bpatrianakos

Yes, maybe they should be encrypted but that's still a problem because most of the time the answer can be correct in context but wrong technically. For example, "what's the name of your first pet?". If you originally answered "Spot" when you set it up then enter "spot" when you're asked later those two won't match after the hash is compared (if you use hashing) and it won't match if it's unencrypted either. That's an easy case to fix of course but there are other times when they ask for the name of your high school or something. I've been asked that several times and I'm not able to be consistent in my answer each time as sometimes my answer will be "Blah Blah High" or "Blah Blah Township High School" or any variation of that. Both answers are correct but only a person can see that.

So as I see it, encryption or hashing is good for keeping the answers a secret but bad when it comes time to use those answers again.

I think I'm missing something. I see how this would be great when it's build time but during development I don't want to have to keep running build commands each time I want to use a new package I'm development. Using Grunt and Bower may be a little time consuming up front but once things are set up its very easy to keep a separate Dev and prod environment in sync between different contributors. I only see the value at build time with Duo which is why I'm sure I missed something.

Right but site owners need to request inclusion on that list only after they've enabled HSTS on the server. I've done this myself and I must say I'd be pretty angry if browsers forced an entire TLD to require HSTS. The result would be SSL warnings everywhere.

I think it's all about context. It's been my experience that "developer" is mostly applied to web developers and "programmer" is most often used when talking about desktop application development. In this context I don't think adding the word "web" before "developer" makes it any more clear as it's web developers who mostly use icon fonts and web developers who are the target audience here.

What part don't you understand? Why FedEx is in trouble or why the pharmacies are illegal? I'm going to assume it's the latter and it's a bit of a gray area.

On the one hand, these pharmacies provide medications at a lower cost than in the US and some countries and would be beneficial to many. So far it looks like its moral and shouldn't be illegal.

Then we begin to think about the people who go online and buy medications they aren't prescribed, playing doctor on themselves. We can say that's their own problem but I'd side with the idea that it does more harm than good.

Then there's the fact that these pharmacies often prey on drug addicts who require treatment, not more drugs.

There's way more to it than that but regardless, it's pretty easy to see why people would be believe they fit into category 1.

What is it a step forward for? A popular opinion on HN seems to be that programming should be taught in schools because it's somehow a new basic skill everyone should have? I have to disagree and don't see it being a step forward for anything. Programming after hours, taught as a kind of extracurricular activity seems sufficient to me. There's no need to know how to program a computer. Knowing how to use a computer is the important skill. You don't need to know how to rebuild a transmission to drive a car in the same way you don't need to know how to build a web page to know how to input text into form fields and click a submit button. Those who are curious and interested will learn to build the things we use while others will find it more than enough to simply to know how to use the things the rest of us have built.

I, like anyone else here, am super passionate about programming and it thrills me to be able to make a computer do my bidding but my friends and family don't care how the computer works. That's okay. I know a carpenter. I love living in a well built home but don't really care to know how to build one. Knowing how to work a stud finder to hang a painting is enough for me.

If you want to be super technical, sure. But in the context of this article that quote rings true. The masters really are surprisingly few in our field. At least the sort of masters I think you're talking about. In my experience most programmers have a sense of imposter syndrome that is very tough to crack so including that quote in the article was something I liked and think is important for other developers to hear. The amount of knowledge and experience needed for true mastery is so deep and wide that in practical terms I would agree with that quote completely.

Before all the comments come flying in (or not, but just in case), here are some answers to questions some may have:

This is my very first iOS app. I found it useful and so did enough people I worked with that I decided to charge a buck for it...

- The point is to check out the idea and design and give some feedback, I don't expect anyone to buy, this is not my way of making a buck off HN.

- For those who are interested in playing with it, I do have a few extra promo codes I can give out. Just send me a message.

This makes sense if you look at it through your own tech-centric lenses. It seems plausible that Linux is good for a normal user when you try to put yourself in their shoes but the problem is that you can't really do that without bringing along your own knowledge and experience without realizing it. Linux is not okay for the basic user described in this post but it can be great for a lot of non techies.

"Grannies" don't like to deviate from the norm. The library has windows, friends have windows, by this point in time a person has come into contact with computers outside the home lots and they're almost always windows with an occasional Mac. You put Ubuntu on Granny's machine and she'll be asking why this doesn't look like what she saw elsewhere. Even if the function and UI are eerily similar there's this weird mental block that stops people from seeing the similarities and focus only on the differences.

The distribution described in this post is basically a Chromebook. Honestly, if your "Granny" needs email, skype, and the web then get an iPad + keyboard or a Chromebook. Not a full Linux install that you rip stuff out of. In fact, people with these granny use cases are already flocking to tablets over desktops in droves. A copy of Ubuntu "Gutsy Granny" as described here is bending a desktop to work not like a desktop save for the mouse.

I'm annoyed with the 2 mainstream OSes like anyone else and I especially hate having to troubleshoot problems that shouldn't come up for these Grannies but as annoying as it is I think switching these people to Linux is partly us trying to enlighten others (which comes off really condescendingly) and partly trying to make our lives easier rather than the user's by putting the user in the equivalent of a bubble where they can't break anything and if they do it's very convenient for us to fix.

Yes, we often say security and think it means total protection. It doesn't. Its rare to see any security feature that cannot be bypassed or broken by some means. This is why we implement security in layers. If it were a binary state then a single layer would be sufficient. The idea is to make it so difficult to break through every layer of security that it becomes impractical but there will always be someone who does it.

I also don't think Apple is dishonest in their marketing. Fingerprint scanning is absolutely better than a pass code and the marketing around it all gives the impression that using it ensures no one can unlock your phone without your fingerprint. Nothing dishonest in that. Plus the layperson really has no interest in learning the specifics anyway so I'm not sure it matters what they say about it so long as it sounds cool and futuristic.

I disagree although my first thought was exactly the same; how do you solve the problem of half of some text being on a dark background and the other half on a lighter area.

I see three solutions to the problem.

The first is not so elegant. If you have text then you wrap each letter in a span tag and apply the JS to each span. Very ugly, not practical, scalable, etc. but it works. If you've got dynamic text coming from a backend then just forget it. This solution is only viable for static content and even then it's not great.

You could implement this as instructed and then just give the text an outline of the exact opposite color. Chances are your text will not equally overlap both a light and dark background so this wouldn't look too bad at all.

The third solution is to just know your backgrounds very well and choose element placement very carefully so that no matter what background you have your text ends up in an all light or all dark part of it. If I had Medium style app where users get to choose the background image of an element that gets text laid over it this is what I might be okay with doing and accepting that not all the background images will lend themselves well to this technique.

Or... There's a fourth way that I've actually had to consider in one of my projects. Until I saw this post I didn't have the final piece of the puzzle but now I do. I would take the ability to dynamically change the text color based on a background and add to it a translucent background to the text with some padding to make it a blocky thing - kind of like how ios7 handles it in notification center.

The idea is that if you have an element over a mostly light background you give that text itself a light background with about 70% - 80% opacity and the text color dark. This way you're covered even if part of the text is on top of some random dark part of the image background. It's the same idea as using a text outline except its more cross-browser compatible and I personally think it looks better.

But like I said, if you're not in control of the text and/or background there probably isn't going to be a bullet proof solution and you'll have to accept trade offs but if you are in total control then there's no reason you can't mitigate these issues completely.

I thought I had addressed that. But you said it perfectly. I guess the short version of what I'm saying is that there shouldn't be a problem with a spy agency spying. The problem is that they've violated their own citizen's rights and the human rights of all citizens around the world if they really do spy on 'everyone'.

I have to admit though, I'm okay (as a citizen of any country) with my government's spy agency violating the privacy rights of citizens and foreigners when it's done in a targeted way. There's a big difference between spying on a person and their network of connections because you've got some evidence to suggest something bad is coming from them and just collecting everything you can and looking for reasons to go after people after the fact. The former is how it should work, the latter is how its being described now.

Actually Roger Ebert did make a movie in the 80's called "Beyond the Valley of the Dolls". And it's good too.

But anyway, your point still stands aside from the small Ebert error.

I don't think he's saying it would be good for anyone for the NSA to continue snooping as they do. I think your first point is wrong, your last point is right, and the two are unrelated.

The issue isn't the fact that the NSA snoops. That's their job and it has value when their power to do so is used judiciously. The problem is that its not being used judiciously. Rather than singling out as few people as possible to root out the bad guys their just collecting everything they can. They don't need to do this and doing so opens up the possibility for huge abuses of power. That's the issue.

I think the article is right that the crypto revelations aren't pertinent to this discussion. I would even consider the crypto revelations a red herring. Is it important how the NSA spies on everyone? No, its only important to know that they do it at all when speaking in the context of how the Snowden leaks are important to creating a national debate and, hopefully, by some miracle, create reforms.

I think its reasonable that as a US citizen you're okay with the NSA being able to break crypto. You just want to be able to trust that they're using it against the bad guys and not you. Even now that we know they're probably using it against innocent civilians its more harmful to the NSA's ability to go after the "bad guys" when they legitimately do (and they still do serve that purpose) and isn't really helping the debate over whether their over collection of data is okay and how to reform that system.

These are exactly the issues I'm dealing with in re-implementing two-factor auth in my own app. On the one hand you can easily roll your own SMS based TFA with the option to use Google Authenticator with a negligible amount of work. Google's app is pretty reliable and most people trust Google (rightly or wrongly is beside the point here).

But then what if Google pulls the rug out from under apps that rely on it and what if knowledgeable users like you don't like the idea of a third party having access to their second factor?

I'm starting to think that unless you're willing to build your own authenticator apps for multiple mobile OSes SMS-only is the best way to go.

Is this really how it works? I know many do go solely with the -webkit or -moz property name to experiment with new features but for any site that's important (not an experiment, needs decent cross browser support) what I see happening is that most developers will do it the right way - they'll use all the available prefixes and end with the eventual standard property name while at the same time ensuring that use of these new features doesn't look completely broken in browsers that don't support the prefixes or non-prefixed version.

It's very rare that I'll see a developer code in such a way that they totally leave out a fallback or code with just one browser in mind. At least not when it comes to any site of importance (these include any site meant for a large audience, non-techies, business, and just generally not a site put together purely for showing off the uses of an experimental feature).

I didn't know Blink was going that route too. I fear that the use of new experimental features will stagnate if Chrome becomes too popular among non-techies.

I disagree and believe there is more upside to this than downside. You certainly can't say that the fact that different browsers and devices handle favicons differently is a standards issue. If you were to try to standardize this then we'd end up with either a very large and complex standard (close to what we unofficially have now) or a lack of innovation. Innovation isn't the exact right word I'm searching for but what I'm getting at is that forcing vendors to use set sizes and naming conventions would detract from some of the small but important UI and even hardware differences in devices and browsers.

iOS had the retina display with mobile safari first, then came Microsoft's metro interface which brought tiles and going forward we're probably going to see many more devices and browsers that handle some aspects of web resources differently and for good reason. We can't expect the web standards committees to be able to account for all of these advances as fast as they come about and I'd argue that's exciting and good.

Furthermore I'd say web standards already do take care of this in the most elegant way I can think of. The <link> tag is totally standard and future proof when it comes to favicons. I don't see anything wrong with adding a link tag with standard attributes to support multiple devices here. The purpose of a favicon is to associate a small image with a website or URL in general. Not all sites need the apple-touch icon or windows tile but some do. What we're seeing here is an attempt to target specific browsers on specific devices for very specific cases. By and large the standard desktop browser favicon has never changed. When you take all that into consideration I think its actually quite reasonable for these different methods of specifying favicons to exist.

I'll grant you that adding all that in your markup is ugly and having to think about which devices you want to target is a pain especially once you've decided on it and then have to start thinking about which markup to use and in what order.

Still, this isn't a case where vendors are using proprietary markup to capture more of the market or doing anything "evil". It's more a case of using an existing standard to take advantage of a specific device capability. Standardizing the way web/markup languages are handled is good but trying to standardize favicons in this context seems like an awkward way of trying to standardize how a device and/or browser and/or OS handles its UI and is not good.

Edit: I can't think of a good way we can standardize this but I am curious if there's anyone out there that has a decent idea for how we can standardize how we specify favicons for the plethora of devices we have now and will continue to see going forward.

The author here makes a good point until he asks his final question. In the case of Dr. Martin Luther King I don't believe copyright would have had any influence on the likelihood of delivering it. The purpose of the speech was selfless and so despite the copyright issue being disappointing it doesn't seem like he would have said "well, since future students won't be able to read the full text of my speech why deliver it?" Though he understood the significance of the march and probably knew his speech was important is there any evidence to suggest he knew how iconic it would become? And even if he did, was he going to forego addressing his audience, the people assembled at the Lincoln Memorial, to make a statement on copyright? It's doubtful. His speech was for the audience there. The fact that it could be reprinted and studied by future generations is just a bonus. The idea that King would be less likely to deliver his speech because of copyright is not realistic.

That said, this also isn't a convincing argument for the abolition of copyright either. I don't know if that was the point though. What this does show is how a copyright can serve the opposite of its intended purpose and hurt society. But for every case like the King speech there are plenty more that are examples of its benefit.

It's disappointing that we do not have free and open access to the I Have a Dream speech but its not a good argument against copyright. Copyright is still an issue that boils down to its use and has to be considered on a case by case basis. I don't think it ever has been all good or all bad and overlooking the vast sea of nuance there doesn't help proponents or opponents of it.

I'm with you but I think there are exceptions. To be clear, I don't think its ever okay to publicly shame a non-paying client like in this post but there are some things that are okay. A specific example is a situation I'm in right now.

Over six months ago I was asked to design and develop a Wordpress site for a slate of candidates running for local office. The guy who came to me for it was someone I had worked for before and had a very good experience with. He was fast, friendly, professional, and asked me to send him an invoice before I even planned to. So when he came to me this time asking me to put together a site that he needed up in less than a week I told him the price and got right to work. We had an agreement in writing only so far as emails went and I even spent my own money to let him use my hosting, get an SSL certificate so he could accept online donations and even gave him a few bucks just to test the donation functionality. He was happy with it and again asked for an invoice before I had one drawn up to send. They lost the election but I still did the work.

Fast forward over six months, 5 invoices, and a phone call later and I still haven't seen a single penny. To get his attention I changed the passwords to his other website (the one he actually cares about). That got him calling right away. I didn't let him know I changed the password and let him think it was a technical bug. He pretended not to know why I was never paid and promised to send payment immediately. One month and 3 emails later he promises to send the money "this week" and that he's in a "cah crunch".

Will I publicly shame him? No. I plan to ask for payment once more and give him a $250 discount if he uses the online payment form I set up for him. If he doesn't do it within a week I'll let him know he was one more week to pay me in full before I lock him out of his business email and suspend his web hosting both of which I provide.

You can always try to make the argument that designers need to be more careful in their dealings but you can't forget that there's always a human element, at least on some level, in all business transactions. Sometimes you trust a guy because you've built a good relationship with him and he fucks you over. I've never been stuffed once in three years though some have tried because I always used solid contracts and other safeguards against being ripped off. But sometimes, just sometimes, someone slips through the cracks and in those cases you have to have some recourse available to you.

This is cool and certainly useful but I have concerns. Forgetting for a moment that this is a shim and imagining that all browsers support this natively, isn't this sort of thing outside the intended purpose of html. Html should describe content not styling and this sort of thing seems ripe for abuse. I thought XML was the markup language for describing custom data. Adding the ability to create your own DOM elements for the purpose of using them as hooks for interactivity and styling seems like something that should be avoided in HTML.

Am I being a too much of a purist or overlooking something here?

Thank you. I've always wondered what the correct spelling was. I've seen both ways here and now I have a firm answer.

It's MOS. Manufactured Outrage Syndrome and its what people in tech do. They see something they personally dislike, decide the world should work a different way, and then write a blog post arguing for it.

The argument is that your conversions drop from people searching for coupon codes. We'll all just have to test that see for ourselves, won't we. This isn't the kind of thing where we've suddenly discovered a new counter-intuitive best practice for shopping carts. It looks like a few finicky people will be upset and call it bad customer service. I for one am willing to write them off as wannabe usability experts and continue to make the majority of users happy most of the time rather than cater to a small but noisy group. In the end you can't please every customer. Ever. Next we'll see a post about why not having a coupon code field is the worst customer service decision in the world too.

Are you sure that lists were added in response to G+? I remember having lists long before G+ was even a thing. I could be mistaken but I'm pretty sure lists and the ability to share things among certain groups of friends had existed for quite some time but was rarely used.

You shouldn't have been downvoted. But you should know that if you don't tow the party line on this topic you'll be marginalized no matter how valid, on-topic, or sane your comment is.

You're right though. First off, I hope your parent was joking, because if not, what he said makes no sense and isn't really related to the subject at hand. Second, while the whole domestic spying scandal is serious business, it doesn't have to be injected into every conversation. Third, you're right. There is no evidence to support that anyone has ever targeted a random individual for the sake of it and you probably shouldn't be using something like Facebook if you plan to discuss criminal activity, and yeah, no matter who you are you can't expect an inkling of privacy online. But that's not really specific to the government either. I can spy you, the guy down the street can, it doesn't take the kind of infrastructure the NSA has to spy on someone. Hell, I'd be more paranoid that random people are spying on me than the NSA. The randoms are more likely to target you for no reason while the NSA, from what we can gather, is more than happy to collect your data and never look at it - like ever.

Questioning the amount of paranoia we seem to have and being pro-NSA spying are not the same thing and it seems like a lot of people aren't able to separate out some of the nuance.

Tea is just as caffeinated, if not more caffienated than coffee. So what you're doing is no different than quitting Red Bull and switching to Monster without withdrawal.

Some teas are decaf but in general the most common teas are caffienated. Even most decaf things are low or almost free of caffeine but not totally.

I suggest you try quitting coffee and tea together and seeing how you feel.

I think you're debating semantics here. What if the person looks at it as doing the world a service by correcting wrong information? Then that would probably fit into the job somehow.

In any case though, I don't think the ethics of editing a word on Wikipedia during work hours is what we're supposed to be getting up in arms about. I'm really not sure still why we're supposed to be upset.

You have to believe some things you are told. Not believing anything you're told isn't really virtuous like some people make it sound. I'm not saying you're like this, but often times I hear people say things like "people just believe whatever they're told" and "the real truth is..." and similar phrases that just sound so empty. Whenever I hear it I think of a person who wants to feel superior because they somehow have learned "the secrets" and have special knowledge about how this world works. Truth and justice are things that are relative. Its often the case that these same people will buy into full-blown or quasi-conspiracy theories not because any critical thinking was done about them but because its just not what the mainstream says. It becomes this weird "us vs. them" mentality where you end up distrusting one set of facts to your own detriment and believe an entirely opposite set of facts, again, to your detriment while leaving out everything in the middle where the truth these people seek really is.

Like I said, I don't know you - I'm not saying you're one of those people I mentioned here but what you said reminds me of things I've heard them say.

Too bad it's those anarchists/traitors/dissidents/hippies/[label] trying to make their socialist/anrarchist/communist/[derogatory adjective] opinions into facts.

See what I did there?

A Senator or anyone within the Senate has just as much of a right to their opinions as any of us do and they also have the same permission to edit Wikipedia entries as we do.

So what is the point in pointing out that someone presumably within the US Senate has changed a word in the Wikipedia article about Snowden? To point out that they're wrong? What if we're the ones who are wrong?

This act doesn't infringe on anyone else's rights in any way. Its an attempt to persuade possibly but we can't blame them for that. They have just as much a right to try and persuade people to seeing things their way as we do.

I'm just wondering what kind of discussion is this supposed to spark? I've seen a fair number of posts on HN lately that are little more than attempts to preach to the converted and turn the comments into a back-slapping fest. Is it weird that I consider the opposing viewpoint any time I make an argument or consider an issue? I don't necessarily agree with changing dissident to traitor but I don't see anything wrong with someone believing that either.

It actually isn't built on Rails but I'm in the middle of a rewrite which is using Rails. Thanks for the compliment!

Agreed. I find posts like these disingenuous. What do learn from this list? I think we all know that SQL injection is a serious problem and a very common mistake already. What this list seems to do is just serve as a high horse we can all get on and proceed to shame and look down our nose at people who:

- Use raw $_GET variables in their code - Use $_GET in MySQL queries - Use mysql_real_escape_string instead of prepared statements or otherwise properly sanitizing input - Use PHP in general

We already know we should all be using prepared statements or combining data sanitizing methods with an ORM and to not trust raw user input and that its cool to hate on PHP. So I ask again, what are we learning here? That there's a ton of programmers who are doing sloppy incompetent work? Not news.

Furthermore, I think context is important. I'm not ashamed at all to say out loud that I've done these sorts of things knowingly and purposefully despite knowing it's not safe or correct. Why? Maybe I was creating simple examples to teach others the basics of getting user input and working with it in a database. Of course you'd warn people not to do things like that in a production environment but you show it that way anyway to get across some basic ideas without throwing too much at people. Or what if I were writing a simple series or scripts or small app that would only be used by myself or a select group of people? What if that application needed to be done in a hurry and was only for internal use and not accessible to the outside world? Lots of things can always go wrong but at a certain point you have to be able to trust someone and its not always better to be right than happy. I'm sure if anyone wants to be pedantic they can poke holes in my examples but the point is that these sorts of sins aren't always so awful depending on the context. I don't see any purpose in this other than to either look for open source applications to exploit in the wild or to just pick on a really easy target to make us all feel superior.