elrodeo

I closed the page right after I read JavaScript.

I switched already 2 months ago on mobile because I got tired by non blockable ads in Chrome and absence of any reading mode. To be in sync with the desktop I switched on the desktop too. Never looked back. And now with the new UI it even looks nicer than Safari imo. Looking forward to 57 on mobile.

> The best thing for Apple to do is to re-take their

> position as a leader of software quality before it’s too

> late: consumers know that Apple’s hardware is the very

> best, but more and more they’re using apps made by Google

> and Microsoft and Facebook.

I'm not sure whether it's not too late already. I switched last fall to an Android phone using only iPhones before that. (I just didn't see the point anymore in paying 2x for an iPhone, which can't do anything better). I started using Google apps like Inbox, Google Calendar, Google Keep, Google Now, Google Fit and now, even I would go back to an iPhone today, there is no way, I'll use Apple Apps again (not as they are today).

If we assume, that — by default — people are unethical, governments are corrupt and most people in power are criminal, then you're f*cked anyway. With or without mass surveillance.

There are very few topics where I just cannot get the point of the discussion among smart people, but this is one of them.

Look at the real world NOW, 15 years after all the surveillance. You still can explode bombs and kill people middle in a european capital without any encryption at all. Is this the kind of surveillance you are afraid of?

If you want to hide something, there are infinitely many ways to do this. No surveillance can (or ever will) read the one time pad encrypted communication. So you have (and always will have) your freedom and capabilities to hide — what's your problem?

Arguments like "well then show me your bank account" are just plain stupid: I have no interest in sharing this information with my work colleagues, my neighbours or my friends just because it would have implications in some social aspects (it's not about security!). But his information is only sensitive in context of a personality. I'd neither have problem to show anything to a random stranger nor would I be interested myself in this information coming from a random stranger.

If somebody uses my information in an unethical way, it is not the problem of a surveillance, but that it's possible at all.

Exposing my personal data to a government during an investigation could also protect me by verifying my alibi. We have nothing to hide, right?

The comparison with free speech is ridiculous. Free speech is the opposite of hiding and doesn't imply breaking the law. Hiding implies playing by other rules, than commonly established. Free speech is important because eventually I might have something to say. But no one would ever agree that he or she will have something to hide eventually (without getting criminal).

So I'm still missing the point...

Thanks a lot for you comments!

> Using MD5 alone exposes you to length extension attacks.

Since NoteHub is anonymous, my concern is not the security, but spam protection only. The Publisher Secret Key + signatures is just a mean to allow 3rd party tools post to NoteHub without captha. That's all.

> The fact that you're able to validate that MD5(password) is correct implies that you're storing passwords insecurely.

Absolutely, the only reason I hash the passwords in the web client and advise in the API to send hashes and not plain passwords is only to kind of protect users' passwords in the context of insecure transport layer.

> Consider switching your API endpoints to use HTTPS

HTTPS costs money. NoteHub is a free toy tool, a pastebin for one-off notes. I feel like, a fancy security would be an overkill for 99% of all use cases.

Spam/flood protection.

Thanks a lot! I don't remember whyI picked Pagedown.js, but I'll definitely take a look on the alternatives on your list.