Hacker News Reader

cbron Marking HTTP as Non-Secure

    VeriSign and GoDaddy, which the NSA frequently uses for MitM?

Link?

cbron Marking HTTP as Non-Secure

StartSSL's interface is a huge pain. Let's Encrypt is hoping to offer things like modules for Apache and Nginx that make them take care of acquiring certs automatically, though we'll see.

cbron Marking HTTP as Non-Secure

     The only thing separating a self signed cert
     from one obtained from a CA is that the CA
     has some of your contact info

Most CA certs are domain validated these days, which means you have to demonstrate control of the domain to get the cert.

    it wouldn't take a whole lot of effort to
    bypass their checks

It's pretty hard. If you get a CA to issue you a cert for a website you have no control over that's newsworthy and would get serious scrutiny put on that CA.

The CA system as it is isn't good, because we have to trust so many different CAs for it to work, but if CAs were widely issuing certs to the wrong parties we'd hear about it more.

cbron What’s the Matter with Boston Tech?

    In Boston $3k/month will get you into a triplex
    in Somerville with no T access.

$3k/month will get you a 2BR anywhere in Somerville or Cambridge, including within 5min of Davis or Harvard: http://www.jefftk.com/apartment_prices/

cbron San Francisco and L.A. sue Uber

Let's say I value thing A ten times more than I value things B through K, and I value them all equally whether I get them together or apart because they apply to different spheres of my life. Then I would be indifferent between getting A or getting all of B-K.

cbron Icdiff: side-by-side command line diffs

Your cdiff colors lines by whether they're added or removed: http://www.jefftk.com/cdiff-shell-function-2x.png

icdiff colors just the part of the line that changed: http://www.jefftk.com/icdiff-comparison-1234a1234.png

cbron Icdiff: side-by-side command line diffs

"colordiff -y" colors whole changed lines: http://www.jefftk.com/icdiff-vs-colordiff-y-2x.png

cbron Icdiff: side-by-side command line diffs

Unfortunately "subtle" isn't really an option when working with standard terminal colors. There are only eight colors, and on most terminals it would be fair to describe all of them as "garish".

A gutter symbol would be an option, though.

cbron Icdiff: side-by-side command line diffs

Sorry, could you give an example input icdiff performs poorly on? I just tried it on "red" and "blue", and got http://www.jefftk.com/icdiff-red-blue-2x.png which seems pretty reasonable to me.

cbron Icdiff: side-by-side command line diffs

git diff --color-words is good. Here's what that looks like on the same file: http://www.jefftk.com/diff-color-words-2x.png

cbron Icdiff: side-by-side command line diffs

This one works in both python2 and python3.

cbron Icdiff: side-by-side command line diffs

colordiff is just a perl script to colorize diff's output. Patching it to add support for the kind of coloring I want to do here would be a lot of work.

As for using emacs, there are many cases when I want a stand-alone diff tool.

cbron Icdiff: side-by-side command line diffs

meldmerge is great! But I also want something I can use on the command line.

cbron Icdiff: side-by-side command line diffs

colordiff looks like: http://www.colordiff.org/screen2.jpg

It's just coloring the standard diff output so lines starting with > or + are yellow and ones starting with < or - are green. This is also what "git diff" does by default: http://www.jefftk.com/git-diff-color-2x.png

icdiff is doing a side-by-side diff, and it's only coloring the changed sections of lines: http://www.jefftk.com/icdiff-side-by-side-2x.png

cbron 24/192 music downloads are silly

It's very important to control for every variable.

It's not, actually. Say you have 10,000 listeners and you randomly assign each one to 16-bit vs 24-bit listening. You have enough listeners that any differences between the groups are due to chance and will very close to even out. Now, if you find people are unable to distinguish between 16-bit and 24-bit you might want to try the test again with more control over the environment, but if you find a substantial difference in a large blind randomized test that's a real finding.

cbron Mean People Fail

In many real situations good and bad things come together. For example, upthread we were talking about Gates (a) doing some aggressive, mean, and anticompetitive things to make a lot of money which (b) he now donates to do very valuable things. In his case (b) really was dependent on (a); if Microsoft hadn't made lots of money Gates wouldn't have been able to donate so much.

cbron The Saddest Thing I Know about the Integers

If you're sending MIDI to a synthesizer that doesn't support choosing temperaments you can mostly fake it by sending pitch bend signals.

cbron Mean People Fail

    If I punch you in the face and then
    apologize to 10 other people for
    hitting you, it doesn't make me a
    good person nor have I in any way
    made up for wronging you.

If you punch me in the face and then apologize to me, your apologizing isn't enough to make you a good person or make up for punching me. So say instead you punch me in the face, and then dive into the river and save someone from drowning. While rescuing them doesn't make it up to me, it's still enough of a good thing that "gnaritas punches cbr in the face and saves X from drowning" is better than "gnaritas does nothing".

But maybe we're just getting into the semantics of what it means to "make up for" or "excuse" wrongs.

cbron Why Parse the User Agent?

Actually, I just ran tests with your DSSIM and Mehdi's SSIM.cpp, and got very similar results. So never mind; the choice of SSIM tool doesn't seem to matter much here.

cbron Why Parse the User Agent?

Will do.

Talking to some people here, they think your DSSIM tool [1] isn't what I should use. Specifically, they said it runs blur and downscale steps aren't part of the SSIM metric. They suggested using Mehdi's C++ implementation [2], which I understand yours is a rewrite of.

Presumably you think I should use your tool instead? What makes the (D)SSIM numbers from yours a better match for human perception than those from Mehdi's? Or should they be giving the same numbers?

[1] https://pornel.net/dssim

[2] http://mehdi.rabah.free.fr/SSIM/

cbron Why HTTPS Everywhere isn't on addons.mozilla.org

It looks to me like they're trying to use not being in AMO as leverage to get Mozilla to implement additional security features. If they said "we'd like these features, but we're ok being in AMO in the mean time" Mozilla would probably mostly ignore them, and these are generally useful features that should help others if developed.

cbron Why Parse the User Agent?

Is this the right set of arguments to be testing?

    $ mozjpeg/build/cjpeg
       -quality $quality
       -optimize
       -progressive

cbron Why YKK? The Japanese company behind the world’s best zippers

    I'm surprised bicycles don't try v-belts.

With a standard frame the chain goes through the rear triangle. To install and replace the chain you need to be able to open it at a master link to get it around that piece of the frame. Both the v-belt and frame do best if you don't open them.

cbron Why Parse the User Agent?

We set default quality parameters for PageSpeed with the goal of producing equal quality images between WebP and JPEG, on average (quality 80 for WebP, 85 for JPEG), but you're right that in this case the WebP image is more distorted as measured by SSIM. Sorry, and thanks for catching this!

Testing now with this image, to bring the DSSIM-measured distortion on the JPEG up to 0.015 [1] I need to encode it at quality=69, which gets me a file size of 24317 [2] bytes to the 20158 [3] I had for the WebP. This is 17.1% improvement for WebP over JPEG, as opposed to the 47.7% improvement I found before. This is all with libjpeg-turbo as included by PageSpeed 1.9.

Running mozjpeg (jpegtran) with no arguments built at commit f46c787 on this image, I get 23870 bytes with no change to the SSIM [4]. This is a 15.6% webp-over-jpeg improvement.

It looks like:

1) We should run some timing tests on the mozjpeg encoder, and if it's in the same range as the WebP encoder or not too much worse switch PageSpeed from libjpeg-turbo to mozjpeg.

2) We should check that quality-80 with WebP is correct for getting similar levels of distortion as quality-85 with JPEG. Is this image just a poor case for WebP or is it typical and something's wrong with our defaults?

[1] Technically, 0.014956 with JPEG compared to 0.015060 for the WebP.

[2] http://www.jefftk.com/kitten-demo--ssim15--pagespeed.jpg?Pag...

[3] http://www.jefftk.com/kitten-demo--ssim15--pagespeed.webp?Pa...

[4] http://www.jefftk.com/kitten-demo--ssim15--mozjpeg.jpg?PageS...

cbron Why Parse the User Agent?

And I guess if Safari had supported WebP back when Chrome and Safari were on the same codebase you would haven't counted them as separate browsers either?

cbron Why Parse the User Agent?

In practice webp isn't usually spoofed, and when it is it's by people who've thought through the consequences and are in a position to deal with potential breakages.

Client side feature detection can also be spoofed, but in practice that's bit a problem either.

cbron Why Parse the User Agent?

The problem with solving this in content negotiation is that breaks proxy caches. If you serve uncachable html that references either jpg or webp then you can serve those resources as "Cache-Control: public", and if you include a content hash or versioning in the URL then you can send a long cache lifetime. If you use the Accept or User-Agent headers to choose what image format to send them you need to issue a Vary header, and basically all proxy caches will treat that as uncachable.

There's some progress with "Vary: Accept" support, but "Vary: User-Agent" is probably never going to be supported.

cbron Why Parse the User Agent?

What are the pros? Smaller requests are only going to have a very small effect on speed or bytes used.

cbron Why Parse the User Agent?

     what the heck is an animated WebP

A drop in improvement for animated GIF: https://developers.google.com/speed/webp/faq#why_should_i_us...

cbron Why Parse the User Agent?

     Isn't the problem more that the browser can't be given
     multiple sources and types and allow it to chose what
     it believes is best?

How would this look? If you simply did:

    <img src-options="image.jpg
                      image.webp">

There's no way for the browser to know which one it wants without downloading all of them, because extensions aren't special. But I guess we could extend srcset to let you specify content type:

    <img srcset="medium.jpg  1000w image/jpeg,
                 medium.webp 1000w image/webp,
                 large.jpg   2000w image/jpeg,
                 large.webp  2000w image/webp">