sounddust

One piece of advice for those in this situation: get the best American Express card that you can qualify for. It doesn't solve all your problems, but there are many cases where it magically just works. One example is ordering things online: AmEx is much more flexible about the shipping/billing address not matching up, and as a result I can often use it with a shipping and billing address from France with no problems.

In addition, their customer service is fantastic, and they can often give you good advice or help you out when you get stuck in these situations.

From the web developer perspective: It's very hard to use JS without putting at least some javascript in the HTML. Loading js files is not very useful if there's no means to actually activate any of the functionality of those files.

In order for your idea to work, you'd have to completely strip all HTML of anything that can reference or activate javascript: not just mouseover, but also href="javascript:xxxx()" as well. That means that the only way you could actually use javascript on a page would be to create a function that would be loaded by body_onload to add event listeners and other attributes through DOM manipulation. It would make web development so convoluted that I doubt that you'd succeed in convincing w3c or anyone else to adopt it.

I think the right approach has to maintain the workflow and functionality of web development. tptacek posted an idea in the other thread that sounds like it would reduce the number of attack vectors without causing too much difficulty to the developer: include a nonce in the header and require script tags to include that nonce.

Your <noscript_within> tag is something that I'm sure every browser developer (and web app developer) has thought up at some point. It does not resolve this problem. It would only protect a site in the case that a website allowed all user input to be passed directly onto the page unedited. Your solution would require app developers to allow commenters the full range of HTML (including blink, marquee, and who knows what else) in their comments. Because once the app developer starts to try to filter the commenter's input, he's opening himself up to an exploit that allows the filtered output to contain a </noscript_within> tag.

The simplest example would be an app developer who simply deleted all <marquee> tags because he/she wanted to disallow marquees. The script kiddie would just insert </noscript_<marquee>within> into his comment.

The more complicated examples would be things that neither you nor I have thought of yet.

That doesn't even take into account the exploit of users in legacy web apps who could potentially start passing in unclosed <noscript_within> tags (in apps which allow HTML but filter only certain tags) to disable legitimate JS later in the page, breaking the apps. Of course, it would be possible to only enable <noscript_within> based on doctype or something else, but then it's certain that some web developers will accidentally forget to do so and leave their app open to abuse.

You are oversimplifying the problem. I am sure that a solution exists and XSS will eventually become a problem of the past, but the solution will be more complicated than you claim it would be.

a. That would barely mitigate the problem; it might stop some of the goofy alert() hacks from people messing around, but the others are just going to use the exploit to include an external .js file. Even if your meta-tag would require all JS code to be in the <HEAD>, someone could have used this exploit to create an iFrame which then contained the JS. Or create a meta-refresh tag that redirects to the page with the exploit. The possibilities are endless.

b. If someone figures out how to break the character escape jail, then they're going to be able to write a </noscript_within> tag.

The iPhone 4 loses 24.6dB of signal strength when cupped at the bottom vs 17.7dB for the Nexus one. If Apple should be required to add an insulative coating to the stainless steel, then shouldn't Google also be required to make their phone thicker (or make other adjustments) until it reaches the 14.3dB reduction of the 3GS?

If Apple is required to subsidize a bumper case, to bring the signal reduction down to 7.2dB, then shouldn't Google also be required to subsidize a case (even with a case, Google's signal reduction would still be 7.7dB).

Also, the iPhone 4 can hold a call quite well at the absolute minimum signal level of -113dBm. If the Nexus One can't do this, then should we demand that Google recall the Nexus one until it can do so?

This whole issue and the hundreds of news stories around it are ridiculous. This is not a black-and-white issue of the antenna working or not. The phone has a weaker signal for some people, and a stronger signal for others, depending on how you hold it and where you are. Take that into consideration when choosing a phone. If it's not working out for you, then just return the phone and buy one you like.

It was kind of you to offer the money, but I wouldn't make negative assumptions about your friend for not accepting it. Consider the possibility that he has good reasons for not accepting it, and that those might be the correct reasons - that he may actually be better off without it in the end.

No, you couldn't. Back then, the web was split between two major browsers: IE and Netscape. However, the feature set of what was supported in JS was not only completely different among the two, but also completely different among different minor versions of the two. Things that worked on Netscape 6.x would be broken on 6.(x+1), and work again in 6.(x+2), although with a different calling convention. It was mind-numbingly frustrating, and I don't think it would have been humanly possible to write JS that supported all minor iterations of each browser and maintained any sort of complex functionality.

By contrast, in 2006, I wrote a JS library that worked on IE6, Firefox 1.0+, and some early version of Safari. It has worked ever since, among dozens of versions of those browsers. That's the difference.

(Edit: I'm struggling to remember what version Netscape was around 10 years ago; the version number above might be wrong.)

The only reason it wasn't acceptable to require Javascript many years ago is because each implementation was so different that it was impossible to guarantee cross-compatibility. If you used JS, it would almost certainly mean that you would render your site useless to a significant group of your users.

Those times are over; Javascript is so consistent across browsers that it's extremely rare to see cross-browser issues unless you're on the cutting edge of web development. And those implementations are converging, so these problems are quickly going from rare to nonexistent.

So the answer is yes, it's acceptable.

(Note: don't play any long-term Flash games with Flash cookies disabled).

If I had known about this issue beforehand, I still would have bought the phone. It doesn't impede my usage in any way, and this is easily the best phone that I've owned, taking into considerations its positives and negatives. It's definitely worth it to me.

Of course you have the right to disagree, and if you already bought the phone and are dissatisfied, then I hope that you'll get a refund. But I think that you are exaggerating somewhat; you have to look at the overall package and function of a phone to determine if it's worth buying, and I don't think this issue is as severe as you're making it out to be.

I took a ziploc bag folded in half (therefore 4-ply) and wrapped it around the metal, and no matter how hard I squeeze it or cover it, the signal doesn't drop below 5 bars.

The iPhone 4 (mine, at least) has the exact same issue, and it's almost in the exact same place, the only difference being the reasoning behind why it happens (in this case, it seems to be about bridging two pieces of metal with your hands), and how it can be avoided (buying a case might help with the iPhone 4, whereas it didn't with the iPhone 2G).

I've owned many other phones that were sensitive to where you held them, in fact I think every phone I've ever owned without an antenna that sticks out is sensitive to this problem to some degree. I had to "train" myself not to cup my hand behind the top-backing of the Nokia I had before my iPhone. And now I'm already "trained" from holding my iPhone that I don't touch the bottom left of the phone when I talk anyway.

It's not a big deal, just something to get used to (and it might turn out that a case will resolve it, which can't be said about many other phones with this issue). It is a legitimate "con" when determining whether to buy the phone, but it doesn't deserve all the ridiculous comments about how the phone is somehow flawed because of this.

(And just to give some more specific details of how this affects my phone: if I put pressure on the bottom-left corner of the phone with my hand where the seam is, the signal strength drops: by 1-2 bars if I hold it normally, or all the way to 1 bar if I give it a death grip. In either case, the calls don't seem to drop).

If you want a Google-voice like service that works in Europe, then try 3jam (although it's not free).

That having been said, you don't get as much use out of it as if you lived in the US. But I use it for free unlimited SMS (incoming and outgoing) to my friends in the US, and for voicemail with an American number .

Of course Apple could change the price based on exchange rates, but price hikes anger consumers, and there may be laws that make it difficult to suddenly raise the price anyway, especially if they have advertised them in catalogs, etc. And that's not to mention all of the third-parties that would have to sync up with Apple on these changes, and all the wrath they would face from consumers, etc.

So I think that their strategy is to set a price that gives them a currency fluctuation cushion and round it to an attractive number that ends in 9.

http://www.youtube.com/watch?v=vJpEuMidcSU is a perfect example of what I'm talking about. If you were to make a list with checkboxes, it would seem that the N97 is as good as an iPhone. But if you actually use it...

I don't think it's a U.S. vs Europe thing; it's just that Nokia had a headstart in Europe. I would bet that they're losing market share here in Europe as well. At least in France, it seems that everyone has an iPhone these days.

That having been said, I do think Nokia makes excellent hardware, particularly the actual phone functionality (voice quality, not dropping calls, etc). If they could just bring their OS up to par, they would see some attention and success in the US.

My point is, I agree with you; I hate manipulative media as well. That's why I think that on HN, we should not be using sensationalist titles with unconfirmed inferences like the one in the title of this post, and we should be discussing this from a more neutral point of view. Otherwise we're just as guilty as anyone else.

The article itself was quite favorable toward the EVO, so claiming that they would be upset by favorable results toward EVO in the poll is kind of nonsensical.

As for the $30/mo unlimited, I believe part of the reason why AT&T removed the unlimited option in the first place is because a disproportional amount of bandwidth is spent by people who jailbroke their iPhone and use 100+GB/month using it as a 3G modem.