3,861 karma · joined December 14, 2012
tom at tom brossman dot com
As an aside, your profile says you signed up 1337 days ago and your karma is at 1358. Another 21 down-votes and your Hacker News profile page will looking pretty leet - I say go for it. Remember, it's just fake internet points, you can't spend them or do anything interesting with them.
I don't know enough about how this works to figure out how to work around it so I reverted to blocking ads at the router with a hosts file. NoScript provides too many other benefits so I had to keep it and stop using pi-hole.
Over the last years working with Seafile Ltd. has proven more and more difficult. Our cooperation now has reached a point where we can no longer in good conscience develop a software together.
Our goal at Seafile GmbH is and has always been to provide a stable and reliable product for our customers and the Open Source community. We have been disagreeing for a long time with
- the current development race,
- erratic changes of public plans,
- beta testing on paying customers,
- removal of features without proper prior notification or migration plans and
- disrespect towards data privacy when it comes to German or European law.
(that last bit is surprising...)
That's likely because CC-licensing has been available on Flickr since 2008 [0] and they only recently started offering the Public Domain license as an option in 2015 [1].
It's good to see them finally offer more license types but they are so late to the game that many people like me just self-published or posted to Wikimedia Commons under the PD license instead, for all those years. I'm sure my images get fewer views than they would on Flickr but I can't be bothered to switch now.
[0] https://www.flickr.com/commons [1] http://blog.flickr.net/en/2015/03/30/flickr-now-offers-publi...
The Google Maps image date is September 2014 (fine print at bottom of page) and we must assume it looked the same on the accident date. It's entirely possible it looked very different on the accident date. Paint spills, fire or previous accident damage to road surface, debris on roadway, etc.
Also missing from all the reports are weather conditions. Did I miss them? I don't see it mentioned at all in the Times or Detroit Free Press articles. Are we assuming it was a sunny and clear day? That view is going to look very different during a thunderstorm.
Pennsylvania seems to be way ahead of other states in their willingness to research safety issues and make changes to their roads and laws. It was the first state I know of that made it a law that you have to have your headlights on if you are using your rain wipers. Makes sense now but they did it first and it definitely helps others see you. They also paint big white circles on the interstate in areas where rear-end crashes are a problem, so you have a very clear visual and know to keep at least three 'dots' behind the car ahead. There are plenty more examples but I feel like this is the perfect state to have something unfortunate like this happen.
The reason they would keep deleting and re-listing the item is because I would leave bad (but factually correct) reviews when I kept trying to find the phone dock and seeing their new listing in Amazon's search results. Their re-listing action caused my reviews to disappear because it was a 'new' product listing with their same fake photo every time. I flagged this repeatedly to Amazon as fraud via chat, email, and telephone and they never took any action. This went on for months, and Amazon never addressed it.
So my point is that by allowing anyone to post a review, you give consumers one more tool to warn each other about fraud and unethical sellers. Yes there are a lot of fake reviews, but there are also legit buyers out there too and we are willing to pester fake sellers for months and cost them a fair amount of losses (postage, abandoned fakes because they don't want them back).
Sellers know they can delete & re-list fakes all day long to disassociate negative feedback for an item , and they know Amazon will never ban them.
The span under the trailer behind the rear drive axle(s) and the forward trailer axle is much longer than you find on European trucks. That means you need a much longer underride guard. You also have to convince trucking company execs that all that extra weight is a good thing even though they know it's cheaper to pay the occasional settlement after a gruesome accident.
Also, putting the trailer axles further forward to shorten the gap is not possible until Indiana changes their minimum axle length regulation (40 feet trailer kingpin to rear axle centerline) because I believe that while they are the only state to have such a rule, you can't do much interstate commerce with a fleet of trucks and avoid travelling through that state with its central location.
Trucking in the US is massively regulated and bureaucratic and you are going to need a lot more than will to get it to change. I'd love to see safer trucks too but I am not optimistic about seeing underride guards in the US anytime soon.
A very close second is the ext4 filesystem, but I don't know if this qualifies as software. I've done all kind of stupid things when formatting or unplugging drives and have never lost data. Full-disk encryption on everything and never a problem. SO reliable. I was doing a full backup to two separate drives at once, one external and one SATA internal. The power went out and I wasn't using a UPS. When the power came back on, everything was still fine but I was worried about data corruption so I plugged in yet another, my last good external drive with a known good copy of everything to compare against. Then the power went out again! I didn't even shout or curse, that's how mad I was. No data loss though, everything resumed from mid-backup and happily continued.
I would raise the stakes a bit more and send PayPal a hard copy of supporting documentation and tell them that you will be disputing any negative report. Send this by a recorded delivery method like registered mail or courier. This means you can go to court and prove that PayPal had clear evidence of fraud and failed to take appropriate action. It also proves that they had knowledge of these facts prior to making the negative report to the credit agencies, which puts them in a bad spot if this all ends up in court. In the USA, the Fair Debt Reporting Act covers this scenario but similar laws exist in other countries.
Keep good documentation and send everything by a trackable method and never let these companies get away with ignoring you when you have a legitimate issue. Just make sure you are sure you have proof that you are correct, otherwise keep better documentation next time.
Basic courtesy and being polite are pretty much universal, so try to be humble and keep an open mind and observe. Older people often are more experienced and savvy about how to handle something so being deferential to them is a no-brainer. You'll spot the incompetent ones soon enough and so continue being polite but ignoring their guidance.
One thing that drove me nuts but took a little while to figure out was that people would almost never say no to a request. I would ask if something was possible and they would pretty much always say yes, not wanting to disappoint, but I would have been better off hearing a 'no, sorry'. I wanted a realistic answer and theirs were often far too optimistic.
Me: "Mr Son, can we make it to Osan in 30 minutes?"
Him: "Yes" (always yes)
An hour later we show up late to another hospital with a very impatient air crew idling and waiting for our patient transfer. We would have all been better off hearing a "No, it takes an hour". Just one small example but this scenario repeated frequently.
I learned that when speaking to a group or doing a presentation it was customary to apologize for your inexperience on the subject and promise to do your best. Tim Berners-Lee could start a talk with "I'm sorry I don't know much about the World Wide Web..." for example and Westerners would laugh but the locals would be like "He's off to a good start".
Understanding this helped me get more realistic answers though. Even if I thought I knew an answer I would keep the question more open-ended to solicit a better response.
Me: "Mr Son, I'm sorry but I forget how long it takes to get to Osan, can you remember?" (said even after making the trip solo dozens of times in often difficult and stressful conditions).
Him: "Ah yes, there is new road construction halfway there so I'll teach you an alternate route to bypass it. We'll be there in about 40 minutes".
Had I not learned to ask a better question, I never would have learned his faster alternate route.
Korea was a lot of fun and I really enjoyed hanging out with the older Koreans who worked on our base, they were a constant source of good info once learned how to talk to them. I also had a 'ration card' entitling me to buy the occasional bottle of Crown Royal on base and give them, which always helped!
I think you have this backwards, sorry. Perhaps it used to be true?
We have reached a tipping point where using a JavaScript blocker like NoScript actually improves the browsing experience. And not just a little bit, I mean substantially. The NoScript UX is good, and I can easily toggle domains on/off. I very seldom have to enable JS for a new site and my list of permanently white-listed sites is relatively small, maybe 20 or so.
To anyone who still thinks that JavaScript makes your browsing experience better, try browsing without it again. The shitstorm of clutter and annoyance that people keep complaining about is now the worse option. No one is hijacking my scroll, no modals are blocking the page content, pages load lightning fast, it's great! For a select few sites that can be trusted to run JavaScript to improve my experience, they get white-listed and work well too. It's my browser, running code I decide to approve, and the overall experience is very good.
All I can suggest is to keep trying every few months. I have been trying for years. My carrier still isn't listed but it finally started working about two weeks ago for me (I'm not in Germany though). Now I have to hope it keeps working with my still unlisted carrier or I risk getting locked out of my account. At least the bad guys are locked out too...
I like the idea behind the project, but from personal experience I decided that I had to switch to another provider that had more robust infrastructure and regularly patched their machines. DNS is too critical and I felt the risk of having my DNS requests hijacked by a compromised machine was too great.
(Also, who down-voted the parent comment? Bizarre, maybe that was accidental?)
I did this a while back for several of my domains and it was easy and fast. One new problem I have is that after getting on the list and moving the static HTML sites over to CloudFront's free HTTPS offering, I see Chrome 50+ will require that you keep sending the 'preload' header directive, which is impossible to do with CloudFront. Bummer.
If anyone from AWS sees this, please note this is one more reason your users want the ability to send extra headers. Even if it's only a select few headers chosen from a dropdown list, this added functionality would come as very welcome news.
I think we've reached a tipping point recently where the relative annoyance of disabling Javascript is now less than the benefit of allowing it everywhere.
I have gone into Firefox's settings and deleted random certs like the Hong Kong Post Office and this didn't break any of the sites I use, but all certificates are re-installed each time Firefox updates.
Thinking more globally, someone living in Hong Kong might prefer to keep the Post Office one but distrust all American CA's from their browser and they should be accommodated too.
Imagine treating the set of trusted CAs in your browser just like your ad blocker's filter list. You would damn sure need a trustworthy curator to maintain that list, but it seems doable (in my admittedly non-expert and humble opinion). Does such a thing exist? Moxie's Convergence extension is the closest thing to it that I'm aware of: https://en.wikipedia.org/wiki/Convergence_%28SSL%29
We regularly have people visit from all the way up and down Hitler's 'Atlantic Wall' and they really like the number and condition of the bunkers here.
Strong consumer protections exist in many developed nations which limit your liability, it is the banks who stand to lose. No doubt it can be a hassle if your credit card number is stolen, But that card is the bank's property. You just report any fraudulent transactions and get a new card if necessary. The more important thing to protect is your private data, you can't get that privacy back.
Also, NoScript is awesome and I highly recommend people try it. It can be fiddly to get working at first but a surprisingly high percentage of websites work better without having to white-list anything. It also helps with privacy by blocking trackers like Google Analytics, especialy on sites like Troy's which lack a privacy policy and do not provide any warning at all about third-party trackers to site visitors. Pretty new site redesign, same lack of transparency as before.
* By 'regular users' I mean when I say "Try an ad-blocking extension with your browser, add it from the menu" and they say "What is the menu?" and we build their knowledge up from there... . It can be frustrating for all but I highly recommend it as it keeps you grounded and provides balance for the HN bubble I sometimes find myself in.
openssl speed rsa2048 rsa4096
on your server for what is probably going to be a rude awakening. For a small, low-traffic site you might be able to manage but as traffic increases you are probably going to regret choosing 4096 bit certs unless you absolutely need them for a specific reason.
The site with FF + NoScript loads perfectly. Everything I need to read the article and use my keyboard shortcuts works fine, no tampering with my preferences. 20 requests, about 1.5kB and loads in just a hair over one second for me - perfect.
It really is an improvement over the defaults that most websites deliver. It's true that some sites completely break without JavaScript but these are not the norm, and if they are worthy you can always choose to whitelist them temporarily or permanently. I've used the extension for about ten years and have only needed to whitelist a few dozen sites total.
Do yourselves a favor and give it a try if you haven't already. I can't guarantee you will love it immediately but as your 'cut through all the bullshit' option it truly excels.
I've provided numerous facts and backed them up with links to sources. That is a substantial transfer of information which you didn't acknowledge. What does all that great security you describe mean for all those people not getting updates? It is a real problem.
You go on to say "That is to say, unless you purposely go very far out of your way to install custom system software that deliberately weakens critical Android security features -thus putting your Android device pretty squarely in the realm of PC-level security-, then there is no software in the Play Store that will take over your Android device." The Viking Horde malware is bad enough with the ads popping up and dangerous links appearing, whether this is 'safely' sandboxed on a vanilla install or completely taking over a rooted devices is of little significance to me. I don't want ANY of it.
I'd like a secure messaging app that can be installed on a more hardened version of Android like CopperheadOS, which does not require the constant 'phoning home' to Google that most Android phones do. Remote install capability via Google Play is huge red flag and a deal breaker for me, but I understand Moxie intends to target more mainstream users and has to make compromises to serve them.
A fair number of Android users like me are more concerned about the mass surveillance practices of advertisers such as Google than we are about the full-on 'tinfoil hat' NSA stuff. I don't like either, but the corporations are more worrying because they're attracting the better workforce with their higher pay and as a result are more effective. We want Signal to protect us from Google, not the NSA.
What initially made me post my first reply to your initial comment was that I saw it was attracting down-votes and I thought you put some effort into it and made some sound points, so I upvoted and replied. This thread has probably run it's course at this point by my email is in my profile if you have anything else to add.
What part of your response above advances your counter-argument please? The closest you came was saying that "Actual "take over your computer" malware doesn't exist in either the Play Store or the App Store." but this is directly contradicted by this story from just yesterday: http://www.slashgear.com/viking-horde-malware-uses-google-pl... (plenty of other sites covering this too)
I'm also unclear about missing limbs being somehow analogous to 'abandoned' phones. Let's set that aside and have a look at this chart on Wikipedia: https://en.wikipedia.org/wiki/Android_version_history Can you look at that and still say that updates are not a wide-spread problem? It links to sources and indicates to me that most Android phones are not using a current version with up-to-date security patches. Do you disagree?
I've stated from the beginning that I disagree that distribution via Google Play is any guarantee of security and provided links to specific examples of malware in the Google Play store as evidence that Google Play has repeatedly been used to distribute malware to many millions of devices. Can you rebut this?
As an aside, I'm reading your reply and I'm thinking to myself "If someone needed a comprehensive 'how-to' for a straw man argument then this one is pretty good". Also please consider that popups were a real problem as late as the early 2000's. That means you must be thinking I am in my early teens, if I am to take your "Are you old enough to remember popup web advertising?" comment at face value. I have to say it isn't helping to persuade me, and is having the opposite effect.
Let's take that brief dig into those 'malware' reports, shall we? Here's one from the Wall Street Journal[0] from last year. Some choice quotes:
"Security-software maker Avast called out a trio of malicious Android apps that were, until recently, available in the Google Play app store. The apps would go into sinister mode after 30 days on a device, and begin spamming users with advertisements, Avast said in a company blog post. Google told the Journal that, as of now, the infected apps have been pulled from Google Play."
"For those who had the apps installed on their phones for more than 30 days, a threatening ad would pop up each time they unlocked their phone, saying the device was out of memory, experiencing a security hole or some other false claim, Avast said. The pop-ups would then route people to websites where more malware could be installed on devices, said the security company. Anyone with either of the known apps installed should delete them immediately."
Do we blame the users since the apps informed them about permissions?
I've read and understood the same things you have, and reached a diametrically opposite conclusion. Maybe this is because I am also taking into account Android's severe updates problem, which is typically left to the carriers and handset makers to implement. Carriers and handset makers want to sell new phones, not patch old ones, who didn't see that one coming? Good on Google for patching Android security holes, too bad they don't reach the majority of users. I'm sticking to my original view and I guess we'll have to agree to disagree.
[0]http://blogs.wsj.com/personal-technology/2015/02/04/android-...