Google Search used to have such a feature. I used it to blacklist w3schools. Of course, the feature is no longer there.

If you're using Firefox: https://addons.mozilla.org/firefox/addon/hide-w3schools/

w3schools used to be a very bad resource but it has improved over the years. See https://www.w3fools.com/.

How so? That page says Marseille Soap is made from vegetable oils, whereas the recipe in the article uses animal fat.

Animal fat is also allowed in Savon de Marseille as long as it qualifies under regulation CE 1774/2002 on the use of animal derivatives for cosmetics.

The point is that it's a very plain soap and goes back to the 14th century.

(I had linked to the English wikipedia article but it's the French one that has more details, sorry for the confusion.)

Earlier:

https://news.ycombinator.com/item?id=16964112

https://news.ycombinator.com/item?id=16802079

Blendle has stopped pay-per-article, moving to subscriptions entirely.

Are you sure about that? I literally received their daily digest which has the price-per-article, as expected, just a few hours ago. Maybe they are now offering both?

Yes, they're stopping micropayments on August 1st: https://www.niemanlab.org/2019/06/micropayments-for-news-pio...

Bummer. Guess that's the end of Blendle use for me. Thanks for letting me know.

The biggest problem I’ve had with Blendle is that I want to read an NYT article due to a recommendation, not because I go to their app. I just would forget to go there. There was no “open with blendle” option to move into my flow.

The original article (https://www.washingtonpost.com/nation/2019/07/26/it-snuck-up...) includes links to some interesting background information, including the event leveling a huge forest area. And it correctly uses square km/miles instead of "square acres".

I hope they pin on the key, not the certificate. For a mobile app I worked on, I had it pin the public key on the leaf certificate and indeed it would fail to connect in this scenario.

For mobile apps, though, you can bootstrap HPKP with a key built into the app. I worked on an app doing this, and it would certainly fail to connect in this scenario.

A lot of internal enterprise networks use MITM, so your app won't work there as well. It might be a good thing or not, depending on your use-case.

Yeah, I considered this a feature. As mentioned elsewhere in these comments, we should have a way to limit the scope of corporate certs.

One solution is to use Name Constraints. The organizational certificate authority could be issued with Name Constraints limiting its power to a certain domain name only, e.g. *.example.com, using Permitted Subtree.

If I was setting up an organizational CA for internal websites (not MITM), I would consider using Name Constraints to limit the certificate's scope and potential for abuse or compromise.

If the app is not for that particular corporation, then no harm done.

I think the point here is that if you use semantic elements, you don't need to use classes to differentiate.

> For U2F there's nothing to be in sync: each key is added individually, and you don't have to add all of them at once. I.e. if you register the key on your keychain at work, you could later add the backup key in your home vault.

The challenge is remembering to enroll using your backup device. Also, ideally your 2 devices would never be in the same room as each other, otherwise you are at risk of something like a fire destroying both.

The desktop version of Yubico Authenticator (yubioath-desktop) allows for storing TOTPs on YubiKeys in Linux and OS X, too.

I like having TOTPs stored this way, as you can use them with any device, including over NFC on Android, just by installing the Authenticator app.