0942v8653

Wouldn't say that IRC has the same exact functionality as Slack. But the Slack mobile app does, and it runs far better than the desktop version (starts up in 3 seconds on a low-powered device instead of 30 on a much faster machine).

> in-browser password storage is insecure

> (If you don't use a master password, which isn't required, I believe?)

When using a cloud-synced password vault that lands on the servers of a third party (this includes Firefox, Google, 1Password, Lastpass, etc.) you must always assume that the file itself is compromised; the only thing between an attacker and your passwords is the encryption by your master key.

I seriously doubt that Firefox Lockbox will allow you to cloud-sync your password file without setting a master password. *

Note: One of the first things malware authors typically go for is the password vault stored in browsers, but this is only because it is commonly used without any master key set.

* It might depend on some key derived from your account password, if you haven't observed the requirement of a master key. Not sure.

I'm not sure why this is being downvoted, as it's totally true. See the E-Sports Entertainment, LLC case:

https://nj.gov/oag/newsreleases13/E-Sports_Complaint_Consent...

Relevant quotes:

> Among the many monitoring activities conducted by ESEA, the ESEA Software was programmed to automatically capture screen shots of computers, track computer mouse movements, and monitor end-users' computer activities even when they were not logged onto ESEA servers.

> ESEA did not place any restrictions on Hunczak and Thunberg's ability to access end-users' computers.

> ESEA did not put policies and procedures in place to ensure its employees were not abusing their full administrative access privileges or inappropriately accessing end-users' computer files.

> From at least April 12,2013 through April 30, 2013, the ESEA Botnet used the GPU of end-users' computers to mine for bitcoins without notice to and authorization from, or in excess of authorization from, end-users.

(By "techniques commonly used by malware", I mean the data harvesting, screenshots, and remote access capabilities exploited by the defendants.)

Certainly. But I think the gp is referring to the idea of putting a single greater-than sign at the beginning of a long, soft-wrapped paragraph. 4chan (and other sites) would highlight the whole paragraph, but on HN if it is very long it isn't immediately obvious that it's a quote. Hard-wrapping the quote and putting a greater-than sign in front of each line, as in email or Usenet is much clearer than the style typically used on HN.

HN does get updates occasionally, e.g. the mobile width change that happened a couple of years ago. I suppose there hasn't been a pressing need to make any changes.

If any sweeping redesign occurred the entire userbase would surely be angry.

Hmm I guess you are right, I was just thinking of the simple case (run on your own metal, no external JS, etc...). I am just uncomfortable with the amount of data that passes through Cloudflare and especially the idea of depending on them just to gain HTTPS support (which you could do almost as easily in other ways). Cloudflare as proxy seems at odds with a decentralized view of the web.

IMO this is dangerously harmful advice. Even if you do the Full SSL (Strict) version, you are trusting CloudFlare with all data. It's probably fine if you are just doing a static site or something, but the fact that CloudFlare has access to users' passwords gives me the creeps.

(You are also trusting CloudFlare to generate the private key of your web server, which is no big deal if you are already using their services between you and the user, but might be more complicated if you decide to trust that cert for internal use.)

Ultimately I only recommend this if you want a fast fix to prevent public wifi operators from injecting stuff into your HTTP content. Any other use and you'll not be able to sleep at night wondering what kind of data CloudFlare has stored.

How about changing your javascript bookmarklet to do 'if on news.ycombinator.com, use the url of the first a.storylink'. That way it can be done from the comments page.

Perhaps it would be best if sensitive options such as the post-checkout hook could only be stored outside of the repository altogether. Given this vulnerability and the semi-recent .GiT/config vulnerability[0], I would not be surprised if other attack vectors are lurking under the surface.

Storing config data outside the repo would not be a foolproof solution, but it would probably make things a little safer. (Having the <repo_root>/.git folder has always felt a little bit "in-band" to me, and I don't like it.)

[0]: https://news.ycombinator.com/item?id=8769667

I can run WebDAV both client and server on my iPhone, which makes it pretty convenient to transfer files to and from it.

Apple is already serious competition against Chromebooks in education. I know of no school district near me which uses Chromebooks, but a few that use iPads.

Plus, it's easier to add a keyboard to an iPad than to remove it from the Chromebook (and replace with touchscreen).

> Some of my friends willingly opt into streaming their position in real time continuously through their smartphones

How do you avoid this? I have a GPS in my car with stored routing information, but if I need to navigate for someone else or get walking/biking directions, I am forced to do this. Printing out directions beforehand is something I did only a few years ago, but these days I don't always have a chance to do that.

While a lot of the real advances in language design are not new, popular adoption of stuff like functional programming has happened in large part in the last twenty years. E.g. list comprehensions in Python were not introduced until Python 2.0 (2000, which just squeezes into your range). And Java is starting to get similar features, which is great for companies who have invested in the language.

For a lite version of this, take a look at Vim's conceal patch: http://vim.wikia.com/wiki/Patch_to_conceal_parts_of_lines

I don't understand this. Rice, potatoes, vegetables are still cheap here. I guess if you're looking at restaurants, this is true. If you are with a group and have to go eat somewhere, they usually provide healthy options which are not too expensive compared to the unhealthy ones (though sometimes, that's just due to smaller portions).

Maybe you have a different experience, having just visited, instead of living here.

addendum: it also depends quite heavily on the area's cost of living, apparently. I just bought a sack of potatoes for $0.40/lb, whereas https://news.ycombinator.com/item?id=16448984 says potatoes in LA are $1.88/lb (nearly 5x as expensive).

>> Why would anyone buy [brand toothpaste vs store-brand toothpaste]

> Taste, familiarity, trust.

That's the idea; familiarity and trust can be manufactured through advertising. You can become familiar with a brand name just by being exposed to it, and trust is harder but advertisers have it down to a science in some important ways.

Also it looks like the mailto is missing an @email-domain.

I find the security benefits of a popular, frequently-updated browser (not IE11) far outweigh the risks posed by use of a rendering engine that certain companies have touched. I echo the suggestions of a WebKit browser or, failing that, Mozilla Firefox.

I would be concerned about links like https://news.ycombinator.com/item?id=10920180 … if you want to do this for yourself only you could easily make a browser extension.

The other issue is that HN will effectively have to store every link you click on the site. I'm not sure I'm comfortable with knowing that is stored.

Will the UK still participate in the GDPR after Brexit? Are there plans to write up something similar?

What about using white noise?

It's a dreadful abuse of the Sapir-Whorf hypothesis, but you should watch it anyway. Agreed.

There's a chasm of difference between electing not to consume some form of entertainment, and refusing to listen to an argument or speech in a university environment.

Most of the time when harm to a child is depicted in a film or television show, it is sort of a cheap, unfair way to get at the viewer's emotions.

What is suggested here is nowhere near the same thing as having a "safe space" which restricts the speech of others.

Social media is one of those things which by nature is difficult to break up. I'd say it's as hard to really fix as any natural monopoly.

Facebook is not near as bad as Google is in terms of quiet influence, at least among the younger generation.

What if you put it into a video? Photoshop it into a meme? Drop it in to an internal presentation?

These are all situations where the copyright of a stock image owner is infringed and yet there is very little that automated processes can do to detect them.

Yes I distinctly remember using Terminal's tabs on snow leopard (10.6), confirmed by [0]. Also, I believe 256color was available in that release, though I'm less sure.

[0]: https://stackoverflow.com/questions/6736602/how-do-i-set-mac...

I believe the Apache license is what you want (so long as you trademark the branding).

Hey, that's my thread! In case anyone's wondering, I ended up with a $25 Nook Simple Touch. If you just want the screen and no touch capability, then look through the rest of the thread. Unfortunately, I have not had the time to play with it much yet, but I can tell you the rooting process works very smoothly for the NST.