tombrossman

Some questions for the researchers, or anyone else who thinks this was okay:

1) Were public roadways and speeds of 70mph absolutely necessary to demo this?

2) What was the plan if the trucker approaching at 70mph hadn't seen the Jeep stalled early and had to swerve or panic stop, possibly crashing and injuring themselves or others?

3) Anyone notify the Missouri State Highway Patrol about this? They may be contacting the researchers with questions about this demo if they weren't consulted in advance.

4) What's the plan if they trigger a bug in the car software of the people they had tested this with earlier? The article mentions them tracking people remotely as they attempt to learn more about the exploit.

I could go on but why bother? In case any of you think this was cool or even remotely (no pun intended) ethical, I'd like to know if you have a problem with letting these two test this on a loved one's car. How about they remotely poke around your husband or wife's car and explore, as long as they promise not to intentionally trigger anything?

If I ever learned this had been tested on a vehicle I was in, I'd make sure this cost the researchers dearly.

EDIT: I've just phoned 'Troop C' of the Highway Patrol at their main number, +1-636-300-2800 and they seemed pretty keen to follow up. The fact that the vehicle was disabled where there was no shoulder, was impeding traffic, and the demo not cleared with them in advance has them concerned. I'm all for testing exploits and security research, but this isn't the right way to do it. And to film it and post it to a high traffic site is nuts.

I'm pretty sure you can add any name you like, so long as you are adding it as an additional card under your existing account. It does not guarantee anonymity from bank employees but it does keep your real name out of vendor's records.

I'll second the FastMail recommendation. I closed several Google accounts and migrated them to FastMail a few years ago and it has been a good experience. The UI is very much faster and spam filtering is every bit as good as GMail's was. No complaints about uptime, either.

I'd been smoking about a pack a day for 15 years when I started seeing electronic cigarettes. They were a bit expensive at first, but once the prices started to come down I couldn't resist trying one. I like electronic gadgets and the idea of trying these (and being able to smoke in even more places) was appealing. I had no intention of quitting when I bought my first one, it hadn't even occurred to me.

Gradually the convenience of the electronic cigarettes shifted my habit away from regular cigarettes, and I found myself rarely lighting up a normal one. I also would take fewer puffs, I might do one or two drags and put it down absentmindedly, not thinking about smoking for a while after. It was 100% on-demand, no urgency to finish something lit.

I tell people I 'accidentally quit' now, since I just gradually weaned myself off tobacco and nicotine. I haven't smoked or used electronic cigarettes in about eight years, and the cravings are gone. I liked smoking and I might consider going back to it if the health risks disappeared due to advances in medicine.

I wonder why the medical community hasn't done more to embrace electronic cigarettes as a 'safer' alternative or method of quitting. Addicts of other drugs are treated using the same model. I don't expect them to embrace it as a safe alternative, but I think they could help others quit or reduce their traditional cigarette smoking habits.

GA's Terms & Conditions make disclosing use of the product mandatory but this has to be the most widely ignored and unenforced rule I've ever seen.

If a lawyer somewhere figures out how to parlay this into a class-action/privacy issue (maybe Europe?) they are going to be filthy rich since this is so widespread. Even government websites use GA and fail to disclose it as required.

First thing to pop in to my head after reading your comment is this Upton Sinclair quote: "It is difficult to get a man to understand something, when his salary depends on his not understanding it."

It's a bit like wishing slaughterhouse workers would start to consider the animal's feelings and spend more time thinking about them.

I hope so too, just like I hope I get to fly around in a UFO because that would be pretty cool. Not really expecting that to happen though.

Let's say you host your site on your own server at www.example.com. You want that to be served by HTTPS. You also have a subdomain cdn.example.com for static assets which is CNAME'd to a proper CDN that you want to use HTTPS with also.

With a wildcard cert, the third-party CDN would need your private key for your self-hosted www.example.com site. With different keys & certs per-site, the process is more modular.

I agree that wildcard certs would be great and I'll default to using them for the simplicity (e.g. temporarily activate a quick test.example.com site to check something works) but the ability to keep things modular is also great.

Watching ads isn't contributing to content creators. That ad money didn't materialize from nowhere, that's a percentage of revenue being diverted to the ad company. Bought Product X? See that Product X ad? You helped pay for it. You could make a strong argument that ad networks are parasitic drag on the economy, but that would probably be dismissed as crazy talk.

I'm not sure the claim is true. I only have one personal experience to base this on (fortunately) but I was in an accident as a passenger in a Jeep Wrangler which ended up upside-down on its roll-cage. Both the driver and I were hanging from our belts and had no problem undoing the buckles. We had to do it one-handed with our other hand trying to support ourselves so as not to drop on our heads after releasing the buckle. Click, release, just like normal.

That graphic is just begging for a remix in the style of the leaked Snowden / NSA docs.

"Providing a Valuable Platform for Advertisers, Content Publishers, and Users" Sure does say a lot about their priorities here, doesn't it? First come advertisers, then publishers, then in last place are the users. This is the message I'm getting.

I think it is unrealistic to assume that the original few who enjoy their little walled garden will embrace net neutrality once these places have better infrastructure. Can you think of any examples of this happening? If you were a shareholder for one of the original companies would you be happy about it?

Also, I don't think very highly of Mark Zuckerberg's ethics, especially with regard to users privacy, but he's a very effective leader and there's no sense getting angry with his success.

It is up to governments to regulate markets, we can't expect CEOs to do anything but promote their own agenda. If you want to get mad at someone, take it out on government regulators who are corrupt or otherwise fail to promote competition.

Piwik is the obvious choice, and it blocks referrer spam by default and hosting can be subcontracted out of you don't want to deal with setting it up.

http://piwik.org/blog/2015/05/stopping-referrer-spam/

http://piwik.org/hosting/

I see no privacy policy on the shapeoftheweb.mozilla.org site though you are correct that they do post that privacy policy on the completely different website www.mozilla.org.

I suppose they would argue that's the same but I don't think it is good enough (especially for a site preaching privacy values). It should be down in the footer, or even better they should be using Piwik and skipping GA completely.

To me, this feels like a website built by a pro-privacy team who had some marketing or PR person slap the GA code in there with no comprehension of irony at all.

EDIT: Also to note that mozilla.org uses UA-36116321-1 tracking and shapeoftheweb.mozilla.org uses UA-49796218-22, which indicates to me that they are aware that these are two distinctly different sites.

It is important to make a distinction between what they make and what they take home. In the US, workers subject to the DOT's "Hours of Service" rules (truckers, train crews, airplane pilots, etc) get very generous tak breaks and take home a far greater percentage of their earnings than most workers.

I made nearly 40K my first year in trucking and had no problem clearing 50K each year after that, and my total income tax rate was exactly 9%. I moved to a state with no state income tax and life was pretty good for a while, until I got tired of trucking. For those who enjoy it, it's not a bad income with very low barriers to entry.

Not only enabled, but in breach of the Google Analytics' Terms which state very clearly: "You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies that are used to collect data. You must disclose the use of Google Analytics, and how it collects and processes data. "

See section 7 "Privacy" here for the full text. http://www.google.com/analytics/terms/us.html

It is definitely about centralizing, on your own domain. Nothing wrong with that but the distinction is to have total control and not rely on a third-party silo. This takes some extra effort but is totally worth it.

Perfect example right here, which is an Ars Technica "article" from their new UK site, brought to you by a certain Microsoft product which just so happens to be worked in to the story. http://arstechnica.co.uk/features/2015/05/ken-fishers-travel...

I disagree. That could be automated exactly like 'self-parking cars' which has been a feature in some luxury cars for a while now.

The most challenging part mentally is accurate trip planning. Drivers try to predict exactly when to move to ensure an on-time delivery and have too many variables to do this with high accuracy. Then they will typically falsify logs and run illegally to make the logs match the date and time stamped documentation (toll reciepts, times stamped on delivery reciepts, etc).

I think that you'll find large trucking companies are happy to keep using cheap expendable labor, who will willingly bend the rules, as this gives the companies the plausible deniability they want.

> "...and, presuming Google doesn't use patents like a troll..."

Saw this this morning discussing how Google bought Motorola and is now demanding more royalties for "standard-essential patents", after selling off Motorola (and keeping their patents to use in lawsuits like this): https://twitter.com/FioraAeterna/status/592775596712849408

I don't follow this super closely and so can't say if the claim is 100% true, but it sure was interesting to read about.

I didn't get the HTTPS error but I did see way too much JS dependency, and that animated background requires an excessive amount of CPU for something I think is unnecessary.

Excellent, good to know that.

Why not contribute to F-Droid, rather than 'reinvent the wheel?' https://f-droid.org/contribute/

Your site looks great and I don't mean to take anything away from it, but when I see something like this I think of it as merely an art project, something I might see on Dribbble. I would never download APKs from here for example, but have no problem trusting F-Droid's APKs.

Go on, fire up a cheap VPS somewhere like DigitalOcean and run "rm -rf / --no-preserve-root". Maybe I am too easily amused but as a long-time Linux user on the desktop this is one of those things I always wanted to try. After it runs, you can't even shut down or run anything else, you just kill the SSH session.

The website is also using Google Analytics without disclosing this in their privacy policy, which violates Google Analytics' TOS[0] and is a pet peeve of mine. Hard to take the site too seriously but I like that privacy is a campaign issue, so it isn't all bad news.

"You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies that are used to collect data. You must disclose the use of Google Analytics, and how it collects and processes data."

[0]http://www.google.com/analytics/terms/us.html

Old discussion here on HN, but the claim is made that every 100ms latency cost 1% in profit: https://news.ycombinator.com/item?id=273900

HTTPS is pretty fast now with SPDY (and soon HTTP/2) but there is no avoiding the fact that is slows down that first page load ever so slightly. No doubt they have studied this carefully and opted for maximum speed, as this maximizes income.

Nah, found that while searching for the other. I can probably use that, though. The one I'm thinking of had you putting a short instruction at the top of the file (like @include) if you wanted it to be part of the output file. Maybe I'm not remembering this correctly as I can find nothing on it now.

Looks good and it is fast, but there are plenty of improvements to be made according to their Pingdom score: http://tools.pingdom.com/fpt/#!/bALFWp/http://tweakers.net/ Surprised to see a total of 91 requests, for example.

Agree with the above comments about reducing bloat, and I'm surprised by the number of smart people who think nothing of setting up a Wordpress site with dozens of CSS and JS files.

I just spent 20 minutes trying to find a link to an Apache function I found recently, which will join all your CSS or JS files together with something like an @include server-side automatically. Can't find it now but as I have been doing this manually I hope I find it again. Anyone know what this is? I seem to recall it was a native Apache function, not part of mod_pagespeed.

This is true and I could have worded it better. My point is that with Let's Encrypt coming online soon, Gandi's one free single year cert per domain gets you HTTPS now, and by the time it expires you won't need to buy another.