Slow and Steady is Bullshit - <AUTHOR> http://www.usuallypragmatic.com/2014/07/slow-and-steady-is-bullshit.html <comment><USER2> I hate this linkbait title hyperbole. It takes whatever moderately good points he had and makes them seem ridiculously wrong-headed. I understand being a blowhard is often necessary to be seen and heard in American business culture, but if you don't really know your shit you end up looking like a douchebag to anyone with half a clue.

For instance, the context-switching cost is very true. It's better to focus on one thing at a time, and multi-tasking is endemic to our society. If you can focus on one thing for a few days with no distraction you can really accomplish mountains especially compared to the usual email/social media distraction dance that is seemingly normal for anyone with a smart phone these days.

However on the flip side, compressing learning that is intended to be absorbed over a few months into a couple weeks of sleepless nights is a surefire way to make sure your retention is absolutely squalid. We used to call this cramming, it allows you to pass an exam, but it's well-known that it doesn't lead to much in the way of long-term learning.

<comment><USER3> "We used to call this cramming, it allows you to pass an exam, but it's well- known that it doesn't lead to much in the way of long-term learning."

Learning in a compressed time-frame can be highly effective. The problem with college kids is they stop learning and practicing right after the exam.

If they kept spending a few hours each week for the next few months they would retain a large chunk of it.

<comment><USER2> Yes they would, however that would be adding a healthy dose of "slow and steady" to the equation, wouldn't it?

<comment><USER4> Not really. Slow and steady would be splitting the entire learning material over a longer period. This would be learning everything as fast as possible (cramming), then taking a couple weeks break, then cramming again. It is indeed much more effective.

(the general case is much less explored, and the article provides no evidence either way, unfortunately)

<comment><USER3> I don't think cramming then taking a couple of weeks break and then cramming again is an effective strategy. It only works with tasks that have a slow rate of decay.

Good for making progress on a side project and yet horrible for learning.

I think slow and steady combined with a few sprints each year is optimal. I do 1 hour/day most of the year and then 40+ hours/week for two non-consecutive months.

<comment><USER4> Well, I guess we're mostly arguing definitions here. If you do 1 hour/day, but fit as much knowledge as you can into that hour, are you cramming for one hour, or taking it slow and steady?

In practical terms, spaced repetition is with no doubt the best method for remembering things, and you could either see it as slow and steady, or repetetive cramming. For understanding things, I don't know of a good method; but it seems like understanding 'keeps better' as long as you remember the relevant facts.

</comment></comment></comment></comment></comment></comment><comment><USER5> TL;DR: Don't half-ass two things. Whole-ass one thing. And then another. And then another. #manliness

\---

I find it odd that we seem to be taking so long as a species to develop a useful, simple and broadly agreed-upon idea about the peaks and troughs on the productivity landscape. Yes, it's better to focus than to multi-task. But it's also good to show up every day and make a little progress. You want to do the "minimum effective dose" each time.

To use his ladder analogy, climbing a quarter-rung a day gets you nowhere, but a rung a day is superior to 4 rungs in one day and then no more rungs for a week.

Aren't there more interesting things we can discuss about the nuances of productivity than "here there be dragons"? Or is this really just chest- beating bravado that we all do from time to time to make ourselves feel better about our choices, and I should get back to work?

<comment><AUTHOR> Agreed! I think it's super important to avoid getting burned out, but I really wanted to highlight the importance of getting to new rungs, though, before you stop for so long that you slip back down.

Where do you personally find the optimums of productivity? For me it's all about having enough projects going that when I get tired of one, I can switch to another and feel fresh about it.

<comment><USER5> Sadly for me I think I still approach productivity in a very "barbaric" way- I have long periods of idleness and procrastination, then I rush a fuckton of work all at once. I've seen some success in my personal projects from writing daily, but I haven't yet adapted such practices to my work and other commitments... I'm an unproductive person who shouldn't be talking about this, heh.

</comment></comment></comment><comment><USER6> This title is missing a "for me".

I am all for finding out your personal way of doing things, but don't call things bullshit just because they don't work for you.

</comment><comment><USER7> I see this type of thinking as the road to procrastination.

If you see each task as a large do or die task that needs sacrifice and extended concentration to complete otherwise there is no point even starting it... you don't start it.

That said, I do agree with this type of thinking and believe many other people do too which is why procrastination is such a widespread problem! My broader take is that you need gears and know when to change up/down. Sometimes you are going up hill and sometimes downhill. Sometimes you need to brake and sometimes steering is more important than speed. Ahhh car metaphores...

</comment><comment><USER8> As someone who has managed many people, I believe this is a personality type. I've seen many programmers who make consistent, daily progress. In my experience that is the most common type. I've also seen a good number of people as described in the article. And there was one programmer that worked for me that took it to an extreme. She would do nothing for a week and a half and then do two weeks of work in a day or two.

I think it is important to find what works to motivate you on a personal level. Sounds like OP made a step in that direction but may be over applying the advice to other people.

</comment><comment><USER9> Even though I get tired of all the "rules" the entrepreneurial community sets out, half of which contradict the other half, I can completely relate to "slow and steady is bullshit" idea.

I started a company when I was 23 and found product-market fit almost immediately. But, being young, naive and completely unexposed to "real" entrepreneurship, I tried to grow the company organically, customer by customer, market by market (in my case, TV markets) rather than raise money. I woke up every day, hit my cold call targets, and spent the rest of the time coding, dealing with other IT issues, recruiting, managing employees, bookkeeping, etc.

While I was busy gathering rinky-dink customers in one corner of the country, my competitors raised money, expanded nationwide, and completely ate my lunch.

While this may be of the "well, that sounds like a personal problem" variety, I believe the following holds true when a new "gold mine" (i.e. as yet unrecognized market opportunity) is discovered by one or more companies:

"Even if you're growing, if you're not growing like crazy, you're falling behind, comparatively."

For example, let's say there's a company competing with Uber that's growing by 2x per year. In a vacuum, that's great, right? But not in reality. Uber is growing at like 100x per year and will eventually destroy that company.

So yes, I completely agree with OP, a least in terms of startups.

</comment><comment><USER10> Pointless machismo is tiresome.

</comment><comment><USER11> Overworking oneself is foolish. Great labor is made with precise work in clear thought, under a nourished and well-recovered body. Strokes of genius on the other hand, can be better aptly recognized for their origin of the mad spurious scientist. Software development usually does not involve too many strokes of genius. The hardest part is being precise, and being comprehensive. Do not take stimulants, code like a maniac, and kill yourself to build something. Build it calmly and collectively. This will reduce regret, and ensure that you do not sacrifice your health for a lucky strike.

</comment><comment><USER12> {one conventional wisdom} is better than {other conventional wisdom}

Next week rolls around....

No OP was wrong! {Other conventional wisdom} is better than {one conventional wisdom} because of their personal story!

</comment><comment><USER13> A friend once said of "The 7 habits of highly effective people" that the first habit was not wasting time reading self help books.

In a similar vein I suspect one of the key behaviors driving productivity might be not spending much time writing about productivity on the internet.

Irony of posting this understood obv, but then I make no claims to productivity, quite the opposite.

<comment><USER14> Actually reading self-help and productivity books is a great way to invigorate your productivity. That is why productivity blogs are so popular.

I will happily read or reread a productivity book just to be inspired to get my game on.

<comment><USER15> It's also a great way to waste time, and fool yourself into thinking you're doing the right thing, when you would actually be better off spending the time working.

<comment><USER14> At least it is a form of "sharpening the saw" (to quote Covey). You are still in the mode of thinking about how to be a better worker.

There are a whole lot of time sinks on the internet that are much much worse ways of wasting time.

</comment></comment></comment></comment><comment><USER3> 2-3 times per year you can go all-out for 3-4 weeks. The rest of the year you have to go at a much slower pace.

To make good progress both methods need to be used together.

Look at dieting. It is very easy and painless to eat 150-200 calories below maintenance per day (as an average sized man). You just eat a little bit less. E.g. If you normally get a large meal at McDonalds then get a medium instead. But over a year that adds up to 15 odd pounds of fat!

Or you can go on a hardcore diet and lose 3-4 pounds a week! If you are smart you will do it for 3-4 weeks and then taper off onto the slow and steady method for the rest of the year.

The problem is people see a huge amount of progress in those 3-4 weeks and think "If it works for 4 weeks I'll keep it up until I have a 6-pack". Then they crash and put it all back on.

<comment><USER16> > Look at dieting. It is very easy and painless to eat 150-200 calories below > maintenance per day

Were you intentionally trying to make the reverse point? 'Cause this may be the worst possible example, otherwise: it's clearly _not_ easy and painless to eat 200 calories below maintenance every day, given the huge obesity problem we have.

<comment><USER3> It is easy and painless. Pretty much everyone has the willpower to be able to order the medium sized McDonalds meal rather than the large (or the large instead of the super-sized). Or to use smaller sized plates when eating at home.

People don't stick to it because the results aren't very visible and they aren't fast. Not because it is difficult.

If you are 60 pounds overweight and somebody tells you to simply eat a little less and in 4-5 years you will be a healthy weight is that really going to motivate you to change?

</comment></comment></comment><comment><USER17> That was my thinking too, that being said, i would be much further in my sportive efforts if i would have taken the slow and steady approach. sure you can burn yourself out for three months, take a break and repeat the cycle, that is, if you don't loose interest because of overtraining, and get distracted with other stuff. better 15 minutes a day a whole life than 3 or more hours a day for who knows how long.

</comment><comment><USER18> works well when planned well. example, if you don't know linux, you can download the whole linuxfromscratch.org and read a few page during weekdays, and burn your weekend implementing it... or if you don't know much c++, you can download and find a few pdfs and videos online during weekends and burn yourself during weekdays... at least it works for me and gave me food for survival... :)

</comment><comment><USER19> Steady and slow is actually a great way to accomplish long term goals. Average speed is sometimes more important. Especially in fitness.

</comment><comment><USER20> Different people have different ways of working. OP likes to works in sprints. Others might not. YMMV.

</comment><comment><USER21> [http://xkcd.com/874/](http://xkcd.com/874/)

</comment><comment><USER22> bullshit

<comment><USER23> He can focus 3 weeks of work in an evening and ... leap over tall buildings. Don't be jealous. ;-)</comment></comment>


A friendly guide to colours in data visualisation - <AUTHOR> https://blog.datawrapper.de/colorguide/ <comment><USER2> IBM did research back in the 90s on perceptually-based colormaps and how to best represent various types of data within the color dimensions of luminescence, saturation and hue [1]. For exmpale, they found that,

(1) Hue was not a good dimension for encoding magnitude information, i.e. rainbow color maps are bad.

(2) The mechanisms in human vision responsible for high spatial frequency information processing are luminance channels. If the data to be represented have high spatial frequency, use a colormap which has a strong luminance variation across the data range.

(3) For interval and ratio data, both luminance- and saturation-varying colormaps should produce the effect of having equal steps in data value correspond to equal perceptual steps, but the first will be most effective for high spatial frequency data variations and the second will be most effective for low spatial frequency variations.

===

[1] [https://www.research.ibm.com/people/l/lloydt/color/color.HTM](https://www.research.ibm.com/people/l/lloydt/color/color.HTM)

or as pdf:

[https://github.com/frankMilde/interesting- reads/blob/master/...](https://github.com/frankMilde/interesting- reads/blob/master/ibm-research__why-should-engineers-and-scientists-be- worried-about-color.pdf)

<comment><USER3> As a result, we have the colormap Viridis [0] [1], which is universally one of the best options available. Odd to see a data viz article about color choice in 2018 that doesn't mention Viridis.

[0]: [https://www.youtube.com/watch?v=xAoljeRJ3lU](https://www.youtube.com/watch?v=xAoljeRJ3lU)

[1]: [https://www.youtube.com/watch?v=TojFwkglCKs](https://www.youtube.com/watch?v=TojFwkglCKs)

<comment><USER4> And yesterday a paper explaining the process of creating Cividis, an even more CVD friendly iteration, was published on plos.org[0]. It's already in Matplotlib, and available for R[1].

(I submitted it yesterday but it didn't get much traction[2], which makes sense given how specific it is)

[0] [http://journals.plos.org/plosone/article?id=10.1371%2Fjourna...](http://journals.plos.org/plosone/article?id=10.1371%2Fjournal.pone.0199239)

[1] [https://github.com/marcosci/cividis](https://github.com/marcosci/cividis)

[2] [https://news.ycombinator.com/item?id=17667572](https://news.ycombinator.com/item?id=17667572)

<comment><USER5> I looked at the paper, and wouldn't really call cividis an iteration of viridis. It's more of a conversion of viridis to "CVD colorspace" (can you say that?), with a few tweaks applied.

<comment><USER4> Well, from my CVD point of view it looks like one ;). It's largely the same except with better color contrast and ability to distinguish detail. But I understand it actually is missing a significant chunk of green hues for the non-colorblind.

</comment></comment></comment></comment></comment><comment><USER6> I've started using the Natural Color System, [https://en.wikipedia.org/wiki/Natural_Color_System](https://en.wikipedia.org/wiki/Natural_Color_System), for my matplotlib visualisations. Snippet of code I use on categorical data:

      good_patch = matplotlib.patches.Patch(color='#009F6B', label='good')
      marginal_patch = matplotlib.patches.Patch(color='#FFD300', label='marginal')
      warning_patch = matplotlib.patches.Patch(color='#FF751F', label='warnings')
      bad_patch = matplotlib.patches.Patch(color='#C40233', label='bad')
      flag_patch = matplotlib.patches.Patch(color='#0087BD', label='flag')
      unknown_patch = matplotlib.patches.Patch(color='#808080', label='unknown')

<comment><USER7> This immediately reminded me of color choices of the Google's "material design".

</comment></comment><comment><USER8> Just to make this even more tricky - please be aware of the small but significant segment of your readers who are likely colourblind to some extent! I have quite severe red/green difficulties and it renders many visualisations useless.

I wrote about my experience here -> [https://mcconnellsoftware.github.io/colourblind-in- software-...](https://mcconnellsoftware.github.io/colourblind-in-software- driven-world/)

<comment><USER9> They did mention it just for anyone curious

"Viz Palette also makes it easy to check if your colors can be distinguished by colorblind people. A browser extension like Spectrum, an online tool like Coblis or an app like Sim Daltonism can simulate the colors as seen by people with different types of colorblindness, too. In Datawrapper, we integrated a color blindness simulator, so no external tool is necessary."

</comment></comment><comment><USER10> This is a great article with a lot of useful resources. One thing I like in theory, but feel pain doing in practice, is generating color palettes for each new web project. There doesn't seem to be a good tool to just spit out a full blown palette for an app much the way bootstrap or other UI kits give you where you have not only primary and accent colors, but shades for hover, disabled states, a "rainbow" of colors for info, warning, success, etc. I really enjoyed seeing the WWDC presentations[1][2] on dark mode. I think their work does a good job of moving this idea forward for Apple devs, but for the web it would be awesome to see something that generates palettes for CSS (and pre-processors) and JS so you can standardize colors in a similar way.

[1][https://developer.apple.com/videos/play/wwdc2018/210/](https://developer.apple.com/videos/play/wwdc2018/210/) [2][https://developer.apple.com/videos/play/wwdc2018/218/](https://developer.apple.com/videos/play/wwdc2018/218/)

</comment><comment><USER11> For color and data visualization, I suggest reading the following from Nature Methods published almost 8 years ago:

[https://www.nature.com/articles/nmeth0810-573](https://www.nature.com/articles/nmeth0810-573) [https://www.nature.com/articles/nmeth.2134](https://www.nature.com/articles/nmeth.2134)

Also, these two are from the "point of significance" column of the said journal which is very informative and good quality. And the column basically covers how to make good figures and present data

<comment><USER12> Paywalled. Any alternative sources?

<comment><USER11> DOI:10.1038/nmeth0810-573 10.1038/nmeth.2134

</comment></comment></comment><comment><USER13> I produce graphical reporting occasionally at my job (manufacturing plant).

Around here a lot of People still like to print physical copies of the morning reports. One thing I've found is that although colors may be distinguishable from each other when viewed on a screen on a print out similar colors all blur together for this reason I like to make sure there is a high contrast between neighboring regions (especially on things like stacked bar charts).

Other big issue is Overhead projectors. It's pretty common for people to review graphs in morning meetings and similar. A lot of projectors are low resolution and also get used in places like control rooms with poor ambient lighting so you can have similar problem with distinguishing color hues.

Using patterns (cross hatching etc) as well as colors also helps distinguish regions from each other.

If you look at industrial control software how dials gauges and the like are represented you can get some good tips on best practices and how to make high contrast easily distinguishable graphics. These things are designed for maximum readability.

</comment><comment><USER14> Can someone give me feedback on what would make the presentation of this data better?

[https://efficiencyiseverything.com/food/](https://efficiencyiseverything.com/food/)

There are lots of Calories Per Dollar, Protein Per Dollar, etc... data for specific food items.

The pages were recently updated so the tables are sort-able, but there might be too much data, and reducing the data is bad for the user.

Any suggestions?

<comment><USER15> If you want a quick at a glance visualization a bar chart of your calories per dollar amount would help users directly compare two items.

</comment></comment><comment><USER16> Nature Blog had a recent article about scientific figures:

[http://blogs.nature.com/onyourwavelength/2018/07/18/heuristi...](http://blogs.nature.com/onyourwavelength/2018/07/18/heuristics- for-better-figures/)

</comment><comment><USER17> Very useful guide. Colour is such an integral part of good UX.

<comment><USER18> I have so many to-dos, compress pictures, add javascript to add features, and now color...

Oh, and the actual product, that too.

<comment><USER19> To me color knowledge is akin to other cultural backgrounds one (who works in any slightly artistic environment such as UI/UX) must have a priori, not a posteriori of the work. It doesn't add up to your TODO list, that's what I am saying.

PS: image optimization should be done automatically IMHO

</comment></comment></comment><comment><USER20> To expand beyond color, Christopher Healey has an extensive report on perceptions of visualizations and the different elements you can use to identify things [1].

[1] [https://www.csc2.ncsu.edu/faculty/healey/PP/index.html](https://www.csc2.ncsu.edu/faculty/healey/PP/index.html)</comment>


Dale Carnegie is Wrong - <AUTHOR> http://greyenlightenment.com/dale-carnegie-is-wrong/

<comment><USER2> I've always thought the two most important pieces of the book are:

1\. Talk in terms of the other person's interest.

2\. Make people feel important.

And if you're Bill Gates, you've covered both of those things in spades simply by being Bill Gates and speaking to somebody.

Picking out extreme outliers like Elon Musk and Steve Ballmer and using them as primary examples of why Dale Carnegie is wrong is, to me, a very specious argument.

The book isn't for outliers, it's for everybody, and there are countless examples of this book having a profoundly beneficial impact on people's lives and how they relate to others, especially in a professional setting.

</comment><comment><USER3> Interesting article ... I do believe that competence, skills and being useful to others is the most important currency in today's world ... this article is worth reading ... thanks for sharing</comment>


A Brief Tour of SunPy – SunPy v0.8.1 – Time Series Data - <AUTHOR> https://www.reddit.com/r/iotml/comments/6wccv7/a_brief_tour_of_sunpy_sunpy_v081_time_series_data/ <comment><AUTHOR> Submitting this through a new niche subreddit I'm trying to grow for those interested in the intersection of real-time data science and connected devices.</comment>


Browser logos - <AUTHOR> https://github.com/paulirish/browser-logos <comment><USER2> Does anyone know if the _old_ Chrome [1] and Firefox [2] logos are available too? To be brutally honest 3D is better than 2D.

[1]: [http://www.google.com/landing/chrome/ugc/chrome- icon.jpg](http://www.google.com/landing/chrome/ugc/chrome-icon.jpg)

[2]: [http://people.mozilla.org/~faaborg/files/shiretoko/firefoxIc...](http://people.mozilla.org/~faaborg/files/shiretoko/firefoxIcon/firefox-512-noshadow.png)

<comment><USER3> Damn, I'd forgotten how shiny that old logo is. I still love the old ones over the new.

<comment><USER4> I know it's kind of anachronistic, but I miss lickable UIs. Can we do super- shiny true 3D objects once we're done with flat? I want to see consistent lighting and envmapping across my entire UI, including icons, and icons actually being 3D objects that pop-out when you use a 3D display.

...I do not have good taste.

<comment><USER5> People already tried: [http://www.enlightenment.org/p.php?p=about/e17&l=en](http://www.enlightenment.org/p.php?p=about/e17&l=en)

</comment></comment></comment></comment><comment><USER6> This is fascinating; I was aware of hardly a third of these. I wish at least the lesser-known ones came with a tagline to explain the point of them/their major features, though that's obviously not the goal of the project.

<comment><USER7> Yeah, I can't tell how many of these are Webkit clones and how many are really novel approaches. The fact that so many of them actually have enough momentum to have a well designed and unique logo really blows my mind though. It's like there's a whole "world of browsers" I didn't know existed.

<comment><USER8> I used to use all sorts of random browsers years ago. I forget the main one, but it used Gecko, and had mouse gestures built in by default, and some other unique features. Was really nice, and this was back in 2005, 2006?

<comment><USER9> Just guessing, but maybe Sleipnir? [https://en.wikipedia.org/wiki/Sleipnir_%28web_browser%29](https://en.wikipedia.org/wiki/Sleipnir_%28web_browser%29)

<comment><USER8> Nope, it was K-Meleon! I remembered just now :)

</comment></comment></comment></comment></comment><comment><USER10> What, no Lynx?

[http://whichbrowser.info/images/Lynx- logo.jpg](http://whichbrowser.info/images/Lynx-logo.jpg)

<comment><USER11> And if historically significant but now obsolete browsers were added (Mosaic, Netscape...), this would be fearsomely comprehensive.

<comment><USER12> Obsolete? I still use it on headless boxes. Should I be using something else now?

<comment><USER13> Check out the forks of Links: [http://en.wikipedia.org/wiki/Links_(web_browser)](http://en.wikipedia.org/wiki/Links_\(web_browser\)) ... There is a console and optional (to compile) graphics mode.

The section on the graphics stack is an interesting read.

<comment><USER14> Thank you for this. I really like that it's a totally self-contained (not even dependent on system fonts) and has nifty tricks for efficiency.

</comment></comment></comment></comment></comment><comment><USER15> Does anyone remember Ghostzilla (or something to that effect?)

It was a browser that made a page monochromatic and made it appear in the chrome of another application. If your mouse left the page, it reverted back to the original chromed app.

It was fantastic for slacking. The programmer shut it down shortly after it was released. It was one of the best hacks I've ever seen.

</comment><comment><USER16> The browser ponies make it all worthwhile.

<comment><USER17> Indeed :). The link at the bottom (to "more browser ponies"):

[http://paulirish.deviantart.com/favourites/51528712](http://paulirish.deviantart.com/favourites/51528712)

That said, I didn't know so many browsers existed. I guess it is part of Paul Irish's job to do so :)

[http://en.wikipedia.org/wiki/Paul_Irish](http://en.wikipedia.org/wiki/Paul_Irish)

</comment></comment><comment><USER18> Kind of disappointed this isn't on there, if only for old time sake:

[http://i.imgur.com/NJWpCbk.jpg](http://i.imgur.com/NJWpCbk.jpg)

Surely there's someone out there still using Netscape.

<comment><USER19> And then there's the very first Mosaic Communications browser:

[http://readwrite.com/files/files/files/enterprise/NCSA%25252...](http://readwrite.com/files/files/files/enterprise/NCSA%252520Mosaic%252520logo.jpg)

[http://www.unc.edu/depts/jomc/academics/dri/011/mosaic.gif](http://www.unc.edu/depts/jomc/academics/dri/011/mosaic.gif)

[http://home.mcom.com/MCOM/images/mcomwelcome1.gif](http://home.mcom.com/MCOM/images/mcomwelcome1.gif)

</comment></comment><comment><USER20> I'm glad that this repo exists. However, to play Devil's-Non-Lawyer-Advocate, is there any danger of trademark infringement for some of these logos (especially IE)?

<comment><USER21> No, there is no danger of trademark infringement [by this page].

Yes, you could still be sued and a settlement might cost less than a defence.

Trademarks indicate the origin of goods and services. Trademark infringement comes when you do commercial activity [not necessarily for money] and the public get confused as to whether that activity is by the company owning a particular mark.

The logo reproductions _could_ be copyright infringement however; this is highly dependent on jurisdiction.

[This is not legal advice and should not be relied on.]

</comment></comment><comment><USER22> What about Arora [1]?

[1] [https://en.wikipedia.org/wiki/Arora_(web_browser)](https://en.wikipedia.org/wiki/Arora_\(web_browser\))

</comment><comment><USER23> I'd love to have the logos in SVG format.

<comment><USER15> I'd imagine you can find many of them on Brandsoftheworld

<comment><USER23> Indeed, thank you for this!

</comment></comment></comment><comment><USER24> Wow, half of the logos are featuring a globe of some sort. And of those, many of them have an animal surrounding it.

<comment><USER25> Doesn't surprised me. The browser is to access the _world_ wide web after all.

</comment></comment><comment><USER26> When you see all these logos in a list, none of them particularly shout the web at me. I'm not smitten by any. The only standout one was the little spaceman with the earth in his visor's reflection. All a bit drab save for Iceweasel. I think I prefered the netscape logo.

<comment><USER27> The Epiphany logo really expressed "web browser" for me — not beautiful, mind you, but expressive. Other than that, I'm with you.

<comment><USER26> I assume you mean Epiphany's logo of an earth with a pointer on top. Is an image of the earth synonymous with viewing web pages? Not really, but an image of the earth has global connotations. Nightly's logo looks like an earth from space (at night), with little dots between cities/nodes I guess representing both lights and communications. It's not that obvious and doesn't translate well. The pointer on the Epiphany logo feels a little dated.

At least the Navigator wheel conjures up the idea that I'm out at sea at the helm. A little romantic I know. I quite like the image on William Gibson's book virtual light, the idea of virtual glasses.

</comment></comment></comment><comment><USER28> You might wanna check out: [http://mehmetaliakyol.com.tr/play/bl/](http://mehmetaliakyol.com.tr/play/bl/) It is a simple API, inspired by Paul Irish' work.

</comment><comment><USER29> This makes me curious about some of these browsers I've never heard of. I feel like I am at Egghead software back in the day browsing boxes on the shelf.

</comment><comment><USER30> What, no love for Dillo?

</comment><comment><USER31> Thank you for sharing. This will save me a lot of time.

</comment><comment><USER32> What, no IE5? I mean IE<6? And Netscape too :)

<comment><USER33> [http://logos.wikia.com/wiki/Internet_Explorer](http://logos.wikia.com/wiki/Internet_Explorer)

</comment></comment><comment><USER34> Where's my xxxterm/xombrero?

</comment><comment><USER35> Ok, I am impressed

</comment><comment><USER36> Missing IE 11.

</comment><comment><USER37> What is this?

<comment><USER38> Seriously? "vector and raster versions of all browser logos possible. transparent backgrounds."

<comment><USER37> Well, I don't understand the "all browser logos possible" part. Is it a generator?

</comment></comment></comment><comment><USER39> What is this doing at the top of HN? Maybe that 4chan thread had something right.</comment>


Dallas' Carmack could be the hidden key to the Oculus VR acquisition - <AUTHOR> http://launchdfw.com/editorial/dallas-carmack-could-be-the-hidden-key-to-the-oculus-vr-acquisition/ <comment><USER2> I basically said this on Reddit:

Carmack has a good resume, but its entirely possible he already peaked. The average engineers career track is something like this:

Young and creative, new ideas but lacks the skills to achieve them which evolves into young, and has refined ideas plus now has some skills which then evolves into older, refined skills, and refined existing ideas. When an engineer is making things, this is his peak. Ending with skills are obsolete, and refined ideas are obsolete

At the end, engineers go in 3 directions. They find a niche supporting the technology of their peak, they try to reinvent themselves, but very typically are inferior to their younger counterparts. Or three they leverage the larger concepts of their experience and manage their younger counterparts.

Carmack was notable because he was banging out great code when he still had edgy ideas. I don't know how his ideas have evolved since then, and he may still be a shining diamond. Its possible. But it would be very noteworthy if someone had the capability to change an industry twice.

<comment><USER3> "But it would be very noteworthy if someone had the capability to change an industry twice." \- VR is a part of his original vision, it's just that hardware was not ready.

Even if he peaked as a coder he is still invaluable as an expert in graphics and gamedev. Especially with low-level coding around those areas. A great attractor of future tech talent to the company as well I guess.

He also improves the image of the company in the eyes of hardcore gamers and geeks: 'OK, they sold to Facebook, but Carmack is still there and he is not a sell-out, so maybe it will turn out OK.'</comment></comment>


Ask HN: Bloggers or content marketers, how do you get feedback? - <AUTHOR> Do you have a process for getting feedback for new posts you write, either for personal blogs or for content marketing posts?  If so, what is it?  Personal friends, professional development groups, asking for critiques on HN or elsewhere?  I'm more interested in what you do before you hit the "publish" button, rather than getting reader comments afterward. <comment><AUTHOR> And a follow-up to that: have you ever, or would you ever consider, paying for feedback/editing services on a post you write? Would the ROI be worth it for you (in particular, for a marketing blog)? Or at that point would it be easier to pay a PR firm to write for you?

<comment><USER2> I would consider paying a small amount for feedback/editing but I would expect the feedback to be very good otherwise, I would not continue to use the service.

I would also consider to exchange feedback for feedback.

</comment></comment><comment><USER2> For my personal blog I (mostly) don't collect feedback before I hit the publish button but I correct the blog post according to the feedback I get afterward.

<comment><AUTHOR> What sort of traffic (ballpark numbers) do you get there?</comment></comment>


The Panopticon Is Already Here - <AUTHOR> https://www.theatlantic.com/magazine/archive/2020/09/china-ai-surveillance/614197/ <comment><USER2> Must read, imho. Subtitle: China's AI Surveillance State Goes Global.</comment>


Hacking Filmmaking: Iterate, Focus on the Product (sounds familiar) - <AUTHOR> http://mashable.com/2009/07/25/youtube-comiccon/

<comment><USER2> Creative endeavor is so similar. The auteur model fits so well. It's a business, but it's also a craft. There's tech and art and communication all rolled into one.

The last part spoke to me the most -- it is _HARD_ to start these days, but the other stuff out there is so terrible that it will be plain as day when you've created something good.

</comment><comment><AUTHOR> ...Tarantion, Roberto Rodriquez, et al...</comment>


Do you want to see the world from other eyes? - <AUTHOR> Our main website is in the construction phase but we want to know your opinions about the idea. You can find informations in our coming soon page. http://paradict.com <comment><USER2> yes, let's see what it will be like</comment>


Online rating systems are broken - <AUTHOR> https://medium.com/@datashovel/online-rating-systems-are-broken-bf1f6adeb6f#.466995awl <comment><USER2> If I vote this up, does that mean I didn't like it?</comment>


Your price may be too low, increasing it may spur sales - <AUTHOR> http://www.b2brainmaker.com/blog/40-blog/139-your-price-may-be-too-low-increasing-it-may-spur-sales

<comment><USER2> Correct. And I follow this "strategy" since some years when it comes to services and specialized products (not mass products, which I make as cheap as possible). Low prices usually attract nasty clients with inappropriate expectations.

And from my side as a client: E.g., I don't look at clothes that are cheap. They usually don't look good, have low quality, wearing them feels unpleasant and--very important--send wrong signals to those who know good clothes (and believe me, many important people spot the quality of your clothes). Going for long-lasting quality usually has its price. I'm not necessarily buying expensive stuff because it's expensive, but it gets my attention at least.

</comment><comment><USER3> I'm not too sure about the name of that website:

"He rain-made you. A guy says if you pay him, he can make it rain. You pay him. If and when it rains, he takes the credit. If and when it doesn't, he finds reasons for you to pay him more. Clay Davis rain-made you!"

That aside, this is not rocket-science, just basic marketing. The only proviso is that you can price yourself out of the market. I recently purchased a new AV product for half the originally-quoted price. I liked it for its convenience, simplicity, etc, but it wasn't so simple and so convenient I would pay UKP5000 to replace Kaspersky at UKP1700, nearly 3x the amount. The sales guy took the point and brought the price down to UKP2500. So, I paid extra but felt like I got a bargain, which says plenty for that guy's sales skills.

</comment><comment><USER4> Also, if your product can be used by a customer in a way that they can see a direct dollar value stemming from it's usage don't be afraid to charge an amount proportional to that dollar value.

Even a very simple product may be worth $100 a month to someone if they can directly see $500 being added to the bottom line with it's use. Sometimes these types of products cheapen themselves by selling for proportional low prices.

</comment><comment><USER5> There is a lot of upside to being perceived as a luxury good. I think Apple is the model example. Anecdotally, I know my mom charges a lot more for piano lessons than many other teachers in the area. Which has the effect of making her more sought out by suburban parents with disposable income.

<comment><USER6> I hope this won't come off as too critical, but you're using the word "penultimate" incorrectly- I've done it myself many times.

To quote Wikipedia, "The ultimate is the last and final item in a series. The related words penultimate and antepenultimate refer to the second-to-last and the third-to-last item in a series, respectively."

<comment><USER5> There's no need to apologize for critique. Thanks.

</comment></comment></comment><comment><USER7> Yeah, this is often true. My iPhone app sells better at 2.99 than 1.99, and I may bump the price again. Hard to A/B test on the App Store though.

</comment><comment><USER8> Price elasticity testing is one of the simplest, and most profitable experiments you can run in an A/B testing engine:

[http://www.marketingexperiments.com/improving-website- conver...](http://www.marketingexperiments.com/improving-website- conversion/finding-ideal-price-points.html)

<http://en.wikipedia.org/wiki/Price_elasticity_of_demand></comment>


Massive Google Wifi outage - <AUTHOR> Google is having some sort of issues with accounts today, and apparently that caused[0] a lot of their mesh routers to reset to factory defaults. Not sure how widespread this is, but there are a TON of people who are not happy.[1]
For my part, I reconfigured my routers this evening, and then a few hours later, they reset themselves again.
The beauty of cloud-managed hardware...
[0] https://support.google.com/wifi/answer/7335595
[1] https://productforums.google.com/forum/m/#!category-topic/googlewifi/Wifi/38Q-v9lBDRg <comment><USER2> Do you need a better proof that you're not in control of your own device you paid for ?

<comment><AUTHOR> Seriously. I'm returning these.

<comment><USER3> Why even buy em in the first place? Seems more like a product tailored to people who aren't really tech savvy, which I'd be surprised to find on HN.

<comment><AUTHOR> Tired of fucking around with flashing custom firmware, manually setting up networks, etc. This just seemed like a painless option.

Nope.

</comment></comment></comment></comment><comment><AUTHOR> Not sure why my links didn't linkify. Trying again.

[0] [https://support.google.com/wifi/answer/7335595](https://support.google.com/wifi/answer/7335595)

[1] [https://productforums.google.com/forum/m/#!category- topic/go...](https://productforums.google.com/forum/m/#!category- topic/googlewifi/Wifi/38Q-v9lBDRg)

<comment><USER4> Thanks. FWIW, links in posts (as in, not comments) don't linkify; an Arc thing. Probably meant to combat spam.

</comment></comment><comment><USER5> We discovered 7 earth like planets yesterday, google and cloudfare went full chaos today.

</comment><comment><USER6> Today, all my Androids required me to reenter my password. May be related to the Google Accounts problem. Is there any more info about it?

<comment><USER7> That was due to the travisCI oauth issue. Google just signed everyone out that was authed to TravisCI

<comment><USER8> Something more general. I got signed out, and I've never used TravisCI.

</comment></comment></comment><comment><USER9> I would rather not have my network gear directly connected to Google. It's enough already that you don't have much choice on the internet.

</comment><comment><USER10> I actually had issue last weekend. One of the 3 routers died (shows as offline), So I tried reconfigure by unplugging and replugging it in. The light went on for few seconds, and the whole thing won't light up again. looks like dead.

</comment><comment><USER11> [https://www.howtogeek.com/206620/how-to-automatically- reboot...](https://www.howtogeek.com/206620/how-to-automatically-reboot-your- router-the-geeky-way/)

I think complete online based bot attack is happening write now targeting a particular device vendor of google. That's why the even internal router of gmail got reset.

<comment><USER12> Care to elaborate on that?

<comment><USER13> I second this petition</comment></comment></comment>


Why Education Startups Do Not Succeed  - <AUTHOR> http://www.quora.com/Avichal-Garg/Education-Startups/Why-Education-Startups-Do-Not-Succeed

<comment><USER2> As someone who yearns to start an education start-up I think this is very good reading.

TL;DR from Quora:

 _Most entrepreneurs in education build the wrong type of business, because entrepreneurs think of education as a quality problem. The average person thinks of it as a cost problem._

 _Building in education does not follow an Internet company's growth curve. Do it because you want to fix problems in education for the next 20 years._

 _There are opportunities in education in servicing the poor in the US and building a company in Asia — not in selling to the middle class in the US._

 _The underlying culture will change and expose interesting opportunities in the long term, but probably not for another 5 years._</comment>


Ask HN: Has the scoring system for articles changed recently? - <AUTHOR>

This is probably completely coincidental, but I've noticed several posts with three or four points that are nearly an hour old or older on the front page. Is this normally how the scoring system works? <comment><USER2> Yes. Items rise with points, sink with time and flags, and are penalized if they don't actually have a link (such as your question here). If items get a few votes very early, and it's a reasonably quiet time, 4 or 5 votes can easily be enough to get to the front page for a time.

It may be that there have been recent scoring tweaks, but your observations don't really support the conclusion.

Disclaimer: I'm just a user, I have no inside knowledge.

</comment><comment><USER3> It actually used to happen more than it is now, the dynamic of HN is definitely changing though, more so due to the change in HN's demographics than anything else.

It used to be the case that an article with more than 100 upvotes was something really special, now half the articles on the front page have that many votes.

Articles have to be much more mainstream in order to have a chance on the front page. Hence the fact we have far more tabaloidy type articles like "Here's How U.S. Spies Will Find You Through Your Pics", "Another Airbnb Victim Tells His Story" and "Getting Bin Laden" on the front page.

<comment><AUTHOR> Not sure I like this change in demographics... :\ But it seems to happen to all communities like HN.</comment></comment>


Is curl|bash insecure? - <AUTHOR> https://blog.sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install.html?hn=1 <comment><USER2> First off, my problem has always been not just with `curl ... | bash` but specifically with `curl [http://..](http://..). | bash`. Notice the http, not https scheme there.

Second, I feel like this is a huge anti-pattern. Why the heck are you writing a custom installer like this? Each platform has its own system for doing installs and upgrades. Package it for the OS you actually support, such as Debian, Red Hat, etc. It's pretty much a one time investment and it makes your software that much easier to maintain on my system. `curl | bash` makes me think that (a) your software will not play nicely with my OS and I'll have to figure out your weird locations for where you are putting your init scripts, config files, data, etc. and (b) that upgrades will be manual and painful. In other words `curl | bash` is for chumps (tm).

<comment><USER3> You're not _wrong_ , exactly, but what ends up being brutal is not just packaging, it's packaging _and_ supporting dependency management + post- install configuration.

RPMs, for example, are pretty terrible at allowing you to specify custom configuration parameters, and you can't use them at all to install something that you don't have root privileges to access.

Custom installers also allow you to have a lot more flexibility in terms of saying, "Okay, let's look to see if there's a mysql instance installed on the system, there's not, so rather than installing an OS one, we'll go ahead and install our preferred mysql version and treat it as an embedded db".

RPM-driven upgrades also end up being a lot messier, since you can't do templated or merged configuration files easily.

I'm not saying that the curl | bash strategy is good either, but forcing OS packages down people's throats isn't ideal for various situations.

EDIT: also, you can't do multiple installs of the same RPM package on a system. So even if you wanted to install 5 instances of app X on a machine, possibly for testing reasons, you can't, and you end up having to use VMs or containers or hacking something together.

<comment><USER3> Gosh, and let's not forget that RPMs can also contain pre- and post- hook scripts, so you could be in a situation where you say, "Install this RPM and satisfy dependencies", and another RPM is downloaded and installed _as root_ , with you never seeing the scripts that are going to be run as part of that process.

You can inspect the scripts by hand by examining the package files, but in some ways it's _less_ transparent than downloading a script and running that.

<comment><USER2> You are downloading software from the internet. How it executes code on your machine is irrelevant, you already trust it. Or do you review every OS package you install for shenanigans on every update? This is an especially bad point to bring up in the context Sandstorm, which runs stuff as root all the time. Do you mean to say that you trust them enough to run a bunch of stuff as root on your server, but not to run a post-install script?

<comment><USER4> No, but I do trust some software enough to run as non-root. Sadly to install this non-root software I need to install the RPM as root, and then I have no idea what it's going to do during the pre- and post- hook scripts.

<comment><USER2> I suppose. Though have you considered the fact that if someone has non-root local access to your machine, they are just one local privilege escalation away form becoming root? And these things come out fairly frequently that you can pretty much count on one being found soon. In other words IMO you should either trust or not trust a piece of code to run on your machine. The distinction between root and non-root user running the code is more for maintainability and sanity and less for actual security.

</comment></comment></comment></comment></comment></comment><comment><USER5> Something I haven't seen mentioned in this article or these comments is that, as a sysadmin, I'm managing a lot of packages.

It's great if you're security-conscious enough to create the greatest install script ever, but I don't have the time to vet every install/upgrade script for every application I have to maintain. That's why we have repositories with signed packages: you trust the repository and you can then, with minimal effort, trust the packages and their updates.

...and that's another thing. A standardised mechanism to keep things up-to- date simply is a requirement of anything I'm going to allow to run on a server. I don't want to be faffing about to keep my servers secure.

Package management is a solved problem by now, I don't know why people are trying to make it more complicated.

<comment><USER6> Frequently, all the install script does is check what OS you're using, and run the relevant package-management incantations (e.g. for Ubuntu, [apt-key add + apt-add-repository +] apt-get update + apt-get install; for OSX, [brew tap +] brew update + brew install).

If package-management systems provided a one-liner "bring in this package source, get up-to-date with manifests, and install the root/default package provided by that source" command (in Ubuntu, "ppa-install" has been suggested numerous times), you could just have a list of such commands on your program's site's Installation page, and they would all fit on a single screen. As it is, though, the stanzas and prerequisites for each OS's incantation are complex enough that it's much simpler to provide the "bash magic" version.

<comment><USER7> On the install page for every PPA is a 1-3 line snippet you can copy and paste which will do add-apt-repository and apt-get. It's not hard and it sounds, from reading all the pro homebrew/linuxbrew comments around here, that this is more of a case that people want to reinvent something that's not broken, and are determined to do so without learning any of the lessons from the last 30 years of package management.

But hey, it prints out an emoji beer mug, so that's cool right?

<comment><USER8> No, there actually isn't. If you click a little green "read about installing" you'll get some bash snippets... which are split up into one-line-at-a-time embeds in lots of text and in any case use the placeholder "ppa:user/ppa-name" instead of substituting in the Right Thing.

</comment></comment></comment></comment><comment><USER9> The thing I don't see in this article, which I do regard as (another) drawback to curl|bash is that you're not just trusting the software developer, you're also trusting their hosting provider.

Anyone who gets access to modify that script on their server can change the content.

Now it could be that they're hosting on a dedicated system, in a datacentre that they own, with no 3rd party access, but that's very much not the norm for most companies these days, and it's impossible for a customer to verify.

This is a problem which is solved with good package signing practices, where the developer signs the content on a system they control before distribution, so at least you can verify that what you're installing is what they released.

<comment><USER10> How is that an argument against curl|bash? If you download a source tarball from the developer's website, then you are _also_ trusting their hosting provider. curl|bash changes nothing.

<comment><USER9> I was referring to cryptographic package signing (e.g. with PGP) so you validate the signature of the package before installing, this lets you validate that the package hasn't been modified since it was signed.

curl|bash ing a script does not provide this protection.

<comment><USER11> Of course you can still check signatures if you wish. Heck, sandstorm even provides instructions on how to do it on their installation manual: [https://docs.sandstorm.io/en/latest/install/#option-3-pgp- ve...](https://docs.sandstorm.io/en/latest/install/#option-3-pgp-verified- install)

<comment><USER9> But curl|bash is a one step process, as soon as you get the script you execute it, with no opportunity to check a signature...

<comment><USER4> You do realize you don't _have_ to use curl|bash, right? You can wget, verify with gpg and then bash it.

<comment><USER12> Of course, but then we're not talking about curl|bash anymore. It seems kind of contradictory to say that curl|bash is secure as long as one doesn't actually curl|bash.

<comment><USER4> I feel like curl|bash is for the masses, who don't care. Then there are more secure options for those who do care.

<comment><USER12> I think that once we're talking about installing server software at the command line, we're already beyond most of the masses.

I'd also argue that secure defaults are _most_ important for folks who don't care. And there are more secure options: the package managers.

<comment><USER11> > And there are more secure options: the package managers.

So sandstorms installation guide should in your opinion just say "wait a couple of years and maybe someone will have packaged it for your distro"? Yes, that sounds excellent way of getting users. And hey, the most secure way of installing software is not to!

<comment><USER13> you can host your own repos pretty easily, and still provide the bash script for oddball distros.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> One of the potential problems here is the fact that even just inspecting the "curl" result of the file can trick sysadmins into executing code they did not wanted executed.

Imagine the following scenario:

$ curl something.tld > installer.sh

$ cat installer.sh

"Hey, that looks safe, I'll go ahead and execute it".

$ bash installer.sh

If the install-file had terminal escape sequences, it could have been used to trick anyone into executing code they had no intention to execute.

More here, if you're interested: [https://ma.ttias.be/terminal-escape- sequences-the-new-xss-fo...](https://ma.ttias.be/terminal-escape-sequences- the-new-xss-for-linux-sysadmins/)

Bottom line: assume everything you download from the internet is malicious in nature and inspect it with every possible tool you have available. And even then, run it in a sandboxed environment wherever possible.

<comment><USER15> use `cat -v installer.sh`

         -v      Displays non-printing characters so they are visible.  Control
                 characters print as `^X' for control-X, with the exception of the
                 tab and EOL characters, which are displayed normally.  The tab
                 character, control-I, can be made visible via the -t option.  The
                 DEL character (octal 0177) prints as `^?'.  Non-ASCII characters
                 (with the high bit set) are printed as `M-' (for meta) followed
                 by the character for the low 7 bits.

[http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD- current/man1/...](http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD- current/man1/cat.1?query=cat)

<comment><USER16> Use "install.sh --oh-and-don't-delete-all-of-my-files=true".

If it's not the default, it's not what's going to happen.

</comment></comment></comment><comment><USER17> To support a "secure" curlbash for [https://github.com/tillberg/gut](https://github.com/tillberg/gut), I used shasum to verify the sha256 hash for the script that is downloaded (before it is executed), and then the script in turn verifies the sha256 hash for the tarballs _it_ downloads.

For example:

$ bash -c 'S="3bceab0bdc63b2dd7980161ae7d952ea821a23e693cb74961b0d41f61f557489";T="/tmp/gut.sh";set -e;wget -qO- "[https://www.tillberg.us/c/$S/gut-1.0.3.sh">$T;](https://www.tillberg.us/c/$S/gut-1.0.3.sh">$T;) echo "$S $T"|shasum -a256 -c-;bash $T;rm $T'

It makes for an uglier command, but it (theoretically) does a pretty good job of verifying that the thing that you download is the thing that you expect to download. It both prevents MITM attacks, TLS verification issues, as well as prevents _me_ from putting some other code there for you to download in the future instead. It either downloads the code you saw the first time it downloaded, or it fails, nothing in-between.

<comment><USER6> This is also what Sublime Text Package Control does; it embeds the SHAsum for the package-manager-packge in the Python it tells you to run to retrieve it.

I think everything would be simplified if there was a program in coreutils for "pass STDIN to STDOUT only if STDIN's shasum is $1". Then you could just `curl | shaverify xxx | bash`.

Or, alternately, we could just try to get curl and wget to implement support for (even a limited subset of) magnet URIs. The magnet schema does exactly what we want here: provides both a SHA for content verification, and an optional "xs" (exact source) parameter to make the retrieval happen from a URL rather than a DHT.

</comment></comment><comment><USER18> Well...

Is curl|bash insecure? YES

Is curl|bash more insecure than most of the ways people install software they just download from the Internet? NO

So it's not ideal, but most people don't do anything else that's much better, and it's convenient, so you can expect it to continue.

<comment><USER19> But they do. They use a package manager such as apt-get, that cryptographically checks everything.

Installing software outside the package manager is the exception here, not the norm.

<comment><USER20> And there is more: many people in security would agree that education is critical.

We educate users to download software from distributions rather than trusting random sources (that might be very safe or not).

<comment><USER21> >trusting random sources

A recent example to add to this, for those who think "nobody who's not a complete beginner would never do that":

[https://www.reddit.com/r/netsec/comments/3lefc6/chinese_ios_...](https://www.reddit.com/r/netsec/comments/3lefc6/chinese_ios_devs_download_xcode_from_3rdparty/)

</comment></comment></comment></comment><comment><USER22> You can programmatically add as much verification into your shell script to verify it's not tampered. All the Attacker has to do is replace your shell script with their own to neuter everything you did.

You will never escape the insecurity of this because you are connecting to another server and accepting whatever output it gives you to run under a bash process. They can poison your process via DNS cache; using a transparent proxy to replace the content. Don't assume that just because they are using HTTPS that it removes all attack vectors.

This is lazy; and insecure. Ship a proper package in a proper repo that people can programmatically add using Chef or Puppet or whatever their moment inspires.

P.S. don't create curl [https://uninstall.sandstorm.io](https://uninstall.sandstorm.io) | bash

<comment><USER23> HTTPS _does_ remove those attack vectors. That's kind of the point.

<comment><USER24> https with a modern transport security stack that uses HPKP, HSTS and cert pinning, sure. curl doesn't use those, though.

<comment><USER22> and when curl supports it; not every distro will ship it. Might take a decade for it to be fully supported.

</comment></comment></comment></comment><comment><USER11> I don't understand all these posts here bringing up distro repositories, pointing out their superiority. Of course it's better to install from repos and I don't think anyone is wanting to replace repo-based package management with curl|bash. But like it or not, not all software is immediately available on every possible distro. Sometimes you will want to install software from upstream for one reason or another. And for that purpose upstreams need to provide independent installation mechanisms.

curl|bash complements package managers instead of replacing them.

</comment><comment><USER25> It's almost as if they copied my blog post from last week...

[https://medium.com/@ewindisch/curl-bash-a-victimless- crime-d...](https://medium.com/@ewindisch/curl-bash-a-victimless- crime-d6676eb607c9) (HN link: [https://news.ycombinator.com/item?id=10217877](https://news.ycombinator.com/item?id=10217877))

<comment><USER26> I was not aware of your blog post when I wrote mine.

I wrote this blog post to introduce the work we did this week on PGP-verified installs and updates, which itself was motivated by Twitter threads last Friday (which you can find in my Twitter history).

If it's any consolation, when I first posted my link yesterday, it didn't get upvoted either. Apparently someone reposted it and had more success. HN is random that way.

<comment><USER25> Thank you. It is just suspicious timing, given the general lack of articles with this tone and approach. They even look similar in structure. I've had articles copied in one way or another (by others) in the past, so it wouldn't be the first time.

Thank you for responding.

</comment></comment></comment><comment><USER27> Leaving the security issue aside for a moment, they are re-implementing package management. For example:

\- What version do I have, how to I roll back to a version that works?

\- What packages do I need for this and where's the log for what you added?

\- How do I deploy this to 100 machines and be sure they all using exactly the same version.

\- How to I control it so updates only happen in my at-risk window?

\- How do I uninstall this?

Package management does all of this and using curl|bash re-invents this in a bad, non-standard way which just makes it's hard for sysadmins to do their jobs.

</comment><comment><USER28> In general I do curl https > tempo then vi tempo then bash < tempo. This gives me the opportunity to check that nobody is pwning me. If the script is an unreadable mess, I do not execute it because it is an indicator of bad software.

In general the script is clear and short.

I like very much curl https | bash as a way to explain installation procedures. It is more rigorous and effective than an english explanation. Code can be tested and improved whereas explanations are always prone to negative critics.

</comment><comment><USER29> One issue they don't address is one of culture:

curl|bash is much less secure, in general, than using your package manager (since not everyone will serve downloads over HTTPS, and won't take the steps described in the article etc.). By encouraging it, they are making this method normal, when it shouldn't become normal.

<comment><USER9> One important distinction to make is that this very much depends on what package manager you're talking about.

Linux package managers tend to use signing and other mechanisms to check content.

Software library package managers (e.g. npm, rubygems, etc) generally don't. Some of them offer signing but almost no packages are actually signed, and they don't do any curation of content.

</comment></comment><comment><USER30> What I got from this article: "`curl|bash` can be secure if you add signing, file integrity checking, and trust the source." The whole time I kept thinking, these are assurances you can get from traditional mature package management.

<comment><USER31> and also from extra steps between curl and bash. Which is the whole point in the first place. If you are going right through a pipe and letting the script verify itself then what's the point.

Are you the guy I'm looking for? YES! --> Seems trustworthy.

<comment><USER32> No the bash script doesn't verify itself. The only real verification step is using https (and writing the script so that it's not vulnerable to truncation attacks).

</comment></comment></comment><comment><USER33> _Of course, all content served by sandstorm.io – from software downloads to our blog – is served strictly over HTTPS (with HSTS)._

What HSTS? You're telling people to use curl!

<comment><USER26> Mentioning HSTS was meant to emphasize that we're serious about "HTTPS everywhere", not specifically meant to be relevant to curl, where the protocol is specified in plain view on the command line anyway. Sorry for the confusion.

</comment></comment><comment><USER34> `curl|bash` is just as secure, as downloading and executing a binary or as downloading and "make"-ing a tarball or downloading an .rpm or .deb file.

And all these are absolutely ugly and definitely less secure than your distro's package manager downloading packages from the supported repository.

1\. Ugly. Just take a look at this: [https://fedoraproject.org/wiki/Packaging:Guidelines](https://fedoraproject.org/wiki/Packaging:Guidelines). This is Fedora packaging guidelines/policies. Every distribution worth it's salt has one ([https://www.debian.org/doc/manuals/maint- guide/](https://www.debian.org/doc/manuals/maint-guide/), [http://packaging.ubuntu.com/html/](http://packaging.ubuntu.com/html/)). There quite strict constraints on what a package should look like, how it should be compiled, in which directories it can place files and so on and so forth. Custom installers (be it `curl|bash` or a .sh file or a .bin file) on the other hand are not policed by anyone except the original author. The installer can stop and ask you to read/accept a license agreement, it can open a browser, it can start background jobs. It can absolutely do `rm -rf /*` ([https://github.com/MrMEEE/bumblebee-Old-and- abbandoned/commi...](https://github.com/MrMEEE/bumblebee-Old-and- abbandoned/commit/a047be85247755cdbe0acce6#diff-1)).

2\. Less Secure. There are hundreds of software packages which are supposed to be installed with `curl|bash`. Are you sure all of them adhere to infrastructure/server security best practices? I for one trust the SysOps team @RedHat. To be clear - if the source code of the program is infected and the distro package maintainer doesn't notice it, you're in big trouble.

</comment><comment><USER35> The one (additional) problem I see with piping the script directly to bash instead of an intermediate file is that it leaves no trace of what was actually run.

Using an intermadiate file like 'curl ... > temp.sh' and then 'bash temp.sh' actually leaves a file which can be looked at before (and if not removed by malicious code) after the installation.

As others pointed out we are giving control away of our computers if we install software. We are giving more control away if we don't use a signed central repository system we (and others) can check openly. We are giving more control away when we can't check that repository. We are giving more control away when we download non-signed binary installers from some a specific site. We are giving more control away when we download installers from some site somewhere on the internet. We are giving more control away when the installer downloads the files itself and leaves no trace. We are giving more control away when the installer auto-updates software from some source somewhere we don't even know what happens anymore.

In that light, the difference between using a temporary file and directly piping is little in security and little in convenience. Downloading the most recent release would be a bit better but a bit more inconvenient. Having it distributed via a signed repository would be a bit better but probably slower and cause more overhead on the developers side.

These differences are not very big and YOU can fix them by doing the additional work. The heated discussion about a tiny detail is a typical symptom of our culture. If the developers of sandstorm promote the convenient way but still provide the more secure way, good for them, so be it, let's move on to things that actually matter.

After all don't forget the fact that sandstorm is bringing the cloud back to earth into your basement. It is designed to conveniently run cloud applications locally so that you don't have to upload your data into some cloud but keep control of it locally.

</comment><comment><USER36> > _Installing software not managed by the distro's package manager can be > inconvenient for system administrators, especially those who are deeply > familiar with the inner workings of their distro._

They raise this point themselves, but never address it.

I guess I'm a "system administrator" of my personal machines, because the last thing I want is software being randomly dumped wherever the author thinks appropriate for now, I guess /opt/ in this case. The post mentions running as a separate user, but if the installer expects to write to /opt/ I don't see how that is possible. Installing in ~/opt/ would be barely acceptable, but it's barking up the wrong tree and now I _really_ have to want to use your software to read enough to understand its expectations.

You don't need packages for all systems, since this also isn't convenient for rapidly changing software (unless you're going to make a full-on repo). But please keep and support a (git clone <repo> && ./configure --PREFIX=<my- choice> && make && make install) option. It solves all of these problems for users who do care.

And preemptively - no, "use a VM" is never an appropriate answer to these concerns. The POSIX system model has many annoying shortcomings, but indiscriminately deprecating the whole thing creates ten times as many problems when what POSIX did provide has to be reinvented in order to _connect_ those monolithic images.

</comment><comment><USER37> I would like the see improvements to configure / automake. These tools already allow you to control where the program will be installed "configure --prefix=$HOME". They also generate an uninstaller: "make uninstall".

But they are missing dependency resolution. I should be able to say: "sudo make depends" to install all missing libraries for the system I'm on, for example run the "apt-get install libexpat-dev" or whatever if I'm on Ubuntu.

</comment><comment><USER38> One thing not addressed is that copy-pasting from the browser is insecure too:

[http://thejh.net/misc/website-terminal-copy- paste](http://thejh.net/misc/website-terminal-copy-paste)

But this should be mitigated by TLS/finding a "trusted" source. A bigger issue might be that curl|bash effectively elevates trust in the developer, the CA, the hosting provider to the same level as trust in your distribution's security team.

And while using SSL, wrapping the script in a function, practising safe posix shell, working acrosss many platforms is good - is it _better_ than using something like [https://0install.net](https://0install.net) ?

I can understand not wanting to work with dozens of distributions; but if you don' tautomate tests across all of those - does your fantastic script really work?

[Ed: it's also much easier to secure an off-line signing key than a TLS key that must be always on-line]

</comment><comment><USER39> The biggest issue I have with curl|bash is this:

curl|bash has no advantage over the "Download and run this installer program" plan. That is, itself, a plan that should go away.

Further, it has the disadvantage that the user gets less transparency and control. When I download and run an installer, I can do whatever I want in between: check a signature, run a malware scanner, copy it into an offline VM, copy it to multiple systems to save bandwidth, apply a (possibly binary) patch, the list goes on.

While I _can do this anyway_ with the curl|bash idiom (by using a temp file instead of a pipe), it makes it less straightforward. Teaching users to do things this way will have the net effect of discouraging those other things.

I think Sandstorm is great, but when someone is insisting on an install method that is _worse_ than one that needs to go away, there _is_ a problem.

</comment><comment><USER40> I get the thrust of the argument but I think this does gloss over some differences:

> The web sites for Firefox, Rust, Google Chrome, and many others offer an > HTTPS download as the primary installation mechanism. It's even the standard > way to install most Linux distros in the first place (by downloading an iso > from the web site).

Yes, but these usually also come with checksums. If I can verify these through any other means I know that what someone else got was what I got too.

> Certificates on the old key expire in about a month. The auto-updater will > begin using the new key as soon as it has installed an update that is aware > of the new key.

I'm not sure I follow. Your key is compromised, you swap out for a new one, but this new one will only work after installing something signed with the compromised key?

Is there any way of updating the trusted keys _before_ installing an update?

<comment><USER11> > Yes, but these usually also come with checksums

Checksums provide zero security benefit. You'd need signatures (like sandstorm.io provides) to actually protect against adversary modifying the installation media.

<comment><USER40> A checksum I can verify through a third source means I know I've got the same thing as they have. Signatures don't ensure that, unless I'm missing something.

</comment></comment></comment><comment><USER41> This topic definitely needs a lot more discussion but, unfortunately, the author mischaracterizes the strongest argument against `curl|bash`: trust.

> Most package managers will even execute scripts from the package at install > time – as root. So in reality, although curl|bash looks scary, it's really > just laying bare the reality that applies to every popular package manager > out there: anything you install can pwn you.

Security-minded individuals are well aware that binary package systems execute code with arbitrary privileges. That's why we only use packages from trusted sources. RedHat, for example, is bound by their commitment to investors. They would be completely ruined if their software channels were compromised.

Some person with a GitHub account? Not likely.

</comment><comment><USER42> At #! we have taken the GPG approach for a while. We also use process substitution which helps with partial line issues, and we take the opportunity to warn and educate people that run our installer without at least glancing at the source first

Https://hashbang.sh

<comment><USER43> Ain't nobody got time to look at source code :-p , well more so, a lot of users (most?!?) would need to skill up in order to understand it. Better they can have confidence that you have good intentions and competency, or more likely, that they have reliable friends who support your work.

It seems a weak link here is TLS and its implementations (see many OpenSSL vulnerabilities) connecting users to some remote resource for importing your key. If you posted signatures of your signature (terrible nomenclature, I know) from very popular people, then new users might have a good chance of having someone in their network that believes in you. Otherwise, they could send out an notice that they need some reviews of you and your code.

(Continuing my reading for now @ [http://www.cs.cmu.edu/~davide/howto/validate_gpg.html](http://www.cs.cmu.edu/~davide/howto/validate_gpg.html) )

</comment></comment><comment><USER44> This is a silly discussion because those who complain about curl|bash are also those smart enough to curl -o file [http://..](http://..). && vim file and read it before running it.

</comment><comment><USER45> So does curl need to have [or has someone scripted] a signature and checksum checking mode where it looks for standard signature files and md5/sha checksums in the download directory and exits if they don't pass or pipes to bash if they do? Would be useful for these sorts of scenarios (to run in a sandbox of course ;0)> ).

</comment><comment><USER46> In the end it always seems to come down to the dependency tree.

Seems like unless you build something like Gentoo, you invariably run into overly stilted or rigid dependency trees.

Even Nix seems to have this issue, because the checksum of a lib is included in the path to the lib compiled into dependents.

</comment><comment><USER47> There is no such thing as secure / insecure.

Security is a spectrum that guards against specific threats and actors.

Most technical security solutions fail the $5 wrench test, if you need to defend against an attacker with a $5 wrench your solution will likely fail.

</comment><comment><USER48> I've read most of the comments so far but I've yet to come across an instance where someone mentioned an actual security compromise they knew of because of this.

</comment><comment><USER49> I think there are other problems with using curl|bash than purely technical ones.

Since it isn't obvious to everyone how to do it correctly you're unwittingly creating a culture of just running anything of the Internet. You're also making it harder for yourself do the right thing, both over time and when you're stressed. It's generally just a good practice to remove sources of errors, especially if they are low-hanging, to get a more robust process. Managing computers is hard enough as it is.

</comment><comment><USER50> curl|bash isn't insecure compared to downloading an installer program over https and running it.

It's just stupid from a _reproducibility_ point of view: the concept that I have some program P which I can run two or more times, such that it's the same object P on each run.

Suppose curl|bash fails somehow and you need to debug it. If you try curl|bash again, it could be fetching a different script.

Of course, there are ways to fix it, like a versioned URL that points to an immutable script. You have to trust that it is immutable though.

A malicious rogue employee who works for the trusted domain could _temporarily_ replace the script with something harmful. Bad things happen to some users, who have no trace of what was executed. The rogue restores the original script and so when that is re-fetched and examined, it looks clean.

None of the affected user saved a copy; they all ran 'curl|bash' and so there is no evidence.

This is really what people don't like; they are just not about to put a finger on it and articulate it properly: the _transience_ of the executable program. When bash terminates for any reason, the program is lost forever. What was actually run? And does that program exist any more, or did the termination of bash just throw away the world's last copy of that version of the script?

In other words, maybe what you want is rather this:

       curl | tee justincase.sh | bash

:)

<comment><USER51> That's not true. Curl doesn't use HSTS, whereas a browser does. Installer packages are signed, as well, so there's at least two ways in which downloading a proper installer from a browser is more secure.

</comment></comment><comment><USER52> fpm would solve their "packages are hard" problem. Additionally, when the upgrade path is "curl|bash" that is poorly thought out.If "curl|bash" installed the package repository, and then used the local package system to install, then that would be better.

</comment><comment><USER53> The rise of javascript has lead to this "Here download this code and eval it!" mentality.

</comment><comment><USER54> sudo curl -k -s [https://rootme.sh](https://rootme.sh) | bash

It's okay because it's secured by using HTTPS.

<comment><USER55>
        $ gpg --verify software.tar.gz
        gpg: Signature made Fri 25 Sep 10:20:57 EDT 2015 using RSA key ID 99BD2CF1
        gpg: Good signature from "Keith Alexander <firstname.lastname@example.com>"

I'm so glad I'm using PGP!

</comment></comment><comment><USER56> I get time to read, and it sounds more to be a commercial, rather a technical overview.

</comment><comment><USER57> They make the argument that "anything you install can pwn you", which is like saying, any food you eat can kill you. Well, no, any food you pick up off the street that has flies and maggots on it might kill you. That's why we _verify_ our software before we install it, and verify our food is good to eat before we eat it.

Here's some reasons why curl|bash is stupid.

\--

 _Unversioned, unverified software_

Like was mentioned in the article, yes, signed checksums are standard ways to ensure you are running only the software the original packager intended. This means that, no matter who could possibly want to attack this software, you will always be positive you are using the correct software, forever.

The author's response to this? "Oh, but we're using HTTPS. So you know the commands we're running are from us."

Anyone could give you exploited software offline, since there is no versioned, verifiable software package.

In addition, anyone who can MITM a remote network connection (like your company, the company who sold you your laptop, the operating system creator or distributor, the browser creator or distributor, any of _six hundred and fifty Certificate Authorities_ , and virtually any internet-connected government in the world) can exploit the software.

In addition to MITM, an attacker, or a Sandstorm employee, can at any time use the company's network itself to distribute exploited software.

HTTPS has had numerous security vulnerabilities over the years, which not only enables MITM of connections, but also attacking and subverting HTTPS servers and using them to distribute exploits.

\--

 _Unknown commands at execution time_

Every piece of package-managed software can be unpacked and examined. Even if you don't know what's in the binaries that are delivered, you can be sure what commands the package will run and what files will be dropped and where.

You can also run the installer in a sandbox and reproduce it every time. You can't reproduce curl|bash every time, because it has the ability to change every time it's run. (Unless you save the bash script the first time you download it)

\--

 _Running arbitrary commands remotely_

Using curl|bash literally asks a remote connection to execute arbitrary commands on your host inside your network. Most well-defended corporate networks should block this, but some don't.

Of course you're about to say "But we run arbitrary code remotely all the time with web browsers!", which is why we have things like NoScript, AdBlocker, etc to prevent any random attacker with a 0day from compromising unknown holes in our software, not to mention leaking our history, cookies and other sensitive data from otherwise "normal" browser functions.

\--

You know why people (like me) get angry about curl|bash? It's a bad troll. It takes obviously bad ideas about security and tries to validate them by waving HTTPS around like a banner of invincibility, then coming up with excuses for why the security problems it introduces are not important.

If you want to be cavalier with your systems, that's fine. But don't try to convince people it's secure when it's not.

</comment><comment><USER58> The answer is Yes. Moving on!

</comment><comment><USER59> Yes, it's insecure and is based on complete trust of the author of the script and the hosting provider, but there's an easy workaround: Don't pipe to bash immediately.

Download the file, inspect the contents and then if you're satisfied with what the script will perform, then run it through bash.

<comment><USER60> The issue is the same for installing anything from source not because you sued Bash/Curl same can be said for the Arch community made package managements for the AUR packages.

</comment></comment><comment><USER61> You may have the most awesome setup in the world, with certificate stapling and keysigning and best-practice scripting and whatever. But curl|bash is simply a bad habit to reinforce. It's a bit like saying that we don't need laws against burglary, because _I_ would never burgle anyone, and I have a 24/7 camera on _me_ to prove where I am at any given time.

That bad habit isn't the worst thing in the world, but it's low-hanging fruit in terms of problematic things to reduce.</comment>


Utopian for Beginners (2012) - <AUTHOR> https://www.newyorker.com/magazine/2012/12/24/utopian-for-beginners <comment><USER2> Discussed in 2014: [https://news.ycombinator.com/item?id=8180493](https://news.ycombinator.com/item?id=8180493)

</comment><comment><USER3> One of my all-time favourite pieces of journalism. If you haven't read it, do so! Upvoted!

</comment><comment><USER4> What an incredible article, I had to look up so man interesting things along reading it that I didn't know before.

</comment><comment><USER5> (I know that this is far from the point of the article.)

Language does not evolve anywhere near democratically.

All across the spectrum of linguistic complexity you will find that certain individuals have significantly outsized influence over how language is used.

This is closer to meritocratic than democratic.</comment>


Random Numbers - <AUTHOR> http://www.boallen.com/random-numbers.html?=resubmit

<comment><USER2> All real crypto keys come from PRNGs (if they don't, you have bigger problems). If your PRNG sucks, you're in trouble. You aren't as secure as AES; you're as secure as your RNG.

Bernstein used a similar visualization to show diffusion in his stream cipher over multiple rounds:

<http://cr.yp.to/snuffle/diffusion.html>

<comment><USER3> Well ... the last time I had to generate real crypto keys for an application I used a 300 US$ (in 1996) TRNG pod that used thermal noise to provide truly random data.

We can be rather sure that TRNGs are used to make one time pads for the intelligence community ... although strangely enough the Venona decrypts are based on the Soviets having reused pages of random numbers, probably due to the high demand that developed after they were invaded by Nazi Germany.

But your point about the need for a high quality (and well seeded) PNRG is well taken, far too many crypo _system_ failures have been due to that.

As I tell people, don't worry about the cipher, you will not do better than the experts, but make sure your whole system is sound.

And speaking of seeds, in the brave new world of cloud computing we've got to be careful about where we get our entropy.

<comment><USER2> Then, due respect, but the last time you had to generate real crypto keys for an application you did so in a very unrepresentative setting. Virtually all real-world crypto ends up depending on a CSPRNG.

I'm sure PRNGs have been used to make "one time pads"[1]. And as you know, those aren't actually one time pads. They're stream ciphers based on PRNGs, and are as secure as the underlying PRNG --- meaning, probably not secure at all. Calling them OTP's perpetuates a misconception about the applicability of OTPs to real crypto.

People have been saying "don't worry about the cipher, think about the whole system" for two decades now, but that message has been attenuated down to "use AES, don't try to design your own block cipher". Frankly? At this point? I think you'd do _better_ if you started by actually designing a simple Fiestel cipher. At least then you'd be assured some basic understanding of what these algorithms actually do.

If you want to think scary thoughts about crypto and cloud computing, remember that I can now spend a couple bucks to get access to a machine that has nanosecond timing resolution to your secure app by nature of it being a single switched gigE hop away.

Sorry about tit-for-tatting your reply, which was interesting, but I think I had at least 2 worthwhile things to add to the discussion there. Thanks for giving me the vector to do that.

[1] _(By way of backstory for the rest of you: one time pads are "theoretically unbreakable" cryptosystems where you and your counterparty somehow securely exchange blocks of truly random data, and encrypt/decrypt by combining that random key matter with data on a 1:1 basis. They have no relevance to real-world crypto, since they depend on you having a way to reliably and securely exchange and retain key material that is as long as the messages you're actually sending)._

<comment><USER3> You overstate the situation with one time pads: they eliminate the decryption issue by shifting it entirely to key distribution.

As for "real-world crypto", they've certainly been used in the 20th century and the continued existence of number stations as mentioned on HN in the last couple of days suggests that such simple systems might still be in use. It's hard to get more simple than a booklet of TRNG data printed on flash paper and a shortwave receiver.

<comment><USER2> Instead of annoying everyone by arguing definitions for the rest of the day, let's just stipulate that we're talking about "crypto done by computers using products that you can actually buy and conceivably deploy in a commercial setting".

Unless you have a physically secure channel to distribute keys (in which case, why bother with OTPs), the fact that OTPs move the security model entirely to "key distribution" is an academic point. Any online key distribution system you'd come up with for your OTP is (a) going to become the fulcrum of your entire system, and (b) by nature of feeding an OTP, going to permit a far more restricted set of designs than any key distribution system for a "conventional" protocol.

The reality is, OTPs are entirely unsuitable for commercial information security. That's a strong claim, but not a slippery one, and I'm willing to back it up.

The arguments around OTPs are surprisingly isomorphic to the arguments around Javascript crypto.

<comment><USER3> I agree with your strong claim, with the single exception of "TRNG data that you can physically hide (i.e. in a PCIe card) may be a useful source of keys or entropy". Which was the sort of thing I was using it for in 1996.

As for your last point, I'd personally substitute "intuitively obvious" for "surprisingly", but I will admit I've been playing this game on and off for a _long_ time

<comment><USER2> You do have an awesome resume.

Why is the relationship between OTPs and Javascript crypto (apart from them being routine signifiers of crank cryptography) intuitive to you?

<comment><USER3> Perhaps for the same reason I run NoScript ( 1/2 :-) ?

OPTs obviously devolve to the key distribution problem.

The environment of client side Javascript is obviously to me a superset of the key distribution problem. After all, you start out by distributing your code to the (insert your favorite derogatives here) client.

Simson Garfinkel likes to refer to the whole https game as something like transferring a valuable from a cardboard box in an alley via an armored car to a park bench. I'd end with the end of a Matt Groening _Love is Hell_ quote: "At night, the ice weasels come."

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> Author, please check your site for hacks. ESET Security detects malware and blocks connection, and bogus JS is returned after the </html> tag.

Edit: it's loading scripts and iframes from harpear.ru, which is on a lot of known malware domain blacklists.

<comment><USER5> Avast Personal also detects a bunch of javascript trojans.

</comment></comment><comment><USER6> Wrote a similar script a while back to vizualize any binary data. [http://www.velvetcache.org/2010/03/15/bin2img-data- visualiza...](http://www.velvetcache.org/2010/03/15/bin2img-data- visualization-with-php)

</comment><comment><USER7> blocked at my work...Detected possible botnet command and control traffic.</comment>


Why the coronavirus outbreak is terrible news for climate change - <AUTHOR> https://www.technologyreview.com/s/615338/coronavirus-emissions-climate-change/ <comment><AUTHOR> There's been buzz this week about upside. Reality is likely to end up somewhere in the middle. Unless it doesn't.

[https://www.nytimes.com/2020/03/13/climate/coronavirus- habit...](https://www.nytimes.com/2020/03/13/climate/coronavirus-habits- carbon-footprint.html)

[https://qz.com/1812670/a-design-trends-forecaster-calls- the-...](https://qz.com/1812670/a-design-trends-forecaster-calls-the- coronavirus-an-amazing-grace-for-the-planet/)

[https://eu.usatoday.com/story/news/nation/2020/03/17/coronav...](https://eu.usatoday.com/story/news/nation/2020/03/17/coronavirus- could-be-saving-lives-pollution-carbon-emissions/5066718002/)</comment>


Android, Symbian Expected To Become One OS - <AUTHOR> http://www.informationweek.com/news/mobility/business/showArticle.jhtml?articleID=209600592

<comment><USER2> Is this even a realistic technical goal? I was under the impression that Symbian was a pretty dramatically different technology than Android. Symbian is a C++ platform from top to bottom (as far as I know), while Android is a Linux+Java platform with not a lick of C++ to be found anywhere (again, as far as I know).

I'm having a hard time imagining how the two could combine in any meaningful way. One project or the other would have to move to the other platform, losing the majority of their existing work. If Google wanted to do that, they would have been the ones to acquire Symbian. If Nokia wanted Java, they would have acquired RIM (or did what Google did and hire the lead developer of the Sidekick and set him loose with more resources and orders to produce the next generation platform for mobile).

The fact that a lot of the same companies are backing both projects is a null statement. Of course they are! They want to be able to offer whichever one takes off, the moment there is consumer demand. They also want to appear to support open platforms (even if they're a little nervous about the idea).

It's going to be a competitive landscape for the foreseeable future, and that's fine. iPhone needs some serious competition, and the only way to compete with something like iPhone is to go the opposite direction on some major point. In this case, iPhone is a thoroughly closed platform--everything goes through Apple, or it goes nowhere--and so the smart money among competitors is going into an open platform. Which one wins isn't really all that important to them...they just need reasonable plans for taking on the iPhone.

<comment><USER3> It's about as realistic as merging Mach, FreeBSD, NeXTSTEP, and Mac OS. It was done, but it took years, cost a lot, and left a lot of legacy crap in the system.

</comment></comment><comment><USER4> This is good news for everyone. As the iPhone OS takes off, Google and Nokia will be free to create a strong contender to this.</comment>