well let's say that only the misunderstood interpretation adds an undercurrent of humor to HN story from yesterday ([http://www.latimes.com/entertainment/arts/la-et-cm- arcadia-i...](http://www.latimes.com/entertainment/arts/la-et-cm-arcadia- immigration-architecture-20140511-story.html) / [https://news.ycombinator.com/item?id=8707913](https://news.ycombinator.com/item?id=8707913) ).

Speaking of snobbishness and reverse snobbishness: liking puns about group theory, lambda calculus, or loop optimization doesn't preclude liking puns in dead languages about ancient philosophers. Or vice versa. The Two Cultures are alive and well but it doesn't mean anyone is compelled to live that way.

<comment><USER7> The "Third World" is a Cold War, not French Revolution reference. There may have been a use of the term in the context of the French Revolution, but the use that has evolved into a reference to less-developed countries mutated from a term for nonaligned countries in the Cold War which was detached from any similar term that may have been used in the context of the French Revolution.

<comment><USER5> Sorry dragonwriter, you make my point.

The term "Tiers Monde" was coined in an essay by Sauvy specifically making the analogy to the Tiers Etat (third estate) of pre-revolutionary France. The point being that the dispossessed majority rose up and overthrew their seemingly entrenched overlords, and that by analogy the disenfranchised poor of the world would rise up and overthrow the then global powers (USA & USSR) of the cold war.

Now academic revolutionary theory had already moved on by the time he wrote that (revolutions like the French or American are clearly the revolutions of the upper middle classes, and even the major communist revolutions of Russia and China were instigated and lead by upper middle class bourgeois who used the poor to help achieve their own ends). But the simplistic marxist view of class struggle was still popular in the press and much of the populace (and was still considered legit in academic settings too until the 90s).

Now as a kid/teenager during the cold war I spend part of my life in India (famously non-aligned; Nehru even foolishly turned down a seat at the security council to make this point) and France and the origins and implications of the term were important parts of how geopolitics was viewed. However in the States, all the context is stripped out rendering the analogy simplistic at best and ultimately not really formative (we already know that there are poor countries -- simply using a new name adds no value). In fact even today I look at my kid's high school american history textbook (stops and rummages in kid's backpack to confirm) and even in _American_ history it seems most of the context has been stripped out. I guess it's too contentious, or perhaps controversial.</comment></comment></comment></comment></comment></comment>


Apple could be forced to stop completely encrypting iPhones under UK law - <AUTHOR> http://9to5mac.com/2015/11/02/apple-encryption-uk/ <comment><USER2> If Apple really believed in their customers' privacy, the could:

\- Just stop selling the phones in the UK.

\- Sell breakable phones in the UK, but explicitly mention that they are no as private as iPhones sold elsewhere in the world, and that "we really don't think you should buy these."</comment>


Online flag waver - <AUTHOR> https://krikienoid.github.io/flagwaver/ <comment><AUTHOR> I use this to test flags. A flag may look fine when flat and still, but it has to work and be recognizable under windy conditions too.

<comment><USER2> Just out of curiosity — what is it that you do that requires creating (I assume) a large set of new flags?

<comment><USER3> In my case, I work for a design studio that often creates branded flags (along with awnings, signage, stickers, etc) for restaurants and other storefronts. This is going to be great for our designers to test out what their flags will look like under semi-realistic wind conditions!

<comment><USER4> What types of patterns don't work on realistic flags?

<comment><USER3> Stuff that's heavily reliant on text, mostly. So we'll try to use logo marks that are identifiable as the brand instead of using the full place's name.

<comment><USER5> Sounds like adapting rules for mediæval heraldry might be useful for y'all. Shields & livery, after all, were meant to be clearly visible from a distance, in poor conditions, while the viewers were in psychological distress.

Likewise, flags which use bold swathes of colour & logos are more likely to be recognisable than wordy texts.

</comment></comment></comment></comment></comment></comment><comment><USER6> If you don't see the flagpole, your WebGL implementation might be broken. I had to launch Chrome on a dedicated GPU (using optirun/bumblebee), it didn't work on the Intel one. A lot of stuff is logged into console, the relevant part is probably "extension `GL_ARB_gpu_shader5' unsupported in fragment shader". I guess my laptop is just too old.

Thinkpad T420, i5-2540M (didn't work) & Quadro NVS 4200M (works), Linux.

<comment><USER7> Anyone had any luck with Firefox on any system?

<comment><USER8> Firefox Focus on Android works fine

<comment><USER9> That uses a Chrome rendering engine.

</comment></comment></comment></comment><comment><USER10> The title immediately made me think that this would be a competitive multi- player webgame that invoked the patriotism of users to keep their country's flag flying.

<comment><USER11> Every tweet with a country's hashtag provides a tiny little gust of wind to their flag.

</comment></comment><comment><USER12> Sharing these is very hard as the URL takes the b64 content and most places i've tried to send this don't take URL's this long (i cannot even shorten it with bitly or our internal url shortener). It'd be nice if it took the URL to make this happen!

<comment><USER13> If you hand it an URL, the URL remains an URL.

E.g. [https://krikienoid.github.io/flagwaver/#?src=https%3A%2F%2Fu...](https://krikienoid.github.io/flagwaver/#?src=https%3A%2F%2Fupload.wikimedia.org%2Fwikipedia%2Fcommons%2Fthumb%2Ff%2Ffb%2FFlag_of_Germany_%2528state%2529.svg%2F1000px- Flag_of_Germany_%2528state%2529.svg.png)

<comment><USER12> Thanks and interesting, i passed it a URL but it gave me a b64 version. I am wondering if something changed. I certainly didn't provide it b64 previously.

</comment></comment></comment><comment><USER11> From the code:

[https://krikienoid.github.io/flagwaver/js/flagwaver.js](https://krikienoid.github.io/flagwaver/js/flagwaver.js)

Aug 3 2012

Since I started working for a new startup not too long ago, I commute between home and work for over 2 hours a day. Although this means less time on three.js, I try getting a little coding on the train.

This set of experiments started from a simple hook's law doodle, to spring simulation, string simulation, and I realized I once again stepped onto physics and particle simulation, this time, more specifically soft body physics.

Based on the "Advanced Character Physics" article, this experiment attempts to use a "massless" cloth simulation model. It's somewhat similiar but simplier to most cloth simulations I found.

This was coded out fairly quickly, so expect more to come meanwhile feel free to experiment yourself and share

Cheers, Graphics Noob (aka @Blurspline, zz85)

Suggested Readings:

Advanced Character Physics by Thomas Jakobsen Character:

[http://web.archive.org/web/20070610223835/http:/www.teknikus...](http://web.archive.org/web/20070610223835/http:/www.teknikus.dk/tj/gdc2001.htm)

[http://freespace.virgin.net/hugo.elias/models/m_cloth.htm](http://freespace.virgin.net/hugo.elias/models/m_cloth.htm)

[http://en.wikipedia.org/wiki/Cloth_modeling](http://en.wikipedia.org/wiki/Cloth_modeling)

[http://cg.alexandra.dk/tag/spring-mass- system/](http://cg.alexandra.dk/tag/spring-mass-system/)

Real-time Cloth Animation:

[http://www.darwin3d.com/gamedev/articles/col0599.pdf](http://www.darwin3d.com/gamedev/articles/col0599.pdf)

</comment><comment><USER14> Very nice. Is there an option to remove the text and forms once you load a file/url?

My test: [https://krikienoid.github.io/flagwaver/#?src=http%3A%2F%2Fim...](https://krikienoid.github.io/flagwaver/#?src=http%3A%2F%2Fimages.fanpop.com%2Fimages%2Fimage_uploads%2FRepublicans- For-Voldemort-debate-678442_504_157.jpg)

<comment><USER15> [https://krikienoid.github.io/flagwaver/#?src=https%3A%2F%2Fo...](https://krikienoid.github.io/flagwaver/#?src=https%3A%2F%2Fother98-agitpopcommunica.netdna- ssl.com%2Fwp- content%2Fuploads%2Fsites%2F3%2F2017%2F09%2Fb7a563b59a00d847f8025209cba0721d.png)

</comment></comment><comment><USER16> This would have been a great reference during New Zealand's failed flag referendum.

Long live laser kiwi!

<comment><USER17> [https://krikienoid.github.io/flagwaver/#?src=https%3A%2F%2Fi...](https://krikienoid.github.io/flagwaver/#?src=https%3A%2F%2Fi.imgur.com%2FBB25stO.jpg)

</comment></comment><comment><USER18> nope, still no improvement for:

[http://www.idahostatesman.com/news/state/idaho/article720305...](http://www.idahostatesman.com/news/state/idaho/article72030522.html)

<comment><USER19> You have to share the attempt: [https://krikienoid.github.io/flagwaver/#?src=http%3A%2F%2Fww...](https://krikienoid.github.io/flagwaver/#?src=http%3A%2F%2Fwww.idahostatesman.com%2Fnews%2Fstate%2Fidaho%2F1qvgjx%2Fpicture72030512%2Falternates%2FLANDSCAPE_1140%2Fpocatello%2520flag)

</comment></comment><comment><USER20> Only getting a white flag using this:

[https://thepiratebay.org/static/img/tpb.jpg](https://thepiratebay.org/static/img/tpb.jpg)

<comment><USER21> perhaps their hosting service (or your ISP, depending on where the image gets pulled to) blocks connections or DNS lookups to TBP?

Update: looking at the JS console, it looks like CORS policy is preventing this: Access to Image at '[https://thepiratebay.org/static/img/tpb.jpg'](https://thepiratebay.org/static/img/tpb.jpg') from origin '[https://krikienoid.github.io'](https://krikienoid.github.io') has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '[https://krikienoid.github.io'](https://krikienoid.github.io') is therefore not allowed access.

</comment></comment><comment><USER22> It even works perfectly with transparent PNGs!

</comment><comment><USER23> They need to add a giphy option</comment>


Dislodged in New York - <AUTHOR> http://www.nybooks.com/blogs/nyrblog/2015/aug/04/dislodged-new-york-homeless-homme-less/

<comment><USER2> What a pitiful state of affairs we've let be created for our weakest rungs on the ladder. I live here in NYC and seeing the homeless just hits me like a hammer every time, it never gets any better seeing young and old alike with their signs and their desperation.

And to think, a third of the shelter system works full time. Way to go America. You dun good. On my facebook all I see is people talking about how "burger flippers" don't deserve a wage increase. So we've got the poor fighting the poor for the meagerest of scraps in a society which apparently consists of people who can only feel validated if they feel better than the people around them. It truly makes me sad.

<comment><USER3> This guy could do ok pretty much anywhere else. He wants to be in movies, and take pictures of celebrities, even if those industries aren't willing to compensate him properly for his time. That is a far cry from flipping burgers.

<comment><USER4> How exactly does the economics of getting a job flipping burgers in the U.S. work out these days? Not a rhetorical question, I don't actually know the answer. Are employers willing to employ fifty-year-olds in such a capacity? How does the pay compare with cost of housing in any given area? How far would affordable housing be located from the place of work? After paying for housing, transport and health insurance as well as other living expenses, would outgoing still be less than income?

<comment><USER5> Generally speaking the adults doing that stuff are making use of several welfare benefits. A single woman with two kids flipping burgers is often living a lifestyle that would require an unsupplemented income of $50K.

<comment><USER4> Okay, so it sounds like compared to Europe, the U.S. has a thinner safety net such that welfare alone won't keep you afloat, but it will supplement a low- wage job such that the combination will keep you afloat?

<comment><USER6> Just barely afloat. If you get sick, your car breaks down, or any number of other things, you can very easily sink.

</comment></comment></comment></comment></comment></comment><comment><USER7> Yes, homelessness is a problem but they definitely could have chosen a more sympathetic "victim."

While $15k is by no means a gigantic income, it's enough to live on as a single person in most parts of the country. Nobody is entitled to a job as a "photographer" in the most expensive city in the country—if you can't make ends meet, try doing something else somewhere else. Not buying $200 shoes (5x what I've ever spent on shoes) would be a good start.

Why does the media continue to insist on using the least sympathetic faces for societal problems? (See also the fixation on the "plight" of students who have loans from top-tier colleges when the far more endemic problem is people who spend thousands on useless degrees from for-profit universities.)

<comment><USER8> Put yourself in the guy's shoes for a moment, even if they cost him $200 when he bought them, presumably long before he became homeless (good shoes well kept are close to indestructible). He's an aging model (early 40s?), presumably with no other marketable skills, and he's hustling pretty hard to keep his head above water. Yes, he clearly made bad choices when he was younger and that led him to where he is today... but given where he's at _right now_ , what exactly do you suggest that he do?

<comment><USER7> > what exactly do you suggest that he do?

Move to a cheaper city and get a job which pays a low but dependable income. If you're willing to be geographically and occupationally flexible, there's absolutely no reason to end up homeless.

<comment><USER8> What such jobs are readily available to early-fifties retired fashion models? How much are the up-front costs of moving to a new city and acquiring a place to live?

<comment><USER7> > What such jobs are readily available to early-fifties retired fashion > models?

He doesn't need a "good" job. He could get an hourly minimum wage job and already have an equivalent salary to his current job.

Since he has some nominal "fashion" experience, retail might be a good place to start. I'm sure Brooks Brothers wouldn't mind hiring a former male model to sell clothes.

> How much are the up-front costs of moving to a new city and acquiring a > place to live?

Honestly, it's probably an upper limit of $5k (I've moved for far less). But he got a lump sump payment of $30k for leaving his apartment—equivalent to two years salary. That's surely enough to move anywhere in the country and find a decent, affordable housing situation.

<comment><USER8> Dude's homeless and living under a tarp on approx $15k/year from odd jobs. Do you really think he's got $5k socked away in savings? He got that lump sum _years_ ago.

<comment><USER7> But where did the $30k go?

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> This kinda seems like a choice that the subject is making. He could do a less "glamorous" job and not live in one of the most expensive cities in America if he wanted to.

</comment><comment><USER10> We can act like this is an issue of social services or redistribution or other cool left wing causes, but this is simply an issue of arithmetic. If we want to house more people, we need more houses. In spite of what you read in the newspapers, there is no construction boom:

[https://docs.google.com/spreadsheets/d/1Z81YIgZSAAtqpp-6AihL...](https://docs.google.com/spreadsheets/d/1Z81YIgZSAAtqpp-6AihL8f1CBXbcFJIlhVy_WMy9XDU/edit#gid=713809792)

Either build more houses or accept that some people will go without.

<comment><USER7> I agree with that viewpoint (major cities need to stop constricting the housing supply), but arguably it's also a problem of demand entitlement.

There are places in this country where he could have bought a small house with the $30k buy-out he got. Living in an expensive city and working in an artistic profession is a _choice_.

</comment></comment><comment><USER11> It's nuts how much we value a dollar over literally anything else. A neighborhood of people who've built up a life in an area? Too bad if some rich people want to invest in a building, you're out by hook or by crook. We've got to learn that as more people move to cities there are other important things to living than squeezing every nickle out.

<comment><USER12> It isn't that we value the dollar over anything else. It's that the dollar is a proxy for whatever we value. That makes it universally desired by all people with their highly diverse ambitions and goals.

</comment></comment><comment><USER13> Now, come on, this is just downright idiotic. I have a friend in Chicago who works 40 hours a week as a lube tech, makes about $28k a year, and is able to support his mother, own a modest house and 2 cars. Is this guy entitled to live in NY? Is anyone? What's wrong with Chicago, or Kansas City, or any other fine city in the US. Does every one HAVE to live in NY or LA or SF?

Also, I really get annoyed with the stereotypical evil landlord depictions. For instance, here is a story about a couple I personally know in LA. They are Mexican immigrants. They both worked hard their entire life. About 20 years ago they purchased a house in central LA. for the last 9 years they have been renting out a portion of their house to a woman and her daughter for $800/mo. Most of the time they would get rent late, and some months not at all. Now they want to retire and sell their house, take out the equity, and move to a cheeper area.

One problem though, they can't. The woman will not move out, and no one wants to buy the house with a current tenant. First she demanded a $19,000 relocation fee, which is required by the City of LA. But you have to remember, this is equivelant to her basically living in this place rent free for 2 years. But that's not all, she also said that she will not move out unless they can find her a little HOUSE (as in with backyard and all), in Santa Monica, where she can pay no more than $800/mo! Legally they can not evict her, and can not sell their house and retire. She is literally holding them hostage. Is that fair?

The point is, no one is entitled to live in NY, SF, or LA. And once you make the move, you might realize that their plenty of nice places out there in US.

<comment><USER14> > Is this guy entitled to live in NY? Is anyone? What's wrong with Chicago, or > Kansas City, or any other fine city in the US. Does every one HAVE to live > in NY or LA or SF?

No one wants to leave his home just because some rich asshole decides he wants to make a shitload of money. (And no, the option to stay is not an option if your landlord is one of the mentioned mafia-like ones)

<comment><USER13> You mean to say: No one want's to leave someone else's house, especially if they get to stay there for way, way, below market rate, just because the actual owner of that house wants to sell that house or fully utilize their investment.

The problem with SF, NYC, and LA is that more people want to live there than is currently possible by the housing market. As a result, supply of available units is overwhelmed by demand. So, if you are looking to blame some one, blame all those people who want to move to NY and are willing to pay more then the next guy for an apartment. If no one was renting these apartments for the price they are currently renting for, the price would fall. That's the definition of market price.

Further, with the internet connecting us closer and closer, I can not imagine where this drive to pack as many people as possible within as small of a place as possible is coming from. I understand that some will argue that high density community impacts the ecology less because you don't have to drive as much. Ok, I'll buy that argument, but can't we have more high and medium density communities in US instead of packing more and more people into the same 3-4 places around the country.</comment></comment></comment>