Show HN: Turn an Excel file into a web application - <AUTHOR> https://keikai.io/blog/p/currency-exchange <comment><USER3> That link to ECB FX rates is the best thing on the page. A stable, free non- commercial source of market data is hard to find.

[https://www.ecb.europa.eu/stats/policy_and_exchange_rates/eu...](https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html)

<comment><USER4> [https://fred.stlouisfed.org/](https://fred.stlouisfed.org/)

<comment><USER3> Awesome, cher bro.

</comment></comment></comment><comment><USER5> Not to be too nitpicky since it looks like the author is a developer and not a writer, but referring to the person building the spreadsheet as the "admin lady" throughout the piece sounds a bit awkward. Maybe just give her a made-up first name?

<comment><USER6> Looks like the author is from Taiwan, where the vernacular 'lady' is a common suffix for admins. Although it's good feedback for someone marketing to a non- Asian culture.

<comment><USER7> I am from Taiwan but have trouble reverse-translating this back to Chinese. What is the vernacular title you are referring?

</comment></comment></comment><comment><USER8> I haven't tried this yet, but if it works well, the implications towards rapid Business Intelligence development are great. In the past, when a user has needed some 15-year-old, macro-infused spreedsheet turned into a more streamline, business-wide process, any data entry components would require roping in webdevs to get the job done, as BI developers don't usually come with a web skillset. The idea that BI developers could just use the spreadsheet to generate a web app not only cuts down the expertise needed, but also solves the problem of training old-timers to use the new process.

<comment><USER9> Lol, instead of one developer now you need two developers one who fucks with spread sheets and one who jiggers the shitty tool to make the web app.

See basically "no dev needed", perfect for old timers who can't code. Or not.

private void placeAnOrder() { listSheet.unprotect(""); Range costCell = spreadsheet.getRangeByName(exchangeSheet.getSheetId(), COST_CELL); if (!costCell.toString().isEmpty()) { Double cost = costCell.getRangeValue().getCellValue().getDoubleValue(); if (cost > 0) { Double amount = spreadsheet.getRangeByName(exchangeSheet.getSheetId(), "amount").getRangeValue().getCellValue().getDoubleValue(); Range orderTable1stRow = spreadsheet.getRange(BOOK_NAME, listSheet.getSheetId(), "C6:G6"); orderTable1stRow.getEntireRow().insert(Range.InsertShiftDirection.ShiftDown, Range.InsertFormatOrigin.RightOrBelow); orderTable1stRow.setValues(DateUtil.getExcelDate(new Date()), cost, destinationCurrency, destinationRate, amount); } } listSheet.protect(PROTECTION); }

<comment><USER10> Can you please not be snarky in HN comments? You have a good point here, but please follow the site guidelines.

<comment><USER9> Ya I'll delete it if I can.

</comment></comment></comment></comment><comment><USER11> You can do some of these tricks with Excel 2016 or later and SharePoint Enterprise or Office 365 -- which many corporations already have.

You can embed an auto-updating Excel file in a SharePoint webpage using a "webpart" that renders as HTML. (Microsoft is getting away from web-rendering Excel with Silverlight,and allowing more functionality without the need for a browser plug-in.)

The trick is to setup the Excel data connection using the "Get External Data" -> "From Other Sources" -> "OData Data Feed" and not use the "Data Connections / Microsoft Query" method. Note: Microsoft Query connections won't update server side, the Excel file needs to be opened, data connections refreshed, and re-saved.

It does require a bit of Excel expertise to setup, but there is no need to create a Java application to get it to run.

<comment><USER12> I'd rather have my Java expertise than Excel expertise.

</comment></comment><comment><USER13> Nice! Spreadsheets have a lot of advantages over coding your own website, especially for people that don't have the skills.

I made an app called [https://Sheet2Site.com](https://Sheet2Site.com) which takes your spreadsheet of items/objects and translates it into an app, with filters.

<comment><USER14> Wait so what exactly is it?

Components of different types, corresponding to rows of different schemas? Where first column says the type? Or is it one sheet per type of object?

And then you import them? And have a page with a bunch of components with data from the sheet?

<comment><USER15> There's a two minute intro video on the homepage that does a very good job of demonstrating the product.

</comment></comment></comment><comment><USER16> The first step should have been to call the bank. For businesses, banks usually have a website that she could log into to: 1) get more up-to-date or more indicative rates, 2) execute the trade. Will save dev & maintenance time.

<comment><USER17> Maybe they are the bank and everyone is calling them?

</comment></comment><comment><USER18> They invented Google sheets api for excel. I've built apps using Google sheets as the dB (via api). Slow but work well enough for personal tools

</comment><comment><USER19> It amazes me to see companies big and small that basically run on Excel.

Why do you think Excel is so ingrained into all kinds of companies and processes?

<comment><USER20> \- Because a spreadsheet is the best UI for many business applications (far better than an HTML table on a webpage).

\- Because Excel allows the user to (i) perform ad-hoc calculations, (ii) audit the input and outputs, and (iii) easily modify the functionality in real time.

\- People don't like filling out forms and most web apps are basically filling out forms.

<comment><USER21> Points 1 and 2 sound like a REPL.

Say we had a REPL that also had a table (like excel, each cell has an address... a 2D stack if you will).

Say we interact using a mouse to select a cell or in the REPL to specify what cell we want to write to. Then, if we use a Lisp, we have tabular code and tabular data...

I might code this up for fun.

<comment><USER22> I don't know if it is what you are envisioning, but there is a spreadsheet program called Scheme In A Grid (Siag) [1] (part of Siag Office [2]).

From the "Introduction" [3] of its Online Documentation: "Siag is an X-based spreadsheet for Unix. It uses Scheme (a Lisp dialect) both for expressions and as an extension language, which makes it easy to create new functions (for native Lispers, that is). There is no requirement to know Scheme to use Siag, expressions can be entered in traditional spreadsheet syntax as well."

[1] [http://siag.nu/siag/](http://siag.nu/siag/)

[2] [http://siag.nu/index.shtml](http://siag.nu/index.shtml)

[3] [http://siag.nu/online-docs/siag/intro.html](http://siag.nu/online- docs/siag/intro.html)

<comment><USER21> That's about what I imagined.

</comment></comment></comment></comment></comment><comment><USER23> Excel is a great tool for MVPs. It's much cheaper to test internal automation within a company with Excel than to build a entire platform, and some users can do it without the need for professional developers.

</comment><comment><USER24> Congrats on the product! And what a coincidence, I'm about to launch a product that 'Turns a (bunch of) Word files into static website': [https://docxmanager.com](https://docxmanager.com)

We are both building a software basing on Office :)

</comment><comment><USER25> See also [https://github.com/michaelneu/webxcel](https://github.com/michaelneu/webxcel) a HTTP REST server built on top of Excel using VBA.

<comment><USER26> see also [http://docs.xlwings.org/en/stable/rest_api.html](http://docs.xlwings.org/en/stable/rest_api.html) for the Python version of the REST api. It doesn't require any VBA...

</comment></comment><comment><USER27> I didn't get if some of the code shown on the page is written as macros in the Excel file itself or are all of them external. Some of it like the cell protection stuff seemed like within the sheet?

It seems you still need to code the plumbing to get the sheet to work and serve it in some webserver, so you might not be able to get rid of your developers any time soon. And I didn't see any mention of it but it seems to be using Java (since it mentions mvn in the example's GitHub page).

</comment><comment><USER28> This does not work for me on chrome 74. [https://keikai.io/demo/editor](https://keikai.io/demo/editor)

<comment><AUTHOR> There is a known issue that the current beta version works with only 100% zoom level. Please check your browser and OS display zoom level and make it 100% to try it out before the fixed version is uploaded.

<comment><USER29> Speaking of zoom, it'd sure be nice if the keikai web site didn't kill zoom on the ipad. Pretty hard to see the screen shots, etc.

</comment></comment></comment><comment><USER30> If you're using React, I wrote this short tutorial on how to use Google Sheets in React apps: [https://appendto.com/2018/08/the-simple-stack-a-primer-on- us...](https://appendto.com/2018/08/the-simple-stack-a-primer-on-using-react- google-sheets-api/)

</comment><comment><USER31> I can't wait to post what I've been building with Excel... from the reaction here, there's going to be some cringing happening.

One thing that I've found amazing is that if you build from scratch, you can have a cross-platform native desktop application that runs on software that's pretty much installed on all company computers.

<comment><USER32> "Cross platform". If cross platform means "pretty much installed on all company" then sure, but if it means ubiquitous among all platforms, then decidedly know. Excel is a huge piece of software, and it will probably never be cross platform, simply because it would take longer to port than the lifespan of the platform you were to port it to.

<comment><USER31> You're correct in saying that Excel is not cross-platform, but I'm referring to my application that lives on top of Excel. If the user is running Excel 16.0 64Bit, my app can run on Windows or Mac... does that not make it cross- platform?

</comment></comment></comment><comment><USER33> > Turn an Excel file into a web application

Why?

Just because you can do it, does not mean you should.

There is another group of people who favor storing html pages in a db.

<comment><USER34> I think just wanting to do it is an excellent motivation for any intellectual pursuit.

<comment><USER35> Probably very similar to my desire to climb mountains. I just wanna see what it looks like on other side... aka curiosity.

If you're only doing things other people tell you that you should, it's worth taking some time for self-reflection to figure out why, and to find out what you _yourself_ are interested in.

Nature walks are great for that kind of thing :)

<comment><USER36> > ... my desire to climb mountains. I just wanna see what it looks like on > other side... aka curiosity.

I wonder for some period of time why people like to climb, so I am excited by your answer. Given all the documentaries, news and travel ads, one can reasonably imagine what it looks like on the other side, don't we? Moreover, its geometry would remain the same in one's life time, for any specific mountain. One can get a pretty close idea from Google Map's terrain view. If one is not that into the details, like the precise curvature for each piece of a mountain, then they are largely the same.

I find myself not attracted to climbing for exactly the reason that they are not different enough from each other to satisfy my curiosity.

<comment><USER35> Ah, I used to think this way, it's kind of a "peakbagger" mentality... bag the peak and move on. I'm all for seeing new mountains, and actually there is a _ton_ of variation in what you can find due to altitude, aspect, geographic location, etc etc. In the same valley I've walked down lush green forest on one side, and walked up dry baking desert on the other. I think the more I've trained my eye, the more unique qualities I see.

In the last year or two though I've realized that every climb is it's own experience, even on the same mountain. The season, the plants and animals that come with it (or snow!), the weather that particular day, whether it's a dry or wet year, the time of day. Some days you get turned back before you reach the peak. Maybe an avalanche happened overnight. Or you time it just right to get a view of sunset/sunrise/aurora/milky way. There's always something new to learn even if it's your 100th ascent. They actually change much more than you'd think.

I always thought it would be tough or impossible to, say, get all the 13ers/14ers in Colorado, or all the 4,000ers in the northeast. Now I realize I could spend a lifetime just getting to really know a handful of them. I find a strange comfort in that. Maybe I'm getting older.

Also, I love to ski and snowboard. Gotta get up to ride down! But I've never lost the desire to go around one more bend, or over one more peak, to see what I can see beyond.

</comment></comment></comment></comment></comment><comment><USER37> For this tasks, I like to use Google Sheets, runs in the cloud, have a good mobile app and runs in any device.

</comment><comment> 1-6 It's 2019 so you came along and took her job! In 2029, an android will come along and take your job!

</comment><comment><USER38> Wait, isn't this particular problem solved with something like Google Sheets?

Other than privacy issues of course.

<comment><USER39> And you might want to still use it in x years time after Google decides to kill-off Sheets. You must be very wary when building anything on a Google service.

<comment><USER40> And what happens if Keikai fails long before Google gets rid of sheets? I get that Google has a habit of killing things off, but they are often things that are unpopular. Sheets is far from unpopular.

<comment><USER39> Yep, I agree it's always a risk; but if you were really concerned you could perhaps acquire a small outfit like Keikai and protect yourself. Your money just isn't interesting to Google so that's never an option.

And I don't believe it's true to say they've only killed unpopular things. Anything outside of the core business (and I will argue Sheets/Docs is outside) is up for the chop.

<comment><USER41> _> but if you were really concerned you could perhaps acquire a small outfit like Keikai and protect yourself_

Only one customer can do that, not all of them. As a small provider of enterprise software I would offer to sign a source code escrow agreement.

<comment><USER39> Yes, that's a far better way to protect your investment. Thanks for pointing that out.

</comment></comment></comment></comment></comment></comment><comment><USER42> We used something like this to build configurators for clients at a previous job some 10+ years ago. I always thought they should have sold it as a service rather than just internal tooling the clients didn't know anything about.

</comment><comment><USER43> A simple solution to an easy problem, and you saved someone time. Good job!

</comment><comment><USER44> The world's most popular database becomes the world's most popular web framework. Makes sense.

</comment><comment><USER45> Your demos break or don't even load if page zoom level is set above or below 100% in Firefox btw.

</comment><comment><USER46> I love spreadsheets. But not like this. Take a step back and really look at it. This is horrible web UI design. Even as just a spreadsheet it could use a lot of work. For example, it would probably function much better as a single sheet rather than having to cycle through three screens for each conversion.

</comment><comment><USER47> Excel is fine until you have to work with nested data structure/relationship.

<comment><USER48> Or until a member on the team has an older version of Excel that causes compatibility problems for the rest of the team.

Or until a spreadsheet is edited in Excel that uses language other than English - formula functions will also take nationalised names.

Or until multiple people make changes to a spreadsheet, but there is no version control in Excel.

<comment><USER49> Version control is a big one for financial institutions, because there's no way to verify what the state of a spreadsheet was when a particular analysis was done.

One place I worked at created a Python library called the DAG (Directed Acyclic Graph) for this. It enabled an easy way to translate a chain of Excel cell functions into Python code, which can then be version controlled, diffed, code reviewed, etc.

</comment></comment></comment><comment><USER50> Does it support charts?

</comment><comment><USER51> Doing something like this for learning, innovation and fun? Sure! But otherwise I don't understand why people are doing things like these, especially with Excel.

<comment><USER27> Boss asks you for currencies of several countries, so you present a table with the data. The easiest way would be to make it in Excel. Then they ask you to keep a record of the currencies they are buying/selling. Again, the easiest database to do that is an Excel file. You have something that works and didn't need the help of anyone to do it.

The important point would be to recognize that when they ask you this for the second or third time it might be time to automatize it.

</comment></comment><comment><USER52> Excel is the new emacs. Both contain robust scripting abilities, can edit text, and begin with the letter 'e'.

</comment><comment><USER53> Or don't please, I think it's a terrible idea to abuse spreadsheets like this.

I'm being forced by my manager to do this for a client due to a close deadline (the idea is to implement a spreadsheet as interface to make it quicker than a classic web app), lbut they keep asking me to implement advanced features that would be 10 times faster to implement with a regular interface or sometimes not even possible on a sheet. Spreadsheets have a precise use case and it's not to replace web apps.

<comment><USER54> > I think it's a terrible idea to abuse spreadsheets like this.

It currently maintains millions of business software jobs.

<comment><USER55> Telemarketing also maintains millions of jobs. Doesn't mean it's a good thing to keep around.

<comment><USER54> > Doesn't mean it's a good thing to keep around.

Well, too bad the smart guys in Silicon Valley are busy perfecting their yak shaving, otherwise I'm sure they would have found the holy grail of business software that us foolish dark matter programmers have failed to deliver on for several decades in no time.

</comment></comment></comment></comment><comment><USER56> Stop encouraging people to use Excel for tasks where it is a poor fit. I have wasted so many hours of my life because of Excel and people using it for non- spreadsheet purposes.

<comment><USER57> You may be a dying breed.

As much as everyone wants to build full stack for every application, Excel is fantastic for complex math out of the box.

Excel is the average persons database.

I have found being able to expand on this has been incredibly useful and modular.

And as a note, VBA is definitely a real programming language, it up to the developer on how to treat Excel.

<comment><USER58> I must be part of the dying breed too. Having been involved in migrating very broken Excel/Access/VBA into properly formed web applications for companies I've worked at, the problem is people using the wrong tool in the first place. It may meet their immediate need but with no viewpoint on it's future usage, then fragility sets in and it costs the company more in upkeep and resource. I can see how that happens, but perpetuating it seems a bad idea.

<comment><USER59> Worked on a project last winter to add a fully featured compliance management system to a state regulatory agency in Access. They have moved to a sql server backend but the support for database operations is incredibly limited by the Access JET DB engine. Ended up just using ADO in my VBA scripts for everything instead of the Access database tools because it was not capable enough for the complexity. This client doesn't have the budget to migrate from Access, but has the budget to continue slapping garbage to it every year. At least as the primary NGO involved works with other states to create a web-based solution, my client might be able to move away from Access by 2025? I would say the majority of orgs that encounter this really have no choice in perpetuating the use of bad systems.

</comment></comment></comment></comment><comment><USER60> It's worth noting that the described flow could've been fully automated from within the Excel itself, with just a few macros and formulas. I've created a spreadsheet doing very similar thing (grabbing the exchange rate from net and generating invoice) like a decade ago, so it's not even something new. The main issue people have with Excel is the same as with vim, majority of users just don't use it properly and know only the most basic functionality - <USER2> results in them doing a lot of repetitive things manually. I don't mind using tools like keikai, they're one approach to solve the problem, but perhaps companies could also try to send their employees on a proper Excel course first.

<comment><USER61> I've been able to learn vim because the web is full of high quality content that will teach it from the basics in a way that's compatible with my mindset.

I never had the same experience learning Excel, maybe the problem is my mindset. The only learning experience I enjoyed about excel is 'You suck at Excel' by Joel Spolsky.

Can someone recommend a good Excel learning path for someone in this situation?

<comment><USER62> The best way to learn Excel is to use it at work. I thought I was fantastic at Excel/VBA until I got my first finance role. Learned more in 3 months than I could have learned in 3 years on my own.

One secret I'll let you in on: most people use plugins like KuTools to do the heavy lifting. There are tons of industry-specific plugins. When you really can't find a plugin to do what you want, then, and only then, should you be writing macros and saving them to your xlsb.

But what if you're not able to use it at work? Then I recommend picking up pet projects and continually look for ways to improve. Just keep asking, "could this be easier?"

Whenever you get stuck on Excel issues, I recommend watching Excelisfun [0] who has thousands of hours of video content on every Excel feature you can think of. If you have difficulties with VBA, check out MSDN help docs.

P.S. Don't write a fuzzy text matching algo yourself. You will drive yourself crazy and Microsoft has one for free to download.

[0] [https://m.youtube.com/user/ExcelIsFun](https://m.youtube.com/user/ExcelIsFun)

</comment></comment></comment><comment><USER63> There is a solution developed in France, WeMaik [0]that is very similar. We've used their solution in the consulting firm I'm a part of.

The clients are very satisfied, because the web app that's outputted by WeMaik is so easy to design and produce that they're produced by industry- knowledgeable consultants, and not web developers.

We go from idea to actionable mock-up in half a day, present it to the client, and then build the real solution assisted by WeMaik. The connections, queries, logic are not no-code, though, for this solution. We describe the specs in the spreadsheets we send to WeMaik, and they configure it.

[0] [https://www.wemaik.com/](https://www.wemaik.com/)

<comment><USER64> And glide [https://news.ycombinator.com/item?id=19163081](https://news.ycombinator.com/item?id=19163081)

</comment></comment><comment><USER65> I've built [http://upstart.me](http://upstart.me) entirely on Google Sheets. Haven't had any issues and works really well. This allows me to collect data from newsletter through a Google Form - which gets stored in a Sheet - that I can then curate, copy & paste to an other sheet that is used as the DB for the Live website.

Im also working on an internal CRM tool for [http://fairpixels.pro](http://fairpixels.pro) with a sleek frontend that can be used as a browser homepage (showing key business stats) all while the same Sheet is used to manage customers.

I highly recommend looking into this because it allows for a simple to manage backend for those that live in Sheets.

<comment><USER66> We were recently considering quick prototyping using Google Forms but ran into two key limitations:

(1) Getting a _validated_ email address of the submitter. It does support an email field, but makes it a free-form text input with no way of enforcing ownership of that email.

(2) Pre-populating some of the fields when we send the user to a form via a link. Without this, the user ends up filling the fields even though they have already submitted that information in another form.

Are there any powerful (forms + spreadsheet) products out there that solve these (and are cheaper than, say, AirTable) ?

(2)

<comment><USER67> Calcapp may be what you're looking for. You can validate text fields using regular expressions and there's an example of how to validate an e-mail address here: [https://www.calcapp.net/learn/beyond- numbers.html#validating...](https://www.calcapp.net/learn/beyond- numbers.html#validating-text-fields). Fields can be pre-populated with either values you know ahead-of-time or through Excel-like formulas.

(I'm a co-founder of Calcapp.)

<comment><USER68> > enforcing ownership of that email.

I believe the GP was talking more about "click here to confirm your account" type validation, not "does it have an @ in it".

</comment></comment></comment></comment><comment><USER69> No.

</comment><comment><USER70> >Offers to do her job free of charge

>Consistently refers to her as "Admin Lady"

Dude what the actual fuck

</comment><comment><USER32> Excel is a dead-end road. I view all software as a vehicle to achieve more software. In other words, the solutions of today become the platforms of tomorrow. To that end, anything made in Excel is completely worthless. You can get some way by using excel, but at some point you want to build something on top of it, and at that point you will have to throw your entire excel solution out the window.

Excel sheets are nothing buy a worse version of bash scripts, at least in my opinion. At least bash scripts let you plug them into something bigger using standard process operations.

<comment><USER71> I suspect you've never worked in a non-software business environment. Your statements live up to your username. I'm sure you're an intelligent and skilled person, but you're speaking outside your wheelhouse right now.

<comment><USER72> LOL at that second sentence :)</comment></comment></comment>


3D printed, open source Ray-Bans for Google Glass - <AUTHOR> http://www.digitaltrends.com/mobile/sunshade-3d-printed-open-source-ray-bans-google-glass/

<comment><AUTHOR> I worked with Next Fab Studio in Philadelphia to develop 'Sunshade' a 3D Printed Prism Cover for Google Glass. I open sourced the code and it's available for anyone here to download and print: [http://prserve.com/sunshade/Sunshade1.0.zip](http://prserve.com/sunshade/Sunshade1.0.zip)</comment>


Copy and paste-friendly Go crypto - <AUTHOR> https://github.com/gtank/cryptopasta <comment><USER2> I was actually at this talk (excellent way to go over this kind of topic!) and I have just a small thing to add.

You'll notice the "Asymmetric Signature" section mentions using ESDSA on P-256 because "the Go implementation of P-256 is constant time to protect against side-channel attacks." However, someone mentioned that this may not be on all platforms because it is hand-coded assembly. After a quick check of the Go source code, this is indeed true. In fact, the constant time guarantee assembly version is _only_ available on amd64 compatible systems[1]. Just something to take note of.

[1] [https://golang.org/src/crypto/elliptic/](https://golang.org/src/crypto/elliptic/)

Edit: Formatting and grammar and spelling, oh my.

<comment><USER3> Author here, glad you enjoyed the talk!

Looking into it more I noticed that there's a Go implementation[1] that is noted to be constant-time with a !amd64 build tag. So it isn't just the assembly one.

[1] [https://golang.org/src/crypto/elliptic/p256.go](https://golang.org/src/crypto/elliptic/p256.go)

<comment><USER2> Wow, I completely missed that (largely because I assumed a Go implementation could not guarantee constant time), sorry about that and thanks for looking deeper than I did.

On that note, how much of a guarantee is there in the Go implementation? I assume in most cases it's going to be constant time, but isn't that a little harder to guarantee when compared to the asm version? And if not why not just use the Go implementation everywhere for consistency?

<comment><USER4> The asm version is much more performant. The Go version is a port of the version in NSS, but the compiler is free to screw it up in various ways. Furthermore correctness is always a concern: cleverness in unsaturated arithmetic code can be hard.

</comment></comment></comment></comment><comment><USER5> Your recommendations and defaults are sane, and the code looks solid, thanks for publishing.

I just don't know why you call this 'copy and paste-friendly'. This is essentially a minimalistic library, not a bunch of code examples (ie. "usage").

Stackoverflow (as awful as roll-your-own-crypto is,) is great for seeing code examples in context of a domain problem, rather than a crypographic primitive.

This is a decent wrapper for goland stdlib's crypto, but doesn't particularly help a person who's trying to understand how to apply crypto to their particular usecase, and would therefore be most susceptible to googling it.

<comment><USER6> 1\. How do I protect my password, umm, I heard I have to hash it.

2\. Goes to [https://github.com/gtank/cryptopasta/blob/master/hash.go#L41](https://github.com/gtank/cryptopasta/blob/master/hash.go#L41)

3\. This `HashPassword()` and `CheckPasswordHash()` functions look interesting

4\. Copy/Pasted into the project, it just works!

</comment></comment><comment><USER7> Don't copy and paste code! Instead, use a well maintained library.

<comment><USER8> I'm not sure, but isn't this post about showing how to use such libraries?

<comment><USER7> No: "Copy and paste-friendly Go crypto"

</comment></comment></comment><comment><USER9> This is a really great idea! I would like to see it for other langs too.

<comment><USER10> NaCl is basically this, but as a library instead of copy/paste. It's available in most languages if you look around.

[https://nacl.cr.yp.to/index.html](https://nacl.cr.yp.to/index.html)

<comment><USER11> [https://golang.org/x/crypto/nacl](https://golang.org/x/crypto/nacl) for the Gophers among us (it provides only box/secret_box, though)

</comment></comment></comment><comment><USER12> P-256 is not a safe curve! [http://safecurves.cr.yp.to](http://safecurves.cr.yp.to)

</comment><comment><USER13> > You should not go below work factor 12.

Out of curiosity, how do people determine 12 is the right work factor? When should/will this go to 13?

<comment><USER14> It is relative to cpu performance.

[https://en.wikipedia.org/wiki/Bcrypt](https://en.wikipedia.org/wiki/Bcrypt)

<comment><USER15> What is the current recommendation for iteration count for pbkdf2?

<comment><USER16> What your slowest hardware can handle in a reasonable timeframe

</comment></comment></comment></comment><comment><USER17> In the encrypt examples I always wonder why they assume that you have a fixed 32 bit key (password). Shouldn't they include a padding function?

Is use this one:

edit: deleted in case some is so crazy to use it :)

<comment><AUTHOR> Wait. Stop. You are writing your own crypto.

AES keys are 256 (or 128) bit, fixed size, and should be random-looking data. The code here uses [32]byte intentionally so you won't use anything else.

If you have a _password_ instead, that is NOT suitable for use as a key directly, whichever the length, because it has low entropy by definition. So you want to stretch it (and whiten it) with something like scrypt. It's a bit of the same argument as password hashing.

Also, you don't want to discover what happens if you have strong patterns like padding in your key (it should be fine, but it's the kind of attacks that come before a full break). And you don't want to cut short a password longer than 32 characters.

This is the issue, btw: [https://github.com/gtank/cryptopasta/issues/7](https://github.com/gtank/cryptopasta/issues/7)

Don't copy-paste crypto from HN.

<comment><USER17> I know! That's why I am asking. I have found surprisingly difficult to find a package that does this.

<comment><USER18> > I know! That's why I am asking. I have found surprisingly difficult to find > a package that does this.

scrypt, with an output length that suits your use-case? (as Filippo points out)

Note: I wrote [https://github.com/elithrar/simple- scrypt](https://github.com/elithrar/simple-scrypt), which wraps Go's scrypt package and gives it a friendlier API (mimicking the bcrypt one). Handles salt generation for you and has sane default parameters, outputting a 32-byte derived key by default. e.g.

        func deriveKey(key []byte) ([]byte, error) {
            return scrypt.GenerateFromPassword([]byte("plaintext"), scrypt.DefaultParams)
        }

You can pass your own params, or modify the defaults to get a different key length depending on your use-case.

<comment><USER17> yes, that is what I was looking for. Thank you!</comment></comment></comment></comment></comment>


YouTube Open Tabs Total Time – Firefox Extension - <AUTHOR> https://addons.mozilla.org/en-US/firefox/addon/youtube-open-tabs-total-time/ <comment><AUTHOR> I find myself usually having many youtube tabs open and counting the total time I'd need to watch all the videos. No more! Here's a handy little add-on that sums the videos total times for you.

Open source @ [https://github.com/tmartty/YouTube-Open-Tabs-Total- Time](https://github.com/tmartty/YouTube-Open-Tabs-Total-Time)</comment>


Caddy Server Is Acquired By Apilayer - <AUTHOR> https://www.ardanlabs.com/news/2020/08/caddy-server-is-acquired/ <comment><USER2> Hi HN. Here's my own announcement with some details: [https://caddy.community/t/caddy-and-certmagic-have-new- owner...](https://caddy.community/t/caddy-and-certmagic-have-new-ownership-no- changes-to-licensing-or-development/9754?u=matt)

Please note that there are no changes to licensing, and this transfer actually happened about six months ago.

I'm quite happy about this. We're already seeing some great things. For example, in Caddy 2.2 there will be native ZeroSSL ACME support (with Let's Encrypt still being the default, because ZeroSSL requires EAB) -- which is appealing because ZeroSSL doesn't have tight rate limits like Let's Encrypt does. It's also good to diversify the ACME CA ecosystem a little bit.

I'm also less stressed and outputting better quality work this year. (Compare the code base from Caddy 1 with that of Caddy 2 and you'll see what I mean.)

We have more committed maintainers as well due to its growth and stability, which I'm very grateful to all who contribute!

<comment><USER3> Congratulations Matt! Big fans of Caddy here at Narration Box. The reverse proxy setup and strong defaults are unmatched and are a joy to use. My favourite feature is the Cloudflare Let's Encrypt DNS-01 challenge integration, it makes adding TLS to internal networks a lot easier for devices like the iPhone/iPad where the cert store is heavily locked down.

<comment><USER4> I'd love to see a write up on this setup.

<comment><USER3> It is coming soon. We all post it here and on twitter when it's ready.

[https://twitter.com/narrationbox](https://twitter.com/narrationbox)

</comment></comment></comment></comment><comment><USER5> Caddy is a really nice server but the documentation for v2 is kind of strange. Every documented config setting is for the new json format, but there is almost no information or examples for a complete json config. And all complete examples are with the old Caddyfile which has now no documentation anymore.

<comment><USER6> Agree, migrating was very painful

<comment><USER7> I changed over months and months ago to v2. It was painful, but docs were being written at the time, and the community was able to help me with most of my problems. The one last problem I've not solved yet is having caddy 2 work with bitwarden whereby bitwarden's ssl does not conflict with caddy 2. I was unable to figure out how to work with it, so my bitwarden ssl expires every month or two and I have to manually update the ssl by bringing down my personal site for a couple of minutes.

<comment><USER8> Can you share what your setup is like? I have bitwarden_rs self-hosted with Caddy in the front doing TLS termination and proxying the request to Bitwarden_rs and haven't experienced any issues for more than a year and half now. There are many ways in how Caddy can be configured (e.g. maybe even just keeping the certs updated, but not serving any HTTP requests [0]). Feel free to drop a thread on the Caddy forum and we can help you out!

[0] [https://caddy.community/t/using-caddy-to-keep- certificates-r...](https://caddy.community/t/using-caddy-to-keep-certificates- renewed/7525)

<comment><USER7> My setup if fully outlined here: [https://sethammons.com/posts/bitwarden_with_caddy/](https://sethammons.com/posts/bitwarden_with_caddy/)

If I don't get any traction on help here, I'll be sure to jump over to the community posts. Thanks!

<comment><USER8> Bitwarden's docs say it's possible to bring your own certs[0]. The Bitwarden marketplace image on DigitalOcean asks whether you want it to manage its own certs or not. From minor googling, it seems you can change your mind later by modifying a yaml file[1]. HN threading isn't best format for support. If this still doesn't help, let's move the discussion elsewhere.

[0] [https://bitwarden.com/help/article/install-on- premise/](https://bitwarden.com/help/article/install-on-premise/)

[1] [https://gist.github.com/kylerchin/00e6990706183ddb0e0e792a1c...](https://gist.github.com/kylerchin/00e6990706183ddb0e0e792a1ce56822#file- config-yml-L33)

</comment></comment></comment></comment></comment></comment><comment><USER9> Hi Matt and the team behind Caddy - I would say that we are very happy with it in MailerLite ([https://www.mailerlite.com](https://www.mailerlite.com)). We have a feature that is called landing domains, which gives the user possibility to use custom domains for their landing pages built through us. We also provide a free SSL certificate for it and previously have used nginx with some custom LetsEncrypt implementation. With Caddy and its ask point we just created a simple microservice which is hit each time there is a request to Caddy to issue the certificate, returns status 200, and we are good to go. It has been marvellous to use in our k8s setup with Redis plugin.

I'm also really happy that you improved startup time with 2.2.0rc1, because we had problems as our setup is massive (over 8000 domains and certificates). It took 17m previously when we redeployed the app for the pods to startup, now it takes ~30s which is quite ok as we also have autoscaling in place.

As of the docs, I also find it a bit confusing, coming from v1. :) I use Caddy for my personal stuff as well and it was quite a learning curve to get the same setup I had before work in v2, but as you said, it is one-time only so it is okay.

Keep up the great work!

<comment><USER2> Thanks for your feedback! That's great to know. The startup times were recently improved in collaboration with one of our corporate sponsors, Fathom Analytics.

The remaining duration is likely due to the speed of the storage backend and/or CPU, but I'd need to see a profile to know with more certainty. 8000 certificates is a lot of decoding/encoding and crypto operations. Caddy can handle it, but the hardware has to be up to snuff too. Post in our forum and we can look for ways to optimize it even more once we know where the bottleneck is.

<comment><USER9> Thank you! Will do.

</comment></comment></comment><comment><USER10> Ok.

1\. It is now 404

2\. Apliayer ( [https://apilayer.com](https://apilayer.com) )

3\. What has Ardanlabs got to do with Apilayer?

4\. What is the relationship between Caddy, Ardanlabs, and Apilayer?

Edit: May be just change the link to

[https://caddy.community/t/caddy-and-certmagic-have-new- owner...](https://caddy.community/t/caddy-and-certmagic-have-new-ownership-no- changes-to-licensing-or-development/9754?u=matt)

<comment><USER11> 1 - Ardan Labs changed the url to [https://www.ardanlabs.com/news/2020/08/caddy-server- acquired...](https://www.ardanlabs.com/news/2020/08/caddy-server-acquired-by- apilayer/)

2, 3 - Based on the Cruchbase page for Apilayer, they were acquired by Ardan Labs yestday.(?) [https://www.crunchbase.com/organization/apilayer- ltd](https://www.crunchbase.com/organization/apilayer-ltd)

Or maybe the two companies bought Caddy together? I'm not really sure. > Ardan Labs announces they have secured the acquisition of Caddy Server with Apilayer.

<comment><USER2> Honestly that Crunchbase page looks automatically generated by a bot. It's not accurate.

<comment><USER12> Even if it's not automatically generated, Crunchbase is (or was?) a crowdsourced wiki, and one of the worst ones at that, with next to no quality control and moderation.

</comment></comment></comment></comment><comment><USER13> As a heavy Nginix user could someone shed some light on why Caddy is a better alternative? Serious replies only, please.

<comment><USER14> \- Built-in ACME client, automated certificate management

\- Simpler configuration language, the Caddyfile

\- Single static binary, no external dependencies

\- Built with Go, so memory safety is essentially solved

\- Very pluggable if you need to add additional behaviour (simple Go module plugin system)

\- Config API with graceful reloads

\- Plenty more, just scroll through the homepage to get an idea: [https://caddyserver.com/](https://caddyserver.com/)

<comment><USER15> The parent comment asked why Caddy is _better_ than Nginx but I'm not sure some of these are applicable.

> Built with Go, so memory safety is essentially solved

Has there been any memory safety issues with Nginx?

> Very pluggable if you need to add additional behaviour

Nginx is easily extendable and has far, _far_ larger plugin ecosystem than Caddy.

> Config API with graceful reloads

So does nginx, with "nginx -s reload"

<comment><USER2> > Has there been any memory safety issues with Nginx?

Yes, of course. For example, nginx uses openssl, so it was vulnerable to Heartbleed, something Caddy can never be vulnerable to. Part of the point of Caddy is to stop deploying C code to the edge.

> Nginx is easily extendable and has far, far larger plugin ecosystem than > Caddy.

Nginx is also 4x older. I'd say for just a few years we're doing pretty good with our very young plugin ecosystem. A lot of this depends on the community. If you want it, make it so!

> So does nginx, with "nginx -s reload"

I think he was referring to a REST/JSON API that isn't unix-specific.

<comment><USER15> Good point about openssl!

> Nginx is also 4x older.

I know, but the GP claimed Caddy's plugin ecosystem was an advantage over Nginx, which just isn't true.

> I think he was referring to a REST/JSON API that isn't unix-specific.

Got it, thanks. Though I wonder how many people actually need a REST API for config reloads given practically everyone runs servers on Linux.

<comment><USER16> You'd be surprised how helpful having a REST API for config reloads is when you're serving more than a simple static site.

</comment></comment></comment></comment></comment></comment><comment><USER17> Does it make sense to announce that a company has "acquired" an open source project? Wouldn't it make sense to title and write the article that the company that writes most (or all) of the code was acquired? "Light Code Labs, LLC."

<comment><USER2> Light Code Labs was not acquired; just the Caddy and CertMagic projects and their assets.

<comment><USER18> Would it be safe to say then, that Apilayer has simply acquired the trademarks and the domain name of an open-source project?

Edit: If the entire project is licensed under Apache License 2.0, what does acquiring the copyright give? The ability to change the license going forward?

<comment><USER19> And the copyright, dude. And literally what else is there? That's the project itself.

</comment></comment></comment></comment><comment><USER20> Just wanted to say that I love CaddyServer. It is super easy to use with minimal boilerplate. The automatic https support it uses LetsEncrypt to acquire a cert for the domain it is hosting is awesome and one of my favorite features!

Congratulations on the acquisition!

<comment><USER2> Thanks! It's great to hear the positive experiences too.

</comment></comment><comment><USER11> It seems Ardan Labs changed the url to [https://www.ardanlabs.com/news/2020/08/caddy-server- acquired...](https://www.ardanlabs.com/news/2020/08/caddy-server-acquired-by- apilayer)

<comment><USER21> The original URL was put back [https://www.ardanlabs.com/news/2020/08/caddy- server-is-acqui...](https://www.ardanlabs.com/news/2020/08/caddy-server-is- acquired/)

</comment></comment><comment><USER22> Thank you for Caddy ! It's been my default HTTP server for a few months and so far the user experience is stellar.

</comment><comment><USER23> I must admit I saw this when it was first announced and I didn't get why it was better but seeing it again and having more time on my hands I intend to experiment a bit further.

Congratulations to the author for their success - it is clear they've created a community of happy users and probably worked really hard to get here.

</comment><comment><USER24> Caddy is the best way to get junior devs up to speed. And the reverse proxy is amazing. And it is easy to know what caddy is doing compared to nginx etc

</comment><comment><USER25> The first time I used caddy (came to it from nginx), I was blown away by how simple it was to get up and running (letsencrypt etc...). Thank you for creating something wonderful, and congratulations!

</comment><comment><USER26> I talked to matt when Caddy 2 launched and was very helpful. Caddy is a great piece of software!

</comment><comment><USER27> Didn't they already join forces a while back? Am I missing something here?

And what does this do for Caddy as an open source server? Will it fork into a confusing mess of features like nginx did?

Update: According to mholt's post above, the gist:

\- happened 6 months ago

\- everything is still Apache 2.0

<comment><USER2> I was hired by Ardan Labs last year to develop Caddy 2. Ardan is still the exclusive partner for business/enterprise support (which I recommend for companies using Caddy). I now work on Caddy full-time through support from apilayer (the new owner) and other sponsors. This should be a more stable and long-term arrangement that benefits everyone, especially the user base / community!

The last six months should give you some idea.

And no, I'd rather quit than make a mess of the project.

<comment><USER27> Great, and congrats again on the arrangement. Definitely more sustainable.

</comment></comment></comment><comment><USER28> What does this means for Caddy? Are we gonna need to fork or are they gonna simply keep developing it in an open way? I wasn't able to grok this info from the post in the link.

Thanks in Advance.

<comment><USER29> Looks like the license won't change, and now there's an easy way to get a paycheck[1]

[1]: [https://caddy.community/t/caddy-and-certmagic-have-new- owner...](https://caddy.community/t/caddy-and-certmagic-have-new-ownership-no- changes-to-licensing-or-development/9754?u=matt)

<comment><USER28> amazing! thank you

</comment></comment></comment><comment><USER30> so is this an acqui-hire?

</comment><comment><USER31> is there anything for caddy, like nginx nchan ?

<comment><USER14> Not currently, no. It shouldn't be too hard to implement a plugin that does something similar though! If there's an existing pubsub solution in golang, it could be integrated into Caddy.</comment></comment>


Effects of battery manufacturing on EV life-cycle GHG emissions [pdf] - jerome-jh https://theicct.org/sites/default/files/publications/EV-life-cycle-GHG_ICCT-Briefing_09022018_vF.pdf <comment> jerome-jh Linking PDF because summary is a bit too optimistic IMO. Key takeaways:

Estimates of GHG emissions when manufacturing LiIon batteries varies ten folds.

An EV may have emitted less GHG than an ICEV after 150000km, although that strongly depends on the above estimate and the electricity mix where the car is driven.</comment>


This Tech Bubble Is Different - <AUTHOR> http://www.businessweek.com/magazine/content/11_17/b4225060960537_page_5.htm

<comment><USER2> The link starts on page 5.</comment>


2 tickets available for Mega Start Up Weekend tomorrow in Mountain View - <AUTHOR>

Do you want to be a part of the Mega Start Up weekend event. The event is divided in 3 major categories, Health, Education and Gaming. We have 3 tickets avail for non-developers (but developers can get them) for the Gaming category. Please reach me if you want them. -Juan <comment><AUTHOR> I forgot to mention my email. Reach me at: email@example.com</comment>


Show HN: Offline – Access your favorite websites without a network connection - <AUTHOR> https://play.google.com/store/apps/details?id=com.gashawmola.offline

<comment><USER2> Anyone else remember when this was a standard feature in a lot of desktop browsers? Or am I crazy.

<comment><USER3> You are not. I hate how browsers nowadays, especially browsers on smartphones, are unusable without access to Internet. Sure, there is Pocket for instance, but IMHO there shouldn't be need for such app. And while I'm ranting at Pocket - there is still no automated login for LWN.net. (I know I can go with manual way, but still...)

P.S. I'm thinking about making nice dedicated cross-platform LWN.net articles & comments reader one day (well, maybe more), but it's hard to squeeze out enough time for that kind of fiddling (unless it's really a gravely matter, but it isn't here).

<comment><USER4> Opera Mobile (the "classic" one before they threw it all away) let you save pages for offline reading. Not perfect but better than nothing. Sadly it did not cache content through restarts which is annoying on mobile where apps get killed a lot. But if I recall correctly at least the navigation back and forward was instant, like on desktop, with no network traffic.

</comment></comment></comment><comment><USER5> I would love to be able to cache websites to my server and access them in the event the site goes offline. I've tried a number of things like wget to "offline" a website and had mixed success. Does anyone know of a proven way to do something like this? (I'd even settle for no images a la google archive/cache but pulling images and scripts would be a huge win)

I'm younger but I can already see link-rot destroying my bookmarks. I now use (and pay) for pinboard.in however I'd like a way to do it myself. I've considered writing a chrome plugin to send url's I visit over to a process running on my server to archive it (with the ability to black/whitelist domains) but haven't found a way to do it yet the works reliably (I'd also probably need to send a copy of my cookies for auth sites).

<comment><AUTHOR> How often a descent website goes offline?

<comment><USER5> What we consider "decent" today is not always "decent" tomorrow and things like personal blogs go down all the time or change their URL structure. Also not everyone has a community/family that will keep their work online after they are gone and I don't want to lose content because someone's hosting lapsed after their death.

Looking back I wish I had archived some of the forums that I used as a kid as a number of them are just gone, no wayback machine, no cache, no archive, just gone.

Sidenote: I'd love to work or just use on a service that can will allow for community funding of both hosting/domain reg so that you could add a widget on your site and have it stay online even after your death as long as people donate, maybe even make the site static if no one can pay and use proceeds from other sites to float the cost. There is a chance that you could die and your close friends/relative would either not have the access (password/key) or technical know-how to keep your site online even if they had the funds to do so

</comment></comment></comment><comment><AUTHOR> Started as a weekend project but took me almost two weeks. Please share any feedback.

<comment><USER6> Thank you, it's pretty sad that we've had to wait years for something that was available in nineties versions of Internet Explorer.

<comment><USER7> We didn't, I've been using Offline Browser[1] for quite a while now. This does seem more polished, though.

[1] [https://play.google.com/store/apps/details?id=it.nikodroid.o...](https://play.google.com/store/apps/details?id=it.nikodroid.offline)

</comment></comment></comment><comment><USER8> One nice feature would be a "follow the next page button" mode for following serials like web comics. Instead of starting from a home page and following all links to a given depth, you would give it the URLs for page 1 and page 2. It would search page 1 for the button that leads to page 2, and then it would find that same button on page 2 to get page 3, and so on. In other words, it would simulate starting at page one and repeatedly pressing the "next" button to read the whole serial.

<comment><AUTHOR> Good idea, I'll consider adding it in next versions.

</comment></comment><comment><USER9> When I used to access the Internet via dial-up modem, and pay for every second online, I'd always browse via WWWOFFLE[1] and then be able to just return to where I had been after going offline. I think I remember putting something in a CHAP script to tell WWWOFFLE I was on/offline.

[1] [http://www.gedanken.org.uk/software/wwwoffle/](http://www.gedanken.org.uk/software/wwwoffle/)

</comment><comment><USER10> How does it compare to existing stuff such as HTTrack ?

<comment><USER11> Offline seems to be like HTTrack for Android (Which is a greatly idea, actually).

</comment></comment><comment><USER12> Seems like it doesn't handle non responding links/webservers. Crash report sent.

<comment><AUTHOR> Thanks for reporting, does it work for other links?

<comment><USER12> Seems to be fine so far, doesn't seem to be resuming download upon stop/restart, might be only me :)

Thanks for the dev so far, looks pretty good.

</comment></comment></comment><comment><USER13> Microsoft's Spartan is meant to have something similar to this. Will apparently sync to your Windows 10 Mobile 'reading list' as well.

Sounds interesting.

<comment><USER14> Do you have any source

I hope this idea will catch on and other browser vendors will implement this feature as well.

</comment></comment><comment><USER15> Doesn't the stock Android browser do this? At least I know it offers me a "save for offline reading" option

<comment><USER16> Can't find that option in _my_ stock Android browser - what menu is it under?

<comment><USER15> Jut the normal "menu" menu (presented when you press the menu button). I am running 4.1.1 so nothing recent.

</comment></comment></comment><comment><USER17> Does anyone have a rec for similar software on iOs. Unfortunately my firm won't let me use android.

</comment><comment><USER18> Is this Free Software? In case it is I encourage you to make it available on F-droid!

</comment><comment><USER19> Very useful and simple to use :). +1 for the material design usage.</comment>


Beta for WARP for macOS and Windows - <AUTHOR> https://blog.cloudflare.com/announcing-the-beta-for-warp-for-macos-and-windows/ <comment><USER2> One of the fun things about working at a place is you get to try stuff out early; as a Windows user, I was one of the first folks outside of the team to try out Warp for Windows.

I would say "I'm happy to answer questions" but I'm not sure what I could answer; for a while now, I frankly forget that I have it even installed. It pretty much Just Works.

<comment><USER3> Here's a question. I've read the article twice and I can't figure out what the product is. What is it? Is it a VPN service?

<comment><USER2> So, 220.127.116.11 is Cloudflare's public DNS resolver. It's the fastest resolver on Earth: [https://www.dnsperf.com/#!dns- resolvers](https://www.dnsperf.com/#!dns-resolvers) It's fast because Cloudflare has 200 data centers all over the globe, and you connect to the nearest one.

Warp is a set of apps that will set your phone (and with this, today, your computer) to use 126.96.36.199 for resolving your DNS. But additionally, it uses the Wireguard protocol to connect, which is a VPN protocol. This hides the contents of your connection from your ISP or network provider. It _does_ mean you're connecting to Cloudflare, and so we've made a bunch of privacy commitments, and gotten external auditing to back those up: [https://news.ycombinator.com/item?id=22747770](https://news.ycombinator.com/item?id=22747770)

The above is all free. You can pay a small subscription fee to get access to Warp+, which uses Cloudflare's "Argo" product to route your requests faster.

Does that make more sense?

<comment><USER4> From the original blog post announcing Warp, I would have thought "yes, Warp is a VPN service" was the right answer:

[https://blog.cloudflare.com/1111-warp-better- vpn/](https://blog.cloudflare.com/1111-warp-better-vpn/)

My understanding of that blog post is:

* 22.214.171.124 is Cloudflare's DNS resolver.

* Warp is a free VPN service, using the Wireguard protocol, with the exit at your nearest Cloudflare data center.

* Warp+ is a $5/mo. paid tier of the VPN service, with the exit at the Cloudflare data center nearest your destination, which ought to be faster.

* All of these are enabled on mobile via the app called "18.104.22.168".

I don't think "Warp is a set of apps that will set your phone to use 126.96.36.199 for resolving your DNS" is right -- but I could be misunderstanding either the product or Steve's summary ...

<comment><USER2> Yes, I got the name of the app wrong; it's called "188.8.131.52". I have been using it only since the Warp stuff was added, so in my brain it's called "warp" even though that's not actually correct, sorry.

Warp _is_ a vpn service, but I hesitate to just say "yes" in this case because of the caveats around end-users seeing your IP. Many folks use vpns to attempt to hide information from the site that they use, but this doesn't inherently do that, it hides the information from your internet provider. When this was announced on HN, there was a lot of arguing about that, so I tried to sidestep it by just saying plainly what it does.

</comment></comment></comment></comment></comment><comment><USER5> Can I run my own WARP server? If not, I'm not that interested.

If I'm trading one centralized service for another, there is no net gain.

<comment> yjftsjthsd-h I dunno; I don't know if I really like or trust cloudflare, but I'm sure I trust them more than my ISP.

<comment><USER6> Yup, that's exactly where I sit. A well implemented VPN is useful because I heavily distrust my ISP. I _could_ use some other big VPN provider, I guess, but I've always admired the tech stack of Cloudflare.. so I'm interested.

And fwiw, since I'm sure someone will think it - I don't want to manage my own VPN on some remote server. Not only would I put myself at risk because I don't have the experience to manage a secure server of such importance, but all I did was move my risk from my ISP to some other endpoint (VPS hosting/etc).

It feels like a game of risks no matter what you do.</comment></comment></comment>


How to apologize for fixing a non-bug: Instapaper - <AUTHOR> http://blog.instapaper.com/post/1135784328

<comment><USER2> Sometimes 'technically correct' isn't always the best kind of correct.

Thanks, Futurama.</comment>


Show HN: Emoji Info API - <AUTHOR> https://www.emojiinfo.com/ <comment><AUTHOR> Hi, HN,

Emoji Info is a service that exposes emoji data in over 42 human languages as a simple JSON-based API.

I made this service because I've been actually using this API on my projects so I think other developers and companies also might find this useful. Try the demo on the site now and let me know what you think!

I also posted on Product Hunt. Visit if you want to engage there: [https://www.producthunt.com/posts/emoji-info- api](https://www.producthunt.com/posts/emoji-info-api)

</comment><comment><USER2> Looks cool, although I would expect usage stats or demographics at least. Or perhaps URLs of GIFs that have the same emotion.

As it stands, there isn't too much information on it and the smallest API tier probably has enough requests to fetch data about all emojis, save them in a JSON file and use that as your data source instead of the API.

<comment><AUTHOR> Thank you for the response! Yes, I'd like to add more data that is useful.</comment></comment>


Trickle‐down technology and why it doesn't work (2013) - <AUTHOR> https://ar.al/notes/trickle-down-technology/ <comment><USER2> Yeah, tools built for experts usually won't be adopted by the mainstream unless they are simplified.

I don't mean dumbed down but reduced in complexity to allow beginners to use it without having to acquire expertise.</comment>


Ask HN: What tools do you use for working with a DAG (Directed Acyclic Graph)? - <AUTHOR> Lots of types of information can be represented as a DAG but I don't know any Excel style tools for working with this type of data. What do you use for organizing, analyzing, and understand DAG structured data? <comment><USER2> I created a graphdb in python which _might_ be helpful [https://github.com/amirouche/AjguDB](https://github.com/amirouche/AjguDB)

</comment><comment><USER3> Neo4j is a good option for organizing and viewing graph data

<comment><AUTHOR> Looks awesome

<comment><AUTHOR> Can't edit my comment but looks like cayley.io is an open source alternative

</comment></comment></comment><comment><USER4> networkx (python library), graphviz (command line tools for viz)

<comment><AUTHOR> Yeah I use networkx to edit and Cytoscape to visualize with json files for saving. But it's definitely not the best workflow since you can't edit and view from one place, you have to export, view it, and then go back to make changes.</comment></comment>


Purple.com, since 1994 - <AUTHOR> http://www.purple.com/

<comment><USER2> Damn, must be worth at least $10m I would think. Sell it to Cadbury. They own a trademark on the color purple.

It's owned by this guy, Jeff Abrahamson, currently a software engineer at Google, London:

[http://fr.linkedin.com/pub/jeff- abrahamson/1/414/5](http://fr.linkedin.com/pub/jeff-abrahamson/1/414/5) [http://jeff.purple.com/index_en.html](http://jeff.purple.com/index_en.html) [https://twitter.com/Jeff_Abrahamson](https://twitter.com/Jeff_Abrahamson)

</comment><comment><USER3> Running Google Analytics no less!</comment>


Embargoed OpenSSL Vulnerabilities - <AUTHOR> https://mta.openssl.org/pipermail/openssl-users/2015-March/000778.html

<comment><USER2> Libs are always a pain to patch at the OS level, because you are not really sure what links against the lib, you can do some manual work but most often a reboot is way easier. Here is a pretty common pattern, that I use, if I cannot reboot right away. Doesn't hurt to go through the motions, then you have a pretty good idea of what needs to be done, stops the panic patch work ;)

On RHEL/CentOS, you can use needs-restarting, to tell you what processes need restarting after a lib update.

      sudo yum update
      sudo yum install yum-utils.noarch
      sudo needs-restarting

On Debian/Ubuntu, you can use checkrestart, to tell you what processes need restarting after a lib update.

      sudo apt-get update
      sudo apt-get upgrade
      sudo apt-get install debian-goodies
      sudo checkrestart -v

Helps to work through this manually, wrap your head around what needs to be done, then you can push that into automation tools if you have a large enough infrastructure. Here's a screencast about the pattern for anyone interested in learning more.

[1] [https://sysadmincasts.com/episodes/44-patching-the-ghost- gli...](https://sysadmincasts.com/episodes/44-patching-the-ghost-glibc- gethostbyname-cve-2015-0235-bug)

</comment><comment><USER3> In case anyone was wondering what "high" means -

[https://www.openssl.org/about/secpolicy.html](https://www.openssl.org/about/secpolicy.html)

 _high severity issues. This includes issues affecting common configurations which are also likely to be exploitable. Examples include a server DoS, a significant leak of server memory, and remote code execution. These issues will be kept private and will trigger a new release of all supported versions. We will attempt to keep the time these issues are private to a minimum; our aim would be no longer than a month where this is something under our control, and significantly quicker if there is a significant risk or we are aware the issue is being exploited._

</comment><comment> Stefan-H Now is the time to ensure you know what your surface area is for OpenSSL. Do you terminate SSL on your hosts? Do you have a loadbalancer that terminates SSL for you? Do you distribute OpenSSL to clients? Do you have network devices that have OpenSSL on them? These things are all important for you to know to be able to handle the response to whatever drops on the 19th correctly. Good luck!

</comment><comment><AUTHOR> Hope to see a lot of OSes properly contacted and ready to release fixes on 3/19</comment>


Lilium's successful test flight of the world's first electric VTOL jet [video] - <AUTHOR> https://techcrunch.com/2017/04/20/watch-liliums-successful-test-flight-of-the-worlds-first-electric-vtol-jet/ <comment><USER2> It's technically not a "jet". They're using a large number of ducted fans for propulsion.

</comment><comment><USER3> This reminds me (in a good way) of Paul Moller's SkyCar vaporware that I've been tracking since seeing it on the cover of Popular Mechanics as a little kid.

It's so cool to finally see something that is actually in the air... that 186 mile range sounds high for batteries, though. If they've really reached that, I'm impressed!

</comment><comment><USER4> I look forward to a Lilium button on the Uber app.

</comment><comment><USER5> Will this be autonomous? From the video, it looks like there is no one piloting. IMO, autonomous flight will be the only thing that makes this successful. Very cool nonetheless.

<comment><USER6> Theyre currently unmanned. Their plan according to the site is a manned flight in 2019

</comment></comment><comment><USER7> Looks cool, Specs look awesome, but I can guarantee I could not afford one.

Make it autonomous and call Uber/Lyft</comment>


Yann LeCun's answers from the Reddit AMA - <AUTHOR> http://fastml.com/yann-lecuns-answers-from-the-reddit-ama/

<comment><USER2> I found this a tantalizing tour (although a bit too much of an insider's tour for my knowledge level) of a lot of the current state of the art in Machine Learning. Well worth a read if you have any interest in the topic.

I also looked at some of the videos in the course linked at the end, and found the teaching quality disappointing (not very clear, fast speech, mumbling.. though to be fair I only saw two different professors).

Does anyone know of a really great quality (meaning attention to good quality communication of concepts... not necessarily slow or "for dummies" but clear) online intro course to Machine Learning?

</comment><comment><USER3> Thank you for sharing. I like his appreciation of Physics. Physicists seem to do well in many non-Physics fields (economics, financial markets, CS, etc) and I've frequently wondered if it's because you have to be smart to go into the field, or if there are special tools they learn. I like Yann's comments on the applied nature of it.</comment>


Meet the Endoterrestrials - <AUTHOR> https://www.theatlantic.com/science/archive/2018/10/meet-endoterrestrials/571939/?single_page=true <comment><USER2> > _Templeton is one of a growing number of scientists who believe that the > Earth's deep subsurface is brimming with life. By some estimates, this > unexplored biosphere may contain anywhere from a tenth to one-half of all > living matter on Earth._

I know the emphasis should be "some", but even then this is a _lot_ of biomatter. How do they come to that number?

<comment><USER3> Volume vs. surface area. The life more familiar to us is concentrated to what amounts to a 2D surface. Oceans are mostly devoid of life excluding surface waters where sunlight is available and seabed ecosystems.

</comment></comment><comment><USER4> This long article finally gets to a useful point and explains how there could be life on the bodies in the Solar System. Microbes eating hydrogen could actually be viable on Mars and other places, just like they do "down in the crust" on Earth. There's actually no reason it couldn't work on many places.

</comment><comment><USER5> > "This is beautiful rock," said Templeton, running a latex-gloved finger over > its surface. Her sunglasses were pushed back over her straight brown hair, > revealing cheekbones darkened from years of working outside on ships, on > tropical islands, in the high Arctic, and everywhere else her work has taken > her.

What a bizarre section. Would the author _ever_ write about a man like this?

<comment><USER6> > Would the author ever write about a man like this?

I think so. It's perfectly in the style of these crappy mass-produced long read articles, padded with every possible cliché and useless piece of information to sound like exciting stories. I'm sick of skimming through tons of padding text to extract the smallest nuggets of valuable information.

<comment><USER7> I wish there was a service where you'd send a url of an article such as this one and it'd spit out a summary with only the relevant data and without all the surrounding cruft. Something like a tl;dr for this type of articles.

<comment><USER8> It's called an abstract, and it's a thing for scientific papers. If you want literally none of the human side of a story or discovery, research papers are a great solution and don't need to be recompiled from longform journalism.</comment></comment></comment></comment>


Quantum computing traps in Minecraft - <AUTHOR> http://www.wired.com/wiredenterprise/2013/10/minecraft_quantum/

<comment><USER2> I love how Google spends money on things like this, inspiring the next generation - the good news for them today was well deserved!</comment>


How Redis works for beginners - <AUTHOR> https://engineering.golr.xyz/2016-11-17-how-redis-works-for-beginners <comment><USER2> Nice of you to provide this write-up. Apropos Blogd, have you considered implementing it as a Redis module instead of forking?

<comment><AUTHOR> Yes, but I think Redis module is in development and is not stable now.

<comment><USER2> Indeed it is but the 1st RC is expected within days/weeks so that would be the direction I'd be exploring from now on ;)</comment></comment></comment>


DIY masks for all could help stop coronavirus - <AUTHOR> https://www.washingtonpost.com/outlook/2020/03/28/masks-all-coronavirus/ <comment><USER2> The presence of any type of mask is effective in reducing casual virus transfer by hand contact between the mouth, nose and eyes - these are the infection routes for contact infection. The penis and vagina are also contact points for infection, so make an ad-hoc mask, Here is one that works because shop towels ar a lot better than paper towels. [https://www.youtube.com/watch?v=mai- UqdNRi8](https://www.youtube.com/watch?v=mai-UqdNRi8)

It also helps block breathing in or out of droplets

</comment><comment><AUTHOR> [http://archive.is/Dlabz](http://archive.is/Dlabz)</comment>


How to abuse HTTP - <AUTHOR> http://pawelmhm.github.io/http/2015/06/04/how-to-abuse-http.html

<comment><USER2> Another good abuse example is setting weird cache related headers. For example caching the same 5xx page with response code 200 whenever on the browser or proxy engines like varnish</comment>


Own This Website - <AUTHOR> http://own-this-website.com

<comment><USER2> Fun concept! Here is what I see as possibilities to own the website, with gradual power: make a client using a single socket that refreshes every 1/3 second [1] ; add multithreading and have 133 [2] sockets open at the same time to make requests; use multiple servers to execute the previous program. You also have to keep in mind that you will get busted very quickly if you just spam your name ; you have to check that you're not currently the owner of the website.

Nice idea though!

[1] [https://github.com/rileyjshaw/own-this- website/blob/master/s...](https://github.com/rileyjshaw/own-this- website/blob/master/server/main.js#L63)

[2] [https://github.com/rileyjshaw/own-this- website/blob/master/s...](https://github.com/rileyjshaw/own-this- website/blob/master/server/main.js#L76)</comment>


World of Warcraft hobby sparks US political row - <AUTHOR> http://www.bbc.co.uk/news/technology-19842704 <comment><USER2> Bringing up quotes with game-specific terminology without proper context - like "I got deeper into assassination" - makes me wonder how you could twist the perception of, say, programming in a similar way.

Maybe "She puts children on a tree and removes their parents!".

<comment><USER3> maybe a better example would be anything to with "master" "slave" relationships.

<comment><USER4> A coworker and I were de-duping records in a database. One of us said while pairing on the script "well, every slave needs a master."

An african american woman in the office turned to us and said "maybe it's the master who needs the slave?"

She wasn't really offend or anything and she said it with a sincere smile. She was just calling out our idiotic computer lingo for what it was.

After apologizing feeling like complete idiots we quickly changed our terminology both in words and in the script to parent/child.

</comment></comment></comment><comment> think-large I can't believe how ridiculous this is. I think that this will definitely just earn her a bigger following among her fellow players and only alienate the older crowd who wouldn't like her anyway.

Politics makes me sick.

<comment><USER5> > bigger following among her fellow players

Most of which don't vote.

> and only alienate the older crowd

Most of whom do vote.

<comment><USER6> "who wouldn't like her anyway" Yea you missed that part, because it's true. Most of the older crowd in Maine are hard core conservative republicans.

<comment> think-large Thanks, that was my point.

</comment></comment></comment></comment><comment><USER7> If you're resulting to insulting someones orc in a political campaign, you're clearly running desperately.

<comment><USER8> Correct!

What matters is whatever they are blabbering about actually gets them out of office or paints a negative picture to enough people that it makes a difference.

If it is not effective, that's when things get interesting, I believe. It could mean a number of things; younger people are voting more, games are becoming more widely accepted as not a bad thing, for instance.

In the latter case, one could argue that the perpetrators are very much out of touch.

<comment><USER7> If it works (and I hope it doesn't) then I guess it can be viewed as a successful way to win, but it's a bit desperate if they're resorting to attacking something like that over policy or similar.

If it doesn't work, I hope for the most part it means the wider population assumes she'd be good at her job and what she does online is her own business, but if it means younger people think of voting that's also a good thing.

</comment></comment></comment><comment><USER9> If it didn't say BBC at the top, I'd assume this was an Onion article.

I'd vote for her because, you know, For the Horde!

</comment><comment><USER10> The main thing that this will probably achieve is pissing of WOW players who are eligable to vote in US elections.

</comment><comment><USER11> The despicable world of American politics continuously out-does itself.

Who cares what the politicians are doing when not at work, especially if it's a harmless hobby?

<comment><USER12> Nobody. As a native of New Hampshire (right next to Maine), I can attest that no one really cares.

</comment></comment><comment><USER13> I really hope that what will happen now is that those who do not care about games will do not care about this, and the gamers will be pissed, voting for her. Also as others have pointed on reddit the fact that she managed to get in a good position have a family and play a game show that she knows how to manage her time.

</comment><comment><USER14> Personally, knowing that a politician plays video games in their spare time makes me want to vote for them! It means they are more likely to be able to identify with my demographic.

<comment><USER5> Video games are fine. For me, WoW crosses a line to addictive obsession. I don't think games like WoW are good for society in general, just because they are _too_ addictive and consuming. Before you know it, you've lost 5 years of your life and achieved nothing.

<comment><USER15> I think that's more about the player than the game. Most people would consider Halo a pretty casual game, but I've lived with people that played 4-5 hours of it per day (on average). Similarly, I used to play WoW for a few hours per week, and then just got bored and stopped. Not exactly addictive.

<comment><USER14> I think a case _could_ be made that games like WoW are designed to attract and exploit addictive personalities. The WoW playerbase probably contains a higher percentage of addicts than most other games, since the game's quest structure is fine-tuned to balance the frequency and quality of rewards. That said, you're absolutely right, this does not mean that everyone who plays WoW is a basement-dwelling addict.

<comment><USER16> WoW is ethically worse than, say, Mario, but better than a slot machine, which is in turn better than everything from Zynga.

<comment><USER17> How are ethics involved in WoW? (Sincere question)

<comment><USER16> Oh, I mean in the sense that it is manipulating players into continuing, I think it's ethically questionable.

<comment><USER17> See, as somebody who was addicted to the game for a few years during college, I don't see how it is manipulating anybody? The game is fun and it has a lot of content and they keep adding content. It was MY lack of self control that led to me playing the long hours I did, it had NOTHING to do with Blizzards "manipulation".

Blizzard is in the business of making money through making games. It is in their interest to keep users playing month to month because of their recurring fee. In order to do that, they need to keep the game fresh so they introduce a lot of content. People want to play this new content so they keep playing.

<comment><USER18> The idea of manipulation in games is when they add specifically add game elements meant to keep the user in the game, and encourage them never to leave. Sure it's all a matter of self-control. Not losing your life-savings at a casino is also about self-control. That doesn't mean that casinos can't do ethically dubious things to take advantage of people without self-control.

E.g. The inside of a casino always looks the same, even at night. No windows (being near the entrance is the exception), lots of bright lights. It makes it easier for a gambler to lose track of time.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Obama, for one, plays poker and drinks beer. Both of which have a dark side. I bet he bluffs in poker.

Will someone make a website saying not to trust him because he is deceitful in poker?

</comment><comment><USER20> I'm curious how this will turn out. Is videogaming as much of a campaign- killer as atheism?

<comment><USER21> No, most definitely not. Atheism will get you nowhere in American politics. We'll have a gay president before we have an atheist president. Which, truth be told, I would love a gay atheist engineer for president. Let's get our priorities straight :)

<comment><USER22> American voters would rather elect a gay or Muslim president than an atheist. Here is a 2012 Gallup poll:

[http://www.gallup.com/poll/155285/Atheists-Muslims-Bias- Pres...](http://www.gallup.com/poll/155285/Atheists-Muslims-Bias-Presidential- Candidates.aspx)

<comment><USER21> That's an interesting poll, thanks!

</comment></comment></comment></comment><comment><USER23> Blizzard should make her a skin, and also a super PAC. That would be so great.

</comment><comment><USER24> As much as I would like to attribute this purely to political banter, I think it reflects a general attitude in the broader society: video games are still not considered equal to the arts, often considered "a waste of time" and childish. Just look at the reporting when theres been another school rampage.

(Of course, the same crowd clamoring for a ban on videogames has no problems with splatter horror movies in the theater, which from my experience surpass any game in realism and pointless violence)

</comment><comment><USER25> Is it just me, or has there been a more-than-normal amount of mud-slinging in politics this year?

<comment><USER26> nope - same old same old <http://www.youtube.com/watch?v=Y_zTN4BXvYI>

at least nobody called anyone a "hatchet-faced nutmeg dealer" yet

<comment><USER27> The level may be the same, however the sheer volume of mud slung in this campaigns cycle dwarf anything seen before, thanks largely to super PACs. We're probably not going to see anything like this again, until the next election cycle.

<comment><USER26> Per capita, I doubt it. We have a lot more avenues to escape this kind of stuff now, and politics was much more of a concern of folks back then.</comment></comment></comment></comment>


Styled Maps Using Google Maps API Version 3 - <AUTHOR> http://www.41latitude.com/post/1268734799/google-styled-maps

<comment><USER2> Those features are already available for a long time in the free software map clients (e.g. OpenLayers) using free map data (e.g. OpenStreetMap).

With OpenLayers, you can even customize the behavior of your map, because it is designed as a JS library rather than a proprietary web API. Also, the clean separation of presentation (map client) and data source (any map server speaking WMS/WFS/whatever) enables you to combine any map data from any sources. Thus, handy overlays are possible without relying on the mercy and the pre-defined possibilities of Google.

<comment><USER3> Say I want to create a fictional map for use with OpenLayers - what's the best way to go about this?

<comment><USER4> Any geographical information software (GIS) offer tools to create spatial data, from scratch or by copying / digitalizing sources.

[http://en.wikipedia.org/wiki/List_of_geographic_information_...](http://en.wikipedia.org/wiki/List_of_geographic_information_systems_software)

Then you can style them, and design a map, using vector drawing software like Inkscape.

<comment><USER2> OpenLayers also provides editing capabilities. This is used for example in the OpenStreetMap project.

Note that his requires writing support (WFS-T or similar) on server side. However, the typical map servers such as GeoServer and Deegree all do support WFS-T.

<comment><USER4> Yes OpenLayers is the leading OS project for web maps, in my opinion. PostGIS/PostgreSQL DB backend is also used often to offer writing/modification, besides WFS-T. But to draw/digitize the spatial data, it could be more practical to use a desktop software, instead of a web app.

</comment></comment></comment></comment></comment><comment><USER5> This is awesome. Example 7 is going to be particularly useful for something I'm working on. Thanks for the post; I was actually looking at how to do this on my own, and now I don't have to. :)

</comment><comment><USER6> I used <http://maps.cloudmade.com/> for a mobile app did last year. It's a really great app for sketching and getting the overall look and feel right.

</comment><comment><USER7> This is _huge_. With API V3 and its accompanying "Wizard", Google has essentially democratized cartographic design. It's never been _this_ easy.

<comment><USER4> It's not cartographic design, it's styling (waaaay different).

<comment><USER8> This'll be news to a lot of people--esp. web designers.

Styling is encompassed under design (waaaay _not_ different).

<comment><USER4> Yep, but not vice versa :)

<comment><USER8> If you understand what you're saying... well, that makes one of us.

<comment><USER4> Styling is part of design, but not a major part. Am i clear, now ?

<comment><USER9> These "splitting hairs" comments are lame and unnecessary.

<comment><USER4> <http://xkcd.com/386/> :)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Love the part with discouraged colouring - they actually remind me of the trippy part of 2001: A Space Odyssey where Dave goes through the monolith. How long until someone makes a completely crazy Maps mashup using exactly those colours?

</comment><comment><USER11> This is an interesting change to the GMaps infrastructure. In the past, all map tiles were pre-rendered, but now it looks like they are being generated dynamically. Anyone got any inside info as to what lead to that change?

<comment><USER12> As far as I know, tiles have always been rendered on the fly.</comment></comment>