Hacker News Reader

It's common courtesy to at least give the vendor a chance to fix the bug before you go public.

I don't use Skype, and I'm no fan of Microsoft, but this security advisory is just shameless (and harmful) self promotion.

spjwebsteron Faster JavaScript parsing

According to the stats gathered by HTTP Archive, the average response size (i.e. after compression) of a JavaScript file is 15kB: http://httparchive.org/interesting.php#responsesizes

This will make JavaScript parsing faster for the vast majority of sites, and for the majority of users.

If you have a single JavaScript file that is 1MB after gzipping, you really should think about modularising your code and lazy-loading the bits that aren't immediately required. See http://ajaxpatterns.org/On-Demand_Javascript

spjwebsteron Swiffy: convert SWF files to HTML5

Anyone who is looking for the "cool HTML5 future" to be ad-free is going to be bitterly disappointed. Online ads predated the ubiquity of Flash, and they'll be around long after Flash is forgotten.

spjwebsteron Implementing New Cookie Law Drops Use by 90%

The spirit of these regulations was undoubtedly to inhibit the practice of cross-site tracking using third party cookies or cookie-like technology. However, neither the EU directive nor the laws that implement it make a distinction between first and third-party cookies. They only distinguish between those that are "strictly necessary" (which I take to mean cookies that if you block them would prevent the site from functioning at all) and those that are not.

Tracking within your own website for analytical purposes doesn't fall under the functional interpretation of "strictly necessary"; your site continues to function just fine if the Google Analytics beacon isn't fired, or can't distinguish between a first-time visitor and a repeat visitor or follow a particular user through the site.

I have heard people argue that analytics are operationally strictly necessary; that we need some insight into the behaviour of site visitors in order to operate an online business effectively. There may be something in that interpretation, but I'm a lowly web architect, not a lawyer. As such, I would be wary of accepting this more lenient interpretation without significant input from someone more schooled in the laws of our land (or any land, for that matter) than I.

spjwebsteron Optimizely Open-Sources Guiders.js, a Library to Help You Guide New Users

I built a similar library on top of YUI called Feature Cue while I was at Yahoo! Sadly it was never open sourced, got rewritten, over-engineered and (as far as I know) faded into obscurity.

I'm glad the Optimizely guys have released their version, because based on our user testing novice users really respond well to this kind of interactive product tour.

spjwebsteron Varnish Cache v3.0 - Features and Additions in Brief

I know the title says "in brief", but it's a little too brief for me. From the horse's mouth:

http://www.varnish-software.com/blog/varnish-30-changes-esi-...

http://www.varnish-software.com/blog/bans-and-purges-varnish...

http://www.varnish-software.com/blog/streaming-varnish-30

Something to pay attention to from that streaming post: if the asset you're streaming isn't already in the varnish cache, only the first user to request it will get it streamed. All other clients will be blocked until the first stream is complete and cached.

> The object will be set to busy while it is streamed. Other clients will be put on hold. Furthermore, the rate at which the object is fetched by the client dictates how fast Varnish will fetch it from the backend.

Unless I'm reading the above wrong, [re-warming your cache for these large objects would seem more prudent than relying on streaming.

There's also a nice write-up by Redpill Linpro employee and Varnish contributor Kristian Lyngstøl:

http://kristianlyng.wordpress.com/2011/06/09/varnish-3-0-0-r...

spjwebsteron CSS Lint

Owing to the lack of options, this is only useful for linting CSS written by the authors or anyone who happens to agree with their opinions on what constitutes good CSS.

Crockford may be an opinionated cantankerous old goat, but at least he gives you options to dial down some of the crazy he's baked into JSLint.

* He's also awesome, but anyone who's worked at Yahoo! or glanced at the JSLint Issues list or Pull Request queue can attest that he has strong opinions.

spjwebster on Why So Serious?

Also see Jeff LaMarche's response: http://news.ycombinator.com/item?id=2620020

spjwebster on On Being Excellent to Each Other

Jeff LaMarche's follow-up to http://news.ycombinator.com/item?id=2618298

spjwebster on Cookie law makes most UK websites illegal: what you need to know

> Why do they not impose a legal obligation on google and ad agencies to not track, or on facebook or whatever.
They do. As I understand it, this law applies just as well to the likes of Google, Yahoo and Facebook as it does to the sites that host their ads. There is some ambiguity over exactly who is responsible for gaining consent for 3rd party cookies — ICO have stated that this is a complicated area and more guidance may be forthcoming — but my approach is that I can't trust these third parties to cover my arse so I'll do it myself.

spjwebster on Cookie law makes most UK websites illegal: what you need to know

Ignoring this law means ignoring the privacy concerns of your users. If you're happy with that, you're part of the reason this law was introduced in the first place.

spjwebster on Cookie law makes most UK websites illegal: what you need to know

There's a disconnect here. How does the absence of analytics mean the site continues to function with reduced usability? You could argue that over time the site's usability would not increase as much as it might be due to missing analytics data, but it won't be reduced just because the Google Analytics beacon isn't present on the page.
If you think that having analytics data is such a benefit to the user, explain to them why you want to track how they use your site and let them decide whether they're happy with that. That's all this law requires.

spjwebster on ICO.gov (click on continue without agreeing to cookies)

The previous implementation of the law was opt-out. It didn't work, because most users were completely unaware they were being tracked.
The real saviour will likely come in the shape of browser support for Do Not Track [1]. While it's not fine-grained enough to be used as the sole mechanism for gaining user consent for all non-essential cookies, it at least covers the 3rd party tracking cookies that were the motivation behind this law change. Note that DNT specifies that the default MUST NOT be opt-in:
> A user agent MAY adopt NO-EXPRESSED-PREFERENCE or OPT-OUT by default. It MUST NOT transmit OPT-IN without explicit user consent.
[1] http://tools.ietf.org/html/draft-mayer-do-not-track-00

spjwebster on ICO.gov (click on continue without agreeing to cookies)

The important bit is "but is essential for part of the site to operate." To me, that clearly falls under the "strictly necessary" banner, albeit that it probably shouldn't be set until you enter the part of the site that requires it.
Government IT moves at a glacial pace, and just like everyone else they're still trying to figure out how this stuff should work. That's why they've deferred enforcement for a year.

spjwebster on ICO.gov (click on continue without agreeing to cookies)

I take it you didn't read the comments on that post then? The ones that explained why the upfront cost of £585 is not at all unreasonable.

spjwebster on Cookie law makes most UK websites illegal: what you need to know

I don't get what's so hard about the concept of "strictly necessary". If you take the cookie away and the site ceases to function such that the user cannot complete tasks they are there to do, then the cookie is strictly necessary. If the site continues to function, even if your business analytics are somewhat impaired, it's not strictly necessary and you need to gain the user's consent to set it.

spjwebster on The Javascript memory leak we all do

It's definitely a stretch to say we all run into these issues, but you'd be surprised how many beginner and intermediate-level developers don't know about this issue precisely because they've been insulated from it by frameworks.
There are plenty of situations where developers can find themselves dealing with insane JavaScript implementations and irresponsible JavaScript frameworks. While the article doesn't explain exactly what the issue is and which browsers it affects (leading me to believe the author himself doesn't truly understand these memory leaks), the recommendation given is a sound one.

spjwebster on The Javascript memory leak we all do

It was an assumption I made in my reply (now corrected) but it doesn't matter; even without removing the node from the DOM there's a memory leak in IE4-6, one that persists until the browser is terminated.
In the other cases, there's no memory leak while the DOM node still exists, because the DOM still has a reference to it so it shouldn't be garbage collected.

spjwebster on The Javascript memory leak we all do

In every browser except IE4-7, removing the DOM node from the document would result in the entire lot getting garbage collected. This is garbage collection collecting garbage. However, in IE4-7 the JS garbage collector isn't responsible for handling DOM nodes and vice versa. Consequently, this results in a memory leak; in IE 4-6 this persists until the browser terminates, and in IE7 it persists until the user navigates to another page.
There is a related application-level memory leak if you have some other reference to the closure that doesn't belong to the DOM node, and that applies to all browsers. See http://news.ycombinator.com/item?id=2567847 for a simple way to deal with that.

spjwebster on The Javascript memory leak we all do

Indeed. Also, a slightly more succinct fix for IE6/7 would be:
function foo(element, a, b) { element.onclick = function() { /* uses a and b */ }; element = null; // avoid memory leak }
The closure contains a reference to foo's activation object, not to its properties. As a consequence, you can clear out the element reference after the event handler has been defined and this will break the circular reference.
The above technique is also useful when creating anonymous functions for other purposes when element references happen to be lying around. Depending on how long these anonymous functions are kept alive and what you do with the elements in the meantime, this would normally lead to a memory leak (due to the dangling reference to the DOM element, rather than a circular reference as described in the article).
See http://jibbering.com/faq/notes/closures/ for a seriously nerdy deep-dive into closures in JavaScript.

spjwebster on Guy Asks For Software Crack, Creator Provides Free App Instead

Since we're on the subject of alcoholic beverages that taste better than your average beer, I'm honour-bound by my West Country upbringing to suggest some decent quality cider. I'm talking about Henney's Frome Valley, Weston's Organic, or (if still and cloudy cider is your thing) Addlestones. This is, of course, unless you can get hold of some proper West Country homemade scrumpy. Cheers!

spjwebster on Google Wants to Kill the URL: Chrome 13 Lets Users Hide the Address Bar

To activate teh hidden URL bar, users will also have to right-click a tab and select "Hide the toolbar" [sic]
The sources quoted in this article in no way support the conclusion present in the title. As phlux said, other browsers have enabled you to turn off the address bar. Are they trying to "kill the URL" too? No, and neither are Google.
This article comes off as little more than sensationalist (albeit apparently effective) link bait.

spjwebster on Sniff my browser: The Modernizr inadequacy

Modernizr classes are best used in the `.no-feature` case, where you do something like use background images or another clever CSS use to mimic the feature or handle the fallback situation.
Switching from progressive enhancement (applying styles if you detect a feature is supported) to graceful degradation (applying styles if you detect that a feature isn't supported) doesn't solve the underlying problem. In fact, it makes the situation worse. JS failure with the progressive enhancement approach means that everyone gets the fallback experience; failure with the graceful degradation approach means that you're potentially asking a browser to apply CSS that it doesn't understand and not offering it a fallback.
No matter which way you cut it, having CSS predicated on classes set by JavaScript creates a dependency where one should not exist. I realise that's the whole point of Modernizr, but in my opinion it isn't the right way to solve this problem. Others may not agree, and that's fine, but it's critically important that developers being encouraged to use Modernizr (or its underlying techniques) are made aware of the tradeoff they are making and the potential impact that may have on their users.

spjwebster on Web App Hacker's Handbook 2nd Edition - Preview

It's the same link as posted on the book author's buy page ( http://portswigger.net/wahh/buy.html) so I'd imagine the parent just copy/pasted it here.

spjwebster on Cracking the credit card code

Back in the day, when processing payments for online transactions cost the earth and pre-auth was but a twinkle in the eye of the bank API developers, knowledge of the Luhn algorithm allowed one to test services via their free trials without having to give up one's credit card number. These days it's only useful as a pre-pre-auth sanity check.

spjwebster on Levels of Infinity

For a fictional, tripped-out exploration of the various levels of infinity, try Rudy Rucker's White Light:
http://en.wikipedia.org/wiki/White_Light_(novel)
I picked this up at a end of line book shop when I was 13 or 14, along with a bunch of other Wired Press books, and it blew my mind.

spjwebster on Why HTTP Streaming?

This is a common misconception. In fact, HTTP Live Streaming as proposed by Apple has nothing to do with chunked encoding. The former splits the video into multiple "chunk" files, using an m3u file as a playlist. Stream variants are supported by having multiple sets of video and m3u files, but dynamically switching between them based on bandwidth is left to the client.
See:
http://tools.ietf.org/html/draft-pantos-http-live-streaming-...

spjwebster on Working Best at Coffee Shops

My take on this is that there's a little part of my brain that wants (nay, needs) to be distracted so that I can actually get on with working. It can be a TV in the next room, a movie or video game soundtrack pumping in my headphones, or a coffee shop full of people and white noise. If that part of my brain isn't distracted by these things, it interrupts the main thread and I find myself lost in HN, my feeds, the BBC website… anywhere but my work.

spjwebster on What ever happened to TextMate 2?

As a long-time TextMate user I hate to say it, but the TextMate 2 saga is a modern-day poster child for why the "throw it all out and start again, it'll be done when it's done" model of refactoring is rarely a good idea.
Users want those "incremental features" that Allan mentioned in this post, and don't care too much what the underlying architecture looks like. It's hard to believe that it wouldn't have been possible to deliver those features whilst iteratively refactoring the underlying architecture.

spjwebster on IE6countdown.com – a wolf in sheep's clothing

I didn't say it was shady or even controversial, just that it isn't as good a deal as it seems. I had a whole "jumping from the fire back into the frying pan" analogy lined up, but couldn't make a snappy title out of it.