wfunction

dang, this is literally the first time I recall ever seeing a mod respond like this, and I've seen some pretty off-topic comments before.

The comment was pretty darn civil, we've had political discussions all the time, and you know better than I do that not every well-received comment in HN sparks "intellectual curiosity".

Furthermore, for the life of me I don't see the "flamewar" that was started here. It seems more like you started the flames by threatening an immediate ban. So I'm a little shocked to see you reply like this. You could've just said the comment is off-topic and deleted it quietly, but to suddenly call it a nationalistic flamewar... I don't see how you expect people to take that.

I'll ask it differently: why are we not getting a black bar for this?

Oh cool, okay thanks!

Seems like part of this could've been prevented by just tweeting with (1/) or (2/) in the beginning of multi-tweet posts.

This is cool but strange and sad. Do you ever feel it goes in the opposite direction for a fraction of the people you meet? Like do you feel anyone who knows your real background (if anyone does...) treats you better because of that rather than worse? I'm asking because I'm tempted to think my reaction and some others' would be the opposite of what you just said, but I can't really say I have a large enough sample size to know...

Do you know if it's easy to patch the binaries so that this effect is nullified?

Has this recently changed (e.g. was it different from v4)? Or was it always the trend?

Oh geez, thanks for the link. I'd cut him some slack. I feel like if I was working under Trump I wouldn't be eagerly jumping in the middle of a crowd of reporters and telling them to throw questions at me in my first 2 months either. "One of the less destructive cabinet members" is quite an exaggeration for someone who's literally only had 2 months and the only bad thing you can think of is that he's run away from a few reporters. I'd be scrambling to get my crap together and figuring out what I'm supposed to do before worrying about answering to reporters about a job I just started. If there's any actual destructiveness on his part that he's refusing to talk about with reporters, that'd be much fairer of an assessment...

Could you link to something? Would be interested in reading more, since I haven't seen this in the news.

To be honest, I'm no fan of oil company CEOs, but I have yet to see anything bad from Tillerson as secretary of state. He seems like a pretty normal secretary of state, and almost like the only sane guy in the administration.

He's doing this because he thinks he's a competent politician who could make the world better? Or because he's looking at Trump and eyeing the throne, realizing everything a billionaire president could get away with?

Ah, yeah, that would explain it. Thanks!

> There was however one moment where Amazon got it right: they recommended to me a book that only a week earlier I had purchased on a whim from an independent bookstore with cash. Creepy good.

That is creepy. Any way it might've been more than just a coincidence?

Wow, that's nice to know. Thanks for that bit of info!

Ohh okay, gotcha.

How reliable are hybrid storage drives? I feel like the last one I saw failed pretty shockingly quickly but not sure (it wasn't mine)...

Their biggest problems seemed to just stem from their arbitrary choice to use subdomains instead of subdirectories. If they just put everything on the same domain (/sites/stackoverflow, /sites/superuser, etc.) then they would literally just need 1 certificate for everything, no third-level-wildcard nonsense. Not sure what this decision to have a gazillion different domains has gained them honestly. Reddit clearly manages to work that way.

Because a normal person will "just click the lock in the address bar" on every single HTTPS website he visits to make sure his company isn't MITMing him, right?

You're not describing the attack, you're describing the damage that could be done after an attack has already compromised the system. I'm saying describe the exact attack scenario, i.e. how any of these could be made possible in the first place.

> If your router or scanner is to be accessible over the network then it needs its own name and it needs to be able to certify that that's its name. Anything else is just too dangerous. A user expects addresses they enter into the browser to mean the same thing on any connection; having a few "magic" addresses that go one place on one network and another place on another network is a recipe for users getting hacked.

...a recipe for users getting hacked? on a home network? by whom exactly? my family? The router is already firewalling the entire network against the internet. Can you describe the exact attack scenario you're imagining?

Er, what "internal CA" are you even talking about? Like imagine my grandma gets Comcast, her internet is not working, and I tell her to go to 10.0.0.1 to see if it shows anything. Suddenly she's supposed to get an HTTPS error warning her there's an MITM attack? Or am I supposed to tell her to install a root cert in her machine and every other machine she might connect in the future?

Or heck, what if I'm just connecting to my damn scanner in my network? Or what if it's a guest trying to do that? "Sorry auntie, you'll have to install my self-signed cert as a root cert before you can use my scanner's web interface to scan your pic"?

> (1) If you trust them to write secure router firmware you can trust them to keep their HTTPS certificates safe

wha? uhm, no. Just because I trust you to do something correctly once that doesn't mean I trust you to keep something else safe for all eternity.

> 2) Router intercepts all DNS requests and responds with its own IP

Actually, what if I have multiple of these routers in (say) a chain? I have to go physically find the one I need so I can connect an Ethernet cable to it and bypass all the others? I can't just connect to the one I want directly by its IP address?

How is it supposed to get a publicly routable address when it's not necessarily connected to the internet?

As a matter of fact I don't. I'm keeping track of my root certs.

OK, and (1) how are you supposed to trust that the manufacturer won't get hacked one day (or whatever) and the IP address won't change to something external/malicious? (2) what if I don't have an internet connection and don't have a DNS server on the gateway that can reply to such a query?

Add an exception for every single internal site? You know how annoying that gets?

Who is supposed to do this exactly? Me the consumer who buys a router, or me the manufacturer of said router? (router/access point/whatever it's called...)

How is a gateway serving a configuration page at 192.168.1.1 to internal users supposed to eventually get an HTTPS certificate for that address...?

If you trust a company's internal CA then aren't you trusting them to issue certificates for every website and not just their own? Isn't that dangerous?

And why would I trust a company I work at to be able to sign certificates for every single website on the internet? Especially if I need to install that root certificate on a personal device?