The future of my games on Apple and what this means for art games - <AUTHOR> http://www.nathalielawhead.com/candybox/the-future-of-my-games-on-apple-post-catalina-and-what-this-means-for-art-games-in-general <comment><USER2> We've heard the warnings about the rise of "proprietary computing", where all experiences in computers need to be approved by the policies of hardware and software manufacturers.

I feel it's getting worse as we get pushed more and more to vertically integrated platforms (Pixel, iPhone, Surface, game consoles, Kindle+Fire etc). We still have Linux, thankfully - at least as long as hardware manufacturers let it run on their computers.

[https://boingboing.net/2011/12/27/the-coming-war-on- general-...](https://boingboing.net/2011/12/27/the-coming-war-on-general- purp.html)

<comment><USER3> Pixels are one of the few phones with custom firmware loading explicitly enabled and exposed by Google. Sideloading apps is also 1 switch away. It could be even better, but I really don't think it belongs in the same category as iPhone and have consoles.

<comment><USER4> Are we supposed to pretend it's something other than vertical integration because you happen to prefer their approach?

<comment><USER3> I don't understand why you'd pretend anything.

You've got 3 areas:

1\. Producers actively preventing you from running custom software (iOS, TVs, game consoles, some Android systems, ...).

2\. Platforms providing default software and leaving an official way to replace it (pixels and a few other androids, ...).

3\. Producers who mostly don't care what you run. (PCs)

It matters to me that things are as close to the 3rd category as possible. But let's not lump 1 and 2 together - there's a huge difference.

<comment><USER4> What does any of that have to do _vertical integration_?

</comment></comment></comment></comment></comment><comment><USER5> A lot of people here are fixating on the $100/year fee -- and don't get me wrong, that's a problem -- but ignoring another significant part of the blog post: the fact that Apple is demanding what amounts to a non-trivial amount of _creative control_ over the visual appearance of games that can be distributed on macOS/iOS. Just like the other restrictions on user freedom, this is a ratchet that will only get tighter as time goes on.

What would happen to indie filmmaking if every TV and movie projector threw up a scary warning screen, requiring a cumbersome manual override, before playing anything that wasn't certified by the MPAA?

If you develop webapps, would you be OK with not being able to get a trusted SSL certificate unless an anonymous reviewer at Mozilla was satisfied with your UI?

<comment><USER6> > _A lot of people here are fixating on the $100 /year fee -- and don't get me > wrong, that's a problem_

How much should you have to pay for unlimited bandwidth, hosting, downloads, user ratings, reviews, feedback, crash logs, showing up in searches, the chance to get featured, and other features like CloudKit etc.?

> _Apple is demanding what amounts to a non-trivial amount of creative control > over the visual appearance of games_

Where did you get that from?

How is that different from Steam, Nintendo, Microsoft and Sony not allowing certain types of content on their platforms? For example, you can't show explicit pornography in your game and expect it to be approved anywhere.

As for not allowing _" blue screens of death, simulated error, glitch art, brokeness"_ that TFA complains about:

Have you seen those "YOUR PC IS INFECTED BY 42 VIRUSES!! CLICK HERE TO CLEAN SYSTEM32! PERMANENT HARD DISK DELETION IN 2 SECONDS!!!" ads?

What if apps start doing that for fun then charge in-app purchases to clean the in-game viruses?

Would you want the job of being an arbiter over whether something like that is malicious deception which preys upon user naïveté, or just a cute quirky joke?

<comment><USER5> > How much should you have to pay for unlimited bandwidth, hosting, downloads, > user ratings, reviews, feedback, crash logs, showing up in searches, the > chance to get featured, and other features like CloudKit etc.?

As others have already pointed out, I'm talking about the fact that Apple charges $100/year to make your software runnable on a Mac, regardless of whether you want to use their app store.

> Where did you get that from?

From the blog post that we're all supposedly discussing: "The next reviewer saw the "blue screen of death" art and said that it conflicts with copyright (it's Microsoft) as well as simulated error not being allowed. So I changed that too. After that it got arbitrarily rejected for another reason… so at this point I changed so much about the game that it wasn't even my work anymore. It didn't reflect any of the things that were important to my work. Simulated error, glitch art, brokeness, historic UI's are deeply important to me because they reflect a computer history. None of that was allowed. I had to change my games."

> How is that different from Steam, Nintendo, Microsoft and Sony not allowing > certain types of content on their platforms?

Steam is a free service that doesn't prevent me from running non-Steam software on my computer.

As for your other examples, I don't think it's different. I think restrictions on user freedom are made worse, not better, by the fact that lots of companies are engaging in them.

<comment><USER7> Look the point stands: it's a non-free as in speech & beer platform

Go work with Purism if you want to ship whatever

What a shock Apple is also nickle & diming for services as hardware sales atrophy. This is business 101.

If we don't like how businesses work we should stop working for them.

Paying for beer & leaving speech free never works. We end up talking about supporting paid beer. Free speech becomes all about what we buy & sell.

If you want a free society that doesn't end up in a nickle & dime system of inequality a test should be is life free as in speech & beer? Organized around resource distribution sure, but free of coercion to support paid speech all day (where to be viable in the eyes of society work must earn money).

That's the DNA of our culture. These are not random things. This is what we and Apple talk about all day: financial justification for behavior.

That's a complete corruption of free speech.

</comment></comment></comment></comment><comment><USER8> This article mixes up a lot of issues and is not very coherent. Here are some important clarifications:

1\. You can run any unsigned or unnotarized software from any developer by right-clicking the app, selecting "Open", and then click the "open" button in the scary warning. It's really simple. I wish people would stop pretending like it was really hard to run unsigned software.

2\. Apple does not "curate" or "review" software distributed outside the Mac app store. The notarisation process runs some automated malware checks, and that's it. The goal is to block malware, not to limit the content you put on your computer.

3\. Notarisation takes less than ten minutes. It's easy to automate it, and you can also do it manually if you want. You can staple the notarisation ticket to the app, but you don't have to. MacOS will look up the ticket via a webservice if you don't staple it. The documentation sucks, but that's the only bad thing you can say about it.

4\. Apple does review stuff you submit to the Mac app store, but fortunately it's entirely optional to submit stuff to the Mac app store, there's nothing stopping you from releasing software outside the app store without any review.

5\. Apple did end support for 32bit apps, which sucks, and I don't have anything good to say about that.

<comment><USER9> You do need to get a paid developer account though and Apple has announced that in the next version of MacOS bypassing notarization is going to get more difficult.

<comment><USER8> You only need a paid account if you want to sign and notarize your app.

You can build apps and distribute them without a developer account. But macOS will show a scary warning to your users.

</comment></comment></comment><comment><USER10> As a developer mainly on MacOS I feel the author's pain. There's also some legitimate gripes about Apple locking down their platform in a way that is ultimately hostile to users down the road.

As a user I say suck it up. Notarization and 1st party QA will make users lives so much easier. I have yet to see people run into serious issues with either that weren't doing things that entitlements/signing were designed to prevent.

The $100/year dev license kinda sucks if you just want to hack around and distribute code, but it also goes a long way to stopping people from creating spam accounts and evading bans. But it's a pretty trivial burden, if you're distributing software professionally and can't cough up $100 in revenue in a year... maybe try your hand at something else or just go the amateur route?

I also don't get complaining about obsoleting 32 bit. Use obsolete software on an obsolete OS in a VM like the rest of us, we all hate supporting things until the end of time.

<comment><USER11> > just go the amateur route?

But how do you even go the amateur route? You still won't be able to distribute what you make.

A big part of my childhood was making games, and sharing them on shareware sites in the mid 90s. It sucks that kids today aren't going to be able to do that. There was no way I could afford $100 as a 10 year old.

<comment><USER10> Well you could write your game in JS and deliver it over the web. Flash games were all the rage when I was a kid.

But for now, non-notarized executables don't fail, they just need to be enabled by an admin account through permissions.

<comment><USER12> WebGL isn't fully supported on iOS, so there goes your nice little web game.

<comment><USER13> Last year I was building web games* with Phaser. To better support iOS, I just changed the renderer to `canvas` when an iOS user agent was detected. In the end, the games worked pretty well on iOS devices.

*Games I worked on: [https://livegame.show/play/ride_v3](https://livegame.show/play/ride_v3) | [https://livegame.show/play/pewpew_v6](https://livegame.show/play/pewpew_v6) | [https://livegame.show/play/bubbleshooter3](https://livegame.show/play/bubbleshooter3)

I will say though, Apple does seem to almost purposefully hold back the web on iOS. I suppose this makes native iOS apps, which must pay Apple 30% of their revenue, more appealing to users. On iOS, the Firefox and Chrome apps aren't allowed to include their own browser engines. They have to just wrap Safari webviews.

On Android, the Firefox app is allowed to include it's own browser engine. An engine that supports adblocking extensions like uBlock Origin.

<comment><USER14> I think this is an issue with phaser. I've also made a bunch of web games with various frameworks, and webGL works fine on iOS in many other contexts. The js port of cocos2d is webGL compatible on iOS.

</comment></comment></comment></comment></comment></comment><comment><USER15> I'm also thinking of just dropping macOS as a supported platform for Krita: [https://krita.org/en/item/first-notarized-macos-build-of- kri...](https://krita.org/en/item/first-notarized-macos-build-of-krita/)

<comment><USER16> It seems to me that Apple is shooting itself in the foot very hard with moves like this. At the end of the day, developers are creating value for your platform. If you treat them like shit, they will leave.

A lot of teenagers who are learning to program right now are definitely not going to be able to pay $100 a year to distribute toy programs they're making for fun. Heck, a lot of adults developers won't pay that. Apple has just made Linux significantly more appealing for all of these people.

I own a MacBook Air at home (and a Linux desktop). I know this will definitely motivate me to go back to a Linux laptop for my next purchase. This move isn't just hostile to users, it's hostile to developers, hostile to the people creating value for the platform.

<comment><USER17> Even if you can easily afford it, the pay-to-publish model should be setting off warning bells. Vanity publishing has been a real thing for a very long time, and normally isn't something that people consciously want to be doing.

</comment></comment></comment><comment><USER18> This was heartbreaking to read. I don't understand how anyone can defend not being able to run software on their own devices, unless it was approved by Apple.

<comment><USER19> It's not about being approved by Apple. It's about a digital signature that proves the identity of the author.

<comment><USER20> Ok, can I use EIDAS? That is surely stronger than whatever identity validation Apple is doing. (I know for sure.) And it doesn't cost $100.

<comment><USER21> That might be worth pursuing within the EU.

That said, if it required something like a "qualified electronic seal" I think the cost would be substantially more (600 EUR a year?), and Apple might turn around and start charging a notarization fee to recoup their infrastructural costs.

</comment></comment></comment></comment><comment><USER22> I agree with the sentiment expressed in this article, but notarization is not the hill I'd want to die on.

Want to play experimental itch.io games? Open a Terminal and type:

        sudo spctl --master-disable

It takes all of five seconds, and it's _permanent_. It might take less technical users a bit longer, but entering text into a Terminal window really isn't difficult, and technophobes aren't using itch.io.

Some people will say this is a bad solution because it makes your computer less secure, but, like, you can't have it both ways. Either you allow experimental software and accept the risks involved, or you don't. Maybe don't play experimental games on the same machine you use for important work.

</comment><comment><USER23> I hope we can all agree that notarization is pretty valuable to users. Macs are a mass market product and most users are not technical. Also to create software for Apple devises you need... an Apple device. Isn't the cost of the device a bigger burden than the $100/yr dev program license?

<comment><USER24> > _I hope we can all agree that notarization is pretty valuable to users._

I don't. As a user, I don't need Apple arbitrarily allowing big players' apps through their approval process while they hold smaller developers to a stricter standard. That will stifle innovation.

If security is the touted excuse, macOS already has sandboxd[1] which can be used with arbitrary apps that aren't in the App Store.

Linux solved the security problem with Snaps, Flatpaks and AppImages, which all use various layers of containers, kernel namespaces and isolation to provide a sandboxed environment for apps.

[1] [https://developer.apple.com/library/archive/documentation/Se...](https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AboutAppSandbox/AboutAppSandbox.html)

<comment><USER25> Can you point to evidence that Apple is rejecting anything from being notarized? I haven't seen any.

And sandboxing is completely orthogonal to the fine-grained revocation that notarization allows for. A sandboxed app could still be malicious: say, a weather app that asks for access to your Contacts ostensibly to show weather at your friends' location, but also uploads all the Contacts info to a malicious tracking service. With notarization, this app could have its notarization revoked once it's discovered.

<comment><USER24> > _Can you point to evidence that Apple is rejecting anything from being > notarized? I haven 't seen any._

Apple is rejecting anything by developers that don't pay them $100 a year, stifling competition in the process.

Apple has a history of conveniently rejecting apps if the rejection is in their financial interest[1].

[1] [https://www.theverge.com/2019/5/31/18647249/wwdc-apple- paren...](https://www.theverge.com/2019/5/31/18647249/wwdc-apple-parental- control-app-store-mdm-spotify-moderation-developers-2019)

</comment></comment></comment></comment><comment><USER26> I don't understand. I keep seeing developers complain about the $100/year developer fee but I also keep seeing strong indications that's not required for notarization.

<comment><USER27> I've a certificate whish is valid until 2022 (valid for 5 years) (generated in 2017 after paied 100$). I distribute only free games (GPLv3) that I sign with this certificate. For Catalina, I can't notarize because I don't pay each year (my certificate is valid then it's useless to pay and I distribute only free softwares)... But I'm fucked by Apple for the notarization.

It's too expansive to pay just to distribute games that will be even refused probably on the app store because it's GPL.

Apple is just killing freedom and continue to take advantage of free softwares (free developers) on BSD, mach kernel, a lot of unix tools... even on projects started by Apple like LLVM Apple takes all advantages of all third contributions.

<comment><USER21> FWIW, Apple doesn't care if apps being distributed contain code licensed under the GPL. They care whether you have the appropriate rights to distribute the app on their store under their terms - and that is asserted by you.

A previous build of VLC was pulled from the store because someone claimed they had copyright on some of the code - because they did not want VLC in the store.

<comment><USER27> Thanks I found more details here: [https://www.fsf.org/blogs/licensing/more- about-the-app-store...](https://www.fsf.org/blogs/licensing/more-about-the- app-store-gpl-enforcement)

</comment></comment></comment></comment><comment><USER28> Some developers here forget that there are game developers that make free stuff, hobby games, This developers often get requests to also package for Linux and Mac because the engine used is cross platform. So this people won't afford to buy a Macbook and pay 100$ yearly for one possible user that would like to try his free game.

I also see users asking for 32 Windows version of the games, there are still a lot of people running old computers and have bad internet connection and there is no good reason not to package some basic game app for them if it is possible.

</comment><comment><USER29> Every Macbook/Mac Pro should come with a free developer account that remains active as long as the purchaser of the machine is using the laptop. Doing so would further distinguish "pro" from non-pro machines, would make notarization less like an annual tax, and would thus encourage rather than discourage such malware-free certifications.

That said, I agree with the article's author that devs should be free to distribute whatever they want without warnings and without having to update annually. Not every piece of software gets maintained but it can still be useful, especially for artistic works. Let the App Store be the place where Apple certifies safety and leave the rest to the user.

<comment><USER30> Much like charities know that the best source of donations is previous donors, Apple knows that the best source of revenue previous customers who've already shown a willingness to open their wallets to pay extra for the Apple experience.

</comment></comment><comment><USER31> This article reminded me of the other major reason I've left OS X, other than five years of shitty Mac hardware which has been covered to death: shitty Mac software. Apple's software has always been on the lowest levels of quality, however, this generally excluded OS X. It's clear to me that Apple intends to remedy that and has already started so with this system protection bullshit that prevents running programs and resets itself on upgrades and possibly at other times randomly (I assume it does so just to fuck with users and show them who's the real boss and owner of their computer).

The author of this piece is 100% correct: none of these changes have anything to do with security. It's all about control. Apple, like most companies, just wants to control everything, whether relevant or not. The end goal is to control exactly what software is ran on their platforms, as clearly evidenced by the linked articles. I highly doubt that we'll be able to run any non-Apple approved tools in a year or two. They are turning OS X into iOS and have already renamed it macOS to let people know it's just going to be a walled garden of shit. The only reason to ever purchase an Apple computer was OS X. Now that OS X is turning into a shitty version of iOS, that last reason is gone. And that's before we get into the garbage hardware. I simply don't understand why anyone would want to support this platform going into the future. It's a platform that stands for censorship. Every component on the platform is designed around it. It's no longer a general purpose computing platform. In the future, it will be even less of one. All in the name of "security" and "privacy." Yup, save the children. But plenty of smart people fall for such stupidity.

</comment><comment><USER6> Let me just place this signpost in the bandwagon's way:

→» Users CAN run un-notarized apps if they WANT TO. «←

You just have to make us trust you as a developer.

<comment><USER32> Should the user click on "Cancel" or "Move to trash" to tell Apple that they trust a developer?

<comment><USER6> I have to menu-click » "Open"

Telling your users to do that (+ any other steps if needed) might take less effort than shaking pitchforks at Apple (though they're certainly deserving of ire in other areas.)

<comment><USER32> Good luck with that if you have a non-technical user base. Gaining trust when the first thing they see is a big warning telling them this software shouldn't be trusted will also be really tough.

<comment><USER6> You could do it all passive-aggressive like Krita: [https://krita.org/en/item/first-notarized-macos-build-of- kri...](https://krita.org/en/item/first-notarized-macos-build-of-krita/)

A developer who doesn't want to put any effort into gaining trust doesn't sound like someone I should allow to run non-sandboxed code on my machine anyway.

<comment><USER33> A developer who doesn't want to pay $100/year and spend countless hours going through Apple's arbitrary approval and notarization process, you mean.

<comment><USER6> And so we reach the end of the for loop: [https://news.ycombinator.com/item?id=21506948](https://news.ycombinator.com/item?id=21506948)

:)

To reiterate: You don't _have_ to notarize, if your users trust you enough to manually allow your app to run.

</comment></comment></comment></comment></comment></comment></comment><comment><USER34> Developers have been worshiping mobile OSs for more than a decade. This is the endgame, and don't say we haven't been warned about it. We 've been burned by walled gardens way too many times to have an excuse. Phones are much less free platforms than desktops. If developers desert phones, people will follow.

</comment><comment><USER35> I've been in love with OSX/macOS since I switched during the Vista fiasco but I feel it's a sinking ship these days.

I recently was looking to get a new machine for music production and ended up building an Ryzen PC with Windows 10. It cost me the same as an i7 Mini but it is many times more powerful, expandable, and silent. Thank god I moved away from Logic years ago.

Windows is not as pleasant to use as macOS, but it's just as stable. A lot of software seems to run better there (eg: Firefox, Chrome).

For dev work I will keep using my iMac and 2014 MBP with Mojave, at least for the foreseeable future. Unless something dramatic happens at Apple I will most likely end up moving to Windows or Linux in a couple of years when these machines die.

</comment><comment><USER36> Dumb question - as a dev on OSX (not yet migrated to Catalina), I compile and run my own code all the time. I also install a ton of binaries, like the Rust installation manager.

Would I see any issue here? I suspect everything I write or "install" via curl/bash/etc will be fine. Eg, if it's a downloaded binary in my $PATH, I expect it to continue to work.

So if that's the case.. why is Apple being so harsh about all of this? I feel like malware will just move to curl scripts and all Apple succeeded at was making normal Apps more difficult to develop.

I imagine some might argue that users will be _somewhat_ informed, and will know not to run stuff in a Terminal. Cool.... but, how many times have we seen non-technical folks run stuff in the Windows command prompt? They can be walked through a malware installation process a thousand times over.

So is Apple going to lock the entire platform down? Are they going to limit my ability to run binaries? My own and others? Because if they don't, this all feels pointless. And if they do, i'l _be forced_ to switch to Linux.

I don't like you these days Apple. What is wrong with you.

<comment><USER21> > So if that's the case.. why is Apple being so harsh about all of this? I > feel like malware will just move to curl scripts and all Apple succeeded at > was making normal Apps more difficult to develop.

The goal is to prevent users from running untrusted applications or mistrusted applications like trojans. If you can convince the user to click through a security warning or run commands from the terminal, then the user themselves have taken responsibility for evaluating trust.

The current system does depend on the user having appropriate 'spidey sense' to what the developer is asking them to do - the yardstick is a certain level of informed consent. If malware driving the user through terminal prompts becomes a significant user problem, that may unfortunately lead to the system being locked down further.

FWIW, other more serious changes (such as disabling SIP) go beyond a terminal command or requiring a password, to requiring you to reboot onto the rescue partition. Here, they are requiring a much higher degree of informed user consent.

</comment></comment><comment><USER37> I kind of blame UX and bad incentives for this. Most of these attempts at curating installation all started as well intended means of keeping malware out of the OS. If you think it's bad today, you forgot what it was like 20 years ago.

However, the evolution of platform protection slowed down as it became clear this was an amazing revenue generator. Incentives became blurred. A new type of malware showed up aimed purely at collecting your data, and our protections haven't kept up, because that's no longer the goal.

</comment><comment><USER38> Companies are in the business of making money. Once they find out they can make more money by not supporting your use case, they will toss you to the curb.

At this point, Apple does this by being a nearly completely consumer focused company. If you aren't the average consumer, they are going to toss you to the curb someday.

</comment><comment><USER39> Does the notarization licence covers the iOS store or do we need to buy both licences?

<comment><USER40> Notarization costs nothing.

But it's $99/year to be a part of the Apple Developer program which covers all platforms.

<comment><USER41> It specifically says that "Software distribution outside the Mac App Store" requires "Apple Developer Program" which costs 99 USD here: [https://developer.apple.com/support/compare- memberships/](https://developer.apple.com/support/compare-memberships/)

</comment></comment></comment><comment><USER42> This is both the most compelling and poetic argument in the article, and the most wrong:

> _"Apple's vision involves us constantly updating work, constantly adding to > our games, constantly paying to exist here, even when some of this stuff is > done. Often when a game is done, it's done. Games aren't a service. It's > like asking for a director to keep updating a movie, or for a musician to > keep changing their song so it can keep running. Decisions like this erase > our history."_

On the contrary, you chose an ephemeral medium for your art. That choice, like making sandcastles, has consequences.

</comment><comment><USER43> "I was looking into the requirements and I cannot afford $100 a year."

I don't understand how someone can't afford a $100/year expense on something related to their occupation.

<comment><USER44> If they pay the expense, will their income increase by more than $100 per year? (not even counting the value of the hours it will take to notarize and renotarize apps)

<comment><USER45> There are no guarantees but, statistically, Mac and iOS users are far more likely to make purchases than all their other counterparts combined.

</comment></comment></comment><comment><USER37> I kind of blame UX for this. Most of these attempts at curating installation all started as well intended means of keeping malware out of the OS. If you think it's bad today, you forgot what it was like 20 years ago.

However, the evolution of platform protection slowed down as it became clear this was an amazing revenue generator. Incentives became blurred, and it's why you have so much malware on the App Store masquerading as casual games.

</comment><comment><USER46> So, I make game engine, Corona SDK. It is indie game engine. No issues with notarizing occurred. I really don't understand what all the fuss is about:

* once notarized, always notarized. You don't have to continue to pay for old apps to work

* You can notarize old apps, same as new apps

* It is very easy. One command line command. That's that. There is also GUI wrapper for it, our user like. But in the end, it is very easy to do.

<comment><USER47> Sure, the article even links to a page describing the process: [https://www.molleindustria.org/blog/notarizing-your- flashair...](https://www.molleindustria.org/blog/notarizing-your-flashair- applications-for-macos/).

</comment></comment><comment><USER48> Windows: Spies on you and shows you ads.

Apple: Censors and controls everything you do on your computer.

Linux: Neither of the above. It's your computer.

The choice seems clear to me.

</comment><comment><USER49> One thing I don't see people talking about on here is.. html5. Probably the greatest number of individual indie games are games made to be played in the web browser.

It strikes me that as a developer if you can't afford $100 and just want to make games, why not make them in the safety of the browser sandbox?

<comment><USER50> What if it's a graphically/resource intensive game that would necessitate running it natively? Imagine trying to run an Unreal Engine equivalent in webgl for example.

</comment></comment><comment><USER51> Hehe, hopefully it's just more fodder for an anti-trust case 1-2 years from now.

</comment><comment><USER52> Apple has lost its way.

<comment><USER53> Apple is exactly on its way, as it's always been. You've just been crushed under its wagon.

</comment></comment><comment><USER54> Yeah, I'm never going to own any Apple crap with these kinds of policies. Pay a crapload of money for a locked down product that you don't really seem to own. No thanks.

</comment><comment><USER55> As an indie software creator, consider that you likely don't have the resources to be a _software publisher_ yourself.

Software publishing is a separate job, a separate comparative advantage, and just because you want to be in ultimate control of your software doesn't mean you can't delegate or contract out that job.

Depending on your size and your publisher's size, you might delegate any of these responsibilities to them:

• their core responsibility: handling the jumping-through-hoops required by each distributor/retailer (in these days these are the app stores) and doing any ongoing liasing with them, leaving you free to just have your publisher as a single point of contact

• doing any extra QA passes required to get your work accepted by each distributor/retailer (and sending the bug-reports back to you)

• learning about changes in your software required to comply with the distributor/retailer's policies, and either reporting them to you, _or_ fixing them themselves, making each of their "ports" into a downstream of your upstream codebase with their fixes living in it

• handling ongoing codebase changes required to evolve your code to comply with minimum-runtime targets of each platform—in effect, giving them commit access to your upstream codebase (though they _can_ do this as a downstream fork, I wouldn't recommend it)

• porting your software to platforms that you can't afford to support yourself (because e.g. the SDK is ridiculously expensive), creating separate "port" forks of the codebase, or perhaps even entirely new codebases that just share art assets

\---

If you're an indie shop, getting a publisher has always been a necessity to sell on the more closed-down stores, like the console marketplaces.

Well, that onerous-ness is just becoming more universal.

That doesn't mean you're out of the market! It just means you have to take the idea of acquiring a publisher more seriously.

And that doesn't mean that your publisher will bilk you out of most of your profits, either. Especially in the Apple case, the fixed costs on the publisher's part are pretty small, so development houses have a lot of negotiation room. You might get away with just paying a publisher a fixed fee to handle the glue-work.

Or, on the complete opposite end of the spectrum, if you just want to "write something then never touch it again", you could just sell your codebase as IP _to_ the publisher, or make some arrangement where you keep the IP, they can make whatever derivative products they like, and you get royalties on those.

</comment><comment><USER56> Last time I used a MAC within 5 minutes it asked me for an F-ing credit card. Why would anyone expect a platform that can do that to be anything but a walled garden?

</comment><comment><USER57> Stop supporting walled gardens, this has been a long time coming. Protect your rights, use free/libre software.

</comment><comment><USER58> One way may be to make distribute games as VM images that can "just work" in VMWare or VirtualBox. Use one of those bare metal frameworks for .net that just need a simple loader to start up. This will have the added advantage of working on Mac or Windows or Linux with one binary. It's not that hard to boot a vm that's ready to go.

<comment><USER55> Or, if you're a fan of the retro aesthetic, just develop "home-brew" games for old consoles, and distribute (sell?) them as ROMs.

 _Everything_ can run e.g. GBA ROMs: your phone, your tablet, your modern PC/Mac, your 20-year-old PC/Mac, your smart TV. Everything. They even run just fine in web browsers through WASM emulators. Web browsers _on phones_. It's kind of ridiculous.

Maybe, on Windows or whatever other arches you are a deft hand with, you can package in a cute little customized emulator to wrap the ROM. (Use a GPLed one; it won't be viral to your ROM.) But ensure you leave the ROM freestanding in a directory for people to use as they wish, rather than hiding it inside the executable. (And, maybe, offer a ROM-only version of the download as well.) If you stop maintaining your installer, the emulator might stop working, but the ROM itself never will.

</comment></comment><comment><USER59> Apple's goal is obviously not security, nor is it to force things to work with the latest version. The purpose is to break backwards compatibility of the apps themselves. Make apps stop working on older versions of the OS. And the OS isn't supported on hardware more than a few years old. So your software you depend on breaks and requires an OS update and an OS update requires a hardware update and a hardware update costs $2,000 if you're lucky and 12,000-$20,000 if you have a lot of peripherals like color laser printers and scanners and audio converters that no longer have working drivers and the only option is to buy a new one of each.</comment>


Websites to visit as a software developer – 2019 - <AUTHOR> https://milapneupane.com.np/2019/11/04/10-websites-to-visit-as-a-software-developer/ <comment><USER2> Websites you can't visit? I think this page is being served with an incorrect mimetype as it triggers a download dialog in the browser.

</comment><comment><USER3> This is such lazy garbage that it almost feels like satire to have it in my HN news feed.</comment>


Z - Jump to directories that you actually use. - <AUTHOR> https://github.com/rupa/z <comment><USER2> I use fasd, which is just like z, v, autojump, only much more powerful: <https://github.com/clvv/fasd>

<comment><USER3> you get + 100 karma for posting that. I can't believe I didn't come up with something similar in all these years

</comment></comment><comment><USER4> No tricks, just regular cd:

      % pwd
      /home/aram
      % cd mstate
      /home/aram/src/launchpad.net/juju-core/mstate
      % cd go/src
      /home/aram/go/src
      % cd plan9
      /home/aram/plan9
      %

It uses the $CDPATH environment variable ($cdpath in rc(1)). $CDPATH is a list of places in which to search for the wanted directory. I put all the things I regularly use there, and my cds are almost always short, usually just a single name.

I don't maintain $CDPATH myself, my profile runs a one liner that descends into certain directories and constructs $CDPATH for me within the constrains of some rules (for example excludes leafs, excludes {bin,doc,pkg,test}, etc).

Finding about $CDPATH was a huge productivity boost to me, not only in time saved typing, but in allowing me to change the way I work. I now rarely care where things in the filesystem are (e.g. various source code for various software, where the build products are, etc). I used to do a lot of moving and symlinking around, to arrange stuff so I remember where I've put it and to keep paths short, but now I don't care. It could be wherever, it's just one name away. The namespace had become a big hash.

<comment><USER5> Just tried this to see if tab-completion works. It does (only for _cd_ of course). BTW: what is "rc(1)"?

<comment><USER4> Rc(1) is the Unix v10/Plan 9 shell[1] written by Tom Duff[2], of Duff's device[3] fame. Rc(1) is of course available in Unix as well, I use the port from plan9port[4].

[1] <http://doc.cat-v.org/plan_9/4th_edition/papers/rc>

[2] <http://en.wikipedia.org/wiki/Tom_Duff>

[3] <http://en.wikipedia.org/wiki/Duff%27s_device>

[4] <http://swtch.com/plan9port/>

</comment></comment></comment><comment><USER6> Fish-compatible version: <https://github.com/sjl/z-fish>

<comment><USER7> Thanks for that, added! It looks pretty promising.

</comment></comment><comment><USER8> I've been using a tool called autojump that does a similar thing and I love it.. <https://github.com/joelthelion/autojump>

Tools like Z and autojump are fantastic timesavers.

</comment><comment><USER9> If you like his Z, check out his V (if you use Vim).

<https://github.com/rupa/v>

</comment><comment><USER10> CDPATH, as desribed in man bash

'The search path for the cd command. This is a colon-separated list of directories in which the shell looks for destination directories specified by the cd command. A sample value is ".:~:/usr".'

</comment><comment><USER11> In case anyone else is wondering what "frecency" is:

Frecency is a portmantaeu of 'recent' and 'frequency'. It is a weighted rank that depends on how often and how recently something occured. As far as I know, Mozilla came up with the term.

</comment><comment><USER12> I have been using this--very handy. Is there a version that doesn't cd? It'd be nice for ls, etc.

<comment><USER13> just use an alias wrapper like:

      alias zls='z \!*;ls;cd -'

(with additional zll etc for ls -l or -a)

</comment></comment><comment><USER14> Is this good for zsh? Is there a preferred alternative?

<comment><USER15> It works just fine with zsh. If you're on a mac you can easily install z (and keep it up to date) with `brew install z`

<comment><USER16> FYI - The caveat for how to set up z for zsh were wrong in brew. I just submitted a pull request to fix this.

<https://github.com/mxcl/homebrew/pull/14621>

<comment><USER17> Great, updating brew asap!

</comment></comment></comment></comment><comment><USER18> Shameless plug: Bash function to jump back in path

<https://gist.github.com/1119556>

<comment><USER19> In bash, you can just _cd -_ to pop back to the previous working directory, like _popd_ without the _pushd_.

I also set .bash_profile aliases to quickly cd up the directory tree with just dots. It's silly, but surprising helpful.

      alias ..='cd ..'
      alias ...='cd ../..'
      alias ....='cd ../../..'

<comment><USER20> I like that idea, I could definitely see it being helpful. I've type _cd.._ too many times when I meant to say _cd .._

<comment><USER19> me too. That's why I also:

      alias cd..='cd ..'

:)

</comment></comment></comment></comment><comment><USER21> Posz for Powershell - <https://github.com/manojlds/posz>

</comment><comment><USER7> Does anyone know what the initial --add is for? I'm using z-fish and I'm wondering if I can elide it.

</comment><comment><USER22> It's a wonderful little tool. I love it. Give it a try, you won't regret!</comment>


Samsung Galaxy Ace Plus S7500 Review and price in UK,USA and India. - <AUTHOR> http://techdistance.com/samsung-gahttp://techdistance.com/samsung-galaxy-ace-plus-s7500-review/laxy-ace-plus-s7500-review/

<comment><USER2> Nice neat and clean article given..</comment>


A secret call to Andy Grove that may have helped Apple buy NeXT (2018) - <AUTHOR> https://www.cake.co/conversations/g4CP6zJ/the-secret-call-to-andy-grove-that-may-have-helped-apple-buy-next <comment><USER2> I think the main long term benefit of buying NeXT was getting Steve back. I left Apple a year or so before this happened (I remember Gil being all excited talking about Apple to the staff right before he realized what a disaster it was and we never saw him again around Infinite Loop) but I left because I was sure doing what they were doing would be the end of Apple. The OS and kernel were nice, the smart people from NeXT made a huge difference, but Steve was, Steve.

If I'd know this would happen I would have never left.

<comment><USER3> Classic MacOS was a disaster once multitasking became a needed feature, and Copland (its in-house replacement) wasn't going anywhere. The only other option would have been to buy Be, to get BeOS. That could have worked too, BeOS was great (and its modern clone Haiku is fun too), but it was clear Apple needed _something_ from outside.

<comment><USER4> Multitasking was needed and Be could have filled the Darwin gap but what they really needed was a leadership kick in the head. Steve was hired, almost immediately led a coup that ended up with Gil gone, the board disbanded and him with near pure control over the company. He fired, chopped, focused, and brought operations to the point where they were not lighting their cash on hand on fire. The business turnaround story is amazing, forget the creative factor and all that, the only reason Apple is still around is that he walked in and rapidly course corrected a company that wasn't even his anymore. He wasn't anything when Gil bought NeXT, his title was just "Advisor" to the CEO. A hilarious title. The magic of the next purchase was that it saved Apple way more money than it cost by effectively letting in a "Good" virus that infected the company's management and cut the cruft fast. '97 Steve had had 10 years of startup OPs pain under his belt.

<comment><USER5> Classic MacOS had multitasking (cooperative...), but it was missing memory protection. The same was true of earlier 68K-based OSes (Atari, Amiga.)

<comment><USER6> The problem with cooperative multitasking is that a SINGLE poorly behaved process in the background locks up the whole operating system. This leads to a horrible user experience.

As a user of the old Mac OS 8 I had no idea what the cause was. I just knew that once I ran into the spinning wheel of doom I was likely to have to reboot. Again.

Preemptive multi-tasking is worse in every way except that one. I mean that you get more bugs, have more overhead from locking, less throughput, and so on. But when the application runs into trouble, the operating system is still able to react to you.

<comment><USER5> Yes, the Amiga had preemptive multitasking, but no memory protection, and the situation wasn't really any better. A single rogue process could bring down the whole system by overwriting parts of the OS.

<comment><USER7> Guru Meditation :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Slightly Off Topic.

I consider both Andy Grove and Steve Jobs as the greatest CEO ever lived in Silicon Valley. ( Sorry it is hard to pick just one between the two )

Current Generation are Patrick Gelsinger ( VMware ), Jensen Huang ( Nvidia ). Satya Nadella ( Microsoft ) and Lisa Su ( AMD ) are two possible candidate but I think it is still too early to tell.

Sometimes if I think if I did't set the bar so high for Apple, Tim Cook would be on the list as well. But their doing on Mac still leaves a bad taste in my mouth so I am not quite over with it yet.

What other Great CEO are there in Silicon Valley's history?

Edit: Looking at this list just now makes me realise all the CEO I considered as _great_ are product CEO. Which sort of got me thinking as to why I don like Tim Cook as much, he is simply not a product person.

<comment><USER9> Tim Cook arguably made Apple what it is today. Without him, Apple might've had great products but failed miserably in the supply chain management side of the business. It's telling that after Jobs, Apple didn't slide into irrelevance but instead continued to thrive.

Tech aficionados (myself included) might have qualms about their product strategy, but overall the business continues to be wildly successful with regular consumers.

<comment><USER10> "It's telling that after Jobs, Apple didn't slide into irrelevance but instead continued to thrive."

Tim Cook is clearly incredibly important to the success of Apple, but from a product perspective it is a refinement of all the products Steve Jobs launched that still carry the company. Those products are faster and slicker and have better cameras -- the innovations afforded to a hyper-profitable company -- but it isn't like Apple has done a 90 degree turn or anything. They aren't a smartphone/pad/computer company that turned into a smartcar/massage chair company.

<comment><USER11> > it is a refinement of all the products Steve Jobs launched that still carry > the company

Not really. You could say that the iPhone still carries the company, but with the exception of that outlier newer initiatives like Services and Wearables/Home/Accessories bring in way more money than products that Steve Jobs launched (Mac and iPad).

<comment><USER10> Not really? Then you casually say "if you exclude the iPhone" which kind of undercuts the entire argument, doesn't it?

70% of Apple revenue comes from the iPhone, iPad, and Mac. Services revenue is entirely and absolutely based upon that, and certainly didn't originate post Jobs.

Even the Watch -- have one and love it -- exists on the back of the iPhone.

So, yeah, really.

Everything Apple has done that has been successful since Jobs is entirely in the halo of the iPhone, which of course still accounts for the vast bulk of Apple's profits.

</comment></comment></comment></comment></comment><comment><USER12> After Steve left, and Apple was floundering I wanted Sun to buy Apple. I was working with Wall Street Companies at the time and I tried my best to make it happen.

I also worked with Scott McNealy here and there and brought it up to him a couple of times. Once he said to me, "Apple's not worth having without Jobs, and Apple doesn't need anyone else if they have Jobs."

So I knew Sun would never buy Apple.

<comment><USER13> Imagine if Oracle ended up owning Apple. Unthinkable.

<comment> yjftsjthsd-h One would hope that Apple+Sun would have been successful enough to never be acquired by Oracle.

</comment></comment></comment><comment><USER14> > And that's when Andy lost some credibility with me. I can't remember exactly > what he said about future speeds, but I seem to remember 400 megahertz or > maybe even more. Oh, please. You're claiming 10x more than Motorola?

Discarding numbers out of hand, at least those number actually were fictional. Reminds of a recent comment on HN where people twisted themselves into knots ignoring numbers they could easily reproduce themselves: [https://news.ycombinator.com/item?id=22590983](https://news.ycombinator.com/item?id=22590983)

<comment><USER15> I _love_ this story so much because of that paragraph specifically. (I had read it before but couldn't find it anymore. Happy to see it show up again!)

> _The only thing more insane was Intel's 80486 running at 66 megahertz! Can > you imagine? I was a_ physicist, _I should know._

It's so perfect! I'm glad he gives us the benefit of his hindsight.

</comment></comment><comment><USER16> Fantastic read. Once again, the chaotic nature of our future unfolding.

These days, the scientists that advise our countries' leaders about the pandemic can make a difference as Chris MacAskill made back then.

<comment><USER17> Thanks! The fascinating thing is I had been a geophysicist for 10 years before joining NeXT, so all my instincts were to approach this as a scientist. When I see Dr. Fauci speaking the best known truths despite the political winds, it resonates with all I know of science -- speak the truth as best you know it and history will forgive you later.

<comment><USER18> The truth is immutable -- that's what makes it so successful.

<comment><USER19> The challenge is to ensure that what you say is the truth. It's often difficult to talk about science casually without erroneously confusing factual evidence with our best, tentative conclusions.

</comment></comment></comment></comment><comment><USER20> It's crazy to think that if:

1\. Apple had bought Be instead of Next.

2\. Then OS X would have been based on BeOS instead of OpenStep.

3\. Which in turn means it would have been written in C++ instead of Objective-C.

4\. Which means iOS wouldn't have chosen Objective-C.

5\. Which means Swift would never have been created to address its shortcomings.

Maybe there would have been some alternate-universe Swift to deal with C++'s shortcomings, but it would likely be a _very_ different language. If nothing else, the lack of keyword arguments would lend a very different feel.

<comment><USER21> I wonder then if iOS would've ever happened. Probably not, unless they still somehow got Steve Jobs.

Apple at least incidentally got some of the benefit of BeOS, or really, the talent behind it: Dominic Giampaolo, who contributed significantly to BeFS, has been with Apple for some time now working on their file systems. I think he is/was a principal on APFS. I'm sure there are others!

Also, muni! From robot frog!

<comment><USER22> The Newton team ended up becoming the BeInc team. iPhone might have happened earlier. BeInc in 1999 focus shifted to internet appliances and had tablets on their minds. The iOS revolution would have happened 5 years earlier.

</comment></comment></comment><comment><USER23> previously: [https://news.ycombinator.com/item?id=17609813](https://news.ycombinator.com/item?id=17609813)

</comment><comment><USER24> " he would ask who on planet earth is the best person to pull off something impossible and he would do anything to hire them." Steve</comment>


The Guardian walks back claims of direct NSA access to servers of tech companies - <AUTHOR> http://www.mediaite.com/online/fulsome-prism-blues-the-guardian-offers-2nd-worst-clarification-ever-on-nsa-story/ <comment><USER2> A lie gets halfway around the world before the truth gets its pants on. This story made it 1/3rd up the front page; stories based on the most extreme possible interpretation of what seems to be Greenwald's own extreme interpretation of a slide deck covered the entire front page for days. Remember when "direct access" meant Palantir was a third party doing the actual collection? Just look at their name! Remember when all of Facebook and Google and Yahoo's denials looked "suspiciously similar"?

Someone on Twitter (sorry) said that Google and Facebook "looked like angels" compared to Verizon. That sounds about right to me, too. But what incentive do they have to do that when their reward is conspiracy-theoretic nonsense about how NSA has their TLS keys and 3rd party contractors are used to keep them from "lying" when they say NSA has no direct access?

<comment><USER3> >A lie gets halfway around the world before the truth gets its pants on. This story made it 1/3rd up the front page; stories based on the most extreme possible interpretation of what seems to be Greenwald's own extreme interpretation of a slide deck covered the entire front page for days.

There's definitely some extreme speculation going on--both from those trying to maximize as well as those trying to minimize this issue. It will take some time to get to the truth. This article is a perfect example of an extreme attempt to minimize this issue.

This article seeks to minimize the Guardian's original story by saying the Guardian is "walking back" their claims. That doesn't seem to be the case. This article cites a paragraph near the end of a minor story published days later as the passage where they "walk back" their original story. The intent of the paragraph seems to be to illustrate that both the "direct access" claim from the NSA and the "no direct access" claims from tech companies can both be true. The original article doesn't seem to be changed.

Beyond that, the Guardian never claimed the NSA had "direct access". They claimed that the NSA slides stated the NSA had direct access. The Guardian has not stated they read too much into "direct access" in the slides, and the original article is pretty clear that "direct access" is simply the NSA claim in the slides, not the Guardian's verdict.

There is another remaining issue: the original article claims access to "live communications", which has yet to be supported by a slide, but it would pretty much rule out the SFTP-only possibility that some people seem to be accepting as fact at this point. Maybe there is direct access to live information from Skype and Apple, but Google insisted on SFTP? We still have a lot to find out.

It could be that the Guardian did exaggerate. But it is far too early to conclude that with so many questions remaining. Not all the companies have described their systems.

One thing is certain: the Guardian does not seem to be walking back their claim.

<comment><USER2> How is running a story that defines "direct access" as a "dropbox system" where "legally requested data could be copied from their own server out to an NSA-owned system" possibly not a walk-back, given Greenwald's original story?

<comment><USER3> The original story is a report about the "direct access" claim from the NSA. People seem to have interpreted the article as claiming as fact that the NSA had a root password to all the companies' servers, but that's not what the Guardian reported. They simply reported an NSA claim.

This separate article covers the story that the original article broke. This paragraph in the article gives an attempt to reconcile the competing claims from the NSA and the companies. What makes you say this attempt should invalidate the original story?

<comment><USER4> The Guardian's original story [http://www.guardian.co.uk/world/2013/jun/06/us- tech-giants-n...](http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants- nsa-data) really does seem to be specifically claiming NSA root access or the equivalent:

> When the FAA was first enacted, defenders of the statute argued that a > significant check on abuse would be the NSA's inability to obtain electronic > communications without the consent of the telecom and internet companies > that control the data. But the Prism program renders that consent > unnecessary, as it allows the agency to directly and unilaterally seize the > communications off the companies' servers.

As soon as people suggested that "collection directly from the servers" actually meant a FISA workflow-automation system involving an API and maybe dropbox servers, Glenn Greenwald indignantly denied, or maybe didn't understand, the possibility that the companies' statements could actually be compatible with the PRISM document [https://twitter.com/ggreenwald/status/343421926057861121](https://twitter.com/ggreenwald/status/343421926057861121) [https://twitter.com/ggreenwald/status/343422182589870081](https://twitter.com/ggreenwald/status/343422182589870081) [https://twitter.com/ggreenwald/status/343423399609131008](https://twitter.com/ggreenwald/status/343423399609131008) [https://twitter.com/ggreenwald/status/343423727066824705](https://twitter.com/ggreenwald/status/343423727066824705) . Meanwhile both the Washington Post and the Guardian started backing down from the NSA-has-root idea. The paragraph WaPo added to its original story

> It is possible that the conflict between the PRISM slides and the company > spokesmen is the result of imprecision on the part of the NSA author. In > another classified report obtained by The Post, the arrangement is described > as allowing "collection managers [to send] content tasking instructions > directly to equipment installed at company-controlled locations," rather > than directly to company servers.

plus the later story it printed [http://www.washingtonpost.com/world/national- security/us-com...](http://www.washingtonpost.com/world/national-security/us- company-officials-internet-surveillance-does-not-indiscriminately-mine- data/2013/06/08/5b3bb234-d07d-11e2-9f1a-1a7cdee20287_story.html) both help to make clear that the Post did intend its original PRISM story to be understood as NSA-has-root.

<comment><USER3> I agree that whether or not the NSA can pull records from these companies without the companies meaningfully reviewing each request is a very important detail.

"But the Prism program renders that consent unnecessary, as it allows the agency to directly and unilaterally seize the communications off the companies' servers" is a strong statement. I agree that it is probably not compatible with the details Google has divulged about its "SFTP and manually by human only" process. But that is only one of the many companies.

I understand the "slides or GTFO" attitude that I'm seeing in these claims that the original story is inaccurate, but I think it's a bit arrogant and premature. A journalist who has seen the entire slide deck continues to tell us that the nature of what the whole presentation reveals is more invasive than a digital lockbox with workflow management software where humans meaningfully verify, evaluate, and approve requests. He could have misinterpreted the slides, but I doubt he would stick to the report so steadfastly once all these objections arose if he were not pretty confident he understood the claims in the Prism presentation.

We shouldn't accept that the NSA can grab a user profile without explicit, individual legal approval from the company as fact yet--there's a lot more we will hopefully learn. And how true this is could vary from company to company. But it's silly to ignore that a credible voice who has seen the presentation is telling us something.

<comment><USER4> I would be slow to assume that anything is known for certain in this kind of "spook biz". I also don't assume that everything interesting has been released on the slides already. (For example, there's interesting reporting in the first Guardian story about what happened to FISA 702 request rates since PRISM was introduced which includes quotations from the slides, but hasn't got much attention seemingly because the relevant slide or slides have not been reproduced yet.) However, there a couple of things that make me fairly confident Greenwald is (or was? I'm not sure if he is still standing by his claim) wrong about this.

One is that AFAIK the Guardian and the WaPo both have access to all the same materials Greenwald has, and they have both been backing away from the NSA- has-root claim for some time. But an even bigger factor is how Greenwald defended his claim. If he'd said "there's still-unreleased material which proves me right, hold tight" that would be one thing. But instead he quoted the "collection directly from the servers" text and linked the new slide it came from, implying that the quotation unambiguously ruled out the drop- box/API interpretation and supported the NSA-has-root interpretation. But in fact "collection directly from the servers" is not at all unambiguous between the two interpretations. And even worse, the You Should Use Both slide, which Greenwald produced as his trump card, provides context which clearly undermines the NSA-has-root interpretation! In that slide it's clear that "collection directly from the servers" is being contrasted with upstream collection of IP data from the telcos. The fact that Greenwald evidently didn't pick up on this himself is pretty clear evidence that his understanding of the presentation is imperfect, whether because it's being distorted by his desire for a bigger and more damning scoop or just impeded by a lack of technical savvy.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Steve Gibson suggests [1] that _direct access_ means, direct access to their _internet pipes_ , effectively tapping or mirroring their content for analysis. He says that "direct access" has more meaning to non-techies than saying they "are listening at the upstream router". Very interesting podcast too. The $20 million per collection point, is to build the secure secret rooms [2] at their [google, facebook, apple, microsoft, etc] telecom providers, slip the fibers, and for all the gear they need to do it. He even suggests this is legal, since it is the open internet and anyone is allowed to peer into the traffic, since this is not actually in any of their [google, facebook, apple, microsoft, etc] data centers, but at the peering level.

[1] [http://twit.tv/show/security-now/408](http://twit.tv/show/security- now/408)

[2] [http://en.wikipedia.org/wiki/Room_641A](http://en.wikipedia.org/wiki/Room_641A)

<comment><USER6> I am not a network expert, but won't most of that data still be encrypted through SSL? If that is the case, it would be almost useless since sites like Facebook and Google have made the transition to defaulting to using SSL.

<comment><USER7> That may be true. However, the giant elephant in the room is the Utah data center.

This is a data center designed to, supposedly, store data on the scale of a yottabyte. I only say "a" yottabyte, because to assume even slightly greater than that is sheer lunacy.

That is freaking massive. If you took all terrorist cells and all terrorist activity for the history of terrorism and terrorist activity, you would not even touch a fraction of a percent utilization. We're talking rain drops in the ocean.

There is no way the NSA is merely watching the bad guys here. The data center is a few magnitudes too large for such a task.

I would assume right now they are merely recording all data, in hopes that one day they will have technology to quickly crack encryption. However, even without knowing what is said (the content), the metadata of connections gives plenty of information on what people are doing.

<comment><USER2> That Utah data center is literally the Internet's Area 51.

<comment><USER8> "literally" :)

and yes, agreed - analogous on so many levels - a publicly admitted places where secret government things happen, which can be invoked to give an aura of reality to conspiracy theories true and false alike.

</comment></comment></comment></comment></comment><comment><USER9> So the Gaurdian appears to have done some very very shoddy reporting. But isn't this all a distraction?

FTP or direct acces, it makes no practical difference if the employee on the other end rubber stamps the requests when they get them. The real question is how much data can the NSA get and what procedures do they have to prevent the targeting of US person?

what checks does e.g Google actually run on the requests? If the procedure is email email@example.com and then some google employee rubber stamps it and sticks the data in an SFTP server, the NSA effectively has unfettered access.

Its clear that you don't need a warrant for targeting a foreign person, so the employee can't check that it came for FISC. Even if they did, FISC seems to be willing to rubber stamp things themselves. So aside from maybe checking if the account is typically accessed from a US IP, whats Google going to do? I pick on Google here specifically only because they have a reputation for trying to automate everything including a lot of customer support and I suspect that if they don't have any discretion on these cases, they may well have automated it.

Of course, maybe they didn't, maybe there are rigorous checks both at the NSA and at the receiving companies. But we don't know and we need to.

<comment><AUTHOR> Google has directly contradicted what you are saying about rubber stamping requests. See [http://googleblog.blogspot.com/2013/06/what.html](http://googleblog.blogspot.com/2013/06/what.html) and [http://googleblog.blogspot.com/2013/06/asking-us- government-...](http://googleblog.blogspot.com/2013/06/asking-us-government- to-allow-google-to.html).

For example: "Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don't follow the correct process."

<comment><USER10> They may be lying. If there's a gag order, they may be required to lie. Or they may consider "review" not to necessarily be human review. Or the person writing that may simply not know. We don't know what's going on at google, and with no transparency, it's hard to have a lot of trust, particularly since there are many examples of government overreach in the past.

Sure, google and facebook and whatever should push back, but it's clear that if the government really wants to abuse its power, they won't stop it. Given the current witch-hunt on whistleblowers, it's clear that those in power do not appreciate being questioned. Trust is fine, but verification is better.

<comment><USER11> What would you consider transparency if your response to that is, "they might be lying."

<comment><USER10> Actual transparency, not just words? That could be free access to their internal architecture (not exactly likely), or more plausible, external, independent auditors.

However, I think you're focusing on the wrong party here - I think it's a lot more reasonable to request this of the government than of companies. There's no reason not to require the government to publish the general structure of what they're doing in great detail, and to let others make up their own mind if it's overstepping its bounds.

In short: I want an independent parties to have free access and be allowed to verify what's going on.

</comment></comment></comment></comment></comment><comment><USER12> The precise mechanism isn't important. The key question is: is there mass surveillance going on without warrants? And the answer appears to be yes. No one has disputed, for example, the Verizon leaks that started all this.

<comment> brown9-2 Technically the Verizon "leak" was a leak of a court order, so it has some legal merit. We can debate if it's fair or in spirit with the Constitution and 4th Amendment to issue such a wide-reaching court order, but it's not warrant- less.

<comment><USER13> Technically, it is a court order, not a warrant. So it is warrantless.

</comment></comment></comment><comment><USER14> Except that theory doesn't explain the public statements either.

Google has specifically denied having a drop box facility:

"We cannot say this more clearly—the government does not have access to Google servers—not directly, or via a back door, or a so-called drop box."

[https://plus.google.com/+google/posts/TMh6gUVrwMq](https://plus.google.com/+google/posts/TMh6gUVrwMq)

Among other features WashPo specifically describes live interception which would require more sophisticated integration than a mere drop box facility:

"Google's offerings include Gmail, voice and video chat, Google Drive files, photo libraries, and live surveillance of search terms."

[http://www.washingtonpost.com/investigations/us- intelligence...](http://www.washingtonpost.com/investigations/us-intelligence- mining-data-from-nine-us-internet-companies-in-broad-secret- program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story_3.html)

Not to mention NYT's independent source:

"In one recent instance, the National Security Agency sent an agent to a tech company's headquarters to monitor a suspect in a cyberattack, a lawyer representing the company said. The agent installed government-developed software on the company's server and remained at the site for several weeks to download data to an agency laptop.

In other instances, the lawyer said, the agency seeks real-time transmission of data, which companies send digitally."

[http://www.nytimes.com/2013/06/08/technology/tech- companies-...](http://www.nytimes.com/2013/06/08/technology/tech-companies- bristling-concede-to-government-surveillance- efforts.html?pagewanted=2&_r=0&hp)

<comment><USER3> It's important to remember that there are many companies involved here. PalTalk's direct access could be a begrudgingly set up teletype of live chat transcripts while Apple could have provided a VPN connection and a root password. We don't know yet know what access was sufficient to be a part of the "direct access" Prism program.

It will be interesting to see what degree of commitment each of these companies showed to the privacy of its users. It appears that however Twitter was complying with requests, it wasn't as convenient for the NSA as Prism access...

</comment></comment><comment><USER15> The Guardian "backwalk" actually _VALIDATES_ our worst fears, albeit with technical nuances to ensure legality. It's really just about the only viable way to implement this absent an SSL encryption crack (I would guess they're dumping encrypted communications from Room 641A waiting for an encryption weakness to be discovered, that way they'll have _everything_ ). As Snowden said, you could wiretap the president if you have a personal email.

Here's how it works (this is my opinion as a web developer, not verified details from Snowden leak):

1) Fancy user interface developed by Booz Allen Hamilton. Enter email address (good choice for a unique identifier, used as unique key in many databases).

2) Backend uses curl to send a request to NSA-certified web api on each service shown on the slide. This serves as a legally-binding FISA request either regarding a foreign agent - no court order required - or a domestic agent - secret FISA court order required (see [http://www.npr.org/2013/06/13/191226106/fisa-court- appears-t...](http://www.npr.org/2013/06/13/191226106/fisa-court-appears-to- be-rubberstamp-for-government-requests)) and assumed to be fulfilled by the api.

3) Kick off NSA equivalent of gearman worker that checks contents of "dropbox"-like service from each company for updates.

4) Services (Google, Facebook, etc) automatically grant request without question as it is a legally binding FISA order. This saves them a ton of money and, hey, it's legal! They have some custom code that allows them to look up a user by their email address - almost guaranteed to be indexed in their database - join it to relevant data sets, and dump it to the "dropbox"-like system.

5) Fancy frontend shows progress bar, while skinny backend compresses retrieved data into zip file for easy download.

This is the most efficient, cost-effective way to do this without venturing into science fiction, ie storing a mirror of all the data which would be stupid on NSA's part. It still verifies our worst fears and answers the question as to how such a program can cost "only" $20 million per year as reported by the slides.

The trick is in the legal framework, not the technical details. This is why the FISA courts are secret.

<comment><USER2> _Here 's how it works (this is my professional opinion as a web developer_

        +++ATH0
        NO CARRIER

<comment><USER15> Yes I am a web developer that goes to work everyday in a professional environment.

<comment><USER2> In your professional experience as a web developer, maybe you could square this assertion:

 _Services (Google, Facebook, etc) automatically grant request without question as it is a legally binding FISA order_

... with the court order the NYT linked to from FAS, where Yahoo is seen to go several rounds with the FISC after having received a lawful directive from NSA to initiate surveillance?

From exactly what evidence do you argue that Google (or any other Internet company) automatically approves all FISA requests?

<comment><USER15> Snarky tone unnecessary. To which court order do you refer?

Edit: Also, your tweet quoting me sarcastically was also unnecessary. I'm trying to be helpful and you're being rude.

<comment><USER4> This is apparently the article. [http://www.nytimes.com/2013/06/14/technology/secret-court- ru...](http://www.nytimes.com/2013/06/14/technology/secret-court-ruling-put- tech-companies-in-data-bind.html)

<comment><USER15> Thank you :)

Relevant part of the article:

>In a secret court in Washington, Yahoo's top lawyers made their case. The government had sought help in spying on certain foreign users, without a warrant, and Yahoo had refused, saying the broad requests were unconstitutional. Related

>The judges disagreed. That left Yahoo two choices: Hand over the data or break the law.

>So Yahoo became part of the National Security Agency's secret Internet surveillance program, Prism, according to leaked N.S.A. documents, as did seven other Internet companies.

From the court order:

"After a careful calibration of this balance and consideration of the myriad of legal issues presented, we affirm the lower court's determinations that the directives at issue are lawful and that compliance with them is obligatory."

Seems to me that tptacek is supporting my hypothesis

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> which guardian article is being discussed? because if you look at [http://www.guardian.co.uk/world/2013/jun/06/us-tech- giants-n...](http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa- data) they are absolutely correct in what they report. everything is qualified with "the documents say...", etc.

<comment><AUTHOR> Are they? The Guardian has selectively released three or four slides out of 41. You can split hairs and try to come up with some contrived reading of the article that could be argued as accurate, but I think in reality everyone understood the article to be claiming that the NSA had unfettered access to the severs of tech companies.

<comment><USER16> they're reporters, not clairvoyants. their job is to tell you what the docs say. they told you, and they were right to tell you, because the information looked very interesting. you jumped to conclusions. and so they now have to apologize because you weren't as careful as they were?

they did their job as well as they could. they had what appeared to be interesting data, but instead of just saying, "wow, XXX" they were very careful to not go beyond what was said.

i jumped to conclusions too. but then i realised i was probably wrong. it happens. but i don't then blame the reporters who did their job reasonably well. _i made the mistake, not them._

</comment></comment></comment><comment><USER17> I think that Greenwald should've been more skeptical, regardless of how technical savvy he may or may not be. Look at the slide in question...in any other organization, that slide would be interpreted as a slide aimed at the newbies/idiots in a company...it pretty much literally says, using brightly colored bubbles: "Hey people, remember that we have _two_ systems for collecting data, so please use _both of them_. We even gave one of them an easy-to-remember acronym"

Isn't it possible that a slide written for newbies (within NSA, or those who work with the NSA) might have also been written by someone who is not an all- star in technical communication?

<comment><USER18> The Bob Cesca item this mediaite post is building on makes the case that Greenwald saw what he wanted to see:

 _I'm going to put it all out there and let the chips fall where they may: I'm increasingly convinced that Glenn Greenwald's reporting on the NSA story is tainted by his well-known agenda, leading him to make broad claims for the purposes of inciting outrage._

[http://thedailybanter.com/2013/06/greenwald-sticks-with- his-...](http://thedailybanter.com/2013/06/greenwald-sticks-with-his-story-in- spite-of-growing-questions/)

See also:

[http://www.rants.org/2013/06/11/epic_botch_of_prism_story/](http://www.rants.org/2013/06/11/epic_botch_of_prism_story/)

<comment> brown9-2 Greenwald's twitter feed of the last few days confirms this (in my mind) - many tweets praising those who are praising Snowden, comparing him to Ellsberg, etc, about how a survey shows X% of Americans think Snowden is a hero. It's not really what I would have expected of a journalist at a major newspaper.

</comment></comment></comment><comment><USER19> How would access to an FTP server that serves all the data one wants not be considered "direct"? I really doubt NSA analysts need shell access to do their dirty work...

<comment><AUTHOR> The point is that the companies decide what production data to deposit on these servers after their legal teams have reviewed FISA requests. According to the tech companies, these requests are individually reviewed and target individuals and are narrow in scope. And they push back when they are broad.

This detail is a major one. This would mean the NSA cannot simply log on to Facebook and query for whatever they want. It means the system is simply a way for companies to comply with FISA requests, something that they were already required to do.

So: even though Twitter doesn't use PRISM, there is really no difference between what the NSA can access on Twitter and what they can access on Facebook. Twitter just complies through some other manner.

<comment><USER20> I think that's a bit generous. They look over the request but if the result set is too large it couldn't be reasonably vetted by lawyers. Eg, they would have a look at it but we don't know how rigorous they are or could be.

<comment><AUTHOR> Yeah, I think the main point is that this is simply a way of responding to FISA requests, which are completely independent of PRISM. In other words, there is no new news here. The debate over FISA itself is certainly quite valid.

Google has claimed these requests are infrequent and narrowly focused, and they have requested permission from the government to publish some statistics. I hope they get it.

</comment></comment></comment></comment><comment><USER21> Just to recap, PRISM looks like a web front-end to a shitload of _other_ systems. This is why a relative noob like Snowden was working on it -- it was web work. It's also why he had such a broad overview of what was going on. He knew the direction and capabilities, if not the details. He was probably just hooking up APIs somewhere.

That's just guesswork, of course. I think it's easy for us (and the Guardian) to imply a lot of detail where none exists. I don't think the Guardian has anything to apologize for. It'd be great if we all got a better technical view of these systems. But asking to receive it third-hand through a leaker and a non-technical reporter is probably a bit much.

<comment><USER22> The Guardian could at least "apologize" for using "scare quotes" in the process of walking back their claim.

That's underhanded for _any_ media publication that aspires to the idea of "journalism".

In addition they could have at least mentioned the idea that other theories emerged as to what the slides they presented might actually mean that way people would be aware that there were other valid conclusions that could possibly be drawn, especially by those with tech and government experience.

<comment><USER23> The Guardian isn't walking back anything. The submitted article just takes another Guardian article about a different aspect of the story (article title: "NSA scandal: Microsoft and Twitter join calls to disclose data requests") and proceeds to call it a walk-back, which it is not.

<comment><USER2> No. Rather than issue a direct correction to their initial story which so falsely represented the facts on the ground that all of the US's largest internet companies simultaneously issued categorical denials, the Guardian ran another article that redefined the term "direct access", knowing (as they had to have) that their own original interpretation of the term, in black and white in Greenwald's original reporting, had been repeated as fact by numerous major media outlets.

<comment><USER24> If the tech companies have been slandered unfairly, why don't they sue the Guardian?

<comment><USER25> Because The Guardian has 19,998 more documents that they don't know the contents of.

<comment><USER3> If they have have acted properly, why should that stop them?

It's hard to lie effectively when you don't know how much of the truth is known.

<comment><USER25> Because nobody, probably not even at the NSA, is confident that they _actually know_ the full extent of what's going on.

<comment><USER3> So true. That's one of the most dangerous aspects of conducting this type of thing in the dark.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> Simple explanation of the original error -- the person who put together the slide deck wasn't exactly a dev on the technology itself.

It does call into doubt the credibility of Snowden's OPINIONS about the scope of NSA technology and procedures.

The technology error -- or more precisely the lack of rapid correction -- isn't one of Greenwald's finer moments, but in general he's done such an awesome job on this issue that I give him a pass on that blunder.

<comment><USER26> And by the way -- $20 million budget always meant PRISM was only a small part of the whole. Not realizing that was actually a dumber error on Greenwald's part than him taking "direct access" at face value.

</comment></comment><comment><USER27> I can help but think about the following point when looking at this. Do people really care whether access was direct or indirect if their own personal records have all been captured and/or seen/analyzed? It sure wouldn't matter to me how they pried their way in - it would matter to me that they had done it though.

</comment><comment><USER28> This is the best explanation I've read about how PRISM might work: [http://uncrunched.com/2013/06/11/connecting-the-prism- dots-m...](http://uncrunched.com/2013/06/11/connecting-the-prism-dots-my-new- theory/)

</comment><comment><USER29> It would seem to be relatively obvious to me, that would I be interested in partaking in a bit of terrorism, I would be relatively sure that using Skype, Facebook or Gmail would be a stupid idea. I think I would have deeply suspected that that was a stupid idea before PRISM, and now even more so since Snowdengate.

The idea that this technology is being used for anything other than mass control is bullshit. I don't want to sound like a member of the tinfoil-hat- brigade, but sadly, I just don't see terrorists using any of the resources offered by the PRISM mentioned US corporations. I do see a very dangerous threat to democracy.

</comment><comment><AUTHOR> An interesting article was just published with the headline "Greenwald gives away the game on his PRISM claim." He is continuing to walk back his original claims of direct access.

[http://littlegreenfootballs.com/article/42126_Greenwald_give...](http://littlegreenfootballs.com/article/42126_Greenwald_gives_away_the_game_on_his_PRISM_claims)

</comment><comment><USER30> I don't know, but it appears the message brigade is out in force now. Our initial shock is gone, and we are eager for more narrative. Now is the opportunity to cast doubt, to reframe, to discredit.

</comment><comment><USER31> [https://news.ycombinator.com/item?id=5844303](https://news.ycombinator.com/item?id=5844303)

</comment><comment><USER32> According to Greenwald, The Guardian is "not remotely" walking back any initial claims.

[https://twitter.com/ggreenwald/status/345315199257047040](https://twitter.com/ggreenwald/status/345315199257047040)

onekade: Confused about this. The Guardian "correction" doesn't walk back its initial claim at all. mediaite.com/online/fulsome…

ggreenwald: @onekade Not remotely - they're desperate to discredit all the spying, but it's not going to work. Documents are too powerful

</comment><comment><USER22> So in other words, the Guardian is saying that I'm right (again)? [https://news.ycombinator.com/item?id=5859493](https://news.ycombinator.com/item?id=5859493)

<comment><USER33> I think it's possible that Steve Gibson is right on this week's Security Now podcast. He suggests that perhaps the NSA has tapped into the ISP just upstream of the 9 companies listed. Then, they copy all of the data coming into and out of the fiber going to the Google datacenters. This fits with the name Prism, and is corroborated by the 2006 revelation about the NSA- controlled room in the ATT building in San Francisco.

Edit: this does rely on the NSA having access to routers, not servers, so it still isn't exactly what they said

<comment><USER34> With a 20M budget?

<comment><USER20> Prism might only be part of it, there are ways of breaking up projects in budgets obviously. It could just feed the data into another system

</comment></comment></comment></comment><comment><USER35> Anyone else think they are playing "Rope a Dope"?</comment>


Opauth: Multi-provider authentication framework for PHP, inspired by OmniAuth - <AUTHOR> http://opauth.org Just released v0.1.0 today.
https://github.com/uzyn/opauth
If you are familiar with OmniAuth for Ruby, Opauth basically does the same thing, except for PHP.
Gave a talk on it today at Singapore PHP User Group. My deck: https://speakerdeck.com/u/uzyn/p/opauth-an-introduction
Opauth is still very new and I still need to work on the documentations a lot, especially tutorials and the wiki. <comment><AUTHOR> Just released v0.1.0 today. <https://github.com/uzyn/opauth>

If you are familiar with OmniAuth for Ruby, Opauth basically does the same thing, except for PHP.

Gave a talk on it today at Singapore PHP User Group. My deck: <https://speakerdeck.com/u/uzyn/p/opauth-an-introduction>

Opauth is still very new and I still need to work on the documentations a lot, especially tutorials and the wiki.

<comment><USER2> Have you seen hybridauth before? <http://hybridauth.sourceforge.net/>

If so any differentiators that would help us choose?

</comment></comment><comment><USER3> I really wish this was around 2 years ago when I made a site that used openid in PHP. I've dealt with so many nighmares of it I just threw it all away and now send people an email every time they want to log in. How do you deal with supporting every different little configuration of PHP servers? I had huge problems with having to put a hack into the code for lightopenid in order for it to work on my webhost, but that hack broke it on my machine.

<comment><AUTHOR> I set a minimum requirement of Opauth Core to be PHP >= 5.2 (though technically it runs fine on >= 5.0) and tries as best as I could to not introduce any unnecessary dependencies, which is the reason why cURL isn't bundled and basic HTTP calls are made through get_file_contents(); and hashing is done through iterations of salted sha1() instead of bundling 3rd party encryption scheme.

Yes, file_get_contents() is not that great, but strategy developers can choose to require cURL if they want, just that Opauth Core doesn't require it.

<comment><USER4> I'm the developer of Requests (<https://requests.ryanmccue.info/>) which might be something for you to consider bundling with Opauth. There's a whole host of problems with using file_get_contents on various hosts, hence why cURL is so often used.

<comment><AUTHOR> Thanks for that. Requests looks interesting. Opauth can consider bundling that to the core and replace my simple wrappers of file_get_contents().

</comment></comment></comment></comment><comment><USER5> Thanks, this looks pretty awesome! Also posted it to r/php as well:

[http://www.reddit.com/r/PHP/comments/tzil2/opauth_multiprovi...](http://www.reddit.com/r/PHP/comments/tzil2/opauth_multiprovider_authentication_framework_for/)

Now to go play with it some more... :)

<comment><AUTHOR> Thanks for cross-posting it at Reddit. I'm statix on Reddit and just left a comment at your post. :)

<comment><USER5> No prob :) And good job, this looks really useful!

A few months back I had to integrate the usual auth providers and was it ever a hunt to find the best scripts for it. I ended up with tmhOAuth for Twitter, LightOpenID for OpenID and Google, and handling Facebook somewhat manually. Will be seriously looking at this as a replacement, and for my next project too.

</comment></comment></comment><comment><USER6> Nice, is there a Wordpress plugin in the works? I'm sure that a lot of people would be interested in this.

<comment><AUTHOR> That's definitely one of the top frameworks/CMS to support. I'll get on with it if no one has started when I'm done with CakePHP-Opauth and Opauth's documentations.

<comment><USER6> Awesome, thanks! I've been dying to switch off RPXnow :)

</comment></comment></comment><comment><USER7> Standardize interface for all OAuth providers. Extensible.

<comment><AUTHOR> Not really just OAuth but it should work with even proprietary authentication providers as long as there is a compatible Opauth strategy for it.

</comment></comment><comment><USER8> Excellent library - has lotsa potential!</comment>


Amazon Multi-Factor Authentication for AWS Accounts - <AUTHOR> http://aws.typepad.com/aws/2009/08/amazon-multi-factor-authentication-for-aws-accounts.html

<comment><AUTHOR> There was apparently some discussion before this announcement: <http://news.ycombinator.com/item?id=787461></comment>


There are over 80 Certified Kubernetes offerings - <AUTHOR> https://www.cncf.io/certification/software-conformance/#logos <comment><USER2> I actually wonder what the Kubernetes conformance suite is worth. For one I took a look at how OpenShift passes the conformance suite as it is much more locked down than stock Kubernetes (that's a good thing, I guess, but not exactly conformant). The answer is, they remove the restrictions before running the suite ([https://github.com/openshift/origin/blob/master/test/extende...](https://github.com/openshift/origin/blob/master/test/extended/conformance-k8s.sh)). So in my view a default installation of OpenShift does not pass the Kubernetes conformance test.

The fact that many software packages for Kubernetes do not run on OpenShift confirms this and challenges the worth of the Kubernetes conformance claim, probably for many other Kubernetes products as well. Afer all, what good is a conformance test when it doesn't ensure compatibility.

</comment><comment><USER3> It would be nice if you could tell at a glance how many of these are forks, versus just installing unmodified upstream Kubernetes.

<comment><USER4> 0 of them are forks, if defined in the typical fashion of not followup upstream development.

[https://landscape.cncf.io/category=certified-kubernetes- dist...](https://landscape.cncf.io/category=certified-kubernetes- distribution,certified-kubernetes-hosted,certified-kubernetes- installer&format=card-mode&grouping=category)

We've split Certified Kubernetes offerings into 53 distributions (meaning they make changes to upstream and/or add software), 35 hosted platforms (meaning they manage K8s for you), and 19 installers (meaning they just install vanilla K8s).

Disclosure: I manage the Certified Kubernetes program and the Interactive Landscape shown above.

</comment></comment><comment><USER5> Now, how many of these are any good? I can't say I've tried more than a couple of these.

Given past experiences with some of these behemoth companies, I'm skeptical that their offerings actually deliver a good K8s experience.</comment>


Migrating from MongoDB to RethinkDB - <AUTHOR> https://blog.webb.page/2020/migrating-from-mongo-to-rethink <comment><AUTHOR> Updated to add:

> Another reason to migrate is the license of MongoDB: SSPL vs. Apache 2 of > RethinkDB.</comment>


State machine processor reference implementation? - <AUTHOR> I'm rewriting a state machine processor for a system at my company. The primary goal is to implement declarative JSON based language for describing state machines so that we have a higher level way of thinking than the current, purely-java solution. The second, more challenging goal is to abstract the components of the system such that the initial implementation can be single node, but getting enough of the correct interface definitions such that it could be refactored to support distributed execution and fault tolerance.<p>Since I've not written one of these before, I'm rooting around the web looking for reference implementations / papers / boxes-and-arrows that could provide inspiration. Any thoughts on what to read? <comment><AUTHOR> I found related discussion on Amazon State Language: [https://news.ycombinator.com/item?id=13093129](https://news.ycombinator.com/item?id=13093129)</comment>


Ask HN: Good forum where indie developer post about ongoing (non-game) projects - <AUTHOR> I'm looking for a site where developers post about their projects throughout their development up to time of final release.  I know of sites that are game focused but are there any good sites for non-game projects? <comment><USER2> Checkout IndieHackers ([https://www.indiehackers.com/);](https://www.indiehackers.com/\);) a lot of people are trying to make viable businesses and post regular updates but there are a lot of side projects too[1].

[1] [https://www.indiehackers.com/products?commitment=side- projec...](https://www.indiehackers.com/products?commitment=side-project)</comment>