cbr

People screw up. The people working on Chrome for iOS didn't mean to break WebP support, and when they discovered this they fixed it in the next revision. They're already plenty motivated and on top of things.

It doesn't make sense to punish visitors for the mistakes of browser makers, even if browser makers need more pressure, which they don't.

(And the situation with Opera is even trickier. They did support basic WebP and no one was even doing Accept-based detection yet. More communication would have been helpful between Chrome and Opera to coordinate what "Accept: webp" would mean, but it's not a situation punishment would improve.)

    Internet Explorer (of all things) already had the right
    idea with its "previous IE" mode: if the renderer emits
    standards errors while parsing the site, offer to retry
    with an older renderer (and send that renderer' original
    UA.)

IE dropping into various modes to interpret your document can be wonderful when it works, but can also be a huge pain. I work on PageSpeed, an open source optimizing proxy, and this IE behavior keeps us from making a lot of optimizations on IE. Consider this code:

    <link rel=stylesheet href="main.css">
    <!--[if IE 7]>
       <link rel=stylesheet href="ie.css">
    <![endif]-->
    <link rel=stylesheet href="more.css">

Combining multiple CSS files into one is a great way to speed up page load times because most of the time in loading these resources is waiting for the round trip. We would like to issue:

    IE7:
      <link rel=stylesheet href="main+ie+more.css">

    Other browsers:
      <link rel=stylesheet href="main+more.css">

But IE's impersonation keeps us from doing this. When we process a page requested with an IE UA, we don't know which version of IE it will decide to be when interpreting the page. Yes, it claims to be IE10, but if it sees something to drop it into IE7 mode then we shouldn't have removed ie.css.

My favorite part of this announcement is the link [1] to where MS says this detection is going away:

    The next major version of IE will still honor document
    modes served by intranet sites, sites on the Compatibility
    View list, and when used with Enterprise Mode only. ...
    Public Internet sites will be rendered with the new Edge
    mode platform.

[1] http://blogs.msdn.com/b/ie/archive/2014/11/11/living-on-the-...

I work on PageSpeed, which makes heavy use of UserAgent string parsing. I would love to stop using the UA and just leave everything up to the browser, but you can't do that without slowing things down. They key problem is we need to know on the server at request time what features the browser supports.

For example, only some browsers support WebP images. We'd like to send WebP to browsers that support it, and JPEG to the rest. If you wanted to do it in the browser you'd have something like:

    <img src="">
    <script>
       if (SupportsWeb()) {
          img.src = "/image.webp";
       } else {
          img.src = "/image.jpg";
       }
    </script>

But this is slow. Why? Because the lookahead parser can't find the image url, so the download can't start until the regular parser gets there and has run the javascript. Instead we want to issue a simple:

   <img src="/image.webp">

to supporting browsers and

   <img src="/image.jpg">

otherwise. You would think this would be what the "Accept:" header would be for. Browsers that support WebP would send "Accept: image/webp". And this almost, almost works. But there are problems: Opera started sending the header when it supported lossy WebPs but before it added support for WebP lossless, Chrome v36 on iOS sent the header but didn't support WebP in data urls [1], etc.

WebP support is just an example; this applies to many of the optimizations we want to make that are dependent on browser support. If we want to be fast we need to maintain a mapping from UserAgent to supported features. Doesn't mean I like it, and yes it's ugly, but we do need to keep doing this.

(The gory details: https://code.google.com/p/modpagespeed/source/browse/trunk/s...)

[1] http://crbug.com/402514

If you don't think a record company would are add enough to justify their share, sign with someone else or keep doing it all yourself.

Looking at that transcript, the redirection from https://www.google.co.uk/... to http://www.google.co.uk/... does appear to be served by Google. It's over HTTPS so it's signed by a key only Google has.

I looked into car helmets a few years ago [1] and my takeaway was that in older cars helmets would have helped, but cars made in the last 20+ years have enough interior padding and airbags that helmets wouldn't add much if anything.

If you convince me otherwise I'll start wearing a helmet in the car and advocating other people do so too.

[1] http://www.jefftk.com/p/car-helmets

    It's almost impossible to go over the handlebars on a Dutch bike.

I've done it. I was cycling slowly along the road, and my front wheel went into a drain-grate that had been mistakenly oriented with bars parallel to the road. I landed on my head, had a sore neck for a while, replaced my helmet, and was glad I had been wearing one.

I tell them to buy a Chromebook.

(But I do talk with them back and forth to make sure a Chromebook will do everything they need.)

The idea is data is unlimited, but only the first N Gb are at 4G speeds.

    Remember when the gramophone destroyed the live
    performance?

The gramophone, and recorded music in general, did destroy the live performance. People listen to much less music live, even as they listen to more music overall. It's also much harder to make a living as a mid-level professional musician even as the few at the top make millions. That said, I do think these are positive changes: excellent music in huge varieties is much more widely available than in pre-recording days.

(The aspect of the change that makes me most ambivalent is its effect on people making their own music. When you can't just turn on music--music far better than you're able to create--people sing for themselves and each other. People still sing some, but most are now embarrassed to sing in front of others. You're basically supposed to be ashamed of your singing ability.)

    In the long term, this devalues a click. The
    very moment things turn...

Why would you expect a sharp turn? Some fraction of clicks on the internet are already fraudulent, and if people start using this product that fraction goes up. But it doesn't really matter because it's all auctioned.

Let's say I run a billing service and I've placed ads on searches for "billing service". I find that it costs me $X of advertising per incoming visitor, Y% of these convert into customers, and a new customer is worth $Z to me. I'm willing to bid up to $X x Y% on ads. Now lets say a lots of people switch from blocking ads to giving them fake clicks and now half the clicks on my ads are from this extension. Y% drops by half, because half the visitors from this source are now just browser-extension bots, so I'm only willing to bid half as much. But so is everyone else, which means my new 1/2 x $X x Y% bid is still competitive, and there's twice as much traffic to bid for, so it all comes out the same.

Ad networks take click-fraud very seriously because it's important to their reputation, but the market is actually pretty robust to it.

(Plus this browser extension sounds like it would be really easy for the ad networks to filter out.)

"this user clicks on absolutely everything we put in front of them" seems really easy to filter out...

Normally when something is in a bonded warehouse it's a storage-only situation. Looking online I can't find anything about indian special cases where this works differently, just the ordinary "store goods here until you sell them, and pay the duty then".

If you don't enter height or weight into "debug my life" it says: "Your current BMI is 23, which is in the healthy range" instead of "you didn't give us what we need to calculate your BMI".

Right now: we could move out of the city and live for decades on our savings.

In a month: most of our savings will have gone into a down payment on a house and we'll have about six months savings.

While I was using "GPS" as shorthand for "automatically determined location", technically doesn't the GPS receiver work better/faster when your phone already has a rough idea where you are?

Sorry! I forgot that the axes were in the surrounding page not in the image.

Vertical is "$/DALY" which is basically the cost-benefit ratio of a medical treatment. $100/DALY would mean $100 to give someone an additional healthy year of life. The horizontal axis is a wide range of developing world medical interventions, lined up from worst cost-per-daly to best. You can see that the very best ones are much better than most of them, though even the "worst" ones are still excellent value for the money both in absolute terms and compared to what additional health spending gets you in rich countries.

I think most people just leave wifi on; constantly turning it off and on is annoying, and you get better GPS when it's on.

Much easier to have this conversation in constant (inflation adjusted) dollars.

This approach would make sense if most charities were similar in how much better they could make the world with your dollar. But instead there are huge differences! For example, if we look just at developing world health we see a power law distribution, where a few interventions are much better than the rest. [1] Instead of signing up to give small amounts to lots of different organizations, it's much better to find one working on one of these best approaches (givewell.org is helpful here) and fund that more.

[1] http://www.jefftk.com/daly-per-1000-usd.png

Sites need to be able to update their certs without giving a scary warning to all their repeat visitors.

Lighter, thinner.

    In addition to using voice actions to launch
    activities, you can also call the system's
    built-in Speech Recognizer activity to obtain
    speech input from users. This is useful to obtain
    input from users and then process it, such as
    doing a search or sending it as a message.

https://developer.android.com/training/wearables/apps/voice....

I didn't downvote you, but the leaked PRISM docs don't show "participation". They show that the NSA was getting the data. If they were doing it by, ex, inter-datacenter fiber tapping then Apple wouldn't have "participated" or even known about the leak.

(Actually, you could use the onload event; you don't actually need navigation timings.)

Certificate pinning usually (ex: Chrome) is implemented with an exception to allow a company administrator to install a new root CA cert on the device and MITM connections. Does iMessage not allow this?

You can already do that.

     good.com:
        <script src="/js/site.js">

     evil.com:
        <img src="https://www.good.com/js/site.js">

Then use the navigation timing api to figure out whether the js was already in cache.

patents

    I'm still waiting for the killer app that makes
    me want one of these.

Triaging notifications without taking your phone out of your pocket. Who's calling me; do I need to pick up? Is this buzz an sms, calendar reminder, etc? That's what makes me want one.

It depends how motivated your attacker is. Could someone make a lot of money if they could get SHA-1 collisions with your application?