Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reserve the 418 status code

tools.ietf.org

Post reply on HN
Print view View original

31–40 of 124 posts

Re: Reserve the 418 status code

#31

Post by HappyTypist »

wyldfire wrote: post #24
lccarrasco wrote: post #5

Earlier quoted context omitted.

An example of an existing easter egg (for reference): https://www.google.com/teapot

It looks as if the teapot is responsive to my phone's gyros. I would've thought it would need special permission for that. What a terribly clever Easter egg.

Nope. Actually, there was a paper published recently on using a phone's gyro / accelerometer (through the HTML5 APIs) in order to keylog users; because the API is precise enough for you to detect subtle motion of the phone as you press on the software keyboard.

Apparently in some mobile browsers, you can continue to poll the API even when your tab is not on focus.

Re: Reserve the 418 status code

#32

Post by LukeShu »

mystrman111 wrote: post #21
toomanybeersies wrote: post #12

Earlier quoted context omitted.

It was interesting reading the threads on /r/webdev about this whole debacle. The threads were full of people saying that he's an arsehole with too much time on his hands who must hate fun. Nobody actually stopped to read the guys bio and realise that he's more than qualified to be bringing up these issues. It doesn't help that the guy who made save418.com is literally 14 (which seems to be about the average age of /…

The /r/webdev thread ( https://www.reddit.com/r/webdev/comments/6stdcj/http_error_c... ) remained quite respectful actually, afaik there were no real hostile remarks directed towards Mark Nottingham within it. In fact, it's ironic - the very comment I'm replying to is probably more distasteful and antagonistic than anything that could be found in the Reddit thread.

Often reddit threads read more respectful after-the-fact; the less respectful comments either get downvoted enough that they aren't displayed unless you look for them, or are moderated away. Often they are much harsher early in the thread. I'm not sure if that ways the case here, but it is common enough that I wouldn't doubt it.

Re: Reserve the 418 status code

#33

Post by HatchedLake721 »

HappyTypist wrote: post #31
wyldfire wrote: post #24

Earlier quoted context omitted.

It looks as if the teapot is responsive to my phone's gyros. I would've thought it would need special permission for that. What a terribly clever Easter egg.

Nope. Actually, there was a paper published recently on using a phone's gyro / accelerometer (through the HTML5 APIs) in order to keylog users; because the API is precise enough for you to detect subtle motion of the phone as you press on the software keyboard. Apparently in some mobile browsers, you can continue to poll the API even when your tab is not on focus.

link the paper please?

Re: Reserve the 418 status code

#34

Post by Izmaki »

joombaga wrote: post #2

Why is 418 the particular target? Just because of RFC2324? > IANA should also typographically distinguish “Unassigned” and “Reserved” in the registry descriptions, to prevent confusion. This I can get onboard with. Honestly, I've never seen a 418 easter egg, but I'd think it would be an HTTP spec violation if it didn't at least conform to the higher level 4xx definition (Client Error) :)

It is implemented as a valid HTTP code in the java Spring framework for everyone to support. That's how I learned about it first.

Re: Reserve the 418 status code

#35

Post by jacquesm »

HappyTypist wrote: post #31
wyldfire wrote: post #24

Earlier quoted context omitted.

It looks as if the teapot is responsive to my phone's gyros. I would've thought it would need special permission for that. What a terribly clever Easter egg.

Nope. Actually, there was a paper published recently on using a phone's gyro / accelerometer (through the HTML5 APIs) in order to keylog users; because the API is precise enough for you to detect subtle motion of the phone as you press on the software keyboard. Apparently in some mobile browsers, you can continue to poll the API even when your tab is not on focus.

Oh, that's really nice. So if you have a fix (and even if you don't) you can use dead reckoning and tie any points where the GPS is accessible and then re-create the path the phone took. That's a bit of a leak. Wonder how long after or before a GPS fix this would be effective, those phone accelerometers probably aren't all that accurate but you might be able to calibrate the one in a specific phone if you have data available for both of them for some stretch of trajectory.

Re: Reserve the 418 status code

#36

Post by jacquesm »

toomanybeersies wrote: post #12
endgame wrote: post #7

Earlier quoted context omitted.

Note that the "contributor" (Mark Nottingham) is also the author of the document in OP, and deserves a lot of credit for taking this approach. Given that his area of work is HTTP standards, I think he initially started removing 418 to tidy up and make things compliant and isn't just some bore who hates fun. Now he's managed to make everyone happy in a standards-compliant way.

It was interesting reading the threads on /r/webdev about this whole debacle. The threads were full of people saying that he's an arsehole with too much time on his hands who must hate fun. Nobody actually stopped to read the guys bio and realise that he's more than qualified to be bringing up these issues. It doesn't help that the guy who made save418.com is literally 14 (which seems to be about the average age of /…

Why should it matter that the guy who made save418.com is literally 14? Let's look at what he's accomplishing - in spite of his age - rather than whether or not he is substantially older or younger than the opposition in this argument. It seems like that's a pretty cheap argument to bring to the table.

Re: Reserve the 418 status code

#37

Post by Franciscouzo »

HatchedLake721 wrote: post #33
HappyTypist wrote: post #31

Earlier quoted context omitted.

Nope. Actually, there was a paper published recently on using a phone's gyro / accelerometer (through the HTML5 APIs) in order to keylog users; because the API is precise enough for you to detect subtle motion of the phone as you press on the software keyboard. Apparently in some mobile browsers, you can continue to poll the API even when your tab is not on focus.

link the paper please?

https://doi.org/10.1007/978-3-319-58460-7_15

Keystroke Inference Using Smartphone Kinematics

The use of smartphones is becoming ubiquitous in modern society, these very personal devices store large amounts of personal information and we use these devices to access everything from our bank to our social networks, we communicate using these devices in both open one-to-many communications and in more closed, private one-to-one communications. In this paper we have created a method to infer what is typed on a device purely from how the device moves in the user’s hand. With very small amounts of training data (less than the size of a tweet) we are able to predict the text typed on a device with accuracies of up to 90%. We found no effect on this accuracy from how fast users type, how comfortable they are using smartphone keyboards or how the device was held in the hand. It is trivial to create an application that can access the motion data of a phone whilst a user is engaged in other applications, the accessing of motion data does not require any permission to be granted by the user and hence represents a tangible threat to smartphone users.

Re: Reserve the 418 status code

#38

Post by mystrman111 »

LukeShu wrote: post #32
mystrman111 wrote: post #21

Earlier quoted context omitted.

The /r/webdev thread ( https://www.reddit.com/r/webdev/comments/6stdcj/http_error_c... ) remained quite respectful actually, afaik there were no real hostile remarks directed towards Mark Nottingham within it. In fact, it's ironic - the very comment I'm replying to is probably more distasteful and antagonistic than anything that could be found in the Reddit thread.

Often reddit threads read more respectful after-the-fact; the less respectful comments either get downvoted enough that they aren't displayed unless you look for them, or are moderated away. Often they are much harsher early in the thread. I'm not sure if that ways the case here, but it is common enough that I wouldn't doubt it.

When comments are removed by mods on Reddit, they're replaced with the text "[REMOVED]", which doesn't appear once in the referenced thread (insults would not be removed in the first place though, they break no /r/webdev rules). And you can scroll to the bottom of the thread to see all the downvoted comments, none of which are are condescending towards Mark. So no, that isn't the case here.

Re: Reserve the 418 status code

#39

Post by masklinn »

joombaga wrote: post #2

Why is 418 the particular target? Just because of RFC2324? > IANA should also typographically distinguish “Unassigned” and “Reserved” in the registry descriptions, to prevent confusion. This I can get onboard with. Honestly, I've never seen a 418 easter egg, but I'd think it would be an HTTP spec violation if it didn't at least conform to the higher level 4xx definition (Client Error) :)

> Why is 418 the particular target?

Because Mark Nottingham (co-chair of the HTTP WG) first tried to get libraries/stdlibs to remove support for 418 (as part of builtins, since it's not a formally standardised code, he had no issue with application-specific support, everyone is free to return whatever status codes they wish) and faced some pushback, he switched to the alternate tack of getting it into a standard.

Re: Reserve the 418 status code

#40

Post by [deleted] »

phab wrote: post #27
peterwwillis wrote: post #16

Earlier quoted context omitted.

So we're trying to avoid breaking the internet by committing to people expecting an error when they're talking to a teapot? So that past implementations of clients connecting to teapots won't break? Like I say, we could also just add it to the spec... But that would be ridiculous, because why would you support telling someone you were a teapot in an HTTP protocol, when the feature is only useful in a protocol for bre…

> That would be like taking a programming language's syntax for assigning data objects and turning it into it's own standard for a text file format. Looking at you, JSON...

[deleted]
Post reply on HN