Product Updates Based on Your Feedback - <AUTHOR> https://www.blog.google/products/chrome/product-updates-based-your-feedback/ <comment><AUTHOR> Like Eric Law[1], I felt like while there were some rough spots in the UX for the Chrome login and sync features, the issue was very overblown (I'd feel very differently if sync had been enabled automatically). I don't have much more to say than Law does --- except maybe that when _your arch-competitor is speaking out on your behalf_ , maybe the narrative has gone a little haywire.

I figured Google would do something cosmetic (again, that's all that I think they really needed to do) to clear up the misconceptions here, but they've added a Matthew Green switch (which is what we all need to call it from now on). That's better than I'd hoped for.

[1]: [https://textslashplain.com/2018/09/24/chrome- sync/](https://textslashplain.com/2018/09/24/chrome-sync/)

<comment><USER2> The sync thing was overblown. The cookies thing was a bit more concerning to me.

Not so much from a privacy angle but from more of a 'Chrome has lots its way' angle.

A lot of our software's more complex interfaces are Chrome-first since its faster to develop - yesterday was the first time I made a serious consideration to change that approach.

Glad to see they are listening to user feedback and reacting quickly.

<comment><USER3> The cookies thing could be seen as a bug: the button does remove the cookies, but because your google sign in state is now tied to the browser sign in state, new cookies will immediately be set.

To fix this, the "remove cookies" button would also have to sign you out of chrome which would also feel weird from a UX perspective.

All in all I think this was just released a bit early before all UX edge cases could be tackled (or even discovered. Sometimes you find things only in wider rollouts)

<comment><USER4> If exempting Google's cookies from being cleared was a bug, they would not have added a message in the UI that "you won't be signed out of your Google Account":

[https://twitter.com/ctavan/status/1044282084020441088](https://twitter.com/ctavan/status/1044282084020441088)

</comment></comment></comment></comment><comment><USER5> Won't change my mind and will stick to Firefox after having switched because of this. First I don't want to be logged in in my browser at all. Second, and probably more important, software is about trust. Even for an open source project, no one has the time to review millions of lines of code. So unfortunately one has to rely on what one believes is the behavior of the authors of the software. And what google did is to shatter that trust by sneaking that change discretely.

<comment><USER6>
        I don't want to be logged in in my browser at all

Same here. Why does Chrome log you in in the first place?

I mean I know it from the companies perspective of course. They want to consolidate as much data about you as possible. And tie you into their ecosystem.

But what is the user facing benefit? Syncing your bookmarks across devices?

<comment><USER7> > But what is the user facing benefit?

Syncing bookmarks, recently opened tabs, passwords, autofill(?). These are genuine benefits when you're working with laptops, desktops, phones and tablets. Whether they're worth the cost of data mining is another matter of course.

<comment><USER6>
        These are genuine benefits when you're working
        with laptops, desktops, phones and tablets.

I work with all of these devices. Yet I don't want any of that syncing.

The thought that Google wants to send my 'recently opened tabs' to their servers makes me shudder. So they get the whole browsing history of every one of their users? Of all the pages that have _nothing_ to do with them?

Same with passwords. So they have a gigantic database with all of their users passwords for all the services the users use? Even those totally unrelated to Google?

<comment><USER8> > I work with all of these devices. Yet I don't want any of that syncing.

So... you're happy that they're giving you the option to turn it off then, right? I mean, you appear to concede that someone users want this. You want the option to turn if off, which you're getting. That seems like good news.

Except your tone doesn't seem to match your logic.

FWIW: I use Firefox too. But... I mean come on folks. They messed up, they're fixing it. The obsession with hatred and flamage is getting a little out of control.

<comment><USER9> The issue is that trust breaches can't just be rolled back. You put people in a situation where they don't want to get caught out by the next change that the press doesn't pick up and/or you don't hear about.

</comment></comment></comment></comment></comment></comment><comment><USER10> I have already switched to Firefox and loving it (Facebook container, tracking protection enabled), but these changes are welcome and responsive.

I hope this is a wake up call that privacy implications need to be seriously considered during product design (even if the intent was better UX), and hidden changes without any UI/notice is going to make issues blow up far more than if there was clear in-app communication.

<comment><USER11> I did as well. DuckDuckGo, ublock origin, privacy badger. I haven't used Firefox seriously in 5 years or so and I'm very pleased with the experience.

To be honest, it's best to use an independent company for your internet browser. Google's incentives and business model no longer matches web browsing for someone who cares about privacy.

<comment><USER12> > I haven't used Firefox seriously in 5 years

Do you mean "I haven't used *Chrome" ..."? Otherwise I don't understand what you're trying to say.

<comment><USER13> They used Chrome previously and now they switched to Firefox and are happy with it, despite not having used it seriously in 5 years.

<comment><USER12> Ah, so maybe the meaning was "I've _just_ switched to Firefox after having not used it seriously for five years". It's interesting that that interpretation was so obvious to so many people but not me!

</comment></comment></comment></comment></comment><comment><USER14> Unfortunately, Chrome 70 is also when `www` subdomain is slated to get re- hidden, and when web audio breaking changes are slated to get re-introduced.

There's just too much to keep up with at this point.

I'm happy about this change, it's a big move in the right direction. But it doesn't give me any confidence for the future. It's crazy that users have to do this every single release. It can't continue like this.

I have no idea anymore what it would take to get me to switch back to Chrome or to start recommending it to friends and family. I feel like Google is actively training technical communities to distrust them. It's going to turn into some kind of Pavlovian response.

<comment><USER15> A Google representative has claimed on the domain hiding bug report that the change is shelved due to the feedback.

Edit: Permalink to the relevant comment: [https://bugs.chromium.org/p/chromium/issues/detail?id=883038...](https://bugs.chromium.org/p/chromium/issues/detail?id=883038#c60)

<comment><USER16> Yes, I think that's exactly what danShumway meant by "users have to do this every single release", i.e., give feedback about a big upcoming change that should never have been made in the first place.

One week it's the domain hiding, another week it's cookie clearing. Who knows what Google is planning to change next time? It's not sustainable for us to go reactive every month.

There's an awfully big disconnect if the makers of the world's most-used web browser are routinely trying to change it in ways that users force them to immediately revert. That's not what good stewards do.

<comment><USER17> >Who knows what Google is planning to change next time?

It's not exactly a secret. Go download Canary and see what's in the pipeline.

<comment><USER13> You missed paren't point. It's not about if you can see the changes immediately in the next release, it's that you have to be constantly vigilant as to what they're going to do next, like looking over your shoulder.

You can do that, but it's time consuming and exhausting. You're better off switching browsers.

<comment><USER17> That's overly dramatic. Both Chrome and Firefox are excellent browsers, and are developed in the open for all to see. They are examples of open source done right.

<comment><USER13> > Both Chrome and Firefox are excellent browsers, and are developed in the > open for all to see.

I still think you're misunderstanding. The problem is that Google as an organization has the incentive to pull shady shit. It may be noticed, but watching Reddit/HN to see if your browser, which should protect you/be trustworthy, is pulling shady stuff, or whether you may've missed a story of it doing so is still exhausting and keeps you wondering.

<comment><USER17> All companies have the potential to do shady things. The majority of Google's changes to Chrome have benefited end-users, and not Hacker News goers. We live in a bubble here, and lately it's been an outrage bubble. There's little substance to any of it.

A recent example: Hackers hate the idea of removing "www". Why? Because it's less accurate and we love accuracy. We think about what happens to the DNS if the www isn't a CNAME for the root, and how this isn't technically accurate.

Real users don't care. The UI is cleaner and make important information like what domain they're actually on more pronounced. This may help reduce phishing attacks and make URLs more legible.

Integrating sync is the same way. I'm not surprised that hackers hate it, but end users will appreciate the convenience. Android had the feature for years already.

We need to get out of this bubble and stop assuming we're the core audience. It isn't evil to design for somebody that isn't us.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> One positive, is that the response was fast and direct. In the past, negative user feedback has tended to be buried, or felt like it, or ignored, or felt like it.

This time, somebody decided the only clean path out was to be responsive: to make changes which reflected community concern and to _tell people about them_

Which I think, is good. I vastly prefer the google which tells people it listened, to the one which says it listens but doesn't tell us whats happening to the inputs we give.

 _(thats the one which lies behind any three-dots 'send feedback' hooks in almost any google app or s/w I use: I never get the sense anyone reads it, cares about it)_

<comment><USER19> > ... is that the response was fast and direct.

Communication about it seems to be. The actual code changes seem like they'll roll out in um... 3 or so months from now?

<comment><USER20> They clearly write in the blog that they'll make changes in Chrome 70 which will release in mid-october.

<comment><USER19> k, wasn't sure. I don't track the Chrome release schedule at all, so figured it was probably quarterly. Sounds like it's monthly then.

Looking again, yep mid-October. So, no rush then. A couple of weeks worth of extra data collection it is then.

<comment><USER21> Yes, I'm sure the code is ready but some evil mastermind twisted their mustache and said "No... let's collect two weeks more of data! Bwahahahaha!"

<comment><USER19> As dumb as it sounds... that's kind of what their actions are indicating. :(

</comment></comment></comment></comment></comment></comment><comment><USER22> The fact that this all happened in the first place is really telling. It's nice that they've backed these features off (a bit) but there's a reasonably clear signal to take away from this.

When company and customer interest are misaligned this is the result. There are plenty of cases where a strong leader in the company with a strong ideology can hold this stuff back, but companies normally outlast those individuals and eventually there's nobody left to stand in the way.

It's wonderful that we were able to make enough noise and fuss that the cost/benefit shifted sufficiently but this will happen again, and then again, and so on... And eventually, we'll be tired of yelling or won't be able to yell loud enough.

Vote with you attention and your data and your money. Switch to Fastmail or Protonmail. Use Firefox or Brave. Buy a System76 laptop instead of yet another not-so-great-for-developers-anymore Apple macbook pro. Choose these options even if they aren't as good because if we don't support the handful of companies who are trying to do something other than gobble up all of our attention and data we're in for a really dark future for the web.

</comment><comment><USER23> Everyone seems to be arguing the utilitarian merit of this feature, but I just don't like what it signals for Google's approach to the web.

They're building in features that integrate their browser into their web pages.

As far as I'm aware no other major browser holder has done anything of that sort, but I'm probably missing some examples.

<comment><USER24> It does seem weird that this would be lauded. I want my browser to be completely independent of what I'm doing on the website because there is no telling what the browser might be doing on my OS and frankly if I want to sign into a website, I will. It's not any of my browser's business what I do on the websites I visit. This seems like a fundamental part of sandboxing but maybe other people don't see it that way.

I imagine more and more so called convenient features might come where Chrome can suddenly install entire Windows apps, clean my files, and replace my OS. Then again, why not. Who am I to tell Google how to compete, maybe they can replace Windows with something better by gradually bloating up Chrome into an OS inside an OS.

<comment> ux-app > maybe other people don't see it that way

If the HN backlash is anything to go by, a lot of people see it the same way as you (me included).

Every company will act in it's best interest not ours, particularly in the case of Google who are blatantly building out a vision of what they want the web to be for 1 singular purpose: to more closely monitor you for the purpose of selling your online activity to the highest bidder.

This much influence being concentrated is bad for the web.

Viva la revolución!

<comment><USER25> > If the HN backlash is anything to go by, a lot of people see it the same way > as you (me included).

HN isn't representative of most users of Chrome. I doubt that we qualify as "a lot" to Google. An extremely vocal minority, at best.

<comment> ux-app you're a techie i'm guessing? How many of your friends/family ask for tech support/advice? There's a serious multiplier effect at work. I'm a high school IT teacher. I influence approx 600 students per year. We now cover online privacy and I will be setting assignments that ask students to investigate and make reasoned arguments about the impact of Google's dominance on their privacy.

Once you annoy enough of the tech literate, word will start to spread. Slowly, then quickly. How do you think Chrome got its foothold to begin with?

<comment><USER25> I won't deny that the tech crowd can influence things, but it's become quite hard for regular users to quit the whole Google panoply of services and tech products. Mail, browser, maps, dns, search, etc... It isn't painless and easy to abandon all of this and I have doubts even tech-savvy influencers can counter it at this point, only by word of mouth.

And about how Chrome got a foothold in the first place, I distinctly remember Google agressively advertising their own product on their search engine page, and bundling the binary with everything under the sun (Adobe Reader, anti- virus, etc...). Every time you installed software, there was a good chance Chrome was included with it. Tech influencers had their part in the success of Chrome, but it definitely wasn't the only factor, or maybe even the most important one.

</comment></comment></comment></comment></comment></comment><comment><USER26> > We're also going to change the way we handle the clearing of auth cookies. > In the current version of Chrome, we keep the Google auth cookies to allow > you to stay signed in after cookies are cleared. We will change this > behavior that so all cookies are deleted and you will be signed out.

I _really_ want to know who the internal champion was for getting the cookies to be perma-stored in the first place. It has to be someone relatively high up and I'm genuinely curious how high it goes.

<comment><USER27> Based on what I know of the Chrome team, it was probably the conclusion of some UX manager or the result of a user study they did around Google authentication. If I had to guess: their end goal is not explicitly to collect more advertising data for Google, but it's to minimize friction around the use of Google services. This leads to decisions like the cookie one.

<comment><USER28> I don't know why but I get an intense feeling of disgust at "people at higher position" making stupid decisions like this one.

My cynicism kicks in and I feel like they know _exactly_ what they're doing, but the bottom line is more important than anything including causing a PR storm on HN and tech blogs.

Strip down emperor's clothes and truly reveal the nature of big corporations and their greed to ruin everything for the benefit of the shareholders and their bonus targets - ethics, privacy and environment.

Perhaps I have a problem with extreme levels of cynicism.

<comment><USER29> In my experience at Google, "people at higher positions" do not really make these kinds of decisions. Someone at the leafmost position in the organization comes up with some research and recommendations and if nobody stops them, they go ahead and do it. It's actually really disorganized.

<comment><USER28> I feel like integrating auto sign in, tracking and Google cookies is less of a disorganized decision and more of a premeditated, carefully snuck in effort for their ads business. All the stars align for the bottom line.

Just look at the state of Android. Try being a cell phone OEM who wants to use Android but without Google integration. Impossible.

<comment><USER30> > Try being a cell phone OEM who wants to use Android but without Google > integration. Impossible.

Tell that to Vivo, Oppo, Honor, Huawei, Xiaomi, Meizu, OnePlus, Lenovo, Qiku, Smartisan, Amazon, etc.

<comment><USER31> OK, try being and OEM who wants to use Android but without Google integration _in a country where Google is legal_. I think Amazon backs up that point, not yours.

<comment><USER32> Google is legal in Russia, and there is a rumour Yandex is going to launch Android smartphone in a month or so. And the store.yandex.com is up.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> This is probably the most important change:

> We're also going to change the way we handle the clearing of auth cookies. > In the current version of Chrome, we keep the Google auth cookies to allow > you to stay signed in after cookies are cleared. We will change this > behavior that so all cookies are deleted and you will be signed out.

</comment><comment><USER34> For those interested in source code, one can review Chromium's implementation of this feature in chrome_signin_helper [1], dice_response_handler [2], and adjacent source files in the /chrome/browser/signin/ folder [3], as well as the files in the /components/signin/core/browser/ folder [4]. To my eyes, it seems an API call is made from the browser to Google to obtain the signed-in state.

[1] [https://chromium.googlesource.com/chromium/src.git/+/master/...](https://chromium.googlesource.com/chromium/src.git/+/master/chrome/browser/signin/chrome_signin_helper.cc) [2] [https://chromium.googlesource.com/chromium/src.git/+/master/...](https://chromium.googlesource.com/chromium/src.git/+/master/chrome/browser/signin/dice_response_handler.cc) [3] [https://chromium.googlesource.com/chromium/src.git/+/master/...](https://chromium.googlesource.com/chromium/src.git/+/master/chrome/browser/signin) [4] [https://chromium.googlesource.com/chromium/src.git/+/master/...](https://chromium.googlesource.com/chromium/src.git/+/master/components/signin/core/browser)

</comment><comment><USER35> I have no doubt this is a direct result of the feedback in the hacker news thread. Googlers read our comments and take them seriously when there is true merit. Keep making noise folks, it matters.

<comment><USER36> Agreed. Now: does Mozilla read these?

I tried to switch to Firefox, but was stymied by a bug where Firefox consumes 100%+ CPU on MacBook Pro Retinas.

Firefox is basically unusable with this bug; Facebook takes forever to load, and even Reddit r/firefox shows "A webpage is slowing down your browser" bar at the top.

Active relevant bugs are here: [https://bugzilla.mozilla.org/show_bug.cgi?id=1404042](https://bugzilla.mozilla.org/show_bug.cgi?id=1404042) [https://bugzilla.mozilla.org/show_bug.cgi?id=1429522](https://bugzilla.mozilla.org/show_bug.cgi?id=1429522)

But apparently this has been going on for 2+ years and Mozilla hasn't been able to fix it.

Given rMBPs (I would think) would be a fairly large market share of people who work at Mozilla or use Firefox, it's both concerning and surprising that a bug of this proportion has gone on so long.

Edit: Jeff from Mozilla has reached out. I sent him a perf log and a screenshot. Tracking here: [https://bugzilla.mozilla.org/show_bug.cgi?id=1494186](https://bugzilla.mozilla.org/show_bug.cgi?id=1494186)

<comment><USER37> Neither of those bugs have to do with 100% CPU on rMBP. Their about using an inefficient presentation path which increases GPU power usage. You can mitigate this today by setting gfx.compositor.glcontext.opaque to true. Further, Firefox Beta has additional texture upload performance improvements that will reduce cpu usage.

If you're actually experiencing 100% cpu usage, post a profile using [https://perf-html.io/](https://perf-html.io/) and I can try tell you why.

<comment><USER36> Steps to reproduce:

1) Pick a rMBP. Any one.

2) Set display options - "more space" under System Preferences.

3) Run Firefox. Load any website. No extensions; safe mode doesn't matter.

4) 100%+ CPU, fans kick up and run high, system gets hot and slows to a crawl.

Chrome and Safari run totally fine under the same conditions.

It's documented pretty thoroughly in the first Bugzilla link I posted; the second one is an offshoot where they're trying to solve this specific issue. If you do happen to work at Mozilla, would really appreciate your help escalating.

EDIT: I now have a perf file showing significant issues when clicking on a YouTube video. It gives an error when trying to upload it to the site, but if you contact me through email (in my HN profile), I can send it over.

<comment><USER37> 1) I'm running a MacBook Pro (Retina, 15-inch, Mid 2015)

2) My display options are set to "more space"

3) I loaded this hackernews thread.

4) Firefox and it's child processes are using <1% cpu.

If I aggressively scroll this page I can push the cpu usage up. We have a variety of fixes in the pipeline that will help with this ([https://bugzilla.mozilla.org/show_bug.cgi?id=1429522](https://bugzilla.mozilla.org/show_bug.cgi?id=1429522), [https://bugzilla.mozilla.org/show_bug.cgi?id=1265824](https://bugzilla.mozilla.org/show_bug.cgi?id=1265824)). That being said, only 4.7% of our users are on MacOS so it's more difficult to justify prioritizing work specific to that platform.

<comment><USER38> 4.7% of your users, but what percentage of web developers?

If that second number is substantially higher (and I personally suspect it is, but I don't have data backing that up) I think it would be very reasonable for Mozilla to prioritize MacOS. Getting web developers to use firefox makes firefox work better for everyone because it makes more sites work well with firefox.

<comment><USER39> Yeah, we do prioritize Mac disproportionately to its market share for that reason. It does sometimes happen that we have to make hard calls though, and that's what Jeff is referring to.

On that note, one of the key motivators behind WebRender (our new graphics backend) is that it provides hardware acceleration across all platforms, including mac (whereas our current Direct2D acceleration works only on Windows). So Mac graphics performance should generally improve once we get that shipped.

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> Too late. I am already done with Google as I was done with Facebook a few years ago. There seems to be no end to the privacy issues and user exploitation that crops up. If it isn't one thing it is another.

These marketing / ad tech companies masquerading as consumer products will inevitably drift toward more invasion of privacy and user exploitation.

<comment><USER41> I agree, more people need to not accept these type pseudo apologies which provide a toggle to turn it off after the fact, they damn well know that 99% of people won't turn it off. And they are doing this on billions of devices.

Don't every freaking website have "Keep Me Signed In" (Don't use this on shared computer) message for decades already?

</comment></comment><comment><USER28> I've realized something over the years: Remember how "cool" Google was in 2007!? I vividly remember.

I have learned an important fact that Ad business is rotten at the core - meaning it has direct conflicts with users. Therefore, I can never come to trust any Ads businesses: Facebook, Google, Snapchat, etc and recently Adobe and Microsoft.

I'm disgusted at the state of advertisement in modern society. It ruined cable, radio, social media, road sides, magazines and the very fabric of society. Turns out that our attention has a huge price tag.

<comment><USER42> I generally agree. However without ads, how do you expect poor people to have (free) access to radio, magazines (well, cheaper), antenna tv?

<comment><USER28> At this rate, the poor are better off without tv, radio and magazines. They're largely just an entry portal into psychological extortion by these advertising firms.

I'm a huge fan of publicly funded media such as NPR and your local public radio station.

<comment><USER43> I'm also a fan of patronizing the media you enjoy. Content makers having a direct relationship with their consumers.

<comment><USER44> Choosing to watch ads is a way of patronizing the media you enjoy.

</comment></comment></comment></comment></comment><comment><USER45> I don't see how having the sign-in sync turned on by default can be compatible with "privacy by design and default" as mandated e.g. by the GDPR. I wonder if they will have to offer a EU version of Chrome soon therefore.

Anyway, 90-95 % of users will probably just stick with the default value because they either don't know about the option or don't care enough to change it, hence from Google's perspective introducing it won't hurt their data collection efforts that much while they can at least say they did something to protect people's privacy. This is why I think "privacy by default" is so important, and it's sad to see that some of the largest players in the data collection space still ignore it.

<comment><USER46> Sync isn't turned on by default. Sign in is. They're different settings.

<comment><USER45> With "sign-in sync" I meant the fact that signing in to a Google service will automatically sign you in to Google Chrome.

<comment><USER46> But then the feature you mention didn't affect storage if user data.

<comment><USER45> It's not about storage it's about tracking. If Chrome syncs your web-based login cookie with your Chrome authentication it means they will associate the data your browser generates with your user account. I don't know what they collect there but I assume it's something, as otherwise why bother to log someone in?

<comment><USER46> Why does it mean that?

It certainly means that it's possible, but of course it was potentially possible before, and the code is, afaik, open source, so you're free to look and see if they really are.

As for non-tracking reasons why this change: it improves the us for users who use multiple accounts or share accounts on a single system.

Sometimes things are just because they want a more useful product.

<comment><USER45> Maybe, it doesn't change the fact that it's not privacy by default, because that would require having the user explicitly opt in to the syncing of the two sessions. That has nothing to do with wether they actually collect or transmit any data.

<comment><USER46> >Maybe, it doesn't change the fact that it's not privacy by default

Why? If this change doesn't impact privacy, why is having it opt out not privacy by default? How is a no-op from a privacy perspective privacy- anything?

<comment><USER45> Is it a no-op though? From my understanding of the privacy policy, Chrome will send e.g. search queries along with other metrics to Google even when the syncing is turned off. As these things are turned on by default it means they would get associated (or at least would be associable) to the logged in user. Is that not the case?

Also, privacy by default means that no unnecessary data is created or shared between systems without asking the user first, regardless of what the purpose of this data sharing is. The Chrome browser and the Google web services are two different things, and most users will not expect that the two accounts are automatically tied together. The nice thing to do here would be to simply ask the user before syncing the logins. I suspect that the long-term goal here is to tie the browser history and search queries of more users to their Google accounts, because that information is very valuable (but also highly sensitive).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER47> I'd prefer that Google not add this "feature," instead of just issuing a blog post that will go unread by 95% of people, and adding a setting that will go unknown to the same 95% of people.

"Oh whoops we got caught. We'll give the few upset people an extra check box to revert to old behavior. But luckily no one else will ever know."

</comment><comment><USER48> "Now, when you sign into any Google website, you're also signed into Chrome with the same account."

I've currently got 6 different gmail accounts pinned. So which Google account am I supposed to be signed into Chrome for?

</comment><comment><USER49> I am one of whom has switched its browser because of this issue. I have seen that in the blog post, they claim Chrome will offer an option not to allow chrome sign in when you sing in on a google service. Let me describe your mentality: hey there who is aware of what they use. I have an option for you. You can turn this feature off. For the others, this will be default. Why don't you simply make this option closed as default?

Do you still want to play with your users, Google? It's your product and your choice. Good night and good luck

<comment><USER8> In the blog post, they also tell you quite clearly that they'll be pushing it in Chrome 70.

<comment><USER49> You are right. I have updated my comment :)

</comment></comment></comment><comment><USER50> This is such a typical response that I would expect from any product management team. "We hear you, we're making small inconsequential changes to make you feel better, but the decision is final."

I still love the rationale for this decision:

> Over the years, we've received feedback from users on shared devices that > they were confused about Chrome's sign-in state.

Their solution: Let's add _another_ state - the "sync" state - I'm sure this won't be confusing to users at all /s

</comment><comment><USER51> Made the move to firefox after the initial post came out about this "feature".

Surprised to say that not much has changed with the move. I was able to find all my extensions in the firefox addons. Life continues

</comment><comment> ux-app for me, the latest issue was just the straw that broke the camel's back. I switched to FF + DDG + Protonmail because I don't like the idea of a Google web.

\- Search

\- Analytics

\- Email

\- Storage

\- Android tracking

\- Online video

\- Chrome which is now becoming a portal to the GoogleWeb

I don't want _any_ company to control this much of what I do online as a matter of principle.

At this point they're a victim of their own success.

<comment><USER52> I'm basically in the same boat. This move combined with the project dragonfly leaks has led me to conclude that google cannot be trusted with my data. That in turn led me to evaluate just how intertwined google is into my life and its pretty scary.

</comment></comment><comment><USER53> Reading this was infuriating. The usability rationale is a blatant lie. They did it to attempt to get Chrome users to adopt Google services more, just like they have with Android, changing what were formerly simple, generic apps to tie into google services (Play Music instead of an audio player, Downloads advertising Google Drive, Keep instead of a note taking app, etc). I like and use a lot of Google products but I don't appreciate my preferences being disregarded.

</comment><comment><USER54> My complaint is not this _specific_ change, but the thought, review and release process that allowed this to become the default. And what was the thinking behind not attempting to explain the cookie behavior that at the very least is surprising, but generally just a bit creepy, right?

Did users _really_ need to explain this to Google? Perceptions of trustworthiness are based upon behavior, and this erodes that a bit. Not a massive amount, but enough to cast new features in a different light.

(The justification that 'most people will find this easier to understand' only goes so far and the fact it gets trotted out so often is itself concern. 'Being logged in everywhere makes your life easier!' Okay, ... and? Who else's life does it make easier and what are they gaining?)

</comment><comment><USER55> Chrome is just spyware. Move on to Firefox already. At some point, Chrome was feeling faster than Firefox and some dev tooling warranted a try. But, with Firefox where it is now, seriously think why on Earth do you want to run this spyware from Google as your web browser.

<comment><USER56> As a Firefox user: it might be less of a spyware than Chrome, but with the Google funding Moz://a can't even plausibly deny they are not controlled competition on the browser market.

<comment><USER55> True. There is no such thing as blind trust. I use FireFox with Privacy Badger and keep my fingers crossed that there are no creepy things going on.

</comment></comment></comment><comment><USER57> That switch strikes me as the perfect compromise - the default remains the automatic log in behaviour and those who don't want it have an out. If I were putting the automatic sign-in feature together I'd have considered this from the outset, but the Chrome devs have always had a preference for minimal UI. Usually this works in their favour, in this case it did not.

</comment><comment><USER58> >> Keep the feedback coming.

Don't conflate Chrome sign in with _any_ web page sign in - not even Google's own. Call that web page neutrality.

Also, I wonder if it will allow signing in with one account and syncing to another as it used to before the current mess. My use case: Keep myself signed in to G Suite Apps (Gmail, Drive, Docs, etc.) with my work address, but sync my bookmarks, extensions and settings to my personal address.

If not, the changes they announced don't help me.

</comment><comment><USER59> Claims to want more feedback. "Blog" post has no comment field.

<comment><USER60> And their 'email' button opens a email with no address:

Button: [http://prntscr.com/kyrhrf](http://prntscr.com/kyrhrf)

Email Opened: [http://prntscr.com/kyri1i](http://prntscr.com/kyri1i)

<comment><USER61> It's obviously a "share via email" button, not a "email the senior product managers in charge of Chrome!" button.

<comment><USER60> That makes sense.

Side point - the comment "email the senior product managers in charge of Chrome!" feels aggressive. It could be an email to a generic address where they sift feedback. That's hardly an unused option on the web. Is my comment here unfair?

While 100% you are correct in the point, I feel polite discourse on HN is the aspiration.

<comment><USER32> Microsoft has UserVoice at least.

</comment></comment></comment></comment></comment><comment><USER38> I'm pleasantly surprised by this. This is nearly as good a short-term reaction as could have been hoped for over the current batch of issues.

Hopefully there was also an update to the privacy policy reflecting the new meaning of being signed into chrome?

</comment><comment><USER62> Was holding back updating to 69, and after restarting le browser, boom I'm now im forced to use this crap with no way to go back.

Spent hours trying to figure out how to disable automatic updates on a Mac. Everything is so deliberately hidden it's disgusting. Find com.google.Keystone.xxx, LaunchAgents, plists, edit this XML, and edit that UpdateDefault field, policies, etc. [1]

Then, being fed up with Chrome, lets see Chromium website, maybe those guys without any bad motives can provide a developer friendly way to disable updates.. It should be somewhere in about:about right? Nop, clicking on how to turn off updates guide[2] redirects to a a Google page irrelevant to auto updates..

This reminds me of the time that Chrome didnt have any password (keychain) protection and they were claiming it was a Feature!

[1] [https://support.google.com/chrome/a/answer/7591084?hl=en](https://support.google.com/chrome/a/answer/7591084?hl=en)

[2] [https://www.chromium.org/administrators/turning-off-auto- upd...](https://www.chromium.org/administrators/turning-off-auto-updates)

</comment><comment><USER63> When I found out the Google update service secretly wake up at night to scan all my hard drive's they where quick to remove that "feature", but I'll never use a Google product again. (it could also have been a malware or virus). But who cares right ? Today everyone uploads their IP to the big vendors who's business model is far from only providing cloud storage.

</comment><comment><USER64> Too late Google. What ever trust I had left in you are gone. I already uninstalled Chrome and it is not coming back on my computers.

</comment><comment><USER65> Nice try, but a bit too late.

Emphasis mine:

> "While we think sign-in consistency will help many of our users, _we're > adding a control that allows users to turn off linking web-based sign-in > with browser-based sign-in—that way users have more control over their > experience._ For users that disable this feature, signing into a Google > website will not sign them into Chrome."

Frankly, is this just more subterfuge because this is opt-out and not opt-in? Most people wouldn't really understand whatever help text you put out there. If you word it in a way that makes saying yes look like the better option, people will do so (people generally say "yes" or "ok" to any dialog because they want to get rid of them and get to work). These are dark patterns that nobody should use, least of all a company that claimed long ago "do no evil".

</comment><comment><USER66> If sync is left disabled, what else does signing into the browser do? I normally use Firefox, where my understanding is that when you sign in, you're specifically signing in to Firefox sync. Since these are separate options on Chrome, presumably there are other functions tied to browser login.

</comment><comment><USER67> I still haven't seen any clear statement from Google on whether or not being signed in to Chrome w/out enabling sync alters what data flows from browser to Google in any way.

If signing in to Chrome is completely without any data exchange, collection, aggregation, or reporting, then please say so.

<comment><USER68> Their Privacy Policy seems to suggest this:

[https://www.google.com/chrome/privacy/](https://www.google.com/chrome/privacy/)

They have two main modes:

"Basic browser mode" \- for not signed-in, or for signed-in but sync disabled

"Signed-in, Synced Chrome mode" \- for when sync is enabled

And the basic browser mode doesn't send anything particularly interesting to Google.

Still, it would be nice to get an official statement about that.

</comment></comment><comment><USER69> >We deeply appreciate all of the passionate users who...

Sounds like a sleazy corporatespeak after covering some missteps.

</comment><comment><USER70> I believe they're deliberately misleading around what the issue is. It's not that Sync was enabled, it's that you were logged in period.

</comment><comment><USER71> Why does it take a damn backlash from users to get Google and Facebook to behave? Just because it's legal doesn't means it's ethical.

</comment><comment><USER72> Their explanation about solving the inconsistency between the chrome browser logged in user and the google web site logged in users makes some amount of sense. I am sure there have been some interesting incidents where people's browsing habits were exposed to other users unintentionally and it's reasonable for Google to want to respond to that.

It seems unnecessary however to auto-log in a person to the chrome browser when there is no such login in the first place to solve this though. It would make more sense to just display a warning when the state is inconsistent rather than start auto-logging people in (regardless of sync state).

</comment><comment><USER73> This is not attempting to fit user needs, this is an attempt to put out a PR fire and salvage quarterly earnings.

I'm still leaving, maybe even more-so because of the false heartfelt "ok let's do it your way". I will not be patronized, we're not on the same team anymore.

<comment><USER74> I don't understand, the piece looks like it promises to address all the problems highlighted in the past few days in Chrome 70. Why are you saying it is a PR piece?

<comment><USER75> The problems were easily foreseeable, and they did it anyway.

Anyone who accepts this as "listening the users", and addressing the issues will likely get burned again in the future.

Google is a advertising company. Their customers are not their users, and therefore I think things are unlikely to change.

<comment><USER76> > Their customers are not their users, and therefore I think things are > unlikely to change.

Interesting concept. Care to expound? Would be interested in hearing more.

<comment><USER25> Nothing surprising: Google's revenues come from advertisers. Advertising is its main focus. Not developing browsers, or even providing search results. Those are merely means to an end. And of course, all the users are targets for ads, NOT customers. A farmer's cows aren't his customers; same logic here.

It's obvious really, and Google never denied it.

</comment></comment></comment></comment></comment><comment><USER77> Of all of the things to be upset at google about this just isn't one of them for me. I'm not quite sure why this is the thing everyone is rallying against google about.

</comment><comment><USER78> _"...While we think sign-in consistency will help many of our users..."_

There's the nub of the thing, and it's not just Google. Like the old song goes, everybody wants to rule the world. That is, if you have a popular service, you buy up other stuff, add on stuff you can do. Pretty soon your users have multiple accounts all over the place. You gotta go to some kind of single sign-on, right?

It's not that it's a bad idea, it's that it's the kind of idea that shouldn't apply to the universe. It's fine when it's your corporate site. Who wants to log into three dozen corporate systems? But when you get FB tracking you everywhere, Google integrating what you thought was a browsing app with it's universe of offerings....it doesn't work.

Yes, users probably wanted it, just like some of them want you to turn the damned thing off. But the key problem here is that single companies shouldn't be in the business of controlling all the information flow. Any architectural decision they make has social/political implications. For this chrome thing, they're trying to position google as the internet, not a place you go on the internet. Everybody wants to do that. And they all claim it's to help the users. But I don't want a company being the same thing as the internet, no matter what Aunt Sarah wants. It's not good for the rest of us. Add to that the _way_ this was done, and then the engineering team being clueless?

It's not that they set out to do anything wrong. At some point, anything you do is wrong. You just have too much freaking power.

Google is at that point.

</comment><comment><USER79> Google business model is the greatest con the Internet has ever seen. I mean, it's a con when your front says "we do no evil, we are cool", and your back is squeezing your users for everything they gave you (gmail monitoring, browsing habits, location history, adsense scam, and now permanent logging). Mind you, I just uninstalled Chrome. Luckily, I never really used it. I recommend Safari and Firefox.

</comment><comment><USER80> I find it interesting reading all the comments here. I can understand the frustration of many HN users, but I also have seen "average" users be confused about switching google accounts on a shared computer. This change is aimed at helping the vast majority of their users understand which account is currently active, and if my experience helping family is any indication it is a good change.

</comment><comment><USER81> I think the larger issue is the culture that not only thought that these changes were OK in the first place but also thought the sneaky manner in which they were rolled out was OK too.

Trust and good will are finite resources Google. There will be no switching back. The horse has already left the barn.

</comment><comment><USER69> > When you sign out, either directly from Chrome or from any Google website, > you're completely signed out of your Google Account.

Am I reading this correctly? When I sign out from one of the Gmail accounts I keep open, I will be signed out of Chrome? I hope this is a misunderstanding.

<comment><USER82> Just tried and that certainly seems to be the case. Signing in, or out, of either chrome or website accounts will reflect that action in the other space.

<comment><USER69> I have to check how does it work with multiple Google accounts. This is silly.

Anyway, I just spend 30 minutes searching for Firefox Add-ons replacements for my Chrome Add-ons and I am pleasantly surprised. A new era begins!

</comment></comment></comment><comment><USER83> > _Keep the feedback coming_

Okay sure... please provide opt-out or disable option for the "Account Chooser" you currently force on everyone for web login.

I don't want my credentials hanging around on the page after I click 'sign out'.

The function of remembering login details on web forms is better left up to my browser, where saved logins are remembered according to my settings and choice, per site. It's not Google's place to stomp all over the well- understood concept of "sign out", with this half-baked "sort of signed out" reinvention.

</comment><comment><USER84> Goggle's business model was built around advertisers. And they are hungry for data.

Privacy is Google's Achilles heel. They have no other option than to collect and sell our data.

</comment><comment><USER85> product updates based on feedback? you mean you're not killing inbox anymore? oh you're still killing it? oh well...

</comment><comment><USER86> He doesn't say Google doesn't track you with this stuff does he?

My guess is they know exactly which sites you visited so the fact you can't see the History sync feature means he's being disingenuous about it not being turned on.

And even if this isn't being used right now someone will eventually abuse that unwritten agreement between you and Google.

<comment><USER46> The privacy policy does say that it doesn't track you.

So that agreement is written down.

<comment><USER86> Okay that's something, I'm sure you can understand I always assume that if the algorithms can track me at some point that information will be too tempting to integrate.

</comment></comment></comment><comment><USER87> > We want to be clear that this change to sign-in does not mean Chrome sync > gets turned on.

Huh? That's even _more_ confusing. How can you easily tell whether you're _actually_ signed in to Chrome?

(I use Chrome at work to test. I avoid it wherever possible because Google's interests do not align with mine.)

</comment><comment><USER88> I was part of the stampede to Firefox because of this. I guess we're all having an effect.

<comment><USER89> Welcome out : )

Hope you enjoy it!

</comment></comment><comment><USER90> So it will be opt-out? I'm sticking with vivaldi for now. I only used chrome because of the dev tools, and vivaldi being a chromium based browser has that as well, along with what seems like much less memory usage and snappier response.

</comment><comment><USER91> Tangential: What is this blog template ? Opening it in chromium and doing pg up/down in quite succession makes it stutter and use 200% CPU. It's also so bad with readability. Why does a simple paragraph of text need all this ?

</comment><comment><USER92> I have to say, I felt like I was one of the few supporters of this feature. But these changes make it even better and clearer for users and they might not have been made if there wasn't so much pushback. So, thanks everyone!

</comment><comment><USER93> The 'suggested articles' that they sneaked into the Android Chrome 'new tab' page a few versions ago really get up my nose. There are some switches somewhere to turn them off but its hard to do.

</comment><comment><USER94> A classic case of two steps forward, one step backward. Google knew this would be a big change for the tech community and devised a release strategy accordingly.

</comment><comment><USER95> Google is going to continue this pattern of behavior. Two steps forward, backlash is too bad, one step back. Let the dust settle, another two steps forward...

</comment><comment><USER96> Great news! I didn't plan to uninstall Chrome (I still prefer it to its competitors). But I'm sure some people will reconsider uninstalling it now.

</comment><comment><USER97> Is there a viable alternative to Google Search for developers? I still get better results at Google for arcane development-related problems.

</comment><comment><USER98> After Google Chrome and news about discontinuing Inbox By Google ill definetly leave google products at all.

</comment><comment><USER99> Is my only option for accessing my email/ google drive on a public computer through incognito now?

</comment><comment><USER100> Great feedback. I just wish I could migrate my Chrome sync data to another account (or away from one).

</comment><comment><USER101> > _We recently made a change to simplify..._

Next up is "we recently made a change to simplify giving us all of your movements."

[https://twitter.com/jonathanmayer/status/1044300922149588993](https://twitter.com/jonathanmayer/status/1044300922149588993)

This is causing me to re-evaluate my personal technology stack.

</comment><comment><USER102> For goodness sake, why are there so many articles about google on top of HN these days!

</comment><comment><USER103> You can tell they knew this wasn't going to be received well based on the title.

"YOU told us you WANTED this."

Gross.

</comment><comment><USER104> Awesome, appreciate it :)

</comment><comment><USER105> It doesn't take long for the tide to turn when you compromise core values. Sugarcoating isn't going to work, I for one see your this trajectory as particularity troubling, if Google doesn't hold onto the reins of what little is left.

</comment><comment><USER106> I guess a lot of people have moved (back?) to Firefox :)

</comment><comment><USER107> Too late, I've already switch to Firefox :)

</comment><comment><USER108> I hate to say it, but it looks like they addressed all my concerns. Except for the fact that I briefly enabled sync, thinking it was for cross-device tab syncing (silly me).

</comment><comment><USER109> Can you stop breaking Gmail, Hangouts and Google Voice UI and apps? There is literally a 20 second lag on Google Voice on iOS. It's absurd.

</comment><comment><USER110> I'll be looking for a company that intrinsically doesn't sell user data. How can you work around that?

<comment><USER17> You might consider Google then.

<comment><USER110> Tell me another joke?

<comment><USER17> You wanted a company that doesn't sell your information. It would take five minutes to read their privacy policy to confirm this for yourself. Much easier than switching providers.

<comment><USER110> Ok, let me rephrase that: they monetise on my personal data and online behaviour. Selling the data would mean losing their unique position. Btw, interesting article currently top voted at HN about ex-google employee ;)

<comment><USER17> >they monetise on my personal data and online behaviour.

Indeed they do. Personally I prefer this to having to pay a monthly fee, but others may disagree (and quality paid services do exist for them).

>Selling the data would mean losing their unique position.

That's right too. User data is their biggest asset versus their competitors.

>Btw, interesting article currently top voted at HN about ex-google employee ;)

Haven't caught it yet. If it's regarding their recent China play however, then that story concerns me too.

</comment></comment></comment></comment></comment></comment><comment><USER111> The more time goes on, and Google gets bigger, the more I shake my head that Persona and Firefox OS died.

</comment><comment><USER112> > allows users to turn off

spin spin

google has lost it

</comment><comment><USER113> did anyone really like spam in Gmail. If not, Why Google didn't have fixed it yet, I am having that issues from 2014, I only check my email once in one or 2 week(s).

</comment><comment><USER114> Nice. Oddly, the published date is listed as Sept. 26, 2018.

<comment><USER115> Yes that is today.

</comment></comment><comment><USER116> Thank you.

</comment><comment><USER117> >We appreciate your feedback

>We deeply appreciate all of the passionate users who have engaged with us on this

If only we could believe this. The last few Chrome updates have clearly shown that Google will undermine the users' privacy in the blink of an eye whenever they see fit.

When there's enough backlash, they will apologize in a cringy way and make some minor changes to appease to the community.

I had my reservations against Chrome, but changed to it anyway, because Firefox was in a bad state at the time. Now that is no longer the case and Vivaldi seems to be quite good, too.

Goodbye, Chrome.

</comment><comment><USER118> >While we think sign-in consistency will help many of our users, we're adding a control that allows users to turn off linking web-based sign-in with browser-based sign-in—that way users have more control over their experience. For users that disable this feature, signing into a Google website will not sign them into Chrome.

The pretext of this feature is supposedly that people who share computers are accidentally signed into someone else's account and this solves that, but why should this be done at the browser level?

I have a hard time believing that anyone who uses the family computer doesn't have their own account _in the OS_ , where their Chrome profiles will be kept separate. I also have a hard time believing that this isn't just about making sure every session is authenticated to make cross-device tracking easier/possible. It's why every Google app on iOS seems to want you to log in. I think my suspicion is probably correct since they're making it opt-out rather than opt-in (knowing most won't).

<comment><USER119> Sadly, its remarkably rare that people have accounts on a home PC. You can still setup a windows desktop with a password-less account, and many people do.

<comment><USER120> do you have any information that backs this up? I'd be quite surprised if this was the case

<comment><USER119> Just observing a few dozen machines over the years. Almost nobody sets up multiple accounts on their machines.

</comment></comment></comment></comment><comment><USER121> Trying to put out the trashcan fire that is their product.

</comment><comment><USER122> Too little, too late. The cat is really and truly out of the bag.

As Microsoft did with Windows 10 Google have done with Chrome they have moved the capture of telemetry and personal data from their network to the users platform.

In the case of Chrome the community have the choice to fork our platform and thank google for their contribution, but say no thanks to thier continued stuardship of it.

Sometimes I wonder if senior execs really understand how precarious open source based business models are - like politics we can vote and change the leaders if they stop acting for the common good.

<comment><USER123> Who is committing to chrome? Who is fixing bugs reported by users?

Google employees. The community is... mostly users. Any fork of Chrome will likely fail, because there is no magical community of privacy minded developers that has the time and expertise to develop Chrome, which is a massive and highly complex piece of software.

If you really feel this way, just switch to Firefox. Mozilla actually has a team of developers who fix and improve it.

Note that a majority of Mozilla's funding comes from royalties paid by Google for ads clicked on SERPs inbound from the Google search box. So Google has the power to control Mozilla if they really needed to.

<comment><USER122> Look at Centos - it's quite possible to follow Google's releases stripping out the 'evil'</comment></comment></comment>


The funny things happening on the way to singularity - <AUTHOR> http://techcrunch.com/2016/04/09/the-funny-things-happening-on-the-way-to-singularity/ <comment><AUTHOR> Do you agree with the conclusion that those that are building smarter machines might make themselves obsolete, when computers are better at math and science?

Will there be a continued need for humans to plan and improve machines, or will they do all the improving going forward (already programmed to find improvements that benefit humans)?</comment>


Stanford Team Devises Solar Powered Water Splitter (w/video) - <AUTHOR> http://www.physorg.com/news/2011-06-stanford-team-solar-powered-splitter-video.html

<comment><USER2> I don't understand why they have to put the silicon electrodes in contact with oxygen.

Can't they just wire the silicon in the solar panel to copper wires and put them in contact with water and oxygen?

<comment><USER3> Something has to come in contact with the water and will inevitable be exposed to the oxygen. The choice of materials appears to be one for performance reasons:

 _The authors pointed out that their approach is general enough to work on other semiconductor substrates and to integrate other catalysts, allowing for fine-tuning of electrodes to maximize performance._

</comment></comment><comment><USER4> Wouldn't it be more correct if the title was "Stanford team devises a way to protect silicon from oxidation"... That is how the video started.

</comment><comment><USER5> Is this the prototype of the cheap product that's been promised years ago (although it still uses platinum & titanium)?</comment>


Ask HN: DisneyPlus – Account Takeovers? - <AUTHOR> We just had our DisneyPlus account stolen. Could it be left overs from the issues they faced at the end of last year? https://www.washingtonpost.com/business/2019/11/19/thousands-disney-accounts-were-hacked-sold-online-little/
We do not share that password with any accounts. My wife and daughter each have it on their iPhones and we use it on our Fire Stick.
We are now trying to work with DisneyPlus to fix it, but they are saying they can't find our account and say to call Verizon to manage the problem since we got it bundled through them. Still working through support on both ends.
Has this happened to anyone else? <comment><AUTHOR> Thinking a tad more about it, part of the problem is they can't look up our account by historic email address. This should be something support at any organization should probably have access to for dealing with such issues.</comment>


One in 25 business leaders may be a psychopath, study finds - <AUTHOR> http://www.guardian.co.uk/science/2011/sep/01/psychopath-workplace-jobs-study

<comment><USER2> In contrast, they estimate that only 1% of the overall US population are psychopaths.

Alas the article doesn't go into detail about what they mean by "psychopath" other than that they "use words to manipulate and con and to interact with you without the baggage of feeling your pain." Which is certainly a good recipe for climbing the corporate ladder in a lot of companies!

</comment><comment><USER3> Am I the only one to think that # is low?

:-)</comment>


Accounting for Startups: Cash-basis or Accrual-basis? - <AUTHOR> http://www.building43.com/blogs/2010/10/13/accounting-for-startups-cash-basis-or-accrual-basis/ <comment><USER2> Cash Basis is _so much less work_. I don't find the analysis any different really, but the paperwork is so much less.</comment>


Silicon Valley has a problem with conservatives. But not the political kind - <AUTHOR> https://www.vox.com/first-person/2018/6/12/17443134/silicon-valley-conservatives-religion-atheism-james-damore <comment><USER2> You know I heard a really good sermon on the radio by an Evangelical preacher the other day about the apostle Paul and the book of Romans that he wrote.

One term he used consistently was that Paul (my namesake) opposed "the culture" of him time. That is, he did not like Roman civlization, he did not really did that there was a temple to Apollo and Neptune but what destroyed the legitimacy of it all was there was a temple just as big across the street to the living Emperor. Similarly he was no big fan of the sexual morality of the classical world.

At the time, early Christianity was a "counter-culture" than the Catholics took over and became the "culture", then Martin Luther is reading Romans while sitting on the can and decides there has to be a permanent counterculture, that the movement has to be "born again" with each generation.

See also: the Jesus Freaks, origin of the contemporary anti-abortion movement, etc.

(I am not a Christian, but I am the resident Christian Apologist and Range Safety Officer for my coven)</comment>


A High-Level Lua API for GPU Parallelism - <AUTHOR> http://willcrichton.github.io/terracuda/ <comment><USER2> While the project is interesting, the main benchmark is very misleading. They claim that terracuda matrix multiplication is faster than the one written in cuda. This can be only true if it is compared to NAIVE matrix multiplication in cuda, which can be confirmed by the time that is reported in seconds, which is orders of magnitude slower than the "real" cuda matrix multiplication.

Why is that benchmark completely meaningles? Because cuda matrix multiplication is so optimized that no one with a bit of sense would roll out his own, and even if he does, that implementation would have to use very specialized and ugly code - can this be done in terracuda, and is it simpler than in C?

Addidionally, the main issue in gpu kernels is not the ugliness of c itself, but the need to optimize algorithms to the hardware of the gpu, thus making the code much more verbose and ugly than the naive c code. That's why terracuda and the likes look fantastic when you compare them with naive C implementations, but they try to solve the wrong problem IMO.

<comment><USER3> Project author here. Your first claim is true, and you can verify it here: [https://github.com/willcrichton/terracuda/blob/master/matrix...](https://github.com/willcrichton/terracuda/blob/master/matrix/matrix.cu)

However, I would dispute that it makes the benchmark meaningless. I agree that no one will write the hand-optimized matrix multiply routine in Terra, but I think that misunderstands the use case of the language. Terracuda is intended to make everyday GPGPU computations super easy, so you can speed up simple scripting code that would otherwise be order of magnitudes slower. Look at the other examples in the repo: if you wanted to write a simple hash function, Mandelbrot generator, or renderer, Terracuda makes it simple to accelerate Lua code.

There will always be room for super optimized kernels for common functions like matrix multiplication, but I believe there's a strong need for a language that handles everything else.

<comment><USER2> My point is that while it can sometimes accelerate lua code, it will also (i'd say) _de_ celerate lua code, when the algorithm is not trivially parallelizable (and that is the majority of cases). So, to get the gpu boost, or evento understand how to implement the algorithm properly, I'd have to drop to the GPU specifics. The main question is then: do terracuda helps with that or will it be the obstacle? (it is not a rethorical question; while I suspect it will be the obstacle, I am interested to hear what is your experience with such cases)

<comment><USER4> I strongly doubt writing Terracuda GPU code would ever decelerate your original application, although it might not be as fast as a hand-written CUDA program (and that's an important distinction!). Terracuda doesn't actually lack that many GPU specifics--really it just doesn't provide access to shared memory constructs which are important for hand-tuned matrix mult kernels and blocked algorithms. And that's in the NVPTX API so it's not a true obstacle, just something I haven't gotten around to writing yet.

<comment><USER5> > although it might not be as fast as a hand-written CUDA program

If you're dealing with larger pieces of code at once (that is, if you have a bigger view of what the programmer wants to run, which you should have), one interesting thing you could do is "exploratory compiling". Try different compilation step sequences and transformations, if you have enough invariants in the code. Machine time is cheap and this could yield some interesting results. Of course, the more constrained the language model is, the more opportunities for this.

(There's been some interesting results in this area, like superoptimizers for local optimization, but larger scale compilation would probably use something like genetic algorithms, as you're unlikely to have the opportunity for exhaustive searches.)

</comment></comment></comment></comment></comment><comment><USER6> This is great. Playing around with Terra for a few weeks now in my spare time. And it's a great language.

As a side note. I'm not sure this is usable in software other than Scientific Computing kernels, as relying solely on CUDA rules out AMD and Intel GPUs, if i'm not mistaken.

Though I guess one could use it as an inspiration for implementing something similar for OpenCL or Vulkan.

</comment><comment><USER7> Awesome project. Terra seems so powerful, it's great to see more applications for it.

Sidenote -- I hate to be the guy complaining about web design, but the Raleway font is very hard to read (Retina MacBook). Here's a screenshot: [http://i.imgur.com/9DkVEaQ.png](http://i.imgur.com/9DkVEaQ.png)

The screenshot is at 2x resolution so the readability problem is not quite obvious, but look at the vertical lines on the "m" letters -- the line width is all over the place even within a single letter. Raleway's miserable kerning doesn't help things either.

<comment><USER3> Totally valid complaint. I've updated it to something that's hopefully more readable.

<comment><USER7> Thank you! Much better now.

</comment></comment></comment><comment><USER8> I love stuff like this, but I'm wondering whether it's actually useful for solving any real-world GPGPU problems.

My understanding is that the hardest part of moving stuff to the GPU is moving data around to and from the GPU without killing the computational performance gains by data dependencies, and to transform your problem to something that doesn't need a lot of control flow or rich/complex data structures. Does Terracuda address these things?

<comment><USER4> Good question. For your first point, Terracuda doesn't do anything particularly intelligent with movement between host/device memories--it's mostly there just to hide that away from you. However, empirically, if your baseline is Lua or Python, almost anything you write in CUDA is going to be more efficient so long as you have enough data to parallelize over.

As for the second point, that is still mostly left to the programmer. GPU code doesn't necessarily preclude complex data structures, however. For one of my benchmarks, we used a software renderer that generates a quadtree on the fly and accesses that during the shading phase ([https://github.com/willcrichton/terracuda/blob/master/render...](https://github.com/willcrichton/terracuda/blob/master/renderer/cuda_renderer.t)).

<comment><USER8> On typical consumer hardware you really want to batch up your processing in a way that gives you the best computation/data ratio to prevent performance being killed by data latencies, I don't think any kind of solution exists that can do that for you automatically/transparently. For the usual suspects like signal processing stuff and such, these problems are relatively easy to overcome because you typically have large amounts of data that can be processed at once or in in blocks.

What would make your project even more interesting is to see how it would perform on an heterogeneous system architecture (HSA), ie: what AMD is working towards. In an HSA, the CPU and GPU share the same memory and address space and a program can basically move processing between the two at close to no cost (no memory ever needs to be copied or mapped in/out GPU address space). For problems that allow some kind of pipelining to absorb start-up latencies caused by data dependencies, a combination of Lua + Terracuda would be pretty awesome, allowing you to move even small/short-running computational tasks to the GPU.

</comment></comment></comment><comment><USER9> Newbie question: Would this Terracuda system be the easiest way to get started with GPU/CUDA programming for someone who hasn't done it before or are there easier approaches out there for running code in parallel on the GPU?

(I have worked with Lua for personal gamedev projects before)

<comment><USER4> Ideally this would be your easiest starting point for GPU programming, but I haven't this particular course project for a year and a half so it would need some polishing before it's ready for prime time. Honestly, I would just dive into the CUDA docs and mess around with their toolchain. Some resources:

Lecture on "GPU Architecture and CUDA Programming": [http://15418.courses.cs.cmu.edu/spring2016/lecture/gpuarch](http://15418.courses.cs.cmu.edu/spring2016/lecture/gpuarch)

CUDA C Programming Guide: [http://docs.nvidia.com/cuda/pdf/CUDA_C_Programming_Guide.pdf](http://docs.nvidia.com/cuda/pdf/CUDA_C_Programming_Guide.pdf)</comment></comment>


Ballmer - Told you so... - <AUTHOR> http://www.webjives.org/ballmer-told-you-so

<comment><USER2> I am completely missing the authors point here. Android isn't free? Android is free to use for device manufacturers. Google bought a device manufacturer and their patents. The quote makes me want to say "devices aren't free either!"

The point Ballmer was originally making (and I believe HTC's CEO confirmed) is that the cost of getting a Windows Phone to market was less than the cost of getting an Android phone to market because of the toolset that Microsoft provides which results in lower integration and testing costs.</comment>


Show HN: Everybody gets one point every day - <AUTHOR> https://pointsproject.org/ <comment><USER2> So, it was already submitted 4 times[1][2][3][4] in the last 5 months and there's still no explanation as to what's the _point_ of this project.

[1]: [https://news.ycombinator.com/item?id=14511457](https://news.ycombinator.com/item?id=14511457)

[2]: [https://news.ycombinator.com/item?id=14526920](https://news.ycombinator.com/item?id=14526920)

[3]: [https://news.ycombinator.com/item?id=14712444](https://news.ycombinator.com/item?id=14712444)

[4]: [https://news.ycombinator.com/item?id=15517341](https://news.ycombinator.com/item?id=15517341)

<comment><USER3> The cynic in me says the point is to collect phone numbers.

</comment></comment><comment><USER4> Seems a bit like the Black Mirror episode[1] "Nosedive".

1: [https://en.wikipedia.org/wiki/Nosedive](https://en.wikipedia.org/wiki/Nosedive)

<comment><USER5> That episode made me by far the most uncomfortable I have ever been while watching a TV show.

I think it was the desperation and how so many people could so easily fall down that path of complete fakeness if such a thing ever took off.

</comment></comment><comment><USER6> So, uh, is this just a way to harvest phone numbers...?

<comment><USER7> Seems pretty malicious.

</comment></comment><comment><USER8> I think this is meant to be a neat little experiment and/or "useless machine" type thing. Like the "Yo" app. I don't think it's meant to be malicious.

<comment><USER9> I'm a little more skeptic.

</comment></comment><comment><USER10> Is this supposed to be some art related to bitcoin?

</comment><comment><USER11> Now how do I convert these points to bitcoins?

<comment><USER12> Why cash out now? Go long. Pointcoin will be worth millions one day.

<comment><USER13> Bitcoin would be worth billions at that point :)

</comment></comment></comment><comment><USER14> And the point of this is?

<comment><USER15> Preview of what life will be like on a basic universal income.

<comment><AUTHOR> Thanks, you are on point with what I'm thinking about.</comment></comment></comment>


How to turn an ordinary gzip archive into a database - <AUTHOR> https://rushter.com/blog/gzip-indexing/ <comment><USER2> Years ago I worked on a project that used files in the TIFF image format as databases. The TIFF format supports the concept of multiple files embedded within the main file, and multiple sections within an image file, each of which is indexed and can be accessed and compressed individually, with different compression methods.

TIFF was designed to be an image format, but of course nothing prevents you from storing and accessing arbitrary data.

In our project, TIFF files proved to work well as read-only databases of large collections of structured binary data.

</comment><comment><USER3> I have no use for this since my data (.png files) isn't compressible but this is brilliant and I wish I had a use case for it!

Would it be possible with something even more space efficient like 7zip / LZMA2 ?

</comment><comment><USER4> What about false positives when looking for the next header?</comment>


Hard Fork Conspiracy Treacherous - <AUTHOR> http://www.riddellwilliams.com/blog/articles/post/hard-fork-conspiracy-treacherous <comment><USER2> It's not clear why forks of Bitcoin would be subject to regulation but not original Bitcoin (which has been maintained by named people for years, not Satoshi).</comment>


Fog Cam – The World's Oldest Webcam - <AUTHOR> http://www.fogcam.org/ <comment><USER2> If all the pics from 1994 is still available, it would be nice to watch a timelapse since 94.</comment>


Steve Ballmer On "Moving The Needle"  - <AUTHOR> http://www.techcrunch.com/2009/09/28/microsoft-ceo-steve-ballmer-on-moving-the-needle/ <comment><USER2> It's interesting to see the scale at which Microsoft management has to plan for future growth. Being so focused on startups, bootstrapping strategies, etc., the article makes it clear that continuing to grow a company the size of Microsoft, with $20B in profits, is not easy -- especially in the technology industry where things change so quickly.</comment>


Trading Halted in Nasdaq-Listed Securities Due to Technical Issue - <AUTHOR> http://blogs.wsj.com/moneybeat/2013/08/22/nasdaq-halts-all-nasdaq-listed-securities-due-to-trading-issue/

<comment><USER2> It sounds like NASDAQ is having a problem with the Tape C consolidated feed (which they administer). Here's some good places to watch for updates:

[http://www.nasdaqtrader.com/Trader.aspx?id=MarketSystemStatu...](http://www.nasdaqtrader.com/Trader.aspx?id=MarketSystemStatus)

[http://markets.nyx.com/nyse/market- status](http://markets.nyx.com/nyse/market-status)

[http://www.batstrading.com/alerts/](http://www.batstrading.com/alerts/)

[https://www.directedge.com/Alerts.aspx](https://www.directedge.com/Alerts.aspx)

edit: Notes for people trying to understand the jargon. The UTP SIP is the consolidated feed for Tape C (i.e. NASDAQ listed) securities. In this case, the feed is composed of two parts: UTDF and UQDF. The UTDF is a feed of last sale prices and the UQDF is the feed of the best quotes from the various U.S. equity exchanges. It sounds like the problem is with the quote feed (UQDF). That's why they've halted trading on NASDAQ listed equities at all the other exchanges.

These days almost everyone takes market data directly from each exchange and builds their own view of the market, so losing the consolidated feed wouldn't be a huge deal, except that it isn't clear what should happen to stay in compliance with Reg NMS when the consolidated feed is down.

<comment><USER3> > These days almost everyone takes market data directly from each exchange and > builds their own view of the market,

Minor nitpick here. What you say is correct if you are talking about say the top 50 trading entities in North America. Once you get to the regular hedge funds, pensions, or anyone who doesn't do heavy algo trading this is false.

My guess is that its more like 99% of people who get live market data get it as a consolidated feed from Bloomberg, Thompson Reuters, Activ, etc and not from the individual exchanges.

Heck even the funds I know that aggregate themselves still have consolidated feeds via their Bloomberg terminals.

Market data is very expensive to get individually from the exchanges. In Canada for instance the TSX is $2500 for Level 1 quotes and an additional $3500 for the depth of book.

NYSE is similar. To consolidate the US markets we can spend $50,000 a month. It's crazy how expensive it can be.

<comment><USER4> Thanks for the breakdown, I have a few questions:

1) What are the advantages of getting separate feeds from BATS/EDGEX etc. instead of using the consolidated then?

Is it because of the slight differences in matching mechanisms and priority queue in the different exchanges' orderbooks? But how can you get a competitive advantage if RegNMS forces exchanges to execute you at NBBO anyways.

2) Another question I have is, let's say I send a DMA marketable limit order to BATS specifically to get the liquidity rebate fees and because there's a price improvement for that marketable order; BATS is obligated to re-direct my order to ARCA, do I still get to collect the rebate fee structure from BATS or is that order technically under the fee structure of ARCA.

EDIT:

> Once you get to the regular hedge funds, pensions, or anyone who doesn't do > heavy algo trading

You are correct that most hedge funds and pensions probably don't trade on HFT strategies. But some of them execute their bulk orders on HFT platforms through integrations via whatever OMS they use. So instead of market-making, liquidity rebates and stat arb strategies, institutions use iceberg, hidden vwap orders to execute their bulk orders at opportunistic times; their bulk order execution algo does analyze the depth of orderbooks to determine the level of aggressiveness of their orders and also leverage co-location for fast execution.

<comment><USER3> > 1) What are the advantages of getting separate feeds from BATS/EDGEX etc. > instead of using the consolidated then?

EDIT: Sorry I misinterpreted the question I think. I was answering why not use the bloomberg feed over the TAPE C feed.

In the case of why get exchange feeds directly rather than the consolidated feed , the answer as far as I know is "Peeking". The exchanges let HFT see orders for up to 30 milliseconds before the general public does. As far as I know TAPE C doesn't give you these "peeks".

See:

[http://seekingalpha.com/article/694931-the-new-high- frequenc...](http://seekingalpha.com/article/694931-the-new-high-frequency- trading-landscape-man-versus-machine)

In the case of getting a consolidated feed from say bloomberg, the data flow is:

EXCHANGE -> BLOOMBERG -> BLOOMBERG OPTIONALLY MIXES IN OTHER DATA(VWAP, etc) -> YOUR SERVER

if you get the data from the exchange it looks like:

EXCHANGE -> YOUR SERVER

so timing. Each exchange takes a slightly different amount of time to publish their quote so if you colocate at multiple exchanges you can respond a bit quicker to each of them than if you wait for the consolidated quote to come from a third party.

> 2) Another question I have is, let's say I send a DMA marketable limit order > to BATS specifically to get the liquidity rebate fees and because there's a > price improvement for that marketable order; BATS is obligated to re-direct > my order to ARCA, do I still get to collect the rebate fee structure from > BATS or is that order technically under the fee structure of ARCA.

TO be honest I'm not entirely sure as I deal more with the Canadian markets, but here the fees are payable where the trade executes.

I'd be surprised if BATS paid you for taking/providing liquidity on another market:)

I don't want to present myself as an expert in the US financial markets. I'm responsible for trading technology for a hedge so its my job to know as much as I can but the only universal truth I've found is that no one fully understand how the whole system works.

<comment><USER5> 1) The consolidated feeds are CTA/UTP (legally mandated committees, [http://en.wikipedia.org/wiki/National_market_system_plan](http://en.wikipedia.org/wiki/National_market_system_plan)) , not Bloomberg. Yes, Bloomberg can provide a similar feed and probably does with some enrichment, but you do not reference the NBBO (National best bid & offer) from a Bloomberg feed.

Also, you do not need to colocate your server to receive a direct feed from the exchange. Anyone with an internet connection and some spare cash can get a direct feed. Anyone that can afford to pay for colo space can also get the feed pretty much instantly (limited by the speed of light).

There is no such thing as letting HFT (what's that?) see orders up to 30ms before, not anymore. Colos are a pain in the ass to manage and cost an arm and a leg, so if you're not in the microsecond and nanosecond race, there's little benefit in paying for colo space. So yes, the ethics can be argued, but these firms are simply paying rent for some space.

Anyone willing to pay the same rent can get the same 'speed improvement'. Retail investors and most hedge funds don't need this speed because they do not have the infrastructure, talent base, or capital to build a trading system that would make any money off of the minimal speed advantage. People argue all this ultra low latency stuff adds liquidity to the market, but I think in the end it's just creating noise and scaring away people that don't understand how the speed is used in the market.

Technologically, Canada is stuck in the stone age compare to what's going on in the states, and I think that's actually a good thing (Canadian working in the states).

To summarize, the advantages are: speed, more speed(colo), and arbitration opportunities against those that just rely on consolidated feeds.

<comment><USER6> You can not receive the exchanges market data over the Internet. You must be co-located at one of the data centers with an available cross connect to the exchange.

Also how is Canada in the stone age technologically? The TMX provides far more direct access to various technologies that are not available by any of the exchanges in the U.S. such as native smart order routers, TMX's native pre- trade risk checks (Mantara) which was a regulatory requirement added back in March to prevent any kind of fat finger mistake or flash crash, and a host of technologies built right into the exchange.

The consolidated market data products available on the TMX are also much more comprehensive than the ones in the U.S., for example in the U.S. all you get are the consolidated last sale (CTS) and consolidated top of book (CQS), in Canada the TMX provides those via the CLS and CBBO but in addition it also provides the consolidated depth of book via the CDF feeds.

<comment><USER5> Yes you can. Anyone willing to write a feed handler for these feeds can. For example, [https://www.nasdaqtrader.com/Trader.aspx?id=totalview](https://www.nasdaqtrader.com/Trader.aspx?id=totalview) and [http://www.nyxdata.com/openbook](http://www.nyxdata.com/openbook). As kasey_junk mentioned, availability is on an exchange basis, so I'm not sure if all exchanges provide this service.

I was talking about the sophistication of low latency trading in Canada and that only. In the states, there aren't a ton of exchanges and ETN and dark pools, with different matching engine rules and all that crap. If I am a sophisticated low latency firm, I wouldn't want any exchange added 'extras' to get in the way.

IMHO, I think retail investors are better served and have less chance of being thrown on a roller coaster ride by runaway algos in Canada compared to the U.S., and that's a good thing.

<comment><USER6> Both links you provided are not products that are available over the Internet from NASDAQ. Both TotalView and OpenBook are multicast feeds that are strictly disseminated to a small handful of data centers, the most notable of which is NY4.

You need to cross connect from your local network onto NYSE's or NASDAQ's network to receive that data.

</comment></comment></comment></comment></comment></comment></comment></comment><comment> the-swa Security flaws in financial institutions has got to be one of my greatest fears. Wall street doesn't understand software[0][1] yet they rely so heavily on it with algorithmic trading[2]. The day that something goes terribly wrong, they're going to have no idea what happened...

[0] [http://www.wired.com/threatlevel/2008/09/six-year-old- st/](http://www.wired.com/threatlevel/2008/09/six-year-old-st/) [1] [http://www.vanityfair.com/business/2013/09/michael-lewis- gol...](http://www.vanityfair.com/business/2013/09/michael-lewis-goldman- sachs-programmer) [2] [http://www.ted.com/talks/kevin_slavin_how_algorithms_shape_o...](http://www.ted.com/talks/kevin_slavin_how_algorithms_shape_our_world.html)

<comment><USER7> You could say the same thing about the energy grid, our military, etc. Not that you are wrong, but Wall Street melting down is way easier to back out of than a nuclear plant.

<comment> the-swa Agreed, but it would also vary by the nature of the hackers' intent. With the current global economy, taking down Wall Street would create an immediate impact worldwide and would have long term rippling effects. Hacking into and disrupting a power grid could do the same, but is heavily dependent upon location and timing, no? Maybe I just don't know enough about how the power grid works.

Granted, if we're talking about physically destroying infrastructure as opposed to just hacking, then I'd have to agree with you.

<comment><USER8> The electricity grid is also extremely complicated system that many people don't understand. With any complex system, it grows to beyond the knowledge of the people working in it.

One thing to note is that many of the critical components on the electrical grid is controlled over the network. When I used to build tools for the electricity trading desk, we were handling market bids/asks and scheduling of the power plants.

Here's an example of the stuff that we were dealing with. This is the real time settlement point prices for ERCOT (the grid network in Texas): [http://www.ercot.com/content/cdr/html/real_time_spp](http://www.ercot.com/content/cdr/html/real_time_spp)

We had systems that lay out prices that we were willing to turn on and ramp up power plants. If prices hit a certain point, we were committed to delivering that power. We made these decisions based on economics of the power plant (gas plant vs nuclear vs wind) and other factors (such as weather , time of day, whether the Cowboys were playing that day).

Anyways, my point is that all these systems are interconnected and rather complex. It doesn't take much for an error in one place to bring down a major part of the system.

Take a look at the 2003 Blackout: [http://en.wikipedia.org/wiki/Northeast_blackout_of_2003](http://en.wikipedia.org/wiki/Northeast_blackout_of_2003)

As with any engineering, you're never going to factor away all the breaks. You need to build a system that assume things will break and ensure that it's not catastrophic.

Also, I don't think it's fair to say that Wall Street doesn't understand software. There are some very smart people doing solid engineering there. Neither one of the footnotes that you had in your post support your statement that Wall St doesn't understand software.

</comment></comment></comment></comment><comment><USER9> For once, this headline understates the story. My first thought was "Why does this belong on hacker news" because they stop trading specific securities all the time. But a system crash is another thing.

</comment><comment><USER10> "UPDATE 3: CNBC reports the Securities and Exchange Comission is monitoring the situation."

Wow, CNBC, what would we do without your valuable insight?

</comment><comment><USER11> What's up with all the technical issues and outages lately? Has there been an increase or is it because we're paying more attention to it?

<comment><USER12> How many are there? AFAIK the last technical issue was a NASDAQ break during the FB IPO, which was a little over a year ago. One severe error per year is not a lot, I think.

</comment></comment><comment><USER13> Google had an outage a couple of days ago, so did Amazon. Now this.

Interesting timing.

</comment><comment><USER14> OH GOD WHAT IS HUMANITY GOING TO DO IF THE STOCK MARKET GOES OFFLINE!?!?

Keep it down. Fucking good riddance.

<comment><USER15> Well, to be fair, your life would probably suck pretty hard if the market was to stay offline. Tis the world we inhabit :)</comment></comment>


Twitter Needs to Become More Open or Die - <AUTHOR> http://gigaom.com/2010/09/16/twitter-needs-to-become-more-open-or-die/ <comment><USER2> Evidence that no matter how much you hedge and no matter how much you caveat, some tech publication will take anything you write and turn it into linkbait.

Alex's writing had none of the urgency this article attributes to him. It explicitly went out of its way to say that centralization vs. decentralization wasn't an immediate risk to the company; in fact, he questioned whether a decentralized Twitter could have focused itself enough to build #newtwitter, which he admires. The article also doesn't claim that Alex left simply because Twitter refused to decentralize.</comment>


Validating Kubernetes YAML for best practice and policies - <AUTHOR> https://learnk8s.io/validating-kubernetes-yaml <comment> default-kramer > Config-lint is a promising framework that lets you write custom checks for > Kubernetes YAML manifests using a YAML DSL. But what if you want to express > more complex logic and checks? Isn't YAML too limiting for that? What if you > could express those checks with a real programming language?

Having recently worked a little bit with YAML for Kubernetes and HCL for Terraform, I really wish they had both just used "a real programming language" right from the start. I'll choose Racket because I know it best, but there are probably many languages that would work well. You could expose very nearly the same configuration language, but backed by a real programming language. I bet this would make some of the tools the author lists at the end (eg copper, config-lint) much easier to write, or perhaps not necessary at all.

And the author didn't mention Helm, but I will. The part of Helm I saw seemed to be a lot of work just to add "functions with parameters" to Kubernetes YAML, something we could have had for free using "a real programming language" from the start: [https://helm.sh/docs/chart_template_guide/functions_and_pipe...](https://helm.sh/docs/chart_template_guide/functions_and_pipelines/)

Why are so few configuration languages not backed by a real language?

<comment><USER2> > Why are so few configuration languages not backed by a real language?

In many cases, not having a full featured language is helpful as you have some additional guarantees that comes with a non Turing complete language like guaranteed completion.

In some cases though, you do need a full pledged programming language. For those cases, HashiCorp recently announced CDK support for Terraform: [https://www.hashicorp.com/blog/cdk-for-terraform-enabling- py...](https://www.hashicorp.com/blog/cdk-for-terraform-enabling-python-and- typescript-support/)

<comment><USER3> You can bring that argument, but only until you decide to use YAML, instead of something declarative and simple like JSON.

Once you switch to something as powerful as YAML, you might as well reach for a real programming language.

<comment><USER4> Also, YAML is kind of a hack.

Living in Norway I've had quite a few of these situations where no is parsed to False [1].

[1] [https://hitchdev.com/strictyaml/why/implicit-typing- removed/](https://hitchdev.com/strictyaml/why/implicit-typing-removed/)

<comment><USER5> It has been fixed since yaml 1.2

That said, yeah :facepalm:

</comment></comment></comment></comment></comment><comment><USER6> I'm having some arguments with other developers (devs) on whether or not this is important. I'm gonna finally try to implement this for my own pipeline this week, hopefully.

I would much rather have devs double check/validate things locally before they edit changes.

Modifying config files by using the edit text feature in GitHub (GH), doesn't enable you to do that.

& Devs are lazy. I'm lazy. They want things easy. Me too.

So let's make it easy. Modify your CI/CD pipeline to validate YAML configs on any file changes (use GH hooks for example)

Now devs can do whatever they want - if their pre-deployment checks fail, go back and fix it!

<comment><USER2> This is a very sensible approach. One pro of having the checks automated instead of just having the developers check carefully their changes is that onboarding a new developer is easier, you will spend less time on very small and specific details and you won't forget to tell some detail.

</comment></comment><comment><USER7> You are using YAML already. How much do you care about best practices.

Only partially kidding here.

<comment><USER8> You're currently being downvoted, but I agree, YAML is kinda terrible, not sure why anyone thought Python's syntactically relevant whitespace was ideal for a config file.

Classic example:

      - containerPort: 7173
        name: http

I think that's an object in a list? But it's not overly clear.And if I indented any of those lines wrong...

<comment><USER9> That's a map as a list element, iirc the terminology. But check out this.

When studying the Yaml spec I discovered that a map property (key: value) can have not only a string as its key, but any value. Even a list. (cue screams)

<comment><USER6> Here's another reason why YAML is bad:

the fact that I have to read the spec to figure out what's going on.

It should have been fairly simple to do this.

Why do I have to know the difference between ":" and "=" ...?

</comment></comment></comment></comment><comment><USER10> I recently had a bug that wouldn't have happened if I'd had these in place: [https://dev.to/darklang/a-fun-bug-55cl](https://dev.to/darklang/a-fun- bug-55cl). I added similar checks (and kube-score and polaris seem like good tools - I might try adding them).

</comment><comment><USER11> I think that this is a great approach to test out the files. Mistakes in those files can cause a production outage. I like doing those tests once a PR is open and before it is merged into master and executed on the production cluster. (Disclaimer i am a co-founder of datree.io)

</comment><comment><USER12> And so the circle of schema validation does yet another turn, now back to those XML config files.

<comment><USER13> Every time I see a JSON config file I miss those kilobytes of XML.

</comment></comment><comment><USER8> I find Intellij's K8s plugin really helpful for identifying issues within a single K8s YAML file, but it won't find things like a deployment.yaml without a pdb.yaml but it's a good start.</comment>