Graying Linux developers look for new blood - <AUTHOR> http://www.zdnet.com/graying-linux-developers-look-for-new-blood-7000020026/ <comment><USER2> 1) Worst reputation for verbal abuse of any open source project around

2) Actively cultivated reputation for being esoteric and difficult to get started in

3) Few "big wins" left. Young devs want to work where there is plenty of land to conquer. This often leads to a jump towards new platforms with plenty of low hanging fruit (node.js is a great example of this in action at the moment, and I say this as a node.js guy in his twenties).

<comment><USER3> > 2) Actively cultivated reputation for being esoteric and difficult to get > started in

You're kidding, right? Kernel programming is not like sitting down and bro-ing out some code to make a webapp, its actually fairly difficult to get right. It should be hard to get code into the kernel, because you know, its a vitally important part of how your computer runs.

This is actually a big part of the problem with Linux in the first place, for quite some time it was much too easy to get bad code into the kernel and stability and security suffered. Now that its finally becoming important to people, you don't get /dev/beer added in a week...

<comment><USER4> While I completely agree with your underlying point, your tone is a bit silly in a not good way.

<comment><USER3> My tone is fine.

While I appreciate enthusiasm for projects, enthusiasm without skill is a net loss for everyone working on the project, and thats what the author was proposing. Its a horrible idea and it hurts the entire community to suggest that inclusiveness increases productivity because it does not.

</comment></comment></comment></comment><comment><USER5> I doubt there's going to be a real problem or that this is something that open source advocates should worry about.

The Linux Kernel is behind a lot of real software that makes real money. If Google wants, say, a better kernel to put underneath Android, it can pay for the developers and the development involved, just for one example.

It's true that the desktop in particular might be more like a charity case. But Kernel development seems only peripherally connected and peripherally concerned with this.

If any younger developers want to donate their time to a worthwhile open source project, there are many other projects that probably won't get attention unless someone donates time.

<comment><USER6> Considering something like 85% of kernel work is already sponsored...

Short snippet: [https://www.linux.com/learn/tutorials/560928-counting- contri...](https://www.linux.com/learn/tutorials/560928-counting- contributions-who-wrote-linux-32)

Full document: [http://go.linuxfoundation.org/who-writes- linux-2012](http://go.linuxfoundation.org/who-writes-linux-2012)

<comment><USER5> Sure,

Seems to go with what I posted above.

If these sponsors want younger developers, I would assume they have the money to recruit them. Otherwise, things seem to be going fine for the Kernel as it is.

</comment></comment></comment><comment><USER7> Being a little more friendly could help their cause.

<comment><USER8> Rewriting linux from scratch in a cool language like Go would also help a lot.

<comment><USER9> Go doesn't even support all of the architectures on which Linux runs, for example, IBM mainframes.

Not to mention that a language that relies on its own automatic memory management (garbage collection) might not work so well for kernel programming.

<comment><USER8> I thought it was obvious that it was a joke motivated by the recent headlines on HN...

</comment></comment></comment></comment><comment><USER10> Modifying the Linux kernel was part of my undergrad OS course; I wonder if schools should start more advanced Linux kernel courses and encourage students to really work on the Linux kernel.

IMHO, its also good for the resume; I would think having contributed to the Linux kernel would be a significant plus on anyone's resume.

<comment><USER11> What course was that you took and from which school? That sounds like a really awesome OS course!

<comment><USER12> I had a project in my OS 300 level class to implement a false IO device with supporting system calls on a custom kernel. In practice, it was 3 - 4 .c files and around 200 lines total.

</comment></comment></comment><comment><USER13> Say I'm a 20-something with strong C and systems programming skills. Can I earn a living contributing to the Linux kernel? Would the Linux Foundation invest in training and mentoring me for a year or two until I become self- sufficient and am able to do the same for the next novice?

<comment><USER14> No, just work at Red Hat or Google, they pay plenty of people to actively contribute to kernel development.

<comment><USER15> IBM did at one point too. Have they stopped?

</comment></comment></comment><comment><USER16> I have been wondering about the demographics of software developers in general, and if there is going to be a larger per-year number of retiring senior people in the coming years than there have been in the past, due to programming being a young industry overall.

That could stabilize the total number of workers in the field - instead of growing it - but could also start an additional per-year drain on senior knowledge.

It's just my uninformed imagination, though.

</comment><comment><USER17> That's fair enough:

Programming is a considerably new craft. Linux kernel gets more and more advanced, people need experience to write code. Experienced are older. That's all there is to it.

20 years back you couldn't have 8.000 40-year old C/ASM developers working on an open source project. Now you can and they happen to write _better code_ than younger developers, which makes sense, that's all there is to it imho.

</comment><comment><USER18> At the beginning, we had to listen: "Linux? bah, that's 4 hippies..."

Now this fact seems to be based on real data.

"Linux? bah, that's 4 grandpas..."

Hippies or grandpas, thanks to all, by each commit.

</comment><comment><USER19> My comment which I made on SVN's G+ page:

I'm not actually worried about the demographics in the sense of the Bitergia analysis. If you actually look at the number of newcomers showing up in each of the graphs (the 0-1 year bar), you'll see that it's generally growing, not shrinking. And of _course_ over time some people will move on to other projects (example: Jeff Garzik was invited to the Kernel Summit before he started as a freshman at MIT, but he's now moved on to work on the bitcoin project). So you would expect that over time, the number of people in successive generations will start dropping off. So their analysis is actually quite sloppy as far as I'm concerned. If the total number of developers submitting patches is growing, and we have a constant supply of new people joining the project, it's all good.

Right now, the sense that I get is that companies are having problems finding high quality kernel developers. So people who are hobbyists and who demonstrate great skill tend not to stay hobbyists for very long; they will get hired, unless they have other reasons for staying put. (Example: if I had joined Red Hat or SuSE much earlier, before the IPO mania, instead of staying at MIT working on Kerberos and IPSEC and doing standards work for the IETF, and only doing Linux has a hobby until 1999, my financial situation today would probably be quite different; not that I'm complaining, mind you! The things that I got to work on while I was MIT was interesting, and I made a conscious choice to stay there.)

So to the extent that finding good engineers is hard for many companies, it's not surprising that we're trying to make sure we can attract new talent. That being said, those of us who were on the Kernel Summit program committee who decided that doing an explicit call for hobbyists did not consult with Amanda and Angela who decided to hold a Newcomer's reception. There was no grand plan; like many things in the Linux world, we have a decentralized command and control, and this was not the result of any kind of central planning. The senior engineers on the program committee, and the staff at the LF who have much greater contact with the executives at their member companies may have been reacting to similar observations about the job market for highly skilled developers, but we made our decisions on our own. So what you saw was emergent behavior; it wasn't an conscious decision by any one person to have an integrated campaign.

That being said, a bigger concern I have is not really the greying of the community, but what's our next challenge. We get the most innovation, and new developers (whether they be engineers employed by companies, or hobbyists) when we are responding to a new challenge. For example, for a while, we had a huge effort making Linux better for enterprise computing and enterprise servers. That tailed off, and then cloud computing and mobile/embedded Linux started taking off, and folks who had previously worked for HP and IBM have migrated to other companies, and there aren't as many people focused on making Linux better for enterprise servers. So the question is what's the next challenge?

What part of the I/T industry will Linux be disrupting next? What interesting technical problems will there be for us to tackle as engineers? What business opportunities will cause companies to increase their investment in Linux, and thus hire engineers to work on improving Linux so they can make a healthy return on their investment? What new set of companies will be the next generation of platinum sponsors for the Linux Foundation?

The opportunity to make Linux better-suited for the cloud and mobile/embedded computing won't last forever. So long as we can find that next opportunity, I'm really not worried about the health of the Linux kernel development community. We will continue to have technically interesting challenges, which will keep the hobbyists and as well as professional engineers engaged; and there will be opportunities to make money, which will keep companies continuing to invest in Linux, and people like me employed. :-)</comment>


The 'What Others Are Doing' Trap - <AUTHOR> http://www.startupmoon.com/the-what-others-are-doing-trap/

<comment><USER2> Yeah, coz the UI in Blender really worked out well. </sarcasm>

Ignoring the established ways users interact with things is is great way to make software unusable, or very difficult to use. People need to be able to transfer their existing knowledge to a new product, thus, you need to know what their existing contextual knowledge is. So you NEED TO DO THE RESEARCH FIRST BEFORE YOU BUILD SOMETHING!!!!!</comment>


Lisp implementation in GNU make - <AUTHOR> https://github.com/shinh/makelisp <comment><USER2> I'd love if make was less capable of implementing a toy Lisp and more capable of quoting characters. Like quoting a left paren. I mean, at all.

<comment><USER3> IN GNU make there's \\( , $(\\() and lparen := \\( ... $(lparen) .

<comment><USER2> \\) didn't work for me (may depend on the context, don't know), and some Google searches and Stackoverflow answers later I settled for LEFTPAREN:=) and $(LEFTPAREN)

</comment></comment></comment><comment><USER4> I love the abuse of turing complete tools. It's a weird perversion that I'm starting to appreciate more.

</comment><comment><USER5> This reminds me of MAL [1], which stands for "Make A Lisp" or Make, A Lisp" depending on whether you're talking about the whole project or just the make version. It branched out into being implementations of a lisp in over two dozen languages, with instructions to help in writing your own. I was working on a haxe version before my motherboard recently bit the dust.

[1] [https://github.com/kanaka/mal](https://github.com/kanaka/mal)

<comment><USER6> And yet there is Racket which is 100% making your own language based on Lisp. Serious question. Why is there mal when we already have Racket?

<comment><USER5> I think there may be a misunderstanding here - mal is not the language you make the lisp (or any other language) in, it is the language you are implementing. Indeed, there is an implementation in Racket, and even in mal itself.

The point of mal is to guide an implementer through the steps necessary for making an interpreter using a language they are comfortable in. It gives some insight into how various constructs are implemented, such as closures and tail call optimization. The purpose is not so much to make a lisp-like language (although that is the outcome), but to learn what goes into making an interpreter for one - especially when you can't lean on the constructs that already exist in the host language.

</comment></comment></comment><comment> david-given A while back I implemented Conway's Game of Life in make... by writing it in a custom high level language and then writing a compiler into GNU Make script:

[http://cowlark.com/2013-10-19-insane- make](http://cowlark.com/2013-10-19-insane-make)

I also wrote an arbitrary precision maths library, because make doesn't support arithmetic. I got as far as addition, subtraction and multiplication before coming to my senses.

</comment><comment><USER7> For more wild things you can do in GNU make by pushing the internal language: [http://gmsl.sf.net/](http://gmsl.sf.net/) And also: [https://www.nostarch.com/gnumake](https://www.nostarch.com/gnumake)

I like they way they've done the arithmetic.

</comment><comment><USER8> Somewhat hidden in the readme: A link to [https://github.com/google/kati](https://github.com/google/kati) which is apparently much faster at execution Makefile code.

</comment><comment><USER9> I bet this was inspired by the "Lisp in your language" post from last week, where somebody did it in JavaScript.

That got me to work on a Python version (using tuples, for maximum parentheses), but it got put on the back burner because my life took a turn for the busy lately.

<comment><USER10> A (very basic) version in Lua/LPEG I did a while ago:

[https://gist.github.com/polymeris/857a7ae31db0d240ef3f](https://gist.github.com/polymeris/857a7ae31db0d240ef3f)

</comment></comment><comment><USER11> A part of me loves and a part of me hates the author.

10/10 would lithp again.

</comment><comment><USER12> > There should be a lot of limitations. makelisp behaves very strangely when > you pass a broken Lisp code.

I can't imagine why..

</comment><comment><USER13> wonderful</comment>


Ticketbleed F5 bug undermines HTTPS - <AUTHOR> https://arstechnica.com/security/2017/02/newly-discovered-flaw-undermines-https-connections-for-almost-1000-sites/ <comment><USER2> Thankfully this is limited to a single (and seemingly small) company's hardware, rather than the entire SSL/TLS stack. Glad it wasn't someone like Cisco too ...

<comment><USER3> We had session tickets disabled already so weren't affected, but you'd be surprised some of the sites that use these devices. I believe AT&T has quite a number in use.

<comment><USER4> At one time Azure was built on a whole bunch of F5s. Unsure if they are still in the picture.

<comment><USER5> F5 is just across the water from Microsoft, and there is a lot of cross- pollination of employees between the two. Even if F5 wasn't the best choice, I wouldn't be surprised if they were used just due to familiarity.</comment></comment></comment></comment>


A history of American genocide (2006) - mkr-hn http://www.salon.com/2006/03/04/bruinius/

<comment><AUTHOR> I would argue that it is still happening today (1)(2).

(1) [https://en.wikipedia.org/wiki/Sterilization_of_Native_Americ...](https://en.wikipedia.org/wiki/Sterilization_of_Native_American_women)

(2) [http://muse.jhu.edu/journals/wic/summary/v020/20.1ralstin- le...](http://muse.jhu.edu/journals/wic/summary/v020/20.1ralstin-lewis.html)

"... Estimates indicate that, from the early to mid-1960s up to 1976, between 3,400 and 70,000 Native women—out of only 100,000 to 150,000 women of childbearing age— were coercively, forcibly, or unwittingly sterilized permanently by tubal ligation or hysterectomy. Native women seeking treatment in Indian Health Service (IHS) hospitals and with IHS-contracted physicians were allowed neither the basic right of informed consent prior to sterilization nor the right to refuse the operation. IHS also subjected mentally retarded Indian girls and women to a contraceptive known as DepoProvera before it received approval from the Federal Drug Administration (FDA) in 1992.

From 1970 to 1980, the birthrate for Indian women fell at a rate seven times greater than that of white women. This dramatic statistic indicates that the sterilization and birth control campaign was significantly more than an attack on women in general: it was a systematic program aimed at reducing the Native population, or genocide. The United Nations recognizes prevention of births in a target group as a form of genocide. Attacks on the reproductive capacities to indigenous women in the United States continue today through the use of chemical contraceptives such as Norplant and DepoProvera. The latest threat is a new form of nonsurgical permanent sterilization known as quinacrine sterilization."

</comment><comment> mkr-hn I changed the title due to the likely negative assumptions people would make about "Progressive genocide."</comment>


Apple Offered to Halve App Store Fee to Get Amazon Prime Video on iOS - <AUTHOR> https://www.macrumors.com/2020/07/30/apple-halved-app-store-fee-amazon-prime-video/ <comment><USER2> Article dated July/30th. Related HN discussion from that day [https://news.ycombinator.com/item?id=23999542](https://news.ycombinator.com/item?id=23999542)

</comment><comment><AUTHOR> All this while in the battle I thought Apple said they were playing fair, being impartial with their deal, that they don't give anyone special pricing. But according to this, they clearly do.</comment>


Dark mode has been the feature of choice in tech this year - <AUTHOR> https://www.ft.com/content/982005e2-2594-11ea-9a4f-963f0ec7e134 <comment><USER2> I've always kept my screens dark, save for web browsing. Mainly its because I started in the terminal days, and I didn't care much for having a flashlight in my face when things got graphical.

Likewise, here's an article that says staring at bright screens damages your eyes: [https://time.com/3257927/you-asked-can-computers-ruin- eyes/](https://time.com/3257927/you-asked-can-computers-ruin-eyes/) This is as good a reason as any. Take care of yourself by having the hippest looking screen in the office.</comment>


School Is to Submit - <AUTHOR> http://www.overcomingbias.com/2016/04/school-is-to-submit.html <comment><USER2> One of the biggest benefits of schooling (that almost no one mentions) is that schools function as an enormous public daycare system that keeps children off the streets while parents work. This allows both parents to work instead of having one stay at home for childcare, increasing the size of the workforce and making the country more productive overall.

Schooling has many benefits to the kids as well (which the author does address), but I find it really interesting that simply the existence of schools provides a benefit to society, even when nothing is taught there.

<comment><USER3> The country is not more productive if the amount of money earned by the second working spouse pays only for the cost of childcare, which is actually the case for many families.

Now, funding public school and paying more income tax _does_ bring in more revenue for the government, which governments tend to like.

<comment><USER4> It's even worse than that - even if the second spouse has some money left over, the inflation of life costs (food, transport, and especially housing and, ironically, education) has turned a one-working-prent from the default into near impossibility!

<comment><USER3> Tell me about it.

</comment></comment></comment></comment><comment><USER5> > Most nations today would be richer if they had long ago just submitted > wholesale to a rich nation, allowing that rich nation to change their laws, > customs, etc., and just do everything their way. But this idea greatly > offends national and cultural pride. So nations stay poor.

The examples of China, Japan and the USA suggest the exact opposite. (Actually I do not know an example that would support the authors claim.)

> When firms and managers from rich places try to transplant rich practices to > poor places, giving poor place workers exactly the same equipment, > materials, procedures, etc., one of the main things that goes wrong is that > poor place workers just refuse to do what they are told.

[Citation needed] and so on, and so on...

In conclusion, I think were the essay falls apart is, that it does not examine different kinds of submit. 'submit' is a very different word if the pupil submits to a teacher out of a deep desire to learn a new skill or if someone submits to a warlord. (And both are very different from submitting to a boss at a workplace.) Plus it would be nice to see a rejection of the standard story, that school mainly teaches useful skills.

<comment><USER6> > The examples of China, Japan and the USA suggest the exact opposite. > (Actually I do not know an example that would support the authors claim.)

What? Japan adopted representative democracy, human rights, capitalism, fractional reserve banking, the metric system, and even western attire. China is more authoritarian, but has made many of the same changes. Their economic prosperity is highly correlated with these changes.

And I'm flabbergasted that you think the USA doesn't prove his point. The original American culture was from the native Americans. Once it was replaced with British culture, the economy of north america flourished. In places where native culture was replaced with others (Spanish/native culture in Mexico, Portuguese/native culture in Brazil, etc), the people haven't had the same level of success. Similarly, Spain and Portugal haven't had the same prosperity as the UK. When it comes to per capita GDP, the effect of culture is vastly underestimated.

> [Citation needed] and so on, and so on...

He links to a citation in the sentence after your quote.[1] The paper is a study of the differences in cotton mill productivity in various countries. The author accounts for varying levels of technology, training, and other factors. He finds that the biggest factor affecting productivity is culture.

Honestly, I think you're reading this far too uncharitably. It's a blog post, not an academic paper. If the author took the time to address the objections in this thread, it would have been 10x as much work.

1\. [http://faculty.georgetown.edu/mh5/class/econ489/Clark-Why- Is...](http://faculty.georgetown.edu/mh5/class/econ489/Clark-Why- Isn't-the%20-Whole-World-Developed.pdf)

<comment><USER5> On the US and Japan, Japan did industrialize first, prior to WWII, and adopted some aspects of western culture afterwards. Similar the US did become independent first and then largely developed what is nowadays called western culture. Both actually used force instead of submitting.

My understanding of China is more limited, but it seems they will become a developed nation first before adopting things like representative democracy, human rights etc.

> He links to a citation in the sentence after your quote.[1]

Indeed I overlooked that link, so I should have chosen a different claim that needs a good argument. ( The claim that education became more rigid as a general trend in history seems dubious for example.) However, looking very quickly through the paper, it does not seem to claim that culture as most important factor is well understood, instead he seems to build an argument that local factors are very important and suggests that culture may be the most important local factor.

<comment><USER6> > Japan did industrialize first, prior to WWII, and adopted some aspects of > western culture afterwards.

Except for voting and human rights, Japan adopted all the things I listed before WWII. The Meiji era was full of westernization.

I don't think people realize just how insanely dysfunctional other cultures can be. Plenty of poor countries lack concepts we consider basic. Take Haiti, for example. I'll quote a couple paragraphs from a doctor who volunteered there after the earthquake[1]:

> It has proven hard for me to appreciate exactly how confused the Haitians > are about some things. Gail, our program director, explained that she has a > lot of trouble with her Haitian office staff because they don't understand > the concept of sorting numerically. Not just "they don't want to do it" or > "it never occurred to them", but after months and months of attempted > explanation they don't understand that sorting alphabetically or numerically > is even a thing. Not only has this messed up her office work, but it makes > dealing with the Haitian bureaucracy - harrowing at the best of times - > positively unbearable.

> Gail told the story of the time she asked a city office for some paperwork > regarding Doctors Without Borders. The local official took out a drawer full > of paperwork and looked through every single paper individually to see if it > was the one she wanted. Then he started looking for the next drawer. After > _five hours_ , the official finally said that the paper wasn't in his > office.

I hope that gives an idea of the culture gains Robin Hanson is talking about. Such concepts only seem obvious to us because we were raised in a culture that already had them.

1\. [http://squid314.livejournal.com/297579.html](http://squid314.livejournal.com/297579.html)

<comment><USER5> Unfourtunatly I don't have much time at the moment, so just a too brief answer; if you view culture as broad enough to encompass the example, then I agree. I would view the lack of alphabetical sorting as more akin to a lack of technology, rather than as a feature of culture.

</comment></comment></comment></comment></comment><comment><USER7> If you want to read something about why schools are bad, don't read this prententious and bizarre ode to the employment, read John Taylor Gatto's "The Seven Lesson Schoolteacher": [http://www.newciv.org/whole/schoolteacher.txt](http://www.newciv.org/whole/schoolteacher.txt)

<comment><USER8> One of my favorite pieces of writing. Both in content and style.

</comment></comment><comment><USER9> _Most nations today would be richer if they had long ago just submitted wholesale to a rich nation, allowing that rich nation to change their laws, customs, etc., and just do everything their way. But this idea greatly offends national and cultural pride. So nations stay poor._

I'm sure the people of these nations would love to watch their culture be erased as they become an underclass in the territory of a powerful nation. Just ask the Native Americans!

 _When firms and managers from rich places try to transplant rich practices to poor places, giving poor place workers exactly the same equipment, materials, procedures, etc., one of the main things that goes wrong is that poor place workers just refuse to do what they are told. They won't show up for work reliably on time, have many problematic superstitions, hate direct orders, won't accept tasks and roles that that deviate from their non-work relative status with co-workers, and won't accept being told to do tasks differently than they had done them before, especially when new ways seem harder._

"Many problematic superstitions?" What? Who is this guy even talking about? This sounds like a caricature, not an actual description of reality.

 _The farming mode required humans to swallow many changes that didn't feel nice or natural to foragers. While foragers are fiercely egalitarian, farmers are dominated by kings and generals, and have unequal property and classes. Farmers work more hours at less mentally challenging tasks, and get less variety via travel. Huge new cultural pressures, such as religions with moralizing gods, were needed to turn foragers into farmers._

Again, how does he know this? Is he just making up stories, or is this based on some sort of evidence?

<comment><USER10> A couple comments; first, you have clearly never tried to manage a third-world work force/team. A single example came to mind quickly for me; a hotel I frequented in Mozambique had a serious problem with feral cats. Like 50 of them. They would come right up to your table, jump on it while you were elsewhere, and lick the butter of your plate.

I like cats as much as the next guy, but seriously.

It took a couple of months to get an exterminator in willing to deal with them; cats = black magic = no employees (relatively well educated and very well paid for the town) were willing to deal with them.

The fact that you're writing this post in English significantly bolsters the point the author made about acculturation. You live in a world in which the English essentially won the culture war, and imposed their culture on a vast swath of the globe. (Check out this fine map of places England has _not_ invaded for some perspective: [http://www.humanosphere.org/basics/2013/08/map- of-the-day-wh...](http://www.humanosphere.org/basics/2013/08/map-of-the-day- where-the-brits-never-invaded/))

While it might be controversial to say that English culture generates on average more wealth than some other cultures, I think it would be reasonably easy to demonstrate that something about the English acculturation of colonies left them better off financially than other European and Asian colonizers.

And, by better off, I mean vastly better off. Compare Nigeria (British, $3k+ per person GDP) to CAR (French, $350 per person GDP). I'm not cherry picking, either. America to Mexico. We live in a world shaped by the Brits.

To your point, financial well-being isn't anything like the only measure. At least in America, part of what made growth easy was whole-sale genocide. Places with more balanced colonization plans got much more strung out violence and economic difficulty. I would argue due to culture conflicts, at least in part.

I don't think the author is disputing this in the essay, though. He is instead saying that more individualistic cultures who will not engage with Western school systems hurt their economic outcomes, for a variety of reasons.

<comment><USER11> > _I like cats as much as the next guy, but seriously._

Sure about that? I wouldn't want 50 harmless cats exterminated just because they bother the uptight guests of the hotel occasionally. I live in a country were stray cats are everywhere, and they routinely come in my apartment too. No problem, I enjoy it and have had they chance to raise many kittens as well.

<comment><USER12> Cats have very _interesting_ parasites.

Full disclaimer: I took a young feral cat into my custody once (after it appeared behind my window on the second floor), but it is still worth mentioning.

</comment></comment></comment></comment><comment><USER13> The idea he proposes sounds very similar to the University Technical Colleges in the UK. Taking students at 14, they try to have a very work like atmosphere, with 9-5 workdays, no homework, and a curriculum with a large project based component run in conjunction with business so that students are solving actual problems seen in real business.

</comment><comment><USER14> I explicitly tell students that total rebellion from the school system (or professor expectations) is usually really stupid—but so is total conformity. Students, and people in general, need to find ways to rebel intelligently.

That's probably true in many companies too. A lot of employers, especially white collar / creative employers, don't want or need total drones. But they also can't have people who are utterly unable to work towards common goals.

I remember a somewhat notorious guy at Google who got fired because he was wildly, vociferously opposed to much of what the rest of the company was doing much of the time. Can't remember his name, though.

<comment><USER15> I believe he left, not got fired. And iirc it wasn't about "much of what the company was doing" but just the stupid way the promotion system works (as well as a very, very niche product idea).

Then again I'm mostly assuming we're talking about the same person because he was one of the only ones I would count as particularly "notorious". The fact that our recollections are so different might mean you're talking about someone from many years ago (before my tenure).

</comment></comment><comment><USER16> In my opinion the very ideas propping up the idea of work and the economy are flawed. They are flawed because work is not designed to meet human needs. Instead the output of work is designed to meet human needs. But people are so busy working they have little time to participate in the output of that work. Work itself is the end, because that is what you spend most of your time doing, it is the product in of itself. We should figure out how to produce work that actually improves well being. Not products or services which do that because they all actually fail to do that in the end if the people producing them are miserable. And they all are.

Like let me give you an example. Say a worker produces a widget. They can produce the widget in an hour or in two hours. They feel better if they produce it in two hours. Modern work practices would force you to have them produce it in one hour to lock in that profit of the additional hour of work. At the end to cost of the item would be affected by how much time is given for work. Say the cost is doubled by doing things this way. At the end the worker earns the same, and say we do that with the whole economy and so everything costs twice that much. But workers are generally happier and more relaxed. To me that would be a better out come than goods that cost 1/2 as much. Not so for the economy.

In fact it would be very good if we could use automation to do just this. Make work more pleasurable. But the way the economy is set up, and the logic that goes with it. This is simply not going to happen.

<comment><USER17> In theory the market should balance this. Workers should be willing to accept less money for more rewarding work.

<comment><USER18> Only if this "more rewarding work" is available and at above subsistence level (nothing rewarding about doing what you like but barely being able to make ends meet and/or not being appreciated for it, which in the end destroys your enjoyment of your line of work too).

And only as long as people aren't hammered 24/7 with ads and consumption imperatives -- a lot of people believe those can be easily resisted and that they never buy anything because of these etc, but statistically most of them are overestimating themselves, they are as susceptible as anyone to consumerism persuasion which includes ads, fashion, peer pressure, status signals, being more attractive to potential partners and tons of other things besides.

</comment></comment></comment><comment><USER19> This self-fellating cultural revisionist drivel is exactly the sort of meta- analysis I'd expect from someone who has spent too long codependent with academia and thusly suffers from an irrational self-hatred and tunnel vision and a lingering feeling that their qualifications are much narrower than they'd like to believe. The author only once cites an _external_ party (three links to the very same blog along with a link to their colleague's book). Even that study says:

> The proximate cause of inefficiency in at least some cases was the workers' > refusal to accept more machinery, but the choices of workers correlated with > the local real wage. Whatever constrained the choices of workers in cotton > textiles, or whatever determined their preferences, must have applied to all > of the local labor force. Unfortunately the sources on the textile industry > do not allow me to go with any confidence beyond this limited ascription of > responsibility to local influences.

So workers in Bombay, who were being payed less than workers in England, refused to take on more responsibilities until they received higher wages. Sounds pretty fair to me. Given the information at hand, we could posit that Western countries were more successful at organizing labor instead of assuming, like the author does, that it can be fundamentally attributed to culture, and that less-developed countries like India should just adopt Western culture. Maybe if they adopted Western culture, they could come colonize Western nations, then they'd be _really_ successful. /s

I can't see this as anything more than some sort of strange philosophical flexing, and the author could stand to get another degree--perhaps this time in history.

</comment><comment><USER20> > * foragers are fiercely egalitarian*

[citation needed] because human nature is egalitarian isn't it.

> _Most nations today would be richer if they had long ago just submitted > wholesale to a rich nation_

What you mean is, British colonialism is the only way to run a country. That sort of thinking lead to wholesale massacres, and the British loosing 4 consecutive wars in Afghanistan.

This is the sort of thinking that died out in the 1930s when the indian servants poisoned their british master's tea.

Of course you don't suggest that spain should have submitted to the moors, who were demonstrably more advanced in financial, artistic and technological means.

Progress doesn't happen because the populous reject change, its because progress only happens through chance. The industrial revolution was sustained in england because, despite massive political change, england didn't completely purge/remodel the upper-classes. There was the same level of suffering and servitude.

> _Forager children aren't told what to do; they just wander around and do > what they like_

[citation needed]

Have you ever fucking seen how foraging works? The child follows the parent and actively learns, or they die when they get lost. Do you think that the knowledge that some red berries are bad is instinctive?

> _While human foragers are especially averse to even a hint of domination, > they are also especially eager to take "orders"_

Logic isn't your strong suit is it? Basically your article could be summed up as:

Humans don't like being bullied or enslaved. If you change the practices of leaders, the plebs will follow.

</comment><comment><USER21> It's true there are plenty of problems with our school system, but....I've been to places that don't have school systems, and having a poor one is better than none.

Also, I feel sorry for anyone who only views education as a way to get a job. They've missed out on a lot of beauty in the world.

<comment><USER22> >Also, I feel sorry for anyone who only views education as a way to get a job. They've missed out on a lot of beauty in the world.

One famous result from psychology is that having people focus on an extrinsic reward for doing something tends to completely overshadow the intrinsic reward involved in performance.

Contrast this with the cost of tuition and the dots naturally connect. (Of course, the opportunity cost of spending four years of your life doing something shouldn't be understated either.)

</comment></comment><comment><USER23> Well, yes. This isn't a new observation. Here's a modern overview, describing kindergarten as boot camp.[1] This idea goes back a long way in European tradition, when education was church-driven. Submission to authority is basic Catholic doctrine, and persists in most spinoffs from Catholicism.

School as training for submission to authority went mainstream during the Industrial Revolution, when employers needed a large but passive workforce. But that's a longer story than I have time for now.

[1] [http://www.sociology101.net/readings/Learning-the-Student- Ro...](http://www.sociology101.net/readings/Learning-the-Student-Role.pdf)

</comment><comment><USER24> Some things in this article I would like to object and to point out are (although I am not here to support or argue for/against the current schools):

>>But they won't be publicly ranked and corrected nearly as often as in school, even though such things will happen far more often than their ancestors would have tolerated.

Are you kidding? Their ancesters would even be publicly killed/maimed by other foragers if they couldn't perform as expected or didn't conform to the rules of the society.

I hate when modern people try to paint very rosy pictures of the past, especially of the so called tribal (hunter-gatherer) people. Many tribal societies can be seen to be guided by a single principle "survival of the fittest" and generally the survival function is some combination of "ability to perform as expected by other tribals" and "conformity to arbitrarily chosen rules by the tribal society".

>>They don't have a single random boss they don't respect, but can instead be trained by many adults, can select them to be the most prestigious adults around, and can stop training with each when they like.

Here the author ignores one important aspect :- not even the forager children can stop training with each "when they like": there are many important factors to be considered here; that if a forager kid has not yet learnt how to "earn food and other things needed to survive" he/she must continue training and it may be under those adult(s) he/she may or may not like to train under.

>>Have teachers continually give students complex assignments with new ambiguous instructions, using the excuse of helping students to learn new things.

If any human language is used to give instructions, those instructions will be ambiguous. I doubt if the foragers used any unambiguous human language.

In short, the rise and need of schools is a very important topic and this article leaves too much out. If time permits, I will write my thoughts on it.

</comment><comment><USER25> No one has mentioned Ivan Illich's Deschooling Society yet? I obviously haven't read Bryan Caplan's book that's discussed in this article, but from the looks of it, none of his ideas are new. They've been explored before.

I find his title interesting though, the problem isn't education, but schooling. Another commenter touched on this, but if you're actually interested in this subject check out Illich's book. It's a lot more radical than this hard to understand piece.

Another thing, at the end why is the concept of appearing as "prestigious forager teachers" instead of the actual "dominating bosses" listed as a benefit? Maybe I'm not reading it right.

tl;dr: read Illich.

<comment><USER26> Not sure if this is complete, but I found this link:

[http://www.preservenet.com/theory/Illich/Deschooling/intro.h...](http://www.preservenet.com/theory/Illich/Deschooling/intro.html)

</comment></comment><comment><USER27> For a website called Overcoming Bias, the bias in the article is fairly transparent.

</comment><comment><USER28> And learning to read is to brainwash you. sigh...

</comment><comment><USER29> Read 'deschooling society' by Ivan Illich. Will help you understand a thing or two about what is school all about.</comment>


The Web We Want - <AUTHOR> https://webwewant.fyi/ <comment><USER2> I know this isn't _quite_ on topic, but this is not the web I want. I want open services to compete with the entrenched players of free-as-a-service, and I want more interop between these open services. I'm sure HN already gets the gist.

I run as de-Googlified a stack as I can: Nextcloud, DAVdroid, LineageOS, exclusively Linux, a private cloud server, etc. This is for my personal usage - at work, we run the whole Google/Atlassian suite, and I'm (mostly) fine with that separation.

But I positively _pine_ for the ease of use and general UX of the closed services when I go back to my private, open-source stack. A quick case in point: the Conversations Android XMPP client

I'm a Librem 5 backer, and I'm looking forward to the challenge of using it as a daily driver. So I'm looking to wean myself off WhatsApp in favour of something open. But Conversations isn't it. It's a _great_ XMPP client, but it's not something I will ever convince the majority of my friends and family to use. It's couched in technical know-how, and while it's a great app for an open source project, it still manages to feel subpar to the closed-source, back-doorable, privacy-draining consumer offerings. Signal seems the closest so far.

(I should add here that I am trying to do something about this: I contribute haphazardly to OSS I use and I evangelize it in my social circle, but it feels like an uphill battle)

More anecdata: I run self-hosted GitLab, Nextcloud, and Wallabag. Hopefully Mastadon and Pixelfed soon.

There is _no freaking way_ to do SSO between all of these. Despite OAuth+OpenID being older than some of that software. Don't get me started on the fact that the quickest way to get a file from phone <-> PC is to Slack it to myself from my work account.

The web I want will compete with closed-source ecosystems, instead of being a disparate collection of DIY server software that doesn't talk to each other in the slightest.

<comment><USER3> I'm personally a fan of Sandstorm.io and hope it can continue growing and offering an alternative much more aligned with individual's interests than what the largest few software companies in the world are creating.

<comment><USER4> > hope it can continue growing

:/

> > [https://news.ycombinator.com/item?id=20312789](https://news.ycombinator.com/item?id=20312789)

"Unfortunately Sandstorm is basically dead at this point. I kept actively working on it for a while in my spare time after the company failed in early 2017, but I haven't found any time to do serious work on it in probably a year now. I do push monthly updates to keep dependencies fresh but that's about it.

Oasis takes in about $1800 per month, which is just about enough to cover serving costs and business expenses (e.g. annual tax preparation). For a while it was making only $800, with me making up the difference out-of-pocket. Then, last October I stopped offering a free plan. Remarkably, revenue more than doubled and has even gradually continued to increase over time -- I had expected a smaller spike followed by a drop-off.

But now it's getting to the point where it feeling really awkward to let people pay for a service that hosts a library of apps that mostly hasn't been updated in 2.5 years or more. In theory developers could still be updating their apps and submitting new ones, but basically the only app actually getting updates is Wekan. So, not sure how long long this can really continue... :("

<comment><USER3> Ouch. I hope that $1800 grows to enough to be sustainable for Kenton to invest some time or hire someone's time to grow the product, even if slowly.

</comment></comment></comment></comment><comment><USER5> Back in the 199x I was able to draw a design and pretty decent ui simply in CorelDraw. Stack some shapes, promote outlines, stretch textures, intersect/combine/diff/layer/group, place along few guides and that's it. Now add some linear algebra on few points to make it resizable (including scroll and time axis) and everyone will create any app or site they need in hours. That's what I did, working as a teenage 'designer' in a small typography producing promotional posters, business cards and info booklets (basically, almost all websites you can imagine, but on paper). Oh, and forms, lots of forms.

I mean, finally throw away that html/css mindfuck, please, and provide some decent shaping and coordinate relationship system instead. So I could go back to that boring 20 projects a week routine.

<comment><USER6> I won't argue that today's web landscape isn't bloated, but the designs you built in 199x had potential audiences several degrees of magnitude smaller and less diverse (in terms of users and devices) than what the average webdev has today. I don't think it's possible to have such breadth and size of userbase and use-cases without a non-trivial increase in build complexity.

<comment><USER7> It may not possible, but that doesn't mean the HTML and CSS clusterfuck is anywhere near the level we'd have expected back in the 1990s. None of the tools we have today can hold a candle to a proper UI builder -- which would suffice for a lot of "progressive" web apps. Back In The Day (TM), with a proper UI builder (as seen in Visual Basic, C++ Builder, Qt Designer) I could build ten different versions of the same dialog, for ten different resolutions and aspect ratios, in about the same time it takes me to get a button to stay where I want it in CSS.

And, by the way, the weirdness of the day -- and the capabilities of the tools -- shouldn't be underestimated! The good ones did proper relative positioning and alignment, supported various kinds of "flowing" layouts and so on. It wasn't uncommon to have to support all modes between 640x480@4 and 2048x1536@32, and basically no applications ran in full-screen mode, so you didn't have about a dozen resolutions and aspect ratios, you had pretty much an infinite number of combinations.

<comment><USER6> Granted, I'm not a huge fan of the generated HTML/CSS/JS that it generates, but don't services like Wix make it incredibly easy for a layperson to build a servicable and attractive UI? Again, I reiterate that the generated code is an absolute clusterfuck (even compared to what I remember Frontpage 99 making), but from what I can tell, the end-user never touches the generated raw code.

<comment><USER7> Tools like the ones I mentioned weren't meant to allow a layperson to build an UI, they were meant to allow _developers_ to build an UI. The experience hasn't degraded much for people who don't write code for a living, but it has degraded significantly for developers.

FWIW, it's part of why I moved away from all this stuff, more than 15 years ago. I discovered a lot of other fun things computers could do (I got into embedded programming, operating systems, security etc.), and web development stopped being fun when we seriously continued digging the hole we were into instead of climbing out of it.

<comment><USER8> > _web development stopped being fun when we seriously continued digging the > hole we were into instead of climbing out of it._

well, at least we got docker and kubernetes to save the day and can scale infinitely with our _superior_ CI which sadly breaks every built and needs a whole department to shepart into this brave new world

</comment></comment></comment></comment></comment></comment><comment><USER9> The Web I Want:

* Usable on a older devices and slower connections

* Respect for accessibility, including no-JS and no-mouse

* Markup that weighs less than 20x the content

* No malware and adware

* Respect for non-Chromefox users

Edit: Just more respect for the user in general would be very nice. Pop-ups. Hostile TOSes. Making user jump through hoops. Spam. Unsubscribe that requires login. Text that's mixed with promotional links. Hostility to no-JS users.

I've decided that this is not the Web I Want a while ago, and when I come across this type of crap, I just leave. And I don't click, e.g. medium.com, links anymore I am much happier now as far as browsig the Web goes, my stress levels are down.

With the time I've saved, I've been able to find new, nice, quality websites, which I visit instead.

And I realized something else: The quality of content I access has become higher as a result. Good quality content is apparently accessible. Crap quality comes with the above.

TL;DR: Stop putting up with crap.

<comment><USER10> > Respect for accessibility, including no-JS and no-mouse

How is JS directly related to accessibility?

<comment><USER9> Accessibility is not just about vision-impaired users. It is about making your website _accessible_ \-- to anyone.

JS websites without fallback reduce accessibility for:

* Users with slower devices

* Users with dated devices and browser software

* Devices with poor connectivity

* Users who have JS disabled through no choice of their own.

* Users who choose to disable JS.

* Browsers which do not support JS.

* Accessibility software.

* Not to mention bots, scrapers, etc., who also have valid use cases.

This is a non-comprehensive list I came up with in just a few minutes. I'm sure there are many more items that can be added to it.

</comment></comment></comment><comment><USER11> There's enough tooling as it stands. In-browser devtools are a veritable kitchen sink of possibilities to tap into. And even a cursory glance at some open source projects on Github yields a plethora of tools, modules and snippets of code to use in your project. In essence you can do anything you want with some JS, CSS, and HTML. This is the beauty of the web. We get lost when we ask for _more_ tools and techniques to do things. It's like a massive collective hallucination that the current stack(s) for developing are _unworthy_ or need to be drastically improved. Yes, progress is good, but we've reached a tipping point IMHO.

<comment><USER12> True, nevertheless the current stack(s) for developing needs to be drastically improved as long as it is meant to be a platform for building apps and not only for publishing documents. I recall how easy and fun it was to build apps with Delphi and alike IDEs and now the whole React&Friends stack scares the shit out of me.

<comment><USER13> What scares you about it? React seems pretty easy to use?

<comment><USER12> When I make a WinForms app in VisualStudio I just drag-drop controls, click them and adjust properties the way I want, then click the controls and write the code which is going to execute in particular events. I have never had to learn this, I didn't need a single tutorial.

Once upon a time I've just got a junior C# developer job (without knowing anything but basic C++ and SQL), were given a computer and a real task and implemented a reasonable good-looking (looking and feeling the way common to all the Windows apps) business app that went straight to production just in some hours. And I didn't need anything but intuition and the API reference. It felt exactly like playing Lego.

Despite I also know basic HTML, CSS and JavaScript (I've learnt during the WindowsNT4 years) I have no bloody idea of what to do to get an approximately same result with today web-based front-end technologies. I've seen some React code and it seems pretty extraterrestrial. What scares me is the amount of what I need to learn before I can produce a useful application. And it seems (and feels the scariest) Photoshop and the art of visual design are on the list.

</comment></comment></comment></comment><comment><USER14> I have this idea for quite some time, but it really manifested after I started using React. I'd like to hear the thoughts of fellow web developers on this.

The whole browser facing side of the web is a mess. I think it's quite similar to C++'s situation. Because we require backwards compatibility, the standard is becoming an unmaintainable mess and the best plan would be to phase out the current browser technology while building something that applies the lessons learned from the current web and build something that is simple and powerful. I think WebGL and WASM would be a good way to start. That way we could build a new browser inside the old browser and once the new browser is stable, we can build the old browser inside the new browser and let it have it well deserved EOL. I'm usually in favour of fixing existing solutions than to start from scratch, but the current web is such a badly engineered mess that it warrants a rebuild.

<comment><USER15> What are some of the design choices you would make differently than existing browsers?

<comment><USER14> Ditch CSS and HTML completely and create a sensible layout engine. If you base everything on a low level rendering API, you can basically create your own framework (though you shouldn't need to). Databinding, event handling etc. should be as simple as in Desktop apps, so we don't need to create ham-fisted abstractions á la Angular or React. Make it so that 90% of the websites don't need any additional code (so that you can reasonably ask users for code execution permissions, similar to notifications). Maybe add the option for low level networking so you don't need to create interfaces so you can support mail protocols natively (I'm unsure about this). Make accessibility so simple it becomes the default. Performance should be a no brainer too. Make tracking as hard as possible from the get-go. Keep the specification lean and don't add stuff on corporate whims. Reduce the memory usage of browsers. Since it's based on WASM you can use any language you want. Hopefully this will encourage better programming practices. Because frankly, the current JavaScript framework/NPM/Yarn/Gulp/Bower/whatever environment is just ridiculous.

Most technical issues can realistically be tackled. I doubt you could win against Google et al. on the tracking/code execution stuff.

<comment><USER4> > Databinding, event handling etc. should be as simple as in Desktop apps

I'm pretty ignorant of how desktop apps work; how simple is it? Are we talking a straight up pub/sub system?

<comment><USER14> Sorry, just saw this. The problem with angular and react databinding is that it takes away control from developers. A simple pub/sub system can be extended to everything a developer wants, without clumsy hash-key insertion, digest cycles or array reconciliation. I think WPF did it fairly well back in the day.

</comment></comment></comment></comment></comment><comment><USER16> Interesting. I'd love to give feedback, but I don't think anything I want fits into the modern web. What I want are often problems with the modern nature of things, not so much with features lacking in the web as it stands. Eg;

1\. I dislike how mutable information is. While I really value ephemerality, I think the "web" needs the ability to refer to content in an immutable way. Misinformation is big these days, and mutation only adds to confusion. It's why some information store stuff I'm writing is all content addressed; in my view information needs to be immutable.

2\. Obviously tracking is a problem these days. I don't think this is a problem of the "web", but I do think it's a problem of the "web" that we have no easy way to distinguish between information sources, like an html page, vs applications with a user experience. I love big bloated web apps, but I think the user needs to be able to distinguish what type of application they're seeking. Information should not opt into complex application user experiences, aka JavaScript. The web keeps opting into more feature bloat as the default; this seems wrong. The opt-in, not feature bloat, to be clear.

3\. The web as it stands also seems to embrace centralization over decentralization. This again is fine _(imo)_ for user experience stuff; not everything needs to be decentralized. Yet, for information, especially immutable information, decentralization seems not only useful but vital. Ideally, stupid simple decentralization too. Connected hubs of peers are nice, but I don't think we should be required to run a process/server to view and manage something immutable. `git pull` a slice of the immutable information you want seems _(to me)_ to be a critical lowest denominator here. Sharing, slicing up, distributing on flash drives, etc - the web as I'd like it should promote sharing of information in ways that fit as many people as possible; not just the ones permanently connected to the internet and so forth.

I could go on, but I think ultimately what I end up describing is an alternate web. Something based around immutability and information, with opt-in full user experiences (aka javascript, wasm, etc) on top of that. What does this look like? Is this IPFS or DAT? No idea.

All I know is I'm making an information store, likely very imperfect and full of flaws, with these ideals in mind. I love the model of Scuttlebutt and a _compatibility_ of that and connected-distributed ideas like IPFS/DAT seem best to me currently. I hope we continue to embrace immutability.

<comment><USER17> The immutability argument makes a lot more sense once you detach presentation from content (json, markdown, style-free html). A presentation-free Web is basically a DB with immutability acting as its versioning system. IPFS/Dat make that argument stronger my adding writability to end-users.

A presentation-free Web also empowers the browser to set the presentation, which really helps with issues around accessibility, anti-tracking, end-user customization, and (I'd argue) decentralization of Web software overall.

<comment><USER18> Immutablity doesn't scale.

Users like having experiences.

It's much easier to build something like Google/Uber/AirBnB on GUN/CRDTs than only-hash based or append-only protocols.

End users don't use something for the protocol, they use it because the app developer created something that gives them value.

We need to stop pitching decentralization to the fantasies of developers, and start giving value to makers, shippers, and users.

<comment><USER16> > Immutablity doesn't scale.

I imagine you're thinking of specific implementation(s) of immutability. Regardless, my use case is not that of Google; my use case is of the person. It's of being able to share, own and read information with trust.

> Users like having experiences.

This feels like a straw man. I very much supported UXs in my post; I even said I love bloated feature rich user experiences. I don't think anyone intends to entirely give up feature rich web. We often just want options. Right now we _only_ have the mutable, feature bloated web. While I love it for applications, it seems terrible for information.

> It's much easier to build something like Google/Uber/AirBnB on GUN/CRDTs > than only-hash based or append-only protocols.

Quite possibly; I do not claim to have all the answers. What I have is a desire. A desire to be able to refer to content, and not have someone change the meaning of that content.

In the age of misinformation I don't think we have a choice. In the same way that a signed binary can be important, I think signed / immutable information is important. Do you disagree?

> End users don't use something for the protocol, they use it because the app > developer created something that gives them value.

Agreed; which is why I was talking about value I see in the features of immutability I described. As well as the anti-value _(is that a thing?)_ I see in the state of the mutable web as it stands now.

> We need to stop pitching decentralization to the fantasies of developers, > and start giving value to makers, shippers, and users.

Saying decentralization is a fantasy seems in spite of some of the most successful technologies in human history. This is odd to me.

 _edit_ : as well as new federated software embracing decentralization. You being against this is perplexing to me.

<comment><USER18> Granted, there are certainly worse implementations of immutability than others, but immutability as the foundational architecture (even in its best design) creates bottlenecks.

Yes, a person owning their data should mean _they can change it_!

Fair point on UI/UX, you got me here - you are right.

It is trivial to build immutability on mutability, this is what MD5/SHA checksums do all the time on things like downloads. But if your base system is immutability, it is hard to do anything else well.

To your question: I agree signing is important. Doesn't mean it needs to be immutable!

Very well said! I'm impressed with how both precise and concise that was. Good point.

Oh sorry, decentralization is great, just its target use case should be "developer fantasy" but "user value add". Sorry for the confusion here. I'm pro decentralization (I build p2p protocols).

<comment><USER16> > Yes, a person owning their data should mean they can change it!

Well being able to change data is of course needed; so that goes without saying _(I should hope)_. However what I mean by immutability is rather that I think the web should allow me to link to a piece of content, and ensure that what I link cannot be changed from underneath me if I choose not to.

I feel like I'm describing features and you're describing implementation. To me, immutability _is a feature_. I'm not at all referring to blockchain or any of that junk - merely that I want to be able to link (in the web sense, url/etc) to content - to discuss it with other people and etc, and have that content not change.

Optionally of course I should be able to link to mutable content. However we have mutability down. The feature add I'm talking about, is immutability.

> It is trivial to build immutability on mutability, this is what MD5/SHA > checksums do all the time on things like downloads. But if your base system > is immutability, it is hard to do anything else well.

Sure, but that's an implementation detail. I was not _(or did not intent to, at least)_ say that the "base implementation" must be immutable. All I care about is that immutability is a first class citizen, and linking immutable content is possible. To build user features around immutability, where as nothing like that exists in the current "web".

<comment><USER18> Excellent separation of concerns (feature vs implementation), totally clears things up in my head, and I agree with you now.

Do you write/blog/tweet? Your clarity and ability to see through things is fantastic. I'd love to follow your work.

<comment><USER16> Haha, alas no. You have me curious about CRDT and immutability though and will be investigating it more for my application. If at all possible. Appreciate the talk!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> What a really want is not to have to browser tabs give triple AAA games a run for their money in resource use for little to no benefit in usability.

</comment><comment> c-smile I believe that most frustrations we've got is in the fact that we are trying to handle two distinct tasks by single tool.

1\. Web as a source of information. Super Wikipedia as you wish. Mostly for us - readers.

2\. Web as a functionality delivery tool - access and interaction with applications.

As we know any universal tool is not that good for the particular task as specialized one.

And that is the main problem I think.

At early stages we had semistatic HTML(3.2)/CSS(2.1) that was quite adequate for task #1 (reading, consuming information). And we had Java applets for applications.

These two were more or less orthogonal and could evolve independently so they still be specialized tools optimal for the tasks they serve.

Hey, we had Android with Java UI... so technically things like VSCode or Google Docs could be just Java [or Kotlin or whatever] applications inside browser if someone really wants that ...

</comment><comment><USER20> I'll volunteer mine, in the hopes that it's been solved already:

After transpilation, minification, and with flaky source map support in many places (e.g. rollbar downloads new source maps after the first error, and doesn't apply them retroacively to the stack trace), a lot of information about errors is lost. Combine this with ubiquitous async programming, and all you get is something like "a.x is undefined", which hardly actionable.

I propose two solutions. First, instrumentation of functions (like rollbar does in python) where you can see the function's local variables and arguments alongside the stack trace. Second, async traces, which trace the scopes where a promise was created, fulfilled, rejected, and awaited. These are huge omissions in javascript tooling today.

<comment><USER21> What I'd like to see is compiled JS with the equivalent of debug symbols; minified JS with source maps feels like a patchy solution at best, after all it's still JS which is represented and transferred as ASCII text; I feel like this could be accellerated by a lot.

I wouldn't mind common libraries (jquery, react, etc) to be shipped by browsers (lazy loaded), with signature verification in the browsers themselves. CDNs / single code locations sorta help by increasing the change of a browser cache hit, but that too seems like a workaround.

</comment></comment><comment><USER22> Hot take: the web technology toolchain is plenty powerful as it is, and expanding it will cause more problems through misuse of newer features than it would create solutions.

Yes, web standards offer loads of tools that let developers and designers get _really_ creative with their work, but we've reached a point where many of us are spoiled for choice, and loads of the mainline options are used, abused, or otherwise ill-optimised to the point of making many websites heavy enough to turn many laptops into space heaters.

Worse still, the "spoiled for choice" factor means that people keep finding radically new ways to use the toolchain; while this is arguably not a bad thing in isolation, it makes it _so_ difficult to keep up with what you're _supposed_ to use at any given time.

<comment><USER23> Technology and progress is great, but deciding on what to use is becoming like browsing for something to watch on Netflix (or other streaming services).

Lots of the time we spend deciding, dealing with devtools and toolchains, and debugging magic helpers or abstractions on top of abstractions (and I love good abstraction), that takes time away from what we are building, the product.

Simple is good, complexity is bad unless it is simple layers/parts but not too many you have to deal with, simplification is good, refactoring is necessary at this stage. In a way there is a choice technical debt. Move fast and break things, sometimes the 'break things' part of that is adhered to a little too much.

Engineering/product development is taking complexity and simplifying it, are we doing that? Or are we adding complexity where it was simple? I am looking forward to the next great simplification wave.

</comment></comment><comment><USER24> I threw this down the tubes, but put this here as well:

What I'd like to see is an HTMLx that addresses the core needs of the Web- using entities, and an ecosystem of Web extensions that expand on the capabilities of it. So, something like what smartphones with their apps and markets are doing. Basic call and message capabilities, but then there's TrueCaller and WhatsApp and the like.

Bear with me. Business, gaming, video and publishing would be the core interests. So this HTMLx would get forms and credit card processing and the like, accelerated sound and input and graphics and networking, two way streaming and en/decoding, and lastly, a responsive grid and symbolic styling. Everything else, all of it – client side tracking, syndication, advertisement, compulsory client-side computation of various forms like fonts and GPU or native kernels, even JS code and client storage and cookies – I think should be available through a market. If your website is using something like that, let it suggest an "app" module to the user to install and enable on this domain.

"Please support our project by enabling advertising on this domain [OK] [Later] [Never]" "For Youtube Movies please install DRM/x264 package from the market [OK] [Later] [Never]" "You will need to enable storage, code, and gaming modules to use Itch [OK] [Later] [Never]"

Because browser extensions suck. Browsers suck. Mobile browsers suck. The experience of the Web sucks, for anyone that knows better. Shopping, gaming, streaming, syndication and publishing all suck big time.

</comment><comment><USER25> This is turning into a great thread for developers to vent about browsers. "Accept/block Notifications?" have become the DHTML popups of late.

</comment><comment><USER26> One day the modern web will be sufficiently powerful and standardised to fully recreate the 1990s Java applet.

<comment><USER27> Welcome to now.

<comment><USER28> Needs to crash more. Lacks platform incompatibility. Needs more cheese.

That wasn't the dark ages of design. It was the bottom floor of a pit in the eye-tortuing prisons of the Inquisition in the dark ages of internet design.

<comment><USER26> Can't tell which way around you're talking.

Modern web lacks cross platform - even cross browser - compatibility and is buggy as hell.

I agree Java applets were pretty ugly. But that was 20 years ago...

</comment></comment></comment></comment><comment><USER29> I want tracking to be opt in, and content serving to be decentralized (at an organizational level — not one company with a decentralized network).

I want the user agent to enforce this, and I want open standards so anyone can build a user agent.

NNTP achieved these goals. The web has failed in all of these dimensions in practice.

</comment><comment><USER30> This is the Web I want and am working on, in significant organizations that are also working on this web (connected to DLTs &c via DIDs), as a solution to everyday problems and a transformative way forward. [https://ruben.verborgh.org/blog/2017/12/20/paradigm- shifts-f...](https://ruben.verborgh.org/blog/2017/12/20/paradigm-shifts-for- the-decentralized-web/)

</comment><comment><USER31> Something i hadn't considered before i started working with a historian friend is the duty we have as developper to provide searchable, durable, standard content for future generation.

it is very likely the wide majority of today's content won't be searchable by historians 200 years from now, because of all the walls we put, of all types (sign up only content, native apps, disappearing companies trashing their database, etc.).

</comment><comment><USER32> Hmm, I really want to suggest that linked SVG files should be able to be styled like inline/embedded ones, but I partly feel this item on the site would probably cover that:

[https://webwewant.fyi/wants/13/](https://webwewant.fyi/wants/13/)

Still, I guess outside of that, I want more customisation options and standardisation around the date/time picker interfaces on those custom fields. The fact every browser has its own version, and most of them are basically impossible to style is ridiculous.

Also it's time we stopped treating form inputs like some immutable part of the OS UI and let developers customise those too. We should be able to fully style select fields/drop downs, radio buttons and checkboxes, etc.

</comment><comment><USER33> If this wasn't technology-specific, I'd submit an idea of:

"The Web We Want... doesn't require you to accept a cookie notice, ignore an anti-ad-blocker warning and newsletter pop-up before circumventing a soft paywall in order to read a quick, shared article."

<comment><USER34> Would you pay $0.2 to avoid that?

<comment><USER35> Yes. Or rather, I'd be happy to pay let's say $25-$50 a month for an overall "News Subscription". Then this amount would get distributed over the various news sources I visit, either based on how many articles I read from a certain source or some other "fair" mechanism.

</comment></comment></comment><comment><USER36> I find it interesting that for this site the "we" is web developers. It isn't web consumers or, for lack of a better term, typical users.

</comment><comment><USER37> Wouldn't it make more sense to have those discussions under the moniker of the WWW consortium rather then having yet another entity?

</comment><comment><USER38> I was gonna write that I do not want any more tools to my web toolbox. Then it struck me, I'm working on developing ... a web tool. But I'm struggling to find "product-market-fit", who needs more/better tools ? And what do you need ?

</comment><comment><USER39> The problem with the web isn't its technology; that part is amazingly great now. The problem is with (a subset of) the people who make websites, and the business interests driving them.

</comment><comment><USER40> You often don't even know what you want until you build it, try it in PRODUCTION.

I prefer a scientific method to discover what we really want here.

</comment><comment><USER41> Well that was a bad first impression. I don't want mobile websites asking to place their shortcut on my homepage.

</comment><comment><USER42> I want a Web in which we use different languages to describe a document and the UI for an app.

</comment><comment><USER43> The second I saw this, I knew what I wanted: CSS transition to auto heights/widths.

</comment><comment><USER44> I want the user to be in full control and not the web site provider.

</comment><comment><USER45> Has anyone looked at the source code for this page?

This is not the Web that I want.

</comment><comment><USER46> Can they help building a time machine to undo the iPhone?

</comment><comment><USER47> Meh.

A lot of people say they want this and that, yet they keep using software and services from the known evil companies, and don't advocate against them.

It's easy to just want things.

<comment><USER48> Most people perhaps don't know how to address the gap between what they want and what they use?

Like me, I want federated social media so that users control their content. Probably that's only achievable legislatively, but the companies who don't want to have to break down their walled gardens - Facebook, Google, Microsoft (eg Skype) - can buy off ("lobby" you might euphemistically call it) the major political party in my country, I'm sure. Where does that leave me?

If I stop using Facebook I just lose out from contact with various social circles (maybe that would be better for me, but that's an entirely separate question), I can use Matrix (say?) but I don't know of a bridge that will free my Facebook messages?

Moreover most of the population probably don't know what they don't know and so aren't aware of the technical possibilities that are there, never mind how they might be put together as a tool they then can realise they want ...

And that's not even to address things like companies finagling themselves into education or healthcare.

<comment><USER47> > If I stop using Facebook I just lose out from contact with various social > circles, I can use Matrix (say?) but I don't know of a bridge that will free > my Facebook messages?

My opinion is that this approach is wrong and less smart than it sounds. This approach suggests that it is possible to smoothly move from one close platform to another one, but it is not.

Network effect is everything in social network, but if you stay on facebook you're keeping its network effect in place, effectively vanishing the need to even explore another social network, federated or not.</comment></comment></comment>


Turntable.fm AutoAwesome Bookmarklet - <AUTHOR> http://empl.us/auto-awesome/ <comment><AUTHOR> I _do_ plan to automate looking up the DOM ID. Just wanted to share it early.

<comment><USER2> Is the purpose to gain more votes from prospective voters by alwaysawesoming their plays?</comment></comment>


Orthodox Jewish Men Wear Blindfolds at Airport to Avoid Seeing Immodest Women - <AUTHOR> http://all-that-is-interesting.com/hasidic-blindfolds <comment><USER2> is this actually for real or some kind of rick roll episode?

</comment><comment> wow123-2 this is antisemetic and untrue</comment>


How a Human-Machine Mind-Meld Could Make Robots Smarter - <AUTHOR> https://www.technologyreview.com/s/603745/how-a-human-machine-mind-meld-could-make-robots-smarter/ <comment><AUTHOR> Kindred AI (the mentioned start-up): [https://www.kindred.ai/](https://www.kindred.ai/)

IEEE Spectrum on Kindred AI: [http://spectrum.ieee.org/automaton/robotics/artificial- intel...](http://spectrum.ieee.org/automaton/robotics/artificial- intelligence/dwave-founder-new-startup-kindred-ai)</comment>


Ask HN: Generalist screencast series for mid-to-senior developers? - <AUTHOR> I recently binged through Destroy All Software's series on Computation, which was eye opening, and now I want more, but it seems most are either aimed at juniors (code school) or about specific technologies.<p>Any recommendations? <comment><USER2> Tooting my own horn, some of the stuff I've done is aimed at more experienced people, and I'm not really interested in teaching specific technologies so much as skills and ways of thinking.

E.g.:

* Blog post on object ownership's different uses and limitations in different languages: [https://codewithoutrules.com/2017/01/26/object-ownership/](https://codewithoutrules.com/2017/01/26/object-ownership/)

* Blog post on bug reporting as an important process in software development: [https://codewithoutrules.com/2017/02/10/voice-exit-user-rete...](https://codewithoutrules.com/2017/02/10/voice-exit-user-retention/)

* Recorded talk on testing, the big picture (first talk here): [https://codewithoutrules.com/talks/](https://codewithoutrules.com/talks/)</comment>


Gravitational waves: Monster black hole merger detected - <AUTHOR> https://www.bbc.com/news/science-environment-46428010 <comment><USER2> 80 solar masses is no monster black hole.

<comment><AUTHOR> Maybe it is a monster merger though? It is very early days in detecting these phenomena, so I expect you are going to see this headline every time we detect a larger merger than before.</comment></comment>


Ask HN: When to say NO to introductory meeting? - <AUTHOR> From time to time I have a new client which wants to meet with me personally and what is significant he/she refuses tell me what will be exact topic of the meeting. It cost me my time and transport expenses. I think they just want to bounce ideas around or pick my brain or whatever for stealing my time.
Do you think it is toxic client and it is OK to say NO?
What would you write/tell such client?
Do you know some interesting online strategy materials on this topic? <comment><USER2> You don't say what sort of business you're in, or what sort of clients you have, so it's impossible to say. However, if someone insists on a meeting and _doesn 't_ tell you what it's about, I think it's reasonable to discuss some sort of payment for your time and input.

You can make it clear that if the meeting turns into something that is of mutual benefit then it will refunded, rescinded, or otherwise paid back. But equally, make it clear that your time is of value to you.

<comment><USER3> You can also make them visit _you_. That makes the visit cheaper for you (no travel expenses, no time list traveling) and (assuming they have a real business, which may be stretching it) more expensive for them and thus should filter out some of these meetings.

<comment><AUTHOR> For now I filter them all. I just want to know if I am doing wrong or what are experiences of other HN readers.</comment></comment></comment>


Do Not Track California Privacy Law Changes Effective Today - <AUTHOR> https://www.iubenda.com/blog/2014/01/01/track-california-privacy-law-changes-effective-today/ <comment><USER2> Am I the only one who thinks "Do-Not-Track" is a snake-oil-grade security and what this header reliably does is only adding a single more bit to uniquely identify the visitor?

<comment><USER3> I tend to agree.

Some marketters just have really weird ideas about what they should be allowed to do. Or even what i should be allowed to stop them doing.

Spam is obviously evil to most people, until they decide to spam for their particular product.

SEO has had some strongly negative effects on the www. I'm sort of thinking of starting a movement like "contrast revolution" or "viewable in any browser". My banners would be "zero SEO performed here".

<comment><USER4> _shrug_

I think the primary tactic for white-hat SEO these days is, "Create good content people want to read." Hard to get too upset about that.

</comment></comment></comment><comment><AUTHOR> Basically, commercial online services (which includes mobile apps) need to add a sentence/paragraph about how they are handling the Do Not Track header requests. This is a California OPPA amendment starting today.

We/iubenda is giving away a special discount to those affected in California, which most of you may be.

<comment><USER5> Honest question: How does one send a Do Not Track header request to a mobile app? One does not interact with a mobile app via HTTP (although the app may use HTTP internally) and can therefore not send HTTP headers...

Or, is it in your opinion, a law written by someone who does not have sufficient technical understanding to find the correct wording, and now the law applies erroneously applies to mobile apps?

</comment></comment><comment><USER6> I'm wondering about how 'club card' tracking is affected by this. If I use a club card at the hardware store, and it has a corresponding website that allows me to manage the card's account, is the tracking law going to apply to purchases I do in store as well?

</comment><comment><USER7> So practically speaking, this California law will have a national effect.

Since it is near impossible to determine if a visitor is a California resident or not, sites/apps will just implement the necessary notices and features to comply with DNT for everyone.

<comment><USER8> I would think that this law has no enforcement outside of California for websites that are outside of California. As a non-California resident operating a website not in California, I am not subject California law. This is the same basis used for not collecting out of state sale tax.

<comment><USER7> I didn't mean the DNT law will be enforced nationally. I meant the effect will be national since a site will just implement the necessary changes once for all its visitors.

</comment></comment></comment><comment><USER9> Now we just need a law to require use of the Evil bit in packets. I'm sure it will be as equally effective as the Do Not Track header.

[https://tools.ietf.org/html/rfc3514](https://tools.ietf.org/html/rfc3514)

</comment><comment><USER10> Does this apply even if you do not have a physical presence in California?

<comment><USER11> It applies, but California has effectively zero enforcement capability if you're operating out of say, Rhode Island.

The only outside scenario is if you get really large, and become a juicy target for the state to go after (and or eg you're large and doing something particularly aggressive in violation). The state simply could never afford the massive enforcement costs to go after every web site owner on earth external to California, so they'll obviously only target the big prizes.

</comment></comment><comment><USER12> Anyone has as an example of text that should be added?

<comment><AUTHOR> I've suggested in the post that something along the lines "we do not react to Do Not Track signals" may be a start. It's hard to tell what will be a standard down the road. If you do honor those signals though, a more thorough description will be in order.

Also note that (6) sets out slightly stricter standards regarding disclosure:

(6) Disclose whether other parties may collect personally identifiable information about an individual consumer's online activities over time and across different Web sites when a consumer uses the operator's Web site or service.

</comment></comment><comment><USER13> Wow I didn't know the law even talks about Do-Not-Track. It's a distraction posing as a solution. The time spent talking about Do-Not-Track could be spent on useful things such as contributing to torbrowser.

<comment><AUTHOR> Hm I think most would agree with a statement like this. On the other hand I think it's important for privacy laws to be in place. We all know how regulations are lagging years behind, so theoretically, this is just the beginning.

In the meantime it's important to comply with it with the simplest means possible imo. That's what we're trying to help with.

<comment><USER2> It's even more important to _not_ introduce privacy laws that are misleading and give a false sense of security, thus averting public from the core problem.

If you can be tracked you will be tracked, eventually but almost inevitably. The law could be used to provide some remedy for damages caused by tracking, but it should be introduced only after core problem with tracking (browsers willingly tag users for indefinite time with invisible tokens, in an quite stealthy manner) is solved.

<comment><AUTHOR> Hard to argue with that @drdaeman. Let's say in an ideal world I'd agree with every last thing you said. Again, it sure isn't perfect, it may be a start. Worse than no developments at all? We're doing our job at iubenda to help developers/website operators to keep up with the developments that are out there right now.</comment></comment></comment></comment>


Become More Efficient Programming by Searching Code Faster – Sublime Text Plugin - <AUTHOR> http://www.instagoogling.com/?hn <comment><AUTHOR> Hi; I'm the creator of this, feedback welcome.</comment>


CSS mix-blend-mode is bad for your browsing history - <AUTHOR> https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html <comment><USER2> Clever!

Here's one way I can think of to fix it without just taking out the feature or trying to hide its results: redefine "visited" from being "visited ever, from anywhere" to "visited from here". For instance, if I visited a wikipedia article on my own, and it appeared on hacker news, it wouldn't appear as "visited". However, if I clicked on it from hacker news, next time I load hacker news the browser would mark it as visited. I think that would keep all the useful properties of visited, without leaking information.

<comment><USER3> I like that!

My own suggestion would be to make :visited something that renders at the browser-chrome level (like OS tooltips or IME controls), rather than the renderer level (like on-page find result highlights or selection-caret link outlines.) Don't hand the state to the renderer process in the first place; just stuff it in the renderer-inaccessible part of the DOM (like XHR response cookies) and then have the browser indicate where on the rendering surface the visited—or maybe unvisited!—links are, in some floating-control fashion (perhaps like Firefox's find-in-page scroll-bar notches.)

<comment><USER4> Where would chrome like that appear in touch UI? Typically tooltips show on hover, but touch UI has no hover effect.

<comment><USER5> Doesn't need to be a hover element. It cam be an underline or a translucent square.

</comment></comment></comment></comment><comment><USER6> If you're following along in the code, four classes are defined, l_and, l_and:visited, l_and_not, l_and_not:visited.

l_and:visited and l_and_not are set to background color white, the others black.

512 link 'stacks' are created, each one in a td tag, each one for each possible setting of the 9 sites he checks.

Each of the classes get mix-blend-mode: multiply turned on.

He then looks for a final image with color white -- that's the bitset of your visited sites, since the multiplies will all give white as the output.

</comment><comment><USER7> I think the best solution would be if visited only applied to the local domain.

Like all the other cross domain policy stuff.

</comment><comment><USER8> This article would more accurately be named the CSS :visited psuedo-class is bad for your browser history, not blaming it on the mix-blend-mode property.

The same idea has been done before, except more cleverly with the color property and captchas:

[https://frantzmiccoli.github.io/visited-captcha- history/](https://frantzmiccoli.github.io/visited-captcha-history/)

<comment><USER9> Did you read the article? It explains how browsers mitigated the :visited pseudo-class issue, then how he bypassed that mitigation using mix-blend-mode. As presented, mix-blend-mode absolutely is to blame for being able to exploit it.

He also explains how this is different than the captcha POF that you linked because the captcha requires user interaction for _each_ URL tested (something that wasn't necessary before the browsers mitigated against it). He explains how to reduce this to a _single_ user interaction, by exploiting mix-blend- mode.

Yes, :visited is a key part of the exploit, but to say it's just that isn't accurate.

<comment><USER10> I think grandparent's point is that `:visited` is actually the source of the problem, and that the "fixes" that browsers applied were leaky. Surely this will continue happening with future additions to CSS.

It seems like a perfect example of leaky abstractions.

<comment><USER11> I think the title is very good because I am aware of problems and mitigations with :visited, so if the title just talked about :visited, I would have thought to myself, "yup, good thing they fixed that long ago in all browsers", whereas with the present title, I actually learned about these new discoveries.

</comment></comment></comment></comment><comment><USER12> > This problem was eventually addressed by browser vendors by simply improving > the accuracy of color quantization when overlaying HTML element

What does this mean?

<comment><USER13> > What does this mean?

It means the problem was solved accidentally.

Luckily enough, all problems will be solved for good by rewriting the browser in Rust, according to my reliable 10x engineer sources.

<comment><USER12> Thanks but that doesn't answer my question at all. I want to know what "improving the accuracy of color quantization when overlaying HTML element" means exactly.

</comment></comment></comment><comment><USER14> Tor Browser doesn't seem to add[1] any defenses against history disclosure attacks.

1\. [https://www.torproject.org/projects/torbrowser/design/](https://www.torproject.org/projects/torbrowser/design/)

<comment><USER15> Any Tor Browser user would be clearing their history constantly with the "New Identity" feature.

</comment></comment><comment><USER16> This is very bad. If I open a website and it knows which of 100 other specifically selected sites I visited, I'd be instantly "profiled" for advertising. Is it possible to block visited link leaks? I'd be willing to give up visited highlighting altogether.

<comment><USER17> In about:config, set this option to false

        layout.css.visited_links_enabled

(if missing, create it as a boolean)

I disabled :visited coloring a long time ago and it hasn't caused any significant problems. It just took a few weeks to get used to the changed link colors.

</comment></comment><comment><USER18> You can also get browser history by misusing CSP violation reports.

<comment><USER19> It has since been fixed since Chrome 48, it seems. Not sure about other browsers. The attack is pretty interesting btw: pinning CSP to http-only, which means that the block can be timed to reveal whether the URL was in history.

the fix was just dis-allowing CSP to restrict to http.

</comment></comment><comment><USER20> Does this require a click from the user? Couldn't you set a background image to make a GET request to the server with the results?

<comment><USER21> It would make it anyway because it does not know that it is not shown.

</comment></comment><comment><USER22> What browsing history? For me, it goes when Firefox closes :)

<comment><USER23> You are a strange man. You don't want browsing history and more important: You close your browser.

<comment><USER22> Not only that, I use Linux with LUKS, and shutdown whenever I'm not using the box :)

</comment></comment></comment><comment><USER24> This is why I don't run JavaScript unless I absolutely must. Unfortunately, a lot of sites leave no option; I find myself choosing to miss out on the content rather than risk the exposure and bad usability.

Side note: Michał is truly prolific, I get the feeling that his dream is to have a full system secure against common attackers, which consumers might actually want to use. He seems to attack every piece of system software in every way from design flaws to implementation bugs.

<comment><USER25> This attack purely relies on CSS. There's no JS involved. (Okay, there is in the PoC, but only to provide the alert listing what sites you've visited; the data leakage can be exploited with no JS involved.)

<comment><USER26> How could you take advantage of the leak without JavaScript?

<comment><USER27> If you turn JS off, you'll still see a mole in the position which signifies your visited subset of tested-for addresses. If you inspect the code, each position has multiple anchor elements, the last of which has an onclick right now. All you'd have to do is add a href to it.

<comment><USER28> How do you send this information back to the browser then? You can't embed it into forms nor send requests to the server. While this information is always there (unless you disable CSS), there is no way to extract it (unless you use JavaScript).

This is why OPs point is still true. Without JavaScript, this information is worthless.

<comment><USER29> The point is that you can use the technique on a legitimate link on the page, e.g. a log-in button. The browser will then make a request anyway, through which you can pass the information back to the server. That is what paxcoder means by saying using a href instead of an onClick. No JavaScript is needed for this.</comment></comment></comment></comment></comment></comment>