How we built Hamiltix.net for less than $1 a month on AWS - <AUTHOR> https://blog.badsectorlabs.com/how-we-built-hamiltixnet-for-less-than-1-a-month-on-aws.html <comment><USER2> Impressive but my side projects are even cheaper to run because 1/3 of the way through I lose excitement, never finish them and then don't do anything with them. ;) Nice post!

<comment><USER3> Or do it like it was 1999. Host it yourself. I had a $20 DO, I've downgraded it to the $5/month plan. My next goal is to move that shut down the VM sometimes this year and host it on a raspberry pi myself.

</comment></comment><comment><USER4> I can modify the price in the checkout by changing the URL parameter. Really?

<comment><USER5> Can also use a negative price! I wonder what would happen if you went ahead with that. Presumably the payment gateway wouldn't pay me $5. Seems a strange choice to be having those parameters in a GET.

<comment><USER6> I agree, the param passing is not ideal. Session storage/local storage is another option.

<comment><USER7> Everything that can be modified by the user is not suitable. The price must be stored on the server side, everything on the client side is subject to modification.

<comment><USER6> The price is checked server side. You have to pass the price somehow to the client in order to display it. This is no different than any other ecommerce site, except that you can see it in a GET param.

I can "change the price" of anything on Amazon with dev tools, but that won't help me when I go to buy it. I appreciate the concern because amazingly this has been a real vulnerability on sites before (recently on a crypto exchange I think).

</comment></comment></comment></comment></comment><comment><USER8> Using Codenvy for development, Github for code, Netlify for deployment and hosting, and Firebase for a database, in total I spend exactly _nothing_ on my side projects.

<comment><USER9> All great services except Firebase. It's hard to version control development and it's a lock in platform that's hard to migrate away from.

<comment><USER10> Try [https://github.com/amark/gun](https://github.com/amark/gun) , it is a popular (~7.5K stars) truly open source (MIT/ZLIB/Apache 2) database that has Firebase like features (realtime sync) plus a lot more, like graph/table/document/relational data and a P2P/decentralized architecture, by yours truly. :)

<comment><USER8> I've used gun. It's really cool.

<comment><USER10> Thanks!

Firebase still has a ton of features we don't have, what would you say are the most important things for us to work on?

<comment><USER9> I love the plug and play nature of Firebase for simple CRUD apps, so the simplicity of Firebase user auth was a huge win. Is that on the roadmap?

<comment><USER10> Yes, we just announced/released the alpha of our auth framework a while ago, called SEA (Security, Encryption, Authorization).

Because it is based on P2P/decentralized cryptography, it is actually pretty hard and cutting-edge to implement (you get end-to-end encryption automatically with it!), but we've made it ridiculously easy for developers to use:

\- Easy getting started guide: [https://hackernoon.com/so-you-want-to-build- a-p2p-twitter-wi...](https://hackernoon.com/so-you-want-to-build- a-p2p-twitter-with-e2e-encryption-f90505b2ff8)

\- 4 minute nad 40LOC interactive coding tutorial: [https://scrimba.com/c/c2gBgt4](https://scrimba.com/c/c2gBgt4)

It is alpha though, still has several more features that need to be added to make it usable for different types of app (so you might want to stick with Firebase till then). Please let me know if you have any questions or anything else I can help with!

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> For those interested, it looks like the aws stack diagram was created with cloudcraft.

</comment><comment><USER9> > After the free-tier expires it will be less than $5, but the fact remains: > it's crazy cheap.

I like the idea behind serverless development, but DO is $5/month and is easy to setup and maintain. From what I understand as your business grows AWS costs skyrocket and just starting out it's more complicated than a DO solution.

The idea is great, but looking forward to the day where serverless is the default solution because it's easier and cheaper. Not sure we're there yet.

<comment><USER12> The costs skyrocket if you're not doing it right - otherwise it tends to be linear with request count. The nice thing, though, is that you don't have to panic or do anything at any scale - it'll just keep running along.

Once you hit high levels of traffic, instead of panicking and trying to add more servers and fixing DB structure, you do a cost benefit analysis and see what to do next. Either work on reducing your cost slope, or make it logarithmic by moving to regular servers.

<comment><USER13> The problem is the per request cost is going to be astronomical compared to what it needs to be once you e.g. get above the initial 1 GB/month tier. Bandwidth at AWS costs about 50 times as much as with Hetzner for example.

> Once you hit high levels of traffic, instead of panicking and trying to add > more servers and fixing DB structure, you do a cost benefit analysis and see > what to do next. Either work on reducing your cost slope, or make it > logarithmic by moving to regular servers.

...and that's a good reason to try to avoid the lock-in of AWS specific services. Relatively entry level setups on alternative platforms will let you scale well past the system where AWS costs starts to get painful and people start panicking about how to cut costs. When you hit that point you really don't want to be facing a major re-engineering effort to be able to even use other options to bring the cost down just as the costs are soaring.

<comment><USER14> > Bandwidth at AWS costs about 50 times as much as with Hetzner for example.

It's actually closer to 70x

Hetzner: 1.25 USD per TB (after 30 TB free per server) [1]

AWS: 90 USD per TB [2]

So, 100 TB at Hetzner will cost you 125 USD (not counting the 30 TB free). You would pay 9000 USD at AWS.

[1] [https://wiki.hetzner.de/index.php/Traffic/en](https://wiki.hetzner.de/index.php/Traffic/en)

[2] [https://aws.amazon.com/ec2/pricing/on- demand/](https://aws.amazon.com/ec2/pricing/on-demand/)

<comment><USER15> Hetzner traffic isn't even that cheap compared to some unmetered offers, for example online.net.

I had to migrate away from Hetzner because I was actually paying 300 dollars on traffic alone.

<comment><USER13> The problem with some of the unmetered offers is that it's hard to know how much you'll actually be able to use, and for how long (before they oversell), so there's some appeal in paying for actual capacity. But certainly, you will pay a premium for that.

</comment></comment></comment></comment></comment></comment><comment><USER16> Very nice. I built a boilerplate Lambda app that puts a lot of this cost effective architecture into practice:

[https://github.com/nzoschke/gofaas](https://github.com/nzoschke/gofaas)

One difference is that I use SNS for cheap email or SMS error notifications.

<comment><USER6> This is awesome and will save people tons of time setting up something similar!

</comment></comment><comment><USER17> Great work! I love reading stories like this. Lambda isn't for every usecase but I'd say a large majority of CRUD apps can use this architecture and reduce costs.

<comment><USER18> For the large majority of CRUD apps the least cost you should be concerned about is hosting, but development time. This kind of architecture adds an extra layer of complexity that is trivially solved with most of the web frameworks out there. I love Serverless, which I chose to design and build a couple of applications, but for some use cases it might not be the best solution.

<comment><USER16> I'm starting to find a FaaS architecture can remove complexity for the developer.

The CRUD functions themselves are easy to write and test.

Then everything else is handled by the infrastructure layer. Auth, security policies, rate limiting, request timeouts, autoscaling, logs, tracing, etc.

With Rails the developer has to build a lot of this into the application layer. And the dev has to do more operations over time to maintain the app and database.

I am working on a boilerplate app that demonstrates all the functionality you get from "serverless" and documents all of the things we no longer have to worry about:

[https://github.com/nzoschke/gofaas](https://github.com/nzoschke/gofaas)

<comment><USER18> Rails is a great framework that prevents you from dealing with a lot of boilerplate when it comes to web applications and to focus only on the business logic. There are some great platforms out there (Heroku, for example) that deal with most of the stuff you mentioned (logs, tracing, autoscaling, etc.), and no one prevents you from using a third party service for auth in Rails as well (Auth0, for example). FaaS is awesome, but you've got to code a lot of stuff that Rails gives you for free. Besides, pushing some logic down to infrastructure locks you in the provider you chose. I'm not saying that's bad, because as I've mentioned before I run some apps fully Serverless in AWS, but there's some stuff you've got to take into consideration.

</comment></comment></comment></comment><comment><USER19> Would be curious to understand how this might work on a plain ole virtual server (ie, Vultr $2.50).

</comment><comment><USER20> "Getting a push alert any time there is an error helps us respond to issues as soon as they come up. "

Oh god no.

Maybe if this system is not expected to ever grow in complexity. Otherwise this will become a big source of frustration really soon. And even if it does not, it's very easy to get a flood of non-actionable alerts for a transient condition.

It would be better to collect error rates and alert on that. Also the other golden signals.

<comment><USER21> yeah but to each stage of a project its solution. If that works at that scale why not?

<comment><USER22> You know for people who live in an ever changing environment and are constantly editing our own reality - so much so that we need to track it in "source control" \- developers are kind of funny how they get stuck on doing things "the right way."

<comment><USER23> Do they really get stuck on doing things "the right way", or do they get stuck on making off-the-cuff remarks about doing things "the right way" for easy karma?

</comment></comment></comment></comment><comment><USER24> > We also made the decision to not use a javascript framework for the front > end, mostly because they are incredebly [sic] complex and some people > suggest they are all terrible (or maybe great?).

Not to mention that for back-end developers, the learning curve is steep and ever-changing especially when one considers the "build" process. Is it grunt, or gulp these days, or webpack, or NPM, or some Frankenstein combination of all of them?

</comment><comment><USER25> You can get below $1/month if you use a cheap VPS [1] ...

1\. [http://www.lowendstock.com/](http://www.lowendstock.com/)

</comment><comment><USER26> I don't get it. Is hamiltix scalping tickets? I thought the ticket sellers control re-distribution. How can it accept payment for tickets someone else is holding?

</comment><comment><USER27> Or use GAE to do the same for ∞ less.

</comment><comment><USER28> Wait but where do you host gitlab? You need an ec2 instance for that, right?

<comment><USER29> Not OP, but I suspect on gitlab.com itself (free private repo for small teams).

<comment><USER30> Not just small teams - unlimited contributors

</comment></comment></comment><comment><USER31> Not familiar with amazon Lambda, is the analogy

developer toolset : amazon lambda

business toolset: zapier

personal toolset: ifttt

correct here?

</comment><comment><USER32> What year did you make it in??

</comment><comment><USER33> how is aws lambda pricing at scale?

<comment><USER12> Same as pricing at non scale. It's per 100ms of execution time. Could do a large scale discount if you're scaley enough.</comment></comment>


ID Card Digitization and Information Extraction using Deep Learning - <AUTHOR> https://nanonets.com/blog/id-card-digitization-deep-learning/ <comment><USER2> This is a decent OCR / structured data extraction literature review but is absolutely not "building an ID card reader from scratch with deep learning".

It's also very hand-wavey on the details of how to actually use graph convolutional networks to extract structured ID card data. For example what "bounding box information" is used in your node representations? What is the architecture of your biLSTM?

This seems very much more like a promotion for your API than useful information on how to build a system that extracts data from ID cards.

<comment><USER3> Sure, the blog might have missed out on the finer details of the different architectures. We intended to give an overview of some of the techniques used to build such information extraction models, we will definitely dive deeper into one of the architectures/model as a second part to this blog.

</comment></comment><comment><USER4> The article has quite a nice introduction to deep learning concepts, but the headline claim of building an ID card reader from scratch is little more than "use our API".

<comment><USER5> Ok, we've changed the title from "Building an ID card reader from scratch with deep learning" to the what the article's title says.

</comment></comment><comment><USER6> I got asked to spec out something for a nightclub ~10 years ago for extracting text from drivers licenses and 18+ cards. I didn't go ahead with the job (client wasn't paying much and the way he wanted to use it was ethically and legally grey) but I did prototype something and recall getting good results from the Python OCR libraries available at the time. What advantages would you get from a deep learning approach compared with what was available back then?

<comment><USER3> the problem with extracting information is not just limited to getting OCR results. the bigger problem while building something like this is extracting the fields and understanding the structure of the document automatically. using some python OCR libraries, you'd probably get text results for a drivers license or a passport separately and process these results on separate rules written for each. with deep learning a non-template solution seems possible which will figure out which ID it is, where the name, address, relevant numbers are and put them in a structure.

<comment><USER7> In the case of U.S. drivers licenses, there are standards for the 2D barcode that would make it very straightforward to parse: [https://www.aamva.org/uploadedFiles/MainSite/Content/Solutio...](https://www.aamva.org/uploadedFiles/MainSite/Content/SolutionsBestPractices/BestPracticesModelLegislation\(1\)/BarCodeDataEncodingReqmtsBestPractice.pdf)

</comment></comment></comment><comment><USER8> "CNNs versus GCNs" is not necessarily correct? You will need to apply GCN on top of CNN to get the structure out of otherwise unstructured text?

</comment><comment><USER3> the article reviews all the recent deep learning based approaches to digitization and OCR along with an explanation of how graph neural networks work and how they can be applied to the problem of ID card digitization.

</comment><comment><USER9> but why not building a card reader by reading the chip content (more accurate than an image)?

<comment><USER10> The title says "ID card". First you need to read the printed texts so that you can be able to read the chip of ID cards.</comment></comment>


Trix: A rich text editor for everyday writing - <AUTHOR> https://github.com/basecamp/trix <comment><USER2> Looks decent. The approach taken is the right one: we do something very similar with the Squire rich text editor ([https://github.com/neilj/Squire](https://github.com/neilj/Squire)) which I wrote for FastMail's webmail. Basically the browser can't be trusted to do any formatting itself, which is a slightly depressing state of affairs, especially as there has been zero improvements in this area for the last 5 years. I guess it's not shiny enough for browser devs to focus on.

Looking through the code, a few things jumped out that should be looked at:

* Native TreeWalker implementations are buggy in some browsers. In the end we decided it was safer to just implement the bit we needed ourselves (see comment at top of [https://github.com/neilj/Squire/blob/master/source/TreeWalke...](https://github.com/neilj/Squire/blob/master/source/TreeWalker.js)).

* The HTML sanitisation using document.implementation doesn't account for DOM clobbering so is currently bypassable with the right malicious content. I recommend using [https://github.com/cure53/DOMPurify](https://github.com/cure53/DOMPurify) for this rather than writing your own. It's tricky to get all the edge cases right, so better to use something that's been reviewed by several people (and in DOMPurify's case also undergone a formal security review). Again, we use this at FastMail as part of our webmail.

<comment><USER3> Can you elaborate on not being able to trust the browser for formatting? Is the idea that web developers should just be able to use <textarea> and not have to think about it beyond that, and that browsers should provide solid default <textarea> editor?

<comment><USER2> I mean things as simple as bolding a piece of text. The way to get the browser to do this for you is to using the document.execCommand method, but the results are inconsistent between browsers. Worse than that though is stuff like hitting "enter" on the keyboard – all sorts of crazy stuff happens (new <span> tags being added, nothing consistent between browsers, generally doesn't do what you want). We came to the same solution the guys at Basecamp have: you generally can't trust the browser to get you from state A -> B and have to do it yourself.

Probably the hardest thing to do is handle copying and pasting, partly because most browsers give you very little control over this, so you have to resort to terrible hacks. You also have to decide how much of the formatting in the clipboard item was "intentional" and how much should be cleaned. I see if you copy/paste just a word from within Trix, it pastes it as a whole block with the block's formatting around it. I suspect this may surprise many users who expect it just to copy the word (the inline bit, not the block around it in editor parlance). Once you start going down this rabbit hole, you end up having to do things like take one DOM tree and recursively merge the "edges" with the adjacent trees to get it to behave as the user expects. I think we do a pretty decent job with Squire, but I'm sure there are still more edge cases we haven't covered.

</comment></comment></comment><comment><USER4> Nice to see this particular bit of info high up in the README (though "as seen in Basecamp 3" would fit well in the Github repo description line):

> _Trix is an open-source project from Basecamp, the creators of Ruby on > Rails. Millions of people trust their text to Basecamp, and we built Trix to > give them the best possible editing experience. See Trix in action in the > all-new Basecamp 3._

Nothing gets me more interested in trying out a JavaScript library than seeing that it's used in a mainstream production product, _especially_ a money- making/critical product by very same the company that created/maintains it...it's a bit of guarantee that the API is relatively mature/won't-go-crazy and that someone has a vested interest in keeping the library up to date with changes in the Web. That was why React was so much more appealing to me than Angular, relative to their respective public release dates...React was already in production at Instagram and parts of Facebook, whereas I don't think Angular was in any of Google's main public facing products (i.e. search, YouTube, Maps)

<comment><USER5> Agree. Although I would have wished to see it in action immediately (on an example page) without having to clone it to my machine.

Edit: Nevermind, just saw the edit on the comment below :)

</comment></comment><comment><USER6> Great timing, we were just looking for a new editor for our project. Since there are so many choices, here's a list of everything mentioned in this post.

Trix - [https://github.com/basecamp/trix](https://github.com/basecamp/trix) \- demo here: [http://trix-editor.org/](http://trix-editor.org/) by basecamp and used in v3, handles files/images well

Squire - [https://github.com/neilj/Squire](https://github.com/neilj/Squire) \- used in FastMail webmail, better for text than images

ProseMirror - [http://prosemirror.net/](http://prosemirror.net/) \- not great with images

Scribe - [https://github.com/guardian/scribe](https://github.com/guardian/scribe) \- by the Guardian team

CKEditor - [http://ckeditor.com/](http://ckeditor.com/) \- solid and very customizable, lots of plugins, a little dated in look/feel

Quill - [http://quilljs.com/](http://quilljs.com/)

Summernote - [http://summernote.org/](http://summernote.org/)

wysihtml - [http://wysihtml.com/](http://wysihtml.com/)

Etherpad - [http://etherpad.org/](http://etherpad.org/) \- collaborative realtime editing

TinyMCE - [http://www.tinymce.com/](http://www.tinymce.com/) \- older editor but still good

Textbox.IO - [https://textbox.io/](https://textbox.io/) \- new from the owners of tinymce project

Froala - [https://www.froala.com/wysiwyg- editor](https://www.froala.com/wysiwyg-editor) \- solid editor, newer features like drag/drop images, v2 RC3 just released

Redactor - [http://imperavi.com/redactor/](http://imperavi.com/redactor/) \- we used this in production but quality has gone down, v2 is half the functionality at 3x the price, not recommended anymore

<comment><USER7> What is the quality problem with Redactor 3?

<comment><USER6> v2 is their newest release: [http://imperavi.com/redactor/log/](http://imperavi.com/redactor/log/)

They've removed features like html code view (which is basic and needed since no editor is perfect), formatting for pasted-in text is worse (even from just another webpage), image handling is broken (cant resize or even move around anymore), and lots of stability bugs in general.

<comment><USER7> Sorry I meant v2. I am using v1 but as I just use it for basic formatting I am not really keen on the high upgrade price. I do think they have done great work with the editor though. If the editor was important for my app then the price would be much less of an issue.

Pasting and image handling is probably the most important features for my clients. Thx for the info.

</comment></comment></comment></comment><comment><USER8> One thing this gets right that heaps of other WYSIWYG's get wrong is lists. You can create a proper multi-level list here with order and unordered lists nested inside each other correctly. This sort of stuff is actually important for creating accessible documents as things like flowcharts need a plain text version and nesting lists is a reasonable way of displaying these.

<comment><USER9> My litmus test for WYSIWYG lists — which Trix fails — is

      1. start a numbered list

      2. put several paragraphs...

         > including some nested block element e.g. quote

         ... inside one list item

      3. Then continue the numbered list (not from 1!)

This is something that's trivial to express in markdown, LaTeX etc but annoying to impossible with WYSIWYG where being in a list pretends to be a per-paragraph boolean property. In many WYSIWYGs you can't semantically put block-level stuff "into" a list item, only fake it by pressing Enter, cancelling numbering on the new paragraph and increasing indent to align with list item.

This makes it a nightmare to continue the list afterwards, because actually I've already closed it. Surprisingly, while many WYSIWYG editors are only ready to start a new "1\. " list, they do allow me to paste the compound item into the _middle_ of an existing list without interrupting its numbering. Sometimes there are other rituals involving liberal consumption of Shift+Enter and Backspace, dancing with text, and promising my firstborn to be contentEditable...

Anyway Trix fails it on the simpler task of multiple paragraphs in a list item. I haven't looked at the code but it seems its content model (at least strictly enforced) for list items is something like:

\- a single block element (can be a quote or code) \- followed by zero or more sublist items.

It's good that Trix won't let me increase indent on a paragraph that doesn't fit its content model. But I need a stronger model for my docs...

Now a quote does allow multiple block content! What happens when I put a quote inside a list and then add sub-lists inside the quote? Madness:

      1. foo
      2. | bar
         | baz (this was Enter, not Shift+Enter)
      3. | 1. sublist
      4. | 1. | ququux
         |    | multi-line/paragraph.
      5. | 1. #code () {####
         |    ###...########
         | 1. #}############
      6. | WAT?
      7. | * ulist...
      8. | * | 1. | - he he

I'd hope the continuous outer / non-continuous inner numbering is just styling bugs and not a crazy model?

P.S. A smaller usability issue: how do you make a numbered list with bullet sublist (or vice versa)? Enter->increase indent->switch to bullets works but Enter->switch to bullets leaves me with no option to increase indent. Unnecessarily confusing.

Anyway, lists are why I hate all WYSIWYG with passion as a user. I wish WYSIWYM with explicitly visible structure (cf. TeXmacs) was more popular.

<comment><USER9> Reported the clear bugs (#63, #64). not sure if the list content model is bug or intentional, though allowing the first line of an item to _be_ a single quote or code block + the freedom inside a quote does make it questionable IMHO... (cf. [http://spec.commonmark.org/0.21/#principle-of- uniformity](http://spec.commonmark.org/0.21/#principle-of-uniformity))

P.S. Squire doesn't seem to allow block content inside lists. Only Shift+Enter linebreaks.

ProseMirror does allow block content (it defaults to markdown content model); continuing the numbered list after non-sublist items required the paste-into- existing-list dance.

Firepad does allow non-item content but doesn't align it like part of the list. It does tend to continue the numbering afterwards, not sure what are its exact rules.

None of this is IMHO satisfactory UX. I've observed many people struggle with lists in any WYSIWYG I've ever seen :-(

</comment></comment></comment><comment><USER10> Since they didn't put a demo up on their site, here's one cobbled from their documentation:

[http://jsbin.com/cazewaxoje/1](http://jsbin.com/cazewaxoje/1)

<comment><USER11> I _just_ added a demo: [http://trix-editor.org/](http://trix-editor.org/)

<comment><USER12> Neat, thanks! Literally just this morning I was thinking to myself that I would give just about anything for a high quality OSS rich text editor capable of generating terse, correct HTML output.

And here, _not even 24 hours later_ , one just falls into my lap.

<comment><USER13> There's also ProseMirror [1], which I'm told is very good, and supports extensions of its document model to support things like embedded objects and Markdown, and is designed for collaborative editing -- all document operations are patches that can be sent over the network.

[1] [http://prosemirror.net/](http://prosemirror.net/)

<comment><USER12> Cool, thanks for the pointer!

</comment></comment></comment></comment></comment><comment><USER14> What is the computational complexity of inserting a character into a text containing N characters, using this editor?

<comment><USER15> This is a very astute observation. When I was developing Gate One I experimented with something similar for terminals (using contenteditable to work around issues with keeping elements up-to-date while retaining formatting) but ultimately ran into severe performance problems. That was years ago though and browsers have gotten _much_ better at handling contenteditable with larger amounts of text.

However, the more tags you add to contenteditable elements (i.e. for formatting) the more work the browser has to do every time there's a page reflow and there will be a reflow _every time the text changes_. So the more formatting, the slower (less responsive) it will be.

The workaround for this (no idea if it's used in this editor) is to divide the document up into lots of individual <div> elements with contenteditable=true and make sure that all outside-the-view elements are removed or at least hidden via 'display: none' and merely re-show them on-the-fly as the user moves about the page. Keeping a page or two above and below the view pre- rendered can help with responsiveness and you'd also have to make sure to pre- fill all the document's unseen space with whitespace so that the user can scroll to any position accurately even if the browser is still retrieving and rendering that portion of the document.

I came very close to implementing such a solution but ultimately decided on something else entirely (server-side rendering and a difference-based terminal update protocol). It's a great idea for an editor and tows the line of, "what we're supposed to be doing" on the web but ultimately it requires a lot of complicated code. Far more complicated that one would think at first glance.

<comment><USER16> [http://trix-editor.org/](http://trix-editor.org/)

They don't use contenteditable in the traditional way:

> Trix sidesteps these inconsistencies by treating contenteditable as an I/O > device: when input makes its way to the editor, Trix converts that input > into an editing operation on its internal document model, then re-renders > that document back into the editor.

I find this a fine solution.

</comment></comment></comment><comment><USER17> This looks interesting especially the part about "Trix sidesteps these inconsistencies by treating contenteditable as an I/O device". We recently started using froala ([https://www.froala.com/wysiwyg- editor/v2.0](https://www.froala.com/wysiwyg-editor/v2.0)) and are really happy with it so far.

<comment><USER18> Also a Froala user, been using CKEDITOR before but switched since Froala worked better and had a simpler API.

</comment></comment><comment><USER19> Interesting naming. The WYSIWYG rich text editor in Google Docs is named Kix. The engine behind Google Sheets is named Trix.

<comment><USER20> Is there an open source alternative to Kix? I've been looking for WYSIWYG which has the look and feel of a document processor.

<comment><USER21> [http://etherpad.org/](http://etherpad.org/)

</comment></comment></comment><comment><USER10> How does this compare to Prosemirror? ([http://prosemirror.net/](http://prosemirror.net/))

<comment><USER22> This doesn't support images as far as I can tell

<comment><USER23> Trix fully supports file attachments and image attachments, as documented in the readme. It includes an inline caption editor for images.

Trix also supports "content attachments" (currently undocumented) which allow embedding arbitrary HTML as attachments in the document. Basecamp 3 uses this feature to embed @mentions with avatars, and various oEmbed types, in messages and comments.

<comment><USER24> I want to see those "content attachments" as a live demo!

I'm currently using CKEDITOR in a Rails app and inserting HTML "templates." CKEDITOR renders the HTML and allows the end-user (or content creator) to modify the HTML while it is rendered inside the contenteditable text area.

</comment></comment></comment></comment><comment><USER25> Has anyone tried to embed Trix into React? How all this custom tags and polyfills will behave inside react component tree (even though shouldComponentUpdate will always return false)?

There is [https://github.com/souporserious/react- trix](https://github.com/souporserious/react-trix) but it looks like it does nothing at the moment.

</comment><comment><USER26> This is a Javascript project, but there is no NPM distribution for it.

Edit: yes, it's not a Ruby gem. I stand corrected.

<comment><USER27> It's also open source. The developers (Basecamp) are obviously deeply invested in the Ruby stack.

If you want to install it with NPM, you could a create pull request with a package.json file and some helpful information for the authors about how to submit to the NPM registry, no?

This _is_ the point of open source software you realise - that you can not just _use_ the software, but that you can help _improve_ it for yourself and others.

<comment><USER28> Raising an issue on GitHub would be a good first step.

Edit: [https://github.com/basecamp/trix/pull/32](https://github.com/basecamp/trix/pull/32)

</comment></comment></comment><comment><USER29> Please tell me this is a humane alternative to TinyMCE, CKEditor, etc?

<comment><USER30> See also [http://summernote.org](http://summernote.org)

<comment><USER28> Okay, time to write up an article about all these different WYSIWYG editors.

<comment><USER31> Please include wysihtml5 on your list :)

[http://xing.github.io/wysihtml5/](http://xing.github.io/wysihtml5/)

<comment><USER28> Would you like to collaborate on an article?

<comment><USER31> Sorry, I only just saw this message. I'd defintely offer to contribute if you're writing one alhough I'm not hugely familiar with many (but am with wysihtml5, quill and CKEditor).

</comment></comment></comment></comment></comment></comment><comment><USER32> A couple things I noted while playing with the demo at [http://trix- editor.org/](http://trix-editor.org/)

* Pressing the <tab> key doesn't insert a tab as I would expect. I'm using Firefox latest on Win8

* The * character doesn't turn into a bulleted list item as I would expect. This is probably more of a nice to have for people use to that behavior in MS Word.

<comment><USER33> Same tab issue on latest chrome osx

</comment></comment><comment> saint-loup It reminds me of Prosemirror: "By strictly separating its document data structure from the browser's DOM, ProseMirror sidesteps most of the mess that is contentEditable, and ensures that the document stays entirely under the control of the editor." [http://prosemirror.net/](http://prosemirror.net/)

</comment><comment><USER34> Last time I saw Basecamp (then 37signals) working on a rich text editor is a long time ago. What happened to WysiHat? I know it had another developer than the two guys who made Trix. What I especially liked about WysiHat was the complete bareness of the toolbar, just plain HTMl links. Is that also possible with Trix?

<comment><USER23> I was involved with the Wysihat project too. What we found is that its approach, like most other editors', is fundamentally broken. We created Trix to solve the problem. [https://github.com/basecamp/trix#different-by- design](https://github.com/basecamp/trix#different-by-design)

I think you'll find Trix's toolbar easy to style however you'd like, but if not, it ought to be straightforward to implement your own using the API.

<comment><USER34> Cool, and great work! I had a small e-mail conversation with Josh (forgot his last name) a couple of years back, I thought he worked on Wysihat alone. I have seen and tested some RTEs for the web, and I can only imagine how hard it is to come up with a durable solution. So thanks for Trix and good luck! P.S. Trix also has a 'royal' connotation to me, because it's short for Beatrix in The Netherlands. Beatrix being the former queen.

</comment></comment></comment><comment><USER35> Why are text editors so popular a project? My apologies if that sounds anything less than a legitimate question. I'm genuinely curious.

It seems very common to me, over the last several years, to see $NEW_SHINY_EDITOR, and I wonder why.

Are the alternatives _that_ bad? Or is it just a matter of another dev wanting to scratch their own itch?

<comment><USER36> Yes, they are all terrible. I don't know if this will be any better. They all highlight how bad the web is as an environment to host applications. A rich text editor - something that is a trivial toy project in any other application development environment - is impossible to build on the web in 2015.

<comment><USER23> It is not impossible. It just takes a lot of time and effort. It took two developers around 18 months to build Trix.

The readme explains how our approach is different from other WYSIWYG editors. (Most others are just toolbars that call execCommand.)

<comment><USER13> Did you look at ProseMirror? [http://prosemirror.net/](http://prosemirror.net/)

<comment><USER23> Yes, of course we've seen ProseMirror. It looks quite nice.

By the time we first heard of it several months ago, the bulk of Trix had already been written.

</comment></comment></comment></comment></comment><comment><USER37> Awesome stuff! Especially the attachment handling. Another more minimal approach is Squire from Fastmail, [https://github.com/neilj/Squire](https://github.com/neilj/Squire)

</comment><comment><USER38> 200kb for css+js

have fun with that on mobile where like all browsers, javascript is single threaded

the reason why we use contenteditable is that it can be done in 15kb and the browser can do it natively, then you just clean up the resulting code on the backend

</comment><comment><USER39> Anyone have an opinion on [http://quilljs.com](http://quilljs.com) ? Haven't seen it mentioned in this thread yet.

</comment><comment><USER40> Demo: [https://wells.ee/trix-demo/](https://wells.ee/trix-demo/)

<comment><USER6> they put the official demo here: [http://trix-editor.org/](http://trix- editor.org/)

</comment></comment><comment><USER41> This is totally off topic, but the first thing I thought of when I read "Trix" was: "Silly rabbit, Trix are for kids!" Anyone else?

On topic: Thanks, Basecamp. I like the minimalism and focus on function of this project. Contenteditable approaches to formatting text needed some love. I look forward to trying this out in my next project.

</comment><comment><USER42> Hard to figure out why no one is doing a plain HTML editor that the humans can understand and cope with it. That way we stay with the plain text with the most open formatting standard. A Notepad ++ that is standardized on HTML and not plain text comes too my mind.

</comment><comment><USER43> > CONDUCT.md

Did projects prior to being hosted on GitHub require a Code of Conduct or is that a new thing.

<comment><USER44> They don't require it, it's just encouraged.

</comment></comment><comment><USER45> Any Ember users out there? We just wrote an Ember component addon for Trix. [https://github.com/lynnetye/ember-trix- editor](https://github.com/lynnetye/ember-trix-editor)

</comment><comment><USER46> The demo GIFs going around on Twitter a few weeks ago made me really excited for this.

</comment><comment><USER47> Does anyone know if this would adapt well for real-time use with multiple people writing at once? Etherpad-style. Or would that need to be architected differently from the start?

Also, sad that it's in Coffeescript.

<comment><USER48> Nothing sad about it. Just because it isn't $your_favourite_language doesn't mean it's sad.

</comment></comment><comment><USER49> so... does it have vi mode?

</comment><comment><USER50> I really like this. If only it supported ie 9 and below I would use it. Looks like we are stuck with CK unless anyone can offer other viable, preferably pretty, solutions?

<comment><USER51> It seems like it uses polyfills to solve this problem, no?

From the documentation:

> Eventually we expect all browsers to implement these standards. In the > meantime, Trix includes polyfills for missing functionality.

</comment></comment><comment><USER52> Finally an editor which can replace existing form elements without extra JavaScript! ContentEditable is wow and all but it doesn't replace textarea, this does.

</comment><comment><USER53> This is cool, one issue thou is that on iOS the select content menu gets in the way. Not Trix fault but iOS makes these WYSIWYG editors a no go.

<comment><USER54> Has anyone found a good workaround for this? The best I can do is move the select content menu after it's loaded, but this looks ugly and is really, really distracting. Nothing else that I've tried works.

</comment></comment><comment><USER55> This is very nice. The support for attachment is a surprise bonus. I'm seriously thinking to incorporate this in one of my projects.

</comment><comment><USER56> This a good time to ask about a good, open source text editor that outputs to Markdown instead of HTML?

<comment><USER9> [http://hallojs.org/demo/markdown/](http://hallojs.org/demo/markdown/) [http://sofish.github.io/pen/](http://sofish.github.io/pen/) [https://github.com/bevacqua/woofmark](https://github.com/bevacqua/woofmark) [http://prosemirror.net/demo_markdown.html](http://prosemirror.net/demo_markdown.html)

Haven't seriously used any of those but I'd put my money on ProseMirror as the most principled one.

</comment></comment><comment><USER24> I'm currently using CKEDITOR in a Rails app. I like the cleaner toolbar design for Trix!

</comment><comment> l-p It breaks Pentadactyl external editor feature as every other WYSIWYG editor do.

This will be a pain to use.

<comment><USER57> If _EVERY_ WYSIWYG editor is breaking the plugin. Maybe it's the plugin that is broken not the editors? Just a thought.

<comment> l-p Actually, not every editor break it, this is not my real issue with WYSIWYG editors anyway.

My problem is that I don't want to use them. Unless they use markdown or another simple formatting language behind the scene, and allow you to switch to a simple `<textarea>` input, you can't avoid them.

I already have a text editor, I already have a way to generate "rich" text, I don't need another tool with another set of bindings, quirks, bugs and incompatibilities. Every editor has its own way to deal with very basic stuff: when writing a list what happens if you press return twice? Backspace on an empty element? Tab? You can't know beforehand.

I'm fine with giving tools to non-technical users, but there should be a way to disable such editors completely so it can adapt to any workflow.

</comment></comment></comment><comment><USER58> I don't get these simplistic editors. You just have to learn ten HTML tags to do the formatting these editors offer.

What would be useful though, would be an editor that supported "design" and not just text.

<comment><USER59> It may be used by people that don't even know what HTML is. Good luck teaching them what a tag is.

</comment></comment><comment><USER60> What about google doc?

</comment><comment><USER61> Very neat -- seems like React for textarea

<comment><USER61> Not sure why so many downvotes -- they build an in-memory representation of the content of the contenteditable, intercept input events to update that representation, and use that to update the actual dom. Presumably they wouldn't just wipe out the entire contents each time either, so it's sending atomic create/update/delete commands to the dom.. So it's like React's vdom just for contenteditable.

</comment></comment><comment><USER62> Oh an editor! Oh... no. It's just a webpage/javascript thing. Not interesting.</comment>


Some models of Airbus A350 airliners need to be hard-rebooted after 149 hours - <AUTHOR> https://www.theregister.co.uk/2019/07/25/a350_power_cycle_software_bug_149_hours/ <comment><USER2> I think the comments here say more about us as an audience than they do about the Airbus. We're totally accustomed to hardware & software problems whose solution is, "just restart it," and we don't even find it all that disturbing - mostly just humorous.

Our standards as developers & testers have gotten pretty low.

I think the only way you'd see outrage here at HN is if the restart involved a real physical crash (as opposed to a software one) and the loss of human lives. Otherwise, we're all, "meh."

<comment><USER3> That's not necessarily a "low" standard. It's that the value of preventing a reboot every few days is much lower than other things we could spend our time on. Mandatory oftware perfection would be a huge drag on valuable new features.

<comment><USER4> I agree with you to a certain degree but appropriateness of the trade off should really depend on where the software is used. Airplane, powerplants, and train signaling systems? I would want longer uptime.

</comment></comment></comment><comment><USER5> > _The remedy for the A350-941 problem is straightforward according to the AD: > install Airbus software updates for a permanent cure, or switch the > aeroplane off and on again._

The subhed and the above graf say it's as straightforward to fix as installing Airbus software patches. But I assume this process is not as streamlined or convenient as iOS or Tesla OTA auto-updates. Anyone have insight to what installing patches on an airliner entails? I'm assuming it involves more downtime than powering down and restarting, if that's the current status quo.

<comment><USER6> The problem isn't the update itself, which is actually straightforward. It's the fact that as soon as you modify the software you must do a c check on the craft.

Which is a horribly long process, around 6,000 man-hours and puts the aircraft out of commission for a few weeks.

<comment><USER7> good. I don't want someone to update the software and next day send it in a commercial flight.

<comment><USER8> I do.

As long as the hardware has been tested, and the software update tested on different hardware, then as long as the test hardware and my hardware are nominally the same, and as long as the software has basic "self test the basics of every component on startup", then I don't see a reason to do more tests.

</comment></comment></comment></comment><comment><USER9> It is a very well know issue with every plane. Sometimes there are no solutions to a problem. You need these hacky solutions. The title is clearly catchy with everything that is going on with Boeing.

But the point is, this reboot process is very well managed and known. So I won't call it scary.

<comment><USER10> I agree it's not scary and it's a good, known workaround. But it's software - we shouldn't say "there are no solutions". The solution is: fix this problem and add long runtime testing to the qa process. Especially if this is a known issue in other planes.

<comment><USER9> When dealing with physical systems it is impossible to have no bugs. To give an extreme example, there is a _not_ a small chance that the cosmic rays can change a bit in a system's memory - [https://stackoverflow.com/questions/2580933/cosmic-rays- what...](https://stackoverflow.com/questions/2580933/cosmic-rays-what-is-the- probability-they-will-affect-a-program)

The issue here is overflow due to time. The time is saved in a variable (don't know how much bits), which overflows after the gives period. Now there are two options 1\. Upgrade circuits of every plane. These planes were designed/built a long time back. Bigger registers were not practical due to costs. 2\. Document it and have a process for it.

<comment><USER11> Environmentally induced errors aren't software bugs, just because there's a problem elsewhere doesn't mean we shouldn't seek to mitigate other problems.

In plane investigations I've looked at (not many) the issue has always been a compounding of several errors or shortcomings .. that strongly suggests you shouldn't let small errors build up in different systems, to me. [1]

If it's a register which takes down the whole system then surely they'd know that (and could fix it with a watchdog that returned the effected systems to the boot state without reboot) -- other comments seem to be saying "meh, it's complex, doesn't matter what the error is as long as reboot fixes it"; that seems really dangerous in safety critical systems.

[1] but I acknowledge the "better the devil you know" issue and that pragmatism and cost take over at some point.

</comment></comment></comment></comment><comment><USER12> Normal :) Same for the Boeing 787 back in 2015: [https://news.ycombinator.com/item?id=17907654](https://news.ycombinator.com/item?id=17907654)

<comment><USER13> Patriot missile batteries, too. [https://en.wikipedia.org/wiki/MIM-104_Patriot#Failure_at_Dha...](https://en.wikipedia.org/wiki/MIM-104_Patriot#Failure_at_Dhahran)

</comment></comment><comment><USER14> Software has a bug. Patch with a fix is released. Some users don't want to update for reasons and demand a workaround. The workaround sucks.

How is this news?

<comment><USER15> The workaround doesn't even suck, IMO.

<comment><USER14> It doesn't suck unless you forget to turn it off and back on.

</comment></comment></comment><comment><USER16> Time- ~Late 1990s.

Place- Small financial institution in the NE.

Having just finished two weeks on the job, one Friday evening before heading out I decided to reboot my Sun Sparcstation. I of course did not have root but there was L1-A which put you into the BIOS. Then: sync;sync;reboot

Workstation starts rebooting.

30 seconds later the sysadmin is standing over my shoulder.

      SA - "What did you do?"
      me - "I rebooted it"
      SA - Incredulous. Like I just set my hair on fire. "Why?"
      me - "Its been two week, you know defrag memory, free up the page tables"
      (some vague psuedo cs bs)
      SA - "This is a Solaris X.Y/SunOS Q.Y machine.
      It had an uptime of 180+days.
      I have machines here with an uptime of 2+ years."
      me - "Really?"
      SA - "These machines do not need a reboot. Ever. Please do not do this again."

I arrived Monday to find that L1-A had been disabled on my machine.

How far we have (pro|re)gressed in 20 years! ;) (edits - typo)

</comment><comment><USER17> Without reading the article it reminds me of the famous software glitch of the Patriot defense system, to work around a rounding error bug it was required to reboot the system if used for not so many hours...

</comment><comment><USER18> I kind of feel like these things should be reset regularly to be safe anyway.

This was a bug that was known, what if there others?

<comment><USER19> Crash early, crash hard.

<comment><USER20> Not what you want in aviation, per se.

</comment></comment></comment><comment><USER21> That is 2^29 milliseconds. I dread to imagine the reasons leading to 28-bit millisecond time in an airplane.

<comment><USER22> Presumably someone is using the high four bits for some other purpose. It wouldn't surprise me if parts of an A350's avionics software is old enough that those sorts of space optimizations made sense.

<comment><USER23> It could also be a tagged value. These are quite common in code created by "high reliability" languages (Ada, OCaml). The high bits are used to carry some metadata.

E.g. you might want to set a certain bit if the value went outside the defined input range of a function (think for example far from the accepted numerical window of a Taylor series expansion). Instead of dealing error conditions at each and every step (thereby making the timing properties of the code unpredictable) you just collect all error conditions and at the end decide if you discard the value, or just use it partially (e.g. it might still be "good enough" to be used as a parametizing input of an adaptive filter, where it averages out with the rest).

</comment></comment></comment><comment><USER20> Interestingly, it looks like the A350 software probably was developed under DO-178B[1] rather than DO-178C[2] given the timing of release. This may seem minor, but Wikipedia's comparison indicates 178B was looser. Of course, these specs just consider requirements, not so much advice on implementation.

[1][https://en.wikipedia.org/wiki/DO-178B](https://en.wikipedia.org/wiki/DO-178B) [2][https://en.wikipedia.org/wiki/DO-178C](https://en.wikipedia.org/wiki/DO-178C)

</comment><comment><USER24> So this is already fixed:

"The remedy for the A350-941 problem is straightforward according to the AD: install Airbus software updates for a permanent cure ..."

And it has the known workaround.

So this has almost nothing to do with Airbus at this point, the directive and the "sighs" uttered by the EU aviation agency are directed at the airlines that won't install the update.

But good distraction from Boeing's woes as long as you only read the headline...

<comment><USER25> > So this has almost nothing to do with Airbus at this point, the directive > and the "sighs" uttered by the EU aviation agency are directed at the > airlines that won't install the update.

Why won't EASA ground the un-updated airplanes?

<comment><USER20> As mentioned else-thread, the plane requires a certain level of inspection after the software update, which merely takes a few weeks and lots of human effort.

<comment><USER26> I find this interesting to compare to the 737 Max. Here the reaction is "just reboot because the inspection after installing the fix takes too long". But with the 737 Max, the reaction is "Create MCAS to avoid the cost of having to retrain pilots? How could you be so stupid?"

I know, the A350 bug hasn't killed anyone (yet). But I see the parallels in the issue, and yet the reactions here are completely opposite.

<comment><USER20> Part of it, I'm sure, is that the A350 bug is comprehensively root-caused and that root cause is understood to be completely bounded by rebooting the system, whereas MCAS reduces the number of points of failure to, in certain builds of the 737 MAX, a single sensor.

</comment></comment></comment></comment></comment><comment><USER27> It's a scary thought that such issues exist, regardless of how common or not.

<comment><USER28> I think planes already scrutinized to a very high degree. What I am more concerned about is airlines doing the reboot in flight to save time. Planes are often on a very tight schedule (maybe not cargo planes).

<comment><USER29> Don't worry, the AD (airworthiness directive) specifically calls for complete, ground power cycles. These cannot be done in flight. [https://ad.easa.europa.eu/blob/EASA_AD_2017_0129_R1.pdf/AD_2...](https://ad.easa.europa.eu/blob/EASA_AD_2017_0129_R1.pdf/AD_2017-0129R1_1)

</comment></comment></comment><comment><USER30> Occasionally rebooting a system is actually a good thing.

"Hello, IT, have you tried turning it off and on!?"

<comment><USER31> The opening line from the IT Crowd [0], one of the cult British sitcoms and a favorite of mine. Highly recommended :-)

[0] [https://en.wikipedia.org/wiki/The_IT_Crowd](https://en.wikipedia.org/wiki/The_IT_Crowd)

</comment></comment><comment><USER32> And? Does it come as a surprise that planes require regular maintenance?

</comment><comment><USER33> Software engineering needs some significant improvements if we would like to keep using critical systems like aircrafts. It is getting to the point where serious software problems are impacting everyday life, not in a good sense.

<comment><USER34> Airbus is already using formal method for creation and validation of the code which are the ultimate version of testing.

<comment><USER33> Whatever method prevents buffer overflows.

AFAIK that is what happens here.

"The CPIOM is effectively a mini computer; in the A350 CPIOMs run discrete avionics "applications", in the sense of apps. CRDCs themselves do not host or run applications, suggesting that the failure condition detailed in the EASA AD may mean loss of a particular app on a CPIOM after a buffer overflow."

<comment><USER26> s/AFAIK/I'm guessing/

Or do you have any objective basis for suspecting that _this_ is a buffer overflow?</comment></comment></comment></comment>


Ask HN: Any Hackers in Singapore or HK want to meet up for a drink? - <AUTHOR>

Will be passing through over the next two weeks and would love to meet some of the local community! Have been traveling for 3 months and these are my final stops. Email in profile. <comment><USER2> Hello from Singapore!

Some of the local hackers here frequent HackerspaceSG (which is currently relocating) — [http://hackerspace.sg](http://hackerspace.sg) / [https://www.facebook.com/groups/hackerspacesg/](https://www.facebook.com/groups/hackerspacesg/).

For a list of upcoming tech events in Singapore, [http://webuild.sg](http://webuild.sg) has a good list.</comment>


Ask HN: Computer Science? - <AUTHOR> I am planning to pursue a degree in CS. Before enrolling, I want to make sure whether CS is right step or not. Are there job opportunities?<p>Please guide. <comment><USER2> I just have an associate degree and landed a 45k/yr job after a 6 month internship so I'd say there is plenty of opportunity.</comment>


Is depression really an evolutionary adaptation? A second opinion. - <AUTHOR> http://whyevolutionistrue.wordpress.com/2009/08/29/is-depression-an-evolutionary-adaptation-part-1/

<comment><AUTHOR> Part 2 can be found here:

[http://whyevolutionistrue.wordpress.com/2009/08/30/is- depres...](http://whyevolutionistrue.wordpress.com/2009/08/30/is-depression- an-evolutionary-adaptation-part-2/)</comment>


Why do we need more powerful processors? - <AUTHOR> If all the programs like Java, .net keeps updating and getting better, then shouldn't it work on older systems? <comment><USER2> Powerful processor is all about moving data in a short time possible: Big Data. It's not just about Java and .Net.

You could look at 3D XPoint and NVRam instead where data lives, those have cut down to 1 digit latency as claimed by Intel or Micron. Still Java 9 should be what you're looking at, lastly, Erlang for lowest latencies.

If Sun have produced proprietary microprocessor for Java it did before, it would have been a different world for us now as far as I heard it has the native performance. It's cost and time effective to buy newer hardware than improves coding to squeeze as much performance as possible.

In fact, general purpose processors we know is not efficient, it uses lot of watts when moving data within the microprocessors. I let the expertise do the talks.

<comment><USER3> Sun's propose-built, native Java processor (picoJava [https://en.m.wikipedia.org/wiki/PicoJava](https://en.m.wikipedia.org/wiki/PicoJava) — forgive the direct link because I am on a mobile platform) absolutely stank and they clearly lacked the incentive to invest more resources into producing a special-purpose part when general-purpose devices (traditional CPUs) would have always had the return-on-investment advantage.</comment></comment>


Preventing brute-force attacks with django - <AUTHOR> http://bruno.im/2011/nov/22/preventing-brute-force-attacks-django/

<comment><USER2> fail2ban is good for this as well

</comment><comment><USER3> That is an issue. But a more significant issue is Django's vulnerability to timing attacks.

<comment><USER4> I'm not aware of any timing attacks against Django.

If there are attacks that we should be aware of please be a good open source citizen and report them to `firstname.lastname@example.com`. We take security reports very seriously, and want very much to fix any issues that're disclosed!

[edit to clarify: I'm one of the lead developers of Django, and one of the members of the security team that gets emails sent to the `security@` alias.]</comment></comment>