Egoless Programming (2011) - <AUTHOR> http://wiki.c2.com/?EgolessProgramming <comment><USER3> The concept of course was Jerry Weinberg's in The Psychology of Computer Programming (1971). I always felt like that book should have had a different title. Maybe "Computer Programming as a Human Activity", which is what he said it was about in the preface: [http://wiki.c2.com/?ThePsychologyOfComputerProgramming](http://wiki.c2.com/?ThePsychologyOfComputerProgramming). The concepts of the book are more social than psychological, as I recall. Even "egoless programming", which is psychology in the sense of looking at how we identify with our ideas, is also about interactions on teams.

</comment><comment><USER4> I have grown into this, and strive to keep it.

Early on on my career, the products I made were an extension of me. Bugs were an insult, design critiques a personal attack. The code was precious and deleting large swathes of it unthinkable.

The consequences? I was probably not that easy to work with, and my software wasn't as good as it could be.

Nowadays I'm proud of what I create, and I enjoy the act of creation. But nothing delights me more than someone (can be me, can be others in the team) taking a hatchet to large chunks of what we've produced, I value criticism of approach and I need people to find faults and bugs to help me deliver a better product. My focus has entirely shifted from "I produce intricate works of art" to "let's find the simplest, most robust way to deliver what my client needs"

Code is a means, not an end.

</comment><comment><USER5> How ironic that reading this, I jumped to the Errors of TeX link, something I've read parts of in the past, and then found myself wondering was I in that file?

I am.

<comment><USER6> This is a really excellent comment.

</comment></comment><comment><USER7> This doesn't resonate with me, because so much of programming is craftsmanship. Often the only purpose of some aspect of programming that matters is that _I_ made it. I crafted it. The design that exists matters _because_ I made it. I didn't pay someone else to do it. I didn't copy it. I _made_ it. The act of making it is very fundamental.

I think it would be similar to artwork. There's no such thing as egoless art making. It's literally the product of the artist.

<comment><USER8> > The act of making it is very fundamental.

Yep, and you can stop after that. Process is the only important thing. After that you'd better to distinguish you and your program/design. It's mere artifact without value.

<comment><USER7> The built artifact is the evidence of the act of making.

</comment></comment></comment><comment><USER9> "Treat your software like livestock, not like pets" \- random HN comment that stuck with me as a beautifully visceral metaphor.

</comment><comment><USER10> To get an index of all C2 wiki pages

          curl https://proxy.c2.com/wiki/remodel/pages/ > 1.html

To get a wiki page in JSON and convert it to textfile without using gratuitous Javascript

Optional: feed through fmt(1)

          curl https://proxy.c2.com/wiki/remodel/pages/EgolessProgramming|tr -d '\n'|sed 's/ *//;s/{ \"date\": \"//;s/ \"text\": \"//;s/\",/\
       /
          s/\. :)//;s|\\r\\n\*|\
       \
       \*|g
          s|\\r\\n|\
       |g
          s/'''//g; s/''//g;s/\\\\"/"/g;s/\\"/"/g;s/\\t//g;s/ ://g;s/  */ /g;s/\" }$//' > 1.txt

To search the wiki

          curl https://proxy.c2.com/cgi/fullSearch/?search=$1|sed 's|href=wiki.|href=https://proxy.c2.com/wiki/remodel/pages/|g' > 1.html

<comment><USER11> why not just click on the link? - seems more work to run this

Also appears quote missing in second code block

<comment><USER10> Why not just serve plain HTML pages like C2 wiki used to do. Why use Javascript and Google Analytics. Why ask why.

Fact: It took more work for someone to convert the HTML to JSON, write the Javascript and set up the proxy than it did for me to write a shell script.

Not sure what were the benefit(s) to that person versus the one-time cost of switching away from plain HTML to requiring Javascript. No doubt he deemed it worth the time to set up.

What I do know is the benefit to me versus the one-time cost of writing a shell script. It means I do not need to use Javascript or submit to Google Analytics. I do not even need internet access once I have downloaded the C2 wiki, converted it to text and stored it on local media. If it one day disappears from the web and the IA, I still have a copy. This wiki is a piece of history and it is not changing.

Apologies for the error with the quotes. Here is a fix

cat > 1.sed

          s/ *//;s/{ //;s/ \"date": \"//;s/. \"text\": \"//;s/)//;s/\",/\
       /;s/ )//;s|\\r\\n\*|\
       \
       \*|g;s|\\r\\n|\
       |g;s/'''//g;s/''//g;s/\\\\"/"/g;s/\\"/"/g;s/\\t//g;s/ ://g;s/  */ /g;s/\"}$//

^D

       curl https://proxy.c2.com/wiki/remodel/pages/EgolessProgramming|tr -d '\n'|sed -f 1.sed > 1.txt

</comment></comment></comment><comment><USER12> This is one of the best pieces of advice I've read in a while!

I've talked with my teammates about this topic before, but I've struggled to put it so well. This article (or a book chapter?) is a very nice nexus between psychology, philosophy and programming best practices for collaboration.

<comment><USER13> Coding Horror republished the ten commandments from the Gerald Weinberg book (any book he's written is worth reading by the way) mentioned in this article:

[https://blog.codinghorror.com/the-ten-commandments-of- egoles...](https://blog.codinghorror.com/the-ten-commandments-of-egoless- programming/)

</comment></comment><comment><USER14> One of the things I love most about my current job is that at some point the whole team has been through the codebase, and no one owns anything. In fact, any one in the team would be hard pressed to tell who wrote what in the first place, even if they themselves did it.

The result is that anything that needs fixing or improving is simply fixed, no questions asked, no feelings hurt. Once code review approves it it goes back into the communal codebase that we all maintain equally, with all credit shared.

At some point, I've gotten to a place where I see it as a bad smell if you can tell a team member's code apart from the rest.

</comment><comment><USER15> Weird article:

> The idea is that programmers must fight the natural tendency to treat their > programs as part of themselves, and therefore to reject all criticism.

This seems to suggest that the author believes people have a natural tendency to reject _all_ criticism of themselves, and that the programs they help build are just an extension of that. In that case, why single out programs? OTOH I could be interpreting that completely wrong; most of that page seems to be about various definitions and interpretations.

<comment><USER16> I have experienced this in myself, and other people many, many times.

I still get a little pinch inside when someone sits down to examine my work.

Especially since I work with a very wide range of technology, so I never really feel I'm dealing with something I've 'mastered'.

edit - <USER2>

<comment><USER17> A perfect example of why humans are so strange. Our default human response could have been wired to be "i can't possibly feel bad when criticized, because i know i'm not a master" and "i love having people examine my work, because it's a shortcut to getting better even faster", but instead we take all the wrong lessons.

<comment><USER18> This is true when I perceive the examiner as more knowledgable but more often than not I perceive them as less knowledgable and ignorant. This can both be true, that they are less knowledgable and ignorant, and that it's wrong of me to assume so. Often it comes from the belief, based on my perceived tone of the examination, that the other person believes they are the expert and are correcting me, the noob. So, feeling perceived as a noob feels disrespectful, especially given a topic for which I'm an expert. That in no way means I shouldn't grow and welcome all examination. But I'm not the Dalai Lama. I'm a normal flawed human being who gets upset when they feel insulted. It will probably take me a lifetime to get better at not feeling insulted. In the meantime, when I remember, I try to couch my examinations of other's code in ways that will hopefully not make them feel insulted.

<comment><USER17> Based on dunning-kurger, you would expect everyone who is less knowledgable than you to actually think that they are more knowledgeable, so you could say that they are acting with somewhat honest intentions in their attempt to correct you. But then this also acts in the opposite direction as well, in that you might think you are more knowledgeable because you are, but you might also think it because you aren't. So, how do you know if you are "right" to be insulted? You probably would need multiple orders of magnitude difference to be sure, but that's very rarely the case. That is to say, it's probably best to be charitable with my interpretations of others.

I feel often the issue ends up that I am more knowledgeable than the other, but only slightly more, so my instinct says that they are off. However, I can't express it well enough, because I can't absolutely describe all the circumstances in which their advice is correct, and all the circumstances in which their advice is not, and then prove why it's not applicable in this specific case. If I could do so, I'd explain it fully, there would be no complaint from the other, and it'd be a great teaching moment. So then maybe such situations where someone is trying to correct me, but I can't give an absolute response back indicates a gap in my self-held expertise.

And either way, experts can learn insights from those who are noobs (though often not in the way that the noob intended).

</comment></comment></comment></comment></comment><comment><USER19> If Egoless Programming is powerful, imagine what we could do with Egoless Living!

</comment><comment><USER20> Anyone try 'becoming one with the computer' when programming?

Seems to compress/clarify modelling & managing complexity sometimes.

<comment><USER21> Can you elaborate on what do you mean by 'becoming one with the computer'? My understanding is that you mean that we should put some assumptions aside and try to look from the CPU point of view, which can be helpful for debugging, testing, design, etc. Am I right? edit: spelling mistake

</comment></comment><comment><USER22> If nobody gets the credit, who gets the raise?

<comment><USER23> If everyone is getting their due nobody needs a raise.

Of course, if everyone is getting their due, companies cannot grow.

<comment><USER22> Everyone always needs a raise</comment></comment></comment>


Motion Smoothing Is Ruining Cinema - <AUTHOR> https://www.vulture.com/2019/07/motion-smoothing-is-ruining-cinema.html <comment><USER2> At its core, tastes are subjective, and this is no exception.

The appearance of video is harsh and artificial. It's cold, but also at times exceptionally clean, crisp and vivid.

Music videos (as the very term suggests) often display a mastery of this style of production, which, when met with intent, can prove evocative in its own way.

If you approach movies knowing that the motion smoothing is a side effect of the monitor, it's actually an interesting way to rewatch old movies and shows. It has a surreal effect, and the movies themselves are otherwise impossible to truly change. It is unquestionably the technology introducing a new layer of distortion.

Which can only mean one thing: the preference is generational, and with time it might just so happen that a generation gap will erase all knowledge of the way things were, and there will arrive a new normal, distorted and alien to those who grew up exposed to the original norms.

<comment><USER3> I don't really agree. I think motion smoothing is a gimmick. Like 3d and curved TVs before it. It gave another metric (besides size) for manufacturers to compete on - 60hz, 120hz, 240hz etc.

Motion smoothing just doesn't look better, especially when it is poorly implemented (the norm) - the motion tends to speed up and slow down, which is worse than the judder it is supposed to fix.

Even properly sourced hi frame rate material looks bad - I saw the Hobbit in HFR and it was difficult to watch the seemingly fake production - my mind could no longer be tricked because there was so much detail in each second for it to reason with. Nevermind the extra lengths that Peter Jackson had to go through to properly light the film, and the extra detail needed in the set work, costumes and makeup.

Change my mind!

<comment><USER4> It's still a generational, subjective, relearn-able thing. Assuming it's true that high framerates make it harder to trick the eye - so what? Nobody complained about Yoda blatantly being a puppet. There are lots of dimensions in which you can suspend your disbelief. If your assertion is true, it simply means we have to suspend our disbelief in makeup, set design etc just a little bit more, in exchange for vastly more realistic motion and artistic space in which to put detail. I think it's a win - I bet set design got a lot harder with the switch to color, too.

</comment></comment></comment><comment><USER5> I remember I got a tv a many years ago that had a cinema setting with accurate colors.

The only problem was that you pretty much had to watch it in dark room (LCD before LED backlighting).

During the day I had to switch back to vivid.

I will say that most aspect ratio problems have gotten better over the years (excepting maybe youtube)

</comment><comment><USER6> Old man yells at cloud. I bet he reminisces the "good times" at Yale learning on hand cranked 16mm. Dont want Motion Smoothing? Start shooting in 60Hz.

> motion smoothing is fundamentally ruining the way we experience film

and fluid perception of reality is ruining this journos life I bet

<comment><USER7> > Dont want Motion Smoothing? Start shooting in 60Hz.

A few like James Cameron and Peter Jackson have tried. Nobody liked it because it looked like a soap opera. I'm not against higher fps, but film has some historical limitations it clings to that remind us it's "film" such as 24fps and widescreen.

The big complaint is that it's on by default--it's not something people are (explicitly) choosing.

Personally, I hate motion smoothing. It's just a gimmick to add a bullet list to the box. I figure it might be useful for sports (I would say video games, but it generally introduces a noticeable lag). It sucks that it's on by default and not consistent or obvious to turn off. If you're happy to opt-in, you do you.

<comment><USER8> I thought it looked fine. Besides, if you use a high framerate you can always sell a downsample and leave open the possibility of a remaster should tastes change later.

<comment><USER7> The problem is the shutter value, which is another artistic choice that differentiates "film" from video and will contribute to the choppiness.

Standard for film is a 180degree shutter (half open half closed when capturing). Originally, you had to physically advance the film to the next frame while the shutter was closed. Video would be effectively always open giving you a longer blur. If you shoot at a 60fps instead of 24fps you're going to have 2.5x less blur (and also 2.5x less light). So downsampling wouldn't look right at 24 or 30fps.

</comment></comment></comment></comment><comment><USER9> If I'm not mistaken, video already is broadcast at 50/60 Hz. If so, how do broadcasters turn a 24 frames per second movie signal into a 50/60 frames per second video signal?

I would guess they use some (advanced) interpolation. If so, isn't the problem one of a) interpolating twice instead of in one go and or b) using lower quality software inside the tv?

<comment><USER10> IIRC it's called 3/2 pull down. Basically they double a frame every so often.</comment></comment>


NumPy Exercises for Data Analysis in Python - <AUTHOR> https://www.machinelearningplus.com/101-numpy-exercises-python/ I compiled a list of numpy practice exercises related to data analysis. Might be helpful if you want to practice some data munging problems. Feedback welcome!<p>https://www.machinelearningplus.com/101-numpy-exercises-python/ <comment><USER2> Does anyone know of any similar resources for Pandas?

I've found the following to be quite helpful but would love to know if anyone knows of other resources in a similar vein: [https://pandas.pydata.org/pandas- docs/stable/cookbook.html](https://pandas.pydata.org/pandas- docs/stable/cookbook.html)

<comment><USER3> I started writing a '100-pandas-puzzles' set of exercises here: [https://github.com/ajcr/100-pandas- puzzles](https://github.com/ajcr/100-pandas-puzzles)

There's also pandas_exercises by Guilherme Samora ([https://github.com/guipsamora/pandas_exercises](https://github.com/guipsamora/pandas_exercises)) which is very good - it's split across multiple notebooks and is more extensive than my repo.

<comment><AUTHOR> Nice stuff!

</comment></comment></comment><comment><USER4> This is very similar in spirit to [https://github.com/rougier/numpy-100/blob/master/100%20Numpy...](https://github.com/rougier/numpy-100/blob/master/100%20Numpy%20exercises.md). In fact, now that I look at it a bit more, it seems like all of this post's examples are reworded versions of Nicolas Rougier's "numpy 100"...

<comment><USER5> There's also Rosalind for bioinformatics problems to be solved in Python.

[http://rosalind.info/problems/locations/](http://rosalind.info/problems/locations/)

<comment><USER6> This looks interesting. Thanks for the link.

</comment></comment></comment><comment><USER3> There are some nice exercises here, good work.

For question 48 it might be simpler to just write

      np.sort(a)[-5:]

instead of using argsort() and then using fancy indexing. Better yet, use

      np.partition(a, kth=-5)[-5:]

which scales linearly with the size of the array.

Also, the one-hot encoding puzzle (51) would be more efficiently solved using

      (arr[:, None] == np.unique(arr)).view(np.int8)

In general, `for` loops over NumPy arrays should be avoided where at all possible.

<comment><AUTHOR> Thanks for the suggestion, I will factor those in.

</comment></comment><comment><USER7> One thing that is holding me back in numpy is not knowing the runtime complexity of operations—of course I can profile code, but I should have better awareness when writing code in the first place. Without an algorithms background, I don't have strong intuitions on the runtime complexity of the primitives (np.unique). Any suggestions?

<comment><USER8> Switch to Julia! Hit @edit unique([1,2,3,2]) in the REPL and you see the implementation.

<comment><USER9> Nice! Ive been meaning to try out Julia for a while now. Is the numpy equivalent in Julia largely written in Julia itself? (as opposed to C/Fortran)

<comment><USER10> Julia's numpy equivalent is basically the standard Array type from the standard library, which I'm 99% sure is native Julia.

<comment><USER11> If one is working on small (<= 15 by 15) matrices, the StaticArrays module [1] is also native Julia and is much faster than Base.Array. Since a StaticArray knows its own size after type inference, they are allocated on the stack, which is nice.

One downside is that unless you're doing BLAS-style operations, writing non- trivial transformations of StaticArrays always seems to require generated functions.

Anyway, I think this is a feature that numpy doesn't provide.

[1] [https://github.com/JuliaArrays/StaticArrays.jl](https://github.com/JuliaArrays/StaticArrays.jl)

</comment></comment></comment></comment></comment><comment><USER12> After a quick peruse, about half the exercises included new material for me. Anybody learning NumPy would do good to review this. Bookmarked!

</comment><comment><USER13> Working through them and noticed a few small things.

For #3, you can make a boolean array with np.ones/np.zeros with the same dtype arg, saves a little bit of space.

ie np.ones((3,3), dtype=bool)

For #14, you can make use of the same compound boolean statements as you can in pandas to make it a bit simpler.

ie a[(a > 5) & (a < 10)]

For #15, this is a built in numpy function.

np.maximum(a,b).

That's as far as I've made it, but I'm really enjoying them.

<comment><AUTHOR> Thanks for the No.14 man!

However, for No. 15, that is not the point of the exercise.

</comment></comment><comment><USER14> > 13\. How to get the positions where elements of two arrays match?

      > Desired Output:
      > #> (array([1, 3, 5, 7]),)

Why is (array([1, 3, 5, 7]),) the desired output, and not array([1, 3, 5, 7]) ?

</comment><comment><USER15> For #15, if the number of elements is large, the speed will be slower than we expected, since maxx function is writren in pure python. But in my experience, it is much faster than for loop in pure python.

</comment><comment><USER16> oh wow I wish I knew about r_ and c_ a few months ago! I'm still annoyed with numpy for being more clunky than Matlab for linear algebra, but resources like this are good for verifying that I'm doing stuff in a numpy-ic way. Thanks!

(Also numpy has some really nice features over Matlab, like [None,:] broadcasting and being able to index a parenthesized expression or function output without naming it. Ok, the latter is not really a feature, more of an example of how Matlab is broken as a language)

</comment><comment><USER17> Looks good, I will definitely use this as a reference!

</comment><comment><USER18> Are there similar exercises for Java-8 streams?

</comment><comment><USER19> anyone knows anything similar for matplotlib?</comment>


'swapping bodies' with a friend changes our sense of self - <AUTHOR> https://www.sciencedaily.com/releases/2020/08/200826110322.htm <comment><USER2> I have wondered about this kind of effect in VR games. There is something fundamentally different about freely looking down at a stranger's body and hands that isn't present when controlling a character on a screen. It should be possible to try some of these experiments at home

</comment><comment><USER3> Fits with why we take psychedelics I guess.</comment>


Big Price Increase for Tuberculosis Drug Is Rescinded - <AUTHOR> http://www.nytimes.com/2015/09/22/business/big-price-increase-for-tb-drug-is-rescinded.html <comment><USER2> This is NOT the currently viral Turing Pharmaceuticals's hike of Daraprim's price ([http://www.nytimes.com/2015/09/21/business/a-huge- overnight-...](http://www.nytimes.com/2015/09/21/business/a-huge-overnight- increase-in-a-drugs-price-raises-protests.html)) that's being rescinded. I had no idea that this practice of buying up patents and increasing drug prices is so common. Sounds like the pharmaceuticals market is full of some very unethical folks.

<comment><USER3> Sounds like handling the PR of buying drug patents and jacking up their price multiple orders of magnitude just became more expensive.

</comment></comment><comment><USER4> The pharmaceutical industry is just as corrupt as the financial sector. It seems capitalists will be capitalists. A lot of well intentioned companies seem to go this way too. Share holders demand profitable growth, sociopathic execs are brought in and I think the results speak for themselves.

<comment><USER5> It would be more accurate to say that _people will be people_. Greed is not limited to capitalists. Greed, lust for money, and the need for power are observable across all political, social, and governmental systems.

<comment><USER6> Speak for yourself.

Edit: Here's a nice link. [http://dwardmac.pitzer.edu/Anarchist_Archives/journals/freed...](http://dwardmac.pitzer.edu/Anarchist_Archives/journals/freedom/freedom2_21.html)

</comment></comment></comment><comment><USER7> How to be praised for doubling the price of an essential drug:

1\. Set the price to 55x the original

2\. Wait for outrage

3\. Set the price to 2x the original

4\. Profit

<comment><USER8> The drug was being produced at a loss. Raising the price so that the manufacturer is able to keep producing it is surely preferable to to no drug at all, right?

<comment><USER9> I doubt it was _that_ much at a loss to warrant a 55x price increase, though. Even 2x is kind of a stretch, although I can see making up for past sales or something (or they were being _really_ generous before).

<comment><USER10> The numbers you need are in the article: $10M loss over 8 years (2007-present), ~45 cases/year.

In order to break even, they need to increase the cost of a course of treatment by about ~$28k/patient.

The new price doubles the price to about ~$50k/patient, which is still short of this number (but bleeding $3k*45 patients = $135k/year is much more manageable than bleeding $1M dollars a year).

<comment><USER11> I applaud you sir! Rather than jumping on the hysteria bandwagon, you actually did the math.

So even if the drug was priced at $28K/patient, the company would be making zero profit. Huh...

<comment><USER12> 28k is the delta needed. 53k/patient is break-even.

</comment></comment></comment></comment></comment></comment><comment><USER13> "Mr. Hasler said this was probably not done because foreign manufacturers were not willing to bear the expense of applying for regulatory approval in the United States to serve a tiny number of patients."

Or we could reduce the burden of applying for approval?

<comment><USER14> I agree. My blood isn't any different than a Europeans' or an Americans', so why duplicate the approval process? It can't be unsafe for one and safe for another just because some imaginary line has been crossed.

It would also help to reduce drug shortages if stock could be more easily transferred.

<comment><USER11> _so why duplicate the approval process?_

It was the separate approval process that prevented an explosion of thalidomide babies in the US.[1]

[1][http://en.wikipedia.org/wiki/Thalidomide#Birth_defects_crisi...](http://en.wikipedia.org/wiki/Thalidomide#Birth_defects_crisis)

<comment><USER14> It could also be argued that one process would have prevented the explosions everywhere.

</comment></comment></comment></comment><comment><USER15> It would be nice for someone to start a non-profit organization supported by donors that would exist purely to purchase rights to these medicines and keep them relatively low-cost to patients.

<comment><USER16> Great idea, and we could call it "the government".

<comment><USER17> S/he said "non-profit" and "donors".

<comment><USER18> Keeping people alive in a first-world country shouldn't rely on the whims of private charity.

<comment><USER17> But as long as it's not a first-world country, fuck those guys, huh?

</comment></comment></comment></comment></comment><comment><USER19> "Rodelis reveals almost no information about itself, such as the names of its executives, directors or investors, on its web page. It operates out of Alpharetta, Ga., though the Chao Center's statement said it was based in Dublin."

They sound a lot like a patent troll.

<comment><USER20> ...with their fiscal headquarters in a tax haven. Dublin? Smells of double Irish and similar fiscal constructions...

<comment><USER14> This isn't unusual for a pharma company, or any other big company for that matter.

Transfer/keep/develop the IP in a low-tax jurisdiction and then have their US/Canadian/whatever division pay a licensing fee to the corp in that low-tax jurisdiction.

</comment></comment></comment><comment><USER21> What a boon this is for Turing. I'm willing to bet most of the public will not realize it's not the same drug from the earlier price hike story.

</comment><comment><USER22> Although the headline is not referencing Daraprim and Turing Pharmaceuticals, some of the content is about that, and there is an embedded video interviewing Shkreli, the Turing CEO.

I recommend watching it; I thought it was a very good interview. Shkreli makes his case much more effectively than I'd have predicted.

Example: he claims that a treatment course of Daraprim costs less than other drugs that, in his opinion, are comparable (i.e. those other drugs are cures for other similar diseases).

</comment><comment><USER23> I'm not a patent lawyer, but I don't understand how 62-year old drugs still require licenses to be manufactured? Seems like another case of patent law gone mad.

<comment><USER11> You don't understand why there are regulations around manufacturing a selling a prescription drug? Really?

I don't know about you, but I kinda like those regulations.

<comment><USER23> No, I understand that, but I thought once a drug's patent expires then any reputable pharmaceutical company could manufacture it as a generic (with the proper testing of course). Is that not the case here?

<comment><USER24> Apparently the issue is the testing. You need to purchase a large quantity of pills from the original manufacturer to compare your new batch with and that was hard to obtain.

<comment><USER23> Ah, I see. It sounds to me like the issue is that there's not enough of a market to attract the interest of another company to get over the initial fixed costs to get the drug approved. Seems like a possible reform would be to streamline the approval process for generics to make this easier.

</comment></comment></comment></comment></comment><comment><USER25> Rescinding seems smart so as not to kill the goose that lays the golden egg by way of overarching regulatory overhaul.

</comment><comment><USER26> Is this the CEO who was trolling on Twitter?

<comment><USER27> No.

</comment></comment><comment><USER28> Only an act of congress could fix this problem, so we are doomed (they have post offices to name before they try to shut them all down).</comment>


Ask HN: Open-Source Maintainers over 60? - awinter-py I'm looking to interview older open-source maintainers to explore the difference between hobbies & work and to talk about ancient programming paradigms coming back into style.<p>Know any projects maintained by 60+-ers? Post here. <comment><AUTHOR> Go is open source and was designed by Ken Thompson (over 70) and Rob Pike (over 60)

Don Knuth of course is over 80, he has written some of the oldest available open source programs still available (from before the term "open source" was coined)

</comment><comment><USER2> Eric Raymond is over 60.[1] He maintains a lot of open source projects (and was one of the original advocates of open source software):

[http://www.catb.org/esr/software.html](http://www.catb.org/esr/software.html)

[1] [https://en.wikipedia.org/wiki/Eric_S._Raymond](https://en.wikipedia.org/wiki/Eric_S._Raymond)

</comment><comment><USER3> Karl Williamson started maintaining perl5 unicode, when he went into retirement.

</comment><comment><USER4> Post on the Asterisk forums.</comment>


Show HN: Twitter/Facebook like autocomplete powers for your comment box - <AUTHOR> https://github.com/ateev/jquery-autocomplete-plus

<comment><USER2> I don't think your repo is public but I'm interested.</comment>


A Year-Long Undercover Plot to Blow Up Eve Online's Most Notorious Space Station - <AUTHOR> https://kotaku.com/the-year-long-undercover-plot-to-blow-up-eve-onlines-m-1831574442 <comment><USER2> Don't let The Initiative's propaganda machine disguise it: At the end of the day the biggest coalition in the game blobbed a smaller alliance, having 10x their total characters in their fleets. Somehow this is a great victory? Doesn't add up to me.

Only thing this proves is that the problem of gigantic blocks rolling over everybody in their path now extends to wormhole space.

<comment><USER3> >the biggest coalition in the game blobbed a smaller alliance

Eh, how do you figure? According to dotlan they're number 11 for space held [1] and number 8 [2] for total number of members.

[http://evemaps.dotlan.net/alliance/systems](http://evemaps.dotlan.net/alliance/systems)

[http://evemaps.dotlan.net/alliance/memberCount](http://evemaps.dotlan.net/alliance/memberCount)

Or are you just bitter vetting in which case carry on.

<comment><USER2> I was just kinda spitballing that INIT + CONDI form the biggest coalition in the game. Not sure if that's 100% true but when they're fighting an alliance that can field like 200 people maximum it might as well be. They're literally an order of magnitude larger.

<comment><USER3> Ah you're combining the goons and init? I suppose you can do that but this is about something init planned and executed, not the goons. And the article says

"Over 550 members of The Initiative logged in to answer the alliance's call to battle. Elsewhere in EVE, allied fleet commanders in The Imperium and in Snuffed Out were asked to provide additional numbers to help the operation."

The Imperium is a coalition of corps _with_ the goons but it's not exclusively made up of goons as far as I know. So it's kinda of disingenuous to dismiss this as a goon op when they weren't directly responsible for it.

<comment><USER4> If you look at the final battle report, goons outnumbered INIT dudes almost two to one.

</comment></comment></comment></comment></comment><comment><USER5> I have zero interest in _playing_ Eve, but I do enjoy reading about these enormous in-game events.

<comment><USER6> Same here. It seems so interesting I don't dare touch it for fear of addiction.

<comment><USER7> You're not missing much. The game is like war: fucking boring for the vast majority of the time, interspersed with short periods of absolute terror. Watch any Eve online streamer and note how much time they spend sitting around or flying from one place to another. [1]

My experience with the game is that the PvE elements are entirely forgettable and uninteresting. The PvP elements could be amazing, but there are too many mechanisms to favor experienced players. It's almost impossible to find a "fair" fight, even as a person with several months of experience under your belt, to the point that it's kind of a joke.

Personally, I don't have that much free time, so I prefer games with a higher ratio of fun to boredom. That being said, if I had to pick a game to play all day for a long time, Eve might be a good choice, simply because of the diversity of experiences and complexity of optimization it offers.

[1]: I just checked. Out of the top ten streamers, nine are ratting (the most boring form of PvE) and one is doing PVP, but he just got killed by five guys after ten minutes of warping around.

<comment><USER8> This was exactly my experience. It was massively boring and time consuming, except for the meta-gaming/data analysis.

Then when you finally did deal with people, they were tribal dicks and any battles were 100% lopsided to the benefit of the experienced player.

Eve Online is everything great and awful about online gaming all in one lag- filled package.

<comment><USER9> The spaceship combat is incidental, the more important part is collecting enough people that you can go look for fights that are decisively in your favor.

<comment><USER10> _the more important part is collecting enough people that you can go look for fights that are decisively in your favor_

So basically, it's like real life. "Bigger army diplomacy," as CGP Grey says. I think this is also extending to social media space.

</comment></comment></comment></comment></comment></comment><comment><USER11> One of the things about Eve Online that's fascinated me is how "open" they make the game for third party developers.

Why bother with a spreadsheet, when you can dial it up a level and use their data export and your favourite "Big Data" analysis tools to look for interesting opportunities?

Maybe you enjoy blowing up space ships, but can't think of an in-game method to fund your habit? Build a tool other Eve players will use (and pay for with Isk) instead.

[https://developers.eveonline.com/resource/resources](https://developers.eveonline.com/resource/resources)

[https://github.com/devfleet/awesome-eve](https://github.com/devfleet/awesome- eve)

[https://www.fuzzwork.co.uk/tweetfleet-slack- invites/](https://www.fuzzwork.co.uk/tweetfleet-slack-invites/)

<comment> cbm-vic-20 The IT infrastructure of some of the more organized groups rivals that of real-world corporations. Industry-oriented groups build ERP and financial monitoring systems, notifications with Slack, "office hours", etc.

<comment><USER12> Heck Sean Smith (who was killed IRL in Lybia) worked for the State Department IRL and was a high level diplomat-ish guy in game (roles seem pretty fluid in Eve thus the "ish").

</comment></comment></comment><comment><USER13> Reading it like this makes me a bit sad - but only a bit. They managed to survive and maintain the first Keepstar for over two years, and it took a huge and long winded infiltration to finally destroy it.

I'd argue that it proves that you have a big tactical advantage in wormhole space, but you're not invincible or safe. Nobody is, anywhere.

Which at the same time is a bit of a shame; I wouldn't mind having my own space station in high security space with no risk of losing it by another corporation. I'm more of a casual base building turtling kind of gamer than the pvp type.

<comment><USER14> For me, when I've read "in wormholes you don't immediately see everyone in the system on the map," my question was why it isn't the default behavior because it sounds way more fun.

Though I suppose, in the vast emptiness it might be difficult to find someone else. But a 'radar' that helps with it could have a limited range.

<comment><USER15> The only thing that's different about wormhole space is that you don't see a list of all players present in the system. This just means that you can't enter a wormhole system and immediately get an idea of how crowded it is, which makes it much more dangerous but doesn't actually change the dynamics of radars and scanning all that much.

<comment><USER16> Thats only a small part of what makes wormhole space truly different.

The entire topology of wormhole space is constantly shifting with wormholes appearing and disappearing. Hole control is paramount to fighting on jspace.

<comment><USER15> Sorry, I shouldn't have said "the only thing that's different", because there are lots of other things that make wormhole space interesting. :) I just meant it with regards to the scanning mechanics.

</comment></comment></comment></comment></comment><comment><USER17> If you're interested in more of this kind of player-made history of Eve, I highly recommend Empires of Eve, both the book and the podcast series:

[https://m.soundcloud.com/empiresofeve](https://m.soundcloud.com/empiresofeve)

The podcast is very well produced and has interviews with the major players from the early years of Eve.

Occasionally when I get the craving to play Eve, I also end up listening to a few episodes of Talking on Stations, an eve podcast that gives fascinating in depth analysis of a world I'll never have time for.

<comment><USER18> >$3,165.21 for the hardcover

Yikes

<comment><USER19> Amazon Marketplace!

Better wait for the second edition: [https://www.empiresofeve.com/](https://www.empiresofeve.com/)

<comment><USER17> There's also an $8 kindle version.

Excited to see there's going to be a second volume!

</comment></comment></comment></comment><comment><USER20> What an amazing sounding game.

I've looked at gameplay videos of EVE before and it looks so boring, but the stories that come out of it are so evidently not boring.

Strange dichotomy.

<comment><USER21> > gameplay videos of EVE before and it looks so boring

it is boring - but the game isn't the gameplay, it's the meaning behind it and the consequences. A game like World of Warcraft has fun game mechanics. But that game has no consequence, nor does the actions in the game have meaning beyond the game's lore.

EVE is different in that any action has a direct consequence on somebody else in the game - you kill a player's ship, they really lose that ship and have to replace it with another ship, which costs resources and time to acquire. You can steal from people, betray them - and make enemies. Real enemies, not fake 'factional' enemies from the lore (like the alliance vs horde).

Playing EVE is like living a second life. That's why they say 'winning' at EVE is quitting it.

<comment><USER22> > 'winning' at EVE is quitting it

Does that imply that there's wide-spread addiction to EVE (among those playing it)?

<comment><USER23> I read it more as a "A strange game. The only winning move is not to play" sort of thing.

<comment><USER24> I'd agree with this. As an engineer you'll find yourself spending more time building tools than playing the game, sat in a station most of the time, and easily spend longer on that then on your actual job. To play is to lose.

</comment></comment></comment></comment></comment><comment><USER25> Hats off to the writer for this epic account. Made it pretty clear how this event transpired even though I've never played Eve.

</comment><comment><USER26> What's the motivation for this attack?

The write-up says this operation was quite costly - 600 billion ISK in resources spent to destroy a station that cost "hundreds of billions of ISK" in the first place. Did the Initiative gain in-game resources and advantages that were worth this costs, or was it mostly just done for the challenge of doing something no one thought possible, and proving their might?

<comment><USER27> This quote from the article seems to answer your question fairly well.

> No one has ever done anything great in EVE without someone else wanting to > destroy it.

</comment></comment><comment><USER28> I wonder why we find stories like this so compelling. We see it time and time again: players work long and hard to destroy things that other players worked long and hard to create.

I'm not mocking those that find these stories compelling. _I_ find them compelling. But when I stop to ask myself why, I dont have a good answer. Why is a successful attack (and less so, a successful defense) so much more compelling than the initial construction?

Why is an Eve battle that destroys tens of thousands of dollars of value (or more) more gripping than a minecraft world with tons of detail?

<comment><USER29> For me it comes down purely to the coordinated attack aspect. There are people spending more time per day than I do at work clicking buttons in an imaginary world. Seven days a week. 52 weeks a year.

Sure that sounds like I'm setting it up to be a whole "hey, look at these losers!" kind of thing, but that's not it at all. I'm jealous. They have something they care about _that_ much and I can't imagine ever having that.

Eve in particular also has appeal to me because of all the other aspects that so accurately mirror real life. There isn't any other game I'm aware of that does that.

So in reality it's not about the destruction or construction or whatever. It's about the depth and dedication.

<comment><USER20> > "I'm jealous. They have something they care about _that_ much and I can't > imagine ever having that."

I identify with this so much. I have some friends who just pour time into games, and sure you can say that's a waste, but to have the human experience of caring that much about something must have some merit.

<comment><USER29> The only other thing I can think of that people have such a love/hate dedication to is their kids, and sometimes I worry that eventually I'm going to have kids and not find them interesting for the same reasons I don't play Eve (plus, you know, the poo).

</comment></comment></comment></comment><comment><USER30> I installed the game again during christmas, but on the login screen I was greeted by the happy little message that my carrier is currently parked in space. Will have to get the other account subscribed first just to scout the area out before activating the other.

<comment><USER31> Couldn't you just have someone else scout for you? Or you don't know anyone else in the game anymore?

Also, is multi-accounting allowed or common?

<comment><USER30> My corp has fallen apart it seems and me telling anyone will make sure that I will be without a ship a few minutes after logging on.

When you get into carriers or larger ships having multiple accounts is almost a must. The large ships used to not be able to use jumpgates to move around and the largest still can't afaik, so to move you have to log another character in the location you want to go to and set up at temporary beacon (in a sace place) that you can jump to.

What you do is you get a second account and fill your character slots with low-skilled characters who only have the skills needed to fly a cheap 'cyno'-ship and place them where you need them.

The negative being that others could figure out who always jumps into system after that one low skilled character shows up.

</comment></comment></comment><comment><USER32> This is the fascinating start of an amazing trend -- happenings in massive alternate realities are becoming newsworthy in their own right (because the complexity, scale, realism, immersiveness, and mass-participation of these simulations). RPO is well on its way to becoming real.

<comment><USER33> It's amazing how much time and effort some people are willing to spend on make-believe. At least in pro sports and entertainment there's big money on the line.

(Don't get me wrong. I admire cleverness, devotion, and capacity to organize. And this event demonstrates all three on the part of those who made it happen. But you'd think they could turn these skills toward more useful ends.)

<comment><USER32> A lot of milennials are eschewing running the rat race working 9-5 jobs to be in debt, rent, and not own anything their entire life for gaming. Once inequality reaches a certain point, everyone either checks out or revolts.

</comment></comment></comment><comment><USER34> How do you hide ships in EVE? Is the playing field just an infinite space where you can move a ship so far away that they are essentially hidden?

<comment><USER35> No, when you are not under attack and log off, ship disappears from world and reappears when you log in.

<comment><USER34> Oh, okay thanks.

</comment></comment></comment><comment><USER36> With some games, the earlier you join them, the more virtual wealth you get and the more you can do as a consequence.

Is EVE Online something a newbie can join today and not feel just like food for the lions?

<comment><USER37> Even the most oldest, most experienced players are just food for the lions most of the time.

The real trick is knowledge and specialization. You play long enough to understand what you want to do, then create a character that specializes in that and that alone.

I don't play Eve anymore, but when I did, my favorite character was a solo stealth bomber pilot. I spent most of my days in the game running around nullsec, cloaked, looking for targets of opportunity. Every once in a while I'd come across someone trying to sneak an industrial ship out into or our of nullsec and ruin their day.

</comment></comment><comment><USER38> Once again Eve proves to be much more interesting to read about than to actually play. I love these stories though.

<comment><USER39> I still have an archive of other people's videos (which I'd guess are still on some web archive or youtube channel, but maybe not) from the earlier days of EVE. The videos are far more entertaining than playing the game was 99.9% of the time. I even discovered some music via player-created EVE videos. What you see in most videos took many months to years of character skill training, a long period of trading or ratting to get ISK, and dozens to hundreds of hours preparing for just the event seen in the video. Most of those requirements (except experience of how to use the ships and equipment you acquire) can alternatively be acquired by spending a lot of money (easily running into the $1000s, at least when I played, and some people would spend that, just to find the whole thing tedious and quit shortly after) on good characters and ships and stuff, but even then PvP is mostly boredom (masked and made "fun" by adrenaline).

Someone with the idea that they want to be just like one of those characters they see in a spectacular EVE video, or that they hear about in an EVE story, is like the kid seeing or reading about astronauts and thinking they want to be an astronaut. Except most people who grow up wanting to be astronauts never become astronauts, and same with any particular goal in EVE. And what happens in EVE stays in EVE. Even if you achieve something notable in EVE, something that requires a lot of effort... it's still in someone else's virtual universe sandbox that could be turned off or changed on their whim.

The chance that you'll ever be directly involved in corp- or alliance-level "big events", other than as cannon fodder, is almost zero unless you know ahead of time you have what it takes to join or build, and then run and manage that kind of enterprise at the equivalent of the c-suite level. Still, 99.99% of your time will be taken up with ordinary stuff. It's a job.

</comment></comment><comment><USER40> I quit EvE a long time ago (2005-2010), and these stories remind me why the game got so stale. Meta-gaming mixed with betrayal is fun to write about, and is a great example of bugs becoming features, but being part of it isn't actually all that enjoyable. Its just something to do when you want to do _something_ that has an effect on _someone_ , because the game has no interesting challenges left to offer.

In the end game you can highsec carebear, or you can sit in a nullsec blob. WH space was a band aid trying to cover the fact that they ruined the risk/reward system between high/low/nullsec, but it was enjoyable none the less.

It was still a great game, and back when I played there was nothing like running around lowsec at -10, or just pulling security for small gang mining operations, or any other small group/solo stuff.

</comment><comment><USER41> >With all of the assets finally in place, there was only one thing left to do. On December 8...

So, Pearl Harbor?

<comment><USER42> One day late… [https://en.m.wikipedia.org/wiki/Attack_on_Pearl_Harbor](https://en.m.wikipedia.org/wiki/Attack_on_Pearl_Harbor)

</comment></comment><comment><USER43> The politics of EVE are incredible. I just don't understand how anyone finds time, though.

</comment><comment><USER44> That was an exciting read.

I'm almost tempted to try out EVE again.

<comment><USER45> What I remember of playing it 12 years ago was that I became quite adept at spreadsheets.

<comment><USER13> That's one aspect of the game, mostly industry or mining IIRC. That's an area that could use some shaking up, because it's pretty much impossible to be profitable if you're a beginning industrialist. Mining works (that's one thing I started off with), but it can get kinda boring if you're trying to optimize it.

The game could do with a bit of modernization in the beginning player's enjoyment and positive reinforcement feedback loop (if that makes any sense). I'm wondering how best to achieve that; maybe make the missions a lot more streamlined, add a bit of story to it, some more cutscenes and voice acting maybe.

I'm imagining a questline where you end up building your own safe base now; one thing I don't like is how you can't really build your own starbase without constantly having to shut it down or rebuild it due to war declarations. What I'd like to see is something like player owned housing in other MMOs where you can build your own starbase inside of an instanced, unreachable pocket.

It would need to have some restrictions, I guess, in e.g. how much you could store there and how much money you could earn there - Eve is all about risk vs reward, and all reward with no risk won't work.

But anyway, a questline to eventually build a starbase, and follow-up quests that develop the base in a variety of directions would be neat.

<comment><USER46> How well would it work as a testbed for learning algorithms? I heard that you get good access to game data etc. Would it be feasible to be profitable at mining if you have a great prediction algorithm? I know nothing about the game but that would sound interesting as a nice dev-sideproject for structured data algorithms. Can you automate/script the trading/mining etc. or is that forbidden/considered botting or whatever?

<comment><USER47> Mining is a venture that benefits less from predictive optimization and far more from operational scale. Barring black swan events, having perfect market prediction is nowhere near as valuable as being able to strip mine systems with an Orca/Rorqual account boosting a fleet of miner accounts.

</comment></comment></comment></comment></comment><comment><USER48> Have there been any "viruses" or "hacks" within the game?

</comment><comment><USER49> Was the problem that Hard Knocks didn't patrol the inside of its wormhole?

<comment><USER50> I don't play Eve. Is it possible to patrol inside the wormhole? If possible, is it practical? (e.g., if there's a lot of volume to be covered it can be possible but not practical.)

If so, this is going to be a one-off event most likely.

<comment><USER51> It's time-consuming and tedious to monitor every wormhole that is created and destroyed. In practicality, player teams (corporations and alliances) monitor their local wormholes while players are logged in, but most teams don't have enough people in enough timezones for anything like total situational awareness.

</comment></comment></comment><comment><USER52> Is there any other game that has been consistently making "the news" for a decade?

<comment><USER53> Minecraft I would say, but for creations, not stories. Eve Online so far seems really unique in being the only sandbox-game which also hosts a massive number of players in a single instance. Without the impressive numbers those stories would be more casual and less interessting, probably not even happening.

</comment></comment><comment><USER54> While reading this account with interest (I'm never played this game) I realized this is how it must feel to a non-bitcoiner to read so much jargon and descriptions in just one short account.

</comment><comment><USER55> Why'd they do this?</comment>


In defense of client certificates - <AUTHOR> http://blog.bimajority.org/2015/10/05/in-defense-of-client-certificates/ <comment><USER2> The state of client side authentication is abysmal, and has been since the 90s, for a number of reasons. The UI is bad, there's no way to log out, and the server has no control of how and when dialogs pop up.

Things started to go sideways when web developers wanted to exercise control over login form presentation, which just makes it very hard to prevent scripts to tamper with them, and the heavyweights that control web browser development simply has had no interest.

I'd like to see the above implemented, it's also time to get SRP in there, and an opportunity for servers to serve pre-filled CSRs, just like the article describes. I just don't know how to get there. Perhaps the bigger institutions such as CERN (they certainly have the respect required) can take a more active part in web browser development.

In the mean time, we still have Kerberos (and HTTP Negotiate). It works well for always online internal applications, and you don't have to mess about with revocations.

<comment><USER3> > In the mean time, we still have Kerberos (and HTTP Negotiate).

There's also this implementation of Kerberos in client-side JavaScript:

[https://webathena.mit.edu/](https://webathena.mit.edu/)

[https://github.com/davidben/webathena](https://github.com/davidben/webathena)

HTTP Negotiate is also super messy in similar ways (For instance, I'm not sure how to authenticate using IE if your current Windows account is a local account instead of a domain one). It definitely works, but not well.

</comment></comment><comment><USER4> Client-side certificates are pretty much a requirement within the U.S. DoD space. And the CAC (smartcard used for logins and ID) are widely deployed right now and used for authentication to such sites. To say that we need to do away with cert auth is a non-starter, given how much gov't buy-in and money has been used to roll these out. The real solution is to fix the support and standards in the various browsers to make all of these "issues" a moot point.

If you've got a TRUSTED certificate authority (your definition of "trust" may vary) and secure key storage (PKCS#11 smartcard, etc.) then certificate-based authentication gives you a tremendous amount of authentication security.

<comment><USER3> Well, the primary thing being deprecated right now is <keygen>, not certificate auth as a whole, so if you have a CAC you don't care about <keygen>.

But also -- why does it make sense that _any website on the public internet_ can potentially find your US-government-signed identity? That's not even a thing the government wants. You can just do logins against a single government-run service and limit authentication to that one origin, and have it produce signed, encrypted statements that you can pass to other authorized servers. And then you also get auditing, revocation, etc. through that single service.

<comment><USER5> Typically you'd only insert your CAC on sites already trusted by your machine, and your machine only has those DoD certs if it's been provisioned by DoD.

<comment><USER3> What does it mean to insert it "on" a site? I have two dozen tabs open; how should Chrome know that my authentication information should go to the government but not to Hacker News?

It seems to me like you necessarily want a custom solution and custom software here; I'm not understanding how the removal of client-cert support from public builds of Chrome or Firefox would be a problem.

(I've never used a CAC, so this might be a dumb question.)

<comment><USER5> When you go to a DoD CAC-enabled site, typically you'll first see a click- wrapper page saying "This is a DoD site, blah blah perjury, prison, blah". This page will present a certificate signed with a DoD CA that only DoD- provisioned machines have. The DoD has a whole suite of CAs for different departments and security levels, which keeps things compartmentalized.

When you click through, you'll be directed to a page that, via standard SSL, requests a client certificate which triggers the browser prompt. At this point, you insert your CAC and select the certificate it contains. After you enter your PIN to unlock the certificate, your browser sends your client cert back and the site verifies that your CAC was issued by the CAC CA and that it hasn't been revoked, then HTTPS proceeds as normal.

The trick is that CAC certificates can't be used blindly, since you have to enter your PIN every time it gets used in a new session. Public sites can't just request a client cert without triggering the prompt and making you re- enter your PIN, and typically the CAC isn't inserted when you're not using DoD sites or on the DoD VPN.

</comment></comment></comment></comment></comment><comment><USER6> It's not just enterprises that use client certificates, Estonian ID cards use them too.

[https://www.ria.ee/public-key-infrastructure/](https://www.ria.ee/public-key- infrastructure/)

<comment><USER7> Same here in Portugal (though they're optional), for logging in to the IRS website and others.

</comment></comment><comment><USER8> _There is a move afoot among Web browser developers to remove an authentication mechanism that many enterprises depend on: SSL /TLS with X.509 client certificates._

I didn't know that. Worrying as, as stated, a lot of enterprises do depend on them. Is there a suggested alternative?

<comment><USER3> If you've got a server you're comfortable typing passwords at (which you probably are, if you're using <keygen>), you ought to be able to set up some sort of server-based authentication like Shibboleth or OpenID Connnect (which is really more of an OAuth than an OpenID...).

If you want something that matches X.509 client certs closely, WebCrypto + localStorage + either an extension or a static site (to host the JS that can get access to your localStorage and sign a site-specific token) ought to work, though I'm not sure I know of any out-of-the-box implementations. Mozilla Persona is essentially this, although since it's a somewhat different use case it's probably not an out-of-the-box thing.

Google would probably encourage you to use FIDO UAF. [https://fidoalliance.org/specifications/overview/](https://fidoalliance.org/specifications/overview/)

</comment></comment><comment><USER9> Were also using authentication with client certificates. Even with Firefox its a mess. We had our authentification break twice in the last 2 years with Firefox. Chrome sometimes just doesnt work and IE seems to work pretty often. But if it doesnt even a settings reset or IE reinstall doesnt fix it. Installing Windows again so it works feels like the good old times with Windows 9x.

</comment><comment><USER10> It's a pity this article is based on a false premise since it could have contributed to the discussion more usefully. What's being removed is the keygen tag, not client certificate support - the two are independent.

</comment><comment><USER11> Even new and shiny stuff uses client certificates. RE: Kubernetes ([https://github.com/kubernetes/kubernetes/blob/master/docs/ad...](https://github.com/kubernetes/kubernetes/blob/master/docs/admin/authentication.md#authentication- plugins))

Loading this into the browser is often desirable for access to the proxy API.

</comment><comment><USER12> Both browsers take patches. If enterprises need them so much, get some of their vast mountains of money from them to fix the problems.

</comment><comment><USER3> Every single one of the purported advantages of client certs here can be done with WebCrypto + localStorage, right?

(I've even heard of people looking at polyfilling client certs with an implementation based on WebCrypto and localStorage.)

<comment><USER13> Apart from the advantage that it's very easy to prevent requests which don't have the required client certificate from even hitting your application, which is a major security win.

<comment><USER3> Well, they're hitting your web server because you don't want a hard-required client certificate. (I've administered a server relying on a larger deployment of client certs than OP's; browser compatibility is a mess, and `SSLVerifyClient require` is a mistake.)

Yes, you can set things up on the server side so that it hits a static page instead of your web _application_. But you can do that with the JS-based solution too: have it send you to a login page with a signed query-parameter or similar, and verify that query parameter in the web server configuration. If it fails / doesn't exist, deliver a static site that includes the necessary JS to do the login.

Your web server will need to verify a signature or MAC there, but this is way less attack surface than the usual client-cert processing code in SSL stacks (which processes untrusted keys and signatures). Removing that code will be an equal or greater security win.

Basically, if there is interest in engineering a good application-level solution instead of relying on the transport-level one, it can absolutely be done. (I do freely admit there isn't anything that can be used out-of-the-box today, to my knowledge.)

</comment></comment></comment><comment><USER14> Debian single sign-on (SSO) recently switched to using client certificates.

See [https://wiki.debian.org/DebianSingleSignOn](https://wiki.debian.org/DebianSingleSignOn)</comment>


How much does employee turnover really cost? - <AUTHOR> https://medium.com/latticehq/how-much-does-employee-turnover-really-cost-d61df5eed151 <comment><AUTHOR> I'm still constantly told by engineering friends that the easiest way to get a raise is to get a new job. That indicates to me that employers aren't that worried about the costs of turnover.</comment>