Hacker News Reader

aplorbuston Understanding the Limitations of HTTPS

More than 50% of the websites found through HN at present do not require SNI. Do you think this is also true of the https-enabled www as a whole?

SNI was introduced to address the problem of shared hosting with respect to SSL/TLS. In the not-too-distant past, SSL/TLS required a dedicated IP address for each HTTPS-enabled website. One certificate per IP address.

There are still many, many websites that satisfy that requirement.FN1 I know this because I use unpopular customised HTTPS clients and have SNI disabled by default. I only enable it when necessary; I have automated this to happen automatically if I receive an SNI error.FN2 Most of the time, I get no such errors.

FN1. I am tired of articles which ignore this fact. If one assumes that all HTTPS-enabled websites require SNI, then one is making an incorrect assumption. For users, the current SNI implementation (sending hostname in plain text) is a problem; people are trying to fix it, as the blog mentions. For website owners and hosting providers, current SNI implementation may not be a problem. I am viewing SNI from the user perspective. I respect other perspectives.

FN2. Most of the sites requiring SNI are Cloudflare sites. As the blog mentions, unless the customer pays additional fees to use their own certificate, Cloudflare acts as a MITM and the user only sees Cloudlfares certificates, not the target websites. This is HTTPS as between the user and Cloudflare, and then (hopefully) between Cloudflare and the target website. It is not HTTPS between the user and the target website.

Edit: Note, FWIW, I do not use third party DNS and in fact do not use recursive DNS at all. I retrieve, store and update DNS data and serve it from localhost bound authoritative nameservers. (I also encrypt DNS packets with CurveDNS in the home lab and with the few remote servers on the intenret that support DNSCurve.) I wrote a custom "non-recursive" stub resolver (for speed not privacy) that outperforms a cold recursive cache. It does not query root servers and minimizes queries to TLD servers and remote authoritative nameservers as it learns from previous answers and updates constant databases and zone files accordingly. Over time, it sends less queries than a recursive cache.

aplorbuston Pass-Through Businesses Are Rethinking Their Status in Wake of Tax Law

https://www.wsj.com/amp/articles/tax-law-leaves-business-own...

Either view in "Reader Mode" in a popular browser or remove the Javascript before viewing with something like

    1. curl -4o 1.htm https://www.wsj.com/amp/articles/tax-law-leaves-business-owners-with-big-decision-to-c-or-not-to-c-1519295401?tesla=y

    2. sed -i -n '/<title>/,/<\/title>/p;/<p>/,/<\/p>/p' 1.htm

    3. open file:///1.htm in browser

aplorbuston The reason Facebook won’t ever change

It appears that the "statistically invisible" commenter is at the forefront of your thoughts, to an extent where you feel the need to address her/him specifically.

"Many people vote with their time and attention." .

Of course. We could argue that you have voted with your comment. The "statistically invisible" commenter got your time and attention (=vote).

"Facebook measures how people behave, not what pundits say."

There is a saying that goes something like, "What you measure you can control." It follows that what the "pundits" posit outside of Facebook is not something Facebook can control.

Its simple. Users and non-users will stop publishing comments about Facebook when Facebook loses popularity.

aplorbuston Hacker News's Undocumented Features and Behaviors

"pg" is still making statements, e.g., in this thread, as "pvg".

What was the motivation for hiding scores? Was it to prevent exactly what you describe? (i.e. downvoting based on view that a comment received "too many" upvotes)

What happened to polls; HN used to have them. Wouldnt they accomplish the desired behaviour? (i.e. measurement of disagreement)

aplorbuston The reason Facebook won’t ever change

"Large companies are somewhat like me - once they get used to a certain behavior, they develop a certain culture and a set of procedures, processes and a work environment that defines them and their future. These define their corporate DNA. It is hard to change. You can't buy new DNA, and companies can't acquire their way into new corporate cultures. Furthermore, companies that lack that self-awareness of their DNA and behaviors, in the end, find themselves extinct.

  The Corporate DNA

DNA contains the genetic instructions used to build out the cells that make up an organism. I have often argued that companies are very much like living organisms, comprised of the people who work there. What companies make, how they sell and how they invent are merely an outcome of the people who work there. They define the company."

source: https://om.co/2011/02/11/change-is-good-but-its-also-really-...

"You can't buy new DNA and companies can't acquire their way into new corporate cultures." - Om Malik

Is there any other way a company could acquire "new DNA"?

151 "virus" wn "WordNet (r) 3.0 (2006)"

virus

n 1: (virology) ultramicroscopic infectious agent that replicates itself only within cells of living hosts; many are pathogenic; a piece of nucleic acid (DNA or RNA) wrapped in a thin coat of protein

     diff -q googledna.2018 googledna.1998 || cat googledna.1998

"Appendix A: Advertising and Mixed Motives

Currently, the predominant business model for commercial search engines is advertising. The goals of the advertising business model do not always correspond to providing quality search to users.

   * * *

For this type of reason and historical experience with other media [Bagdikian 83], we expect that advertising funded search engines will be inherently biased towards the advertisers and away from the needs of the consumers.

Since it is very difficult even for experts to evaluate search engines, search engine bias is particularly insidious.

   * * *

For example, a search engine could add a small factor to search results from "friendly" companies [e.g., the search engine company itself, its subsidiaries, companies that use AMP, etc.], and subtract a factor from results from competitors.

   * * *

This type of bias is very difficult to detect but could still have a significant effect on the market. Furthermore, advertising income often provides an incentive to provide poor quality search results.

   * * *

In general, it could be argued from the consumer point of view that the better the search engine is, the fewer advertisements will be needed for the consumer to find what they want. This of course erodes the advertising supported business model of the existing search engines. However, there will always be money from advertisers who want a customer to switch products, or have something that is genuinely new. But we believe the issue of advertising causes enough mixed incentives that it is crucial to have a competitive search engine that is transparent and in the academic realm."

source: https://dl.acm.org/citation.cfm?id=297827

Authors: Sergey Brin, Lawrence Page

Published in: WWW7 Proceedings of the seventh international conference on World Wide Web

Computer Networks and ISDN Systems

Volume 30 Issue 1-7, April 1, 1998

Pages 107-117

Elsevier Science Publishers B. V. Amsterdam, The Netherlands

doi 10.1016/S0169-7552(98)00110-X

The anatomy of a large-scale hypertextual Web search engine 1998

Citation Count: 3,024

aplorbuston AP photographer Max Desfor dies at 104

Without the annoying ads. Source: AMP, no Javascript, CSS, etc. http://www.nydailynews.com/amp/life-style/remembering-iconic...

aplorbuston $2 hardware SSH keys storage

"... for generation and initial dongle configuration, use secure erase after generation and configuration..."

Is there any reason one would want to use secondary storage versus storing these temporary files in memory, (e.g., "memory disk" or tmpfs)?

aplorbuston A look at the J language: the fine line between genius and insanity (2012)

/After/s/hn.csv/t.kdb/

aplorbuston A look at the J language: the fine line between genius and insanity (2012)

Heres the .q file I use to read HN. Hobbyist programmer; corrections/improvements welcome. Better yet, how would I do this in J?

cat 1.q

   \c 2000 200
   k)-23!t:select from .:`:t.kdb
   k).Q.fs[{`t insert +:`url`title`user`item!("SSSS";",")0:x }] `:hn.csv 
   k)-23!t:?:select from t 
   `:t.kdb set t 
   \\

As for how to get hn.csv, I use shell scripts to download all the pages of HN html (in accordance with robots.txt specified delay). Then I use a simple lexer (made with flex) to transform the html to hn.csv with the above selected columns.

After some years, the file hn.csv can grow quite large, larger than available memory.

To read and select articles from t.kdb, I use less(1) and some small shell scripts.

This lists all the articles, starting after a given offset, or zero by default:

      echo -e '\\c 2000 2000\nk)select i,title from .:`:t.kdb where i>'${1-0}'\n' \
      |exec q > 1;
      exec less 1;

Then, to select and read an article or its comments I use the ":!cmd" feature in less(1) to invoke an appropriate shell script (actually, an execline script). Quit, and I am returned to less.

Have seen lots of systems for reading HN made by HN readers, using various databases I guess. This is mine, using kdb+.

aplorbuston Tractor Hacking: Documentary About Farmers Fighting for the Right to Repair

"Just about everything you own running embedded software that has some update functionality..."

"Worse, just about all these devices have some access to JTAG ports such that you could easily program them yourself if you wanted to and had something useful to flash them with. I've run into so many products I use on a regular basis with bugs or simple but badly needed features that I could have easily fixed/hacked in with access to the source code but alas, I cannot."

IMO, it is a massive waste. Short-sighted, short-term thinking.

There are people who for whatever reason do not want you to have access to the software ("firmware") and to read/fix/improve upon it.

Some of these people comment on HN. They become active during debates over whether users would derive any benefit from being able to read and edit source code.

aplorbuston Chrome will stop displaying ads that are repeatedly flagged as disruptive

Apologies if the comparison offends anyone but every time I see PR (public relations) about ad-blocking by Google, I see them as a company like Goldman Sachs, who has taken positions on both sides of a bet, so to speak.

There is a glaring conflict of interest as others have pointed out; it cannot be ignored. Through strategic acquisitons such as Doubleclick, Google and its subsidiaries are the largest warehouse of advertising on the www. The company is the machine that keeps web advertising humming along.

Google wants to keep everyone happy. Users are fed up with advertising. For example, Google could offer a search engine free of any ads, as they did in the early days.FN1 They have more than enough cash to do it. This would make users very happy. Google could try to support itself by selling something, besides advertising. But this will not happen. Why? (Rhetorical question. Not asking for an answer. We all know what it is.)

By creating a web-advertising juggernaut and collecting the maximum allowable quantity information about users through every means legally possible, (far beyond merely search engine usage) Google has taken a position against users (the ones who dislike ads) as well as for them (as argued in myriad PR pieces).

Google is not curbing it own actions (as the #1 promoter of advertising on the www), instead it is taking aim at advertisers. Some of those could be existing or potential clients (which might seem intriguing).

But while its clients (be they advertisers, users or others) may experience "losses", like Goldman (or not; sorry, bad analogy!), Google always "wins".

Any PR piece proclaiming that Google is taking sides with users (for a "better web") ignores that they also have taken sides with advertisers. Google has big bets on advertising. As everyone knows, users do not contribute significant inputs to the Google balance sheet; advertisers do.

FN1 At that time one of the Google founders called out advertising as being something to avoid. Interestingly, there was no "disruptive" vs "non-disruptive" advertising distinction.

aplorbuston The insane amount of backward compatibility in Google Maps

"Whatsapp actually has a time-bomb programmed in the app of some sort and it will kick you out if it realizes that it hasn't been updated recently."

aplorbuston Older Entrepreneurs Do It Better

Full article always available via ampurl:

https://www.wsj.com/amp/articles/older-entrepreneurs-do-it-b...

Use "Reader" mode in the browser to avoid AMP advertising or do something like

   curl -o 1.htm https://www.wsj.com/amp/articles/older-entrepreneurs-do-it-better-1518098400
   sed -n -i '/<title>/,/<\/title>/p;/<p>/,/<\/p>/p' 1.htm
   firefox file:///1.htm

For even better results use a text-only browser for reading the news. AMP pages look great in a text-only browser. No ads.

aplorbuston The House That Spied on Me

Where is the code/setup configuration for "iotea"?

Ever since "IoT" started gaining momentum as a marketing buzzword I have been thinking this type of router could be an interesting product for non-nerd users.

Idea: The one device that only the user controls. User veto over all traffic to and from "smart" devices. In theory.

I recall seeing a comment from a Googler on HN once that basically admitted the users only hope for privacy is to control a router.

Not a laptop, phone, browser, smart thermostat, smart speaker, etc.

A router.

Boring.

But not insignificant.

Something as inexpensive and accessible as an RPi was good enough for this user.

aplorbuston Regular Expression Matching Can Be Simple and Fast (2007)

"... and the lack of backtracking can be limiting..."

As someone who "gets by" on BRE and ERE, I would consider that a feature.

aplorbuston Chrome 68 will mark all HTTP sites as “not secure”

The simpler solution is to not run that code.

The imaginary user cited does not need that code in order to "browse memes".

The code is there for advertising, e.g., to attract advertisers as customers by gathering data about users.

Hence the push to HTTPS is for companies that aim to generate revenue from selling access to or information about users to advertisers.

I have no problem with HTTPS on the public web, to the extent that it is the concept of encrypted html pages, and perhaps these are authenticated pages (PGP-signed was an early suggestion).

Encrypt a page of information (file), sign it with a public key and then send it over the wire . The wire (network) does not necessarily need to be secure.

However I do have a problem with SSL/TLS.

I would like to leave open the option to not use it in favor of alternative encryption schemes that may exist now or in the future. It seems one allegedly "user-focused" company wants to remove this option. Comply with their choice or be penalized.

The issue I have with TLS is only to the extent TLS is the idea of setting up a "secure channel" to some "authenticated" endpoint (cf. page), with this authentication process firmly under the control of commercial third parties, using an overly complex protocol suite and partial implementation that is continually evolving (moving target) while people scramble to try to fix every flaw that arises out of this complexity.

To the extent it is not what I describe, I have no issue. (That is, I'm pro-TLS.)

We have one company aiming to replace HTTP with their own HTTP/2 protocol, which to no surprise has features that benefit web app developers and the advertisers they seek to attract far more than they benefit users.

Could we design a scheme to encrypt users web usage that would not benefit advertisers? I think yes. But this is not what is being developed. Encryption today is closely coupled with the "ad-supported web". If we are not careful, this sort of policy pushing by Google could cripple the non-ad-supported web that existed before the company was incorporated.

Encrypted "channels" are not the only way to protect information transferred via the web. TLS is not the only game in town.

aplorbuston Tinc VPN: Secure Private Network Between Hosts

"WireGuard Key Generation in JavaScript ======================================

Various people believe in JavaScript crypto, unfortunately. This small example helps them fuel their poor taste."

aplorbuston Tackling the Internet’s Central Villain: The Advertising Business

Internet not same as web. Public web is just one type of internet usage. Almost all ads are on web, triggered from web or html email, leaving rest of internet ad-free. Certainly there are incumbents who want users to think internet and web are synonymous.

Radio and TV were "passive" mediums where broadcasters were in control and audiences passively consumed what was offered. Ads were included. Web has traditionally been more interactive. Users had control of what to consume and when, through specific, focused (HTTP) requests.

No web user intentionally requests ads. Think about this.

The user requests a specific resource.

Then how is advertising being "included"?

Answer: Popular web browsers load resources (ads) automatically, by default. Requests for ads are made by the browser, not the user. Companies that sell ads write these browsers and try to dominate the "browser market". Other web browsers (that might avoid loading ads) are discouraged. Web developers take advantage of the popular browsers written by ad sales companies to manipulate the pages users request, filling them with ads.

Going back into the history of the www and browsers, the intent of auto-loading resources may have originally had nothing to do with advertising. But today, it has everything to do with advertising (and tracking).

aplorbuston How Google Chrome’s ad blocker works

"However, users can't add their own websites to the blocklist."

aplorbuston Patio11 AMA about Japan, Technology, Business and Startups

I understand the differences, however, the term was being used to describe EC2. In another example, I saw Amazon CEO Jeff Bezos in an interview refer to "grid computing" as a synonym for EC2 when describing it to a naive audience. Indeed the AMA authors comment about "setting the world on fire" was responding to the first announcement of EC2, not a general discussion of grid computing. He chose to use that term, rightly or wrongly, because like Bezos he saw it as synonymous with EC2.

aplorbuston RFC: Ubuntu 18.04 LTS Minimal Images

Not a Linux user but out of curiosity just looked at the "Trusty Tahr" 37MB amd64 minimal image (mini.iso).

Most recent amd64 minimal image is 58MB ("Artful Aardvark").

Trusty Tahr bzImage compressed kernel is 5.5MB.

The initrd.cpio.gz is 20MB.

The uncompressed initrd is 52MB.

Assuming most of the initrd size is modules, can the Linux user reduce the size of the initrd by compiling own kernel and creating own initrd with only the modules she needs?

aplorbuston Patio11 AMA about Japan, Technology, Business and Startups

Also from same author, on the emergence of AWS EC2 and S3:

https://slashdot.org/comments.pl?sid=194921&cid=15971343

"... not going to set the world on fire."

But see (also on front page currently):

https://finance.yahoo.com/news/amazon-com-announces-fourth-q...

It seems like AWS is doing quite well.

aplorbuston Alphabet's earnings miss profit estimates as spending grows

Earlier HN title: "Alphabet cracks $100B in annual revenue as advertising soars"

aplorbuston Why Create a New Unix Shell?

This keeps showing up on the front page. No doubt it will have users.

Lets say there are two uses of a shell: 1. interactive and 2. non-interactive (scripting).

Lets imagine the commandline user is learning about her OS. She learns it is heavily reliant on shell scripts to build and (if desired) to automate starting services.

She realises that to understand the OS she will have to learn the shell that the OS developers used for scripting.

Then she realises that if she chooses another shell for interactive use, she will have to learn two shells.

Finally she realises that any script she writes in the "non-interactive/scripting" shell will also run under the interactive one. But not vice versa.

If she only has enough time in life to master one shell, which one should she choose?

Over time I found I really cared more about the scripting aspect of a shell than the interactive facet.

The scripting shell used by the OS authors might be an Almquist derived shell, for instance.

Occasionally the ash Im using gets a new "feature" but not too often. I like that it stays relatively small. The latest "feature" is LINENO.

But I also use a smaller version of this shell with no command line history, no tabcomplete, etc. IMO, there is no better way to learn how to reduce keystrokes. It has led to some creativity in this regard for which I am thankful.

After "mastering" ash, I started using execlineb, pipeline and fdmove. I am starting to use more components of execline and am continually replacing ash scripts with execline scripts for more and more daily work.

I guess we will never see execline on the front page, which I think would be interesting because I would like to hear whatever harsh critique HN can muster.

Seeking a better non-interactive/scripting experience, I have experimented with many other shells over the years, and written simple execve "program launchers", but in this vein, I have not found anything that compares to execline.

The speed gains and resource conservation are obvious, but with the ability to do "Bernstein-chaining" and the option to use djb low-level functions instead of libc, it is a rare type of project.

The speed and cleanliness of the compilation process is, compared to all the other crud one routinely encounters in open source projects, "a thing of beauty". Humble opinion only, but I think others might agree.

aplorbuston LinuxBoot: Linux as Firmware

VGA textmode. I stopped using X11 many years ago. Theres no graphics drivers compiled into the custom kernel that I use (not Linux). The term "no graphics layer" seemed like adequate shorthand.

aplorbuston LinuxBoot: Linux as Firmware

80 and rising. Can we hit 90?

aplorbuston LinuxBoot: Linux as Firmware

60 and rising. Can we make it to 70?

aplorbuston LinuxBoot: Linux as Firmware

50+ points. Amazing.

Anyones guess what this means but at the least I think it shows users1 have opinions about UEFI. I think it is a good thing if computer owners care about initialization, bootloaders, owner control and freedom of choice. Clearly some do care. Hats off to those folks.

1 Besides only this one: http://yarchive.net/comp/linux/efi.html

aplorbuston LinuxBoot: Linux as Firmware

IMO, the problems that [U]EFI introduces (that far exceed the historical limitations it overcomes) should be self-evident.

IMO, he should not have to argue against having multiple, redundant copies of drivers, shells and utilties each accessible only in its own "OS" (UEFI, GRUB, OS). It should not be a debate. This is definitely not "defense in depth". IMO, whomever controls the first OS controls the computer because there is no need for the second and third OS in order to do work (make network connections, move files across the network, etc.).

These "hardware features", whether its [U]EFI or ME or whatever acronym, IMO is a land grab by hardware vendors over what we know as the "OS". Less computer owner control, more vendor control. The sum effect of all these "features" is that verification that something is the way that the owner wants it and has not been modified is far too complex and is ultimately under control of the vendor, not the computer owner.

I do most work on the commandline in text-mode (no graphics layer) and as such I only need one OS, with some basic utilities. When the news came that new computers would have [U]EFI, I considered whether I should just switch from the OS I am using to [U]EFI. It seemed to have all the utilities I would need to do work, along with the ability to extend with new programs.

I only need one OS to boot to a working environment. I should be able to choose that OS. I hope that Minnich and Hudson and others will consider that the user may want to choose a kernel other than Linux as a source for drivers, e.g., BSD, Plan9, others incl. future OS not yet written, etc., even if it today it has inferior driver support compared to Linux, or Intels UEFI, or whatever.

The speaker seemed a bit perplexed when someone in the audience questioned whether Linux is a "TCB". What is and what is not a "TCB" should be the computer owners decision, and not anyone elses. If the computer owner wants to cede authority for that decision to a third party, then she can make that choice. But IMO it should be a choice made by the computer owner, and not anyone else.

aplorbuston How Old School C Programmers Process Arguments

"What's so cool about this is its flexibility."

This is something I have never understood.

I am a connoisseur of command line progams. I have used hundreds of them over decades. I write command line programs and scripts every week. It is an obsession. Yet I am embarassed to admit that honestly I have never understood the benefits of flexibility with passing arguments. I never understood the "getopt" movement. I do not use it. All my programs are very simple and straightforward without heaps fo options.

I apologise for being obtuse, but what am I missing?

To anyone who might be offended: I am not criticising flexibility of commandline arguments or its coolness. I just want to understand what are the practical advantages over something more simple and less flexible, like what I prefer. Only if I understand the advantages can I be an advocate for using numerous commandline options and flexibile parsing.

(Theres another post about setenv et al. on the front page right now. For programs that read from environ variables -- which can be a better alternative to using heaps of commandline options IMO -- I just use envdir from daemontools.)