Ritzy – A collaborative web-based rich text editor - <AUTHOR> https://github.com/ritzyed/ritzy <comment><USER2> I am the author a recently-launched similar product [1], which also tries to contain the impact of contentEditable by capturing user actions and applying them to the document model in its own code. The main difference is that my system does leave selection (mostly) to the browser, by enabling contentEditable and then capturing events that actually perform changes. Another project of mine [2] does take the approach taken by Ritzy, but for plain-text editing. I consciously didn't go that way this time. Here's why:

\- Accessibility. Screen readers don't know what you are doing if the browser doesn't know. They won't communicate your tag soup to the user as an editor interface.

\- Cursor motion and selection management hard. Consider right-to-left text and mixed bidirectional text. Getting this right is a big project on its own. You can get the basics working easily, but there's a long tail of hard behavior that you will at some point need.

\- Touch interfaces don't interface well with your fake selection. So you'll have to implement your own selection-management interface. Which might not even be possible for some things (like access to the built-in spell checker).

\- It isn't needed. Though it also requires some gymnastics, working with the browser's native selection on modern browsers isn't all that hard.

[1]: [http://prosemirror.net](http://prosemirror.net)

[2]: [http://codemirror.net](http://codemirror.net)

<comment><USER3> I wrote some collaborative editors and I fully agree on those points. In my opinion, contentEditable is a codebase way too big to replicate in JavaScript (unless you're Google).

</comment></comment><comment><USER4> Pretty interesting, although reimplementing every single standard text editor behavior can be difficult.

Missing standard text editor behavior that I know of:

\- right-clicking on selected text

\- dragging-and-dropping selected text

\- triple-click to select paragraph

\- OS X emacs keybindings: ctrl+n/p/f/b as arrow keys, ctrl+a/e to go to beginning/end of line, ctrl+k/y to cut/paste, etc

<comment><USER5> i hit the same things on mac, like ctrl-a/e. couldn't jump to the beginning and the end of the file either. i tried various shift key combinations until i finally inserted some special character which i couldn't delete. all this happened within ~20seconds of trying it. not sure what to conclude from it; im still in shock. somehow the language of announcement is not in line with the capabilities of the tool. it suggested something more mature.

</comment></comment><comment><USER6> I sympathize with anybody who attempts to write an editor that runs in a browser.

If you're going to even entertain the thought of writing an editor I recommend reading Piotrek Koszuliński's article on Medium [1]. There are many pitfalls when writing an editor and the sooner you know of them the better.

On the plus side a new spec for a more low-level version of contentEditable is currently being worked on.[2] It's a complicated undertaking but the task force is making progress. There is participation from all major browser vendors so we have reasons to be optimistic: we may make it out of the Dark Ages of web-based rich editing one day.

[1] [https://medium.com/content-uneditable/contenteditable-the- go...](https://medium.com/content-uneditable/contenteditable-the-good-the-bad- and-the-ugly-261a38555e9c)

[2] [https://medium.com/content-uneditable/fixing- contenteditable...](https://medium.com/content-uneditable/fixing- contenteditable-1a9a5073c35d)

</comment><comment><USER7> I've yet to see a good Wysiwyg table editor on the web, especially open source and embeddable. So if you can deliver on that at some point, that would be a big reason for me on why start using. I like minimalistic approaches, but so far the minimalistic approach is usually to just _forget_ about tables, which I don't find acceptable. Emacs Orgmode so far has the cleanest simple approach to this and I'd love to see that replicated.

</comment><comment><USER8> A nice contribution to the browser-based editor world. I enjoyed perusing the source, which looks pretty clear. There's not much UI, which is perfect for me because I've been looking for a browser-based editor to study.

Tried it on a 2,000 line text file and it caused Chrome 44 on Yosemite to time out close the tab.

<comment><USER9> Trivial CRDT implementations tend to be memory-heavy and to scale badly, especially after a long editing session. Decreasing the cost of tree traversal requires smart garbage collection, balancing and merging of nodes.

<comment><USER3> CRDT is heavy on metadata and thus requires some compression and garbage collection techniques. In this implementation, every letter is a JavaScript object. Performance was not an objective, I guess.

</comment></comment></comment><comment><USER10> Another interesting library built for collaborative editing is Prosemirror. It's also in its infancy stages.

[https://github.com/ProseMirror/prosemirror](https://github.com/ProseMirror/prosemirror)

It's by the guy who created CodeMirror and TernJS.

<comment><USER11> Which is seeking funding to go open source [https://www.indiegogo.com/projects/prosemirror/#/story](https://www.indiegogo.com/projects/prosemirror/#/story)

<comment><USER2> Here's a direct link to ProseMirror's collaborative editing demo [http://prosemirror.net/demo_collab.html#edit- Example](http://prosemirror.net/demo_collab.html#edit-Example) (which is up, and fast)

<comment><USER10> I'm definitely excited for ProseMirror. If it's as quality as CodeMirror I'll be happily integrating it into everything I build!

</comment></comment></comment></comment><comment><USER12> What is the file format? WebODF has all the mentioned features, includeing collaborative editing, and in addition it uses OpenDocument Format as the file format.

[http://www.webodf.org/demo/](http://www.webodf.org/demo/)

<comment><USER13> The primary data structure underneath is a "causal tree" CRDT. However, import/export to a JSON structure representing rich text is the "native" format. Example is the source used to create the text in demo instances of the editor:

[https://github.com/ritzyed/ritzy- demo/blob/master/src/create...](https://github.com/ritzyed/ritzy- demo/blob/master/src/createReplica.js)

</comment></comment><comment><USER14> Since it uses React internally, I wonder how large these documents can grow until the experience gets sluggish. I ask this because React basically requires all of the internal content to be "visited" upon a redraw. But regardless of React, it is still interesting to know the constraints in terms of performance.

Also, instead of just pointing to the code on github, I'd like to get at least a little insight into the architecture of the project, because that is the interesting part, in my opinion. There is a brief description in the readme on github, but it doesn't really paint a clear picture.

<comment><USER15> The techniques for addressing this are essentially the same for any display technology: Avoid rendering stuff that is not on the screen. This works just fine in React.

<comment><USER14> But if at every update (every keystroke of the user), the algorithm needs to go through millions of lines of text to determine which ones to show, it is going to be slow, even if eventually only e.g. 50 lines are shown.

<comment><USER15> You can say the same thing about any text editor built with any technology. This problem is fundamental and the tools to solve it are foundational. It's also no different than a game that doesn't render objects behind the player or obscured by walls. You need to choose data structures that enable efficient visibility queries.

For a game, there's some sophisticated math involved. But for a text editor? You only need to perform basic arithmetic on the scroll position and window height to index in to a vector of lines.

In React, you could render exactly 50 <Line> components and choose which 50 by exactly the same means vim chooses which 50 ncurses lines to show.

</comment></comment></comment></comment><comment><USER16> This is an interesting project, and I totally understand the desire to eschew the use of contentEditable. But, from what I've seen, handling bidi text and accessibility essentially require using contentEditable as the input mechanism, even if you manage the document yourself.

Does this handle RTL text input and accessibility issues?

<comment><USER13> It does not. See the comments from Marijn above. I don't know anything about RTL/bidi and accessibility, so I'm not sure if these are intractable problems for Ritzy or not.

</comment></comment><comment><USER17> It would be nicer if this wasn't tied in to a server implementation, so it could be a standard react component that specifies a couple of handlers as PropTypes. Would make it much more easier for people to reuse it!

</comment><comment><USER18> Here's a demo instance:

[http://demo-ritzy.rhcloud.com/editor/NyYKfTMh](http://demo- ritzy.rhcloud.com/editor/NyYKfTMh)

</comment><comment><USER19> The demo is down, but it doesn't even have bullets?

If you're looking for a good collaborative rich text editor on the web, look up Quill or ProseMirror.

<comment><USER13> Quill is good but not great. I looked at Quill extensively before embarking on writing Ritzy. Its collaboration features are minimal -- as far as I know there is no way to do collaboration across two browsers i.e. there is no working and/or available server-side component to coordinate the OT deltas produced by Quill (both editors have to be on the same page, which is somewhat pointless). I believe the authors were moving towards doing this via compatibility with ShareJS, but never quite got there. Offline support will be a pain to add with OT.

ProseMirror looks cool. I wish @Marijn the best with it! Not sure about ProseMirror's offline capabilities. I hope he adds multiple cursors and selections like Google Docs (and Ritzy).

</comment></comment><comment><USER20> Awesome project, but I misread the title and expected this to be a collaborative real-time editor built _for_ React...

</comment><comment><USER21> Looks very promising. Been looking for Google Doc alternative for sometime now.

I realize that there is a commercial service aspect that is being worked on to provide server side hosting, however, how easy would it be to self host this on sandstorm.io?

<comment><USER13> Pretty easy! Check out the demo source code: [https://github.com/ritzyed/ritzy-demo](https://github.com/ritzyed/ritzy-demo)

</comment></comment><comment><USER22> Very well done.

On mac you use cmd-C, cmd-V instead of control-C, control-V.

There is a bug that causes new line to function incorrectly when the cursor is on the first line of the document. New line on other lines work fine. (Safari on Mac)

<comment><USER13> Yup, I noticed that bug! It's fixed now ([https://github.com/ritzyed/ritzy/commit/c42769d27730a11fe0d4...](https://github.com/ritzyed/ritzy/commit/c42769d27730a11fe0d44122d343479cf7c54d55)) (demo is not updated yet). It should be easy to add the Mac key bindings -- I need to find a Mac to test on.

</comment></comment><comment><USER23> You guys should publish a content-editable abstraction that fixes regular cases first and then build stuff like collaborative editor on top.

</comment><comment><USER24> This looks interesting, sadly I'm getting an internal server error from the demo.

</comment><comment><USER25> On iPhone I can't get focus to edit the demo. That is slightly concerning.

</comment><comment><USER26> Demo is crashing :(

</comment><comment><USER13> Author here. Thanks for posting this. I had posted it earlier as a ShowHN ([https://news.ycombinator.com/item?id=10087162](https://news.ycombinator.com/item?id=10087162)), but without much notice, so I'm ecstatic to see lots of comments here. Great feedback.

Some responses to the various comments:

1) This is a _very_ early release. I'm aware of all the missing functionality, and the README is pretty clear about all the missing stuff, including undo/redo, bullets, numbered lists, tables, and more. I don't have access to a Mac, so I wouldn't expect any of the Mac keybindings to work. That should be pretty easy to solve though.

2) Piotrek Koszuliński's article was really eye opening. Being completely new to the field of editors, and even new to Javascript (this is my first major Javascript project -- my background is mostly enterprise Java and some Scala), I defer to experts in this field like Piotrek and Marijn, the author of Codemirror and Prosemirror. I'm honored that Marijn even took the time to comment :-) It's possible that Ritzy could still serve as a useful tool within some narrower contexts that do not require handling the long tail of hard behavior mentioned (accessibility and RTL/bidi). OR, with the appropriate expertise, that some of that functionality could be added. Re. touch interfaces, fair point -- my thought was that could be worked around (e.g. by an alternate native component on touch interfaces that talked the same CRDT language -- I believe that's the approach that Google Docs took with editing Docs on mobile). Currently on mobile, basic cursor navigation by text, keyboard / text input, and viewing others' changes in real-time appears to work pretty well (better than I expected actually!). Selections don't work at all.

@marijn: how difficult would it be to add multiple cursors and selections to Prosemirror? I notice that currently the Prosemirror collaboration demo does not show cursors or selections, which is pretty key to a great user experience.

3) @gritzo (the author of Swarm.js, a key library used in Ritzy) mentions that the implementation uses a JS object for each char. That is true and it's very heavy. My initial goal was correctness and as a POC, with something easy to understand and debug. Optimization can come later, if indeed there is interest in taking this general approach further.

4) Recent changes to Ritzy (not yet pushed to the demo page) make each cursor, line, and selection a separate React component within a hierarchy. This makes navigation, rendering and selections pretty quick. However, the editor has never been tested against documents larger than a few hundred lines. My gut feeling is that the limiting factor right now is not React, but the "fat" CRDT data structure I used. It gets particularly bad when a lot of characters are deleted. There is no tombstone clearing logic yet.

5) It should be pretty easy to strip out the server-side stuff and make it client-side only. You lose the "killer feature" of Docs-style collaborative editing though. The server-side is pretty simple to self-host -- check out the demo source code @ [https://github.com/ritzyed/ritzy- demo](https://github.com/ritzyed/ritzy-demo) for an example.

I'll try to get the demo back up and running. Its hosted on the smallest (free) tier of Openshift and I've done zero server-side optimization. I'm sure it didn't take much traffic to kill it. Any other suggestions for (free) hosting for NodeJS projects?

I'll also try to write up a design doc over the next few days for those who requested that / are more interested in those aspects.

Thanks again for all the comments / feedback!

<comment><USER2> > how difficult would it be to add multiple cursors and selections to > Prosemirror? I notice that currently the Prosemirror collaboration demo does > not show cursors or selections, which is pretty key to a great user > experience.

If you mean Sublime Text-style multiple cursors, that'd be very hard. CodeMirror's contentEdtiable-base mobile backend does support them, but that's only possible because it already contains a full implementation of cursor/selection for the non-mobile version.

If, on the other hand, you mean showing the cursors from other people working on a collaborative document, that isn't very hard, it just involves inserting widgets and marked ranges at the right places.

<comment><USER13> > If, on the other hand, you mean showing the cursors from other people > working on a collaborative document

This is what I meant. Good that its not very hard. Though I'm curious: how do you know what the "right place" actually is i.e. don't the coordinates of the cursor position depend on the rendering of the text which is under the browser's control?

What about showing multiple selections from other authors like Google Docs (and Ritzy) does?

<comment><USER2> > don't the coordinates of the cursor position depend on the rendering of the > text which is under the browser's control?

Yes, but you can ask the browser (using `getBoundingClientRect` and `getClientRects`, which also exist for text range object on all halfway modern browsers.) Or you can insert the caret element inline at the correct place.

What would be hard about showing a selection from another person?

<comment><USER13> Not "hard" as such. Just requires a completely separate code path than the local cursor and selection machinery. That isn't too much of a barrier though... I look forward to its implementation in Prosemirror!</comment></comment></comment></comment></comment>


Spies Like Us: How We All Helped Build Prism - <AUTHOR> http://www.businessweek.com/articles/2013-06-12/spies-like-us-how-we-all-helped-build-prism

<comment><USER2> Seems like this article plays a bit loose with the facts. Apache Hadoop and MapReduce are based on Google white papers, but Google didn't actually develop either. And is it that Google couldn't afford Oracle software, or they knew they could build something better?

However, the main thrust is valid: the same data that is valuable to Facebook and Google (and their advertisers) is valuable to the NSA.

</comment><comment><USER3> One of the core principles of free software (as in the free software foundation) is no restrictions on the use or distribution of that software. This also means that if you release a piece of software under a license that prevents, say, arms manufacturers, dictatorships, or the NSA from using it, it is not really a free software licence.

<comment><USER4> If we are dealing with an organization that routinely lies to congress, how much respect do you think they give the restrictions you place in some text at the start of your source code?

<comment><USER5> Herge is saying that the free (libre) nature of free software means that these organizations must also be free to use it.

</comment></comment></comment><comment><USER6> Yep indeed the likes of Google/Facebook/Yahoo open source technologies have made it much easier for the government to create the tools needed to sift through terabytes of data, yet even if Hadoop/Map Reduce etc... were closed source I'm sure the big G would have come up with their own solution.</comment>


.NET 5.0 Preview 1 - <AUTHOR> https://devblogs.microsoft.com/dotnet/announcing-net-5-0-preview-1/ <comment><USER2> Good news. Is there any plan to improve F# tooling on these goals?

<comment><USER3> Just so we're clear, F# tooling is pretty great compared to most other languages, but it's clearly not to a level of C# or Java.

With that being said, what improvements are you looking for? The people who work on tooling will likely read your comments.</comment></comment>


Boot Docker in 10 seconds on any VM or physical machine with this 30 MB ISO - <AUTHOR> https://github.com/steeve/boot2docker

<comment><AUTHOR> Just do:

        wget https://github.com/steeve/boot2docker/releases/download/v0.1/boot2docker.iso
        qemu-system-x86_64 -cdrom boot2docker.iso -m 1024

Mind. Blown.

<comment><USER3> However, remember that qemu-system does _not_ virtualize, so it will likely be slower than a virtualized environment (vbox...).

qemu-kvm does virtualize, but only on Linux.

<comment><AUTHOR> Indeed; for the lucky ones around here with a bare metal Linux box, just substitute kvm instead and ROCK ON!

<comment><USER4> On ubuntu it says 'W: kvm binary is deprecated, please use qemu-system-x86_64 instead'

</comment></comment></comment></comment><comment><USER5> so I can't seem to find a roadmap for docker - a blog post from august said they were trying to be "production ready" by the end of october. Does anyone know when it is supposed to hit 1.0 / production ready?

<comment><USER6> Hi there, you can find a high-level roadmap here: [https://github.com/dotcloud/docker/blob/master/hack/ROADMAP....](https://github.com/dotcloud/docker/blob/master/hack/ROADMAP.md)

We ship on average one major release per month, and one minir release per week. Each major release comes with a detailed blog post explaining significant improvements and what we're planning next.

For example here's the 0.7 announcement: [http://blog.docker.io/2013/11/docker-0-7-docker-now-runs- on-...](http://blog.docker.io/2013/11/docker-0-7-docker-now-runs-on-any-linux- distribution/)

0.6 announcement: [http://blog.docker.io/2013/08/websockets-dockerfile- upgrade-...](http://blog.docker.io/2013/08/websockets-dockerfile-upgrade- better-registry-support-expert-mode-and-more/)

It's true that the dates projected in that blog post have slipped - <USER2> because the amount of usage, contributions and integrations we had to deal with is 10x what we expected - docker is a VERY active project! And we're still adjusting to that.

Another thing that happened since that blog post is our partnership with Red Hat (and several other major partnerships we're not yet allowed to disclose) which gave us the opportunity to make docker available on many more machines. For example 0.7 was shipped in collaboration with Res Hat for support of unmodified linux kernels: that collaboration meant more external patches to review and digest, and a delayed release, but now docker runs on all linux distros! So I think it was worth it :)

I will be updating that roadmap document soon, and perhaps we can write another blog post when that happens.

I'm always happy to answercquestions on irc (#docker on freenode) or on the mailing list!</comment></comment>


Come join our new IRC network - <AUTHOR>

ᕕ( ᐛ )ᕗ MUTiL8 ᕕ( ᐛ )ᕗ -
Hacking/Programming/Exploit dev - http://red-dragon-security.com/Community - IRC: 22.214.171.124 - SSL port 6697 or default 6667 - #MUTiL8 <comment><USER2> Hi! This is an Etoot. An avid user of hacker news media.</comment>


In Europe, a right to be forgotten - <AUTHOR> http://www.theatlantic.com/technology/archive/2011/02/in-europe-a-right-to-be-forgotten-trumps-the-memory-of-the-internet/70643/

<comment><AUTHOR> This was actually posted yesterday by someone else, but under the headline 'why several countries want to allow people to censor personal data on the web.' I thought this was a very misleading characterization of the article, which sank quickly without comment, even though it contains much that is of interest to HN.</comment>


Ask HN: What are books/biographies narrating the early days of businesses? - <AUTHOR> <comment><USER2> "Fire In The Valley (The making of the personal computer)" by Freiberger & Swaine (McGraw-Hill) is an excellent book telling many stories about individual companies in the early days of Micro computers.

A television film "Pirates of Silicon Valley" was based on parts of the book. [https://en.wikipedia.org/wiki/Pirates_of_Silicon_Valley](https://en.wikipedia.org/wiki/Pirates_of_Silicon_Valley)</comment>


Pagd - a highly pluggable static site generator - <AUTHOR> https://github.com/prataprc/pagd

<comment><USER2> What would be the benefits of this over something like Jekyll or Octopress?

<comment><AUTHOR> pagd has got lot of additional features and it is very much extensible. [http://pythonhosted.org/pagd](http://pythonhosted.org/pagd)

<comment><USER3> Is it really more extensible? Jekyll has the means to execute arbitrary code as well, which means it can do basically anything Ruby can do. I assume that's the same with pagd, but with python code... But that doesn't make it more extensible.

<comment><AUTHOR> its not about language's capability. Its about using extensions/plugins to support multiple formats and things in the templating language.</comment></comment></comment></comment>


Flatpak – A Security Nightmare (2018) - <AUTHOR> http://flatkill.org/ <comment><USER2> > A high severity CVE-2017-9780 (CVSS Score 7.2) has indeed been assigned to > this vulnerability. Flatpak developers consider this a minor security issue.

The actual wording in the linked release is "This is a minor security update, matching the behaviour on master where we avoid ever creating setuid files or world-writable directories." The wording is perhaps a little ambiguous, but my interpretation of that is, "this is a minor update that fixes a security issue," not "this is an update that fixes a minor security issue." The author also implies that simply including a setuid binary would allow the app itself to get elevated privileges. This seems at odds with the way flatpak uses containers to sandbox the app, and in fact when I looked at the linked CVE, the actual vulnerability is that a _seperate attack_ could use a setuid binary installed as part of a flatpak to get privilege escalation. Don't get me wrong, it's still a sever vulnerability. But it is much more difficult to exploit than the author first led me to believe.

<comment><USER3> Add to that the first paragraph, which is literally a complaint that flatpack does not make things better compared to rpm.

Indeed the one about security updates is valid and my biggest grievance with such an approach. Note, however, that propietary software like sublime could easily use statically linked or embedded libraries anyways, as they do not have to adhere to any packaging guidelines. So this applies only to free software that has been packaged with the distro.

<comment><USER4> > Indeed the one about security updates is valid and my biggest grievance with > such an approach.

And that stems from misunderstanding.

Flatpak has a concept of runtimes. If you have some basic library that would be updated by your distribution, you have pretty much big chance that it would be part of the runtime and updated by runtime maintainers, not by the application authors.

I.e. you would get your security updates, subject to the maintenance period of the runtime (for example, the org.freedesktop.Platform has 2-year support).

<comment><USER5> _If you have some basic library that would be updated by your distribution, you have pretty much big chance that it would be part of the runtime and updated by runtime maintainers, not by the application authors._

Unfortunately, this is not true. Many of the Flathub Flatpaks compile custom versions of a lot widely-used libraries. E.g., the most recently updated Flathub package of an open source project (as of writing), compiles by itself [1]:

Boost 1.73, Eigen 3.3.7, OpenCV 4.3.0, exiv2 0.27.2, marble 20.04.1, lensfun 0.3.2, ImageMagick 7.0.10-13, libgphoto2 2.5.25, libusb 1.0.23, jasper 2.0.16, libksane 20.04.1, sane-backends 1.0.27, libqlr master, qtav 1.13.0, x265 3.3

Most of these are standard dependencies that are in most Linux distributions.

[1] [https://github.com/flathub/org.kde.digikam/blob/2d0b5b369382...](https://github.com/flathub/org.kde.digikam/blob/2d0b5b369382afa08074bc72b34774c022fe15ef/org.kde.digikam.json)

<comment><USER4> Widely used does not mean, that they are good candidate for a platform library. Many of them do not have stable API, so you either keep everything on an ancient version (hopefully compilable against), or stuff breaks.

E.g. Boost. Fedora 32, which was released this April, but has version 1.69 (released in Dec 2018), while the current one is 1.73. Similarly, ImageMagick is updated every few days. In these cases, it is better to let the applications decide which versions they want, and keep up with updates.

</comment></comment></comment></comment></comment><comment><USER6> Unless this has been updated since 2018 (it doesn't have a date but also looks like it still from 2018) it should be marked [2018].

Also: Here is previous discussion from around the time this website was created: [https://news.ycombinator.com/item?id=18180017](https://news.ycombinator.com/item?id=18180017)

<comment><USER7> > Unless this has been updated since 2018

I think this might also apply to Flatpak.

Has Flatpak addressed any of these concerns? If so, how?

<comment><USER8> That's not how this works. Old content is marked with its year, irrespective of its relevance.

</comment></comment></comment><comment><USER9> This page is really old, but I disagree with "the users are misled to believe the apps run sandboxed".

I think most people use flatpak (and/or snap, appimage, etc.) as a way of installing applications in a way that does not contaminate the host OS, and a way of removing them again without leaving any traces behind.

For example, it's an extremely convenient way of installing Steam without having to worry about its obscure, 32-bit, dependencies.

That they are sandboxed, or not, is very much secondary, for most users, I believe.

<comment><USER10> What I know about flatpak was from some Linux you tubers who led me to believe it was a sandbox. For that matter, some hn users posted similar things in the last month when talking about snaps iirc

<comment><USER4> Flatpak has a sandbox; but for some apps, it has to be a more open, otherwise they would not work as intended. All that's open is visible as a flatpak permission; if you want, you can tighten it up and see, what breaks.

On the other side spectrum are people, that are disappointed, that they cannot use SDKs installed at random places in their host system with editors packaged with Flatpak. Well, duh...

</comment></comment></comment><comment><USER11> A great talk on Flatpak sandboxing was released in March. [1]. The original post is from 2018 (Flatpak 1.0). Not sure if these issues are completely fixed yet, there are a lot of release notes up to version 1.63 (stable). [2] It seems that the maintainers and community are working on improving security continuously. My main hope is that they optimize for privacy, security and user control of the packages. Overall I'm impressed by flatpak with it's cross-distribution packaging.

[1] [https://www.youtube.com/watch?v=3rCIEzfZw1I](https://www.youtube.com/watch?v=3rCIEzfZw1I)

[2] [https://github.com/flatpak/flatpak/releases](https://github.com/flatpak/flatpak/releases)

<comment><USER12> Did you see it live? Not a great experience on Youtube, audio problems unfortunately.

<comment><USER11> I found it through search on Youtube, had been looking for which way to package applications on Linux. Packaging really takes a bit of time, reading documentation and figuring out how to do it. After packaging a flatpak you need to add it to a local repository on your device before you can test install it, which isn't as intuitive as clicking on a .appimage file, but brings some benefits. The documentation is quite readable: [https://docs.flatpak.org/en/latest/first- build.html](https://docs.flatpak.org/en/latest/first-build.html).

Agreed for audio quality. It's hard to listen to with only the left channel working. It might be worth reuploading it with balanced stereo.

</comment></comment></comment><comment><USER13> Am I the only person who actually doesn't really mind that flatpaks and snaps have less user-control over behavior and/or security implications?

I really enjoy them. Install it, forget about it, let it update automatically.

Theoretically could something unwanted happen, yeah probably, but I enjoy the convenience they provide and typically you're installing fairly well-known software (Microk8s, VS Code, and Chromium come to mind).

My one gripe with snaps is that AppArmor can occasionally cause headaches with Microk8s permissions.

<comment><USER14> If you don't care about user control, why would you be using Linux at all? When you hit a bug in a flatpak or snap, what are you going to do? E.g. on Linux you now just can't input Japanese text in Slack and there's no way to fix this.

<comment><USER15> Could you elaborate on the Slack-Linux-Japanese thing please?

I have no problems with it, and was wondering if maybe an update broke it?

<comment><USER14> See e.g. [https://forum.snapcraft.io/t/cant-use-input-method-in- snap-a...](https://forum.snapcraft.io/t/cant-use-input-method-in-snap- apps/4712/50) . Certainly it was broken for years, and if it's been fixed then that's only very recently.

</comment></comment></comment></comment><comment><USER16> I still love flatpak, and much of what this article states is hostile and outdated. The "XDG portal" specification makes filesystem access less popular then before. Also, "fakepak"? Really?

</comment><comment><USER17> I don't understand why people favor Snap or Flatpak to Appimage, which looks to be the simplest of the three. Would anyone mind sharing their experiences?

<comment><USER18> My experience is that AppImage solves problems of Flatpak and Snap, but doesn't introduce any problems from these two.

I don't see why AppImage wouldn't be able to be updated if support for this would be added to the app itself.

When trying to download software that doesn't exist in my distro's repo, I always look for AppImage first.

<comment><USER19> Because AppImage doesn't solve the problems.

\- No sandboxing

\- Doesn't solve the "run everywhere" problem, AppImages usually are compiled agaisnt Ubuntu LTS's, which isn't 100% binary compatible with other distros, e.g. fedora

\- Its a game of bingo whether the AppImage has a library bundled or not, and whether the app will work your host version or not.

\- Performance, appimages are a compressed filesystem that getss mounted by fuse each time the app is run, which is slow, additionally subsequent launches of the app aren't even faster because we get fresh inodes each launch.

\- Bad system intergration, appimaged is an abomination.

\- AppImages promote a bad security practice of marking binaries from the web as executable, let's not replicate the main way malware is distributed on Windows.

</comment></comment></comment><comment><USER20> As opposed to what? To how I run GIMP in the past? Certainly not.

> Look ma, I've discovered a program can do nefarious things

What else is new?

<comment><USER21> I mean, there's an argument that this is worse. If a security bug is found in libc, in the "old world," your distro would have an update out in a day, and you'd be completely safe. With flatpak, you also depend on whoever's maintaining the GIMP flatpak (and all your other apps), who may not be motivated to do updates any faster than GIMP's normal release schedule, potentially leaving you vulnerable for much longer.

<comment><USER22> > your distro would have an update out in a day, and you'd be completely safe

If you do not restart your services after updating the package, your services continue to run against the exact libs they were started with, even though the library is updated on disk and anything new that starts will use the fixed version. For something like the libc, that is pretty much every service bringing it in and still running the unpatched version of the library.

Updating distro packages is of course usually a good thing, but alone it does not make you "completely safe".

Also they have a patched version "in a day" because they embargoed public release of the vuln details usually for months, creating a gap where a (growing...) set of people know a secret that can compromise your system and you don't. When I get that update I don't feel "completely safe".

</comment></comment></comment><comment><USER23> So Flatpaks also install under /var? That's horrible, I thought it was only Snaps that made that decision :( Does anyone know what the official reasoning for this is?

<comment><USER16> Flatpaks use a git-like tree of hashes, which cant just be shoved into random places on your filesystem. It has an exports directory you can symlink or add to your path.

<comment><USER24> In that case it should be in /opt, where application bundles not managed by the system's primary packaging system belong.

<comment><USER25> This isn't technically correct when Flatpak is installed via your distribution. Then it _is_ managed by your packaging system and it's data should live in a /var/lib.

/opt is for software that doesn't adhere to the FHS and can't/shouldn't be installed in a prefix. Red Hat and Arch install software to /opt via their official package managers. /opt isn't safe to stick arbitrary software even though it's commonly used for that — /opt/local is the non-FHS equivalent of /usr/local.

</comment></comment></comment></comment><comment><USER26> Independent of the technical issues being discussed I find this site to be an interesting example of the politics around open source development. It is run anonymously (out of albania, presumably to avoid whois lookups) and does not link to responses or opposing points of view. In addition it is posted regularly on various technology sites such as reddit, HN, etc.

</comment><comment><USER27> Flatpak mixes together application packaging, sandboxing, desktop integration, and an update mechanism. I do not understand the need to have all four in the same tool. I even think it limits the usefulness of each component.

Would a combination AppImage, firejail, and a couple of shell scripts be worse?

<comment> dylan-m Much worse. I encourage you to try some properly sandboxed Flatpak apps. Here's a fun one:

[https://flathub.org/apps/details/com.github.maoschanz.drawin...](https://flathub.org/apps/details/com.github.maoschanz.drawing)

Note that the app has no access to your home directory by default, and this fact is invisible to the end user. The file open and save dialog is handled out of process by a portal, which is a service that allows an application to (with permission) poke holes in its sandbox. By tying a few different things together, this is seamless: the user gets a file chooser dialog and chooses a file, as usual. (As a bonus, it's always a native dialog). Behind the scenes, the application is granted access to read or write to that file.

I don't think this would be easy to manage if Flatpak was split into a bunch of different moving parts, and I can't imagine it providing any meaningful benefit.

With that said, it isn't as monolithic as folks seem to think. It's built on bubblewrap and ostree and a whole bunch of freedesktop specifications.

</comment></comment><comment><USER28> > The criticial vulnerability "shell in the ghost" was fixed in flatpak about > one month after linux distributions.

I can't find any reference to that vulnerability except this page.

<comment><USER29> The name isn't an exact match but maybe it's this glibc vulnerability:

[https://blog.qualys.com/laws-of- vulnerabilities/2015/01/27/t...](https://blog.qualys.com/laws-of- vulnerabilities/2015/01/27/the-ghost-vulnerability)

Edit: nope, this is Ghost in the Shell, from last February

[https://www.microsoft.com/security/blog/2020/02/04/ghost- in-...](https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell- investigating-web-shell-attacks/)

<comment><USER28> I don't think either one is right.

That first one is from Jan 2015, but according to Wikipedia the first release of Flatpack was Sept 2015. The second one doesn't even seem to be a vulnerability, but rather the general concept of web shells. One of the vulnerabilities mentioned in the article (CVE-2019-0604) is for Microsoft SharePoint, so that's unrelated to Flatpack. Also note the difference in order of the words "ghost" and "shell".

</comment></comment></comment><comment><USER30> Packaging your software in Flatpak/snaps/appimage:

Pros:

You have 100% control of your dependencies.

Cons:

You have 100% responsibility for your dependencies.

In short: more control implies more responsibility.

</comment><comment><USER31> The moment you delegate your security or stability concerns to a third party, all bets are off. Period. Package maintainers, RedHat, whoever.

Maybe the patch fixes a vulnerability, maybe it creates one. Maybe the company pushing security is really pushing mindshares of ecosystems for subscription revenue and industry influence.

Build from source; keep your packages as minimal as possible; keep your permissions as granular and restricted as you can manage; and pray to your gods of choice.

I can't understand why people are so anxious to embrace so much unneeded complexity. Things that "just work" always just work until they just don't.

<comment><USER32> I'm pretty sure "build from source" is out of reach for most people (from a technical ability standpoint), and for those who could do that, most have better things to do with their time.

If your threat model includes intentionally malicious packages from Red Hat, Debian, or whomever, ok, but understand that you're a miniscule fraction of a percent of the user base. And you'd better be auditing the source that you compile as well.

<comment><USER33> The words "threat model" gets thrown around, but I'm not actually sure "our threat model didn't include our OS vendor" would be considered an acceptable excuse.

Sure, we have reasons to trust Redhat;

\- You can look at their working practices ( Good coding hygiene, Peer Review, Tools, etc )

\- You can make the commercial argument ( they make money by doing the right thing, it's not in their interest to hack us )

But ultimately we're still explicitly trusting 1000s of people here, so reality is much more nuanced.

\- Hardern your OS, i.e. only install the bare essentials.

\- Monitoring for processes or networking traffic doing unexpected things.

Thus, you evidence that you reasonably trust the vendor but you'd expect to see an alert were to prove false.

Probably a better use of "threat model" would be, we don't need to place trust in developer end user devices because we instead place our trust in our SCM, CI/CD and the SDLC process.

<comment><USER32> > _The words "threat model" gets thrown around, but I'm not actually sure "our > threat model didn't include our OS vendor" would be considered an acceptable > excuse._

I can't recall any threat-modeling session I've been a part of, or any infosec security professional I've talked to, who has seriously considered the OS vendor as a threat. "Our threat model didn't include the OS vendor" absolutely _is_ an acceptable excuse.

Your mitigations (only install bare essentials, network monitoring) are good advice in general, and people should be doing those things regardless of any perceived threat from the OS vendor.

Aside from that, really the only way you can absolutely harden yourself assuming a hostile OS vendor is to... not use an OS, and build your entire system from scratch. Which, again, sure, might be a perfectly reasonable thing to do for some ultra-sensitive applications, but -- again -- that is a teeny tiny fraction of a percent of what's actually happening out in the world.

<comment><USER33> First point, depends on what you work on I guess. Most of the world doesn't patch, but that doesn't mean managing your dependencies isn't important.

On the last point, doing it all yourself probably isn't actually better. Most people don't have the time in the day to invent the universe, so you're always back to figuring out how you establish trust.

</comment></comment></comment></comment></comment><comment><USER10> > Yes, it's possible your linux box has been compromised if you use flatpak, > we are literally talking about several months old public exploits. Ever > opened an image in flatpak Gimp? The criticial vulnerability "shell in the > ghost" was fixed in flatpak about one month after linux distributions.

There were some heavily up voted comments and posts on hn this year about how much people hate how snaps auto update themselves. Does this change anyone's mind, or do those points still stand?

<comment><USER34> Those points are completely unrelated to flatpak taking a long time to release patches. Whether flatpak forced updates or not, from TFA it seems as though it's still months behind Linux distros.

</comment></comment><comment><USER35> This article is written in bad faith.

RE: The sandbox is a lie. No it's not. The technical capabilities are there.

The problem is that the application needs to be written a certain way in order for the sandbox to be enforced and the app not to break. This is a not a technical problem but a political and resource one. Meaning how do you incentivize developers to re-write their apps so that they are compatible with that. Given that there are very few money to be made in linux applications I can see why developers are not rushing to re-write. Hence flatpak's allow for an escape hatch on the sandbox so existing apps continue to work. Even Google, with all of it's influnce on the android ecosystem, and all the money involved in it had to back off on scoped storage last year because of the developer outcry. Flatpak is moving towards the right direction. But because of lack of resources it 'll take more time to get there.

RE: You are NOT getting security updates

Again the author mixes technical capability with the limitations of a volunteer driven ecosystem to arrive to a bad conclusion. In 99% of cases flatpaks are provided by third party volunteers. They have no obligation to stop their life in order to test and provide timely updates. This is also true for normal deb/rpm packages by the way. Maintainers of complex packages such as calibre are unsung heroes. However flatpak's architecture allows for software vendors to host their own repositories and it's easy for the user's to subscribe to them. Hence if a software vendor wants to provide timely updates to their users the capability is there and waiting.

RE: Local root exploit? Minor issue!

Hello Nitpicking. thayne did a better job than I could do in their post ([https://news.ycombinator.com/item?id=23523887](https://news.ycombinator.com/item?id=23523887)). At the end of the day an update was provided for the users addressing this. As a user I don't care about how the update was sold. I saw an update available and I updated my system.

TLDR: Flatpak technical capabilites are fine (or working towards the right direction). The ecosystem does not have the resources to emberace those capabilities fast enough and that's been used to diminish the technical work been done.

<comment><USER36> This is a tool. How good it is, is measured by how useful it is to me. If it does not provide something I need it to do, then it's less good for it. If it fails to provide the services it advertised as providing, then it's straight- up bad. I don't care _why_ this happens. Might be technical, might be political, might be resource based. Doesn't matter. The tool either does what I need it to or doesn't. And flatpak does not provide sandboxing or security updates, and that it doesn't do this is independent of whether it's a technical or non-technical problem.

<comment><USER35> It's one thing to criticise flatpaks on the grounds of not getting the job done because nobody uses it properly and another to say there's no sandbox.

</comment></comment></comment><comment><USER37> I will use appimage. I refuse to use flatpak or snaps. That's my take as a linux user and admin.</comment>


Ask HN: Who do you follow on Twitter? - <AUTHOR>

I finally created a Twitter account instead of just browsing, and it seems like it could be a great personal news feed if I follow the right people. HN seems like the right place to ask: are there any Twitter accounts (tech-related or otherwise) you find especially insightful or informative? Who do you follow on Twitter? <comment><USER2> Personally, I follow way too many people to get any actual enjoyment out of Twitter. I would really like to slim down, but it would take a considerable amount of time to do so.

But if you're interested in web development and design, check out [http://uptodate.frontendrescue.org/](http://uptodate.frontendrescue.org/) for some good pointers on who to follow.

</comment><comment><USER3> I try to stick to around 200 people (anymore and I have a hard time keeping up). While a big chunk of who I follow is coworkers or people related to my work, theres also people/accounts like:

@pycoders @jessenoller for python related stuff, and @zeeg for python and startup insights (he's behind getsentry.com)

@nntaleb @neiltyson for my daily dose of awesome science/math/logic.

@wilw @pvbrett @deadmau5 for some celebrity/author/music nerd fixes. @deadmau5 is worth following alone for the pictures of his awesome studio setup.

A pretty good tactic i've found is to find someone who's interest's align with your own and see who they are following.

</comment><comment><USER4> I'm in a similar boat- I just started using my Twitter account after creating it years ago & never following anyone.

So far I follow 4 people: Barack Obama, who tends to say the same thing over & over. Kim Dotcom, who talks about privacy issues & retweets interesting stuff on that. My email provider who almost never tweets. And a guy from my local hackerspace who barely ever tweets, too.

At one point I followed @TheWhiteHouse, but it was just BS, so I stopped.

I'll be interested in seeing where this thread goes, since I'm also interested in finding interesting people to follow- thanks for asking.

</comment><comment><USER5> [https://twitter.com/zalew/tech-python](https://twitter.com/zalew/tech-python)

[https://twitter.com/zalew/tech-javascript](https://twitter.com/zalew/tech- javascript)

[https://twitter.com/zalew/tech-clojure](https://twitter.com/zalew/tech- clojure)

[https://twitter.com/zalew/podcasts](https://twitter.com/zalew/podcasts)

</comment><comment><USER6> I follow around 900 people, most of whom are reporters/bloggers/actors/actresses/attractive ladys/friends.

Depending what you're interested in, some favourites of mine are: @SciencePorn, @GaryVee, @TheStalwart, @AntonKreil, @GSElevator, @DavidBrent, @Cmdr_Hadfield, @FootyGif, @Digg, @GaryLineker

I always say how Twitter gets much better after following more people.

</comment><comment><USER7> I don't Tweeter myself, but I do subscribe (via the now removed, but still functional RSS feeds) to a few accounts, all of which are status updates. That's the one useful thing about Twitter for me - providing status updates to customers via a third-party site, so they can be accessed even when your domain is gone or your datacenter flooded.

</comment><comment><USER8> I follow the always-relevant and useful @PicardTips and @HackerNewsOnion.

I also get less entertaining, but more actionable, advice from @patio11 and @orangethirty (both regular HNers). Patrick also periodically retweets the posts of others you may wish to follow.

</comment><comment><USER9> I'm mostly following people who I met at conferences / meetups / work as well as people who usually have something interesting to say in matters I'm interested in, like people from W3C, Opera, Google, popular UX speakers and such.

</comment><comment><USER10> This should help: [https://twitter.com/Scobleizer/most-influential-in- tech](https://twitter.com/Scobleizer/most-influential-in-tech)

</comment><comment><USER11> I exclusively follow @_milesokeefe:

[https://twitter.com/_milesokeefe](https://twitter.com/_milesokeefe)</comment>


The Power of Gratitude - <AUTHOR> http://blog.jgc.org/2010/10/power-of-gratitude.html

<comment><USER2> We're back to the regularly scheduled good content after the rant. Thanks!

Kidding aside, as the author of some minor open source software, and a few things here and there, it's always really nice to receive a note of thanks. Take a moment to do so with that Rails plugin or other little something or other that makes your life easier.

<comment><USER3> With every installation of Perl comes _perlthanks_ : <http://perldoc.perl.org/perlthanks.html>

        * Can you use perlbug to submit a thank-you note?

        Yes, you can do this by either using the -T option,
        or by invoking the program as perlthanks

From older _perlbug_ perldoc it said: _Thank-you notes are good. It makes people smile._

:)

</comment></comment><comment><USER4> While it is indeed pleasant to be on the receiving end of gratitude, there is also real value in being grateful.

The author made the point, that as a result of showing gratitude, he was somewhat rewarded. I find that just the mental boost that I get when I am in a grateful state of mind is valuable.

</comment><comment><USER5> Another nice benefit of gratitude is that studies have show it improves the thanker's happiness.

"The Happiness Hypothesis" covers some of the research on this. Participants would write a thank you letter to someone they felt they owed something to, or keep a gratitude diary.

There are a few details on this page: <http://www.happinesshypothesis.com/beyond-gethappy.html>

</comment><comment><USER6> Jeff Atwood recently commented on this comic <http://theoatmeal.com/comics/email> that they left out the "Thanks" email. This article and my own opinions makes me wonder why wouldn't you say thanks.

</comment><comment><USER7> Take blame, give praise</comment>


GNU GDB 7.5 brings Go support, reverse debugging on ARM - <AUTHOR> http://sourceware.org/ml/gdb-announce/2012/msg00004.html

<comment><USER2> For anyone, like me, who had no idea what reverse debugging was, you can step backwards from a breakpoint/segfault or whatever. <http://sources.redhat.com/gdb/news/reversible.html>

<comment><USER3> I ran into it accidentally just the other day, but all it told me was that I couldn't use it while debugging a multi-threaded program. I was immediately both elated and disappointed in the feature, since nearly all the C++ programs I work are multi-threaded.

I don't know if that's true in the latest versions, but it certainly seems like solving that problem in a multi-threaded environment would be difficult.

Edit: this seems to indicate it can be enabled in a threaded program: [http://stackoverflow.com/questions/7517236/how-do-i- enable-r...](http://stackoverflow.com/questions/7517236/how-do-i-enable- reverse-debugging-on-a-multi-threaded-program) I will have to try it. I guess it's just another case of a badly worded error message "Target multi-thread does not support this command." sure makes it sound like you can't reverse in a multi-threaded program, doesn't it?

</comment></comment><comment><USER4> It's good to see Go officially supported.

<comment><USER5> What happened before? Go documentation was already claiming gdb was the debugger to use.</comment></comment>


Cloud computing is a trap, warns GNU founder Richard Stallman (2008) - <AUTHOR> http://www.guardian.co.uk/technology/2008/sep/29/cloud.computing.richard.stallman?CMP=twt_gu

<comment><USER2> So I won't say that RMS is totally correct, but he's not entirely wrong, which is more than I usually agree with him.

</comment><comment><USER3> Why now ? The article is old.</comment>


Apple Keynote 2018: iPhones Get Better, World Gets Worse - <AUTHOR> https://www.theatlantic.com/technology/archive/2018/09/everything-is-worse-except-your-phone/569980/?single_page=true <comment><USER2> This is a political story, but then so is most of tech these days.</comment>


Ask HN: Is API scraping more common now than page scraping? - <AUTHOR> Given that many/most sites are SPA-style now that make structured http requests to retrieve their data (after initial page load), does modern scraping target underlying api's now, or is it still centered around parsing markup? If the latter, why? <comment><USER2> There isn't a general rule. It depends on the website architecture. If there is an API you can use it is better for you and less tolling on the website (given you know what you are doing), otherwise scraping it is.

</comment><comment><USER3> doesn't have any sense to make manual crawling and parsing, having tools like crawlera or proxycrawl makes it super easy to get data in API style way. So why complicate?</comment>


India has launched a 648MW solar power plant - <AUTHOR> http://venturesafrica.com/india-launches-largest-solar-plant-world/ <comment><USER2> Topaz, California - 580 MW - cost $2.5 billion - built in 2 years

Tamil Nadu, India - 648 MW - cost $677 mln - built in 8 months

...wait, what?

<comment><USER3> I'd guess much of it is labour and land cost.

<comment><USER4> Also falling prices for photovoltaics probably, the topaz farm was completed two years ago.

<comment><USER5> Extrapolating a few graphs I found via a quick google search, you don't get a 5x drop in costs due to cheaper solar panels.

[http://solarcellcentral.com/images/module_prices.jpg](http://solarcellcentral.com/images/module_prices.jpg) [http://www.data360.org/temp/dsg605_500_350.jpg](http://www.data360.org/temp/dsg605_500_350.jpg) [http://costofsolar.com/management/uploads/2013/12/solar- pv-c...](http://costofsolar.com/management/uploads/2013/12/solar-pv-cost- trend.png)

</comment></comment></comment></comment><comment><USER6> While by no means I mean to minimize this announcement, if the press was publishing an article every time a Coal plant opens in India, we would have an article every few days or so on HN.

Just to put things into perspective:

\- A plant like Topaz, California generates ~1100 GWh/year. [3]

\- "India was the third top electricity producer in the world 1272 TWh in FY 20014-15" [1]

\- "India was the third top coal producer in 2015 with 283.9 Mtoe (7.4% global share)." [1]

\- "Nearly 80% of total electricity generated (utility and captive) in India is from coal." [1]

So we're about at 3 orders or magnitude, in terms of generated electricity, between what you currently get from coal plants and this new Tamil Nadu plant. While the penetration rate of renewables is faster than coal [2], the same thing cannot be said of generated capacity. Globally an unit of power from renewables has a far lower EROI compared to Coal [4].

So I support what kumarski said below, this is much of a hype. If India wants to be serious about climate change, they should at least stop building Coal plants.

[1] [https://en.wikipedia.org/wiki/Energy_in_India](https://en.wikipedia.org/wiki/Energy_in_India)

[2] [https://www.greentechmedia.com/articles/read/Renewables-](https://www.greentechmedia.com/articles/read/Renewables-) Are-Outpacing-Coal-in-India

[3] [https://en.wikipedia.org/wiki/Topaz_Solar_Farm](https://en.wikipedia.org/wiki/Topaz_Solar_Farm)

[4] [http://festkoerper- kernphysik.de/Weissbach_EROI_preprint.pdf](http://festkoerper- kernphysik.de/Weissbach_EROI_preprint.pdf)

<comment><USER7> The electricity penetration and per-capita usage in India is abysmal. If Quality of Life for Indians is a concern (which it rightfully should be), India should open more coal plants.

US and Europe's path to prosperity went through Coal and to demand Indians and Chinese sacrifice while not making any thing substantial themselves (i.e. in US and Europe) is hypocrisy.

Indian population : 16% of world pop US population : 5% of world pop

Just one more stat for perspective.

<comment><USER8> > US and Europe's path to prosperity went through Coal and to demand Indians > and Chinese sacrifice while not making any thing substantial themselves > (i.e. in US and Europe) is hypocrisy.

Regardless of whether hypocracy is involved, wanting India and China to avoid the mistakes the West made is entirely reasonable. If nothing else, the US and Europe built coal plants before better technologies were available. India has access to modern natural gas plants, fuel cells, wind, solar, etc if it wants them. No one would suggest that India or China build lots of steam engines, after all.

<comment><USER9> > Regardless of whether hypocracy is involved, wanting India and China to > avoid the mistakes the West made is entirely reasonable. If nothing else, > the US and Europe built coal plants before better technologies were > available. India has access to modern natural gas plants, fuel cells, wind, > solar, etc if it wants them. No one would suggest that India or China build > lots of steam engines, after all.

Building steam engines and maintaining them was more expensive than building fuel based / electric trains. Even the initial cost was less. So the transition was faster and made a lot of economic sense.

Solar energy prices dropped to around parity with coal for the first time this year, hitting 4.34 rupees (about 6 US cents) a kilowatt-hour (kWh), while coal tariffs range usually range in between 3–5 rupees/kWh (about 5–8 US cents). It wasn't possible until April of this year to even consider Solar a viable alternative. With prices dropping (and hopefully continuing to drop until at least 2030) we can now think of installing new power plants backed by solar.

However, what happens to the old coal based power plants that power 20% of Indian populace (that is close to 3/4th of the population of the United States)? It is going to be super expensive to transition those old power plants to solar. Also, what about 24/7 power? Solar power plants don't guarantee 24/7 power. So you can't completely get rid of coal plants anyways. India has to do quite a bit of balancing act to provide energy for it's 1.3 billion and growing population.

It's not as easy as you make it out to be. If that was the case, United States would have already transitioned to 100% clean energy like it did with steam engines in the 19th-20th century.

</comment></comment></comment></comment><comment><USER10> Kerala, India -- The world's first solar airport no longer pays for electricity [http://money.cnn.com/2016/03/14/technology/india-cochin- sola...](http://money.cnn.com/2016/03/14/technology/india-cochin-solar- powered-airport)

USA -- whaat ?

</comment><comment><USER11> My biggest hope on climate is India, China and Africa are soon in a position to put pressure on the West for how little we're doing.

As prices continue to drop there'll be less and less incentive for them to continue installing polluting power.

<comment><USER12> The West is very good at pointing to the equation that benefits them while sidelining the historical path that was taken to get here. The narrative and finger pointing is strongest if the focus is on per-country impact versus per- person impact. Very "electoral college-ish", and inappropriate when the core underlying problem has no borders.

The choice of words and numbers have made it plausible for an 'us' versus 'them' scenario. You do have to give credit to the wing of the PR machine that runs this so effectively.

Going forward, controlling the narrative, and the associated "baseline" on geopolitical issues is going to be huge. Western countries have an unparalleled advantage thanks to the English and other Euro-languages which can reach a large portion of the globe.

<comment><USER13> The historical path is completely irrelevant. We need to stop producing CO2 ( _completely_ stop) within the next 30+-30 years if we want to limit global warming to ~2 degrees. The fact that "first world" countries have historically polluted much more during their development doesn't change that. We have to stop pointing fingers and start massively investing in change.

<comment><USER14> There's no way avoid finger pointing. There are tens of millions of people without electricity for their basic needs (think warming a babies milk or light for security), yet there are people in the west dumping a single use coffee cup (unheard of in poorer nations). People cannot continue to drive 5 liter vehicles for fashionable reasons and still expect poorer nations to live in abject poverty. What i'm saying is that finger pointing is exactly what we need to do.

<comment><USER15> FWIW, you can train most babies to accept cold or room temperature milk or formula by simply not offering it warmed. This saves a lot of parental effort of warming bottles, although the energy savings are minimal. Maybe refrigeration would be a better critical energy use? Storing milk (human or otherwise) safely is a big enabler.

</comment></comment></comment></comment></comment><comment><USER16> Here is the documentary on this project made by National Geographic [https://www.youtube.com/watch?v=gM-0lrIxCnE](https://www.youtube.com/watch?v=gM-0lrIxCnE)

<comment><USER17> And for Letterman's sad fans, some video related to India power management [https://www.youtube.com/watch?v=RnaBB7lTyjk](https://www.youtube.com/watch?v=RnaBB7lTyjk)

</comment></comment><comment><USER18> > By 2022, India aims to power 60 million homes by harnessing 100 gigawatts of > solar energy.

That could power 82 Doc Brown DeLorean time machines[1].

In comparison, the 2013 estimate for world energy consumption was 12.3 terawatts[2], which would power 10165 Doc Brown DeLorean time machines.

[1]: [https://en.wikipedia.org/wiki/DeLorean_time_machine](https://en.wikipedia.org/wiki/DeLorean_time_machine)

[2]: [http://www.webcitation.org/6fzEHL2Bz](http://www.webcitation.org/6fzEHL2Bz)

<comment><USER19> In general, Indian homes use very little power.

A fan or open windows are likely to replace central heating/aircon, a bicycle or public transport a car, a radio a television, and locally sourced wood- fired stoves electricity and gas in the kitchen.

Your global 'energy consumption' figure probably includes stupid things like American industrial agriculture, Dubai, the US military, people's calories from food, ~free geothermal power in volcanic zones, established hydropower, etc.

<comment><USER20> > Dubai

The UAE as a whole only consumes 15% more energy per capita than the US. Given how much smaller it's population is (around the size of NYC), it seems unfair to include it in the list. I assume that number also includes how much energy is needed to produce oil, which is exported worldwide.

The country is heavily investing in renewables, Dubai wants to supply 7% of power by solar from 2020, and 75% by 2050.

[https://en.wikipedia.org/wiki/List_of_countries_by_energy_co...](https://en.wikipedia.org/wiki/List_of_countries_by_energy_consumption_per_capita) (sort 2013 by capita)

[https://en.wikipedia.org/wiki/Solar_power_in_the_United_Arab...](https://en.wikipedia.org/wiki/Solar_power_in_the_United_Arab_Emirates)

<comment><USER19> OK so good point - as usual looking at real numbers is far more informative... Qatar is way worse, yadda yadda.

That said, the US is a pretty bad yardstick. Another way to look at it would be to say that the average UAE citizen uses 250% of what an Iranian uses, or the average Qatar citizen uses 650% of what an Iranian uses, despite a (very) broadly similar climate and self-sufficient energy production.

The US citizen uses 11x more than an Indian, who is only slightly ahead of a North Korean (despite a horrific climate), both of whom are ~3x more than a Bengali.

</comment></comment></comment></comment><comment><USER21> Can anyone compute the ecological footprint of this power plant?

Just curious how much raw material( water, etc, even waste ) went into building all that panels and the auxiliar stuff.

<comment><USER11> Compared to the eco footprint of a nuclear plant with fuel and waste handling, or coal plant with associated mining and transport?

I'd be astonished if it wasn't clearly the least impactful.

What the world needs is easier ability to compare true impact of building, and running our stuff. Without all the hidden externalities and hidden subsidies.

<comment><USER22> > Compared to the eco footprint of a nuclear plant with fuel and waste > handling,

Nuclear is a close third with waste included for ecological foot print including waste. Its a $$$ game that Nuclear losses.

[http://www.nei.org/News-Media/News/News-Archives/Nuclear- Pow...](http://www.nei.org/News-Media/News/News-Archives/Nuclear-Power-Plants- Are-Compact,-Efficient-and-Re) (Has a strong bias towards nuclear)

Nature article shows its the money and lead time that kills nuclear.

"Add to that the high costs and long lead times for building a nuclear plant about $3 billion for a 1,000 megawatt plant, with planning, licensing and construction times of about 10 years and nuclear power is even less appealing." (2008)

And now the cheap cost of solar and other alternative energy shows that it makes financially cense to use renewable over traditional carbon fuels.

[http://www.nature.com/climate/2008/0810/full/climate.2008.99...](http://www.nature.com/climate/2008/0810/full/climate.2008.99.html)

<comment><USER23> What is your replacement for baseline load? Solar alone isn't enough and the cost changes if you need battery infrastructure to handle dark times. Nuclear power doesn't stop when the weather changes.

<comment><USER22> I think the cost for nuclear and lead time will have gas powered and coal plants for dark times. The issue is the cost for these dark time power will go up. I have a friend who is a Wheelwright and he states that backup plants that only come online 3 days a month makes more money then if it was running 100% of the time.

[http://energypost.eu/battery-storage-will-take-backup- power-...](http://energypost.eu/battery-storage-will-take-backup-power- plants/)

In the next 10 years batteries will have a larger role and about 25% of coal power plants will be retired by 2020 in US and Europe.

<comment><USER24> That profitability is the consequence of regulation. Utilities are generally a government granted monopoly so any failure to provide service (brown or blackouts) comes with huge fines. Last I checked, the fine for a utility in Southern California for a blackout in the LA metro area could be as much as several hundred million dollars. That would wipe out the profitability for the year so the vast majority of utilities in the US own or contract out to "peaker" plants that are on standby but ready to quickly spin up.

If these regulations were updated to require less polluting peaker plants, nuclear might be the only option because the economics are government mandated. I wouldn't be surprised if California started moving this direction by 2050 if it can give up the Nat gas addiction.

</comment></comment></comment></comment></comment></comment><comment><USER25> Still feel adding solar to rooftops is better - just in terms of space utilized - than these giant solar farms..

<comment><USER26> Large parts of both India and China are covered by deserts where you can build huge wind farm and photo-voltaic capacity without disturbing anyone. Centralised areas make more sense in terms of maintenance, so building one plant per village could make much more sense than putting everything on roof tops

<comment><USER27> India has about 1/10th the desert area as the US.

</comment></comment></comment><comment><USER28> If we would collect all energy that get's to planet earth via light, how much of the total energy available to us would that be? Compared to say converting all mass of earth into energy somehow.

According to Wolfram Alpha, 1kg of mass contains about 10^17 joule. Let's see how much Kg earth has... about 10^25. So earth contains about 10^42 Joule?

According to a quick googling around, the sunlight that reaches us contains about 10^20 Joules per day.

So hey, if we burn up everything we can outdo the sun for 10^19 years!

<comment><USER29> Interesting comment. All the talk about renewable energy forget the fact that the Sun energy is equivalent to burning the earth for energy. Except it's much less efficient.

<comment><USER30> I couldn't understand, can you please explain in detail?

<comment><USER29> The Sun is burning itself in order to create the light that citizens of earth are then collecting a portion of to generate electricity. That's not much different than burning oil or coal here; except that it's happening in earth and at exponentially smaller scale.

</comment></comment></comment></comment><comment><USER31> This article gives some images that show the scale: [http://www.aljazeera.com/news/2016/11/india-unveils-world- la...](http://www.aljazeera.com/news/2016/11/india-unveils-world-largest- solar-power-plant-161129101022044.html)

</comment><comment><USER32> I'm not sure devoting 10 sq km for a 648 MW plant is the most efficient use of land. A nuclear or coal fired plant of similar or even larger capacity will take up much less space. This is especially problematic as India and especially the state of Tamil Nadu is one of the densest places on earth.

<comment><USER33> That's a pretty bad argument to make. I'm not sure why you call the state of TN "one of the densest places on earth", it has a lot of rural farmland and the only population concentrations are in the major cities. It has roughly the area of Florida, not really the largest of states but pretty large in the country. The power-plant is in one of the more rural parts of the state, and the land it uses probably was useless barren land anyway.

<comment><USER32> 600/sq km is pretty dense IMO. It's larger than India's overall population density (382/sq km). Also you seem to be tragically unaware that land is often a scarce resource for infrastructure development in India. Taking farmland under eminent domain is an extremely emotive and political issue. Read up on the troubles of the present government to liberalize the land acquisition law.

<comment><USER33> I think you're conflating two different issues here, the plant is in an area which is pretty much barren land, far from any major city, and has only a small town near it. The troubles governments face when acquiring land for infrastructure is usually for things like metro rail through congested cities, or building airports on the suburbs of major cities and the like.

The issue of it being densely populated land would have been valid if this was near some major city and plant actively hampered development. There probably is no such issue now, the plant provides cleaner energy than the alternative (coal), and is a huge step forward towards reducing the country's need for non-renewable sources.

</comment></comment></comment></comment><comment><USER34> A lot of news coming out of India is hype.

I promise you that at night we burn 50% ash - lignite coal to compensate for downticks in solar and upticks in consumption.

For the next few years we'll be opening a new coal plant each month.

To give you an idea of how far we are behind as an energy grid.

The US & China each Produce about 4000 Terawatt Hours Per a Year.

India is somewhere in the ~1500 Terawatt hours per a year.

To make up the difference we're going to burn a ton of coal, the worst kind of coal.

<comment><USER35> I don't know why were you downvoted, but it really is true. If they really cared about the environment, the massive pile of garbage in Delhi would stop being burned [1]. This is the National Capital we're talking about. And the landfill is not somewhere far off the city either, you can _see_ it smoking if you board a yellow line Samaypur bound train and look outside the windows near Azadpur station.

So yeah, we're going to burn a ton, or two of coal, and keep building Solar power plants.

To be fair, I applaud the efforts being taken, however, pretending that the problems don't even exist is what's unfortunate.

[1] [http://www.ndtv.com/delhi-news/smouldering-mountains-of- garb...](http://www.ndtv.com/delhi-news/smouldering-mountains-of-garbage- poison-delhis-air-water-1292267)

<comment><USER34> I don't know either.</comment></comment></comment>


Chops – Make beats with your voice - <AUTHOR> https://www.getchops.app/ <comment><AUTHOR> Hey HN! We're Tristan & Greg from Chops [https://www.getchops.app/](https://www.getchops.app/) . Chops is an iOS music making app that lets you make beats with your voice. We're currently running a closed TestFlight beta, and are planning to launch soon.

Tristan and I are both musically inclined without being professional musicians. Our Voice Memos apps are filled with bits of song ideas that we recorded as inspiration struck. An issue we've seen with recording these snippets is that 1) you can't layer your voice easily without using a specialized looper app and 2) it always sounds... like your voice. We're not pro beatboxers, so our "voice drums" don't sound that great. Enter Chops.

We've designed a way to create drum tracks using your voice -- you "sing" the drums and then pick a drum sound (kick, snare, hi-hats, etc.). Check out the video on our page to get an idea of how it works.

We're super excited to push this idea much further, and to make music making more accessible, intuitive and fun. We feel that there should be a larger overlap between music "fans" \-- this includes people that sing along to songs, that hum tunes, that make up songs for their families -- and "musicians" as the term is too commonly defined (e.g., people with a musical education, professional artists, etc.)

If you feel even a tiny bit musically inclined, we'd love to have you be part of this beta round!

Reach out to us email@example.com for any questions or AMA here. Thanks a lot!

<comment><USER2> I've been wanting this for literally decades. I make mouth-click beats all the time, and it's easier and more tempo-accurate than what I can do with my fingers/hands. Does Chops support more than one "instrument" at a time? Typically I use one click for the kick, and then a different one for the snare. Can it act like a standard MIDI controller for external software/hardware?

<comment><AUTHOR> That's... exactly the use case we were thinking about! We've been using Voice Memos to record song bits / mouth beats, and hopefully this is the better / smarter version of that.

Chops does support multiple instruments at a time -- right now, you can layer many drum and audio tracks (drum tracks play built in drum samples, while audio tracks are those that you record using your phone's microphone).

The app is MIDI-based, but it cannot trigger external software/hardware devices at this time. This is something that's on the roadmap!

</comment></comment></comment><comment><USER3> Love the "make beats with your voice" tagline, it's simple and effective. The demo video on the landing page makes me think on an idea: why not allow recording a video of your face while you record your vocal beat? It seems people are using TikTok as a mean of physical expression (through dance, mostly) and maybe your app could grow a subculture through the same dynamics?

Curious to see the final version!

<comment><AUTHOR> Totally a great point, and other apps in this space -- typically those that target a larger, non-"pro musician" audience -- do have more entertaining / fun engagement mechanisms, such as recording a video selfie while singing / karaok'ing, etc.

Really great idea, thanks a lot!

</comment></comment><comment><USER4> Reminds me of Mike Gao's Vocal Beater [1]. Too bad it doesn't seem like he's been keeping it updated recently. He's able to beatbox and it'll automatically recognize the instruments too.

Here's a demo of him using it on YouTube: [https://youtu.be/OS7LeMHImBM?t=232](https://youtu.be/OS7LeMHImBM?t=232)

[1] [https://apps.apple.com/us/app/vocal- beater/id384844110](https://apps.apple.com/us/app/vocal-beater/id384844110)

<comment><AUTHOR> That's fascinating! We're 100% going into that direction, and the necessary algo work to do this reliably is not trivial.

Thank for the great pointers!

</comment></comment><comment><USER5> It would be better to do this when you launch. Right now it looks like just a signup page, and Show HN requires that there be something for people can try out: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html).

<comment><AUTHOR> Hey dang, my sincere apologies about this!

The app is ready to test and we're reaching out to people who are signing up with TestFlight links i.e., everyone will get to try out the app.

But you're right of course that there's nothing to try on the launch page -- there's only a demo video.

We'll be more careful for future projects, and will only post again about this once we're live on the App Store.

Sorry again!

<comment><USER5> It's ok! You're welcome to post when people can try it out. I think it will have some appeal.

</comment></comment></comment><comment><USER6> Signed up for the beta, seems super creative can't wait to try it. Cheers

</comment><comment><USER7> Very cool! Will check out.

<comment><AUTHOR> Thank you! Looking forward to your feedback!

</comment></comment><comment><USER8> Fun! :D</comment>


Basic HTML/CSS - <AUTHOR>

So I made a basic page in HTML : file:///Users/CaiGengYang/Documents/CaiGengYang.html<p>Thinking of what product to build to get some users to test and use it. Any ideas/suggestions ? <comment><USER2> CaiGengYang, no one can get to the page you created because the web address (URL) you provided is apparently on your local machine. You need to provide us a web accessible URL. Good luck.

<comment><AUTHOR> rman666,

How do I check what is the web accessible URL?

</comment></comment><comment><USER3> Please see [https://en.wikipedia.org/wiki/File_URI_scheme](https://en.wikipedia.org/wiki/File_URI_scheme)

<comment><AUTHOR> blueflow, what's the point of this wikipedia page?

<comment><USER3> The file:// scheme refers to local files. Local files on your local computer. Inaccessible from the outside world.

<comment><AUTHOR> Ok I think I get what you mean .. so this :

file:///Users/CaiGengYang/Documents/CaiGengYang.html is a local file on my local laptop because it has the "file://" scheme and thus is inaccessible to other people besides myself.

So how do I create a personal site like this : [http://www.paulgraham.com/](http://www.paulgraham.com/) which is fully accessible to the public ?

<comment><USER3> For http: You need to place the File in a directory which is served by a Webserver which is public accessible.

Its kinda complex and there are many, many ways to achieve this.

If you can use git and have a github account, you can use Github Pages: [https://pages.github.com/](https://pages.github.com/)

<comment><AUTHOR> blueflow,

I created a GitHub account here : [https://github.com/CaiGengYang/CaiGengYang#caigengyang](https://github.com/CaiGengYang/CaiGengYang#caigengyang)

This is a site for hackers and programmers to collaborate on code and projects ? Cool ...

How to start creating a project ?

<comment><USER4> Github is a remote host for Git repositories - if you don't know how to use git then you're going to need to learn. If you do, great. Since your profile says you're trying to become a programmer and want to work for Google, it's a necessary skill.)

Github pages is a way to host sites from a Github hosted repository: [https://pages.github.com/](https://pages.github.com/)

There are other ways to host a site as well, typically involving an account with some service (Godaddy and Hostgator are two popular ones but there are hundreds of options) and registering a domain name, and uploading the files (usually by FTP though modern services deploy by git as well) to the remote server. Then the domain name points to the files on that server.</comment></comment></comment></comment></comment></comment></comment>


Ask HN: Anyone know where I can find Wordpress devs with recommendations/reviews - <AUTHOR>

I have an existing site that needs someone who is very well versed in Wordpress, optimizations and caching. Basically looking for someone to go through the site and fix up the code, clean/tune the caching etc. Also looking for recommendations on how to improve the performance/loading etc.<p>It does generate profit and I really need a professional eye/opinion before something terrible happens / biting off more than I can chew. <comment><USER2> As a WordPress dev, I'm well versed in the ecosystem of WordPress, and the only thing I would trust is a personal recommendation. If you don't know folks who have WordPress sites, then shoot an email to all your favorite bloggers and asm them if they have a dev they'd recommend.

<comment><AUTHOR> Do you have one you can recommend? :) If you do, mind emailing their contact info to me? jimmy at justjimmy dot ca

<comment><USER3> I shot you an email a few minutes ago. If you don't see it, please check your spam folder!</comment></comment></comment>


Data Structures Influence Speed of Quantum Search in Unexpected Ways - <AUTHOR> http://ucsdnews.ucsd.edu/pressrelease/data_structures_influence_speed_of_quantum_search_in_unexpected_ways <comment><USER2> > Both intuition and previous work seem to indicate that quantum searches will > slow in sparsely connected data structures...

Funny that this is opposite what I would guess. The more complex and interconnected the data structure means more possible "paths" to explore.</comment>