Hacker Newsnew | past | comments | ask | show | jobs | submit | naturalized's commentslogin

I know that in Chrome's incognito mode, nothing gets written to the disk at all (including Flash's Shared Objects). So if I open an incognito window, browse, then close Chrome, then open another incognito window and return to the page, does this defeat all this?


Nope, just tried it. Incognito, cookies there. Clear cache, incognito mode again and 3 types still captured. Really quite fascinating.


Did you completely quit the browser in between your visits? Because if the instance of Chrome from which you opened the incognito windows have been running between your visits, it may have retrieved these from the memory, even if you closed the incognito window after the first visit.


So we need a stateless browser and don't have one.


wget or curl come to my mind


Why doesn't anyone try this? I did, and it seems that incognito mode does defeat this. However, since this always sets the same cookie, I couldn't tell if it read it or set it. From the looks of things, it only read the cookie, which means that closing incognito mode deletes it.


I have gotten Flash Objects before, while using Chrome incognito mode.

Will have to repeat this experiment with the current version.


We operate a large site with thousands of PayPal payments per day. This is a sample email we just got from PP:

Hello ....,

We were recently notified that a payment you received was reversed by the buyer's bank.

As a result, we have reversed the following transaction: Transaction date: xxx Transaction amount: xxx USD Buyer's email: xxx Buyer's name: xxx Your transaction ID: xxxx

PayPal is committed to maintaining a safe environment for our buyers and sellers. You can help protect yourself against claims and reversals by following the guidelines of our .

Thanks,

PayPal

Note that their email template has a bug: it says " following the guidelines of our ."! Cannot they fix their email templates? They are dealing with f..ing real money! The Viagra spam that I get has less bugs in their email templates!


Actionscript 3.0 is much more sophisticated than Javascript/HTML5. The capabilities of HTML5 are equivalent to Actionscript1.0/Flash Player 6, circa 2004 (these demos were entirely possible even in Flash Player 5 perhaps). Plus, Flash is reasonably cross-platform (except for iPhone/iPad of course). On another note, making embeddable widgets (slideshows, videos with more than just viewing functionality, like Youtube) is very hard in Javascript, since any complex embedded Javascript would likely clash with other scripts on the page (we have experienced this, making a complex Javascript widget, that ended up clashing with Adsense ads of our customers, it was a nightmare to debug that).

Incidentally, I brought up my task manager while viewing these demos, the CPU utilization jumped from 5% to 97% (Core 2 Duo, 1.66 GHz).


Wait for an year or two. IMHO, HTML5 is going to evolve much faster than ActionScript. When I saw these kind of cool animations in Flash years ago, I wanted to play around with it but couldn't see the source. It was all hidden behind the swf/fla files making it harder to see how things were done. If I wanted to fiddle with it I needed Flash software. Not so with HTML5. All you need is a text editor and a browser. I am sure whoever this link would have tried to look at the source.

> making embeddable widgets is very hard in Javascript, since any complex embedded Javascript would likely clash with other scripts on the page

You can use local variables the way jQuery uses it. Something like (function($))(jQuery). If you declare all your variables and functions within this scope its easy to avoid clashes with other scripts.


>When I saw these kind of cool animations in Flash years ago, I wanted to play around with it but couldn't see the source.

While technically all JS is open-source / source-visible, just wait: where there's a market, there will be more and more sophisticated obfuscation techniques. Especially for a language like JS, where it can easily generate and modify its own code.


While I do not care for obfuscation for its IP protection function, having the source visible and accessible is a problem for games: how can we know that top scores are valid and a variable has not been modified? Basically, all JS games are cheatable. John Resig talked about this http://bit.ly/bO3bcf


The reverse is also true. For every obfuscation tool there will be an unobfuscation tool. They may not give back 100% of the original source but they can go close.


There are SWF decompilers too.

http://www.google.ca/search?q=swf+decompiler

If HTML5 authoring tools start appearing we'll have to make sure they use open formats and runtimes.


"HTML5 is going to evolve much faster than ActionScript."

As written, this statement is wrong.

Adroit developers are picking up HTML5's JS API's with more enthusiasm than they have ActionScript, and they'll push those API's to their limits, as they have done with the DOM API's. But the technology itself--the underlying standards--must necessarily evolve at a slower pace than a proprietary language like ActionScript. Browser vendors haven't quite caught up with HTML5's growth yet; once the the spec's final, W3C won't be moving the goalpost out any further for a long time.


> once the the spec's final, W3C won't be moving the goalpost out any further for a long time.

You're wrong, html5 is supposed to be the last final big version, it is agreed that html5 will continue to be incremently improved from now on (it was posted recently on HN).


Oi! I didn't say HTML5 is "the last final big version" of HTML, I said we won't see it expanded for a long time. Maybe I'll be proven wrong about that, but it still takes demonstrably longer for the W3C to reach an agreement about new specs than it does for Adobe to release updates to Flash. Flash Player 5 was the most recent version when XHTML 1.0 came out!

That said, I would like to read that article/thread. Do you have a link, or remember its title? I can't seem to hit upon the right combination of Google keywords. ;) Thanks.


Why wait? Everything in these demos was possible with IE5 and its VML implementation. Canvas has been in FireFox from the start.

You don't need HTML5 to do vector graphics in a browser.


Canvas is a relatively new thing, originally built by Apple before they standardised it. Maybe you meant SVG? Even that was Firefox 1.5 though as far as I recall.


> Plus, Flash is reasonably cross-platform (except for iPhone/iPad of course)

Except that it sucks rocks on everything besides x86 and Windows. OS X? Linux? amd64? ARM? There's a reason it's not on iOS devices. Adobe has consistently failed to make a compelling offering for anything except 32-bit Windows.

(I know it runs on amd64 machines, but it's not 64-bit: http://kb2.adobe.com/cps/000/6b3af6c9.html)

I'll take a truly portable Flash 5 equivalent over Flash 9 or 10 where everything outside Windows/x86 is a second class citizen.

CPU usage is still pretty high with this stuff, but there are plans to accelerate it and improve performance. What's the plan for Flash? Who knows because it's proprietary^ and there's a single entity that can fix things. And HTML5 performance isn't much worse than Flash on OS X or Linux. Windows is completely irrelevant to a lot of us.

^ Now someone's going to point to the spec and mumble something about Flash being an open standard. Show me a single open and viable alternative implementation, then we'll talk about it being open. Till then we're Adobe's pawns.


I think I know a thing or two about Flash.

http://mahmud.arablug.org/

It's a powerful platform, and I will accept the author's desire to avoid using his demos in "HTML5 vs Flash" punditry; but it's apparent where HTML5 is headed, and I can't help but notice its competence, in domains where flash is usually considered the only option.


I actually doubt that Adobe has the competence to make high quality software, that would be required for mobile Flash (due to serious optimization that is required). There is probably not enough engineering culture in the company for that. I also think that a proper software company cannot be located in San Francisco itself, otherwise they tend to attract programmers that are too cool/have to many outside interests to write a high quality code.


"Too many outside interests to write high quality code"?

You need to get the chip off your shoulder and distinguish between genuine passion for hacking, and escapist basement dwelling. Outside interests refresh your mind and body and give you new inspiration.


Many of Adobe's engineers are based in Ottawa,Canada and India.


Or, if you want to really delete a file, use #shred filename command

#man shred SHRED(1) User Commands SHRED(1)

NAME shred - overwrite a file to hide its contents, and optionally delete it

I especially like the -n option!


Except that shred is not guaranteed to work on many (most?) modern filesystems. From `man shred`:

       CAUTION: Note that shred relies on a very  important  assumption:  that
       the  file system overwrites data in place.  This is the traditional way
       to do things, but many modern file system designs do not  satisfy  this
       assumption.   The following are examples of file systems on which shred
       is not effective, or is not guaranteed to be effective in all file sys‐
       tem modes:

       * log-structured or journaled file systems, such as those supplied with
       AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)

       * file systems that write redundant data and  carry  on  even  if  some
       writes fail, such as RAID-based file systems

       *  file  systems  that  make snapshots, such as Network Appliance's NFS
       server

       * file systems that cache in temporary locations, such as NFS version 3
       clients


It works fine on default EXT3. The only thing journaled is meta-data. You snipped that part out. More from man shred

In the case of ext3 file systems, the above disclaimer applies (and shred is thus of limited effectiveness) only in data=journal mode, which journals file data in addition to just metadata.

In both the data=ordered (default) and data=writeback modes, shred works as usual.


Good news for AMD and ARM that Intel is getting diluted with irrelevant stuff!


We do not want Google to know the true size of our service, so we have analytics code in every 5th pageview (when templates are constructed by scripts, it inserts the analytics code only when the UNIX time is divisible by 5.


Umm - I assume you know this, but inserting the analytics code only when the UNIX time is divisible by 5 isn't the same as every 5th pageview.

(Also, doing it on a pageview basis instead of visitor basis means you lose all the nice visit path tracking Analytics does)


What's the reason to hide your size from Google (or anybody for that matter)?


though that would skew the referrals and other metrics wouldn't it?


If your numbers are large enough, no. As long as the selection isn't biased, it doesn't matter.

Another commenter on this topic has a good post about convincing management of the validity of sampled metrics, I'd read it then tip your chair back and stare at the ceiling for a while.


Well, now they know.


I thought every number is divisible by 5


I do not think they control a botnet- they download that LOIC tool individually, specifically for DDoS purpose. Gawker does not seem to have a serious infrastructure: it looks like they are hosted on DATAGRAM.COM, they do not even have their own IP ranges. So it's probably easy to knock down.


In order the remedy this problem, the unlocked multi-carrier phones should be just as available as ISP-neutral PCs. This is clearly not the case, a typical user does not know where or how to buy an unlocked Droid X (and even if they bought it on eBay, it only works on Verizon anyway).

So your comparison is not adequate.


Sure, the laptop comparison falls down in some ways, but I'd argue that your point argues in favor of mine. A phone is much more locked down and difficult to upgrade. Most customers won't upgrade unless it comes in a nice automatic OTA package from the carrier or manufacturer. With PCs you have the option to relatively easily purchase or download a major new OS version and install it yourself. PCs are commodity hardware; phones are not (yet).

The fact that unlocked multi-carrier phones aren't readily available is a problem with how the carriers and wireless service works, and has nothing to do with Android, or iOS, for that matter.


Does it mean that any site can be shut down if it's used by terrorists? Which one is next: facebook, because terrorists can create a group there and send messages, twitter, because a terrorist cell can use it to coordinate attacks, or perhaps wordpress? Which service will be shut down next?


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: