IntelliJ IDEA 11 is Out - <AUTHOR> http://blogs.jetbrains.com/idea/2011/12/intellij-idea-11-is-out-get-ready-for-a-productivity-takeoff/ <comment><USER2> I may have one of the single dumbest reasons every to not be able to use IntelliJ as my primary dev environment: their comment/Javadoc formatter isn't as robust as Eclipse's.

I am very verbose commenter for both other people coming behind me (in closed or open source software[1]) as well as myself a year down the road going back through thick code and needing to get back up to speed on it.

Because of this I frequently use HTML formatting in my Javadoc (lists, code snippets, etc.) and find Eclipse's Javadoc formatter more or less perfect.

It breaks lines exactly like I want it to, leaves blank lines entact where I want it to, etc.

I've attempted to file bugs for IntelliJ over the years to refine their Javadoc formatter and they have been fixed, but it still misses the boat on complex single, multi-line or Javadoc comments that requires hand-editing.

I know it's silly, I just can't get over that.

I also find the module/web/deployment/artifact model untenable; but even that I could get around if I had an effective formatter. (FWIW the Eclipse/WTP model is just as stupid when it comes to J2EE project modeling, so no one wins that battle)

[1] [http://www.thebuzzmedia.com/downloads/software/imgscalr/java...](http://www.thebuzzmedia.com/downloads/software/imgscalr/javadoc/org/imgscalr/Scalr.html)

<comment><USER3> If you can't get IntelliJ IDEA's JavaDoc formatter to do what you want there exists a plugin which lets you use Eclipse for formatting call Eclipse Code Formatter: [http://plugins.intellij.net/plugin/?idea&id=6546](http://plugins.intellij.net/plugin/?idea&id=6546) I have never used it, so I cannot comment on its quality, but it might be worth a try.

However submitting bugs and feature requests with examples would be better. Many reports are fixed quite quickly. I did not manage to find the bugs you filed though: <http://youtrack.jetbrains.net/issues?q=%23rkalla>

<comment><USER2> Bas thank you for the link; I gave that plugin a try before going back to Eclipse. Unfortunately the workflow of actually using it is terrible for someone that formats frequently (like I do).

I can't find older bugs, but the most recent one was this one: [http://youtrack.jetbrains.net/issue/IDEA-28895?query=voted+b...](http://youtrack.jetbrains.net/issue/IDEA-28895?query=voted+by%3A+rkalla)

I don't know what happened between the report and the fix in 10.x, but I didn't notice changed behavior. The formatter still didn't wrap correctly for me and indent.

For example, take this:

      /* This is a really long line */

and turn it into:

      /*
       * This is a really
       * long line.
       */

IIRC what it did was break the line but not prefix it with star, or it prefixed it but put no space between star and the chars... something like that.

It also didn't handle longer // comments well from what I remember and most importantly would mangle the HTML embedded in my Javadoc comments.

These are little touches that Eclipse takes care to handle... like ul-li lists inside of Javadoc that it will leave as a list and not try and compact down into a run on sentence.

Or things like p-tags formatted nicely as paragraphs.

I literally just want the _default_ formatter from Eclipse in IJ and I'd be a happy camper.

I am surprised more people don't notice these discrepancies, but I don't want to be the only one pestering the IJ team for these fixes. They have plenty of other things to work on.

As I said I like to write a lot of comments; so I notice this more than most. I don't think I represent the norm here.

</comment></comment></comment><comment><USER4> I think without question it's the best Java IDE out there. I try to avoid writing code in Java like the plague but if I really have to, I use IntelliJ IDEA.

<comment><USER5> <http://www.quickmeme.com/meme/35fnoa/>

<comment><USER6> I don't always reuse dead memes, but when I do, I stay on Reddit.

</comment></comment></comment><comment><USER7> I have just given this version a ride on a personal Android project. The new layout preview for Android interfaces works fine in the Community Edition (the free, open-source one).

So really - IntelliJ IDEA Community Edition is right now the best IDE for Android development and it's free too. Forget about Eclipse.

<comment><USER8> I also tried this new IntelliJ release for a test Android project and I couldn't deal with the fact that I had to fight the logcat window scrolling (every time a new message appeared the logcat window jumped to the bottom even if I was actively scrolling back to look at some previous message).

Do you know if there is an option to turn this behavior off? This seems like a small thing but it is a complete dealbreaker for me.

</comment></comment><comment><AUTHOR> The key new features introduced in IntelliJ IDEA 11 include:

* Support for web development with the Play framework.

* Groovy 2.0 support with new intention actions and refactorings.

* Gradle integration.

* CoffeeScript editor with code assistance, inspections and formatting options.

* Grails 2.0 support with all its features, including also Grails web-flow and Spock framework.

And most importantly,

* The updated IntelliJ IDEA Community Edition gets important improvements for Android development, including live preview of Android UI layouts and compatibility with the latest Android 4.0 SDK (Ice Cream Sandwich).

<comment><USER9> Also: it is very col to be able to grab the source code for the community edition, and build the IDE yourself. That said, I buy the Ultimate edition because I live in IntelliJ (even to the point of doing about half of my CLojure dev in IntelliJ - don't laugh, it is pretty nice.)

</comment></comment><comment><USER10> Intellij falls squarely into that category of software that I'm always happy to pony up money for, year after year. The product is excellent, and support is just incredible.

A few times a year I'll run into an issue and fire off a support request. "Serge" usually responds within minutes, either with helpful guidance or an offer to create a bug report (that actually gets fixed). This same guy has been answering my support requests for something like 4 years now... incredible.

<comment><USER11> I also have had exactly the same experience.

Now if only the vim plugin could be made a little less buggy (not jetbrains fault)

</comment></comment><comment><USER12> I like the editor itself, code completion and scala support in IDEA, but that's about it. The UX is almost as bad as Eclipse's. Once you stop for a moment to look at it, it's almost ridiculously bad.

Give it a go: in your project right-click "External libraries". What would you expect? Something like "add new one", "manage", "copy from..."? No such luck - this is what you get instead.

\- new (always inactive)

\- cut, copy (always inactive)

\- find / replace in path / analyze / reformat / optimize imports / compile (for external libraries? seriously?)

\- refactor, add to favourites (expands but all options inactive)

\- local history (never active, not what you'd imagine)

\- various file operations (for "collections" of external libraries?)

\- update copyright (active, but seems to be a noop)

Ah - you actually wanted to manage the external libraries? Try right-clicking the module, "open module settings" (how about "settings"?), "libraries" / "global libraries" (there's no mention of "external libraries"). And that's just one trivial issue that every single user of idea will see fairly frequently. IDEA is full of them.

</comment><comment><USER2> FWIW: IntelliJ is an excellent IDE, but all this anti-every-other-IDE commentary is silly...

Eclipse, NetBeans and IntelliJ are all fantastic; seriously, all of them.

They all have a slightly different fit and feel to them. Just figure out which one meshes with your mental model and workflow best and have at it.

The idea that one is categorically better than another is just not accurate. They are certainly better than each other at _different_ things, but not better or worse at EVERYTHING than one another.

<comment><USER13> The problem with Eclipse is that the UI and UX are terrible, so it really doesn't matter what else it is good at.

Unless someone actually likes Eclipse or is already very familiar with it I cannot recommend it over IntelliJ.

<comment><USER2> No argument on the Eclipse UX being bad; that being said

> "so it doesn't really matter what else it is good at"...

I think it is safe to say UX is _really_ important to you ;)

<comment><USER13> It is. There is no room in my toolbox for sluggish and cumbersome tools.

</comment></comment></comment></comment><comment><USER14> I have been using Eclipse since at least 8 years. This year an employer insisted that I use Intellij. It took me around three weeks to get used to it. I never want to switch back to Eclipse. It just runs so much smoother

</comment><comment><USER15> I started using IDEA with this latest version, and it's the version that has convinced me to come over from Eclipse.

I don't particularly like Eclipse (I don't hate it either, but it's not exactly winning best coding environment for me), but in the past IDEA has just felt "clunky" to me. The text always looked off, the environment itself seemed difficult to use, and the whole experience just seemed jerky and slow. Then I tried out 11 on my MacBook, and man, they've really taken the time to clean things up. I haven't tried it on Windows yet, but it really fits in well with Lion. It's also WAY more performant than past versions, at least from my subjective experience.

Combined with the fact that it works really well with Maven out of the box (and that it's been one thing after another with m2eclipse), this'll be the first time I purchase an IDEA license.

</comment><comment><USER16> I really urge anyone who's in a situation where they have to write Java to use IntelliJ. Java is the language of choice for much of my CompSci course, and it is the only tool that makes that bearable.

<comment><USER17> yeah, for the extremely heavyweight enterprise stuff in a comsci course at a small uni, one definitely needs a commercial IDE. I cannot imagine what would it have been like if I had to use a mere text editor for that back in the days...

<comment><USER16> A small uni? The University of Southampton is a leading research university here in the UK, it is a member of the Russell Group and the ECS school is incredibly highly thought of. I'd thank you not to refer to it as small.

Have you tried working in Java? I happily use Emacs for every other language I use, but even doing simple XML processing becomes unmanageable without intelligent auto-complete.

Further when you're marked on code style in an OO context the ability to refactor code smoothly is a huge bonus, that you just don't get from a mere text editor.

</comment></comment></comment><comment><USER18> Is Tomcat integration still left out of the community edition? I paid for a full IDEA 10 license, basically for this feature. I don't mind paying for software, but I think leaving Tomcat integration out of the community edition makes it hard to compete with Netbeans and Eclipse.

On the other hand, the Maven integration in either edition of IDEA is much nicer than either Eclipse or Netbeans.

<comment><USER19> Yes, here's the comparison: [http://www.jetbrains.com/idea/features/editions_comparison_m...](http://www.jetbrains.com/idea/features/editions_comparison_matrix.html)

And the better integration with Maven was our primary reason for moving to IntelliJ.

</comment></comment><comment><USER20> I have been working with the RC/Beta-version for some time now because I need the Grails 2 integration for a new project - and it works really well, it's a joy to work with this IDE. Also, bugs in the development versions were fixed quite fast (in my experience).

</comment><comment><USER21> IntelliJ is very impressive. Only started using it when I noticed how good its Scala plugin is. Feels like the level of polish I'm used to with Java editors. Code completion, refactoring etc.

</comment><comment><USER22> Hopefully this fixes the random "I'm tired, so I'm going to stop doing code analysis and inspections until you restart me" bug that is the bane of my existence in 10.5.

<comment><USER10> If you haven't already reported this as a bug I'd encourage you to do so. The Intellij folks are incredibly responsive to bug and problem reports.

<comment><USER23> I'd like to second that comment. Unlike most companies, e.g. Apple, JetBrains is really responsive to bug reports.

They have fixed everything I have ever filed a bug about. (I use RubyMine for some Ruby projects, because even though the UI is kinda insane, coding without text completion is IMO more insane.)

On a related note, their bug tracker, YouTrack, is also probably the best of the dozen or so major ones I've used. Really fast, great keyboard support, and free for small teams.

<comment><USER23> Pedantic note: I wrote 'text completion', but I meant 'reasonably intelligent text completion based on either a compiler's knowledge about your source code, or good heuristically derived inferences about your source code for dynamic programming languages where that is the best approach'.

Back in 2001 or so, IntelliJ was _fucking_ _mind-blowing_ with its Java completion and high-level insight into your code. Now, Microsoft's Visual Studio or Apple's Xcode can hang, and the other Java IDEs are at least in the same league.

But very few IDEs can do a decent job of completing code for dynamic languages (especially those unlike Objective-C, with its opt-in (but fairly ubiquitous) type declarations). RubyMine (which is a variant of IDEA) does this much better than anything else I've seen.

Most IDEs and editors tend to offer to complete e.g. every method defined by every class, or they fail to offer to complete the thing that you mean. That's pretty much garbage.

</comment></comment></comment></comment><comment><USER24> Here come the Java trolls. You can write "cool" code with it too (Scala). Sheesh!

<comment><USER21> As a long time Java programmer I've found that Scala had made programming fun again. As much a I like Java I find coding in Scala more enjoyable. I am constantly surprised by the number of colleagues who have taken an intense interest in this language.</comment></comment>


Effect-Driven QuickChecking of Compilers [pdf] - <AUTHOR> http://janmidtgaard.dk/papers/Midtgaard-al%3AICFP17-full.pdf <comment><AUTHOR> Seems like the server couldn't handle the HN traffic.

The actual implementation is here:

[https://github.com/jmid/efftester](https://github.com/jmid/efftester)

</comment><comment><USER2> Thanks for the overwhelming interest! I've put up another copy of the paper here: [http://people.compute.dtu.dk/janmi/Midtgaard- al:ICFP17-full....](http://people.compute.dtu.dk/janmi/Midtgaard- al:ICFP17-full.pdf)

</comment><comment><USER3> It redirects to

>Ups, du overskred CPU forbrug grænsen

It seems link does have problems. Anybody else does experience same thing?

<comment><USER4> Yes, and I really want to read the actual pdf :(

<comment><USER5> Google cache, if you zoom in its readable: [http://webcache.googleusercontent.com/search?q=cache:1BoR02j...](http://webcache.googleusercontent.com/search?q=cache:1BoR02jYqRUJ:janmidtgaard.dk/papers/Midtgaard- al%253AICFP17-full.pdf+&cd=1&hl=en&ct=clnk&gl=uk)</comment></comment></comment>


Show HN: Stupid, but funny, video app for Android - <AUTHOR> http://yaycam.com/

<comment><AUTHOR> Author here.

Just a silly app, but video in Android is not exactly an easy endeavour!

This is part of a suite of apps in the space of video effects that we hope to be releasing, and that hopefully gets me closer to transitioning from nights- and-weekends to full-time. Too optimistic, perhaps?</comment>


Ask HN: How do you help your kids with schoolwork? - <AUTHOR> How do you help your kids with their schooling (beyond homework)?
I'm interested in things that you feel advance their understanding of math, sciences etc.
My oldest son is 10 and in Grade 5, and I feel like the classroom curriculum is targeted at the slowest student, and the average and above-average students aren't challenged enough. <comment><USER2> My son, 6, just started primary school at the beginning of September. The only thing I am trying to do right now is foster an enjoyment of learning. I am doing this by showing him how to take what he learns in school that day and apply it to things that he enjoys.

For example, he is learning about spelling and reading right now. I asked him what things he would like to watch on youtube, (robots) and then we spent time learning how to spell that word together so he could find a cool video on robots.

For art (which he doesn't like very much) I've been getting him to draw out designs for things he wants and then I build them out of wood for him. So while he is not painting beautiful rainbows or anything (yet) he has designed some cool amphibious vehicles and Mars rovers which I went on to make for him.

It seems to be working so far - but hey, I am only a month in. The key seems to be in getting _him_ to figure out what he wants to use the information for.</comment>


White Collars turn Blue - by Paul Krugman from 1996 - <AUTHOR> http://www.pkarchive.org/theory/backwrd2.html

<comment><USER2> I submitted this to newmogul.com.

<comment><USER3> He's right you know. Especially if you consider how much easier it is becoming to accomplish the non-trivial in the latest programming languages like ruby, eventually, programming itself won't be a career anymore, it'll be an added- value skillset, and eventually, a common skill.

That's why I'm a reverse engineer and systems programmer. :D

</advertisement>

<comment><USER4> Certainly it is faster to develop a program in Ruby than the equivalent program in 86 asm. On the other hand it is still the same mind that is needed to produce the results (at least for anything that is not trivial).

<comment><USER3> Have you _met_ a professional VB (only) developer?</comment></comment></comment></comment>


Tracing a Meme from the Internet's Fringe to a Republican Slogan - <AUTHOR> https://www.nytimes.com/interactive/2018/11/04/technology/jobs-not-mobs.html <comment><USER2> I'm not sure why the NYT is trying to make this sound somehow nefarious? All political movements have slogans and talking points.

<comment><USER3> Sure, but that's not the point. What the piece actually presents is a (quite interesting) illustration of how the far-right online community kicked off a specific talking point and spread it widely within just a few days.

<comment><USER4> >online community kicked off a specific talking point and spread it widely within just a few days.

It's just a meme. That's how it works.

>far-right

Dilbert guy? I do not agree.

</comment></comment></comment><comment><USER5> Awesome to see a politician get so in touch with his constituents... in this meme age.

</comment><comment><USER6> A very well done data centric piece. The visualization was very effective.</comment>


Nix × IPFS – Milestone 1 - <AUTHOR> https://blog.ipfs.io/2020-09-08-nix-ipfs-milestone-1/ <comment><AUTHOR> And for anyone that would rather to cut to the chase:

[https://github.com/obsidiansystems/ipfs-nix- guide/blob/maste...](https://github.com/obsidiansystems/ipfs-nix- guide/blob/master/tutorial.md)

[https://github.com/obsidiansystems/ipfs-nix- guide/blob/maste...](https://github.com/obsidiansystems/ipfs-nix- guide/blob/master/branches.md)</comment>


Should automobile software be open-sourced? - <AUTHOR> http://www.collisiondetection.net/mt/archives/2010/02/should_automobi.php <comment><USER2> It should absolutely not be open-sourced. I know a few people in the car industry, and there is no doubt in my mind that in the long-term open-sourcing car software will make car-reliability worse.

1.Writing software for a car extensive domain knowledge about how a car works. Acquiring that knowledge is a lot more expensive than learning about computers.

2\. It means writing better software helps your competitors. Cars are a red market, to get any market share you take it from someone else. Toyota is currently the market leader because they spend way more on engineering, and they work harder than the big three. I've talked to mech. engineers at Ford and Toyota, and there is no doubt in my mind that I'm safer in a defective Prius than I am in a defect-free Ford Taurus. Toyota does a better job than the big three at every step in the design and manufacture of a car.</comment>


Microsoft teases its Edge browser for macOS - <AUTHOR> https://www.theverge.com/2019/5/6/18528881/microsoft-edge-macos-mac-browser-teaser-build-2019 <comment><USER2> Still very curious what they're going to be using for the HTML5 EME CDM here.

Will Microsoft port PlayReady to MacOS?</comment>


Dude Sneaks into Game Studio… Eats Their Food… Discovers Unannounced Game - <AUTHOR> http://www.gamebreaker.tv/news-main/pc-2/dude-sneaks-into-game-studio-discovers-unannounced-game/

<comment><USER2> The studio's response (on the linked Kotaku article) is incredibly classy and well written. Completely unoffensive while strictly discouraging this kind of behavior. Kudos.

</comment><comment><USER3> Textbook social engineering. Look like you belong, and everyone will assume that you do. Easier to just go along your routine than ask about the "new guy".

</comment><comment><USER4> Slightly off topic: but GTA5 has a mission where you had to do essentially that.

</comment><comment><USER5> Free advertising for the game studio. Good thing they let him waltz right in.

</comment><comment><USER6> I want to know if HL3 is coming.

</comment><comment><USER7> This is why you buy an anti-tailgating system for your unattended but secured doors.

</comment><comment><USER8> A tail-gator</comment>


Kuhcoon (YC W15) Automates Facebook Ad Campaigns for SMB's - <AUTHOR> http://techcrunch.com/2015/02/19/yc-backed-kuhcoon-promises-to-automate-facebook-ad-campaigns-for-small-businesses/

<comment><AUTHOR> Hey all founder here,

Advertising on the Internet is a complex, fragmented nightmare. Different paid media channels require different strategies, tools, expectations, and most of all: time.

Our goal at Kuhcoon is to completely automate the creation, management, monitoring, and optimization of every paid media campaign on the Internet. For now we do this with Facebook Ads, but soon our advertisers will be able to automate their entire paid media strategy across every paid channel on the web.

We want to help advertisers of every size spend a few minutes a week telling us how much they want to spend, what their goals and creatives are, and who they plan to target. Our Intelligence System will then automatically segment out their audience during creation, A/B test multiple creatives and messages, pause poor performing ads, create and rotate new ad variants between target segments, and drive the budget into top performing campaigns.

The beauty of this automation is that it requires no extra work from the advertiser. There are no complex rule-based systems. There are no unnecessary bell and whistle features. There is no need to anxiously check campaigns every few hours.

Give us these three simple data points: budget, creative/conversion goal, and target demographic. Kuhcoon will then automatically drive your budget into the top performing ads with the lowest cost per conversion and the highest volume.

Happy to answer any questions!

<comment><USER2> It sounds like you have built a meta ad manager that taps into the API's for these ad platforms.

How does your pricing work given that you are targeting advertisers who spend between 20K - 1M?

Is it a percentage of ad spend or a fixed monthly fee?</comment></comment>


Your Strategy Is Showing #1: The Millennial Road Trip - <AUTHOR> https://medium.com/@JessG/your-strategy-is-showing-1-the-millennial-road-trip-b03891e37eec <comment><USER2> > Here is a shot of them taking a selfie, to capture the best night of their > lives. Selfies are relevant.

*Brilliant!</comment>


New Experimental Version of HN Search - <AUTHOR> https://blog.algolia.com/try-new-experimental-version-hn-search/ <comment><USER2> This is only 50% tongue in cheek, but if there were commenting and a normally ranked front page on this, I'd probably use it instead of HN itself ;-) It looks really good. (I know about all the other HN front ends but none have stuck with me.)

</comment><comment><USER3> This post was from January, but strangely enough, it seems it never got submitted here. I've been using the Algolia HN Search "experimental" interface for months and it works really well. You can turn on the experimental interface through the "settings" link [1] on the bottom of the search page.

Some people love to see "thumbnail" images of the sites in the search results, and they most likely have all the required bandwidth/speed/latency needed to view the images without discomfort. For people on slow, high-latency Internet connections, the thumbnail image loading is slow and annoying. The good news is, after you select "experimental" mode in the settings, you can then turn off thumbnail image loading.

[1] [https://hn.algolia.com/settings](https://hn.algolia.com/settings)

</comment><comment><USER4> I agree with the other poster who didn't like the font. It's much too light. This is fixable in Firefox, but I don't see a way to do it in Safari.

It would be nice to have something akin to browsing at +5 on slashdot. Muggles can't see the karma each comment has, but maybe HN can give Algolia that information so that it can present just the top comments. For example, there have been recent threads with 600 comments. It sure would be nice to read maybe the top 10 or 20. Or maybe the top 5% of comments, minimum of 10 comments, maximum of 25 comments? That's the general idea.

As for someone else's comment about non-JS fallback, that isn't important to me. Normally I read HN w/o JS, but that's because there's no need to whitelist the site except for optional stuff like search. I would have no concerns with running HN with JS on.

</comment><comment><USER5> Hi guys, here one of responsables for this interface, we didn't change it since January but seeing such threads make us want to add some improvements on the UI. Looks like working a bit more on the font readability could be a good start as it's something that came up several times.

FYI Here is our blogpost about this project[1].

@meeper what do you have in mind with 'recommandation system"?

[1] [https://blog.algolia.com/try-new-experimental-version-hn- sea...](https://blog.algolia.com/try-new-experimental-version-hn-search/)

</comment><comment><USER6> Please roll back to the font family, size and color of the existing version. Small, thin, light grey on a white background is not even a little bit readable. It's roughly equivalent to the "dead", greyed out comments here on HN proper in terms of pain.

Given that you probably intend for people to want to read the text you present, I bet that's not the experience you're going for.

</comment><comment><USER7> Interestingly enough, this was built with Angular 1.

Also, after doing a couple of searches, it is clear that this is a treasure trove of interesting articles that never made it to the front-page of HN. If I was simply "surfing" for interesting things related to programming/startups/development/etc., this may well be more worthwhile than Google.

</comment><comment><USER8> Re-posting my comment on the original blog: "Hi guys! I am just in love with the new UI. HN is my daily dose for the awesomeness and the new search is the icing on top of the cake! Cheers!"

And seriously this is there since Jan and I stumbled upon this today!

</comment><comment><AUTHOR> TL;DR. Try it here: [https://hn.algolia.com/?experimental=true](https://hn.algolia.com/?experimental=true)

</comment><comment><USER9> If you guys need a recommendation system, let me know...

</comment><comment><USER10> A non-JS fallback would be nice.</comment>


California's Lying Fields of Gold (2018) - <AUTHOR> https://medium.com/asparagus-magazine/californias-lying-fields-of-gold-f8c6f0a348d5 <comment><USER2> So strange, I grew up in CA and always viewed these "golden hills" as pretty hideous expanses of death (and a fire risk). The very brief period you could drive down 101 around San Jose, or 41/46 near San Luis Obispo, and see resplendent green hills (still too few wildflowers though), were wonderful by contrast.

Microsoft didn't use the dead brown fuel that covers much of California when they were looking for Bliss [https://en.wikipedia.org/wiki/Bliss_(image)](https://en.wikipedia.org/wiki/Bliss_\(image\))

<comment><USER3> Why death? And what do you mean by 'dead brown fuel'?

<comment><USER2> Because the grass is dead, and because it could fuel a fire due to its low moisture content.

<comment><USER3> Oh. I assumed oats and other grains were naturally yellow-colored plants, since that's how they're always depicted, but from checking Google I see that's not true.

Are the 'golden fields' actually green for part of the year? Is it seasonal? They can't be perpetually dead, but I'm failing to find any further information.

<comment><USER2> Yes, for a brief period in spring, especially after a good rain, the hills are coated in stunning fields of vivid green. You'd think you were in Ireland.

Oats are green, but dry out as yellow straw (the classic yellow thatch roof look is dried oaten straw, for instance)

</comment></comment></comment></comment></comment><comment><USER4> When I learned about the invasive grass, I felt a real loss for what California must have been. Imagine a few hundred years ago. As a native American, suppose you take a hike up what will become known as mission peak. Walking through the green and blue grasses, stands of oaks and buckeye to get to the top. From there you can clearly see the hills we know as San Francisco, the islands in the bay. Looking down below you is a verdant valley full of life, your home.

</comment><comment><USER5> Unlike the author I feel that the native grasses actually look really pretty and fit so much better with the landscape.

</comment><comment><USER6> I always assumed these hills used to have denser forests of oaks that have since been thinned out for cattle grazing, why you have cities named like "Oak Land".

The central valley used to be covered in oaks, especially near rivers, but they're almost all gone.

<comment><USER2> Somehow I never considered the etymology of Oakland. Funny how it's right in front of you your whole life...

Similarly I was in Spanish class one day and thought "oh, ventana sounds like 'viento'" when I realized "WAIT A MINUTE Window is a wind hole!" \- never would have thought of that in English I suspect.</comment></comment>


Is It Snowing Yet? - <AUTHOR> http://isitsnowingyet.org/

<comment><USER2> Wrote a website similar to that: [http://canileave.com](http://canileave.com)</comment>


Let's be real about dependencies - <AUTHOR> https://wiki.alopex.li/LetsBeRealAboutDependencies <comment><USER2> Really interesting article, but it does treat Go and Rust dependency cultures as equivalent. Whereas there is a _strong_ preference in Go culture to use as few dependencies as possible, and preferably only use the standard library. A Go project using "2-300 dependencies" (cited in TFA as normal for a Rust project) is incredibly unusual, and would be a cause for concern.

There are regular posts in r/golang from new Go devs asking what frameworks to use, where to find the list of packages needed to do anything, etc. The answers are always "just use the standard library".

This is often portrayed as a result of Go's historically relatively poor package management. But I'd argue it's the other way around. Go's culture of avoiding dependencies meant that package management wasn't as big a requirement as it is in other languages.

It'll be interesting to see if the average number of dependencies in a Go project increases now that the package management system is more standardised and powerful.

<comment><USER3> The article uses C tools as an example, and which are even more conservative with dependencies than Go.

Note that it's the _transitive_ dependencies add up. Each project, even Rust, or even npm, has only a few direct dependencies on average.

Actual stats for Rust crates:

         0 deps: 23.77% crates
         1 dep:  13.81% crates
         2 deps: 11.70% crates
         3 deps: 10.33% crates
         4 deps: 8.12% crates
         5 deps: 5.75% crates
         6 deps: 4.48% crates
         7 deps: 3.84% crates
         8 deps: 3.85% crates
         9 deps: 2.61% crates
        10 deps: 1.90% crates

<comment><USER2> interesting. I've no experience with Rust, so took his "2-300" at face value.

It'd be interesting to run the same analysis on Go projects and compare.

<comment><AUTHOR> It's not about "face value", it's that you may only have three dependencies, but if one of those three has ten, and two of those ten have five, and so on and so on. The article is talking about the end total, the parent commentor is talking about direct dependencies.

<comment><USER2> Yeah, sorry, I meant that I misinterpreted his "2-300 dependencies per project" to mean the developer themselves had included 2-300 dependencies per project, rather than that was the final result of the entire dependency tree.

Maybe I've seen too many nightmare JS projects where this is literally true ;)</comment></comment></comment></comment></comment>


Breaking Deniability in Signal with SGX [pdf] - <AUTHOR> https://aaltodoc.aalto.fi/bitstream/handle/123456789/33674/master_Vieitez_Parra_Ricardo_2018.pdf <comment><USER2> Deniability is a popular feature to add to cryptographic protocols and it seems in vogue to complicate protocols significantly to get it. But does anyone really care?

I'm struggling to think of a single case, ever, where someone embroiled in a public dispute denied the contents of conversation logs, even in cases where it'd be trivial to do so because the logs were just screenshots of WhatsApp or copy/pasted emails. People _have_ deniable communications already in so many cases and yet nobody cares, nobody actually ever claims "I didn't send that".

To take the Bezos case, he _could_ have just let them leak some dick pics and then said, "not my cock, not my problem". How would anyone have known otherwise?

The only case I can think of where cryptographic proof was used to prevent deniability were some Wikileaks email dumps where there was some very small amount of skepticism that all the emails were real, that maybe some forged emails had been put amongst the real set. The messages were all DKIM signed though, which proved it wasn't true. Which in this case would appear to have been beneficial - the leaks revealed various political shenanigans that were of a public interest nature. But I don't think DKIM ever made it to public consciousness: journalists don't know about or don't care about cryptographic proof.

Now maybe none of that matters, maybe deniability is near-free to implement so why not? But this paper suggests it's more complex than it looks. Any auditable generic computing infrastructure can be used to break deniability. In the unlikely event that disclaiming screenshot-strength evidence becomes a widespread tactic, anyone who wants to defeat it can just use a TPM and trusted boot. Getting deniability back may either seriously complicate already complex implementations (which is the enemy of correctness), or just fail entirely.

Moreover it seems to me that most people, given the chance, would rather than _undeniability_ , as that would be useful in all kinds of regular situations like contract disputes. It'd make casual verbal-but-over-internet-chat type contracts meaningfully useful, along with other interesting capabilities.

Perhaps in the end this protocol feature is a bad tradeoff.

<comment><USER3> Just because you can't understand the value of deniability does not mean it has none. As for trade-offs, there don't seem to be any according to this paper.

From TFA:

"We then present an practical attack that can be used to compromise deniability in the Signal messaging protocol, and introduce some possible countermeasures that restore deniability

[...]

Deploying the attack presented in this thesis requires not only having access to a TEE but also compromising one of the parties to a communication."

Deniability is a powerful tool which one would rather have and not need than need and not have. Let research run its course for the betterment of protections available to us all.

<comment><USER2> _Deploying the attack presented in this thesis requires not only having access to a TEE but also compromising one of the parties to a communication_

Essentially everyone with a PC has access to TEEs: beyond Intel SGX there's also the traditional static root of trust mechanism, which suffices for this, and also voids the paper's proposed solution; indeed the paper recognises that given a certain kind of TEE there appear to be no solutions.

As for 'compromising one the parties', the point of deniability implemented cryptographically is that your counterparty in the conversation could encrypt messages such that you can't tell who encrypted them, i.e. an encrypted chat log could have been forged. So the adversary is the person you're talking to: they're already 'compromised'.

</comment></comment></comment><comment><USER4> It's very neat and well worked out, but in hindsight it seems kind of obvious. If the "judge" trusts an "uncorruptible" witness then deniability can't hold.

Now if only Intel could actually build a secure TPM! :P

<comment><USER5> And also get rid of the Visa hardware debugging block, apparently.

</comment></comment><comment><USER5> Tl;dr: From skimming the document, you only need to run one side of the conversation in a trusted execution environment to break deniability for both sides of the communication.

Clever!</comment>


Where Tcl and Tk Went Wrong (2010) - <AUTHOR> https://journal.dedasys.com/2010/03/30/where-tcl-and-tk-went-wrong/ <comment><USER2> I spent a lot of time with Tcl, first at company some friends and I started in the late '90s, and then at Arbor Networks, where I dragged it into their service provider product.

In a Lisp, code is trivially parsed because everything is a tree of conses, and the language derives tremendous power from that.

In Tcl, code is trivially parsed because everything is a string, and the language is hamstrung by it; it's a little like trying to code a major project in Bourne shell.

For a time, Tcl had the best C integration story of the scripting languages, with a thoughtfully designed extension interface that was easy to use. But every major scripting language has that now.

Tcl was early to what I guess I'll call mainstream metaprogramming (obviously, Lisp got there first) with "upvar" and "uplevel" and [incr tcl]. But Ruby --- which bears a lot of similarities to Tcl --- did all that stuff much better and more cleanly.

<comment><USER3> > a thoughtfully designed extension interface that was easy to use. _But every > major scripting language has that now._

OP> Easily _embeddable_ /extendable.

Easily embeddable language implementations have regrettably remained more uncommon. Sure, extending has gotten relatively easy, but it's still in that "we own the world - you are welcome to visit, as long as you _fully_ respect our partially-documented memory, stack, io, threading, whimsy, and other disciplines" kind of way. And "feature: we're embeddable! (sort of, if you're careful, sometimes, maybe)" toxic hairballs of surprise are still a thing.

<comment><USER4> Exactly. Tcl competes with Lua, not Python or Ruby. And Tcl and Lua both have their respective advantages and disadvantages.

\- Lua has better support for handling non-trivial data structures, but Tcl interop is a lot less cumbersome, as the host language only needs to know how to pass strings back and forth, basically.

\- Tcl is more suitable for writing DSLs due to its homoiconicity, but Lua's more conventional syntax is more suitable for traditional programming.

\- Tcl's command-oriented syntax makes it fairly easy to write an expressive shell-like interface for your application (debugging, state inspection, expert interface).

I'll note that via JimTcl [1], Tcl also has an additional niche for bootstrapping software as a much saner replacement for /bin/sh programming, such as in autosetup [2].

[1] [http://jim.tcl.tk/index.html/doc/www/www/index.html](http://jim.tcl.tk/index.html/doc/www/www/index.html)

[2] [https://msteveb.github.io/autosetup/](https://msteveb.github.io/autosetup/)

</comment></comment></comment><comment><USER5> I thought the time TCL went wrong was back in 1994, when Sun unilaterally announced that TCL was going to be the official scripting language of World Wide Web browsers, prompting RMS to kick off the TCL War by writing "Why You Should Not Use TCL". [1] And then Sun changed their mind and decided that Java was going to be the official scripting language of World Wide Web browsers. And we all know how that turned out.

[1] [http://vanderburg.org/old_pages/Tcl/war/0000.html](http://vanderburg.org/old_pages/Tcl/war/0000.html)

</comment><comment><USER6> We fixed the syntax problems if you like C better than Tcl.

[http://mcvoy.com/lm/L/L.html](http://mcvoy.com/lm/L/L.html)

Type checked, C like, structs, perlisms like if (buf =~ /re/), compiles to tcl byte codes so that L can call tcl and tcl can call L, open source, liberal license.

<comment><USER7> This seems to have evolved in Little. [http://www.little- lang.org/](http://www.little-lang.org/) Or is it a different language? The original name of Little is L.

<comment><USER6> Same language, we called L because I'm Larry, then decided that was stupid and renamed it little as in little language.

</comment></comment></comment><comment><USER8> As a long-time Tcl/Tk user it seems where some might think Tcl went "wrong" was combining its Lisp-like semantics with C-style syntax. The "hybrid" was confusing to many programmers, especially those coming from C and similar tools.

The article mainly examines the corporate and marketing aspects of Tcl's history, and not so much the technical merits of the language. True enough, Tcl lost out to Java and other languages on that account but as the article acknowledges Tcl still has quite a large community keeping it going.

On the technical side, the commentary about "everything is a string" has been extensive discussed and IMO has been shown to be more than not a red herring. In any case many of the "warts" that were prominent in 2010 have been at least partially addressed. Notably in recent years Tcl as acquired many Scheme-like features, an official OOP facility, and coroutines among other "modern" features.

Tcl remains incredibly flexible and adaptable to diverse problem domains. I wouldn't try to write a hardware driver in Tcl, but for many problems it's the most productive tool in the toolbox.

</comment><comment><USER9> Tcl had been a pretty good way to create things like embedded command shells for C-based programs, and this was great as long as people operated in fairly sequential ways like "command1, command2, command3".

The problems with Tcl start to show up when invariably somebody decides they want something more logically complex than a sequence of commands. _Debugging_ Tcl is extremely difficult, which makes it a huge maintenance liability. For example, a "line number" isn't much help if the "line" refers to 90% of the file and Tcl thinks all of that is essentially one statement (no matter how many braces are in it). As another example, there are _tons_ of places where a variable is referenced both like "$this" _and_ "this"; that is just a whole series of accidents waiting to happen, especially when you consider that many functions depend on argument order and they don't necessarily produce obvious malfunctions when variables are misused.

<comment><USER10> > For example, a "line number" isn't much help if the "line" refers to 90% of > the file and Tcl thinks all of that is essentially one statement

I think this may have improved since you last looked:

      $ cat j
      #!/usr/bin/env tclsh
      puts [ set a [ expr { 9 + [set x]}]]
      $./j

      can't read "x": no such variable
          while executing
      "set x"
          invoked from within
      "expr { 9 + [set x]}"
          invoked from within
      "set a [ expr { 9 + [set x]}]"
          invoked from within
      "puts [ set a [ expr { 9 + [set x]}]]"
          (file "./j" line 3)

> there are tons of places where a variable is referenced both like "$this" > and "this"

$this is essentially [ set this ], returning its value, or deferencing the value, if you will. The entire set of rules that Tcl abides by are contained entirely in a small document (here [0], with commentary). It's really not difficult to figure out.

[0] [http://wiki.tcl.tk/10259](http://wiki.tcl.tk/10259)

<comment><USER9> That trace is not as bad as I remember but if you write that in a nice long multi-line series of if-statements (say) it'll still print out the whole mess and only tell you one useless line number. If there's a "proc" it's a little better but it can only show the bad line number _relative_ to the "proc", requiring you to do some manual work to find the function within the file and then the offending statement line.

Also, I have no problem with the logical "$x" syntax; rather, the fundamental flaw is that the _string_ "x" could be used to change the variable "x" without _any_ clue in the syntax that this may happen (e.g. no "&x" like in C, no "\$x" like in Perl; just "x", or worse "$y" that resolves to "x"). And don't even get me started on multi-level "upvar". This whole thing is a minefield, especially if people use simple variable names that can't be searched in a code base. If you're really unlucky, you accidentally swap the order of parameters and it just so happens that your "$x" value is almost plausible so you never notice the disaster you just created. It's simply a "write once, modify never" coding style: it saves the programmer 10 seconds and creates the most brittle of code. I would never recommend it to anyone.

</comment></comment></comment><comment><USER11> I wrote that... I think it's still pretty valid and encourage people to think about some of the lessons rather than just like or dislike of Tcl.

<comment><USER12> Hi David, Thanks for your article. As you chime here, do you think the dev platform had also an impact on the language visibility (fossil vs github) ?

<comment><USER13> Not David, but I think Tcl popularity was already going down way before GitHub became as popular as now. Around 2005 most projects were on SVN, and Tcl was already more or less "the language that you have to use together with Tk".

<comment><USER14> >Tcl was already more or less "the language that you have to use together with Tk".

And "expect", which is the only reason I've ever touched TCL in my professional career.

</comment></comment></comment></comment><comment><USER15> Very little mention of Eggdrop.

Eggdrop was my first introduction to Tcl/Tk and though the learning curve was harder than Perl, it was fascinating.

There was quite a lot to like about Tcl. Mainly that everything just worked.

Packages were solid, getting stuff off the web was easy.

It's a nice language. Try it.

<comment><USER16> Between BitchX and Eggdrop development, I'd say that TCL was my most-used language circa 1998-1999. Had totally forgotten about it until seeing this post (for better or for worse!)

</comment></comment><comment><USER17> I'm not a programmer by any stretch, but back in the early 2000s I used Tcl/Tk to create my own little scripts and utilities in Slackware, my everyday OS of the time. It's simple to learn and use for the layman, but powerful enough to do real tasks and automate workflows.

I have no real need for it these days, but I'm happy to see it is still in use even if it's not as popular as it once was.

</comment><comment><USER18> I'm having a look at Tcl at work due to legacy code and it's no language that I find easily accessible. Especially when having not that much time and having a large codebase.

The interpretation and the braces in braces parts are annoying. Not very readable.

Modularization is not easy and other files can't be imported as fast as with Python or ES2015.

Resources and tutorials are not readily available, there is no community I ran into to ask stuff compared to the rest of the language world.

Finding a test framework or linting mechanisms is not easy either.

I'm no friend of Tcl at the moment, I'm not sure if that will change.

<comment><USER19> > I'm no friend of Tcl at the moment, I'm not sure if that will change.

Languages don't really seem to "come back" that much. At some point being for too long out of the mainstream weighs against you.

<comment><USER20> > Languages don't really seem to "come back" that much.

Objective-C came back from obscurity with a vengeance.

<comment><USER19> Because Apple poured a 1 billion dollars into it and turned it into basically the main programming language for 2 OSes.

</comment></comment></comment></comment><comment><USER21> A fair amount of where tcl went wrong was the initial string type that couldn't handle binary data. They did fix it, but the inability was a showstopper for early adopters.

For strings, if a null was in the data, it truncated at that point, and there wasn't an alternative type that could handle it.

</comment><comment><USER22> They're not dead yet :-) and a new book on Tcl just came out - [https://news.ycombinator.com/item?id=14730316](https://news.ycombinator.com/item?id=14730316)

</comment><comment><USER23> Poor resource management model is my biggest personal turn-off. The post actually mentions it when it talks about everything-is-a-string - the problem with that approach is that handles for external resources are then also strings, and this in turn kills any form of garbage collection (both tracing and refcounting), because it is possible to construct a string that is a valid handle out of various bits and pieces lying around. Thus, you have to manage all resources manually. For a high-level scripting language, I consider that unacceptable.

<comment><USER24> I don't really have much of a need for garbage collection, but I did investigate strong/weak references (which I would probably prefer over garbage collection). See [http://wiki.tcl.tk/41605](http://wiki.tcl.tk/41605). That's the best I could do with my limited knowledge of the Tcl internals. My suspicion at the time was that if the Tcl core team really wanted to implement strong/weak references, then they would probably be able to come up with a proper way of doing that. And if they could do that they could do garbage collection. But I don't really know ...

<comment><USER23> I think the problem with such systems is that they have to contend with the infinite varieties of ways references can be stashed away. When a local is itself a reference string, that's well and good. What if it's a string that has a reference embedded in it somewhere? But that effectively describes all Tcl data structures...

<comment><USER24> Yes, the way I was looking at strong/weak references was that strong references could only be held as a value in local/global/class variables, including in lists and dictionaries.

And converting a strong reference to a string would give you a weak reference. So you wouldn't be able to, say, convert a list that included a strong reference to a string, then convert the string back to list, and have exactly the same list that you started with because the strong reference in the original list would be a weak reference in the resulting list.

Strings can represent list and dictionary data structures, and combinations of, but I'm not sure that strings represent all Tcl data structures in the same way. I'm thinking of Tcloo and Tcl arrays - I don't use those and know little about them.

</comment></comment></comment></comment><comment><USER25> I discovered Tcl and Tk a few months back. Spent a few days poking around and experimenting. At first I was incredibly impressed, and amazed I hadn't even heard of it before. But once I started digging deeper, the poor docs turned me off.

If anyone is interested in seeing a recent app example, check out git-gui [0]. It's bundled with git.

[0] [http://repo.or.cz/w/git-gui.git](http://repo.or.cz/w/git-gui.git)

<comment><USER26> Could you provide more information on which documentation you found poor ? Tcl certainly has a lot of it, in the official manual pages for everything as well as the wiki.

<comment><USER25> Sure, but I'm mostly going from memory though.

I'm on macOS. Installing the latest version was confusing. There's a tcl-tk package in homebrew-core, and a tcl package in homebrew-cask. The tcl package is ActiveTcl. What's the difference? On the tcl.tk site, if you try getting the binary it'll point you to ActiveTcl.

Diving into the wiki was very confusing. Lots of articles have comments by random people, and it's not always clear if their comments are relevant or outdated. There's dozens of links, and hard to discern which ones are worth looking into. Lot of links are dead.

The differences between the different Tclkits is not obvious, too many choices. And how do they relate to starkit? I think I remember having downloaded an sdx compiled widget, and I couldn't find the sdx utility, so I couldn't unwrap it.

Tons of dead links in the Great Unified Tcl/Tk Extension Repository [0]. Almost nobody puts up screenshots of their widgets.

It's also frustrating to find out that Tcl Dev Kit is a paid component. I'm probably spoiled by other languages, so this might be pretty entitled of me, but I'd consider the dev kit's tools to be essential. The most important tools for me would be the debugger, linter, and inspector.

As a standalone user, I'm not going to pay $300 just to play around with a programming language. It would be a huge improvement if they were made freely available, even if under a non-commercial license. Then people can try it out, and if they find a good use-case in their job, they might buy a license. I've done that with other software. To give a concrete example: in a few college projects and hackathons I used highcharts [1], a JS charting library. Since it provides a free non-commercial license, I ended up learning how to use it pretty well. Fast forward a bit, and the company I was with wanted data-dense interactive charts. I evaluated a few options, but was most satisfied with highcharts, so I happily convinced them to buy a license.

That's also similar to what Qt has been doing too, and it has been hugely successful. You can use the free open source version, which is licensed under GPL and LGPGv3. But if you want to keep things locked down, you can pay ~$3500/year for their commercial offering. Most humans probably won't pay for the commercial version unless they're full time app developers, but businesses tend to have much deeper pockets.

[0] [http://core.tcl.tk/jenglish/gutter/](http://core.tcl.tk/jenglish/gutter/)

[1] [https://www.highcharts.com/products/highcharts](https://www.highcharts.com/products/highcharts)

<comment><USER26> This is great information. Thank you for putting it together I'll bring it up on the Tcl'ers chat !

</comment></comment></comment></comment><comment><USER27> I remember trying Tcl/Tk many years ago during high-school: the syntax was interesting and building GUI applications was extremely easy. I don't know why Tcl is not popular today, but there is one pretty cool Unix tool that uses/extends it called Expect [1]

Expect lets you automatize user interaction with terminal applications. And then there is DejaGnu, a testing framework, that uses Expect and Tcl. Probably the most important software project using DejaGnu right now is the GNU Compiler Collection. A not so significative project that also uses it is the interpreter of my toy language :) it took me a little bit to understand how to integrate it with Autotools but now I really like it (here is an example: [https://github.com/pera/ad- hoc/blob/master/testsuite/ahci/dg...](https://github.com/pera/ad- hoc/blob/master/testsuite/ahci/dg.exp)).

[1] - [http://expect.sourceforge.net/](http://expect.sourceforge.net/)

[2] - [https://www.gnu.org/software/dejagnu/](https://www.gnu.org/software/dejagnu/)

</comment><comment><USER28> The first company I worked on was an heavy Tcl shop.

For me they went wrong on being a pure interpreted language, having to write all performance critical parts in C wasn't scaling for us.

It was there that I learned only to use languages with JIT/AOT support.

Also having Tk stuck on a Motif look and feel wasn't appealing to us as a mechanism to deliver good UI/UX to our customers, specially to the majority of them on Windows.

</comment><comment><USER29> The greatest innovation of Tcl was how easy it was to extend with libs in C. I still thinks that Tcl's author famous paper about using "glue languages" is still one of the best ideas in software engineering.

Read about it in Ousterhout's Dichotomy: [http://wiki.tcl.tk/9865](http://wiki.tcl.tk/9865)

</comment><comment><USER30> Beside Python, Tcl remains my language of choice when it comes to text mining and ML/AI data engineering proof of concepts.

<comment><USER31>
      Besides Python

So, when & why do you use Tcl over Python?

<comment><USER32> Some of the UNIX systems I admin actually have Tcl installed by "default" (Solaris and AIX) and no Python. So I use Tcl there when I want to do things about shell.

</comment></comment></comment><comment><USER33> Tcl is a great language and ecosystem. It fell victim to a few independent political decisions that resulted in low popularity:

\- Sun's pushing Java and killing everything else

\- Stallman's distaste for anything non-GPL

EDIT: wording

<comment><USER6> That's the first I've ever heard anyone say that Stallman had anything to do with Tcl. Do you mean to imply that guile wouldn't exist if Tcl was GPLed? Or something else?

<comment><USER32> It's too hard to guess that even with hindsight. Stallman probably would not have objected to Tcl at all if it was GPL and not BSD.

<comment><USER34> I'm not entirely sure about that. While Stallman is most famous for his license preferences, he has a longstanding, pretty strong pro-Lisp preference as well, dating back to his early work on Emacs Lisp. Guile Scheme was created as the official GNU extension language mostly because Stallman thought a version of Lisp was the right language for a standard GNU extension language, and Tom Lord convinced him that Scheme was the right version of Lisp for the job. It wasn't a preexisting GPL'd interpreter that he just picked because of its license.

<comment><USER32> I was only talking to the point of Stallman dissing Tcl. Would Guile still have happened? Maybe, and for the reasons you outlined.

</comment></comment></comment></comment></comment><comment><USER35> Tcl, is just not as nice a language as other dynamic languages

and it didn't have the ecosystem to justify it

I think Tcl fails on the basics, nothing too deep, subtle or obscure

</comment><comment><USER36> Its used a ton in the EDA (Semiconductor) Industry. It has its uses for scripting. Everything doesn't have to revolve around web programming.

<comment><USER37> Decades ago Synopsys chose it for Design Compiler. Mostly Hobson's choice (what good alternative did they have?)

But it was an awful language because it was so limited. Many commands in DC naturally want to return objects. But those don't exist in Tcl (maybe they do now?).

So DC had to invent "collections" to make up for the limitations. Which confused the heck out of engineers. Resulting in Stack Overflow questions such as this one:

[https://stackoverflow.com/questions/17864980/collections- to-...](https://stackoverflow.com/questions/17864980/collections-to-list-in- tcl)

So, yeah, EDA uses Tcl but its for historical reasons rather than because its a good tool for that purpose.

</comment></comment><comment><USER29> I had a little contact with the language. The article nails the biggest problem with TCL:

"One actual technical problem that Tcl faces is the concept that all values must be representable as a string. This is more or less ok for things like lists, hash tables or numbers, but is problematic when the user wishes to represent a value that simply isn't a string."

<comment><USER38> Thats actually not totally true. Internally, Tcl has two value types, string representation and actual value representation. Everything DOES have a string- representation though- some are made up (like file handles, fileX) and some are just ASCII forms of the values underneath (like integers).

Tcl is cool because you can manipulate the string form of values incredibly easily, but people confused this with "Everything is a string". It should be "Everything can be manipulated like a string".

</comment></comment><comment><USER39> I used tkinter, after years seeing it in d2 nuke. It was very very straightforward.

</comment><comment><USER40> Seems like the culture prunes back some languages and starts up new ones.

The only language that I think will escape this is JS due to the browser - unless we make a new sandbox app container designed to run scripts (a la java plugin).

<comment><USER41> In the near future - if not already - people will call writing JS without a framework "bare metal".

<comment><USER40> Are you referring to this talk?

[https://www.destroyallsoftware.com/talks/the-birth-and- death...](https://www.destroyallsoftware.com/talks/the-birth-and-death-of- javascript)

</comment></comment></comment><comment><USER42> I got into Linux (and now a long systems administration career) quite literally because I wanted to run eggdrop bots on a shell server. Programmed in TCL :-)

Quirky bit of personal history that amuses me to no end.

</comment><comment><USER12> IMHO the lack of an official OO system has been one of the main drawback to the language when at the same time python were rising.

<comment><USER10> I can see that. There was (and is) a plethora of object systems, which could be seen as a double (triple?) edged sword. It provided choice, with many alternate features and methods (no pun intended), but perhaps at the expense of developer clarity - which one best serves my needs? Will I end up in a dead end? What are most others using? What serious problems might I be adopting? The "third edge" though, is a positive, though took time to arrive: the TclOO that was finally developed was informed by the technical and social impacts of years of experience with various OO systems, and indeed emerged mature and well-formed because of that. In fact, it was initially developed to only be an underpinning for other flavours of OO sugar to be bolted on top, in support of existing systems like [incr tcl] and Snit. It ended up being received as system good enough to use directly, in it's own right.

<comment><USER12> I've never have the chance to use the new core TclOO, but I really think they've made mistake at that time by implementing another new object system instead of promoting an existing one like [incr tcl] (even if not perfect/incomplete).

<comment><USER10> Certainly debatable. For those interested, see a description/discussion here [0] and check it out in Tcl 8.6[1].

[0] [http://wiki.tcl.tk/18152](http://wiki.tcl.tk/18152)

[1] [https://www.tcl.tk/software/tcltk/download.html](https://www.tcl.tk/software/tcltk/download.html)

</comment></comment></comment></comment><comment><USER43> Cuz no BDFL?

<comment><USER6> I dunno why you got down voted, your point seems valid to me. Tcl thrived under John, after him it was ok when Hobbs was the de facto leader, it's sort of gone flat since he moved on. In my opinion.

<comment><USER44> Perhaps because lots of languages have done well without a BDFL. Look at the top 10 languages in Tiobe or the RedMonk surveys, and the majority don't have BDFLs.

<comment><USER43> Ok, let's do that:

        1	1		Java	12.961%	-6.05%
        2	2		C	6.477%	-4.83%
        3	3		C++	5.550%	-0.25%
        4	4		C#	4.195%	-0.71%
        5	5		Python	3.692%	-0.71%
        6	8	change	Visual Basic .NET	2.569%	+0.05%
        7	6	change	PHP	2.293%	-0.88%
        8	7	change	JavaScript	2.098%	-0.61%
        9	9		Perl	1.995%	-0.52%
       10	12	change	Ruby

Of TCL's brethren

Python, BDFL

PHP, BDFL

Perl, BDFL

Ruby, BDFL

The rest (even though you wouldn't compare them to TCL cuz they're not in the same niche) have/had huge corporate sponsors and/or are entrenched industry standards and have also had iconic/notable figureheads (Gosling, K&R, Stroustrup, Hejlsberg, Eich).

<comment><USER45> Perl probably shouldn't be in that list. It's arguable that Larry has had any direct influence on it for at least ten years, perhaps 15.

</comment></comment></comment></comment></comment><comment><USER41> More than anything, I would say that what "went wrong" is simply that the wind changed. Tech is driven by fashion more than anything else, something becomes "cool" and everyone scrambles to re-write perfectly good software in a new language for no particular reason (other than keeping their CVs up to date). Tcl is a powerful language that you can use to create complex systems with simple code, the holy grail. But instead the industry took a massive step backwards and said "event driven programming? let's use Javascript!"

<comment><USER46> Blame the browser. If Brendan Eich had tried to repurpose an existing language instead of mashing together a new one; or if Microsoft had used their de-facto monopoly in early '00 to push abetter language, JS wouldn't be as big as it is today.

<comment><USER47> This I'll never understand. Why, for god sake why, did he had to create such a terrible scripting language while he had plenty of great open source existing ones ? I mean:

\- lua appeared 2 years before

\- python 5 years before

\- perl 7 years

Instead we have this monstrosity with no namespace, terrible error handling, pitiful stdlib, limited expressiveness, atrocious data structure and type handling, so full of traps and gotchas we had to write a book about the part of the languages not to use.

<comment><USER48> I've read that he'd wanted to just use Scheme, but that they needed the language to have "Java" in the name, as well as curly braces. So, we got Javascript.

Also, given that DSSSL was an early contender against CSS (and a great deal more powerful), we could have basically had Scheme there too. [https://blog.cloudflare.com/the-languages-which-almost- becam...](https://blog.cloudflare.com/the-languages-which-almost-became- css/?f)

Lastly, because S-expressions can represent everything that is representable in SGML/XML/(X)HTML, but more succinctly, we could have basically had Scheme instead of HTML.

Imagine if, instead of JS/HTML/CSS, we had... Scheme. I'm pretty sure that the alter universes where this happened also all have peace, warp drives, and working cold fusion.

<comment><USER3> > Lastly, because S-expressions can represent everything that is representable > in SGML/XML/(X)HTML, but more succinctly, we could have basically had Scheme > instead of HTML.

I suggest (along with David Moon (Lisp Machine)) that a key disadvantage of sexp with respect to *ML, is that there's no place to hang on "extra stuff". Many lisps allow you to decorate the nodes with properties once the nodes are read, but the properties lack a printed representation. It's a homoiconicity fail. Sort of like not allowing comments in JSON might be, if a common case was then to attach comments to the objects after they're loaded. That very isn't common, so the restrictiveness is worth it. It's not clear that's the case with sexp.</comment></comment></comment></comment></comment>


Microsoft Certificate used to sign "Flame" - <AUTHOR> http://isc.sans.edu/diary.html?storyid=13366&rss

<comment><USER2> More details in the MS technet post: <quote> We have discovered through our analysis that some components of the malware have been signed by certificates that allow software to appear as if it was produced by Microsoft. We identified that an older cryptography algorithm could be exploited and then be used to sign code as if it originated from Microsoft. Specifically, our Terminal Server Licensing Service, which allowed customers to authorize Remote Desktop services in their enterprise, used that older algorithm and provided certificates with the ability to sign code, thus permitting code to be signed as if it came from Microsoft.

We are taking several steps to remove this risk:

• First, today we released a Security Advisory outlining steps our customers can take to block software signed by these unauthorized certificates.

• Second, we released an update that automatically takes this step for our customers.

• Third, the Terminal Server Licensing Service no longer issues certificates that allow code to be signed. </quote>

[http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft...](http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft- releases-security-advisory-2718704.aspx)

<comment><USER3> This doesn't seem to make a lot of sense. On one hand they say that it's an "older algorithm" which presumably implies that the vulnerability is a simple software implementation bug. On the other they point out that the provided certs had "the ability to sign code", which is a straight up authorization failure (and a staggeringly bad one given the regime). Which is it?

<comment><USER4> As far as I can tell from the patch, the "Microsoft Enforced Licensing Intermediate PCA" certificate had code signing enabled. This is a little silly, but not an issue as long as the corresponding private key is kept safe. Unfortunately, the certificates were signed using MD5(-RSA), which is broken. I believe that what happened is that someone found a collision for this certificate and used the resulting fake certificate with known keys to sign Flame.

Interestingly, one of the revoked certificates expires in 2017 and used SHA-1. This one had certificate signing enabled! It's possible that either the private key for that certificate escaped, or it's being revoked as a precaution to remove the unnecessary capabilities.

<comment><USER5> Though MD5 is considered utterly broken for cryptographic purposes, AFAIK there are as of yet no known practically viable preimage attacks. Finding a collision for an already signed certificate would require a preimage attack.

There are very cheap collision attacks, which let you to generate two values that hash to the same MD5 signature; an attacker can exploit that by making you sign one object, and then swapping it out with another with the same hash.

<comment><USER4> That's true. However, it's possible to do it with two co-created certificates ([http://www.schneier.com/blog/archives/2008/12/forging_ssl_ce...](http://www.schneier.com/blog/archives/2008/12/forging_ssl_cer.html)), and depending on how the licensing process works, that could easily have been done. I would imagine that the creators of Flame have more than enough computing power to do that.

The articles though seem to be suggesting that the "real" certificates were being granted with too many powers. Microsoft's advisory seems to suggest that both were potentially used (MD5 collisions _and_ overly-broad purposes on real certificates). It's hard to tell what really happened here...

</comment></comment></comment></comment></comment><comment><USER6> Aren't you glad Microsoft is the de facto code signer for UEFI Secure Boot now? ;)

<comment><USER7> It's just one of many reasons why Microsoft alone shouldn't decide what operating systems can work on UEFI machines. If the future is UEFI, then we need an industry body like the W3C or something to work with OS vendors, not just Microsoft.

<comment><USER8> The idea that an industry body would be more secure than the security department of major software company is something I don't see a lot of evidence for. Apart from the root DNS servers I can't think of any.

There are plenty examples of companies keeping something secure. There aren't many of industry bodies.

I'd trust a bank (well, some banks) before I'd trust either the W3C or IETF with the keys to the universe.

<comment><USER9> I doubt there is a single large company that has not been hacked at some point. It's just most hacks don't get reported and most reported hacks don't make the news.

</comment></comment></comment></comment><comment><USER10> A little more detail: [http://www.securityweek.com/microsoft-unauthorized- certifica...](http://www.securityweek.com/microsoft-unauthorized-certificate- was-used-sign-flame-malware)

</comment><comment><USER11> It would be useful to solve the mystery of how the chain of trust was compromised.

Was a Microsoft employee involved?

Can't we have some sort of chain of trust beyond the reach of sovereign governments?

<comment><USER12> [http://blogs.technet.com/b/srd/archive/2012/06/03/microsoft-...](http://blogs.technet.com/b/srd/archive/2012/06/03/microsoft- certification-authority-signing-certificates-added-to-the-untrusted- certificate-store.aspx)

<comment><USER11> From the link ... How did this happen?

"When we [Microsoft] initially identified that an older cryptography algorithm could be exploited and then be used to sign code as if it originated from Microsoft, we immediately began investigating Microsoft's signing infrastructure to understand how this might be possible. What we found is that certificates issued by our Terminal Services licensing certification authority, which are intended to only be used for license server verification, could also be used to sign code as Microsoft. Specifically, when an enterprise customer requests a Terminal Services activation license, the certificate issued by Microsoft in response to the request allows code signing without accessing Microsoft's internal PKI infrastructure."

Interesting. The Microsoft Terminal Services CA has the corporate identity, but not the corporate trust chain. Is this a deliberate back-door provided to the US government, or simply an ordinary vulnerability?

We need some sort of certification, an independent audit, of X509 certificate authorities and their trust chains. Agreed?

<comment><USER13> I guess there's no way to prove that isn't deliberate, but that smells like the rather more common failure to implement crypto systems properly.

<comment><USER14> Allowing code signing with a certificate that we generate for and hand out to enterprise customers was certainly not something we intended to do at Microsoft. It was sloppy and a mistake on our part that we rushed to address as soon as we discovered the issue. Honestly, I think many of us are terribly embarrassed by this failure and a little surprised that no one (us included) had discovered this issue years ago. :(

<comment><USER15> I agree that is by far the most likely case, but if you wanted to give the USG a backdoor to sign code, this is also exactly how you'd do it -- as a deniable oversight, which, when found, could be explained as a simple oversight and rapidly corrected.

<comment><USER13> Frankly, if I were going to create a deliberate backdoor I'd make it harder to find than this. I wonder when it was first discovered.

<comment><USER15> Yeah, so would I. It also got put in one ago, which is before putting back doors into commodity OSes was such a useful thing for national security (probably compromising crypto systems and specific RF hardware used in air defense, etc was the primary goal back then).

I probably wouldnt rush to fix a convenient exploit once discovered, though, if existing USG policies could protect against it (removing most CAs, using DOD CAs) for government operations.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Doesn't surprise me.

Certificate signing is only as good as the weakest points which are 1) humans, 2) code, 3) maths respectively.

You can't trust (1), ever.

(2) is flawed by the fact that (1) made it.

(3) is pretty good but relies on a few assumptions which we appear to arrogant enough to assume will always stand.

</comment><comment><USER17> Is this more serious than the signing for stuxnet?

<comment><USER18> Maybe:

1\. The certificate appeared to be available to anyone who was looking hard enough. Microsoft provided the misconfigured certificate to anyone activating their Terminal Services product (!). Pretty embarrassing.

2\. It's not evident what the signing requirements are for Microsoft Automatic Updates code (at least I can't find them). Presumably they validate an explicit Windows Update chain, but if they don't, this could perhaps enable an attacker to auto-install the Flame virus as an update. I doubt that would be the case, but their security announcements aren't very forthcoming.

<comment><USER19> The Windows Update signing requirements are, AFAICT, not documented and they do require a special chain. Whether having Microsoft in the root is special enough is another question.

Regardless, it appears that a signed driver is enough to pwn any modern Windows box via USB. "The system is installing driver software for your device..."

EDIT: What it most likely would work for over the network would be a man-in- the-middle attack on users who "Always trust ActiveX controls from Microsoft". Not to mention plain old impersonating websites for users of MSIE and Chrome.

A scary but plausible possibility is that an attacker with such a cert could forge client certificate credentials to obtain remote access via RDP, MS Terminal Services Gateway, ISS certificate mapping, etc.

<comment><USER18> F-Secure claims that this /would/ allow forgery of Windows Updates (!!): <http://www.f-secure.com/weblog/archives/00002377.html>

"...Flame has a module which appears to attempt to do a man-in-the-middle attack on the Microsoft Update system..."

<comment><USER19> Yep. It appears that, in fact, windows update has been pwned by these certs.

More info. [https://www.securelist.com/en/blog/208193558/Gadget_in_the_m...](https://www.securelist.com/en/blog/208193558/Gadget_in_the_middle_Flame_malware_spreading_vector_identified)</comment></comment></comment></comment></comment>