y0ghur7_xxx

I am happy that XMPP gets some love. Centralised messengers are a real problem now. People on whatsapp are only reachable on whatsapp, same for viber, messenger, skype, ... We are in a really stupid situation. XMPP works now, is decentralised, has secure E2E encryption, is not controlled by a single entity, and has good clients for android and desktop (iOS is unfortunately missing).

I am rooting for an XMPP comeback.

The wrote in the mail that crash reports are anonymised.

> The data collected could be used to identify a single person.

> How many people have the exact same combination of CPU, amount of RAM, location, disk sizes,GPU vendor/model, disk layout and installed applications ?

> If the data is unique enough, it's PII.

You can not connect a unique combination of cpu, gpu, disk size, with me, y0ghur7_xxx, if you don't collect my ip address or my name in any other way, so no, it's not "personal data" as per GDPR.

They don't collect any personal data. The GDPR defines "personal data" with

"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"

Nothing in the collected data is "relating to an identified or identifiable natural person", so the checkbox is not even necessary.

I don't think AMP for email will have success. It works only for users with gmail, so all other email provider users are left out. Why should someone write an AMP email if it does not work for any client? And if gmail users don't like AMP mails they can just switch provider or trash them.

I don't see a problem here.

> Lots of programs I have try to update outside dpkg: Chrome, Intellij, VS Code.

Chrome and vscode have their own apt repositories. I don't know about intellij, but at least for the other two you just have to install them using their repos, and not using the dpkg package directly.

I was annoyed too with the password creation. Too much to think. Now I installed this addon[1] and I use a password manager to save it. I don't even know my passwords myself.

[1]https://addons.mozilla.org/en-US/firefox/addon/pwgen-reloade...

This is actually something I would like to wear. It's like normal glasses, I am not recording videos of the people around me, and it could show me relevant information when needed without looking at my phone. I can think of a few use cases this could cover, in a very elegant way.

The nice thing is, that they are completely "invisible" for other people around me.

> With no details, no motive, and no plausible explanation for what kind of weapon this might be, doubts began to surface.

I'm probably reading this wrong, but is the "Sonic weapon" not a real thing? I thought it is:

http://www.independent.co.uk/news/world/americas/sonic-weapo...

https://en.wikipedia.org/wiki/Sonic_weapon

There was also a discussion here on HN, but I can't find it now.

> * Simple for family members to download and use?

psi https://psi-im.org/

> * Opensource (server & client)

Can install your own prosody instance or use one of the many free xmpp servers avalable.

> * Available on Linux, Windows, iOS and Android

I don't know about iOS, but on Android Conversations is excellent: https://f-droid.org/packages/eu.siacs.conversations/ and https://play.google.com/store/apps/details?id=eu.siacs.conve...

Any xmpp client that supports OTR. I like psi+ (https://psi-plus.com/), but there are many.

You can pair it with conversations on android (https://f-droid.org/packages/eu.siacs.conversations/).

> Did you also have to tell your users to press Ctrl+F5 to get the updated assets?

Actually I did!

What I do now is this: there is a websocket connection always open with the connected browsers, and when there are some assets that reallyreallyreally should be refreshed, I send a command though the websocket and the browser (after a few client side checks, like making sure the user is not in the middle of filling out a form) executes ´window.location.reload(true);´

> 1. If a file upload failed your site was broken until you managed to upload it again.

I don't think an scp ever went wrong for me. But maybe your lan network is different.

> 2. Deploying something that required a database migration had to be done out of hours, or the site had to be taken offline to do it.

Does webpack handle db migrations too? I didn't know. I was talking about js/html/css assets. Not the backend.

> 3. Recovering from a disaster was hard, and pretty much always resulted in significant data loss.

I don't know your specifics, but recovering from a disaster in this case is getting up an other server (or serverS) and copy the files over.

> 4. Moving a site from one server to another was awful, because it meant SSH'ing (or telnet'ing...) on to the box and compiling things from source.

That's the nice thing about mod_pagespeed: you don't compile anything.

> 5. If you worked on anything that ran on multiple servers you pretty much had to script it all anyway.

What's wrong with scripting everything? I like automation.

Do you remember the time when you just copied your file over to the server, and magically everything was deployed? I do. It was a good time. Yes, I am old.

In search for something that makes me work like the good old times, but with modern javascript solutions, I stumbled upon mod_pagespeed[1]: it minifies your javascript and html, optimizes images, and more or less does what webpack does (minus the typescript -> js compilation).

The good old times are back for me: deploying is now an scp away.

For important projects I copy the static assets to the server, let jenkins run integration tests on staging and if everything works as expected just copy it over to production. One less thing to worry about for me.

[1]https://www.modpagespeed.com/

> If you really want to fight the root of the problem, it's not likes and comments, but education.

I agree, but it's impossible to educate everyone on any subject. I think in this case, people who are experts in the matter, should give a reputation rating on the article. That would be really great. For example, I am no expert in theoretical physics, but I may enjoy an article about it, but how do I know it's not a bunch of bullshit I am reading? If I see that Stephen Hawking gave it a 5 star reputable source rating, I "know" I can believe it.

> What about the shared hosting providers that are "affected" that decide to do nothing to "fix" this?

The problem is that I can upload a self signed certificate on a shared host for a domain I don't own.

This, in and for itself, should not be a problem. I did nothing wrong, and the shared host did nothing wrong as well: it only allowed me to upload a self signed cert for an inexistent domain. IMHO, those two actions should not allow someone to get a valid cert for a domain they don't control, and whose only fault is that they pointed their A record to the shared domain host.

I don't think TLS-SNI is sufficient proof of Domain Control. IMHO it should be sacked.

> I would even rather read HN via NNTP, if given the option.

https://github.com/gromnitsky/hackernews2nntp

Publish you package on an http reachable git server and use that as location for your package.

> While trying to get a solution to address this vulnerability as fast as possible, we faced communication issues with Intel which was deliberately restricting & filtering the information about the bug.

and

> According to the latest update from Intel, a microcode is required to completely fix the bug. The microcode release date is, at this time, scheduled for an undisclosed confidential unacceptable late date

seems like intel is not much help.

so i bought my cpu a few months ago. will intel replace it for free?

> The absolute max value stands at less than a third of that.

Care to elaborate?

> I haven't researched deeply, but apparently the add-on does nothing until the user opts-in on studies.

It adds some css to a list of words:

https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894...

This happened to me yesterday, so I looked for it.

The Extension actually does nothing, but invert (make them upside down) a few words on specific sites.

It's an experiment called "PUG ARG" to check whether page contents sniffing works. Its page doesn't reference any Bugzilla issue or Wiki page, while https://wiki.mozilla.org/Firefox/Shield/Shield_Studies/Queue doesn't list it.

The source code references https://support.mozilla.org/kb/lookingglass, which (as of now) only says "test - 12817".

The add-on tests whether specific words can be detected on sites; the current list has nice picks like "revolution" and "privacy". Of course, this is only a test, but in the future Firefox might look for specific terms in the pages you load and do specific things based on them.

The other thing it's doing is to send an extra header to three specific sites: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894.... I suppose the words and the domain are a reference to the Mr. Robot series.

The add-on describes itself as an "Augmented Reality Game Experience" and was made by a certain "PUG Experience Group": https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894....

Of course, Shield Studies are supposed to be a way of making "more informed product decisions based on actual user needs".

https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...

I tried it, and I know there is a lot of work behind this, but you asked for an opinion and here it is: I look nothing like the emojis, I could not identify myself with them.

The first thing that comes to mind is that captainduckduck is free and opensource and the product you linked to is a closed source service you pay ($3,499/month) for.

> why would I want to buy custom hardware when whatever off-the-shelf 2013ish netgear/linksys router I have can do port forwarding and max out my connection?

for me it was because

- it could not max out my connection: it was maxing out a 70Mb/s on a 100Mb/s connection

- those off the shelf routers do not support vlans, and I like so segment my home lan in stuff I trust, and stuff I don't trust.

Well, I want to be the old grumpy guy here: just don't buy their stuff.

I still miss a lot of extensions. One of my favourites was pwgen¹. I missed it so much I decided to write my own², but writing it I found out that the WebExtensions api is still a big work in progress.

For example writing some text to the clipboard seems to be a basic thing a web extension should be able to do. BUT to do it, you have to create a textbox, set its value to something, then programmatically select the text, and then invoke document.execCommand("Copy") to copy the text. Come on! Why not something like browser.clipboard.copy('some text')? And it does not even always work like expected³.

I hope the next ff versions will improve on this. Extensions are what makes the browser your own.

¹https://addons.mozilla.org/en-US/firefox/addon/pwgen-passwor...

²https://addons.mozilla.org/en-US/firefox/addon/pwgen-reloade...

³https://bugzilla.mozilla.org/show_bug.cgi?id=1344410

adb pull /data/data/org.fedorahosted.freeotp/shared_prefs/tokens.xml tokens.xml

> But the obvious answer for truly secure connections is your own CA root or a self-signed cert you manually install/enforce.

> Most decently-written software that supports SSL/TLS allows you do that.

Unfortunately maintaining your own CA and installing it on all your devices is no easy feat. On android it's not even possible without root, and most IoT devices are not "decently-written". So what you say is true on paper, but delegating your CA to an external service like letsencrypt is unfortunately the only doable way as things are now.