JRuby 1.7.0. Released - <AUTHOR> http://www.jruby.org/2012/10/22/jruby-1-7-0.html

<comment><USER2> > InvokeDynamic support

This is the big one, in my opinion. See here[1] for some benchmarks of JRuby + invokedynamic. We're talking orders of magnitude for some benchmarks.

[1] [http://blog.headius.com/2011/08/invokedynamic-in-jruby- const...](http://blog.headius.com/2011/08/invokedynamic-in-jruby-constant- lookup.html)

<comment><USER3> _some benchmarks_ from Wed, 10 Oct 2012

jruby-1.7.0.RC2 -Xcompile.invokedynamic=true

<http://shootout.alioth.debian.org/u32/jruby.php>

<comment><USER4> So with about the same CPU time, JRuby will use up to 100x memory in worst case?

Anyway Ruby 2.0 is suppose to solve the Ruby is Slow problem. although i have yet to see any evidence that will the case. Sigh.

<comment><USER5> > So with about the same CPU time, JRuby will use up to 100x memory in worst > case?

The JVM often trades increased memory usage for increased performance. That said "100x memory" is total hyperbole, even in the context of a microbenchmark. If you want the JVM to use less RAM, you can turn down the maximum heap size. Otherwise the heap will grow until it reaches close to full before the GC does a stop-the-world style collection of the old generation.

> Anyway Ruby 2.0 is suppose to solve the Ruby is Slow problem

Absolutely not. There are presently no plans to add a JIT compiler to the de facto Ruby interpreter.

The JVM on the other hand has the most advanced JIT compiler in the world. InvokeDynamic on Java 7 allows JRuby to do method inlining, and on Java 8 it will be able to take advantage of the full suite of HotSpot optimizations, including escape analysis and lock elision when compiling Ruby code into machine code.

No other Ruby VM will have that level of optimization.

<comment><USER6> > Otherwise the heap will grow until it reaches close to full before the GC > does a stop-the-world style collection of the old generation.

Most real applications will be using ConcMarkSweepGC(or G1) and ParNewGC. With these collectors the JVM won't just burn through all the memory and halt the world unless you throw a workload at it which the GC can't handle with its normal GC cycles.

The GC makes small sweeps regularly but the duration of those sweeps is limited to ensure relatively consistent response time. If you were creating and throwing away so many objects which were promoted to the tenured generation that these small, time limited, GC sweeps couldn't keep up, then you would see the heap grow to its maximum and a 'stop the world' GC would take place. In practice that doesn't happen in the vast majority of workloads.

<comment><USER5> No, you're wrong, an _extremely_ scant number of applications can completely avoid allocating memory in the old generation. Your best bet would probably be to use the Disruptor approach of preallocating everything then avoiding any subsequent allocations if that's really what you want to accomplish. However, if you honestly believe "most real world applications" can avoid allocating memory in the old generation, I'd sure love to see some graphs of some heap profiles of real world usage of these applications!

CMS does a stop the world collection of the old generation, however it will do an incremental collection of the eden generation. If you've ever looked at a graph of the JVM heap observing CMS running under VisualVM or YourKit, you'll notice a distinct sawtooth pattern to its collections. The diagonal parts of the sawtooth represent incremental collections in eden space. The vertical parts of the sawtooth represent stop-the-world collections of the old generation.

The "small regular sweeps" you're talking about affect the eden generation, not the old generation. Collecting the old generation is a stop the world operation in every JVM GC option except Azul's C4 collector. C4 resorts to all sorts of clever tricks to avoid stopping the world, most notably read barriers and eager pointer updates. On the Azul hardware, these tricks involved hardware transactional memory. On x86 they don't have HTM (at least until Transactional Synchronization Extensions ship on Haswell). What they do, however, is quickly set up GC invariants and a trap on a given page. Whatever thread accesses a page that contains an object which needs to be relocated relocates the object on the GC's behalf and gets the new pointer. All that said, C4 is only available on the Azul JVM, which is commercial.

CMS can't do this. It stops the world at a JVM safe point whenever it needs to collect the old generation.

<comment><USER6> CMS collector has two different types of collections it will do on the old generation. Both are "stop the world" but for drastically different amounts of time. During its 'normal' operation most of the sweep is done concurrently with two short "stop the world" points for each GC cycle. If it can't keep up, then it will do a full blow "stop the world for real" collection.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Biggest things stopping me from using jruby:

1\. Incomplete integration with postgresql. The ActiveRecord jdbc adapater doesn't have all the features that the standard pg adapter does.

2\. Slow startup / test runs. At one point, loading large amounts of files (like during rails bootup) was much slower on jruby than MRI.

<comment><USER8> Based on this comment, I started looking into JRuby support for the pg gem. I think it's possible; I have started stubbing it out, and the Postgresl JDBC driver publishes additional interfaces that provide everything folks here have been asking for.

I'm looking for help filling it out. Here's the mostly stubbed extension:

<https://github.com/headius/jruby-pg>

And here's the docs for pgsql's hidden interfaces (cast the JDBC objects to these, and you're good to go):

[http://jdbc.postgresql.org/documentation/publicapi/index.htm...](http://jdbc.postgresql.org/documentation/publicapi/index.html)

<comment><AUTHOR> This would be brilliant, as Postgres is one of the most commonly used databases with Rails (generally, and also because of Heroku) so having feature parity between the pg gem and JDBC drivers that you can use with, for example, Torquebox would be great, especially for people wanting to migrate to JRuby.

I did some basic benchmarking with one of the JRuby 1.7 preview releases and was impressed enough with the speed benefits to want to try it out with a small app on Torquebox when JRuby 1.7 was released.

Thanks to joevandyk and xiljin for pointing out the search_path and datatype support situation before I undoubtedly encountered them myself - and love the fact that headius has immediately leapt in to try and fix things :-)

</comment></comment></comment><comment><USER9> JRuby is really great. I use it every day for both work and personal projects.

Big thanks to all the contributors!

</comment><comment><AUTHOR> Looking forward to installing it and trying it out with Torquebox ( <http://torquebox.org/> ) for a new project.

</comment><comment><USER10> Not only does it default to 1.9 after one year, it catches up all the way to 1.9.3-p286, released only ten days ago.

</comment><comment><USER11> Congratulations to all devs, committers, documentation maintainers, supporters, donators, secret lovers and overall alternative ruby enthusiasts.

</comment><comment><USER12> Is JRuby worth using if JVM language integration isn't needed? E.g. A fairly standard Rails app.

<comment><USER13> My experience is that if you don't need JRuby (for Java interop or to satisfy pointy-haired strictures), you probably won't see much benefit from choosing it, at least for a Rails app.

On one hand, JRuby is technically a much better Ruby than Ruby, and if you want to improve bulk throughput you'll probably benefit. On the other, if bulk throughput were important, Ruby probably wouldn't be your first choice, and there are some downsides.

The biggest problem, especially for Rails, is the warm-up cost. Rails's start- up time is already painful, and adding to that hardly improves the test- develop cycle. I've not tested this latest release, but in 1.6.8, running a test suite was multiples slower than C Ruby. Test suites, which run a lot of different code, aren't really representative of real-world workloads, but if you're working on an application it really hurts.

You might also have trouble with gems that have compiled extensions. It takes a bit of Gemfile fiddling, but there are alternatives to most of those.

For applications other than Rails (which is really a bit of a pathological case), JRuby seems well worth a look. I've never found C Ruby's threading up to the job of making a responsive GUI application, but JRuby might work a lot better with its JVM-backed threads.

</comment></comment><comment><USER14> cool. "rvm install jruby-1.7.0" works :-)

<comment><USER15> I initially got an "Error: Your application used more stack memory than the safety cap" message running that.

This solved it: <https://github.com/jruby/jruby/issues/346>

tl;dr:

        rvm get stable

then reinstall jruby 1.7.0

</comment></comment><comment><USER16> Best Ruby implementation so far.</comment>


Newsy exits with 35 million dollar sale to legacy media company - <AUTHOR> http://techcrunch.com/2013/12/09/scripps-buys-newsy-for-35m-to-expand-from-tv-and-newspapers-to-digital-video/

<comment><AUTHOR> Newsy's 'transformational' approach to video aggregation (considered to be on the borderline of theft by many legacy media companies) is a really interesting purchase for a media company like Scripps, which was founded in the late 1800s.</comment>


Jumping Ship for Career Progression - <AUTHOR> https://programmerfriend.com/jumping-ship/?ref=hcknws <comment><AUTHOR> Thinking about my own career progression so far I came up with the following post.TLDR: I have no clue.

What is your opinion and experience about switching jobs never/once/every 6 months during your first 5/10 years?</comment>


Cops accidentally record themselves debating the best way to frame a man [video] - <AUTHOR> https://www.youtube.com/watch?v=oVCgCHnmjSY <comment><AUTHOR> Relevant Reddit discussion: [https://www.reddit.com/r/videos/comments/c751ca/cops_illegal...](https://www.reddit.com/r/videos/comments/c751ca/cops_illegally_confiscate_guys_phone_and/)</comment>


Clever Oculus Project Lets You Live Your Life In Third Person - <AUTHOR> http://techcrunch.com/2014/07/01/clever-oculus-project-lets-you-live-your-life-in-third-person/?utm_campaign=fb&ncid=fb

<comment><USER2> >If we may suggest a next version of the project: have a drone follow you automatically, blasting its camera feed to the Rift wirelessly.

[https://www.kickstarter.com/projects/sqdr/hexo-your- autonomo...](https://www.kickstarter.com/projects/sqdr/hexo-your-autonomous- aerial-camera)

<comment><USER3> It would be far more interesting to have a camera equipped drone like the this [0] connected directly to the Oculus Rift. Especially if you could outfit it with two cameras instead of one, for stereo vision.

Since the camera moves independently of the drone, you could use the full range of motion of your head to control the camera while flying it. It would probably be the closest you could get to feeling like you are flying yourself.

[0] [http://arstechnica.com/gadgets/2014/06/flying-and- crashing-a...](http://arstechnica.com/gadgets/2014/06/flying-and- crashing-a-1300-quadcopter-drone/)

</comment></comment><comment><USER4> In case you are interested in the DIY version:

[http://www.instructables.com/id/Viewing-Myself-in-3rd- Person...](http://www.instructables.com/id/Viewing-Myself-in-3rd-Person/)

</comment><comment><USER5> Now I can see my balding head all the time...

</comment><comment><USER6> I wonder what it feels like?

<comment><USER4> Check the instructables link I posted about a similar project. Around step 8 they start commenting on that.</comment></comment>


Computer Musings by Professor Donald E. Knuth - <AUTHOR> http://scpd.stanford.edu/knuth/index.jsp

<comment><USER2> [http://stanford- online.stanford.edu/seminars/knuth/081209-kn...](http://stanford- online.stanford.edu/seminars/knuth/081209-knuth-300.asx)

I attended this one - it started off kind of slow but ended up pretty interesting.

</comment><comment><USER3> I seem to recall this link has been posted here before, but for those who have not yet seen the videos yet, they are delightful.

</comment><comment><USER4> I can imagine that he'd have some ugly things to say about the lectures being available only in Windows Media Player format.</comment>


Apache log4php 2.1.0 released - <AUTHOR> http://www.grobmeier.de/ann-apache-log4php-2-1-0-released-13072011.html

<comment><USER2> Wow, that's the first release from the project in nearly two years. Good to see.</comment>


Hacker known as "fxmsp," charged with fraud hacking 40 different countries - <AUTHOR> https://www.justice.gov/usao-wdwa/pr/citizen-kazakhstan-known-fxmsp-charged-computer-fraud-wire-fraud-and-conspiracy-hacking <comment><USER2> He is known under his real name Turchin, not his handle fxmsp.</comment>


Ask HN: Most clever business models? - <AUTHOR> Sometimes, very clever business models appear that are key to the success of a product. For some research I'm doing, I'd like to collect as many examples as possible <comment><USER2> I've always been impressed by Duolingo's strategy - offering language education while distributing text translation.

Traditionally, language learning software like Rosetta Stone has been very expensive. Duolingo offers a free language learning service. As students improve/advance, Duolingo starts to use real sentences for teaching / translation. Because the other side of their business offers language translation services, the app can surface client's text to students and once enough students have attempted to translate it, their software compares and returns the best match to the client. [1]

Equally interesting, its founder previously started Captcha, which cleverly took the "prove you're a human" opportunity to have humans OCR books and street signs. Since the Google acquisition, I think ReCaptcha is now primarily used to improve Google Maps data.

I believe Duolingo has started exploring other revenue opportunities as this hasn't been as profitable as originally expected, but the idea is/was clever.

[1] [https://unicornomy.com/how-does-duolingo-make-money- business...](https://unicornomy.com/how-does-duolingo-make-money-business- model/)

</comment><comment><USER3> The most ingenious business model I ever heard of was for a proxy service called hide-my-ass that let people get past firewalls when web surfing at work. They didn't charge a penny for using it, but if a user visited Amazon, the proxy invisibly changed every link on Amazon to one of the company's own affiliate links.

An unusual business model I've always liked but never got around to trying would be to have a stock trading game on iOS or Android where people bet on the directions of hypothetical charts (that are secretly derived from historical data) and compete for the best returns. Give the game away for free with no advertising, mine the results for outsized performers, and if you find any, then secretly feed current market data to them and trade off their bets. I'll bet there are lots of other possibilities for getting useful work done for free by gamifying it.

</comment><comment><USER4> We have a gym that costs less when you train more. You pay €29,- a month but get €1,- discount per training. So if you train every day you train for free.

I'm still not sure wether this is outright genius (most people overestimate the number of times they will actually go) or really dumb (your heavy users train for free).

<comment><USER5> Gym memberships are a clever (or diabolical) business model in general. Few people will ever cancel a gym membership once they sign up, because who wants to admit to themselves that they're now making an active decision to be a lazy out-of-shape bastard? I've had gym memberships where I went 5 or 6 times a week, but then there have been other (longer & more frequent) times where I'd pay a gym $40/month and go only once a month, if that. There was one stretch where I paid more than $1,500 over three years and didn't go a single time. Those gyms must have loved having members like me.

The lesson: a good business model is to come up with a subscription product that's aspirational, where people will feel like they're giving up on their dreams or giving up on becoming better if they cancel, because many people will continue to pay you month after month rather than face the sorry truth.

<comment><USER6> This might change. Subscriptions are the new thing and customers expect more. Personally, I won't accept a gym membership anymore that I can't cancel in 3 months max.

<comment><USER5> To be clear, I'm not talking about a subscription where you're locked in for a minimum of 12 months or whatever. I _could_ cancel any of the gym memberships I've ever had with only one month's notice. I just never did. (Because if it occurred to me to think about canceling, I'd say, "No, I really should start going. I'm going to start going. Yep, I definitely am." And then not go.)

</comment></comment></comment></comment><comment><USER7> I'm a big fan of the Wyze Labs business model: buy cheap white label hardware from China for really cheap, write westernized software for it and massively undercut the rest of the competition that is doing custom hardware development.

</comment><comment><USER8> A lot of mixing business solutions with models.

I have a meta-model I use to determine the mechanism of how a given company makes money. Simplest is the service model. Most complex is arbitrage. There are 3 in between. Variables are the scaling factors.

Question isn't "how does it make money," but rather, "of possible transaction types how must it make money and how do its factors scale?" There is a short list of ways it must, and then finite factors of how it scales.

Most clever to me is Renaissance Technologies who appear mainly to be an arbitrage factory. Ad-tech markets are closely related. Clever in the sense that their business is about buying clever and applying it to a limited class of increasingly esoteric arbitrage problems. From what I can tell, investment banks are essentially institutional casinos where you take a set of street level hustles and conceptually walk them back until they fit into a regulatory framework. Beating that game would be a lot of fun.

Market makers like uber, airbnb, ebay and AMZN are the next smartest. A company like sharetribe is a good example of smart market making, I hope they do well.

FANG companies are essentially publishers, and their business is about demographic pandering and selling viewers to advertisers/marketers.

The other categories have different structure. Separating the business model from the problem and solution gives insight into just how clever they really are.

</comment><comment><USER9> There's an extremely clever model that's been losing popularity for a while now: Make something valuable and charge money for it.

<comment><USER10> I've never heard of that. Are there any historical examples?

</comment></comment><comment><USER11> Check out park.io: [https://www.indiehackers.com/interview/how-automating- tasks-...](https://www.indiehackers.com/interview/how-automating-tasks-helped- me-grow-revenue-to-over-125k-mo-73da9c0b51)

The product (individual domains) advertises the service (domain backordering).

Sort of reverse-engineered marketing.

</comment><comment><USER12> I'm working on $1/month social network. Been working on it since December, MVP is about 80% complete now.

<comment><USER13> would be interested in learning more about this!

</comment></comment><comment><USER14> Robinhood seems to be excellent business model.</comment>


Lessons Learned – Custom ERP in Smalltalk - <AUTHOR> http://smalltalk-bob.blogspot.com/2016/01/lessons-learned.html <comment><USER2> Last I looked Visual Works smalltalk had weird license schemes that involved perpetual royalties [1]. When I used to work in business/enterprise software (no longer, thank FSM) this was an instant deal killer, especially for small businesses.

Any information on how this was dealt with on this project would be greatly appreciated.

[1] [http://www.cincomsmalltalk.com/main/products/pricing/](http://www.cincomsmalltalk.com/main/products/pricing/)

<comment><USER3> afaict this custom ERP would fall into "Companies that plan to use Cincom Smalltalk for developing applications for use within their own corporation" \-- so your question does not apply to this case.

</comment></comment><comment><USER4> Working on an ERP startup^, this was a very interesting read for me. Our situation is a little different, because our goal is a customizable platform rather than a single instance built for a single company.

Some points that resonated with me:

 _Pay your technical debt early_ : Cleaning up after yourself as soon as it becomes apparent you've made a mess is huge. The most painful parts of our application to use and to modify were built the wrong way (in hindsight) and haven't been overhauled yet. The amount of additional work that has gone into building and maintaining those parts over what would have been necessary is massive. Of course, you can't always know how to build it right until you build it wrong. Take the (tech debt) loan, but make sure you've budgeted for paying it back quickly so you don't keep paying the interest forever.

 _Show progress_ and _Have clear metrics_ : These have been very important for us. We started (some time ago) using milestones in our implementations to keep client expectations in line with reality, and to keep ourselves on track and smooth out the effort/time curve. This is probably project management 101, but it seriously helps keep clients happy and reduces stressful last-minute work.

On the other hand, I have to question the necessity of a custom ERP and the cost and effort put into it. "Total effort was about 16 to 18 person years (our team size varied from 3 to 5 over 3.5 years)." It seems to me that a lot of wheels may have been reinvented. In our experience, many companies think they have totally unique processes and data to track, when they're really doing just about the same stuff as their competitors. There can definitely be advantages to having a custom, integrated system, but on the other hand, a more flexible and customizable system can be deployed much faster and cheaper. Not SAP, but there are other options.

Bob: I'm not sure what you can share, but what are the key benefits the company expects to get out of a custom ERP? How big is the company? What is the breadth of the software, here--does it include e.g. accounting, or mostly industry-specific data collection?

On a more technical note, can you expound a little on how Smalltalk factored into the design of the software? Why do you think Smalltalk was good productivity-wise?

^Bizowie (bizowie.com)

<comment><USER5> >> On the other hand, I have to question the necessity of a custom ERP and the cost and effort put into it.

I can't imagine why anyone would, either. I've seen companies spend 2X the cost of a new ERP system that would solve all of their problems on customizations and additions to an existing, outdated ERP system.

What do they end up with? Solutions that are incomplete, unreliable, and late to the game.

<comment><USER6> Every business is unique, and a custom solution can support that uniqueness, rather than the compromises that can need to be made with a (customizable) packaged solution.

I've seen one company write off a 100 million dollar investment in a Peoplesoft based replacement for a custom system, because it was realized that the compromises that solution required were becoming too great. Sure it was fabulous for 80% of requirements, but the other 20% became a giant sinkhole of money and pain.

<comment><USER4> Absolutely, if you have the budget to build, maintain, and support a custom ERP, it may be the way to go. But I think it's a tiny fraction of businesses where the benefits of that outweigh the extra costs involved. You have to be very large, and your issues with existing systems have to be pretty expensive, before that's the case.

Out of curiosity, do you know / can you share what kinds of problems caused the Peoplesoft investment to fall apart? What issues did they run into?

</comment></comment></comment></comment><comment><USER7> Interestingly, the first "extreme programming" project was a Smalltalk project (internal at Chrysler)

<comment><USER8> All these development practises originated in Smalltalk I believe. "Agile" software development itself was dreamt up by a bunch of (mostly) Smalltalkers. I heard once told that these practices were attempts at formalising/packaging and selling normal Smalltalk development practices.</comment></comment>


A better, more positive Tumblr - <AUTHOR> https://staff.tumblr.com/post/180758987165/a-better-more-positive-tumblr <comment><USER2> hello this is a test</comment>


Emacs 25.2 released - <AUTHOR> https://lists.gnu.org/archive/html/emacs-devel/2017-04/msg00619.html <comment><AUTHOR> The original message has a typo in the subject. It says version "25.1" but the message author corrected it after. This is really about 25.2 release.</comment>


BigQuery new features, includes running JavaScript UDFs within the "Google SQL" cluster - <AUTHOR> http://googlecloudplatform.blogspot.com/2015/08/Google-BigQuery-adds-UDF-support-for-deeper-cloud-analytics.html

<comment><USER2> Some other features rolled out:

\- New faster execution engine, especially for large complex queries

\- Dynamic partition optimization

\- Federated querying from Google Cloud Storage

\- Obsoleteness of the EACH keyword

\- Numerous UI improvements

\- BigQuery Slots - an offering to guarantee availability of resources for SaaS and ETL workloads

\- High-compute workloads and supporting pricing model

\- Increased query limits for higher concurrency

<comment><USER3> Each user is limited to running approximately 3 UDF queries in a specific project at the same time.

not sure where to put that insame low number.

<comment><USER2> Fair point - it's a new feature that is getting eased in. As with other quotas, talk to us about your use case.</comment></comment></comment>


What hardware companies should know about Kickstarter - <AUTHOR> http://gigaom.com/2012/10/09/what-hardware-companies-should-know-about-kickstarter/ <comment><USER2> Is a "kickstarter for hardware" which offers preorders, etc. even feasible? If it is, why isn't Kickstarter using that model?</comment>


Taking Netflix's Vector Performance Monitoring Tool for a Spin - <AUTHOR> https://ma.ttias.be/taking-netflixs-vector-performance-monitoring-tool-for-a-spin/?hn

<comment><USER2> So the author has to use yum (a package manager), to install node's npm (a package manager), to install bower (a package manager "for the web") to install Vector...

wow

<comment><USER3> Welcome to the future!

<comment><USER4> A future with out signed packages is a scary future.

</comment></comment></comment><comment><USER5> Anyone aware of what benefits this would give someone on a pure-EC2/AWS platform over just using CloudMetrics?

<comment><USER6> Per-second metrics and a (claimed by netflix) pluggable system for custom metrics that's likely easier than pushing custom cloudmetrics data.

Some data from Netflix employees here: [https://news.ycombinator.com/item?id=9339698](https://news.ycombinator.com/item?id=9339698)

</comment></comment><comment><USER7> Any word on integration with Graphite?

<comment><USER8> PCP's pmwebd can already export its metrics to Graphite.

[http://pcp.io/features.html#analyze](http://pcp.io/features.html#analyze) [http://www.pcp.io/man/man1/pmwebd.1.html](http://www.pcp.io/man/man1/pmwebd.1.html) [https://web.elastic.org/~fche/blog3/archive/2014/06/16/pcp-a...](https://web.elastic.org/~fche/blog3/archive/2014/06/16/pcp- and-graphite-backwards)</comment></comment>


Node.js v6.0 Released - <AUTHOR> https://nodejs.org/en/blog/announcements/v6-release/?release <comment><USER2> For anyone using TypeScript to build your Node.js code, you can now switch your target to es6/es2015 in your tsconfig.json:

        {
            "compilerOptions": {
                "target": "es2015",
                "module": "commonjs"
            }
        }

Assuming you're not using that 7% ([http://node.green/](http://node.green/)) :)

Just make sure to update your package.json to take a hard dependency on Node 6+ if you do that:

        { "engines" : { "node" : ">=6.0.0" } }

This will make it so that ES6-compat is assumed and TS won't transpile ES6 functionality, but it will use commonjs for modules, which means your TS will almost be a 1:1 mapping with the compiled JS and everything should just work.

<comment><USER3> Personal pet peeve: Please don't set the node engine field in npm packages. It potentially breaks your package whenever there's a new release candidate because `email@example.com` is less than (!) `firstname.lastname@example.com` when it comes to npm's handling of this field.

<comment><USER4> node.js and JavaScript in general make PHP look a well designed decent language and ecosystem.

I cannot grok how can people chose this stack to create any product in it.

<comment><USER5> What does this type of condescending bile add to the discussion? Thousands of companies successfully use PHP and node to write excellent software every day. If you despise node so fervently, why are you even engaging in a thread about the latest node release?

Personally, I prefer ruby whenever its an option, but I've worked with node in the past and it's a decent platform that worked very well for the company (a commercial app servicing about 840k api and page requests per month).

I just don't understand the hate.

<comment><USER6> So negative opinions about '*' should never be expressed?

JavaScript is a terrible language, and imho es2015 fixes a lot of broken stuff in the only backwards-compatible way it can. That said, I find the entire micropackage culture around npm and node, coupled with the hundreds of packages that typically constitute build scripts for even a smallish node project make me realize just how brittle it is compared to competing platforms.

<comment><USER5> "Negative opinions" are fine. Heaping on condescending substance-free exclamations of ridicule in the middle of a thread about a specific issue regarding a platform you don't even use is just toxic arrogance.

Your "micropackage" complaint is daft; if you don't like small modules don't use them. Why is the language to blame for _free_ , open-source code that _you don 't have to use_? How is this even a legitimate complaint? You don't _need_ hundreds of packages for anything and you can find examples of this in any language.

</comment></comment></comment></comment></comment></comment><comment><USER7> FYI for anyone looking for the downloads, v6.0 technically hasn't been released yet. It will most likely be out within a few hours.

Edit: of course right after I say it isn't released, it is released. :)

Release post: [https://nodejs.org/en/blog/release/v6.0.0/](https://nodejs.org/en/blog/release/v6.0.0/)

<comment><USER8> Looks like there is not yet a Homebrew PR: [https://github.com/Homebrew/homebrew- core/pulls](https://github.com/Homebrew/homebrew-core/pulls)

Current formula still points to v5.11: [https://github.com/Homebrew/homebrew- core/blob/master/Formul...](https://github.com/Homebrew/homebrew- core/blob/master/Formula/node.rb)

EDIT: PR created: [https://github.com/Homebrew/homebrew- core/pull/633](https://github.com/Homebrew/homebrew-core/pull/633)

<comment><USER9> Looks like a PR was created ~4min ago.

Sidenote - was just messing with Homebrew a few days ago, and found it a little bizarre that all of the recipes are in source control and require a pull to update, rather than being on a server somewhere.

<comment><USER10> Such things can get painful for github

[https://github.com/CocoaPods/CocoaPods/issues/4989#issuecomm...](https://github.com/CocoaPods/CocoaPods/issues/4989#issuecomment-193772935)

<comment><USER8> I think that's a different issue.

</comment></comment></comment></comment></comment><comment><USER11> On a related note, does anyone know if there's a way to tell Babel that your compilation target is Node.js v6.0 and only have it compile stuff that isn't natively supported yet?

Edit: Thanks for all the answers. I just went through the list of unsupported features and as I'm not using any of the remaining 7%, I might be able to get rid of Babel during development if I'm lucky.

Edit 2: Oops, still no es6 module support :(

<comment><USER12> Isn't Babel 93% redundant on the server side now? If you're not very dependent on the last 7% I'd just remove it.

<comment><USER13> The big missing thing is modules, which aren't in the kangax compatibility table.

<comment><USER14> In fairness, the babel approach to module handling is probably better than an in-browser es6 module implementation, or what may follow... compatibility with npm packages (cjs) will be significant for a while.

<comment><USER13> My understanding is that V8 will provide hooks that parse the module imports, then delegate to the embedder to fetch the actual source code and hand it back to V8 to load. I'd expect that the Node implementation of these hooks would work the same way as the existing require() machinery, so that existing libraries will continue to work.

</comment></comment></comment></comment></comment><comment><USER15> Interesting how this is written as a traditional press release rather than software release notes like most other open source projects

<comment><USER16> Here's the changelog: [https://raw.githubusercontent.com/nodejs/node/v6.x/CHANGELOG...](https://raw.githubusercontent.com/nodejs/node/v6.x/CHANGELOG.md)

Notable changes summarized here: [https://github.com/nodejs/node/pull/6383](https://github.com/nodejs/node/pull/6383)

</comment></comment><comment><USER17> I've been a front end developer for, well, quite a while, and in that time we've gone from cycles of around a decade (thank you IE6!) for new versions of JS to something closer to a couple of years.

The future, as I see it, is incredibly bright.

</comment><comment><USER18> NW.js v0.15.0 beta released with Node.js v6 : [http://nwjs.io/blog/v0.15.0-beta1/](http://nwjs.io/blog/v0.15.0-beta1/)

</comment><comment><USER19> I'm really curious to see the kinds of things people will cook up with the new Proxy object

</comment><comment><USER20> And now available on Google App Engine (Flexible Environment).

Example app running v6.0.0: [http://nodejs600.appspot.com/](http://nodejs600.appspot.com/)

</comment><comment><USER21> Is there a plan for Node.js to get `import` any times soon? Will we need babel in order to use this for months? years? ever?

<comment><USER22> There is/was a vote on this pretty soon. We are deciding how modules would work - with a new file extension? With a module.json? With a separate entry entry in package.json? Lots of decisions to be made :)

<comment><USER23> Surely they should work the way they work in ES6?

Any solution that requires extra work (file extension, another file to maintain) is a non-starter.

Frankly it should work how Babel transpiles it - because there's no reason for it not to.

<comment><USER24> ES6 didn't define precisely how module loading worked, one of the reasons it isn't actually implemented yet. And there are actual reasons why the method babel currently uses won't precisely match the actual implementations (see hierarchal v flat dependencies)

<comment><USER23> Those problems are just as present in CJS as far as I'm aware though...?

Yet they were solved for that.

</comment></comment></comment></comment></comment><comment><USER25> For those curious about the performance improvements, [https://benchmarking.nodejs.org](https://benchmarking.nodejs.org) has you covered.

</comment><comment><USER26> Any idea why the node-compat-table says 96%? [http://node.green/](http://node.green/)

<comment><USER27> Uncheck "requires harmony flag " and it falls to 92%. I'm guessing the extra percent is a rounding issue.

</comment></comment><comment><USER28> I'm using webstorm to write a node app. I'm using ES6 and webstorm transpiles it to 5.1. Details here:

[http://blog.jetbrains.com/webstorm/2015/05/ecmascript-6-in-w...](http://blog.jetbrains.com/webstorm/2015/05/ecmascript-6-in- webstorm-transpiling/)

I'm using node 5.9.1 and webstorm creates a _-compiled.js and_ -compiled.js.map file for each transpiled file.

If I use Node 6 which I understand is now up to 95% support for ES6, do I still need to transpile to ES5.1? Is anyone else using webstorm with ES6 and are you also going through this transpiling step?

</comment><comment><USER29> "Fastest Growing Platform"

Does this refer to growth in number of users or in number of modules? Or maybe just counting the number of lines of code?

<comment><USER30> It makes me feel a little ill to think of all the new-ish devs jumping on the Node train, thinking it's the Next Big Thing in server code. It's a cool technology, and incredibly easy to get into, but then the curve gets so very steep as you try to make it behave like any of the robust and fundamentally sound language/framework app development ecosystems.

If I could offer any advice to anyone who is relatively new to all this, I would say choose anything else: Ruby/Rails, PHP/Symfony, Python/Django, Java/Spring, C#/.NET, whatever. You'll be doing yourself a favor. Learn how to do things correctly, in an tech stack that actually exists and works properly and makes sense, then see where things stand for JS on the server in a couple years. The bad habits, mistaken assumptions, and rampant misinformation being spread in the JS world these days is just amazing.

<comment><USER31> "Choose anything else" sounds like some FUD to me. I'm not an expert with all the technologies you mentioned but I feel like Meteor has just recently truly come into its own and I would pick it over Rails, Django, or anything PHP any day.

I think another factor is the level of conservatism of the programmer in question: would you rather work on stable but somewhat boring platforms at a large enterprise, or do you want to be on that new-new at a hip startup? (These options obviously exist on a spectrum.)

If you want to be in the fastest-moving, most exciting ecosystem around, it seems to me that JS is the train you want to be on.

</comment></comment></comment><comment><USER32> This is a great news.

Are there any tools that statically or otherwise checks any potentially breaking pieces in the Node v4+ codebase/dependencies?

</comment><comment><USER33> Note that the require mechanism is quite flakey, and they are discussing a new release or even reverting [https://github.com/nodejs/node/issues/3402#issuecomment-2151...](https://github.com/nodejs/node/issues/3402#issuecomment-215166795)

</comment><comment><USER34> Released where? Download page still points to v4.4.3 (LTS)/v5.11 (current)

<comment><USER35> Release build failed - [https://github.com/nodejs/node/pull/6383#issuecomment-214844...](https://github.com/nodejs/node/pull/6383#issuecomment-214844512)

New one is running, and should be out soon-ish.

<comment><USER34> It's there now, awesome! Going to take it for a spin now

</comment></comment></comment><comment><USER36> Why doesn't tail call optimization get any love?

<comment><USER37> Unfortunately it get's lots of pushback instead. It seems very likely that syntax will get changed to `return continue fn()` [https://github.com/tc39/proposal-ptc- syntax](https://github.com/tc39/proposal-ptc-syntax)

Somewhat related there is no optimization for passing arbitrary length arrays with `...` to function having `...rest` as the last argument, which means [].splice is still a footgun:(

<comment><USER38> That explicit tail recursion syntax is pretty gross. Is there a precedent in any other language?

<comment><USER39> Clojure's recur is kinda-close, I guess?

<comment><USER40> It is, but Clojure uses it, because it cannot really do Tail Call Optimization due to constraints on the JVM. Therefore "recur" is required to keep the Stack from overflowing.

</comment></comment></comment></comment></comment><comment><USER41> Is it stupid to still use v0.12 ? Last time I've checked I've had compatibility issues with all new (now old) io.js versions.

<comment><USER42> What sort of compatibility issues? Most packages update to work with new Node releases fairly quickly. Usually the packages that have compatibility issues are ones with native C++ bindings. If you `npm rm` the package and reinstall it, it will usually build correctly for the latest Node/V8 release.

Further, if you have a project that for whatever reason is not feasible to update to run on modern Current Node, you can use `nvm` or `n` to choose which Node release you want to use: i.e. `nvm exec 0.12 node old-project.js` and `nvm exec 6.0 node fresh-project.js`. v6 (and the versions that preceded it) has made Javascript _really_ enjoyable to write.

<comment><USER43> Our biggest issue is to get off node 0.12, we need to get off protractor 2, and some of our protractor tests fail on protractor 3 for reasons no one has yet figured out. The only clue is a note saying selenium webdriver 2.48 changed how its control flow worked, but nowhere is what changed from 2.47 to 2.48 documented.

<comment><USER44> You can't diff between 2.47 and 2.48 and see what changed? Or is that a binary part you don't have source access to?

<comment><USER43> "Showing 930 changed files with 13,029 additions and 10,187 deletions. "

Feel free to try: [https://github.com/SeleniumHQ/selenium/compare/selenium-2.47...](https://github.com/SeleniumHQ/selenium/compare/selenium-2.47.0...selenium-2.48.2?expand=1)

It's a dependency of a dependency with multiple language versions in the one repository.

</comment></comment></comment></comment></comment><comment><USER45> Is there a list of the remaining 7% features?

<comment><USER46> [http://node.green/](http://node.green/)

</comment></comment><comment><USER47> I like to see some benchmark for latency and throughput, as far as only official benchmark is exist.

</comment><comment><USER48> Released where? It's not in the GitHub releases, not on the homepage either.

</comment><comment><USER49> I'm assuming this is backwards-compatible with 5.X?

<comment><USER50> The major version bump indicates there are changes that could break some use cases. There's a partial changelog [0] in the v6 release pull request.

[0] [https://github.com/nodejs/node/pull/6383#issue-151012738](https://github.com/nodejs/node/pull/6383#issue-151012738)

</comment></comment><comment><USER51> Hope its not getting bloated

</comment><comment><USER52> Why is there a press release for this sort of thing?

<comment><USER53> Do you have a problem with it?

</comment></comment><comment><USER54> interesting...considering JavaScript itself is a shaky language.

</comment><comment><USER55> babel sucks - I never though I could hate something so strongly.

Just today I had to deal with the fact that babel wraps ALL your generators in some shit function.

Why ? just why ? generation function was supported in browsers longer then the age all the babel maintainers combined.

The worst part is I do not use babel myself - I wouldn't touch it with a ten foot pole but am forced to use it due to my stupid cowokers writing everything using babel - ( why does babel need .babelrc file ?? - is babel such a prominent part of your life that you need .rc files ?? and why does the .rc file need to be specified in every freaking folder ! )

1) babel's docs are also terrible

2) The people maintaining babel seem to actively market babel and then at the same time ignore questions and requests for better docs from the community.

3) Slowest compiler I have had the pleasure of dealing with - my babel watch process consumes a grand total of 150 MB of memory !!

Edit - had to follow HN guidelines

<comment><USER56> I like the idea of Babel, but would prefer it as a sort of compile-for- production step. The performance and debugging complexity don't seem worth it as part of the development process. Seems like it'd now be possible w/ Node v6 and a modern browser to develop "live" in (93% of) ES6 and then just Babel- compile to ES5 for backwards compat at the end?

Which unfortunately loses the ES7 features.

<comment><USER57> You can use the env option to change the transforms per env [http://babeljs.io/docs/usage/babelrc/#env- option](http://babeljs.io/docs/usage/babelrc/#env-option)</comment></comment></comment>


Show HN: Machine Learning into Production Workshop: MLFlow, Airflow Tutorials - <AUTHOR> https://github.com/TheGurus/ml-in-production-madrid <comment><AUTHOR> Hi guys, this is the repository of a workshop we tought last weekend in Madrid, maybe you can find it useful. The content is:

* How to setup MLFLow, a tool for ML experiment tracking and model deploying, from zero to hero. * How to track ML experiments with MLFLow * How to put models to production with MLFLow. * How to deploy models to production in AWS Sagemaker with just a couple lines of code. * How to setup Apache Airflow, a powerful tool to design, schedule and monitor workflows. * How to create workflows that take advantage of deployed models.</comment>


Analogue Pocket - <AUTHOR> https://www.analogue.co/pocket/ <comment><USER2> The things that excite me the most about this aren't the backlog of games, but the TV dock, Nanoloop tracker, and making new games. I am a big fan of seeing how creative people can be with limitations. Making a game or music on this system definitely would fall in that category. I'm not aware of what the limitations are for this game though.

I like the GB studio app, though since it maintains strict backwards compatibility with the original Game Boy, you have a very restricted color palette.

I wonder if PICO-8 can be ported to this.

</comment><comment><USER3> At least one GBA game (Megaman Battle Network 4) had a major glitch (game hangs in the WoodMan scenario, in a particular area of the game, after a random battle) that only occurred on some hardware (Nintendo has acknowledged the issue on the original DS [1]; I've seen a Let's Play [2] claiming it happens on the GBA SP as well but cannot confirm that for myself)

The cause is different behavior on trying to load invalid sprites; to my understanding, the NDS keeps reading until the address wraps around to a valid sprite, locking up until then; other hardware stops reading immediately. That scenario has a problem with one particular animation when the map reloads after a battle. It seems plausible that other games would have the same issue, but MMBN4 Blue Moon is the only one for which Nintendo's got an acknowledgement of the issue on their site, so maybe literally nobody else made that mistake.

I wonder whether they caught that? On the one hand, it's a (relatively) known issue, in that Nintendo has mentioned it on an official support page. On the other hand, it seems to only impact a single scenario in a single game, which has a load of other bugs anyway. But then, they're not trying to support DS games, so the only way for the bug to get in (if they're going for an as- close-as-possible emulation of the GBA and doing so successfully) would be if the bug does in fact cause hangs on the SP and they used that one as their reference.

[1] [https://www.nintendo.com/consumer/systems/gameboy/trouble_sp...](https://www.nintendo.com/consumer/systems/gameboy/trouble_specificgame.jsp#megaman) [2] [https://lparchive.org/Mega-Man-Battle- Network-4-6/Update%200...](https://lparchive.org/Mega-Man-Battle- Network-4-6/Update%2007/)

</comment><comment><USER4> That's awesome!

Though, I'd rather have LSDJ than Nanoloop (Nanoloop is cool, but I found the tracker interface of LSDJ more comfortable)...but, I guess since it's compatible with Gameboy games, it's compatible with LSDJ, so, it's probably just a matter of sticking it on an SD card and plugging it in.

Assuming that's so, I'll buy this just to not have to worry about my Gameboy's screens going out completely (both have several dead or dim vertical lines already). And, being able to program the FPGA sounds hella cool. I wonder if a handheld Amiga (or C64 would also be cool, without needing the resources of an Amiga) is a possibility...

</comment><comment><USER5> Super intriguing. I don't really know much about FPGAs, but the idea of using them to essentially clone old gaming system CPUs is flat out awesome. I assume that theoretically this would be identical to original hardware, unlike emulating it in software?

This Pocket device looks like a well made product. I wish all the best to this endeavor -- if nothing else just for helping preserve gaming history and letting people (more accurately) play older games.

<comment><USER4> "Identical" is a really strong word. The original Gameboy had all sorts of quirks due to the low price target of the device and the technical limitations of the time. The way the bits are tossed around inside will be very similar to the original hardware, and programming it will be roughly identical (it'd have to be to run all the old games accurately and at the same speed), but all the interfaces to the real world will be quite different.

This thing has HD color output...that's definitely not identical, but it's not a bad thing. The audio output is also a modern signal path...we probably wouldn't want it to be the same whiny/noisy output as the original at this price. And, oddly, some people do what's called a "prosound mod" on original GameBoys to clean it up a bit and obtain better frequency response, though I think that's silly...I just embrace all the quirks and accept that it's how GameBoy music sounds, if I wanted pristine I'd use my 24-bit 192KHz interface on my computer that's like a million times more powerful.

I think the cool thing about projects like this (and I'm excited about several of them) is that we get devices that we don't worry about dying, that remind us strongly of the ones we grew up with or enjoy tinkering with because of their limitations. Even if they aren't identical. If you really want identical, just buy a GameBoy. You can get original ones in good working condition for cheaper than this (though you might have to go through a few to get one that's actually in good working condition without screen problems...I bought like five on eBay to end up with two in mostly good shape, but the one with the best screen has also developed dead vertical lines since I've had it, but total spent was probably less than $200, including shipping).

</comment></comment><comment><USER6> Oh man, this looks great. I've been wanting a system that you can program close to the metal like this.

That being said, I think this will be just for the programmer enthusiasts, $200 is a pretty hefty price for consumers considering you can make a Pi that can emulate a lot of retro consoles for cheap. Understandably expensive, though, given what this is.

</comment><comment><USER7> The hardware looks incredible.</comment>


A Criticism of JavaScript Cryptography - <AUTHOR> http://bren2010.github.io/jekyll/update/2014/06/17/javascript-crypto.html
<comment><USER2> I thought this was a good post, but I wasn't impressed with the criticisms of other blog posts. Okay, perhaps I'm biased, because I wrote one of them, but how about I try to defend the other?

The Matasano post is here:

[http://matasano.com/articles/javascript- cryptography/](http://matasano.com/articles/javascript-cryptography/)

Perhaps the most objectionable thing about the Matasano article is title. Otherwise it does a very good job of criticizing a particular way of engineering web cryptography that is, for lack of a better term, total bullshit. But is the approach criticized in the Matasano post used in the real world?

Let's try an experiment! Go to google.com and type in "encrypted chat"

If your results are similar to mine, one of the top 3 results will be "chatcrypt.com". Let's read the "How It Works?" page:

> Most people thinks that if a website uses a HTTPS connection (especially > with the green address bar) then their "typed-in" informations are > transmitted and stored securely. This is only partially true. The > transmission is encrypted well, so no third party can sniff those > informations, but there is no proof that the website owners will handle them > with maximum care, not mentioning that the suitable laws can enforce anyone > to serve stored data for the local authorities.

Okay, so this site attempts to implement end-to-end encryption in a web browser. Except... what's the problem? Oh, it looks like chatcrypt.com isn't served over HTTPS. In fact, if we try to visit the site over HTTPS, it doesn't work at all.

chatcrypt.com claims to keep your traffic secure using end-to-end cryptography implemented in JavaScript, except the JavaScript is being served in plaintext and is therefore easily MitMable.

Top 3 Google result for "encrypted chat"

Is the Matasano post that unreasonable? (besides the title) It pretty much describes that sort of site to a tee.

<comment><USER3> I mean, it is secure against passive adversaries... but that's nit-picking.

ChatCrypt has made a large number of mistakes, though, I concur. They don't use HTTPS, it isn't open sourced, and the developer is practically anonymous.

I would still maintain that Matasano's article is problematic, though, because it has one of two effects on the reader:

1\. The reader is more-than-well convinced on faulty basis that JS crypto should never be used.

2\. The reader is still adamant on continuing their project, but is now alienated from a source that could have offered a plethora of helpful advice. (Example: "Please, for all that is good, use HTTPS.")

Of course, nothing will prevent the occasional surfacing of bad crypto, but their article certainly doesn't help any of its causes.

<comment><USER4> How about, instead of arguing that readers of an article are more convinced than they should be about something _you yourself appear to be convinced of_ , you put your money where your mouth is and formulate an argument for a setting in which _content-controlled browser Javascript_ is a sensible place to deploy cryptography. Give yourself the full benefit of every facility the web programming model gives you, up to the limit of installing browser extensions (at which point you're no longer talking about content-controlled code). What's a system like this _that has worked well_ , and would be resilient to a determined adversary?

<comment><USER3> Is that a question? I don't understand the question. "Put your money where your mouth is" doesn't sound like a rebuttal.

I've no idea what you're talking about.

<comment><USER5> > I don't understand the question.

Let me break that down for you:

1) formulate an argument for a setting in which content-controlled browser Javascript is a sensible place to deploy cryptography.

1.a) Give yourself the full benefit of every facility the web programming model gives you, up to the limit of installing browser extensions.

2) What's a system like (1) that has worked well, and would be resilient to a determined adversary?

So, he's claiming to have shown that content-controlled browser javascript crypto is worse that useless because it allows good people to inadvertently leak secrets. All you have to do to prove him wrong is just tell him a use case where it would make sense and then cite an example where that worked well* and would be resilient to a determined* adversary.

So, all you have to do is say "chatcrypt.com's use case makes sense and chatcrypt rocks. Here I show that it is unbreakable until long after the stars cool, and no amount of kneecap cryptography will lessen the adversery's burden."

* He's giving you two wiggle words already, you can define them however you'd like.

</comment></comment></comment></comment></comment><comment><USER6> Wow.

 _A construction or implementation is secure if an adversary, given a certain level of power, is unable to achieve a given objective. The level of power an adversary is assumed to have and their ultimate objective is called the threat model.

If a new construction is secure under a new threat model that either increases the amount of power an adversary can have or makes the adversary's objective broader, the new construction is said to have a higher level of security._

This is what we need more in security discussions. So many discussions, here on HN but also, well, everywhere, are really misunderstandings about which threat model to assume. People get into hot-headed fights about whether some solution somewhere is or is not "secure", when really all they disagree about is which definition of "secure" to use.

Well done! I propose that security related blog posts take some time out to casually define these terms over and over again, for a while, until we can all just assume them known and be done with all the vague imprecise nonsense.

<comment><USER4> This sounds important, but the distinction between "passive" and "active" attackers has come up in every discussion of JS crypto I can remember on HN, and indeed in every discussion of TLS (see, for instance, every discussion of why certificate authorities are necessary and why self-signed certificates are insecure "despite using exactly the same cryptography as CA-signed certificates").

I do not believe this is a dimension that has been missing from previous discussions, but perhaps you can use the search bar below to find a debate about JS crypto where it was missing and where the result was misleading to readers.

<comment><USER6> > _but perhaps you can use the search bar below to find a debate about JS > crypto where it was missing and where the result was misleading to readers._

Oh come on, was that sneer called for? If you really feel that none of the security discussions here on HN are getting way out of hand over what's really a misunderstanding on some basic assumptions, then you haven't been looking. Note, I didn't say "JS crypto discussions", I said "security discussions".

In fact, I'm mostly referring to the kinds of discussions that did _not_ start as a security topic, but evolved into them. There, there's often people like me, who care about security but who are far from experts, and these people (myself included) often mix stuff up. Clearing out definitions and which threat model to assume would _really_ help in such discussions. I thought that this blog post did that in a very clear and non-opinionated way in that little paragraph there, so I complimented it.

Is that really so bad?

<comment><USER4> I'm not sure what controversy you think you're wading into here, or why you think I was sneering. I was being completely serious.

</comment></comment></comment></comment><comment><USER4> I suppose I'm expected to give a full-throated defense of the Matasano post, which I wrote, but I'm not going to. While I don't dislike the post _as much_ as this author appear to, I don't much like it either. I wrote it in a single draft, all at once, as a sort of message board comment I'd write once and maybe in the future refer back to. I didn't promote it on HN and I'm not the reason it keeps getting cited.

None of this bickering changes a simple truth: when a web mail provider claims to provide "NSA-proof" end-to-end encryption, hosted in Switzerland just to be safe, using software that _you don 't have to install on your computers at all_, then you need to assume that web mail provider can read your email, and so can anyone who can coerce that provider into doing something. If you believe that --- and you should --- then I don't care what you think about the rest of the Matasano article.

<comment><USER3> If you think that's the "simple truth," you either didn't read the article, or you have some piece of information you're not sharing with the rest of us.

You also know something about the "formalisms of HBC" (now redacted), and how it doesn't work with browsers that even scholars don't know about.

I think we'd all appreciate elaboration.

<comment><USER4> This comment appears to be totally unresponsive to mine.

Incidentally, the "now redacted" in the parent comment refers to three bullets I had written in the grandparent comment and left for _four minutes_ before realizing that objecting in detail to this person's blog post more or less amounted to making a full-throated defense of the Matasano post. Which, like I said, I'm not in love with either.

</comment></comment></comment><comment><USER7> One problem with the "passive adversary" attack is that even if the nonce+HMAC protocol defeats the passive adversary, you as a user have no way of verifying whether or not your adversary is passive. Or whether they exist, or, indeed, anything about them, as in the real world, you don't get to pick your adversaries. The user needs a way to determine whether the connection is secure before they can trust it, because they can't (correctly) assume that only passive adversaries exist.

So, if that is the best in-browser crypto can do, then it is still basically useless, unless you get to choose your adversary. And "active adversary" software is off-the-shelf tech, not some sort of bizarre thing only the NSA has access to. Active adversary is the lowest baseline of attack worth talking about.

<comment><USER3> No, you don't get to pick your adversaries, but you do get to pick the strongest one you wish to be secure against. Or for that matter, can be secure against. I briefly mentioned Diffie-Hellman key exchanges to provide an example of another common primitive that's only secure against passive adversaries. (DHKEs are typically used in peer-to-peer applications.)

Also, if you keep reading, I mention several uses for in-browser crypto.

<comment><USER7> Let me say it again: As a user, you can't _verify_ that you're secure against the attackers.This is my important point, not whether a particular chosen attack was blocked. Therefore, if you care at all about security, you can't trust the channel. You're only looking from the POV of the attacker, but you've got to consider all the POVs, including the users, and not impute to them knowledge that they can't have about the universe ("I am only being attacked by passive attackers") in order to declare your system "more secure".

Saying "I'm secure against passive attackers" doesn't mean that you're safe doing anything on your "secure" channel, because the bar for active attack is so low that that's hardly saying anything. You can be secure against "passive attackers", but you still can't verify that you _haven 't been attacked_, in general. A definition of security in which a user blithely sticks sensitive data on a channel, unconcerned about whether the channel was attacked, is a useless definition of security... by definition, we're not talking about a user concerned with security, of _any kind_.

If we are talking about a security scenario where the equivalent of "active attack" is actually quite difficult and it takes a nation-state's resources, I'd be happy to discuss this argument. We've historically used some encryption at points in time where technically brute forcing it was feasible for very large entities, for instance. But the bar for active attack on the web is low here, very, _very_ low.

<comment><USER3> This is an example of the Perfectionist Fallacy I was talking about in the article.

You can't verify that someone isn't MiTM'ing with a stolen certificate. You can't verify that the CA hasn't been coerced into forging a valid certificate. You can't verify that your government hasn't ordered that computer manufacturers install surveillance devices. That doesn't mean that the internet is unusable.

Some things are vulnerable to active attacks, and if they were attacked, nobody would know. Every cryptographer knows this. It's not a big deal.

<comment><USER8> I didn't get the impression jerf was arguing for perfect security, as much that they were saying that securing _only_ against a passive attacker is as useful for the user as not using TLS at all.

Selecting a threat model is all well and good, but if you select an artificially easy threat model to defend against then you're not really helping users (in this case, helping them against random evil ISPs?)

</comment></comment></comment></comment></comment><comment><USER9> It's not clear to me if the author is _endorsing_ the use of browser crypto in any particular scenario. Regardless, probably the most common reason for wanting browser crypto is to protect the data _before_ it hits the server, thus protecting against a malicious or compromised server.

For example, consider a web-based mail client. You want to send an encrypted message, say via PGP, and you don't want the server to be able to read it, even if the server is evil. You'd _like_ to be able to do the PGP encryption 100% in-browser, with no browser plugins or extensions necessary.

I think that's the most common category of use-case for browser crypto. Unfortunately, it's one where browser crypto plainly doesn't work. The whole point here is to defend against an evil server, but if the server is evil, _it will send you evil crypto JS._ TLS doesn't help you. Nobody's impersonating the server or altering the JS file in transit. You're getting an authentic copy of the JS file from the real server. It just happens to be an authentic copy of an _evil_ JS file.

Given that, what _can_ you do with browser crypto, practically speaking?

<comment><USER10> It still might protect you if you won't access server while it's compromised. It protects you from someone just hacking your server, downloading all the data and getting away.

Also you might serve files that do the encryption from different server that's smaller, better protected, more stable, that less people have access to.

<comment><USER9> > It still might protect you if you won't access server while it's > compromised.

The end user can't know when that's the case.

> Also you might serve files that do the encryption from different server > that's smaller, better protected, more stable, that less people have access > to.

That doesn't provide any assurance to the end user that the JS isn't malicious.

Remember, "compromise" doesn't just refer to a drive-by hack. The site operators themselves may become compromised (or start that way), and deliberately serve malicious JS. Users can't know when that's the case. When it is the case, the strategy you suggested offers no protection, because the "more secure" JS server is still under the control of the bad actor.

<comment><USER11> > > It still might protect you if you won't access server while it's > compromised. > The end user can't know when that's the case.

This is the entire point of the article. You can't know if it's the case, you can't either with any software distribution. When you type 'apt-get install opensshd', how do you know if you're getting the package from an uncompromised server?

You just have to trust that the public keys you got are the right ones, and their private keys have not been stolen.

So what the author is saying is that regarding that aspect web crypto is at roughly the same level.

The big problem of course is that there is evidence that the whole CA system is much less reliable than the old GPG signing party system.

<comment><USER9> > When you type 'apt-get install opensshd', how do you know if you're getting > the package from an uncompromised server?

If you don't take any steps to verify the integrity, then you don't know.

The big difference, as I see it, is that the JS code gets served over and over again to the same clients. Every time you visit the website, it can load a new version of the JS.

<comment><USER12> Even if you do verify the integrity of the package, then you still can't know for absolute certain that the package maintainer hasn't somehow exposed their private key or been otherwise compromised. You have to trust them.

<comment><USER9> If the package maintainer has exposed their private key, and yet the package itself in intact, what harm is there (at the moment)? With the key compromised, you _could_ have been MITMed, but you weren't. You _could_ be MITMed in the future, but that's a problem for another day.

<comment><USER12> I just saw this reply, and I have to clarify: the moment the maintainer's key is compromised, it becomes possible for someone to MITM. It's not clear if that's what you were saying, but that's how it is, and that's absolutely a problem as soon as the key is compromised (particularly if he/she was targeted).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> One aspect of in-browser functionality OP mentions is "offline". However, browsers are pretty cool in that they can mix offline and online. You can open a local html file and it can then make online requests. Alternatively, you can request an html file online that then can access local files.

This ability to mix offline and online content is something that I think has a lot of potential to improve client-side encryption. Specifically, client-side encryption coupled with an unhosted webapp[1].

I've been exploring this potential for my byoFS[2] project, and made an example end-to-end encrypted chat demo[3]. You can request the app anonymously (or even save it and open it locally). The app then lets the user connect an online datastore (e.g. Dropbox) to save the encrypted chats.

This separates who serves the anonymous static webapp and the authenticated datastore, and makes it much harder to target a javascript attack (the most common attack from the Snowden leaks).

[1] - [https://unhosted.org/](https://unhosted.org/)

[2] - [https://github.com/diafygi/byoFS](https://github.com/diafygi/byoFS)

[3] - [https://diafygi.github.io/byoFS/examples/chat/](https://diafygi.github.io/byoFS/examples/chat/)

</comment><comment><USER14> In a project I'm working on [1], I'm planning to provide a browser extension that verifies the source code is digitally signed and that it matches the source code published on GitHub. I believe this creates a pretty good security model for a web-based app, even more so than most desktop programs.

Some more information from the security page [2]:

The browser extension provides improved security by verifying the integrity of the files served by the server. The verification is done using two factors:

\- Cold storage signature verification: In addition to SSL, static files (html/css/javascript) are signed using standard Bitcoin message signatures, with a private key that is stored offline and encrypted. This ensures that the content served from the webserver was not tampered with by a third party.

\- Comparing against the code on GitHub repository: The source code from the GitHub repository is built on Travis-CI and the resulting hashes are published publicly on Travis's job page. The extension ensures that the content served by the webserver matches the open-source repository on GitHub.

If an attacker gains control over the web server, he still only has access to information the web server already knows (which is very little). To get sensitive information, he would have to modify the client-side code to send back more data to the server.

For an attacker to successfully mount such an attack against someone with the browser extension, he would have to:

\- Gain access to the web server.

\- Gain access to the personal computer of a developer with commit access to the GitHub repository. [3]

\- Commit his changes to the public GitHub repository, where they can be seen by anyone. [3]

\- Gain physical access to the offline machine with the private key and know the passphrase used to encrypt it.

[1] [https://www.bitrated.com/](https://www.bitrated.com/)

[2] [https://www.bitrated.com/security.html#browser- extension](https://www.bitrated.com/security.html#browser-extension)

[3] That's assuming that GitHub and Travis-CI are themselves secured. Gaining access to any of them would make those steps unnecessary.

<comment><USER15> So what happens when github goes down? I'd argue a better source for this sort of thing would be to put the hash in dns, either directly in a txt record, or using hacks involving A or AAAA records. Your nameserver almost certainly has more security than your github repo.

<comment><USER12> That would be really sweet if you could access dns directly in client-side Javascript, particularly given the existance of DNSSEC (great for bootstrapping trust).

Alas, client-side JavaScript doesn't speak DNS. You'd have to go through a server, which would mean you'd lose anything you might gain.

</comment></comment></comment><comment><USER16> Attesting software (i.e. JavaScript, even from third parties) might be possible if [https://w3c.github.io/webappsec/specs/subresourceintegrity/](https://w3c.github.io/webappsec/specs/subresourceintegrity/) gains traction.

</comment><comment><USER17> Why do people use styles like these that push all the content uncomfortably to the sides? 40% of the screen is dedicated to what? The blog title and a link home.

Edit: [http://i.imgur.com/62l4zCG.png](http://i.imgur.com/62l4zCG.png) 500% better

<comment><USER18> The line length in your edit is WAY too long.

<comment><USER19> That depends on its physical size (and viewing distance). Pixels don't really mean anything.

</comment></comment></comment><comment><USER20> Can any of you comment on my scheme described here: [http://ashkash.github.io/ajaxcrypt/index.html](http://ashkash.github.io/ajaxcrypt/index.html) This should resist even active adversaries:

\- Statically encrypt and publish content on HTTP server \- Transmit these via HTTP to an iframe component at client browser \- transmit decryption and key routines using HTTPS. \- HTTP-iframe locally sends message to HTTPS-iframe via window.postMessage() \- HTTPS-iframe decrypts content (with pre-shared key) and renders it on page

</comment><comment><USER21> Ten years from now, when web security is even more laughable and anemic than it already is, some of us are going to remember discussions like these where application developers at large ignored the warnings from the established crypto community. Some of us are old enough already to remember this pattern happening before.

I understand the strong reaction to the actions of the NSA, but all this is doing is providing the appearance of security while not making it any more difficult for adversaries like the NSA.

<comment><USER22> Yep. This whole NSA thing has forced a new generation to start reading Applied Cryptography...or at least make it plain that they need to.

</comment></comment><comment><USER23> Interesting coincidence. I just wrote [http://vnhacker.blogspot.com/2014/06/why-javascript- crypto-i...](http://vnhacker.blogspot.com/2014/06/why-javascript-crypto-is- useful.html), in which I explain the threat model implied in the Matasano's article doesn't apply to most applications.

<comment><USER24> "they just make the task of programming a crypto library a bit more fun and challenging, not riskier"

Seriously? It makes it more difficult to get things right, but the risk of getting it wrong is not increased? And that after you just described how the challenges of JS have already directly led to vulnerabilities?

Also, you mostly don't really support your own argument. How exactly does a malicious server not affect "crypto browser apps"? How does staying out of scope for PCI DSS have anything to do with security (except maybe demonstrating that PCI DSS is crap because it can so easily be circumvented)? Also, in what kind of scenario would leaking info in a referer be a problem, but leaking the same info in encrypted form would not? And how do you guarantee that your verification code is loaded fresh from the server once your application has been compromised in a browser?

<comment><USER23> > Seriously? It makes it more difficult to get things right, but the risk of > getting it wrong is not increased? And that after you just described how the > challenges of JS have already directly led to vulnerabilities?

Well it seems that you misunderstood which challenges I was talking about. Lack of types is a big problem, but besides that everything else doesn't make the risk bigger.

> How exactly does a malicious server not affect "crypto browser apps"?

I didn't claim that malicious servers won't be able to affect crypto browser apps. What I said is that in these apps you have to trust the server already, so it doesn't make sense to consider them untrusted.

> How does staying out of scope for PCI DSS have anything to do with security > (except maybe demonstrating that PCI DSS is crap because it can so easily be > circumvented)?

It's exactly the point. When people say "javavascript crypto is harmful" they don't consider use cases where it's really useful, even just to circumvent PCI DSS.

> Also, in what kind of scenario would leaking info in a referer be a problem, > but leaking the same info in encrypted form would not?

I don't understand this question.

> And how do you guarantee that your verification code is loaded fresh from > the server once your application has been compromised in a browser?

Because every time I refresh my browser I get a chance to get some trusted code from the server.

<comment><USER24> > Well it seems that you misunderstood which challenges I was talking about. > Lack of types is a big problem, but besides that everything else doesn't > make the risk bigger.

So, it isn't actually a bit more challenging then?

Also, it seems to me like you are at least forgetting timing and possibly other side channels.

> I don't understand this question.

I just can't see any actual scenario where that helps, mostly because it seems to me that the cipher text usually would be a plain-text equivalent, so it doesn't really matter to the attacker whether they have the plain text or the cipher text.

> Because every time I refresh my browser I get a chance to get some trusted > code from the server.

So, in other words, you don't have a guarantee?

Other than that, and in general, it seems to me that your argument is somewhat of an equivocation fallacy: You are essentially redefining crypto to include kinda-non-crypto, to then claim that this redefined crypto actually can sensibly be used in browser-side JS, and therefore the arguments against the use of the original crypto are somehow not good advice.

I would think that it is rather obviously implied in most criticism of JS crypto that you are not just executing code that performs a cryptographic primitive, but that you are actually using it to achieve some security goal, and in particular that you are using client-side JS rather than some server- side crypto for some security advantage. That is essentially the implied vague threat model.

So, yeah, it's true that there are uses for crypto primitives that aren't affected by that threat model, because they aren't about security at all. And others that are less affected for various reasons. But it's highly misleading to therefore claim that "most applications aren't affected by that threat model". I'd think that most applications actually are. Except for those built by people who do understand enough of cryptography to not need posts such as the one by matasano. That is to say: Yes, once you yourself can write such an FAQ, you might be able to make use of JS crypto. But at that point, that post won't keep you from doing it anyhow. If you can't, though, chances are you first need to understand every single point made in it.

<comment><USER23> > So, it isn't actually a bit more challenging then?

More challenging, yes. Riskier, no.

I don't like that Javascript doesn't have native support for big integers (like Python does), or that it stores numbers as floating points in a 52-bit mantissa, but I fail to see why this makes developing crypto code riskier.

> Also, it seems to me like you are at least forgetting timing and possibly > other side channels.

Well, I ain't. When you don't control the instructions being executed by the CPU you may have the risks of security-sensitive information leaks. This applies not only to Javascript, but also to all scripting languages. I could say that it also applies to Java, if the methods in its BigInteger class aren't fixed-timing.

In other words using Javascript doesn't make the problem any worse. If you disagree, you're invited to take a look at End-To-End, find a side-channel leak and write an exploit for it. You could earn serious cold cash with that finding.

> I just can't see any actual scenario where that helps, mostly because it > seems to me that the cipher text usually would be a plain-text equivalent, > so it doesn't really matter to the attacker whether they have the plain text > or the cipher text.

I described where it helps in my article.

Re your last point: if doing SSH in a browser isn't crypto I don't know what could be. Is the only thing you consider Javascript crypto encrypted webmail? That's your problem then. You know one wrong use case, and you refuse to admit that there are other legitimate ones.

Edit: remove a few unnecessary sentences.

Edit: some people don't like Javascript crypto so much that they downvote me without saying anything.

<comment><USER25> > If you disagree, you're invited to take a look at End-To-End, find a side- > channel leak and write an exploit for it. You could earn serious cold cash > with that finding.

For one thing, the IDEA implementation seems to be incorrect. In IDEA, multiplication is defined as multiplication modulo 2^16 + 1, where 0 means 2^16 [3]. However, looking at the multiplication function:

[https://code.google.com/p/end-to- end/source/browse/javascrip...](https://code.google.com/p/end-to- end/source/browse/javascript/crypto/e2e/cipher/idea.js#312)

When x == 0 but y != 0, the result of the modular multiplication is always 0, when it should not be. The correct code would be (in glorious C syntax, everything unsigned and 32-bit):

        if(x != 0) {
            if(y != 0) {
                return x*y % 65537; // result fits in 32 bits
            }
            else return 65537 - x; // or 1 - x mod 2^16
        } else return 65537 - y; // or 1 - y mod 2^16

Of course, even if correct this code is still vulnerable to timing attacks (under contrived conditions) [1]. This can be worked around using a little bitwise magic:

        t0  = 65537 - x;
        t1  = 65537 - y;
        t2  = x*y % 65537;
        b0  = -(1 ^ ((x | -x) >> 31)); // 0xfff..ff if x == 0
        b1  = -(1 ^ ((y | -y) >> 31)); // 0xfff..ff if y == 0
        return ((t0&~b0&b1) | (t1&b0&~b1) | (t2&~b0&~b1) | (1&b0&b1))&0xFFFF;

Additionally, the modular inversion seems to be needlessly complicated by using Euclid's algorithm (and I'm not sure it's correct either: it seems not to respect the "0 means 2^16" rule). Use the usual a^(p-2) mod p inversion trick, using an optimal addition chain [2], to make it simpler, constant-time, and possibly faster.

None of this is Javascript's fault, for what it's worth. But I certainly don't expect Javascript to make it any easier to write correct code, much by the contrary.

EDIT: Fixed constant-time code.

[1] [https://www.schneier.com/paper-side- channel2.pdf](https://www.schneier.com/paper-side-channel2.pdf)

[2] [http://wwwhomes.uni-bielefeld.de/cgi- bin/cgiwrap/achim/scrip...](http://wwwhomes.uni-bielefeld.de/cgi- bin/cgiwrap/achim/script_lookup_ac?para=FIXED)

[3] [http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass- inspec-19...](http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass- inspec-1991-2.pdf)

<comment><USER23> Thanks for the report. I'll take a look and get back to you. Where can I contact you?

Edit: I've just filed [https://code.google.com/p/end-to- end/issues/detail?id=82](https://code.google.com/p/end-to- end/issues/detail?id=82). We can discuss the problems of IDEA there. Thanks!

<comment><USER25> That link gives me a 403 error? In any case, I've put an email in my HN profile.

<comment><USER23> Oh yeah, it was restricted to my team. I'll make it public, and notify you via email. BTW IDEA is not enabled/registered.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> I really enjoyed reading this. Certainly put the browser security model in a new perspective for me.

</comment><comment><USER22> I think that the main reason that people keep wanting to do this is that web developers would like to work on this problem but don't have skills that are applicable immediately. It's going to require a great deal of learning on most of their parts that is at least as daunting as becoming a good front-end developer to use existing crypto libraries well...much less engineer new cryptosystems. That would be the difference between being able to code and being able to write a high quality optimizing compiler, for instance. With study and hard work you can use the fruits of the crypto community well...but you have to start by realizing where you are starting from. In browser javascript isn't just another programming language and runtime that's completely akin to c and the c runtime. The Matasano article does a great job of describing why.

</comment><comment><USER22> No such thing as a secure keystore? He needs to look harder. Aside from hardware which is tamper proof... which exists in smart cards and TPM chips... most operating systems use file system ACL's. Yes running as "root" means you can get the keys... you have to protect them...

<comment><USER22> Why did this get downvoted? No one even replied!

<comment><USER21> You are right, and the fact that people are just dismissing you out of hand is frightening. It shows a lack of even the interest to understand how off-base they are.</comment></comment></comment>


Generation wealth: how the modern world fell in love with money - <AUTHOR> https://www.theguardian.com/global/2018/jul/08/generation-wealth-how-the-modern-world-fell-in-love-with-money <comment><USER2> Another interesting documentary about this topic is "Born Rich" by Jamie Johnson, one of the heirs to the Johnson & Johnson fortune. He interviews several of his peers. The film was nominated for two Emmys. It's available on YouTube at [https://www.youtube.com/watch?v=km_JmxnzTvc](https://www.youtube.com/watch?v=km_JmxnzTvc).

</comment><comment><USER3> A documentary that investigates the _pathologies_ that have created the richest society the world has ever seen.</comment>


Amazon Redshift – Working with JSON Data - <AUTHOR> http://www.hackpundit.com/amazon-redshift-json-query-function/ <comment><AUTHOR> Are you using Redshift JSON functions?

Any Challenges that we can discuss here.</comment>


Russian Rocket Fails, and 2 Astronauts Make Safe Emergency Return - <AUTHOR> https://www.nytimes.com/2018/10/11/science/soyuz-rocket.html <comment><USER2> Sorry, this event occurred five days ago, and has been thoroughly discussed here.</comment>


Review my website: NagNation.com - <AUTHOR> http://nagnation.com

<comment><USER2> It seems like an easy way to make a few extra dollars. I'd like to try it, but my validation email hasn't come through yet.

Edit: Well, the email came through and I tried nagging someone (who I believe is the OP). It seems that there aren't many nag requests on the site, meaning there's a supply problem.

<comment><AUTHOR> Thanks for reviewing the site! Yes, that was me, we've only recently launched. We're hoping more people use it for nags so the supply will be greater. Did you get the actual email from the system or the manual override email?

Edit: By the way, you were the 1st person to use the site who was not a builder or tester. Congratulations!

</comment></comment><comment><USER3> Clicked the TryFree email after registering. 500 error. :/ Tried again a minute ago and it worked.

</comment><comment><USER4> haha amazing idea!

<comment><AUTHOR> Thanks! They work too, the nags I've tried and other testers have tried have been done.</comment></comment>


Microsoft combines Windows and Surface, making it tougher on PC makers - <AUTHOR> https://www.pcworld.com/article/3519552/report-microsoft-combines-windows-and-surface-businesses.html <comment><USER2> This recalls memories of the Nokia takeover. It got other vendors salty since basically Nokia could sell Windows phone for free, while others had to pay licensing fees. Granted, Windows phone was a newcomer facing an uphill battle against IOS and Android, while the PC market is well established and many businesses simply depend on Windows, but I wonder if this will still make for another little dent.

> Does Microsoft's reorg pose a dire threat to the greater PC industry? Of > course not. But it might have a demoralizing effect on PC makers, some of > which have to feel that Microsoft's moves make it tougher for everyone to > compete.</comment>


Year 1 of the Revolution: Complete Novice to Skilled Developer - <AUTHOR> http://chriszf.posthaven.com/year-1-of-the-revolution

<comment><USER2> "With the right person, the right curriculum, and the right instructors, it's possible to train a person in ten weeks to be competitive with a college graduate with a computer science degree, even for a position at a tier-1 engineering organization. Beyond that, it appears to be repeatable."

\-- Well said. Hackbright has repeated this process 3 times in the past year.

</comment><comment><USER3> I hear that U. of Phoenix also offers some great degrees at reasonable prices!

</comment><comment><USER4> To what extent do software companies typically train new hires?</comment>