andrewreds

I would like to see in the HTTP/2 spec allow http traffic, with the requirement that http 2 traffic must be signed. This would allow publicly accessible resources (including javascript) to be cacheable, without compromising security. Random thoughts:

* The signage could be done in headers (HTTP/1.0 compatible)

* Works with all existing internet caches that don't modify pages they cache

* (some proxies inject headers into pages, so the spec should be resistance to this, and throws out all unsigned headers)

* Signature must cover cache expiry and full page url (including FQDN, port number etc)

* don't send cookies, user-agent or other identifying details over http 2 (helps with caching, and privacy)

* Could have a requirement that all https 2 traffic can only link to resources on https or http 2

* If the signature in the http 2 message fails, browser could fall back to https 2

* A redirect could sign the content it is redirecting to (to securely load resources from 3rd party CDN)

Edit: formatting

I think you also forgot:

  * Don't trust a compiler that has been compiled with an untrustworthy compiler... [1]

Most of the standard library is written in go.

a large part of the runtime package (within the standard library) is written in c and asm. This c code compiled with one of the 5c, 6c or 8c compilers.

gcc is only used for bootstrapping (I believe... tho I am still trying to get my head around what happens).

Would this really be a problem?

If you have a look at the article, linked from the article, they are hiding the un-subscribe link when the link is inside quotes.

For me, the emails that get forwarded to different accounts (due to email rules), don't have quotes, so the link will show. But pressing the forward button will put quotes around the entire email, so the link won't be shown.

In saying that, there are probably some email setup out there, that doesn't work like mine, and just happens to wrap every email that it displays in quotes...

according to [1], Mark Zuckerberg makes $310.67 per second... so $100 will buy you under one third of a second of his time... I hope you are not expecting a long reply.

[1] http://www.best-reviewer.com/how-much-money-does-mark-zucker...

simple:

don't sign up with an email whos domain is on this list: https://github.com/juliuss/dc_autotag/blob/master/autotag.xm...

Ummm....

Essentially electrons must travel around in a circuit. Sort of like a racing car. Electrons can't teleport from one location to another, and the number of electrons in a circuit will never change.

If touching you touch a wire, and you don't make a circuit (a complete loop) then you will receive no current (electrons can't move in a circuit), thus there is no voltage (since V = IR)

Usually when you touch the active wires in a powerpoint a circuit is made:

from the powerplant to the powerpoint, from the powerpoint to you, from you to the floor you are standing on, from the floor back to the powerplant.

A transformer works by having two coils of wires, and when electrons flow through one coil, it excites the electrons in the other coil, and they start to move too. (This is done through magnetism).

A transformer is usually used to change the voltage of an AC source, but in the case of the "Isolation transformer" the voltage on the input side and the output side are the same.

In a transformer, the two coils of wire aren't actually connected to each other. So if you touch one of the output wires, you don't make a circuit, as the electrons need to get back to the other output wire for a circuit to be formed.

The same thing happens with a battery. Unless you are touching both terminals, there will be no current flow.

re #1,

could this be solved with an exponential decay?

aka, saying that a click from 1 month ago is less valuable than someone clicking today.

By tweaking the decay you could change how quickly the algorithm will sway when the conversion rate changes.

EDIT: I just saw that rauljara suggested this below: https://news.ycombinator.com/item?id=4040230

A password works by there is a piece of text that only you know, and thus, when you give that password to a server, that server knows who you are.

can't you also view a url as a password? (If only I know the url, then only I can download the file).

I am able to give out a url to someone else, so they can access the file, likewise, I can give out my file server's username and password, and whoever has it can also access my files.

"""On the flip side, Kim Dotcom will lose the ability to use the data to defend himself after pleading not guilty to piracy."""

Is it me, or is this saying: "We [the author(s) of the page] don't care if he has any evidence proving he is innocent. We just want to see him in jail"

isn't 418 from the HTCPCP specification, rather then HTTP?

thanks :) Google+ is soooo much better then Facebook :)

I will also love one too. andrewreds AT gmail DOT com

How long after release do you think it will take for IR filters for the IPhone will be on sale by 3rd parties?

the lists page is not listed on the lists page

I am with Google in not supporting this flag. I think it will just bring on a false sense of security.

I feel that the other browsers are just trying to get a tick in the privacy features box.

I like "I HATE WATER" http://www.translationparty.com/#8642238 "If you are not used to using water that is being used to sign for you, I do not sign up for Facebook."

I think another example is required:

A ['Cracker breaks in', 'employee goes rouge', 'a police officer abuses power', ...] and steals all the ['users internet history', 'SMSs', ...] on the system. Which is preferable:

A) Since most of the data has been properly deleted, the thief only has access to the last few days of data to sell or do what they want with.

or

B) Since the government has made it law for the data to be keeped, the thief has the last 6 months to 2 years worth of data to sell or do what they want with.

Which of these do you think will help children get raped?

And I am not even starting on privacy invasion by the government...

I would write a program/ build a device that will solve the problem...

Wait a second...

oh S#!T...

I would first check how much my life insurance will cover for """accidental""" death...

I find pages that open in new tabs a little annoying, when I am on a site like HN, as the new tabs steal the focus, making it harder to pre-load many tabs.

In saying that, I think some people could find it useful, and it is an easy feature to implement to implement as a setting.

I think I have got it... should I give a spoiler?

that link gave me a 404... did you mean: http://www.popsci.com.au/2010/12/how-secure-is-julian-assang...

it doesn't work for me (Sydney/ Austraia) :(

WHAT... why would you completely black out the number, where you could instead use random coloured squares, that look like it is a blurring, so someone can go through all the effort, decoding your white noise, and thinking in the end they have your number... when they don't ;)