Have the anti privacy crowd come out in droves now that we have a public desire for contact tracing & there's a desire to scapegoat why netflix et al have reduced stream quality due to increased load?
& HTTP is not an option. I for one enjoy my ISP not being able to inject ads into my streams
Comment threads don't represent the community view. They self-select for commenters who object to something. This is particularly true early on, since objecting is usually a reflex reaction that leads to quick comments. Reflective comments, the better kind, take longer to appear—because reflection is a slower cognitive process and because they take longer to write. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
The third wave is people looking around and not seeing the second-wave description of the thread really matching the comments (we got one of those too: https://news.ycombinator.com/item?id=22935245). That's because the original objections have since been supplemented by more interesting comments that were slower to roll in. It may also be because the janitors a.k.a. moderators have been active in the thread, sweeping up and so on.
Edit: Speaking of janitorial work, I've downweighted this subthread now, which is one of the things we do. Check out the effect: at least as of this moment, if you scroll back to the top, notice how much more enticing and curious the conversation is, than if this were the first thing were seeing. It's as if the thread can breathe.
What's the better way to play out this dynamic? Since there were three comments I didn't think it'd be optimal to spam by replying to all three individually. Maybe picking one to reply to would be better. I don't think downvoting is the right play, but ignoring may be
Maybe responding with agreement to the article, without objection to the objection
The trouble with an indignant anti-crap comment is that it can't help but repeat the crap it's objecting to, because that's what it's about. Negation is a form of repetition. Crap subthreads tend eventually to get moderated by users, but that doesn't happen with their anti-crap counterparts. Usually those get upvoted to the top, since people love defending the unfairly criticized and we all respond to indignation. But then it sits there, choking out new discussion with metafumes.
The best way to counter bad comments is to post a good one—for example, a reflective comment about the specifics of the article, or a curious comment about something unexpected in it. This isn't always an option, though, because one doesn't always have something like that to say. I think responding to reflexive negativity with a pleasantly-worded objection can still be helpful—just not as a top-level comment.
https://news.ycombinator.com/item?id=22933774
https://news.ycombinator.com/item?id=22934040
https://news.ycombinator.com/item?id=22934379
Maybe these comments appear first because they're less likely to've read through the article. Otherwise it'd have to be something to do with the demographic of people watching /newest. But it was posted 4 hours before I made my initial post, so I don't know
This is not quite true - it's less about _Netflix's_ load and more about load on the _access networks_ (end-user ISPs).
They are seeing longer peaks, increased congestion (fewer folks are leaving their homes), and thus the reduction in default streaming quality by many streaming platforms was a move to limit congestion on these last-mile networks (and some IXs) where possible.
The EU & India anticipated the most congestion here, which is why you likely saw these announcements start with the EU before becoming global, as other ISPs/IXs/govts began to think about the same.
Disclosure: I work for Google in this space, but don't represent them here.
The top answer is a stackoverflow answer saying no way. "Putting SSL everywhere is only a way to get a warm fuzzy feeling on security that is no good. It [SSL] is usually only used as a distraction allowing administrators to disregard actual security issues."
https://stackoverflow.com/questions/2177159/should-all-sites...
Netflix already had a secure system with their original business model of mailing you the content.
Finally, allowing advertisers to profile us based on our browsing data is one step before allowing the police to do so as well. Maybe it's the same step.
A few things are whitelisted but the handful of things that break aren't necessary anyway.
OCSP is to query random CA web servers when opening a SSL connection to verify if the certificate in use was revoked. It's broken by design because servers simply don't have internet access.
Microsoft Windows, for example, allows administrators to re-publish external CRLs internally, but this only works for the built-in crypto API. Non-native applications generally won't pick this up, including most command-line tools. Blocking outbound port 80 is a mistake.
A colleague said it best: Certificate private keys are like your password. Tell no one, ever. The public key is like your passport. It's safe to hand to a border officer. CRLs are the lists of passport numbers used by known terrorists wanted by Interpol. Preventing the border officer seeing that list just lets the terrorists through the airport. This is never good.
Similarly, most firewalls ship with "drop" as the default rule, which means that a small error in the firewall rules will just end up with 20-120 second timeouts throughout the network. If instead they "rejected" flows with an explicit deny response, this failure mode would be instant and easier to diagnose.
Just yesterday I was trying to diagnose a packet loss issue on a network where some security troll blocked all ICMP between all endpoints. The last time "ping" was used as an attack vector was in the last century, but apparently it's important to prevent any hope of diagnosing entire categories of network issues. Unsurprisingly, their network has atrocious performance, random periods of high packet loss, and asymmetric routing issues. This will not get resolved until the idiot in the security team quits or retires.
PS: I suspect their issue is large UDP packets getting dropped on some paths due to MTU issues. To diagnose this without ICMP in a complex network is basically impossible. The automatic fix is to enable Path MTU Discovery... which requires ICMP!
Every large environment I've been to that has these security trolls in charge with nobody to reign them in was a shitshow of broken systems performing catastrophically badly because they spend 99% of the time waiting for timeouts.
PPS: Why firewalls don't simply have a default, auto-updating rule for "Enable CRL & OCSP outbound" for all known public CAs is beyond me. This is an extremely common requirement, to the point of being practically mandatory for any medium-large enterprise. If you firewall doesn't have this feature, and about a dozen similar ones, you're getting ripped off. You're probably paying some decent fraction of a million dollars for a bag a tools, not a complete solution.
Specifically, if you use HTTPS for OCSP then now you need OCSP for the certificate for the HTTPS connection you're doing to get OCSP, so you open another HTTPS connection, and you need OCSP for that certificate, and then you open another HTTPS connection and...
But most browsers don't do OCSP by default because realistically you need fail-open behaviour and if you have fail-open behaviour there's no meaningful security benefit so why bother?
OT, but why am I still paying full price for less-than-full quality? Same with Amazon - why am I paying for two-day Prime shipping even though it's impossible to get that level of service right now? /rant
You can always cancel your contract with them if you don't like it.
Note: I'm not even sure they have disabled 4K, it's just an example.
My guess is some people have a greater hatred for DRM, which makes Netflix "bad", and so anything Netflix does security-wise that isn't removing DRM becomes irrelevant.
But those comments seem to be mostly downvoted now anyways, so they don't seem to be representative.