Lx1oG-AWb6h_ZG0

> Now, their employees can securely access Ghost Land at ghost-land.sso.pacworld.com

That’s the part I’m confused about. They force all sites that need SSO to be under the same subdomain. If they can share the same session cookie, why does each microservice need to redirect at all? Can’t they all use the same oauth app underneath?

Maybe I’m missing something, but what is the advantage of maintaining a separate oauth provider (sso-auth)? Since they apparently need to support just google creds, why not let sso-proxy talk to google directly? Why do they need to maintain a separate token infrastructure?

The other (related) question is how the token refresh works - is it tied to the underlying refresh token generated by google, or is it something completely independent?

This is one of the weirdest corner cases I’ve heard of, right up there with the famous 500 mile bug. /u/captaincool diagnosed the issue a few weeks back (confirmed by OP today after talking to apple):

> It's definitely the helium.

> The processor in a modern, high volume device typically has its main clock driven by what's known as a MEMS oscillator. These are barely visible mechanical systems that resonate at some designed frequency, and include packaging to convert this resonance into a useful electrical clock signal. These devices are extraordinarily cheap ways to produce a steady clock, but they have a number of drawbacks. Most relevant, in order for these types of devices to function properly, the mechanical resonator must be inside a tiny hermetically sealed chamber with either a controlled gas inside or a vacuum, as the gas composition in the chamber can affect the output frequency.

> For both cost and physics reasons, these hermetic seals are not perfect, and are somewhat commonly permeable to small atomic gasses such as helium.

...

> For this specific case, Apple devices probably share a common family of MEMS resonator to reduce manufacturing costs. This clock likely leaks in helium rich atmospheres, pushing the output frequency outside of the bounds that the main processors are designed to handle, rendering them non-functional. If left idle long enough, the devices may begin to function again, but depending on the concentration of helium which leaked in, this could take anywhere from weeks to years to occur in natural atmosphere and temperatures.

https://www.reddit.com/r/sysadmin/comments/9mk2o7/comment/e7...

Here are a few of the articles, in order. Bloomberg restricts you to 10 links a month, but you should be able to access them:

https://www.bloomberg.com/view/articles/2018-08-08/elon-musk...

https://www.bloomberg.com/view/articles/2018-08-09/musk-s-mo...

https://www.bloomberg.com/view/articles/2018-08-13/funding-f...

https://www.bloomberg.com/view/articles/2018-08-17/elon-musk...

Again, these are highly recommended and give you a glimpse of this entire farce from the finance perspective.

> CarPlay adds support for third-party navigation apps displayed right on the car’s dash — joining music, messaging, calling and automaker apps.

woohoo! Can I finally use google maps in my car then? I don't understand why the Apple Maps team has been so slow on features

Don't they already do it? I thought the android location service queried google's wifi database to help figure out where you are.

Writing to a clipboard when you’re the active tab doesn’t require the prompt, I’d imagine that covers the vast majority of use cases. I can’t think of any good reason why a site should be able to read from the clipboard silently, or write to it in the background.

Service workers provide way more capabilities than just creating a shortcut. Google’s doc[1] provides a good introduction, but essentially you get things like push notifications and background sync in a cross-compatible way (chrome, Firefox, Edge, and now Safari). I’m particularly excited about the caches and sync APIs, which allows sites to be rendered and be interactive even when you’re offline or have a flaky connection.

1: https://developers.google.com/web/fundamentals/primers/servi...

“Higher privacy setting” is kind of meaningless when Facebook seemingly goes out of its way to make the settings page hard to use. You pretty much need a PhD at this point to understand what all the toggles do, and even then it’s not enough because they automatically opt you in to any new feature. I remember at some point in the beginning when they kept resetting all my privacy settings because they refactored their features but didn’t preserve my old privacy setting... I just gave up at that point and stopped bothering.

The precise clock is located on the satellites, not receivers. The receivers figure out the correct time by listening for the signals from multiple satellites and matching them against each other and it’s own internal tables. This is the expensive part.

Holy crap, that was brutal. I don't think you can get any closer to accusing someone of incompetence without actually coming out and saying so directly. If Samsung et al are this cavalier about the trust zone, what is the state of the rest of their systems, which presumably have orders of magnitude more code? Suddenly, all the reports about the thousands of bugs in tizen don't seem like exaggerations anymore.

On a different note, how does the iPhone's trust zone implementation compare? Does anyone know if it is vulnerable to similar issues?

Can't you serve it out of your domain, accessible only with an API key? This is pretty much what all map services do, and is a pretty well established pattern.

Every single mapping app has to implement some kind of mapmatching, since you can't rely on the GPS sensors to always be accurate: the GPS position is frequently wrong when you're moving between cell towers , and can be lost for several seconds in cities. Nokia/HERE's implementation (which I was told was very similar to tomtom/garmin's implementation) was written more than a decade ago, and IIRC, every time it encounters a fork in your path, it projects your position on every alternate for a few seconds and chooses the one that best matches the current gps+compass+accelerometer data as your "current" route. The output of this algorithm (which btw is hideously incomprehensible -- I'm talking old c++ with almost no comments) is what is used for map viewing/routing/guidance... the pure gps signal is never used as-is.

This is very good news, I'm really tired of how bad Skype's quality has gotten. WhatsApp's voice calls, on the other hand, are almost always crystal clear, often better than even phone calls.

Thanks, this is fascinating! This is the sort of thing that makes me think Vernor Vinge wasn't so far off when he described the concept of programmer archaeologists.

BTW, can you upload the original doc file somewhere? Google Docs appears to be mangling the formatting in a few places (page 28, for example).

I'm glad for the relatively low amount of breaking changes this time. npm prepare should be a nice addition (using prepublish for, e.g., installing typings is such a non obvious hack).

That said, I'm still not certain about shrinkwrap excluding dev deps. I mainly use it to ensure my build agent uses the same dependencies as my dev box, and at a time when things like babel pull in a ridiculous amount of sub dependencies, it really does not make sense to not lock down _all_ your dependencies by default.

Ha! I foolishly thought that when ng2 hit RC, it actually meant things would be stable. Keeping up with the ridiculous amount of breaking changes (the router, for example) through the RC versions was a horrible experience.

async/await as we know it actually came from Midori's C# dialect, which indeed was inspired from F#: http://joeduffyblog.com/2015/11/19/asynchronous-everything/

(Although, just to be pedantic, the concept of futures is way older than F#. Alice's syntax, for example, is pretty close)

the human average is around 185 crashes and 1 fatality per 100 million miles, which is pretty damn impressive considering the huge variation in terrain and skill. I'll be very surprised if any self driving tech right now can even dream of coming close to these stats.

I've had it working perfectly well with my google voice number for years now. When did they start blocking it?

The only problem I recall is that the initial text verification doesn't work - I had to do the phone call option - but this is a problem with gvoice, not WhatsApp: google blocks pretty much all server-triggered texts.

That's what one-way hash functions are for. You never store the raw fingerprint data, just its unique salted hash so the data cannot be reused elsewhere.

Their ios app has over 18000 classes (https://www.reddit.com/r/programming/comments/3h52yk/someone...), so I can easily believe the android app is similarly bloated as well. (To be fair, most of the 18K classes seem to be auto generated, but that still doesn't lessen the compiler's burden.)

Isn't this just a tool to enable double blind experiments on old vs new software?

Wait, is he serious? Is he really making the argument that they assemble in China because the schools there teach children how to assemble iphones? Even if you generalize it to any manufacturing assembly job, it still sounds ridiculous.

MSDN does support friendly names: https://msdn.microsoft.com/library/system.string (works for any .net class)

I think the person who wrote this particular page simply didn't specify a friendly name, which is why it's falling back to the canonical name.

Wow, that was intense.. Not sure if I'd call it hilarious, but damn, that was mind blowing. (Also, check out the related video about smart pipe, it's depressing how close to reality that is.)

This is like installing arch Linux and complaining it's not as easy to use as osx. There are literally thousands of other sites that'll tell you what a device "feels" like to use. Anandtech is the only site (except maybe Ars for big launches) that gives you the nitty gritty engineering details, which is what some people are interested in, and hence have upvoted.

... This entire article is about how those operations are basic at all, and will cause bugs if you're not careful.

Surely this is barking up the wrong tree? The problem is with your phone provider allowing anyone to hijack your number. What Google does is entirely reasonable for the vast majority of people. If AT&T fucks up, that's not Google's fault.

That's a bit misleading. Most NFL games are only available on network channels, not ESPN/Fox Sports/Univision. I'd hardly call that minor.