just2n

"Well, we have met the enemy, and he is us.* In the currently shipping version, Firefox ships with many options that will render the browser unusable to most people, right in the main settings ui."

The solutions offered? Kill it all with fire. I'm paraphrasing, of course.

Problem: People today change some feature then have a "broken" browser (basically, they forgot to turn it back to the default, or they didn't realize they changed it in the first place).

Solution: reset button, also notification to the user that "this page might not work correctly", some sort of an extension of how Chrome shows you that a popup and/or a cookie was blocked, based on your settings. Don't treat your users like idiots, just provide information that clears up certain odd states by explicitly informing them of something like:

"The webpage you are viewing may not work correctly because the following options differ from their default values:

1. Enable automatic loading of images. 2. Enable JavaScript.

These features of Firefox are essential for most webpages to run properly. If the webpage you are trying to access is behaving strangely or appears to be working incorrectly, <click here> to load the page with the default browser configuration."

Done, and done. No removing useful features from the browser, no treating users like morons, but now I have a new, useful, awesome, self-debugging feature which is user friendly, and doesn't require a pesky IT guru's assistance navigating the sea of 10 trillion options.

1. If your provider goes down, you lose mail.

2. If you are conversing with people who are using an insecure mailer, such as gmail, Yahoo, etc (which is probably > 99.9% of all e-mail users), your e-mail is still accessible to the NSA, or to some Fortune 100 advertising company.

3. It's only a matter of time before the "big dogs" in email abuse the position and decide who is and isn't allowed to send/receive email outside of their little oligarchy, either on their own or at the behest of governments.

Like so much else that has been corrupted, we need to scratch the current architecture as too insecure, and build something truly secure for the future. This isn't in the interests of the Googles of the world, and it's actively in the worst interests of the NSA/FBI/CIA, so it's probably the right thing to do.

As for impeachment, it's much easier to try to punish a single person, or demand such, than it is to demand the punishment of hundreds. I don't think we should cry foul when a bad law is passed -- it's bound to happen. Rather, when both of the other branches fail to do their duty to balance power, or worse, exacerbate the problem.

1. This (re: citizens violating classified laws or legal interpretations) is definitely a situation where any sane judge/jury would find against the ignorantia juris non excusat principle, so I don't expect the use of any of this to hold up in any court, ever, not just because its effects are potentially unconstitutional. And any judge worth the wood upon which they sit would dismiss any evidence presented that has been gathered as a result in that it wasn't obtained with a legal warrant, or in any manner that is constitutional.

2. This is massive amounts of ammunition for conspiracy theorists, especially truthers. Let me give it a try: 9/11 was an inside job, orchestrated by the US government under the Bush administration as a false flag operation in order to to get the Patriot Act passed with plans to classify interpretations which would give the government over-reaching powers to violate the constitutional rights of citizens to the point of being able to create a Stasi state.

3. Why don't we demand impeachment if Obama re-authorizes any part of the Patriot Act, obviously knowing about classified secret interpretations which have already been found to be unconstitutional (re: classified findings)? The congress has the ability to decide whether or not the President has committed a "high crime", and I'm fairly certain this fits the historical meaning of that term.. knowingly and willingly violating the constitutional rights of every US citizen, a constitution which the president is sworn to defend (https://en.wikipedia.org/wiki/Oath_of_office_of_the_Presiden...).

In my experience, as long as you hold onto the cognition that a repository is a collection of files and commits are, in effect, diffs, git won't ever really make sense, since none of what it does could be feasibly implemented with diffs. It's actually much simpler than that, hence the name.

When I first started learning git, I had only experience with SVN and Perforce. Both typically led to egregious practices (branches are directories?) and actual merges were rare (rather, you manually merged and just made a new commit). I felt they were a huge hindrance and were actually constantly in my way, a sort of mandatory bookkeeping I had to maintain.

When I started working for a company that heavily uses git, I buckled down and read through pro git (available at http://git-scm.com/book for free), the user guide (https://www.kernel.org/pub/software/scm/git/docs/user-manual...), and the man pages of the commands I was using. One day it just clicked and all made sense, and it was the only logical solution to SCM. Now I can't live without git. In my personal projects, step #1 is to git init a new repo. In working, git is never in my way, and rather provides me with incredibly powerful tools for massively increasing my productivity through workflows that just aren't possible under SVN/P4.

For me, on Chrome Canary, the animation "chugs" every 20-30 frames (from 60 fps to a frame that takes 200ms). It's almost entirely in rendering, and it's immediately following a jQuery callback. It only happens when scrolling down. I'd like to see this done with a very simplistic requestAnimationFrame tweener to compare the same type of animation against something that is doing nothing else but computing a new scrollTop and setting it. I have a strong feeling, in Chrome at least, that the problem here is jQuery, not SVG perf.

Additionally, for other browsers, I'd like to see this tested with icon fonts.

Further, the diffing format used there is atrocious.

Law is code. Why haven't we fixed this yet?

I, for one, hope this succeeds. Maybe then we'll have a way to get the masses to understand just how bad this surveillance state really is, for all of us.

So it'd be up to the backup software with access to the sensitive storage being smart enough not to cause that problem. Alternatively, backups and restores could require an internet connection.

First, the analogy is completely wrong.

Second, Microsoft is realizing people are getting seriously tired of the bullshit "always on" concept. It's hard to justify and is widely rejected as a valid technical limitation on platforms where you expect to always have an internet connection (and is only accepted when the gameplay itself REQUIRES a connection, unlike the late SimCity). It's completely unacceptable in a device that historically has been played without an internet connection, and in the best case, that scenario becomes like the PC, in that it's only acceptable when the user wants to play some form of internet-based multiplayer.

There is no valid technical justification for "it has to either be all physical CDs or you have to have to connect to our servers every 24 hours". With a properly secured console, it should be fairly trivial to support shared digital games without requiring a ping.

I, surely less intelligent than the entirety of the xbox team, came up with this in about 10 seconds:

Person A informs server of intent to share game G with person B.

Server sends a message to person A: "game G disabled for period X hours". This message is signed for authenticity, with public key crypto, verifiable by a public key stored in secured memory on the console.

Server sends a message to person B: "game G activated and enabled for period X hours". This message signed identically to #2.

Person B starts game G, console verifies signed access card, if valid, downloads game. Once download/install is complete, console again verifies access card. If valid, runs it. Periodically, every 30 minutes, console checks running processes against associated access cards. If an access card becomes invalid, the process is terminated gracefully (save progress, notify user why).

Person A tries to start game G. Console verifies signed access card, if valid. Access is restricted, so console informs user G is temporarily unavailable due to being shard with Person B.

Surely this isn't that difficult to implement? And now you don't have to be online except to download the digital game.

I seriously HATE it when companies try to impose nonsensical, unjustifiable, technically wrong "limitations" on me just because it suits them. Stop it.

But on the other hand, someone who seeks asylum from a tyrannical government who would illegally violate those rights and possibly torture or indefinitely detain them is clearly a bad person. Even though this is very similar to how our country was founded.

I don't see how those two views are not entirely contradictory.

And that's what the mainstream media has been focusing on in this case: he fled to China. That's the only important thing. Clearly he's guilty. Clearly he's a treasonous anti-American. Is he a Chinese spy? It's all borderline defamation at this point.

For instance:

"Do you think PRISM is a powerful tool to prevent major terrorist attacks?" 48% yes, 52% no

A powerful tool which has yet to provide leads into a potential threat (rather, traditional means have still been significantly more effective), and which failed spectacularly to even hint at the Boston Marathon bombing? There's too much data. People can easily use code words or encrypt their communications. It's horribly and totally unreliable, and warrants are already a thing.

"Is Bradley Manning a hero?" 31% yes, 69% no

"Should Edward Snowden be prosecuted for disclosing classified information?" 56% yes, 44% no

"Do you consider Edward Snowden a hero?" 34% yes, 66% no

But then...

"Are you glad that Edward Snowden revealed the secret surveillance program?" 75% yes, 25% no

That seems like strong cognitive dissonance. Is it possible the people answering this poll are getting their information from a source that bashes the person/act, minimizes the program (or discloses no information about it or how it could be abused), but is happy it's a talking point? Maybe NBC and Fox News?

Am I presumed guilty, since it's clear there's "evidence" to show that I was the source of the now widely spread copy? Do I now have to prove to a judge that I actually didn't upload that file to TPB?

Guilty until proven innocent?

If the government is amassing information on individuals to prove guilt of some crime, by withholding that information from counsel, it's very possible that evidence that proves the individual is completely innocent may be destroyed inadvertently since the individual has no idea what they might be someday accused of.

The reason it really doesn't hold at all, in general, is because many websites (and particularly their contents, not necessarily the sites themselves) cater to different interests, and it's really not a surprise that people in different age groups have different interests. It's also certainly not surprising that Reddit caters to the interests of younger people more than Facebook does.

Consider Disney.com. Nothing new or hip about it. I'd bet >80% of the users are under 30.

I think this is a fairly incorrect assumption, and it feels like it's being used to justify an opinion about Facebook here by undermining how "cool" and "hip" it is.

Just come out and say what you want to say. Facebook sucks, and there's definitely nothing new about it anymore. I'll do you a favor and not try to trick you into agreeing with my opinion by making misleading correlations between it and objective data. If you disagree with me, awesome, you've found something of value in Facebook. That's great for you. I hate it. We're different! :)

http://en.wikipedia.org/wiki/Secure_Socket_Layer

For instance, on HN, Chrome is currently doing this:

    Your connection to news.ycombinator.com is encrypted with 128-bit encryption.
    
    The connection uses TLS 1.2.
    
    The connection is encrypted using AES_128_CBC, with SHA256 for message
    authentication and ECDHE_RSA as the key exchange mechanism.

1. Brute force the 128 bit key. This is.. probably not going to happen?

2. Via a weakness in the AES128 algorithm or implementation, you can simplify a brute force into feasibility (AFAIK, no such attack currently exists).

3. Via a passive attack on ECDHE_RSA, you could potentially guess the shared key efficiently and decipher our communications (AFAIK, no such attack currently exists).

So it's not quite as simple as recording encrypted information and obtaining the SSL keys. You need the server to actively remember the keys used for every encrypted connection, and obtain those, too. Or MITM everything and record the unencrypted data.

There's a fairly huge difference between how browsers handle HTML and JS. After fully parsing HTML, the DOM tree is completely built and once resources are loaded, the page is completely rendered. It's declarative. Code is different. No JS interpreter runs a function you define until you call it. So code is parsed and then later on, independent of its parsing, can do things.

When you're asking if code does something, especially in the context of an event listener, it's expected you're actually running the code, regardless of how you've presented it. The HTML equivalent would have been to have asked if opening index.html here would've caused an alert to be shown.

    <!-- index.html -->
    <a href="image.html">Click me to see a funny picture.</a>

    <!-- image.html -->
    <img src="catpic1029381859834.png">
    <script>
        alert('I hope you like my cat!');
    </script>

> It's a difficult quiz, no one's expected to get everything right.

Incorrect. It's a deceitful quiz. The delivery is excellent sans a few load-time render issues, but the content needs work.

> Does the above trigger a request for the current page (a reload without user interaction) in any of the following:

The "without user interaction" as presented describes the request for the current page, implying a programmatic reload, not "will this code run without user interaction." Of course it won't, nor will this:

    function foo(){
      console.log('harharhar, I won\'t ever be printed, obviously!');
    }

> If the currently executing task is the dispatch of a resize event in response to the user resizing the browsing context

Emphasis mine. It's reasonable for an implementation to interpret this as a manually fired event does not meet the criteria and reload the page, while the same code called while actually resizing the browsing context would not.

Some of these questions, by their nature of being browser-specific, are time sensitive since no versions are specified. And I'd have to double-check all of these answers because I found at least one which is wrong:

    window.onresize = function(){window.location.reload()}

Unfortunately, there's still no NoScript for Chrome :(.

In that case, I have no interest in any of their articles.