Ask HN: What are your favorite / least favorite site layout styles? - <AUTHOR>

I'm a coder, not an artist.  I find myself spending too much time agonizing over how to make my sites look.  I thought I'd ask folks what they preferred.
For example, what width?  I've recently begun using the 960.gs grid system (960 px wide).  I notice that most new sites are still using something narrower.  Is 960 still considered by most to be too wide?
How about framing the content like hacker news does, vs an open format like Google does?  Again, I notice that most new sites seem to be abandoning the framing, in favor of the open style, or a hybrid style, where the header is open, but there is framed content underneath.
Then there's the whole landing page business.  Do you clutter up the landing page with information like 37 signals, or do you leave the landing page uncluttered, with a prominent link to the "sales page" like dropbox does?
I know this is all just personal taste, opinion, etc, but I'd be interested in yours. <comment><USER2> Design depends on your target audience.

1\. Page Width

If your target audience is tech un-savvy folks - go with a narrow screen width. 780 pixels. If its folks keep up with technology, go with 960 pixels.

If you're designing for cellphones, reduce your width accordingly.

2\. Column width

Readability tests have shown that 50-60 characters per line is the optimum. More text than that per line and people's reading speeds decrease. And their comprehension takes a dive too. So sticking with 500 pixels per column of text is generally a good idea.

3\. Landing page style

Basic formula to keep in mind is: AIDA

* Attention

* Interest

* Desire

* Action

Follow them in sequence.

Good post to read: <http://zygote.egg-co.com/designing-to-sell/>

Advanced formula is creating landing pages based on your target audiences personas.

Step 1: Figure out all the types and segments of people who will visit your website. <http://www.futurenowinc.com/personas.htm>

Step 2: Determine what you need to do to persuade each of these types of personas to take action

Step 3: Create different navigational pathways for each of these persona types.

Good book to read: Waiting for Your Cat to Bark [http://www.amazon.com/Waiting-Your-Cat-Bark- Persuading/dp/07...](http://www.amazon.com/Waiting-Your-Cat-Bark- Persuading/dp/0785218971) (Note: its a book with excellent content but reads like a boring textbook.)

Good website to deconstruct and learn from: <http://www.theleodiamond.com/> (This website is created for 6 different persona types.

* Very curious analytical type people who research before buying

* Folks who are fashion conscious

* Girls choosing the diamond

* Guys choosing the diamond

* Media, investors etc

* Folks who already know about Leo Diamonds and just want to find the nearest location

Can you see how different keywords and linking / navigation structure is used for each of these personas?)

</comment><comment><USER3> Hmmm - I don't know that I have a particular style that I like; I'm more of a, "When I see what I {like | dislike}, I know it immediately." That probably doesn't help.

For our site, we went with the fixed width layout and I'm happy. For more link-driven/based sites (a la reddit/hn/digg), I prefer a full screen layout I suppose since I don't want to scroll forever.

For landing pages, I wish I could tell you anything useful. What I've found, after several years of trying to predict what would be successful, is that I suck at predicting what people will like. Test, test, test...

I suppose to me it all boils down to one thing: usability. Gorgeous designs fail if they aren't usable and crappy designed sites who fit a need thrive. Now I'm just rambling...

Here's a couple of book recomendations:

* "Letting Go of the Words: Writing Web Content that Works" by Janie Redish - fantastic book. It isn't about design/layout per se but it is, see?

* "Don't Make Me Think: A Common Sense Approach to Web Usability" by Steve Krug

</comment><comment><USER4> I like sites that mix liquid width style and fixed width (centered) content. I vary my site's width with how much content there will be and try to balance the whitespace out with the amount of text/content, usually between 800 and 950 pixels wide.

As for landing page, I think it should highlight whatever is the most important part of your site. The first thing I should notice is what you do and if I'm interested, have a well defined navigation so I can learn more.

On a truly personal note, I love big footers from both a design and usability point of view :)</comment>


Ask HN: How do you deploy your applications? - <AUTHOR> Be it web apps, workers, stateful applications, how do you deploy them?<p>* Fabric/Capistrano * kubernetes deployments with kubectl * Jenkins jobs * other <comment><USER2> Just follow the hype from community sites, if you see a tool gaining respect from other devs, adapt it asap, sit back and enjoy the party.

</comment><comment><AUTHOR> At $work we use shipit-engine by Shopify to deploy to kubernetes.</comment>


Ask HN: SendGrid billed a CC I never typed into their app. How is that possible? - <AUTHOR> Hello there, HN,
Last week I was wrongly billed $21 on a SendGrid account I haven't used for three years. They billed me for a "dedicated IP address", but my free account doesn't even have access to that feature.
I contacted their support and they promptly acknowledged the fact that it was an error on their end and the payment was refunded.
Now to the weird part: the credit card they charged was issued on April, 2019. The last time I logged into their website was December, 2017. After I got billed, I logged again and there is no mention of any credit card registered on my account (when I go to "Billing", it asks me to enter my first payment method).
I also never used Twilio, which recently acquired SendGrid.
So, how on earth did they get access to that credit card number? I only register it on services I trust (Google - GSuite, Amazon - AWS, DigitalOcean, Netflix etc), and I generate a virtual credit card number for all one-time payments. The only possible way I can think of is if any of the companies I previously registered that credit card number shared it with SendGrid, which would be completely absurd.
When support notified me I would get refunded, they dodged the CC question. When I asked again, their full answer was:
"Thank you for following up I appreciate your patience. At this time our billing team is still looking into how this happened. Again, I'm very sorry for the inconvenience."
And now, 3 days later, the ticket was closed without additional information.
Do you folks have any idea what may have happened here? Am I missing something? Is there a magic API to get someone's CC number based on a previous one? <comment><USER2> Yes, there _is_ a magic API to get someone's CC number based on a previous one. It's called Visa Account Updater and MasterCard Automatic Billing Updater.

[https://usa.visa.com/dam/VCOM/download/merchants/visa- accoun...](https://usa.visa.com/dam/VCOM/download/merchants/visa-account- updater-product-information-fact-sheet-for-merchants.pdf)

[https://www.mastercard.us/content/dam/mccom/en- us/issuers/Do...](https://www.mastercard.us/content/dam/mccom/en- us/issuers/Documents/Mastercard-Automatic-Billing-Updater-Merchant- Global-2017.pdf)

</comment><comment><USER3> Similar issue with Bank of America debit card. Security guy for bofa said if vendor is determined. They can contact MasterCard and obtain new card info.

<comment><AUTHOR> Wow, had no idea such thing existed. Thanks for the information!

Now I wonder why their support did not say that...

<comment><USER4> The support person probably doesn't know about this capability.

</comment></comment></comment><comment><USER4> When a card is updated, the merchant (via payment provider) can request the updated card details. This is meant to avoid disruption in recurring charges, but has the side-effect of surprising unsuspecting customers. If you don't like this functionality, your bank/card issuer may let you disable, but there are no guarantees.

</comment><comment><USER5> This belongs on Reddit along with the "I bought some Pringle's and almost all of the chips were broken" posts. Call the bank, cancel the charge and report it as unauthorized. End of drama.</comment>


Go native, HTML will lag for a while - <AUTHOR> http://blog.suthakamal.com/2012/08/go-native-html5-is-going-to-lag-for.html

<comment><USER2> Good points and I agree with the general conclusion.

One aspect of building a mobile HTML app that soundly beats the native alternative is iteration speed. Not having to wait for the approval (and possible resubmission) turnaround time can be quite an advantage especially early on.

The key is being able to transition to a native app quickly - an interesting thoughts for the phonegaps and other html wrappers of the world.</comment>


Intel Says No to Ubuntu's New Display Server - <AUTHOR> http://news.softpedia.com/news/Intel-Says-No-to-Ubuntu-s-New-Display-Server-381223.shtml <comment><USER2> The site that plagues Google with shitty search results by scraping Github and other websites and removing source links brings us a summary of yesterday's news via a spam account.

For extra fuckwittery they even nofollow the source links they steal their news from.

Stay classy, Softpedia!

[https://news.ycombinator.com/submitted?id=hanuca](https://news.ycombinator.com/submitted?id=hanuca)

[https://news.ycombinator.com/item?id=6347244](https://news.ycombinator.com/item?id=6347244)

<comment><USER3> Why don't we simply blacklist Softpedia and other bullshit sites from HN submissions.

</comment></comment><comment><USER4> For those interested, this comment is caused by this commit revert: [http://cgit.freedesktop.org/xorg/driver/xf86-video- intel/com...](http://cgit.freedesktop.org/xorg/driver/xf86-video- intel/commit/?id=0c697aee9b3767be7d1e04e4e4f9d304f23b188a)

So originally the XMir support was merged in, then reverted on instructions from Higher Ups.

I can't really blame them, if they make driver changes Intel would have to adapt the XMir code to cope with them.

<comment><USER5> What is the reasoning for putting this code in the video driver?

The "Theory of Operation" comment in the merged-then-reverted code is insightful. Apparently, the code is supposed to figure out which parts of windows are damaged, and then tell the windowing system to do something about it.

IMHO, windows are not a concept that should even exist in the video driver [1]. They should be entirely under control of the windowing system. Which means that figuring out which parts of windows are damaged is logic that should totally reside in the windowing system, having no parts in the video driver.

If this code must be in the driver because it needs to access private data/functionality that's not visible outside the driver, then an API to expose those driver internals to the windowing system would be a design that better separates those layers.

Reverting this commit seems like a sound technical decision to me. Assuming Intel's decision is politically motivated, and then getting outraged about it, seems counterproductive.

[1] Even if this concept has already leaked into the driver for X or other windowing systems, doesn't mean that questionable designs used in old code should be allowed in new code.

<comment><USER6> Not really informed here but I would venture a guess that 'perfect separation of concerns' causes a performance hit. In the backend web dev world you can usually suck that up by making the load parallelizable across servers, something you don't have the option of doing with code running locally. In other words, 'separation of concerns' is great until you hit a performance bottleneck, as you often do with any resource constrained system.

</comment></comment></comment><comment><USER7> According to Phornoix, Chris Wilson of Intel wrote this in a Git commit:

 _We do not condone or support Canonical in the course of action they have chosen, and will not carry XMir patches upstream._

[http://www.phoronix.com/scan.php?page=news_item&px=MTQ1NjY](http://www.phoronix.com/scan.php?page=news_item&px=MTQ1NjY)

Phoronix's link to said commit does not work, so it is hard to infer context. But I would assume that "the course of action they have chosen" refers to working on Mir in the first place rather than contributing to Wayland. If that's the case, can't say I really blame Intel.

<comment><USER8> ""the course of action they have chosen" refers to working on Mir in the first place rather than contributing to Wayland. If that's the case, can't say I really blame Intel."

I absolutely blame Intel. Whatever you think about Ubuntu's decision to make their own X server, it is childish to not include working patches for purely political reasons. It's not like Ubuntu is asking Intel to do their work for them.

So Canonical got railed for not contributing upstream, and they try to contribute upstream they get everyone blaming them again? That's ridiculous.

<comment><USER9> Most upstreams will generally accept responsibility for keeping code working - just having it "merged" often means then handling bug reports, testing, etc. If the Intel people don't want to maintain specialized Ubuntu-only environments just to test the Mir codepaths, that's kind of their call.

It probably also didn't help that Canonical employees were using it as a political football to boot other GPU vendors, e.g. [https://twitter.com/olliries/status/375704285083738112](https://twitter.com/olliries/status/375704285083738112)

It was Canonical's decision to fork, if they have to bear the costs of the fork then so be it.

<comment><USER8> The old classic argument around why Linux doesn't have a rigid internal API comes to mind ([http://www.kroah.com/log/linux/stable_api_nonsense.html](http://www.kroah.com/log/linux/stable_api_nonsense.html)). Maybe there are commonalities between supporting Mir and Wayland that would allow Intel to create a more universal piece of software? If Canonical does the work to make the driver universal, wouldn't the whole community benefit?

I'm not a big fan of letting politics get in the way of engineering, and this smells of the fact that Intel is trying to battle ARM in a proxy war, with FOSS as collateral damage.

<comment><USER10> > Maybe there are commonalities between supporting Mir and Wayland that would > allow Intel to create a more universal piece of software?

This still increases cost on the part of Intel.

</comment></comment></comment></comment></comment><comment><USER11> Choice is good, but for too long has open source been fighting among itself. I commend Intel for doing this. They're hardly alone after all, they're just joining Kde, Gnome, Enlightenment and all the other open source projects that embraced Wayland.

</comment><comment><USER12> Maybe this means Canonical will focus more on ARM hardware now, which is kind of the point of Mir anyway - to be a lot more efficient on "lower-end" mobile hardware like ARM chips. Can't say I wouldn't like that to happen.

<comment><USER13> Or Canonical's packagers will just carry on patching the Intel drivers?

<comment><USER14> That works fine because Intel has open source drivers. Not so much if NVIDIA and AMD decide to only support Wayland.

<comment><USER13> True enough. No support for NVIDIA cards at all in current Ubuntu betas. I _think_ even nouveau was falling back to X compatibility but I might have that wrong. It was sloooow

</comment></comment></comment></comment><comment><USER15> Why would any party make such a hostile announcement in the FOSS scene? I'm not all that involved in that scene, but surely this approach is counter- productive? Especially if you can't back it with a sound technical reason.

<comment> Tuna-Fish > Why would any party make such a hostile announcement in the FOSS scene? I'm > not all that involved in that scene, but surely this approach is counter- > productive?

Something like this is actually quite common, and more or less necessary.

In proprietary software development, there is typically some hierarchical authority that makes design decisions. You might debate for a while, but eventually _someone_ is going to come up with a decision of how things are going to be done. In FOSS, no such central authority exists, so design of inter-related projects is effectively a distributed negotiation. Usually, things are done amicably, everyone is happy to share each other's code, and disputes are handled peacefully. However, every now and then there is a situation where two entities simply cannot agree, and one of them has to put the foot down and say: "No, this is a bad idea, we won't spend the effort helping you do this. If you want it, do it yourself."

And since it's all a very public negotiation, making this kind of announcement is just one step up the ladder of escalation from a private email declining a patch. As flames go, it's rather tame. :)

> Especially if you can't back it with a sound technical reason.

Intel absolutely can, and has, for hundreds of times over the past few months. At some time you just have to give up on trying to convince the other people and do something useful.

</comment></comment><comment><USER16> It seems there's similarities between Wayland and Mir:

[http://en.wikipedia.org/wiki/Mir_(software)](http://en.wikipedia.org/wiki/Mir_\(software\))

"Mir, like Wayland, is built on EGL[6] and utilizes some of the infrastructure originally developed for Wayland[7] such as Mesa's EGL implementation[6] and Jolla's libhybris."

So why didn't Canonical just use Wayland, I thought that was their plan forward a couple of years ago?

Whatever they do I hope they don't screw up Ubuntu 12.04's excellent ability to play Steam based games.

EDIT: Read the controversy of the Wiki article, interesting insights.

</comment><comment><USER17> What an awful move. Note that they are deliberately hurting open source software by restricting contributions for a purely political reason.

Obviously it will result in an Ubuntu fork of the intel drivers, which will eventually lead to a situation where the only consequence is a more painful workflow for Ubuntu core contributers and early adopters looking for up to date drivers.

<comment><USER18> I don't see how it's political to let Canonical keep the burden of maintaining code that only they care about...

<comment><USER19> Is that what is happening here? Intel's explanation of "The Management" handing down orders doesn't imply technical reasons were the motivation. It's unclear.

If there are technical reasons - like the one you mentioned - let's hear them, they might be valid.

<comment><USER20> Does anyone else see the "-The Management" comment as having more than a tinge of sarcasm? I think people are taking it a little too seriously.

<comment><USER21> [http://cgit.freedesktop.org/xorg/driver/xf86-video- intel/com...](http://cgit.freedesktop.org/xorg/driver/xf86-video- intel/commit/?id=0c697aee9b3767be7d1e04e4e4f9d304f23b188a)

Note "Ordered-by:" line, clearly intended to communicate Chris Wilson was ordered to do this, rather than doing it of his own accord.

<comment><USER20> You still see no attempt at humor or lightheartedness in this? May I remind you that his email ends in .co.uk, so many people may need to apply a "British humour filter". Most of his commits have "Signed-off-by:" with a name; he replaced "signed-off" with "ordered" and the name with a vague reference to "The Management".

The further context I was thinking of was this:

[http://cgit.freedesktop.org/xorg/driver/xf86-video- intel/com...](http://cgit.freedesktop.org/xorg/driver/xf86-video- intel/commit/?id=58a7611ccfda88c7cbcc62b25b787d6b0fa64081)

<comment><USER21> I'm obviously aware of both commits, and of much, much further context beyond the commits. No, I see no humor or lightheartedness. Signed-off-by is not just something Chris made up, it's a pseudo-standardized line for git commit messages.

Further context I'm aware of is that Chris explicitly accepted and applied the patch after working with the developers to get it right, along with other signs of cooperation.

Yet more context I'm aware of is much of the political bullshit surrounding Mir, Wayland, Canonical, Red Hat, Intel and really the entire FOSS community at this point.

This isn't a joke. This is Intel's management intervening.

<comment><USER20> > I'm obviously aware of both commits, and of much, much further context > beyond the commits.

Maybe you should share that first, rather than leaving it implicit. (If your comment tells the whole story I am unconvinced. OK, so the guy merged a patch, then it turns out he did not in fact have the blessing of his employer, so he reverted it with a slightly snarky commit message. Any more context I should be aware of beyond that? It does not sound like a huge conspiracy to me.)

Edit: also, what does "The Management" mean? This guy's immediate supervisor? Intel CEO? I feel like some people are taking an oddly paranoid reading of the situation. I don't know anything about Intel specifically but I have worked at a large company, I am willing to bet that the higher you get in Intel's management the less they care about Ubuntu.

<comment><USER21> No, I'm not about to spend days or weeks trying to impart knowledge of the history, values, and practices of the entire FOSS community on you.

You're free to continue acting smug about things you don't understand and building strawmen left and right (I note this is at least the second time in the last week you've done this), but you should stop expecting others to do the heavy lifting for you.

<comment><USER20> You made it sound like you had inside knowledge of Intel's decision making process that is relevant here. If that's the case I think you should disclose it instead of getting mad at me or assuming it is universal knowledge.

Our thread from last week is totally unrelated to any of this. I would rather not engage in discussion that is based on personal animosity. Let's stay on topic.

<comment><USER21> No, I didn't make it sound like that. You are, once again, inventing a strawman, and drawing wild conclusions based on insufficient knowledge. Last week's thread is not unrelated. It shows the same pattern of inane, bad-faith behavior.

<comment><USER20> So saying that publicly signing something "The Management" while working in a company the size of Intel is comically vague, and saying people should lighten up a bit without additional info and perspective, that is acting in bad faith? I am not trying to offend anyone with this commentary, it is my own opinion.

<comment><USER21> > _So saying that publicly signing something "The Management" while working in > a company the size of Intel is comically vague_

You didn't say that.

> _saying people should lighten up_

You didn't say that, either. Which is good, because "lighten up" is not, has never been, and will never be a reasonable thing to say to anyone, anytime, anywhere.

Your original comment wasn't unreasonable. Where you started going off the rails was initially with "May I remind you", which is patronizing.

Then "Maybe you should share that first, rather than leaving it implicit.", chiding me for failing to magically know that you lacked knowledge that is relatively common within the set of people who care about the subject at hand.

Then you characterized my statements as describing a "huge conspiracy". Being unaware of any "huge conspiracy", only a lot of wide-open politics, this is, to me, at once puzzling and insulting. "oddly paranoid" makes it even worse.

Then you accuse me of pretending to have inside knowledge of Intel, when I did no such thing, and did not intend to, and say I should "disclose" this thing I don't have, as if I'm trying to hide something.

And now you seek to rewrite history.

<comment><USER20> I am pretty sure I did say these things. But nevermind. More importantly I don't think I'm guilty of nearly the malice you ascribed to me, and a part of me is wondering where you are based on the off chance we can share a beverage of your choice and you can see I'm not a monster. Is it the thread from last week that has you angry at me?

<comment><USER21> I didn't even know who you were until your third comment, which sounded eerily familiar. And there are certainly no circumstances under which I would voluntarily associate with someone who displays your pattern of lashing out whenever they don't understand something.

<comment><USER20> Well, I tried. I would humbly suggest that one person's "lashing out" could be another's simple misunderstanding.

In the meantime I think there is a phrase you used to describe me, something along the lines of "willful misinterpretation"; I believe you may have done the same for me.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> I don't know what to say here. I'm still running Ubuntu but the phone-tablet- desktop eat it all strategy got me seriously concerned. Come on, Microsoft can't do that with its deep pocket, neither does Google, you just don't eat more than you can chew, not to mention you have no market share in any of them yet. Focusing on ubuntu server LTS, charging service fees, focusing on cloud platforms, while maintaining a free desktop to keep a wide user base, seems more reasonable to me.

</comment><comment><USER23> Political talks aside, it looks all good. Intel will develop code for Wayland (which potentially will be used in all but Ubuntu distros) and Ubuntu will be working on adding patches for XMir on their own since XMir will be used only in Ubuntu. Eventually either XMir will be proven better and more distros adopt it and then it will be more reasonable for Intel spend time on integrating drivers with XMir.

No real news here.

</comment><comment><USER24> There is one vendor using Mir. One. I don't blame Intel for not backing it.

<comment><USER25> And there are zero using Wayland. Zero.

<comment><USER26> Wayland packages have been in Fedora since 18 (it's at 19 now and 20 is to drop in under 3 months time). You can already start testing your apps to see how they work in Wayland, and it's on the roadmap to being integrated as the default. Gentoo and Archlinux also appear to have experimental support and plans to switch.

<comment><USER27> > Gentoo and Archlinux also appear to have experimental support and plans to > switch.

Indeed, but the problem with Wayland is that one can't just 'switch' from X. Wayland provides graphics multiplexing; that's it.

Possibly mangled analogy: it's like saying we're switching from a LAMP stack to Postgres; it doesn't make sense as a statement.

<comment><USER28> >the problem with Wayland is that one can't just 'switch' from X.

Does switching to a wayland compositor by default and using xwayland for the applications that still can't talk to it not sufficiently address that? At least as practically as is possible when replacing a popular piece of interoperable software with a large user install base?

</comment></comment></comment></comment></comment><comment><USER29> [https://wiki.ubuntu.com/Mir/Spec](https://wiki.ubuntu.com/Mir/Spec) doesn't even consider remoting, and to date Wayland has just punted on it. Is there any way they can both lose? The brief era of only caring about the machine under my desk is coming to an end, and any display system that isn't designed around accommodating latency is going to become a terrible mistake.

</comment><comment><AUTHOR> True or false?

<comment><USER30> True:

[http://cgit.freedesktop.org/xorg/driver/xf86-video- intel/com...](http://cgit.freedesktop.org/xorg/driver/xf86-video- intel/commit/?id=58a7611ccfda88c7cbcc62b25b787d6b0fa64081&utm_source=anzwix)

Intel is the most active company in Wayland developement too.

</comment></comment><comment><USER31> This is a totally bullshit way of managing a FOSS project. You should never remove working code from a FOSS project if someone is already maintaining it and that someone represents a major chunk of your users. I hate that Ubuntu guys are moving away from X/Wayland (so suddenly and in a close-is way), but treating them like this indirectly is wrong. We got to play fair with the FOSS eco-system.

<comment><USER32> Not sure it deserves the down votes you got but I think you are very wrong. If you are running a project you can remove what you want, if someone wants something different enough they can fork it. If you do it early before many people are using it you will get far less complaints than when there are millions of users.

Adding code, and features places further requirements and limitations on further changes and any feature added and widely used will become nearly impossible to remove later.</comment></comment>


Ask HN: What are the most well-made iOS apps? - <AUTHOR> I use, and have purchased, some incredibly well-made iOS apps (Tweetbot, Overcast, Scanbot, Citymapper, Signal, Cloak, among others). Can anyone offer suggestions for apps that you love and find useful? The App Store isn't a great discovery tool in this regard. I'm happy to pay! <comment><USER2> I'm not sure if it is in your region, but Transit [0] recently blew me away. A ton of attention to detail and work put in, check out the blog post they had on HN recently about their autogeneration algorithms [1].

[0] [https://transitapp.com/](https://transitapp.com/) [1] [https://medium.com/transit-app/how-we-built-the-worlds- prett...](https://medium.com/transit-app/how-we-built-the-worlds-prettiest- auto-generated-transit-maps-12d0c6fa502f#.t4mzg3h0x)

</comment><comment><USER3> I use Pythonista[0] frequently for iOs automation/thinkering/prototyping and it is definitely my favourite iOs app, great value for the money spent.

Ole Moritz, the developer is very attentive to detail, dedicated with frequent releases and creative in that the app provides very useful and easy modules to interact with iOs native functionalities.

I also found the community[1] to be lively.

Check out the docs[3], specifically the "Pythonista Modules" section if you want to get an idea of what the app is capable of.

P.s. Also check out his other app, Editorial[2] if you need a plaintext editor on steroids!

0: [https://itunes.apple.com/us/app/pythonista-3/id1085978097?mt...](https://itunes.apple.com/us/app/pythonista-3/id1085978097?mt=8) 1: [https://forum.omz-software.com/](https://forum.omz-software.com/) 2: [https://itunes.apple.com/us/app/editorial/id673907758?mt=8](https://itunes.apple.com/us/app/editorial/id673907758?mt=8) 3: [http://omz-software.com/pythonista/docs/](http://omz- software.com/pythonista/docs/)

</comment><comment><USER4> Every app by the Omni Group is incredibly well made and even more incredibly maintained. They really have it together when it comes to implementing new iOS features. Also they have, by far, the most impressive watchOS app I've ever used in it's balance of the system's limitations and the app's complexity (OmniFocus). [https://www.omnigroup.com](https://www.omnigroup.com)

</comment><comment><USER5> I was just thinking today about how well Pocket is made. I've used it for years and it hasn't really ever disappointed me. It is stable, easy to use, has a ton of power user features tucked away, and it's offline sync abilities work impressively well. It's an app that has improved my life, or at least my commute.

<comment><USER6> Hmm. I keep having the bug, where adjusting the font size won't work: the whole text gets huge or tiny spontaneously.

Also, I don't find their tag system that good for later navigation (this is especially the case on the web version).

</comment></comment><comment><USER6> Day One: one of the best UI for me

And, surprisingly, Google Photos

</comment><comment><USER7> I use an iPad just for running Animoog: [https://www.moogmusic.com/products/apps/animoog-0](https://www.moogmusic.com/products/apps/animoog-0)

If you're at all interested in music synthesis this app cannot be beat. It's a lot of fun. I think it's an extremely well-designed app because it really takes advantage of the iPad's multi-touch screen for its virtual keyboard.

</comment><comment><USER8> I find Pacemaker to be one of the most well designed apps I've ever had the pleasure of experiencing. 10 years ago, a DJ setup like this would've cost thousands of dollars. For just a few bucks, I can get an app that feels almost as natural. The design is beautiful as well.

[http://pacemaker.net/](http://pacemaker.net/)

</comment><comment><USER9> I would check out the Houzz app. The design is clean and simple but the reviews are the best I have ever seen for an app at this scale, especially the ratio of 5 star reviews on the app which suggests to me that they have designed something that works really well for their target audience both aesthetically and functionally.

</comment><comment><USER10> Café Wifi! :D [https://cafewifi.com](https://cafewifi.com)

</comment><comment><USER11> Liking these guys right now: Drafts, Narwhal, Headspace, Sit, btcReport, Gyroscope, Patterns, Calculator+. Gboard and Slash are nice keyboards to try out.

</comment><comment><USER12> Surprised it hasn't been mentioned yet: [https://workflow.is/](https://workflow.is/)

</comment><comment><USER13> Transmit, Coda, and Prompt by Panic, Inc. [https://panic.com](https://panic.com)

</comment><comment><USER14> UberEATS.</comment>


Indian Navy joins search for missing Malaysian plane in the Malacca Straits - <AUTHOR> http://timesofindia.indiatimes.com/india/Indian-Navy-joins-search-for-missing-Malaysian-plane-in-the-Malacca-Straits/articleshow/31855418.cms

<comment><AUTHOR> This Yahoo! News live update thread seems to be comprehensive:

[http://in.news.yahoo.com/live--after-60-hours--no-sign-of- de...](http://in.news.yahoo.com/live--after-60-hours--no-sign-of- debris-050909598.html)</comment>


Survey Finds iPhone Owners Far More Satisfied than Android Owners - <AUTHOR> http://www.macobserver.com/tmo/article/survey_finds_iphone_owners_far_more_satisfied_than_android/ <comment><USER2> Survey Finds iPhone Owners Far More easily Satisfied than Android Owners</comment>


Brendan Eich: WebAssembly is a game-changer - <AUTHOR> http://www.infoworld.com/article/3042705/web-development/javascript-founder-brendan-eich-webassembly-is-a-game-changer.html <comment><USER2> Personally, I think this is terrible (and it really is a game-changer, only not the kind that I'd be happy about). The further we get away from the web as a content delivery vehicle and more and more a delivery for executables that only run as long as you are on a page the more we will lose those things that made the web absolutely unique. For once the content was the important part, the reader was in control, for once universal accessibility was on the horizon and the peer-to-peer nature of the internet had half a chance of making the web a permanent read/write medium.

It looks very much as if we're going to lose all of that to vertical data silos that will ship you half-an-app that you can't use without the associated service. We'll never really know what we lost.

It's sad that we don't seem to be able to have the one without losing the other, theoretically it should be possible to do that but for some reason the trend is definitely in the direction of a permanent eradication of the 'simple' web where pages rather than programs were the norm.

Feel free to call me a digital Luddite, I just don't think this is what we had in mind when we heralded the birth of the www.

<comment><USER3> I agree. I'm really running dry on respect for Brendan Eich. None of the moves he's making are for the benefit of user privacy - look at Brave, his new browser project. It replaces ads on the web with his own ads, tracks you, and puts money in his pocket instead of the publisher's pockets. I'm struggling to remember why he was respectable in the first place - for making JavaScript, an awful programming language we've spent 20 years trying to fix? I don't think that his word on these issues is worth anything any longer.

<comment><USER4> He created JavaScript in 10 days. It's still in use 20 years later. That's very respectable.

<comment><USER5> >He created JavaScript in 10 days.

It shows. JavaScript is fucking horrible, to put it mildly.

<comment><USER6> Its got bad parts and its got good parts. Once you learn how to ignore the bad parts (and the bad examples) the language really shines. Especially with the newer versions.

<comment><USER7> Stockholm Syndrome.

</comment></comment></comment></comment></comment></comment><comment><USER8> On the Rust side, we're working on integrating Emscripten support into the compiler so that we're ready for WebAssembly right out of the gate. Given that the initial release of WebAssembly won't support managed languages, Rust is one of the few languages that is capable of competing with C/C++ in this specific space for the near future. And of course it helps that WebAssembly, Emscripten, and Rust all have strong cross-pollination through Mozilla. :)

If anyone would like to get involved with helping us prepare, please see [https://internals.rust-lang.org/t/need-help-with- emscripten-...](https://internals.rust-lang.org/t/need-help-with-emscripten- port/3154)

EDIT: See also asajeffrey's wasm repo for Rust-native WebAssembly support that will hopefully land in Servo someday: [https://github.com/asajeffrey/wasm](https://github.com/asajeffrey/wasm)

</comment><comment><USER9> As we get closer to having a WebAssembly demo ready in multiple browsers, the group has added a small little website on GitHub [0] that should provide a better overview of the project than browsing the disparate repos (design, spec, etc.).

Since the last time WebAssembly hit HN, we've made a lot of progress designing the binary encoding [1] for WebAssembly.

(Disclaimer: I'm on the V8 team.)

[0]: [http://webassembly.github.io/](http://webassembly.github.io/) [1]: [https://github.com/WebAssembly/design/blob/master/BinaryEnco...](https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md)

<comment><USER10> About the binary encoding... It's a bit easy to armchair these things, and it's too late for WebAsm now... but if you're on the V8 team, you have access to Google's PrefixVarint implementation (originally by Doug Rhode, IIRC from my time as a Google engineer). A 128-bit prefix varint is exactly as big as an LEB128 int in all cases, but is dramatically faster to decode and encode. It's closely related to the encoding used by UTF-8. Doug benchmarked PrefixVarints and found both Protocol Buffer encoding and Protocol Buffer decoding would be significantly faster if they had thought of using a UTF-8-like encoding.

LEB128 requires a mask operation and a branch operation on every single byte, maybe skipping the final byte, so 127 mask operations and 127 branches. Using 32-bit or 64-bit native loads gets tricky, and I suspect all of the bit twiddling necessary makes it slower than the naive byte-at-a-time mask-and- branch.

        7 bits -> 0xxxxxxx
        14 bits -> 1xxxxxxx 0xxxxxxx
        ...
        35 bits -> 1xxxxxxx 1xxxxxxx 1xxxxxxx 1xxxxxxx 0xxxxxxx
        ...
        128 bits -> 1xxxxxxx 1xxxxxxx 1xxxxxxx ... xxxxxxxx

Prefix varints just shift that unary encoding to the front, so you have at most 2 single-byte switch statements, for less branch misprediction, and for larger sizes it's trivial make use of the processor's native 32-bit and 64-bit load instructions (assuming a processor that supports unaligned loads).

        7 bits -> 0xxxxxxx
        14 bits -> 10xxxxxx xxxxxxxx
        ...
        35 bits -> 11110xxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx
        ...
        128 bits -> 11111111 11111111 xxxxxxxx xxxxxxxx ... xxxxxxxx

There's literally no advantage to LEB128, other than more people have heard about it. A PrefixVarInt 128 is literally always the same number of bytes, it just puts the length-encoding bits all together so you can more easily branch on them, and doesn't make them get in the way of native loads for your data bits.

Also, zigzag encoding and decoding is faster than sign extension, for variable-length integers. Protocol Buffers got that part right.

Note that for security reasons, if there are no non-canonical representations, there can't be security bugs due to developers forgetting to check non- canonical representations. For this reason, you may want to use a bijective base 256[0] encoding, so that there aren't multiple encodings for a single integer. In the UTF-8 world, there have been several security issues due to UTF-8 decoders not properly checking for non-canonical encodings and programmers doing slightly silly checks against constant byte arrays. A bijective base 256 saves you less than half a percent in space usage, but the cost is only one subtraction at encoding time and one addition at decoding time.

[0][https://en.wikipedia.org/wiki/Bijective_numeration](https://en.wikipedia.org/wiki/Bijective_numeration)

<comment><USER9> It's not too late! The wasm binary encoding is open to change up until the browsers ship a stable MVP implementation (then the plan is to freeze the encoding indefinitely at version 1).

The primary advantage of LEB128 is (as you mentioned) that it's a relatively common encoding. PrefixVarint is not an open source encoding IIUC.

We'll do some experiments in terms of speed. If the gains are significant we may be able to adopt something similar (this [0] looks like a related idea).

Thanks for the suggestion.

[0]: [http://www.dlugosz.com/ZIP2/VLI.html](http://www.dlugosz.com/ZIP2/VLI.html)

<comment><USER10> PrefixVarint isn't open-source, but the encoding is trivial.

PrefixVarints are a folk theorem of Computer Science, (re-)invented in many times and places.

I actually coded it up once in Python and once in C before joining Google, and was chatting with an engineer, complaining about the Protocol Buffer varint encoding. The person I was complaining to, said "Yea, Doug Rhode did exactly that, called it PrefixVarint. He benchmarked it much faster."

</comment></comment></comment></comment><comment><USER11> Since I started hearing about WebAssembly I cannot stop thinking about the possibilities. For example: NPM compiling C-dependencies together with ECMAScript/JavaScript into a single WebAssembly package that can then run inside the browser.

For people thinking this will close the web even more because the source will not be "human"readable. Remember that JavaScript gets minified and compiled into (using Emscripten) as well. The benefits I see compared to what we have now:

\- Better sharing of code between different applications (desktop, mobile apps, server, web etc.)

\- People can finally choose their own favorite language for web-development.

\- Closer to the way it will be executed which will improve performance.

\- Code compiled from different languages can work / link together.

Then for the UI part there are those common languages / vocabularies we can use to communicate with us humans: HTML, SVG, CSS etc.

I only hope this will improve the "running same code on client or server to render user-interface" situation as well.

<comment><USER12> More importantly, if we want to make "view source" more palatable in a WebAssembly age, we need to have it support source maps from day 1.

<comment><USER11> Yes, that would be good for development / debugging (like debug symbols) or as an optional way to give people access to the source.

</comment></comment></comment><comment><USER13> Considering how critical _SharedArrayBuffer_ is for achieving parallelism in WebAssembly, I'm hoping we see major browsers clean up their _Worker_ API implementations, or even just comply with spec in the first place.

Right now things are a mess in Web Worker land, and have been for quite some time.

<comment><USER14> Absolutely agreed. We should be able to debug Web Workers with development tools (e.g. set breakpoints / examine state / etc), nest Web Workers, use console.log from within a Worker, and construct Web Workers from Blob URLs. It's infuriatingly difficult to work with Web Workers without these features, which are missing from most browsers!

I think there's a chicken-and-egg problem with regards to Web Workers: Developers do not use Web Workers because they are hard to use/debug/develop with, and browser vendors do not improve their Web Worker implementations because they have limited adoption. Someone needs to break the cycle.

<comment><USER13> There's also a host of nasty bugs and implementation deficiencies, depending on the browser.

My favorite is in Chrome with simple DedicatedWorker instances communicating with each other directly via the MessageChannel API. It works, except when the UI thread is blocked, because messages are routed through the UI thread. Firefox doesn't have this problem, but it has its own issues—namely the UI thread for each tab runs in the same OS process, unlike Chrome where tabs are isolated processes.

That said, Firefox and Chrome are far ahead of every other browser in terms of how they implement workers. Other implementations are borderline destitute by comparison (e.g. no DOMHighResTimeStamp available in worker context, no Transferable support for important items).

> _Developers do not use Web Workers because they are hard to use > /debug/develop with, and browser vendors do not improve their Web Worker > implementations because they have limited adoption._

You hit the nail on the head. I think it's also a dislike for the API as a whole, because really workers are just a convoluted way of enforcing thread safety. Personally I'd prefer a far more simple and traditional shared memory model, with developers being afforded enough rope to hang themselves with if they so desired.

The existing methods of transferring data to and from workers are frankly crap, the only light at the end of the tunnel being SharedArrayBuffer and the Atomics API designed around it. The problem is that both are essentially designed for compiled applications, ala asm.js and WebAssembly. In a compiled [browser] environment, the heap is seamlessly allocated on a SharedArrayBuffer, so writing parallel code is nearly identical to the traditional desktop experience from a developer's point of view. In plain old Javascript however, you have to serialize and deserialize native types to and from the buffer, which is expensive. It really makes Javascript seem like a second-class citizen with regards to parallelism.

<comment><USER15> SharedArrayBuffer has been accepted as stage 2 in tc39 so there is now a good chance you will have this from JavaScript as well.

[https://github.com/tc39/ecmascript_sharedmem](https://github.com/tc39/ecmascript_sharedmem)

<comment><USER13> Right. My point was that the way the API is built is definitely more friendly towards compiled use cases. With JS, you have to manually serialize and deserialize virtually everything that transits the buffer.

Still, it's nice to see the spec move forward.

</comment></comment></comment></comment></comment><comment><USER16> If anyone at infoworld.com reads these comments:

On the top of the page, there is a horizontal menu containing "App Dev • Cloud • Data Center • Mobile ..."

When I position my cursor above this menu and then use the scroll wheel to begin scrolling down the page, once this menu becomes aligned with my cursor, the page immediately stops scrolling and the scroll wheel functionality is hijacked and used to scroll this menu horizontally instead.

It took a few seconds to realize what was happening. At first I thought the browser was lagging - why else would scrolling ever abruptly stop like that?

I closed the page without reading a single word.

</comment><comment><USER17> I still think there is a lot of room for static pages with links in the style that people seem to be prematurely waxing melancholy about when forecasting where WebAssembly _may_ lead the internet. I was always able to find sites of interest that didn't include Flash, Java applets, and company when I just wanted to read something. I find some of the scroll-hijacking, and other javascript goodies on modern pages to either be a distraction, or non- functional on some different devices. On the other hand, I am particularly happy about, and working with Pollen in Racket, a creation by Matthew Butterick. Pollen is a language created with Racket for making digital books, books as code, and bringing some long-needed, real-world publishing aesthetics back to the web [1,2]. I may even by a font of his to get going and support him at the same time!

       [1]  http://docs.racket-lang.org/pollen/
       [2]  http://practical.typography.com

</comment><comment><USER18> If you want to see Brendan's keynote from O'Reilly Fluent yesterday, a sample went up [https://www.youtube.com/watch?v=9UYoKyuFXrM](https://www.youtube.com/watch?v=9UYoKyuFXrM) with the full one at [https://www.oreilly.com/ideas/brendan-eich-javascript- fluent...](https://www.oreilly.com/ideas/brendan-eich-javascript-fluent-2016)

<comment><USER19> And Alex Russel's keynote (Google) " _Progressive web apps and what 's next for mobile_" can be found at [https://www.oreilly.com/ideas/progressive-web- apps-and-whats...](https://www.oreilly.com/ideas/progressive-web-apps-and- whats-next-for-mobile)

</comment></comment><comment><USER20> I think the web may split into two.

1) 'Simple' web pages will stick with jquery, react, angular, etc type code. Where you can still click view source and see whats going on. Where libs are pulled from CDNs etc.

2) 'Complex' saas web apps, where you need native functionality. This will be a huge bonus. I'm in this space. I would love to see my own application as a native app. The UI wins alone make it worth it!

<comment><USER21> What does 'native functionality' mean for a web app?

Do you mean skipping the DOM and making a Canvas for displaying content? Or do you mean something else?

</comment></comment><comment><USER22> To me, it's more about choice of programming language than performance. Though the latter is very important, I think the former is what will open up doors to making the browser a platform of choice (pun intended). Currently, it feels like JavaScript is the Comcast of the web. Everyone uses it, but that's only because there aren't any other options available to them.

<comment><USER23> Definitely agree ! I really hope that web asm will kill javascript and (css by the way). I just hate this language.

</comment></comment><comment><USER24> Video of the talk?

EDIT: Here is the full-length one - [https://www.oreilly.com/ideas/brendan- eich-javascript-fluent...](https://www.oreilly.com/ideas/brendan-eich- javascript-fluent-2016)

<comment><USER18> Here's his Fluent keynote from yesterday: [https://www.youtube.com/watch?v=9UYoKyuFXrM](https://www.youtube.com/watch?v=9UYoKyuFXrM) .. full at [https://www.oreilly.com/ideas/brendan-eich-javascript- fluent...](https://www.oreilly.com/ideas/brendan-eich-javascript-fluent-2016) (click X on the popup window, you don't need to sign in)

</comment></comment><comment><USER25> Sorry, but most of the discussion here is completly missing the point about WebAssembler.

It is just a technology, to make things brought through the web, faster. And it is open. And no less secure, than js. So I think it's great.

Good technology does exactly, what the creator wants. And if people don't like some of the things, that gets created with it, then it is not a problem of the technology itself.

So people can do good things, or bad things with it. But in the web, we have the freedom to choose, where we go.

And if we don't like ads for example, we should be aware, that Web-Site creators still want money for their work, so maybe we should focus and support a different funding model. I like the pay-what-you-want or donation model the most, Wikipedia shows, that this is possible on a large scale ...

</comment><comment><USER26> I want to agree with him, I'd like to see a future where WebAssembly closes the gap between native apps and the web. For better or worse browsers are the new OSes, and I dream of a future were all vendors come up with the equivalent of a POSIX standard where any web application can access all (or a wide common subset) of any device's capabilities, from the filesystem to native UI elements.

<comment><USER27> Hey, I've got an idea. How about we just implement this POSIX like standard at the OS layer.

We can call it POSIX.

<comment><USER28> It's a shame you got downvoted for that, as you make a very good point. This whole trend of making the web browser a poor man's OS is definitely a bit hinky. I mean, how many layers of abstractions built on top of other (redundant) layers of abstraction really make sense?

This stuff is one reason that, despite the advances associated with Moore's Law, the advent of SSD's, and increasing RAM counts, computers don't feel any faster than they did in 1995. It's ridiculous in a way.

Just to play Devil's Advocate: maybe web browsers should be good at, ya know, _browsing_ and leave the other stuff for something else.

<comment><USER29> > _It 's a shame you got downvoted for that, as you make a very good point._

I think this is because the comment comes off as flippant and snarky.

> _This stuff is one reason that, despite the advances associated with Moore > 's Law, the advent of SSD's, and increasing RAM counts, computers don't feel > any faster than they did in 1995. It's ridiculous in a way._

That statement is ridiculous. I've never heard anyone claim that the computers of today don't "feel" any faster than computers of 20 years ago, but if you feel that way I just don't think you're living in the same universe as those of us who walk around with quad core computers in our pockets.

> _maybe web browsers should be good at, ya know, browsing and leave the other > stuff for something else._

Please define "other stuff" and where you draw the line between that and simply "browsing"

<comment><USER28> I think it's a shame you got downvoted as well. Have an upvote on me.

As to the rest:

 _I 've never heard anyone claim that the computers of today don't "feel" any faster than computers of 20 years ago,_

Interesting, I find it to be a fairly common refrain. In fact, what I'm saying is basically just a paraphrase of Wirth's Law:

[https://en.wikipedia.org/wiki/Wirth's_law](https://en.wikipedia.org/wiki/Wirth's_law)

 _but if you feel that way I just don 't think you're living in the same universe as those of us who walk around with quad core computers in our pockets._

Well, I walk around with a quad core computer in my pocket as well, and I still stand by that assertion.

 _Please define "other stuff" and where you draw the line between that and simply "browsing"_

I'll allow that there's some subjectivity there, but when you're talking about a "web application" like, say, Microsoft Outlook online or something, or a programming editor or a CAD program or an image editing program, I can't help but wonder if that stuff should really be done purely "in browser" as opposed to being handed off to another program.

OTOH, I understand (some of) the arguments for doing it this way. Having a uniform experience for all clients, the security holes associated with plugins, avoiding the need to deploy software to individual machines, etc. I'd just like to suggest that people spend some time considering if there are other ways to achieve the same end(s) other than continuing to bloat the web browser until it replicates all the functionality offered by the underlying OS.

<comment><USER30> > Having a uniform experience for all clients

An experience that is uniformly slow and uniformly broken a different way on every browser...

<comment><USER28> I largely agree, but the argument is "If we rely on plugins, some users will have the plugin and some won't and since users don't install plugins, not everybody will be able to use our $THING".

And it is a somewhat legitimate argument. Whether or not it justifies having the browser subsume everything is, IMO, an open question.

<comment><USER30> I think if we decide heavily siloing / sandboxing is the right thing for software generally, then what you want to do is build an operating system that works that way (kind of like iOS, but with provisions to enable better data sharing so that you can actually make things with that OS).

This would be TREMENDOUSLY better than trying to make the browser into an OS.

<comment><USER31> What do you think about a browser tab that loads a VM running Linux running OpenJDK that runs a full Java application in its own sandboxed OS instead of an applet, with some mechanism for file transfer to the host OS? You could also support any other language, WINE, Mono, whatever. The point is having a sandboxing mechanism that gives existing native code first class status in the browser. Too hacky?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> WebAssembly... Wow, if we keep going, we'll re-invent what Sun achieved 20 years ago with Java. If only they hadn't f-ed it up...

<comment><USER33> The JVM problem was that it had applets and did not have the DOM integration of Javascript. I do often wonder if instead of Javascript in 1995 we had got WebAssembly and WebSockets.

<comment><USER32> You could actually call into JavaScript from Applets, using something called LiveConnect. See [https://docs.oracle.com/javase/tutorial/deployment/applet/in...](https://docs.oracle.com/javase/tutorial/deployment/applet/invokingJavaScriptFromApplet.html)

Was it simply/easy? No. But, you probably wouldn't want to.. The DOM is a crappy way to build an application UI. Someday we might figure that out.

<comment><USER34> The concept of the DOM is so widely considered to be useful in declaring user interfaces, that multiple languages have copied it.

[http://fxexperience.com/wp- content/uploads/2011/08/Introduci...](http://fxexperience.com/wp- content/uploads/2011/08/Introducing-FXML.pdf)

[https://en.wikipedia.org/wiki/Extensible_Application_Markup_...](https://en.wikipedia.org/wiki/Extensible_Application_Markup_Language)

The HTML DOM sucks, but what other DOM is widely available and already installed on literally every machine on the planet?

</comment></comment></comment></comment><comment><USER35> A question to WebAssembly experts: How easy it is to use WebAssembly as a sandboxed embedded scripting mechanism in my own native (C++) application? I am writing a native real-time system (a distributed 3D engine for VR) in which I send scripts on the wire between machines, and I need to call an update() method of these sent scripts like 90 times a frame. I need complete sandboxing, because my trust model is that what is trusted on machine A may be absolutely not trusted on machine B: not only not letting the scripts do any functions other than what I explicitly let them call, but I need to have hard limit on their memory usage and execution time also, but preferably they should execute in-process, so they can reach memory I let them and be called from the thread I want. Currently I go wtih Lua, but to have really good performance I will need to research this topic more deeply later.

</comment><comment><USER36> Are those boxes in the picture Firefox OS phones?

Is this an old picture?

<comment><USER37> Good catch. The URL of that image [1] seems to indicate it's from April 2014 (or earlier).

Seems Brendon Eich resigned that same month/year [2].

[1]: [http://core0.staticworld.net/images/article/2014/04/brendan-...](http://core0.staticworld.net/images/article/2014/04/brendan- eich-100259498-primary.idge.jpg)

[2]: [http://recode.net/2014/04/03/mozilla-co-founder-brendan- eich...](http://recode.net/2014/04/03/mozilla-co-founder-brendan-eich-resigns- as-ceo-and-also-from-foundation-board/)

</comment></comment><comment><USER38> What is the upgrade path for Emscripten users? I understand that LLVM will have WebAssembly backend, but how will OpenGL to WebGL translation work, for example?

<comment><USER39> Emscripten can already compile to both asm.js and WebAssembly, with just flipping a switch between them.

All the JS library support code is unchanged, so Emscripten's OpenGL to WebGL layer is used just like before, and the same for all the other libraries.

The WebAssembly backend in LLVM will eventually be used by Emscripten as another way to emit WebAssembly (right now it translates asm.js to WebAssembly), but the new backend is not ready yet.

See also [https://github.com/kripken/emscripten/wiki/WebAssembly](https://github.com/kripken/emscripten/wiki/WebAssembly)

</comment></comment><comment><USER40> If you think WebAssembly (or asm.js) is a good idea, I would very much like you to do the thought experiment of what design decisions something like WebAssembly would have made 15 or 25 years ago, and what consequences those would have today.

Helpful research keywords: Itanium RISC Alpha WAP Power EPIC Java ARM Pentium4 X.25

<comment><USER41> I can't think of any software development API that ended up being perfect 15 or 25 years later. Javascript certainly isn't. Java applets, ActiveX controls and Flash _very_ much weren't, but, at the time, they did things you couldn't with the standard web stack.

And we're better off for learning the lessons of the failures, creating improved technologies to replace them (HTML5, JIT Javascript engines, etc), and building on the successes to continuously do more things that previously couldn't be done in the browser.

Will WebAssembly be perfect? Of course not. Will there be unanticipated problems? Of course. I would not at all be surprised if it becomes the next Flash. But it's better to move forward and keep innovating with new web technologies instead of letting the platform stagnate.

We've tried feature-freezing the web for a few years; it was called "Internet Explorer 6" and it sucked.

</comment></comment><comment><USER42> I'm conflicted. One one hand I support open data/raw documents. But this prevents native-like, real-time applications. It also forces developers to work on Javascript which is a terrible language.

On the other hand we have lock-in ecosystems, closed silos, that are detrimental to the commons.

The only consolation I have is that if WebAssembly provides a bytecode instead of machine code then we still have the ability to perform reverse engineering.

In the end, we have _ALL_ have to do the hard task to inform every single person why Apple/FB/MS/Google are harmful to us and why we should boycott their programs/services.

</comment><comment><USER43> I wonder if along with these byte code engines we'll get capability grained control systems too. Somehow I doubt it though.

So in the future, when you visit a website they'll be able to Eg: open windows, pop up unblockable modals, webGL, bytecode loaded spam/ads, etc. The end users option will be to block everything, or live with it.

I do not like this bold new world we're entering.

<comment><USER44> This is a common confusion somehow. The programming language has _nothing_ to do with the APIs provided by an environment. JavaScript can do all those things now, as long as you run it in an environment that provides APIs to do those things (node.js, electron etc). The browser is not that _environment_. When you write a keylogger virus in C, you are relying on the APIs provided by the environment to do it, they don't come from the C language.

<comment><USER43> I wasn't confused at all. Technically there is a difference between a language, an API and a platform.

That's all true in the case of NodeJS and the like, but not true for web browsers. There the language the API and the platform come as one.

The result is, remote websites can execute code on a users computer. With no control except for simple technical measures.

</comment></comment></comment><comment><USER45> WebAssembly shouldn't be for the end users to use, it should used for implementations of other languages so they can access the same APIs Javascript can.

Add Lua to the browser, add Perl 6 to the browser, etc. There are plenty of decade old W3C specifications that never made it to the browser properly, like XSLT 2.0, XQuery 1.0, XForms, never mind the latest versions of the specs.

<comment><USER44> I don't see how it can be feasible to use it for implementations of other languages that don't directly map to webassembly like C. You would have to ship a runtime for the other language along with your application code. The runtime will be either huge with long startup time or small but too slow to be feasible.

<comment><USER45> Whichever it is it can't be worse than implementing other languages in Javascript directly or using stuff like GWT and there are plenty of those already (including development for running Perl 6, btw).

Runtime for a few selected implementations should be very well be packaged or installed along with the browser itself. Failing that, it should be cached.

<comment><USER44> > Runtime for a few selected implementations should be very well be packaged > or installed along with the browser itself. Failing that, it should be > cached.

Web Assembly isn't related to this. You can standardize on a new language VM that browsers should ship, like was attempted with Dart. What Web Assembly enables is more efficient VM with better interop to Web APIs than currently is possible, but the most prohibitive thing will not change (having to ship multi megabyte VM along with your application code).

<comment><USER45> Lots of things will change. If it makes sense to do that, then there will be demand for it.

Here's something already [https://news.ycombinator.com/item?id=11269736](https://news.ycombinator.com/item?id=11269736)

</comment></comment></comment></comment></comment><comment><USER46> Is WebAssembly going to be host url resource based (like current .js files are) or will it be used as part of some centralized global assembly cache (GAC) solution where assemblies are only usable from a CDN type of authority?

</comment><comment><USER47> What exactly will be better? One can compile a lot of languages to JavaScript today. JavaScript is fast enough and size doesn't really matter for most use cases. Is WebAssembly going to be much faster than JavaScript?

<comment><USER48> Webassembly is basically a portably assembly language (as in, lower level than C), that then gets translated instruction for instruction into actual assembly language.

It's several layers 'below' JavaScript. It's basically cross-platform, native code.

<comment><USER49> And moreover, the resulting native code is executed inside the same VM that executes normal Javascript, so it's not anything like starting some Flash file, it's just that we can have native code speed, when needed, _inside_ of the Javascript. That existed already with asm.js. This step now should allow less overhead in parsing such code, which matters when there is a lot of code like in the games or big programs directly translated from lower-language code base. Less overhead means less battery drain and faster start of the program, as an example.

</comment></comment></comment><comment><USER50> Has anyone tried NativeScript? [https://www.nativescript.org](https://www.nativescript.org)

Heard about it on a podcast recently, haven't had a chance to try.

<comment><USER51> Just pointing this out to absolve future confusion: This comment is very off- topic.

\- WebAssembly is a new low level language for client-side scripting in web browsers. Future web browsers will support WebAssembly in the same way they currently support JavaScript. WebAssembly has a number of advantages over JavaScript, including performance and an AST-like syntax that makes it more suitable as a compilation target.

\- NativeScript is a framework for developing "cross-platform" mobile apps. It achieves this through a JavaScript/TypeScript API and common UI components that are implemented natively on both iOS and Android.

I have not tried NativeScript and I am skeptical of projects that aim to "bridge the gap" in mobile development. iOS and Android are ever-evolving and so you must rely on the platforms that target them to stay up to date. Further, these platforms have very different design goals and the compromises that frameworks like NativeScript make often come at the expense of user experience.

NativeScript could be great! But please be aware of the shortcomings of eschewing native development.

</comment></comment><comment><USER52> If we keep this up, the web will be almost as good of an application framework as a '90s era desktop application. Yay, progress!

</comment><comment><USER53> I wish the browser vendors focused on CSS Grid module support as much as they did WebAssembly.

</comment><comment><USER54> This looks AWESOME

</comment><comment><USER55> Thanks for that update that no one asked for.

<comment><USER56> Please don't be rude.

We detached this subthread from [https://news.ycombinator.com/item?id=11262923](https://news.ycombinator.com/item?id=11262923) and marked it off-topic.

</comment></comment><comment><USER57> WebAssembly = SWF with diff name. Come on!

</comment><comment><USER58> The format of WebAssembly could be Java ByteCode.

<comment><USER59> It's lower level than that.

</comment></comment><comment><USER60> Yeah, great. Transform everything into opaque binary blobs, as far as the eye can see. Wonderful.

Thanks for nothing.

<comment> T-A From [http://webassembly.github.io/](http://webassembly.github.io/) : "Open and debuggable: WebAssembly is designed to be pretty-printed in a textual format for debugging, testing, experimenting, optimizing, learning, teaching, and writing programs by hand. The textual format will be used when viewing the source of wasm modules on the web."

<comment><USER60> Yeah, nice, this and and so many other formats, that people just throw up their hands and give up on, when confronted with the raw binaries they work with on a daily basis, are simply open and wonderful all the time.

Except not.

Portable Executables. ELF binaries. Zip Files. Open Image Formats.

All of these are theoretically open, and perfectly accessible to all, in their raw form.

And yet broadly inaccessible to like 90% of the world's lay people, since the concept of an interpreter eludes them, and in some cases is explicitly denied to them. The same will happen with this.

This puts things on a shelf, well out of reach to many more people. And a very small group of people love that.

So, while encrypted smart phones and email "go dark" on mass surveillance, the rest of everything else "goes dark" for ordinary people.

</comment></comment></comment><comment><USER61> I don't know. I am not sure yet. What the HN folks think about this?</comment>


12-year-old FarmVille user runs up £900 debt - <AUTHOR> http://www.guardian.co.uk/money/2010/apr/07/farmville-user-debt-facebook

<comment><USER2> Since Zynga and Facebook are located in the US, I would use a COPPA argument against Zynga/Facebook. They would have to get parental consent before collecting personal information (including billing information) from a child under 13. I think this argument would hold even though the child was in the UK. It's worth a try...

<http://www.coppa.org/comply.htm>

</comment><comment><USER3> Kids will be kids!</comment>


Easy private certificate management for VMs on AWS, GCP, and Azure - <AUTHOR> https://smallstep.com/blog/embarrassingly-easy-certificates-on-aws-azure-gcp/ <comment><USER2> The idea and functionality looks good. Some quick friendly feedback:

For production I would want to run this in Docker in some sort of a portable fashion.

Looking at the documentation it seems that you have to manually enter the password when you start up step-ca. That's not really going to work for automated setups. You need to be able to inject secrets from environment variables, or these days, Kubernetes secrets.

There's also the issue of backing up your CA secrets, e.g. if your step-ca process dies and you want to restart it somewhere else. That may be out of scope for step-ca though and handled through some other process, which is fine.

Might be good to add some documentation on how to set this up in a high availability fashion so it is not a single point of failure.

I do like the relative simplicity of this compared to all the other CA solutions out there. Good luck and thanks for the work.

<comment><USER3> > For production I would want to run this in Docker in some sort of a portable > fashion.

Do [https://hub.helm.sh/charts/smallstep/step- certificates](https://hub.helm.sh/charts/smallstep/step-certificates) & [https://hub.docker.com/r/smallstep/step- ca](https://hub.docker.com/r/smallstep/step-ca) tick this box for you?

> Looking at the documentation it seems that you have to manually enter the > password when you start up step-ca... environment... kubernetes secrets

There are a couple options here. You're only prompted for a password if your intermediate signing key (at `$(step path)/secrets/intermediate_ca_key` by default) is encrypted with a password. You can create your own signing key (e.g., with `step certificate create`) or remove the password (e.g., with `step crypto change-pass --no-password`) and you won't be prompted for one.

The `step-ca` binary also takes a `--password-file` flag. We chose to take this from file vs. environment or directly as a flag because files are the easiest thing to secure in general... and we're all about misuse resistance. If you really want to use a string or an environment variable you can use bash process substitution (e.g., `--password-file <(echo "pass")` or `--password- file <(echo $PASS)`).

We're also working on PKCS#11 HSM support and will be supporting cloud HSM/KMSs on all the popular clouds, which is probably the best and most secure option for most people.

> There's also the issue of backing up your CA secrets, e.g. if your step-ca > process dies and you want to restart it somewhere else.

Yea this is super tricky. I think HSMs are probably the right answer. As it stands, the password protection on the signing keys mean it's _somewhat_ ok (if not best practice) to backup the keys. Really though, the whole system is designed to make intermediate and even root rotation fairly easy so there's that option, too.

This is an area where we're still improving and definitely appreciate feedback from anyone who has thoughts.

> Documentation on how to set this up in a high availability fashion

Yea good call. We need that.

For anyone who's reading this you should be aware that the CA just needs a root and intermediate cert in `$(step path)/certs` and an intermediate key in `$(step path)/secrets`. You don't have to create these keys with `step ca init`. You can use the lower level `step certificate create` command group to create a second intermediate that hangs off an existing root, for example.

> I do like the relative simplicity of this compared to all the other CA > solutions out there. Good luck and thanks for the work.

Thanks so much! <3.

Edit:

If you're doing k8s stuff also check out:

\- [https://github.com/smallstep/autocert](https://github.com/smallstep/autocert)

\- [https://github.com/smallstep/step- issuer](https://github.com/smallstep/step-issuer)

If you're using Envoy/Istio we're also iterating on this:

\- [https://github.com/smallstep/step-sds](https://github.com/smallstep/step- sds)

<comment><USER2> Excellent response, thank you. Answers all my questions.

</comment></comment></comment><comment><USER4> I feel like the lack of "audience" field (or equivalent) in AWS IID makes them bit less attractive for authentication than GCP/Azure ones. For example here step-ca could impersonate (if compromised) the client instance to any other services that were to use IID for auth (or vise versa).

<comment><USER3> Yep. AWS's instance identity implementation is crap. I want to write a follow- up blog post about this. They also don't rotate their keys and their tokens don't expire. To top it off, their implementation is buggy and terribly documented. Honestly it's pretty shameful. They have the resources to fix it, and they should fix it. GCP's implementation is the best. It's JWT-based and heavily inspired by OAuth OIDC identity tokens and uses a lot of the same infrastructure. Azure's is a close second. None are perfect.

That said, even AWS's crappy implementation is super useful, and really the only good way to do this (that I know of?). We've tried to mitigate this risk somewhat by making tokens single use. I'd like to also add a way to send a token to `step-ca` to say "this server doesn't need a certificate" that basically marks the instance as "used" without issuing anything. If everything that uses IIDs did this, and you ran through all of your services at startup and either authenticated or said "I never need to use this service", it would provide some protection.

Still, to your point, AWS should fix their shit.

<comment><USER4> Btw can step create client certs? That would reduce the need to use IID for anything else, even if it doesn't really resolve the underlying issues with IID

<comment><USER3> Yep. That's my preferred solution, obviously ;)

Certs have "TLS Client Authentication" key use set by default.

</comment></comment></comment></comment><comment><USER5> This is very similar to [CFSSL]([https://cfssl.org/](https://cfssl.org/)), any specific reasons to use this over Cloudflare's PKI?

<comment><AUTHOR> I'm a smallstep developer.

From a mile high view, the thing that makes step somewhat different is the heavy emphasis on usability and reducing overall complexity of managing your own PKI holistically.

So, even if smallstep is more complete in a feature-for-feature comparison to alternatives, the primary focus on ergonomics and filling the "humanized" tooling gap is why you might pick it over another tool... depending on your needs.

In a sense step is to cfssl/openssl as httpie is to curl. You can accomplish a lot of the same things, but they're at different levels as far as mental tax and overall approachability.

</comment></comment><comment><USER6> This is very neat stuff and I'd actually be interested in talking to you more about where you see it going in the future, because it's extremely closely related to some stuff I've worked on. One clarification:

Am I understanding it correctly that step-ca can be configured to either 1) hand out certs for _any_ CN or 2) only hand out certs for the machine's FQDN according to the instance metadata? In essence, the "any CN" mode is only useful for knowing that this instance is one of your own (but exactly which one is totally on the honor system), and the "FQDN only" mode is useful if you use your cloud provider's FQDNs for your hosts. Do I have that correct?

<comment><USER3> Yes, your understanding is correct. I think it's _slightly_ better than you suggest... since instance identity authentication only works once per instance (by default) you'd probably have some other monitoring stuff in your stack that would notice if a VM went rogue. If a `foo` instance got a cert for `bar` your CD stack would presumably still consider it a `foo` instance and, for example, add it to DNS as `foo`. Then connections to that instance would fail (since it can't authenticate as `foo`) and, hopefully, you'd notice.

Still, this is hand-wavey and complicated and not ideal from a security perspective. It's a lot better than _not_ having certificates at all, but it'd be even better if this gap were closed.

To close this gap we need some sort of enrollment process. The reason we didn't add this for MVP is it's kind of complicated. I think we'd need some policy at the CA that maps VM identities to the workload identities the VM is authorized to run. We need to figure out what would run this enrollment step to add the mappings (probably different for different stacks) and how that thing would authenticate to the CA.

We've also been a bit reluctant to add ad-hoc policy stuff to the CA because we have a generic policy solution that we've been working on. Once that's released it'll give us a much better foundation for this sort of stuff.

Finally, there are other ways to build a stronger enrollment mechanism today. We have a JWT-based one-time-token authentication mechanism[1] that you can use, where a "provisioner" (e.g., something in your CD pipeline like Puppet or Kubernetes) issues a one-time token for a workload to get a certificate from `step-ca`. In this flow the JWT contains the workload's identity, so whatever issues the JWT controls certificate enrollment. This flow has pretty much the same characteristics as an IID+enrollment flow.

Finally, we have ACME support coming soon (next week, actually). So that'll be another option if you want a stronger binding to an instance's FQDN.

Hope this makes sense. Happy to answer any additional questions!

[1] [https://smallstep.com/docs/design-document/#jwk- provisioner](https://smallstep.com/docs/design-document/#jwk-provisioner)

</comment></comment><comment><USER7> I've used XCA [1] before for managing my personal CA and PKI certs for things. I simply then share my root CA out to my necessary end points and handle things from there.

[1] [https://hohnstaedt.de/xca/](https://hohnstaedt.de/xca/)

<comment><USER3> I've never used XCA but I've heard of it. Does it have an actual "online CA" with an API for signing certificates or is it more of a desktop app that works with local signing certificates - like a graphical version of OpenSSL?

If you ever have a reason to check out the `step` / `step-ca` toolchain I'd love to chat about the differences you see. Message me here or shoot me an email (mike at smallstep).

<comment><USER7> Since it's my own CA, I have a few personal scripts that handle it. Everything else (like the root cert) is handled offline with a different physical device. It's nothing more than some glorified bash stuff and pulling public CA's from my own sites.

XCA is a gui for dealing with making certs. For me even as a technical user, i prefer it more than CLI.

<comment><USER3> Cool that's good feedback. We've been working on a web interface that we could maybe turn into an electron app for this sort of stuff.

I'm probably pressing my luck promoting here but if you do a bunch of cert related stuff check out our `step certificate` command group at [https://smallstep.com/docs/cli/certificate/#commands](https://smallstep.com/docs/cli/certificate/#commands) \-- it does a bunch of cool stuff like dumping x509 as JSON and extracting public keys and linting certs and it's way easier to use than openssl. Might be useful in your scripts.

<comment><USER7> I will be taking a look at it for sure! Like I said i'm pretty small time, but I love the power of having my own CA.

</comment></comment></comment></comment></comment><comment><USER8> What's the advantage of this over some scripts like [https://github.com/tomberek/easy-ca](https://github.com/tomberek/easy-ca)?

<comment><USER3> See the comparison to cfssl below. Step has lots more features, is easier to use, and harder to misuse. Relative to easy-rsa, the most important difference is that step-ca is a service that can issue certs via an API. Combined with step it can also help with lots of cert management tasks like root distribution and automated renewal.</comment></comment>


Show HN: Need help coding to save our water - <AUTHOR>

I'm looking for some help developing this front end: http://equationdesigner.appspot.com/ I'm pretty much a n00b when it comes to what web technologies to use, my focus has been the back end. This is also my first attempt seeking help on HN, lets hope this GOes well.<p>I started this project for a group of lake ecologists (GLEON.org), but I think the computer science can be used more broadly. <comment><AUTHOR> I haven't actually connected the front and back yet, but the big idea is Symbolic Regression. The process flow is as follows: Buoys get put in lakes and collect high resolution data. We don't really have the tools yet to understand what the data is telling us outside of the basic ecological theory. One avenue for greater understanding is to uncover the differential equations that are driving the system. In comes symbolic regression(SR), a means of deriving equations directly from observational data. Much like (non)linear regression, we want to model the data. SR searches both equation form and coefficients for fitting a data set.

This is meant to be the user interface to my master's research. I am developing a deterministic algorithm for SR that outperforms the Genetic Programming method. I want to take it one step further and have humans and computers working together to find equations or in general data mine.

</comment><comment><USER2> hi, I'll try to help you. What's your mailid? We'll be in touch.</comment>


Ask HN: How can I learn how to invest in the market? - <AUTHOR>

Hello, I'd like to learn how to invest in stocks, bonds, options, etc. However I find that there are no classes, and no realistic( please no make 100K in 5 days!!) books that would teach me what skills I need to learn.<p>I'd just like to learn what to look for in market trends, how to accurately research stocks, and how to make money etc. I know some basic terminology and researching but I'd like to be better before investing any money. <comment><USER2> Nobody ever _wants_ to hear this, but I have to say it anyhow: read A Random Walk Down Wallstreet, give up, and invest in index funds.

<comment><AUTHOR> I hope this is not "above me" I don't know as much as the average hacker would probably know about markets. I'm 20 and don't have THAT much knowledge.

>>give up, and invest in index funds. Alright, Any book recommendations for that?

<comment><USER2> It is not a commentary on you, but rather on markets. On average, investor performance is market average minus expenses, and this holds regardless of investor sophistication.

<comment><USER3> Actually my understanding is that investor performance is usually better than the market average, but not by enough to meet expenses. Therefore after market returns usually lose. Markets are not perfect. But the imperfections are small.

There was a study I saw a decade ago about whether any funds produced better results than chance. Due to the difficulty of modeling the possibilities, only mutual funds were considered. So people like George Soros did not get counted. In the end 2 names had performed high enough that, with 95% confidence, their performance was not by chance. Their names were Peter Lynch and Warren Buffett. Peter Lynch retired before he got to the 99% confidence.

Interestingly both Peter Lynch and Warren Buffett recommend low cost index funds for average investors.

</comment></comment></comment></comment><comment><USER4> Google "fantasy investing" to find a good online trading simulator and then trade, trade, trade. Nothing compares to trading a real portfolio with "play money". Books are good for teaching basics about stock research but they don't teach you about your own psychological biases, risk tolerance, individual stocks' trading volume, etc.

At the same time, subscribe to some financial channels on YouTube (like Peter Schiff's for example) and watch them every day. Whenever you hear something you don't understand, read up on it. It'll take time but it will be worth it. (Just make sure you don't end up with all-bull or all-bear channels, like I said you want to keep your own emotional biases in check).

</comment><comment><USER5> This is a comment I made on a previous submission:

"Trading" is not the answer. "Investing" is. Read The Intelligent Investor and Security Analysis, both by Benjamin Graham; and F Wall Street by Joe Ponzio (His website fwallstreet.com also has a number of gems. Particularly, his post about how to value a business [http://www.fwallstreet.com/article/26-calculating-the- value-...](http://www.fwallstreet.com/article/26-calculating-the-value-of-a- business-part-ii))

If you read those materials, you will learn how to invest. They will teach you how to value stocks and more importantly, teach you how to think about the markets - be emotionally detached.

</comment><comment><USER6> Warren Buffets letters to shareholders would be a good place to start. Read all of them.

The intelligent investor and securities analysis by Ben Graham are essentially reading albeit abit dry.

I'd also recommend (when looking at equities) that you do lots and lots and lots of research on individual stocks and really get to know them before you take the plunge and fully understand why you've decided to buy.

Also, have an entrance and exit point on all investments. Unless you're going for the 'value investing' strategy buying and holding forever.

<comment><AUTHOR> I'm looking for more applied advice. Your advice seems to have more of that, does Buffets' letters include such things?

Thanks for the entrance/exist point strategy. I am planning to invest for the short term so that should be useful

<comment><USER7> Well, I'd say Buffett's letters' strong points are the way it breaks down tough concepts into a language that most people can understand. While I wouldn't say that he dispenses much in the way of investment advice, they make good reading if you're looking for a broad stroke of the US economy (especially the financial sector) as well as the factors that affect his business.

It also helps that his letters tend to be free of the BS that permeates some of the annual reports I've had to read through. When a business he owns isn't doing well, he admits to it without needing to couch behind platitudes.

</comment></comment></comment><comment><USER8> Read some books by Michael Lewis and then reconsider your plans.

You need to understand the psychology of markets, booms and busts and how the professionals fleece the wannabes. Understanding economics and reading Warren Buffet's remarks will lead you to invest in safe stocks, et al. That is not the way to getting rich anytime soon.

</comment><comment><USER9> read jack schwager's books, the better biographies on warren buffett (lowenstein's, also snowball effect), lowenstein's book on ltcm is also worth reviewing.

i highly recommend the origin of wealth -- an amazing book

mark douglas' books can be helpful,

how to make money in stocks by o'neil,

steenbarger's book

george soros' books

hank pruden's book

you want to learn what a trading plan is, and you want a trading plan that will work in irrational markets (since humans are not rational etc.), has some risk mgmtn (risk does not equal volatility), rules to buy and sell, etc.

hope this helps,

<comment><AUTHOR> But these are autobiographies, I would like a book that gives me APPLIED knowledge on trading in index funds, options, stocks, bonds, forex..etc. I'll start with stocks/index funds because they're easier.

I want to invest short term(less than a year)

<comment><USER9> not all are (auto-) biographies.

o'neil's book is very applied.

schwager's books are not all biographies, and include several very applied books. the market wizards series include significant amounts of practical advice on risk mgmt, exit strategies, trading plans, etc. -- from some of the best investors.

consider your level of commitment to trading. are you willing to dedicate 4 years of work to becoming a winning trader? are you willing to read 20 books about trading?

there is a zen aspect to learning about trading, which can help explain the value of biographies, when you think about it ;)

best wishes in your journey! ;)

</comment></comment></comment><comment><USER10> I reckon Reminiscences of a Stock Operator & Monkey Business: Swinging Through the Wall Street Jungle are absolute MUST.

</comment><comment><USER11> I highly recommend Benjamin Graham's The Intelligent Investor</comment>


Startup Quote: Thomas Edison, co-founder, General Electric - <AUTHOR> http://startupquote.com/post/3253285791

<comment><AUTHOR> To have a great idea, have a lot of them.

\- Thomas Edison

<http://startupquote.com/post/3253285791></comment>