tombrossman

Piwik can. Run a self-hosted instance or pay them to run it, and it handles server logs no problem.

You do give up the ability to get live stats, but you get better performance and the ability to track more visitors (read: people like me who have blocked GA for years...)

Added bonus: Referrer spam is automatically blocked by default.

https://piwik.org/log-analytics/

EDIT: Almost forgot GoAccess, if you are okay with a terminal app and want live stats (can also be scripted to generate HTML reports) - http://goaccess.io/

Why hide it behind a link shortener?

Direct link is here: http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//...

There's something about pasting vs typing that fails to give the user the necessary feedback and this has been a problem for a while. I faced this same issue years ago and I finally figured out my passwords were being truncated by hitting the 'forgot password' link and noting that the service emailed me the plaintext password (another problem but let's do one at a time) which was fewer characters. My original was 32 and the one they sent was far fewer.

I emailed support to ask and they said 'oh yes, we limit the number of characters in your password'. There was no documentation or feedback on the page to tell you this if you pasted the password, but if after pasting you deleted the last character and then tried to re-type it, you would see the error. Pasting never triggered the tooltip telling you the issue.

Now I try this each time I sign up for something which is a minor hassle but still much easier than the seemingly random failures I had been seeing. It also taught me to immediately sign out and test the services' password recovery functionality to weed out the ones storing plaintext passwords, so that's good.

Yes, go with Jekyll and use this 'Clean Blog' theme: https://github.com/IronSummitMedia/startbootstrap-clean-blog...

There are probably multiple ways to do it given Medium's clean design and popularity, but that's the way I've done it and I can recommend it.

Scanning your comments, I haven't learned about what tracking is accomplished by serving the https://cdn·ampproject·org/v0·js file itself, can you please comment on what data (if any) is collected by being 'the' place all AMP sites phone home to on page load by default?

Two other points, and I hope these are received as constructive criticism.

1- You only score 'B' on SSL labs for the domain serving the AMP JS file.[0] Maybe this is intentional so as to include support for Android devices that no longer get updates but it's not great security for the rest of us.

2- Your page explaining the project executes Google Analytics tracking code and has no privacy policy and does not disclose the fact that you are tracking visits. This is a breach of your very own Google Analytics T&C's[1] which read in part "...You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies that are used to collect data. You must disclose the use of Google Analytics, and how it collects and processes data...".

Neither of these inspire confidence and I hope you can get at least one of them corrected soon.

[0]https://www.ssllabs.com/ssltest/analyze.html?d=ampproject.or...

[1]https://www.google.com/analytics/terms/us.html

I'm curious why you say "when visiting a AMP-enabled web pages, the pages do not render at all". I'm not seeing the same result. The first two 'AMP' pages I tested loaded very quickly and were easily readable.

I use Firefox with NoScript, which is definitely blocking the JS from ampproject.org. I also use Privacy Badger and uBlock Origin (thanks btw) and I'm not having any trouble at all. Here are the figures for the two pages I've tested with so far:

1- Visiting https://www.ampproject.org/how-it-works/ loads a perfectly readable page weighing 16.05kB in 40ms. It's just one file, the HTML document.

2- Visiting The Verge's demo page http://www.theverge.com/platform/amp/2015/10/7/9467149/googl... also loads a single perfectly readable HTML document weighing 17.6kB in 184ms.

I've used NoScript for quite a while and while I don't expect every page to work perfectly with it, the speed gains are incredible! AMP and NoScript aren't directly comparable but they seem to be accomplishing the same thing for me. Only one of them is also blocking third-party tracking and delivering feather-light pages which nearly always render acceptably.

Can you please clarify whether you mean the pages are totally blank, or if they just don't render the same as if you had allowed them to execute JS? (obviously if you globally block ampproject.org you can't access even their index.html page but that's not the info I'm after...)

It's true you can really DOS your own site if you don't follow best practices or have catastrophic data loss. Same with HSTS if you ever need to go back to HTTP.

On balance, yours is a solid decision for your company and for typical users. Just pointing out a complication with something new people are starting to use.

I've just started using it with a short TTL and several extra hashes I can fall back on in reserve. Works fine but I'm definitely not 'all in' yet.

Edit: Also, if my understanding is correct you _do_ create an offline 'key' to generate hashes with a backup CSR, though this won't help if your machine (with the backup CSR used to generate a new key & recover from a server compromise) is also compromised.

Probably not a top concern for users, but this does look like it would be really difficult to use with HTTP Public Key Pinning unless Sandstorm were also keeping the pinning TTLs pretty short - which defeats the purpose.

More info here if anyone's interested in HPKP: https://scotthelme.co.uk/hpkp-http-public-key-pinning/

NB I still get a broken character and not the magnifying glass on your site: https://imgur.com/a/3Rb7t

I think people seriously overestimate how useful CDNs are for static assets. Even if the page you visit happens to call for the same version of a resource you might have cached, there is no guarantee it is requested from the same CDN. And all these hostname lookups slow things down too. I frequently see a site request assets from multiple different CDNs when those assets are all available from a single CDN. The designer clearly copied a snippet of HTML without regard for the extra lookups when they could have found all the necessary assets on a single CDN.

I tried finding reliable data for cache hit/miss rates for popular CDNs but was unsuccessful. Is there a site out there tracking this that designers could refer to? It would be good to know if simply concatenating all your CSS (for example, or JS) into one file and serving it from Cloudfront would beat scattering it across several providers and hoping the majority of visitors had cached copies. I suspect the single file would perform better but I have no reliable data to support this.

Thanks for explaining the issue so clearly. I see this a lot after installing Privacy Badger and I wondered what it was called. In the rare instances that I needed one of these for page navigation, I've just hovered the mouse pointer over it and guessed at it's purpose by looking at the URL. It's one of those things that are an annoyance, but not quite a big enough issue to spend my time solving it or learning the cause.

Here's a classic example: http://consumerist.com/2009/12/31/30-day-window-to-cancel-sp...

I don't mind sharing but there are so many examples online for anyone searching 'cancellation letter template' I don't see the need. It's a completely standard business letter that you keep very short and to the point. Include your account numbers and do not bother with providing a reason unless you are exercising your 'get out free' option for a rate hike on a term contract. The shorter the better. Read the contract from the service provider and have a copy of your most recent bill to refer to for account details, and make sure the reader has enough info to process your request properly.

Note that this works best for small-time stuff like broadband or mobile phone plans, if you have a lot riding on it you are better off talking to a lawyer and paying for an hour or two of their time.

Sample text,remember to keep it very short and to the point:

<your address>

<their address>

<date>

Notice Of Cancellation Of Service (or alternate subject line, use bold print this line only)

Dear Sir or Madam, (or preferably a name if known)

I am writing to cancel service under account number <?12345?> in my name at the above address effective <insert date>.

(optional paragraph) I will return your equipment to your office on the same date and obtain proof of delivery.

(optional paragraph) I reject your rate increase of <insert specific detail here>. You forfeit the Early Termination Fee due to the following materially averse change to our previous agreement: <insert reason here> (It CANNOT be a sales tax increase or anything outside their control but can definitely be an increase in any silly and vague 'regulatory' fees, etc. A classic example is an increase in SMS fees from 5¢ to 10¢, regardless of whether you actually went over your allowance and paid an overage yet. They may offer to waive this but you are not obliged to accept - they chose to alter the deal and they broke their contract, not you)>

Sincerely,

<name & signature>

Haha beautiful, I was just typing this same idea in my other reply. Good luck, you are saving people lots of hassle for a low price and I hope you do well.

Yes, time is money isn't it? Like anything else it's easier the more often you do it. I have a template letter I adapt, and I use the automated kiosk at the post office to send. Do it when you are out running errands and it doesn't add up to much time really.

I can say that if I were running a $5 'let us cancel for you' deal I'd damn sure be doing it all by letter though. No way I'd pay to have a bunch of employees sitting on hold with Comcast when I could crank out form letters and mail them in big batches. Possibly easy money if you have enough clients to scale it.

Nearly all of these contracts with Comcast or similar companies will have a postal address you can write to and cancel. Even if they provide no cancellation postal address, look up their 'Agent for service of process', this is always listed somewhere. I never call to cancel, this is a waste of time and not necessary.

I've done this repeatedly (use certified mail, or recorded delivery, the term varies by country) and it's dead easy. I have cancelled service with no early termination fees at both Sprint and Verizon, and kept my subsidized phone while continuing on month-to-month service when they raised fees - a 'materially averse' change - always read the fine print. Same thing with AT&T dial-up back in the day.

This service looks interesting but really there is no easier way than sending a proper business letter and keeping proof of delivery. Only once did a company dispute receiving my letter and I emailed a scanned copy of the proof of delivery and that was it.

It sometimes helps to remind the company that falsely reporting a bad debt onto your credit record carries huge fines and you will definitely be checking to make sure they don't 'accidentally' forget or lose your paperwork, and that you have complete documentation and are prepared to defend. Be polite but do be firm, too.

First thing I look for in any announcement or news story about supposedly 'secure' smart-phones is a mention of the baseband issue. Failing to mention it indicates to me that they are unaware (and so insecure by default) or just don't care.

You'll see it mentioned occasionally in reviews but generally it's just ignored. I don't know if this is down to a lack of comprehension of the reviewer, or if the prevailing attitude is that this is 'too big a problem' to solve, and so nobody likes to talk about it. I do see it raised in nearly every HN thread about secure phones, so that's good.

I think it will take a big non-US based manufacturer with approval from their government to totally re-do baseband and fix this issue. It won't be certified any time soon in the US market but that's fine with me so long as it plays well with GSM.

Just to clarify, I'm using the CLI 'youtube-dl' tool to grab shows, which works really well across many different sites and services. I'm not watching BBC iPlayer shows in YouTube. Here's their site: https://rg3.github.io/youtube-dl/

That button isn't displayed if you are outside the UK, which causes some confusion. I guess it's a simpler solution than redirecting to an error page.

I disagree with how you've framed this. When you say "All they want to do is play video with some UI around it." that is solved, it's fairly easy and works fine.

At issue here is DRM and the BBC's need (probably contractually mandated by the rights holders) to control what you can do with their content on your devices. It's about control, not about simple delivery.

I use Linux only and when I visited the opt-in page with Firefox I received the following error message: "Sorry, we can't provide you with the HTML5 Player beta because your browser doesn't support Media Source Extensions. Please try another browser. Only Google Chrome is supported on your platform at this time." Testing the same page with Chromium and it worked fine. I won't use Chrome and won't install Flash so I was pleased to see it working with Chromium.

Looking at the bigger picture, it's still easier for me to use youtube-dl and grab the videos that way. The quality is higher and even on my gigabit fiber broadband, I got some buffering and the frame rate dropped which showed significant tearing in the playback. At least CPU use was much lower than with Flash.

The future isn't Flash, it's HTML5 video and I'm pleased to finally have something that works for us Linux users who don't use Flash. Nice work BBC iPlayer team and if any of you are reading this comment I say thanks.

Edit: formatting

Not directly related to the article content, but did anyone notice the odd caption/credit under the top article image? It reads "Source: Google images approved for reuse." which I haven't seen before.

A quick reverse image search reveals that it's by this guy on Flickr (https://www.flickr.com/photos/topgold/6273248505/) and carries a CC Attribution license, which this article is clearly not in compliance with. It's a publisher owned website an you would think they know a bit about copyright.

Note this is for password-protected phones only, PIN and pattern protected phones not affected.

The original vulnerability is here, for those preferring to skip CNN and go straight to it: http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-...

I wonder what happens to the SPDY-specific directives once support is removed. I use 'listen 443 ssl spdy;' and 'add_header Alternate-Protocol 443:npn-spdy/3;'. If these are just ignored no problem, but I wonder if it breaks anything?

Not sure you will see this as your question is a couple days old now, but it is possible to create one or more backup keys & CSRs to use to generate a second hash. When you say "I don't have my next certificate yet" you should know that you don't need it, that's perfectly fine.

You would include the fingerprint of the second CSR along with the fingerprint of your current certificate in the header, and then if you ever need to change certs you generate a new one from that same second key & CSR.

Scott Helme's blog post here walks you through the steps and provides examples: https://scotthelme.co.uk/hpkp-http-public-key-pinning/

Hope that helps!

I have a very similar attitude towards bot accounts. Early on, they were instantly recognizable and took no time to identify and block. Now that I'm doing it for a while, I feel obliged to continue and I've discovered that some bot accounts look semi-legit at first (Twitter's 'uncanny valley') but that dragging their profile image into Google's reverse image search would give them away. Same image, loads of different accounts all almost normal but when viewed as a group they were obvious fakes. Curating your Twitter followers list is just a matter of personal preference, nothing more.

And I'm definitely a 'tweet deleter' after reading this article[0] and agreeing with the premise that Twitter messages aren't that important to preserve. I'd rather deny data miners the ability to better profile me than keep old messages. The article's linked-to Ruby script to archive & delete messages stopped working recently but I found a newer one[1] which works very well. Set it up as a cron job, set the preferred threshold for RTs, favorites and time, and it keeps your feed tidy. If that old message was so great your followers will mark it as such and the script will preserve it. The rest disappear after X days.

[0]http://fusion.net/story/50322/meet-the-tweet-deleters-people...

[1]https://github.com/mikemcquaid/TwitterDelete

Definite issues:

- Durability. Best practice with high-value freight is to back the trailer against an object so you cannot open the doors. Good luck backing those monitors against something solid. Crunch.

- Weight. Trucking companies do things like switch to 'super singles' (a double-wide tire in place of tandems) to save a few pounds. They wouldn't be likely to embrace hanging 4 monitors plus whatever extra gear is needed to power & protect them.

- Compatibility. Trailers currently have standardized connectors for air, power, and signaling (turn signals + ABS + GPS if trailer so equipped). This would need a non-standard connector or at least a secondary one for video.

- Visibility. Nice squeaky clean trucks in the video. What happens a few hours down the road, or in snow when the front grille and trailer rear end are covered in spray, sand, and/or ice?

- Anti-theft. I've picked up trailers in so-called 'highly secure' yards with 24/7 guards and CCTV, and the trailers were missing basic things like brake lights, tires, even the little rubber seals on the air brake connectors that cost pennies to replace. How long to these monitors remain on your trailer when you park in say West Memphis or Baltimore and go inside to eat and shower.

It's an interesting idea and I commend the engineers for producing a partial solution, even if highly impractical for real-world use. Needs much more work though.

Also, watching that demo video the first thing that jumped out at me was how incredibly close the cars were when they cut back in front of the trucks. They filled the displays in the rear, I'd say they were about 1.5 - 2 line markers distant at speed. Incredibly dangerous for the cars, hope no one ever does that in normal driving. If you are that close to the nose of a truck and need to brake, you are getting squashed and there's nothing the trucker can do to help you. They'll be lucky to see you, and definitely won't be able to see your taillights yet. You also just annoyed them by triggering the safety cutout on their cruise control which they'll have to reset each time. This is logged and after too many of these they get called in to talk to a safety manager about their 'tailgating problem'.

I've been using the Android app by Manuel Maly for a while and can recommend it. It's available on FDroid: https://f-droid.org/repository/browse/?fdfilter=HN&fdid=com.... or Google Play: https://play.google.com/store/apps/details?id=com.manuelmaly...

Agreed, I use an ad blocker and have Firefox's PDF viewer disabled and I have no clue if I'm still vulnerable. At a minimum, I'd like to know if disabling the viewer is enough to mitigate the risk, or if popular add-ons like Adblock Plus, NoScript, or Privacy Badger are enough.

Does this require Adobe Flash? I'm getting a "Error loading player: No playable sources found" message using Firefox on Linux. I don't have Flash installed but sites usually fall back to HTML5 video or tell me to install Flash. Neither happened here.

This looks really interesting though, so good luck with it and I hope to get it working soon.

EDIT: It's only the the live streams I'm having trouble with, the pre-recorded works fine.

Too late to edit my original comment again so I'll post a reply here as a general reply to those who reacted negatively to my decision to phone the police.

While I strongly support free speech and believe security researchers should be given some extra latitude when appropriate, what I saw was not at all appropriate. I saw two well respected security researchers sitting in a room like Beavis and Butthead laughing and remotely disabling a vehicle on a multi-lane interstate highway, like it was a big joke. The reporter in the Jeep literally says "This is dangerous" and asks urgently for help. This all filmed and posted to Wired for the world to see, like they are proud of it.

Before working with computers I drove tractor-trailers for a while and was lucky to achieve a million-mile safe driving award. I have a pretty good idea of the dangers here and I know that stretch of road well, I've crossed it many times. I know from experience that a car stopped in the middle of a multi-lane interstate is one of the most dangerous situations you can be in. I've had people hit me who didn't see my huge trailer with flashers on and warning triangles out on a sunny day - it happens quite often. I've seen dozens of people killed in situations exactly like this. You see it coming and a random driver just plows into the stopped vehicle.

I exercised my judgement and decided to phone the local Highway Patrol office. I've read the negative comments and I disagree, I still think it was the correct thing to do. If you are a researcher and you do something this dangerous, and are foolish enough to then post it on a high-traffic site like Wired, I think you forfeit any right to a discreet warning and you deserve to have the police show up demanding answers to some tough questions.