Ask HN: Review my mockup tool: WireframeSketcher - <AUTHOR> http://wireframesketcher.com

<comment><USER4> Man, there are a lot of these "Balsamiq-esque" apps lately.

I've started wondering if it has anything to do with Peldi's financial transparency. People saw what a cash cow it was and decided they wanted a piece.

<comment><USER5> I haven't seen any Mockup-products coming out recently, care to share some links?

Personally I'm not too interested in having IDE integration so...

<comment><USER4> The way I see it there are 2 classifications. Wireframing tools and then mockup feedback tools.

Wireframing

* Mockingbird (<http://gomockingbird.com>) - Built on Cappuccino, best designed of the bunch

* Napkee (<http://www.napkee.com/>) - <USER2>

* Hot Gloo (<http://www.hotgloo.com/>) - Just a web app I believe

* Pencil Project (<http://www.evolus.vn/Pencil/>) - Firefox add-on

* Several more wireframing type apps...

Mockup feedback

* Mocksup (<http://mocksup.com>) - Make your mockups clickable (Full disclosure, I'm co-owner)

* Notable (<http://www.notableapp.com/>) - Mark up websites and mockups with comments

* ConceptShare (<http://conceptshare.com/>) - <USER3>

* Several others that focus on just mockup feedback, not much differentiation

<comment><USER6> mockflow.com also- A collaborative one

</comment></comment></comment></comment><comment><USER7> The tour pages are really well put together content wise; When trying to decide if a program is worth a downloading, I usually scan the screenshots page and make a quick decision based on first impressions. Comes across as easy to use but with some nice power features.

The landing page screenshot has been poorly resized however. I'd make that a bit bigger and prettier, and you could even go so far as adding slick little javascript tooltips to explain different tools. Could help your conversion rates maybe? Also perhaps consider using the same shiny green 'Try It Now' button on the bottom of the tour pages, instead of switching to a text link. Small grammar nitpick, 'How it works' is not a question.

<comment><AUTHOR> Thank you for your feedback. I quickly fixed the text and changed the buttons.

I know that the screenshot is badly resized but couldn't do better. I've used GIMP. What tool should I try?

<comment><USER7> Yeah gimp does ugly resizing. Python image lib would probably be better, or if you have access to photoshop that works very well of course (bicubic sharpen setting). Or email me the file if you like. :)

Other ideas- I'd make the top blue gradient extend the whole width of the page. If you're going to make your signup buttons with fancy css shadows etc, might as well do the same for your logo text rather than having it in an image. Any reason for the lack of spaces in 'Wireframing&Prototyping'? You've got 'learn more' text in two different formatting styles on the landing page. No need for external links to open in new tabs, your users will be savvy enough to use their back button. I'd consider burying the 'get it free' in the footer rather than by the buying info - perceived value and all that.

<comment><AUTHOR> I've emailed you the original image. Thanks for looking into it.

I've just started improving the website design and striped headers and footers are next on my list. I need to figure out how to do it with Blueprint CSS. CSS buttons is something that I've added only a week ago. I've used the fancy- buttons plugin for compass to do it.

I've fixed that '&' everywhere. It didn't occur to me that there should be spaces. I've also fixed the links.

I actually thought about placing the "get it free" section somewhere else or removing it altogether. I thought it was a good strategy to acquire as many users as I can.

</comment></comment></comment></comment><comment><USER8> The Eclipse Update system is horrid (especially when your copy of 3.3 is ancient). Nice work - it is one of the better Eclipse plug-ins I have used.

Some points - since you are hosting this in Eclipse, it seems that you are focusing on developers. Most graphic designers won't touch Eclipse. Also most developers once they experience another IDE (IntelliJ, for example) find it harder to return.

Maybe nitpicky but when I drag an object like a container or button into the screen canvas, it messes with my flow when I get an immediate edit box for the text attribute. I'd rather double-click to edit.

Comparing with Balsamiq, one thing that I don't like about Balsamiq is you can't yet have named groups of items (e.g. all the navigation elements). Being able to have a reusable user-defined library of custom groups - e.g. new "Edit screen for editing Foo in module X" would differentiate mockup tools from the spawn of Visio.

Grouping logically would be the difference between bitmap type editing and Illustrator-type editing. It would be nice to be able to have an outline tree view of elements organized in a hierarchy by UX intent.

<comment><AUTHOR> I think the update system got better in later versions although there are sill some usability problems and I am not a big fan of it.

I realize that Eclipse is not for everyone. But a plugin for IntelliJ or some other IDE is a completely different product. FWIW there is a "standlone" version of WireframeSketcher that you can get through Yoxos: <http://wireframesketcher.com/install_details.html#yoxos>

I'll see what I can do about the immediate edit box. Obviously an option for it could be a solution. I'll see if there are more requests for it.

Take a look at master screens. I think it might be what you are looking for. You can reference screens from other screens and create reusable units this way. Changes to referenced screens are propagated automatically.

I plan to add editing inside groups. I think your idea of logical grouping is good. It was actually this issue that was stopping me from adding the possibility to put in Outline the complete contents of a group. Logical hierarchy would give much more appropriate results.

<comment><USER8> Just tried master screens. Did exactly what you said it would do. Nice feature. Would be nice to have a poor man's layer system where you can quickly toggle the visibility or at least dim the master screen(s) so they kind of become the background/grid.

Suggestion - include some sample screens built to your best practices and a couple storyboards using those screens.

<comment><AUTHOR> Yes, I've had other requests for dimming masters. For now you can overlay a semi-transparent panel to achieve the same effect.

Better samples, better screencasts - all this is on my list. But like for any coder it takes some great effort for me to spend my time on website/marketing. But I'll get there I promise.

<comment><USER8> Nice side project. Your investment in the coding really shows off.

In case you did not see Dan Grover's response about the work breakdown on his Etude sheet music iPhone app:

"Were you the only one developing it? How long did it take? Love the app and the video on the webpage, by the way."

"Luckily, I have a precise answer to this because I have this weird habit of tracking every minute of my time on my own projects. Here's the breakdown on Etude in hh:mm

Actual iPhone app: 210:11

Song converter: 72:52

Store (UI + server side): 82:23

Building site and designing marketing materials: 44:52

I did most of the work, but I did contract some of the graphics I had trouble with to a designer, and I've taken someone awesome on board to work with music companies and other "strategic" stuff for the future."

<http://news.ycombinator.com/item?id=1196308>

</comment></comment></comment></comment></comment><comment><USER9> What makes your tool better than Balsamiq Mockups?

<http://www.balsamiq.com/products/mockups>

<comment><AUTHOR> I target specifically Eclipse users. There are many advantages of having the tool integrated into the IDE: familiar and customizable interface (views, window system), use the same resource management (files, projects), version control.

Feature-wise it's more difficult to differentiate but WireframeSketcher has some distinct features like master screens and storyboarding. There are more subtle differences like the possibility to insert icons in any piece of text which gives a lot of flexibility. Take a look at this blog entry: <http://tinyurl.com/yeuo3v4>

Speedwise I'd say WireframeSketcher is as close to native speed as it gets considering that it's also cross-platform.

</comment></comment><comment><USER10> My $0.02 - the mock up on the front page looks like someone trying to design a clunky looking desktop app from the 90's (what's more, designing something that looks like it is at least partially subverting the standard OS File Save dialog) Maybe a more 'relevant' mockup would help (e.g. something suggestive of a webapp, or something abiding by more modern Windows/OSX interface guidelines). Even some of the some of the screenshots on the feature tour page I though were a little more relevant. Or perhaps a rotating carousel or video. A/B test it :) Other than that I think the product is good, I even have a vague recollection of downloading this a while ago when I was looking for wireframers for our team to use. (We ended up not using any tool, fwiw.)

<comment><AUTHOR> You are totally right. I'll replace this example with something better. Making a good video is next on my list.

</comment></comment><comment><USER11> Looks good. I couldn't see anything about exporting as (say) HTML? That's one thing I really really really would pay for: I sketch, and the tool exports a basic HTML & CSS template. Probably best used for what you call "Masters".

<comment><AUTHOR> You can export to PDF. Also take a look at storyboards which let you create something similar to PowerPoint presentations. Those can be exported into a multi-page PDF: <http://tinyurl.com/yczskbh>

<comment><USER12> Exporting to, say, XCF or a similar image file format with layers (is there one out there that will work across Photoshop+GIMP?) would be much more useful to a graphic designer than a PDF. PDFs are great for printing and overview, but having wireframes in a layered image file format for your graphic designer would be a huge plus.

<comment><AUTHOR> You can also do PNG exports. There is batch export that will let you export a set of screens all at once. You'll have multiple files but I am not sure if it's a limitation.

<comment><USER12> Layers, I think, are more important for individual sections of the wireframe - this allows the eventual visual designer to take portions of the design atomically, leading to greater internal visual consistency throughout the site. It also eases the pain of slicing and dicing ;)

</comment></comment></comment></comment></comment><comment><USER13> I think the Eclipse integration is a very interesting way to differentiate.

One nit: I'd put a space around the "&" in the page title for SEO.

<comment><AUTHOR> Done :)

</comment></comment><comment><USER14> I was looking for this just minutes ago! Will certainly check it out.</comment>


Flappy48 - <AUTHOR> http://www.cnet.com.au/flappy48-is-a-work-of-diabolical-genius-339347116.htm

<comment><USER2> 50% Flappy Bird, 30% 2048, 30% Snake; the additional 10% is borrowed from the remaining minutes of your life.

<comment><USER3> no power of will?

<comment><USER4> 5% pleasure, 15% pain? 100% reason to remember the name?

</comment></comment></comment><comment><USER5> Okay wow the meta-joke on these games is getting to pretty intense levels lol. On a technical level though, I found this game extremely hard while using space-bar, but very easy with mouse clicks. It seems to jump differently or something.

<comment><USER6> I noticed this too, even though I'm using a laptop. The space bar feels "floatier" to me.

<comment><USER7> Space bar will flap higher if you hold it longer. Mouse click always flaps the same amount.

<comment><USER8> Dev here, can't believe I'm just reading this now. This is indeed a bug. Thank you based hackernews.

</comment></comment></comment></comment><comment><USER9> Ruining productivity since 2014 - and I thought I had kicked my 2048 habit

<comment><USER10> Oh thank god this is in Unity's "runs evereywhere where it's windows" web player. For a second I was worried.

<comment><USER11> Just wait. If it really _is_ good, there'll be an HTML version to sap your time within a couple of days.

<comment><USER12> With "doges", probably.

</comment></comment></comment></comment><comment><USER13> Do you have a version which works on Linux?

<comment><USER14>
      sudo add-apt-repository ppa:pipelight/stable && sudo apt-get update && sudo apt-get -y install pipelight-multi

      sudo pipelight-plugin --enable unity3d.

<comment><USER15> Is this alone supposed to enable Unity3D? Doesn't seem to work for me.

<comment><USER14> I forgot to mention those commands are for Ubuntu, sorry. [http://www.reddit.com/r/gaming/comments/23qthg/flappy_bird_c...](http://www.reddit.com/r/gaming/comments/23qthg/flappy_bird_combined_with_2048meet_flappy48/cgzs9hg)

<comment><USER15> I do run Ubuntu (13.10 32-bit), but I don't see any effect.

        $ sudo pipelight-plugin --enable unity3d
        [sudo] password for nb:
        Plugin unity3d is now enabled

No new extension was added to Chrome. How am I supposed to check whether Unity works?

<comment><USER16> You won't get a new Chrome extension. If you want to see if Unity works, why not try playing Flappy 48 since that was the original reason this was posted.

<comment><USER15> Obviously, it doesn't work, that's why I tried to look if anything got installed at all.

<comment><USER16> You asked how to check if it works, so it wasn't obvious to me that it wasn't working. You can see if the plugin was installed by going to chrome://plugins/. For whatever reason, things seemed to be more stable for me in Firefox than in Chrome.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> I am not good at writing code, but it seems logic to me to use something like the HTML5 Phaser framework instead of unity, which 80% will not install anyways because... well because the little hipsters in us dislikes Comic Sans and proprietary plugins, right?

</comment><comment><USER18> I'd like to imagine that this was partially inspired by my Flappy Text that I made a few months ago : [http://codepen.io/sakri/full/eukbC](http://codepen.io/sakri/full/eukbC) (full screen) in editor [http://codepen.io/sakri/pen/eukbC](http://codepen.io/sakri/pen/eukbC)

</comment><comment><USER19> I am not installing yet another plugin.......

</comment><comment><USER20> This looks like the alien overlords constructing ever-more-convoluted tests to see if the puny humans have evolved enough to learn the Higher Truths. Next: Flappy48 while juggling Bitcoins and finding a taxi during surge pricing?

</comment><comment><USER21> Fun concept, but the physics is way off.

Edit: I was using space instead of clicking the mouse. The mouse click is way easier than using the space bar.

</comment><comment><USER22> Trailing blocks can get stuck and fall off. Clever.

</comment><comment><USER23> That is ... awesome.

</comment><comment><USER10> Is anyone else bothered how cNet are referring to 2048 as a "Threes clone"? The two games are very different and Cirulli himself mentioned that he created 2048 with no knowledge of Threes, only as a clone of a clone of 1024 which really only took the "two tiles with the same numbers merge when they collide" element from Threes.

<comment><USER24> > which really only took the "two tiles with the same numbers merge when they > collide" element from Threes

Which is the only element Threes has!

<comment><USER25> It also has 1s and 2s merging with each other but not themselves.

The bottom line is that Threes is a much better game than any of the clones I've played. There's a subtlety and polish to the gameplay that is missing from the others. It's obvious they spent a lot of time perfecting everything from the tile distribution to where they spawn and how they merge.

<comment><USER26> It's very polished ... but. The start animation? Needs to die. Showing me a game which then turns out to be finished when I try and swipe? Bad UX. Score totalling animation? Cute the first couple of times, very annoying thereafter. Swiping and signing? Again, cute for a couple of times rapidly turning into a rancid waste of time when you want to play again (yes, I know you can set this to autosign now but ...)

It's just not smooth enough from start -> play -> restart -> restart to be a good casual gaming experience. It's start -> thud -> thud -> play -> thud -> thud -> restart -> right, back to 2048 then.

<comment><USER25> So the start screen, menu, and all metagame aspects are more important than gameplay to you? Okay, if that's what you value.

<comment><USER26> When they take up a substantial fraction of the time playing a casual game? Yes, they become important. If I can't pick it up and quickly play N games whilst I'm on the train of a morning, I'm not interested, sorry. If I wanted long load times and faff between games, I have a whole Steam library full of that.

<comment><USER25> So you have to tap twice in between games instead of once. If this is anything approaching a significant fraction of your time playing Threes, _then you are terrible at it_. It takes a good 10-20 minutes to get up to a 768 or 1536.</comment></comment></comment></comment></comment></comment></comment>


Facebook to Remove Onavo App from Apple Store - <AUTHOR> https://www.wsj.com/articles/facebook-to-remove-data-security-app-from-apple-store-1534975340 <comment><USER2> I know exactly how this software works because I have analyzed it deeply. Every packet that goes through the Onavo VPN is analyzed. Using API's available to a normal sandboxed app, the source port is mapped with the process ID, then mapped to the package identifier, and then Facebook knows how much data is being used by which apps. Until SSL was mandatory for apps, they could also analyze the data itself, but that was stopped a couple years ago on iOS.

Once Facebook has all the packets, they can do various analyses and machine learning to even learn which features are most popular within a competitor's app. It is quite sophisticated.

<comment><USER3> Does it have logic to inhibit packet analysis when being tested by Apple App Store reviewers?

<comment><USER4> You're thinking of Volkswagon's VPN app.

<comment><USER5> Haha, it's rare on HN that someone gets a joke right. Well done!

Edit: it was worth the downvotes, would do again.

</comment></comment></comment></comment><comment><USER6> This is malware and should have been rejected from the App Store months (if not years ago). Better late than never.

I'm sure if it was a smaller company doing a similar thing they wouldn't have been given such leeway as Facebook was for so long.

<comment><USER7> I understand people say things like this because they're the edgy, hot take - but the Onavo VPN software is absolutely not malware. It's a performant, free VPN that people use in exchange for some anonymized data. There have been no known leaks or breaches.

<comment><USER8> From Apple's App Store Review Guidelines:[0]

> 2.5.14 Apps must request explicit user consent and provide a clear visual > indication when recording, logging, or otherwise making a record of user > activity. This includes any use of the device camera, microphone, or other > user inputs.

So did Onavo "provide a clear visual indication" whenever collecting data? Somehow I doubt that, because it would have been a constant warning.

0) [https://developer.apple.com/app- store/review/guidelines/](https://developer.apple.com/app- store/review/guidelines/)

<comment><USER9> There is a constantly visible indicator that you're using a vpn on everything but the iPhone X. It's a stretch admittedly, but there's an argument to be made.

<comment><USER10> That is definitey not an argument.

</comment></comment></comment></comment></comment><comment><USER11> I really hope Apple pulls through with a thorough research of other free VPN apps on the App Store and cracks down on other sketchy ones too. I doubt that Onavo users will be inclined to pay for a VPN, and I suspect they instead will look for other free alternatives.

Onavo didn't have to make money because it was owned by Facebook and it was known to collect data for its parent company's market research. Much less is known about how other VPN apps remain sustainable-- I wouldn't doubt some might be running on sketchy business models.

</comment><comment><USER12> > Facebook Inc. pulled its data-security app

Calling this a 'data security app' is like calling a Snickers bar a diet meal replacement.

This app literally gives facebook the ability to track every app you runs and every website you visit, for how long, when, and what network you do it from.

It is literally the kind of data collection that people use VPNs to avoid!

<comment><USER9> > It is literally the kind of data collection that people use VPNs to avoid!

I have a feeling that a majority of VPN app users use them with the intent of preventing a specific party from collecting that data (e.g. an employer or a government).

<comment><USER13> There's also a lot of people who use VPNs to keep their browsing private while they're on a broadly accessible wifi

<comment><USER14> I get why people would use a VPN to thwart censorship but I never really understood this line of reasoning. It seems that instead of giving a few minutes' browsing history to an unknown wireless provider, users are giving their _entire_ history to an unknown VPN provider. Am I missing something?

<comment><USER15> Many VPN providers claim to not keep logs, and have varying levels of trustability.

</comment></comment></comment></comment></comment><comment><USER16> Censorship and privacy concerns have ironically created a market for malware- laden and snooping VPNs to prey on unsuspecting users. the cure is worse than the disease

<comment><USER17> This isn't what I'd call "the cure", though. This is the "privacy" equivalent of those bullshit cancer "cures" that prey on poorly informed or desperate people.

</comment></comment><comment><USER18> Related: Sensor Tower puts out several free VPN products and sells the analytics observed.

</comment><comment><USER19> I feel really conflicted about this.

On the one hand, there's a clear value proposition here: instead of paying a few bucks a month for a VPN, you can instead pay by giving a giant megacompany your private data.

The problem is we as a culture don't have a good consent model for educating people about what this actually means. In a world where everyone who used Onavo knew exactly what data Facebook was getting from them, and what that meant, what number of users would willingly use it?

Calling it "malware" or "spyware" doesn't feel accurate, since they're not outright lying about what the value prop is, but they're still being deceitful by omission and are preying on people's ignorance.

<comment><USER14> A lot of the bundled type of spyware I've seen relies on users clicking "I Agree" on an EULA. The problem is nobody reads the EULA, they just want whatever software it's attached to as quickly as possible.

I suppose my point being that just because users "agreed" to something doesn't necessarily mean they knew what they were agreeing to at the time.

</comment></comment><comment><USER20> non-paywall: [http://archive.is/dA1vk](http://archive.is/dA1vk)

<comment><USER21> "Error 1001 DNS resolution error

What happened? You've requested a page on a website (archive.is) that is on the Cloudflare network. Cloudflare is currently unable to resolve your requested domain (archive.is)."

Domain blocked?

<comment><USER22> Archive.is blocks DNS lookups from Cloudflare's public resolver.

Edit: No idea why, just sharing context I have.

<comment><USER23> ...why?

<comment><USER24> I just googled and found plenty of threads stretching back months. It seems to have to do with Archive.is returning wrong IP addresses to Cloudflare's DNS queries. They are apparently telling folks to use Google DNS but the configuration of which IP address to return is entirely in their hands. I'm still quite confused by the situation, to be honest.

</comment></comment></comment></comment></comment><comment><USER25> Do all VPN companies sell their traffic to others? I think that is now probably assumed to be the case.

<comment><USER8> Many ISPs and telecom providers certainly do. Some were even selling geolocation data. So arguably you must use VPNs and/or Tor for privacy.

<comment><USER26> > Many ISPs and telecom providers certainly do

Do you have a list of them or source for this claim? (not that I'm disagreeing with you, but just want to see the full extent of the problem)

<comment><USER8> We know that AT&T, Sprint and Verizon sold location data to numerous corporate entities. But T-Mobile has claimed that it didn't.

"Verizon and AT&T will stop selling your phone's location to data brokers" <[https://arstechnica.com/tech-policy/2018/06/verizon-and- att-...](https://arstechnica.com/tech-policy/2018/06/verizon-and-att-will- stop-selling-your-phones-location-to-data-brokers/>)

"Verizon and others call a conditional halt on sharing location with data brokers" <[https://techcrunch.com/2018/06/19/verizon-stops-selling- cust...](https://techcrunch.com/2018/06/19/verizon-stops-selling-customer- location-to-two-data-brokers-after-one-is-caught-leaking-it/>)

It's well known now that ISPs can monetize and sell customer data. For example, see [https://www.usatoday.com/story/tech/news/2017/04/04/isps- can...](https://www.usatoday.com/story/tech/news/2017/04/04/isps-can-now- collect-and-sell-your-data-what-know-internet-privacy/100015356/)

</comment></comment></comment></comment><comment><USER27> Why are there a million VPN apps and protocols with pointless variations? Why isn't the VPN software included in my operating system enough? e.g. Settings/General/VPN on iOS. macOS and Windows have something similar.

EDIT: This was an honest question. If anyone has any insights to share, I would really appreciate it. Over the years, I have dealt with some truly questionable third-party VPN software from the usual big name networking equipment vendors and plenty of other so called "security" vendors.

<comment><USER28> Because VPN is a service, not a piece of software.

You're paying third parties for the service, and those third parties use the money to maintain the infrastructure powerful enough for each user to have high speed VPN service (nobody's gonna use a VPN that throttles the speed by 90%) across different geographical regions.

 _If_ Microsoft and Apple wanted to offer a VPN as a first-party service out of the box, they would be forced to maintain a pretty complex infrastructure across multiple regions _and_ somehow be able to support way more traffic than any third party VPN provider (because of their name). So, where's the money for the infrastructure going to come from?

In Facebook's case, form mining the data. I would argue that Apple isn't stupid enough to attempt something like that, and as for Google, they already do have a first-party VPN integrated into Android[0].

I would argue that the reason that third-party VPNs are shady is _because_ they need a large infrastructure in place before they can offer the service. Once they do have the infrastructure in place, they're not making profit, but covering their losses, while at the same time being forced to scale even further.

[0] On Nexus/Pixel devices from certain regions that activates automatically when connected to an insecure WiFi: [https://www.howtogeek.com/275474/how-to- use-androids-wi-fi-a...](https://www.howtogeek.com/275474/how-to-use-androids- wi-fi-assistant-to-keep-your-phone-safe-on-public-networks/)

<comment><USER27> You are confusing service with software. All major operating systems have built-in VPN support. Check the network settings on your phone or computer. There will be a section for VPN settings.

</comment></comment></comment><comment><USER29> Non-paywall coverage on The Verge: [https://www.theverge.com/2018/8/22/17771298/facebook- onavo-p...](https://www.theverge.com/2018/8/22/17771298/facebook-onavo- protect-apple-app-store-pulled-privacy-concerns)

"Onavo, which began as an Israeli analytics startup focused on helping users monitor their data usage, was acquired by Facebook in 2013. Its VPN provider then became a data collection tool for Facebook to monitor smartphone users' behavior outside its core apps, helping inform Facebook's live video strategy, competition from other social apps, and its decision to acquire companies including WhatsApp."

Geez, man. That is _evil_. Especially since most users don't know the difference between "security" and "privacy", and probably assume that it would have the exact _opposite_ effect.

<comment><USER30> Oh please. The description in the app stores is pretty clear about this behavior ([https://play.google.com/store/apps/details?id=com.onavo.spac...](https://play.google.com/store/apps/details?id=com.onavo.spaceship)):

"As part of providing these features, Onavo may collect your mobile data traffic. This helps us improve and operate the Onavo service by analyzing your use of websites, apps and data. Because we're part of Facebook, we also use this info to improve Facebook products and services, gain insights into the products and services people value, and build better experiences."

Running a VPN isn't particularly cheap. I'd assume that any free VPN is one of:

      1. criminals collecting and monetizing your information
      2. state actors collecting and ?????????? your information
      3. companies collecting and monetizing your information
      4. too small to need to do one of (1)-(3)

</comment></comment><comment><USER31> The next step is to ban third party frameworks in apps for "analytics" or serving ads. That should be something intermediated and provided by Apple itself.

[https://developer.apple.com/documentation/storekit/skadnetwo...](https://developer.apple.com/documentation/storekit/skadnetwork)

<comment> kyle-rb Yeah, Apple needs a monopoly on serving ads too.

<comment><USER32> After the iAd fiasco, I don't think Apple wants to go anywhere near in app ads.

</comment></comment></comment><comment><USER33> Why post a paywall link?

<comment><USER34> This might be kind of ironic (you'll see what I mean) but to get to full wsj.com articles just put the word "full" before wsj, keeping the rest of the URL the same.

For this article that means go to

[https://www.fullwsj.com/articles/facebook-to-remove-data- sec...](https://www.fullwsj.com/articles/facebook-to-remove-data-security-app- from-apple-store-1534975340)

(I just copied and pasted our post link then added "full" before wsj.com)</comment></comment>


Ask HN: Is it possible to get non-technical users to self-host software online? - open-source-ux Has anyone ever had success with getting non-technical users to install or deploy software on a server?
I have never heard a success story. I hope someone has a successful tale to share?
Are one-click app marketplaces the only viable option? (One-click app marketplaces include hosting and take away some of the complexity of deployment - examples include Linode, Digital Ocean).
It seems to me that without easy deployment for non-technical users, self-hosting will never be a viable option for most people, only for a tiny minority of technical users. Agree or disagree? <comment><AUTHOR> > It seems to me that without easy deployment for non-technical users, self- > hosting will never be a viable option for most people, only for a tiny > minority of technical users. Agree or disagree?

Agree. You'd have to come up with a very clever idea to get non-technical users to self-host software without a sys-admin. My idea is close to one click app marketplaces, but this time it is done on a physical in-house NAS which is ready to buy. Thus, it should be possible to self-host apps like, Bitwarden, Gitlab, etc on the NAS and it is already accessible from the cloud login (Western Digital optionally does this). But in most cases, it is done for them.

This is why technical support exists in general. For consumers, End users pay for support as part of a package to help them with setting up software tuned to their requirements, including self-hosting. For companies or institutions, they have IT departments that do all of this in-house for them.</comment>


Building a static serverless website using S3 and CloudFront - <AUTHOR> https://sanderknape.com/2020/02/building-a-static-serverless-website-using-s3-cloudfront/ <comment><USER3> I don't work for them or anything, but I've honestly found Netlify to be the absolute easiest solution for static site hosting. And it's free! There are some paid features, but the free stuff is all you need. You can use SSL, accept form inputs through request capturing, automate deployments with Github/Gitlab hooks, auto generate static pages for most popular static site generators (Jekyll, Hugo, etc.) Absolute breeze to use. Beats any hacky AWS solution hands down imo.

<comment><USER4> Maybe an overly simple and dumb question but have to ask: What's the big difference between hosting static sites on services like these and just going with a regular webhost like Bluehost and slapping in something like a wordpress template? This is what a lot of blogs, landing pages and even fairly static small business or organization sites seem to do without problems and it's all pretty user.friendly for the non-developer crowd (me included)

<comment><USER5> People have been coming up with solutions to the 'make a basic business website' problem since the 90s, when Microsoft FrontPage, Macromedia Dreamweaver and NetObjects Fusion fought it out, and computer magazines would mail out their entire website on the CD on the magazine's cover, for readers without web access.

At this point, there are a great many ways to skin a cat.

Assuming you've got $5 a month or so, it mostly comes down to personal preferences about workflow, vendor independence, security, reputation, and who you already have an account with.

<comment><USER4> I asked below but no answer, so hopefully not bothering but I ask again here. Any solid guide or resource you could recommend on doing just this, building a static site with these services while not using wordpress and typical hosting services like bluehost etc.

</comment></comment></comment></comment><comment><USER6> This is hilarious. All this complicated and unneeded stuff for a static website. It completely misses not just a point but multiple points.

Maybe you want a static sites so that it'll 'live' forever and not be effected by future changes in software stacks. You definitely don't get that by doing this.

Maybe you want a static site so that it's simple to set up. It's not this.

Maybe you want a static site for security, all the complexity and accounts here make it less secure than a random site running random php.

This is just buzzword bingo for someone's resume.

<comment><USER7> Hmm you conveniently omitted comments about HA, latency or scalability... Pushing a bundle of files to a CDN it's undeniably a superior static site/SPA hosting in many ways.

Maybe the article overcomplicates but with services like Netlify, Amplify or Firebase Hosting it's stupid easy and cheap, and there's no vendor lock-in.

</comment></comment><comment><USER8> Host a static website the HN way:

1\. Buy the cheapest most unsustainable VPS ipv4 deal out there.

2\. Make A record and WWW record and point domain to your new fangled server.

3\. Configure server:

apt-get install nginx goaccess

cd website

cp * /var/www/html

Yearly maintenance required: apt-get update, apt-get upgrade

reboot

View traffic stats: goaccess -f /var/log/nginx/access.log

<comment><USER9> Serious question: how much more maintenance is required? Could I get away with unattended-upgrades and nginx+wsgi+PostgreSQL?

I ask because actual servers seem like dark magic to me so I want to try to build a product with them, but I can't find anywhere if it's possible to run a reasonably secure server without years of studying.

<comment><USER10> If you're serving static content, installing Apache, nginx, or any other web server will do just fine. Make sure to set the document root to a directory you're fine being public.

If you're running something dynamic like WordPress, stay extremely on top of patches, unfortunately, and be super cautious about what plugins you use. (This is one of the better reasons to use a static website.)

If you want to run a Postgres for your dynamic website, configure it to listen only to localhost or only via UNIX sockets.

Make sure you keep your software up-to-date. unattended-upgrades is a great idea for OS-provided software.

Be careful about where you get software from. More than just "get it from somewhere trustworthy," the big concern here is to get it from someone who is applying software updates. For most OS-ish things, you want to get them from your distro; try to avoid downloading e.g. PHP from some random website, because you won't get automatic updates. For a few things - especially things like WordPress - I wouldn't trust the distro to keep up, largely because the common practice is to release security fixes by releasing new versions, and distros are going to want to backport the fixes, which is slower and not always guaranteed to work.

As another commenter mentioned, turn off remote password logins and set up SSH keys. (Most VPS providers will have some form of console / emergency access if you lose access to your SSH keys.)

<comment><USER11> I run my sites, all static on a VPS, but I do the authoring in a single multi- site wordpress install and use 'Simply Static' plugin to publish the result. The benefits are pretty awesome:

heaps of templates (because I'm often lazy), 1 stop shop for patches, locked down plugins (child sites can't install plugins, only enable/disable), and only one place to look for problems (& you can lock the wordpress site to a single IP if you always want to use it from a single place).

FWIW, I never groked AWS & it's ping times in my country are about 1/2 as good as local providers. (15-30ms for local, vs 50-100ms for AWS local). Speed matters.

Also, my use case is to 'fall over' (meaning: fail/stop working/be unresponsive) wrt DDOS, whereas I know many here are 'must not fail' (with varying levels of acceptability). So, I write concise, low bandwith consuming websites that appear instantly (to my local market users).

</comment></comment></comment></comment><comment><USER12> I would like to just mention that github does static site hosting for free. I have used it for a few years. Never had a problem. Static, Free, probably not going out of business in the next 5+ years, domain is my only cost.

<comment><USER13> True, but they reserve the right to prohibit sites that use up a non-trivial amount of bandwidth, or that have commercial purposes, or various other reasons.

It's a great service, but I wouldn't count on it as your primary hosting.

</comment></comment><comment><USER14> I found s3 + cloudflare to be a better combo. Cloudflare offers free ssl certs and has overall been a great experience. I also use AWS SES for my domain mail. It gets delivered to S3, then a local python script grabs it and dumps it in a mailbox file for dovecot to serve via imap. I pay $0.05/month for my hosting of my site and email.

[https://markw.dev](https://markw.dev)

<comment><USER15> I find your email setup intriguing. Any chance you could share those scripts in a GitHub repo or gist?

<comment> mxie-ca I have this set up couple years ago via this lambda function: [https://github.com/arithmetric/aws-lambda-ses- forwarder](https://github.com/arithmetric/aws-lambda-ses-forwarder)

It may look outdated, but it still functions well for me

<comment><USER14> The big difference is my setup doesn't require another email service. Just 10 lines in a config to spin up an imap server. I was trying avoid the big mail providers when I set this up.

</comment></comment></comment></comment><comment><USER16> How is this so complicated? I shudder to think of the amount of developer hours wasted by the weirdness and complexity of AWS. Really wish they would prioritize usability and developer experience.

<comment><USER17> AWS's business isn't making simple things like this easy for solo practitioners who are never going to spend any money.

Their business is making big complicated things possible for companies that are going to spend a lot of money and don't care about a small amount of incidental complexity.

<comment><USER18> > Their business is making big complicated things possible for companies that > are going to spend a lot of money and don't care about a small amount of > incidental complexity.

While imposing technical limitations to extract more revenue along the way.

<comment><USER19> Could you share some examples?

</comment></comment></comment></comment><comment><USER20> Can someone please provide practical advice on moving from a site hosted on Wordpress using all the plugins to a static hosted site? It seems unbelievably complicated.

My non-technical employees and partners like Wordpress. We like the plugins that make web development easy and not arcane.

But we don't like the fact that every page requires basically a database read. Yes, we use WP-SuperCache, and it's ok.

But why oh why is it so hard to do the editing on Wordpress and the publishing on a Static site? Anyone with some real guidance here?

We want the people who come to the site to get the static experience while the people who edit the site to get the Wordpress experience.

<comment><USER21> In a previous life I worked on a site that had a private Wordpress instance that was scraped and cloned to a more or less static site.

You can either do this explicitly using a small scraper tool, or implicitly using aggressive reverse-proxy caching rules.

<comment><USER20> Sounds pretty intensive. Every page would need constant scraping as links update and sidebars change, wouldn't they?

<comment><USER21> I think you might be overthinking it. Just drop cache after publishing.

Maybe you're doing something more complicated that isn't amenable to pseudo- static?

</comment></comment></comment></comment><comment><USER22> I've had to do this multiple times over the past two years. It's always a shock to me how hard it is.

The Lambda@Edge functions especially. They have 4 phases they can be injected into: viewer-request, origin-request, origin-response, and viewer-response. If you put your code in the wrong place you get hard to debug issues. Additionally you cannot "annotate" a request, so a decision at say "viewer- request" cannot pass information to later stages.

Also, deployments take 15 minutes at least which just further frustrates the debugging process.

<comment><USER23> This was actually one of my most delightful experiences with Azure Functions and Microsoft's API Management solution - overhead does not make it the right fit for every serverless architecture, but it did make orchestrating functions in this way a lot easier

<comment><USER19> Thanks for this comment! I know what the next side tech I'll play around with will be :)

</comment></comment></comment><comment><USER24> It's amusing to me how programmers look back with disdain at web development in the 90s and how "you just uploaded files to a FTP server" and now we've circled back to the same thing, just with a whole lot more plumbing in the middle.

<comment><USER25> For me, Netlify is the right mix (I'm not affiliated with them). It has the 90s ease of use with modern tools and performance out of the box. It's simple to upload files or sync a repo and it it's free. I'm not sure why anyone would host a static website on the AWS stack.

<comment><USER26> > I'm not sure why anyone would host a static website on the AWS stack.

Well, I do that, so I guess I'll chime in.

First and foremost is the idea of not tying your site's build process and hosting to a company that could go under. Yes, Amazon could, but if I had to bet Netlify will either cease to exist, be bought out, have its free offering discontinued/changed/etc. long before that.

Second is that sometimes your site's build process is more complicated than what Netlify provides. For example, my site is a static Hugo site, which Netlify supports, but there's one crucial step in the build process where I turn my "resume.html" page into "resume.pdf" \-- I have to run a Docker image that starts headless Chrome in order to render the PDF properly. As far as I can tell, that can't be rigged up in Netlify.

Finally, I was able to learn a lot about AWS by hosting my site this way -- setting up a Lambda to listen for GitHub commits, using the AWS API to launch an EC2 instance to build my site, how to configure S3 and CloudFront to serve up content properly, etc. And at the end of the day I get a site that I have complete control over and is approximately free to run.

<comment><USER27> > First and foremost is the idea of not tying your site's build process and > hosting to a company that could go under.

Sounds like you're imposing a complex build process on yourself while getting locked into a web of AWS features to be honest.

Could you not skip generating the PDF resume since you've already got the HTML version to keep life simple?

If you stick to running a basic NPM script to build your site there's little lock-in with Netlify. You could also build your site on a CI platform then push the generated pages + assets to Netlify after.

<comment><USER26> > Sounds like you're imposing a complex build process on yourself while > getting locked into a web of AWS features to be honest.

I should elaborate a little. My whole site is contained within a Docker container that has NPM, Yarn, headless-chrome, Hugo, etc. I can generate everything with a single command. The AWS bits are just there for hosting and responding to a GitHub commit. So the build process is portable-ish, but from what I saw Netlify doesn't just let you do headless-chrome on a free plan[1].

> Could you not skip generating the PDF resume

Not really, the point is to automate everything away behind a single Git push.

1: [https://community.netlify.com/t/using-zipped-binaries-how- to...](https://community.netlify.com/t/using-zipped-binaries-how-to-actually- use-them/2740/12)

<comment><USER27> Why do you need a PDF resume that's built automatically though? Does it need to be in PDF? Does it change that often? Aren't resumes something you customise per job application?

</comment></comment></comment></comment></comment></comment><comment><USER28> Since we are all sharing how to deploy static sites, here's my approach using CloudFormation to build a static site with S3, CloudFront, Certificate Manager and Route53.

[https://gitlab.com/verbose-equals-true/django-postgres- vue-g...](https://gitlab.com/verbose-equals-true/django-postgres-vue-gitlab- ecs/-/blob/develop/cloudformation/infrastructure/static-site.yaml)

and here's how I deploy that site with GitLab CI.

[https://gitlab.com/verbose-equals-true/django-postgres- vue-g...](https://gitlab.com/verbose-equals-true/django-postgres-vue-gitlab- ecs/-/blob/develop/gitlab-ci/aws.yml#L29)

Also, nobody mentioned GitLab pages which offers some pretty nice static site solutions as well.

<comment><USER19> Nice solution! If you're interested in a code based solution, this is one space where the CDK really shines. OAI, CloudFront Website Distributions, and Route53 AAAA records to the distribution are all turnkey constructs. Deployment is just executing 'cdk deploy'.

If your CFN gives you headaches ever, maybe take a look

<comment><USER28> Thanks, I'm interested in learning a code-based solution. I like the ideas behind CDK, Pulumi and Terraform, but I feel like they all have trade-offs. CFN isn't the best, but I don't look forward to having to re-implement my entire tech stack to achieve the same result compared with what I currently have

</comment></comment></comment><comment><USER29> Just use Netlify, it's free, you can hook it up to a GitHub repository and they'll handle your Let's Encrypt certs for you.

<comment><USER30> Just use Github pages, supports TLS, CNAME and is free.

<comment><USER29> Netlify does DNS and can serve from private repos for free. Not sure if GitHub changed their policy, but last time I looked, if you wanted to serve from a private repo, you needed to have a Pro plan.

<comment><USER31> That's not true (at least not anymore). Now that Github offers free unlimited private repos, there's no difference between public/private ones.

<comment><USER32> No, it is still true. From [https://help.github.com/en/github/working-with- github-pages](https://help.github.com/en/github/working-with-github-pages)

> GitHub Pages is available in public repositories with GitHub Free, and in > public and private repositories with GitHub Pro, GitHub Team, GitHub > Enterprise Cloud, and GitHub Enterprise Server. For more information, see > "GitHub's products."

<comment><USER31> Ah, I guess it's because I'm on Github Student.

</comment></comment></comment></comment></comment></comment><comment><USER33> For anyone who is hosting .html files and doesn't want to have to put index files inside directories, the "trick" with s3 is to rename the file to the name without the html extension, and change the Content Type to text/html.

Earlier today I modified the popular jakejarvis s3 sync github action to allow for this during my CI/CD process.

[https://github.com/davidweatherall/s3-sync- action](https://github.com/davidweatherall/s3-sync-action)

<comment><USER34> Thanks for sharing that. Nice repo! Can you explain why I wouldn't want an index file in a directory? I assume you mean index.html?

<comment><USER33> I do mean index.html! Personally I prefer the url structure of example.com/about as opposed to example.com/about/ \- especially when adding on anchors or parameters (example.com/about?param as opposed to /about/?param).

Relative pathing can be useful depending on file structure.

It avoids issues with directory / page naming conflicts. E.g. my images are stored at /assets/img/image.png - but if I wanted to create a page at example.com/assets this would require me to then place an index.html inside my assets directory - which doesn't seem logical.

Overall, mostly personal preference of me disliking the index.html inside directory method - It just doesn't seem like it's the "right" way to access a page. If I have a example.com/about page - I expect them to be hitting an about.html file.

</comment></comment></comment><comment><USER35> I've been using S3 static hosting and CloudFront for all of my static sites recently and it's fantastic (and nearly free). This is not a hacky solution by any means, S3 buckets support static file hosting out of the box and CloudFront sits in front caching your content across the CDN. Throw in AWS Certificate Manager and you get TLS solved too. Low traffic sites cost literally nothing. S3 runs $0.004 per 10k requests and Cloudfront comes in at $0.001 per 10K.

</comment><comment><USER19> I don't really understand the author's claims here.

            const streamsBucket = new s3.Bucket(this, 'StreamsBucket', { websiteIndexDocument: 'index.html', removalPolicy: RemovalPolicy.DESTROY })
            /* Create a cloudfront endpoint to make it publicly accessible */
            const streamsDistributionOai = new cloudfront.OriginAccessIdentity(this, 'StreamsBucketOAI', {});
            const streamsDistribution = new cloudfront.CloudFrontWebDistribution(this, 'StreamsDistribution', {
                originConfigs: [
                    {
                        s3OriginSource: {
                            s3BucketSource: streamsBucket,
                            originAccessIdentity: streamsDistributionOai,
                        },
                        behaviors: [ {isDefaultBehavior: true} ],
                    }
                ]
            });

Will create a bucket that will serve index.html from a non website bucket. Three lines of cdk code. If you need to populate the bucket, add another line to create a new BucketDeployment to populate the bucket.

All files are secured by OAI and not accessible over the public internet.

</comment><comment><USER36> This is a ridiculously complicated tutorial.

Sure, S3 works if you're deploying it as safest as possible and want to pay for it too and do this on a recurrent basis, but otherwise is too big of a fuss for a personal blog, I use GitHub pages for over 4 years now with no issues, my own domain and SSL.

The simplest is surge.sh, period. If you don't need a domain, a web platform and just want to deploy from your CLI, surge.sh is the solution. It's good when you want to show off a static website to someone outside your sever. Even the switching to a premium plan is done from the CLI.

Other solutions are: Netlify, ZEIT Now, Aerobatic or Render.

I frequently use this list from this GatsbyJS wiki to check for static website hosts, I recommend it: [https://www.gatsbyjs.org/docs/deploying-and- hosting/](https://www.gatsbyjs.org/docs/deploying-and-hosting/)

</comment><comment><USER37> The complicated stuff seems predicated on this:

"However, the S3 website endpoint is publicly available. Anyone who knows this endpoint can therefore also request your content while bypassing CloudFront. If both URLs are crawled by Google, you risk getting a penalty for duplicate content."

I'm curious if anyone has experienced these issues in practice.

<comment><USER38> I run the setup of S3 + Cloudfront and never ran into their index problem because I'm not trying for URLs without document file extensions.

I assume that's the reason for really wanting index redirect in directories. Pretty URLs, I didn't feel the need. There are other valid reasons too I'm sure. But my needs diverged from the article even earlier than SEO penalties.

<comment><USER37> The pretty URLs thing is confusing me now too. AWS lets you configure the buckets to do the pretty URLs.

[https://docs.aws.amazon.com/AmazonS3/latest/dev/HowDoIWebsit...](https://docs.aws.amazon.com/AmazonS3/latest/dev/HowDoIWebsiteConfiguration.html) [https://docs.aws.amazon.com/AmazonS3/latest/dev/IndexDocumen...](https://docs.aws.amazon.com/AmazonS3/latest/dev/IndexDocumentSupport.html)

I put up a Jekyll site on s3/cloudfront recently and it seems to work well.

Anyway, I'm still wondering about the consequences of the naked s3 endpoint being available.

</comment></comment></comment><comment><USER39> I know this is not a popular opinion here, but here goes:

I use a digitalocean instance where I install nginx. Then I copy the static files through sftp or scp. For ssl, I install letsencrypt.

<comment><USER40> "I saw a guy building a website today.

No React.

No Vue.

No Ember.

He just sat there.

Writing HTML.

Like a Psychopath."

(credit to [https://twitter.com/kiddbubu/status/1187120868259979269](https://twitter.com/kiddbubu/status/1187120868259979269))

</comment></comment><comment><USER41> What benefits does this have? in comparison to much easier solutions like; Netlify, Github Pages etc..

</comment><comment><USER42> What's wrong with old school apache server running on a $5/month DigitalOcean droplet?

<comment><USER43> I've been running my personal blog and many other micro-sites on a $5 DigitalOcean droplet for years. It's seriously the best bang for the buck.

</comment></comment><comment><USER44> What I've gleaned from this thread is that in 2020 there are a thousand easy ways to host a static website. Just take your pick and go with it.

<comment><USER45> And for every way, there will be 10 people who will call you names for doing it this way, and that you should really do it another way. Just do whatever makes sense for you.

</comment></comment><comment><USER46> I see you are using Hugo 0.62.1

[https://sanderknape.com](https://sanderknape.com)

FYI starting with 0.63.0 the speed has about doubled:

[https://github.com/gohugoio/hugo/releases/tag/v0.63.0](https://github.com/gohugoio/hugo/releases/tag/v0.63.0)

<comment><USER47> Is the speed it's taking to building the static site usually a problem? I don't recall ever waiting for it to be done. Maybe my site is too minimal to see a difference ([https://annoying.technology](https://annoying.technology)).

<comment><USER48> I have compile times of >30 seconds with Jekyll blog [1,2]. This is an issue. It adds a lot of friction to the edit/preview loop.

BTW: I just moved it to Netlify since reading this thread. Took me ~5 minutes.

[1] [https://github.com/HeinrichHartmann/HeinrichHartmann.github....](https://github.com/HeinrichHartmann/HeinrichHartmann.github.io)

[2] [https://www.heinrichhartmann.com/](https://www.heinrichhartmann.com/)

<comment><USER47> FWIW I'm getting a "certificate does not match *.netlify.com" SSL error on your site.

</comment></comment></comment></comment><comment><USER49> It's much simpler to use GitHub Pages + Cloudfront (optional).

<comment><USER50> Ya, I'm trying to understand what the downside to github pages is compared to this strategy. Can anybody elaborate on what I might be missing?

<comment><USER51> I'd rather be a paying customer and know I'm not going to lose my setup because of some reason.

<comment><USER50> That's absolutely a valid reason. All my static sites are not generating income and don't need support. I've also got my own backups, so if GH decides I shouldn't be there I'm not losing much. If a site is important to your business then support is certainly more critical.

Thanks for the very valid counterpoint!

</comment></comment></comment></comment><comment><USER52> Did the same for my personal site. Really happy with the result: [https://ethanaa.com/blog/conversion-to-static-site-with- vuep...](https://ethanaa.com/blog/conversion-to-static-site-with-vuepress-and- aws-s3/#amazon-route53)

I also wrote follow up posts on adding document search: [https://ethanaa.com/blog/document-search-with- algolia/](https://ethanaa.com/blog/document-search-with-algolia/)

And continuous deployment: [https://ethanaa.com/blog/continuous-deployment- with-circleci...](https://ethanaa.com/blog/continuous-deployment-with- circleci-and-s3deploy/)

</comment><comment><USER53> > The redirect logic provided by the S3 website endpoint can be moved to a > Lambda@Edge function.

The post here is using Lambda@Edge to handle pointing example.com/about/ to example.com/about/index.html

However there's a lot more you can do / may want to do with Lambda@Edge if you're hosting a Cloudfront+S3 website.

I just wrote up how I set up a system to make managing server-side redirects (e.g. 301s from /old-page to /new-page) easier via Lambda@Edge.

[https://news.ycombinator.com/item?id=22351484](https://news.ycombinator.com/item?id=22351484)

[https://engineering.close.com/posts/redirects-using- cloudfro...](https://engineering.close.com/posts/redirects-using-cloudfront- lambda-edge)

<comment><USER54> I did some redirects without lambda's last year using s3 routing rules, which kind of worked. As figuring out this and several other things, I also wrote up some details on this.

[https://dev.to/jillesvangurp/using-cloudfront-s3-and- route-5...](https://dev.to/jillesvangurp/using-cloudfront-s3-and-route-53-for- hosting-395o)

IMHO, Amazon should be ashamed of themselves for making it so unbelievably convoluted and hard to host a simple website on cloudfront. It's the one thing almost every website out there has to solve and they made it super painful to get this right.

</comment></comment><comment><USER55> You should use Amplify, it solves allk those problems.

<comment><USER56> I use AWS Amplify, it makes all of these headaches go away and it's ridiculously simple to configure.

1\. Add your domain in AWS Route 53

2\. Tell it which git repo & branch you want to use (including private github ones)

3\. It detects the repo contains a hugo site (works for other ssg) and generates a build script

So now every time I commit to my selected branch, Lambda is notified, it fires up a vm to generate the html, move it into S3 and takes care of Cloudfront, SSL & so on.

</comment></comment><comment><USER57> I did something very similar recently with my website. With that said, I would not do it again. For doing something—seemingly so simple, the infrastructure work was a pain.

Also, while I'm at it, static websites are, in my opinion, a little "gimmicky" since it's impossible to determine the user's browser size at build time. This means that you have to make a choice to build for either mobile or desktop first. Then, if the user is using the other device, they'll encounter the FOUC issue (flash of unstyled content).

For me, that's big enough reason to not use static websites in the future.

<comment><USER58> What? Why aren't you using media queries?

<comment><USER57> I am using media queries—while they work, they'll flash the "unadapted" version depending on what component is rendered first. The alternative is to add some kind of loading aspect to each component but I think it's not very scalable

<comment><USER59> _they'll flash the "unadapted" version depending on what component is rendered first_

A normal CSS file is render blocking so the DOM content won't be displayed until the browser has downloaded it, parsed it, and knows what to display. If you move your main layout styles out of the component (presumably this is using styled components or similar?) and in to a CSS file that's defined as a <link> in the header of the page then that problem will go away (or a <style> tag in the header if you're worried about the additional fetch). This is how browsers have been designed to work.

</comment></comment></comment></comment><comment><USER60> Now you just need to configure a Lambda to take care of cache invalidation on CloudFront, based on s3:PutObject events. CloudFront also supports headers like "cache-control: public, max-age=3600, s-maxage=86400", so you can have quite aggressive caching on CloudFront where you can just invalidate it on demand anyway.

Personally I just listen for any event and invalidate all objects, since that's way cheaper than issuing an invalidation request for each object, but performance wise that might not be the best option.

</comment><comment><USER61> Here's my terraform-ization of an S3 + Cloudflare setup for SSGs. I use Zola but that's incidental.

[https://gitlab.com/bitemyapp/statically- yours](https://gitlab.com/bitemyapp/statically-yours)

There's a weird bug with the `tf init` but it can be worked around by running `tf init`, deleting the providers in `.terraform`, then running again. Hashicorp has an open bug for the problem I think.

I could probably clean it up more but this has been okay for a couple sites I run.

</comment><comment><USER62> What are good ways of managing your content with a static website?

For example, say you want a single index.html file, with each article contained in a separate content file - "blogpost01.html", "blogpost02.html", etc. - that you somehow include in the <body></body> of your index file?

Is there any way to do that with a static site, or something similar where your content is separated out into individual files?

<comment><USER63> Use a static site generator. The parts you touch for authoring posts will end up "included" during the build step, producing files that you don't touch which each redundantly contain the common markup. Or with an SPA generator like Gatsby, there wouldn't even be any redundancy (but client side JS is required).

<comment><USER64> One example of the above is PyKwiki: [https://github.com/nullism/pykwiki](https://github.com/nullism/pykwiki)

</comment></comment></comment><comment> brown9-2 One thing that these guides on using S3 never mention is to make sure to set alerts if the cost of the bucket grows too fast, i.e. your site gets popular.

</comment><comment><USER65> We've also been using S3 + Cloudfront for our static website, it's super cheap and has been low touch.

We've run into two things though:

\- We have very little control over TLS versions and cipher settings.

\- We have to use a CNAME so we can't point a bare domain at it which also means we can't add our site to the HSTS preload list (I think there is a way to purchase an IP though now, if anyone knows please let me know).

Overall totally worth it though.

<comment><USER66> On your point about using CNAMEs - if you have the domain set up with Route 53, you can create an A/AAAA alias record on the domain apex pointing to CloudFront.

</comment></comment><comment><USER67> I struggled with setting up static website hosting on S3, CloudFront, Route53 and ACM, so I created [https://github.com/tobilg/serverless-aws-static- websites](https://github.com/tobilg/serverless-aws-static-websites) to automate this via the Serverless framework

</comment><comment><USER68> Are there any guidelines for controlling cost when running a static website on S3+CloudFront?

Say my regular bill for this setup was $5 a month. Can I at least get a notification if I have a lot of visits and the bill goes over a threshold, say $50?

Also, is there any protection against things like DDoS that could quickly push the bill into the $100s and beyond?

<comment><USER69> aws (and all other cloud providers I've used) has a pretty elaborate cost alert system.

<comment><USER70> Alerts do nothing to stop a huge bill.

<comment><USER71> You can use a lambda function that is triggered by a cloudwatch alarm when your bill approaches an arbitrary limit.

What you do in response to such an event is entirely up to you

</comment></comment></comment></comment><comment><USER72> Why is this "serverless"? It's just rented server capacity on a shared host, right?

<comment><USER19> Serverless is an operational construct that refers to the amount of management you have over the underlying servers.

</comment></comment><comment><USER73> For static websites nothing beats the CLI experience of surge.sh - <USER2> (simple) command and its deployed. Its so smooth that I forget its there.

The way the API has been designed to make the usage natural/guessable has inspired me a lot when I have made other CLI projects.

</comment><comment><USER74> I prefer Google Cloud Run and it need not be 100% static though it should be stateless.

</comment><comment><USER75> Deploying static sites is the original and best candidate for engineers overengineering

</comment><comment><USER76> Anyone knows how I could measure website performance all over the world averaged across multiple runs both for webpage and downloading huge file (100Mo) ? To verify that the CDN is indeed faster than my current hosting solution

</comment><comment><USER77> Why isn't this the 3rd option: Set the S3 bucket private and give CloudFront access to it. I've been using it for a while and it seems to be working.

</comment><comment><USER78> this was literally what I was doing today and if I'd just checked hacker news it would have saved 3 hours of faffing with Lambda

</comment><comment><USER79> Static sites are overrated for most cases. Often you still need a backend for editing with non-technical folks or just easier handling of media, etc so you're now running a server-side instance of some blog or CMS while adding a whole new detached frontend layer.

With things like Cloud Run that can run a container on-demand for every request, it's easier to just stick with regular Wordpress or Ghost server-side stacks.

<comment><USER80> > Cloud Run that can run a container on-demand for every request

People will bounce back. It will take far too long to load. The point of a static site on a CDN is speed. If your goal is to get outside visitors, then you definitely do not want to do this.

I can understand Cloud Run for demoing small apps though.

<comment><USER79> Cloud Run just pauses the CPU, the container is still fully loaded and resumes very quickly. You can also cache the pages with a CDN.

</comment></comment></comment><comment><USER30> Still can't do the same without paying hourly for a load balancer on Google Cloud. C'moon Google!

</comment><comment><USER81> actually you should use Netlify or Firebase Hosting. Both have a CDN behind them.

Frameworks like Nextjs Static Site export and Gatsbyjs have a lot of tooling support for firebase hosting and netlify.

</comment><comment><USER74> Use google Cloud Run though I love Netifly.

</comment><comment><USER82> Amplify really eases the pain with this.

</comment><comment><USER83> Great article!</comment>


Palantir blocked China's CDH Investments from buying stock, says a lawsuit - <AUTHOR> https://www.bloomberg.com/news/articles/2017-03-18/at-peter-thiel-s-palantir-allegations-of-theft-and-deception <comment><USER2> There is something very much not right about a shareholder of a company like Palantir trying to sell their stake to a Chinese shareholder. That would give the Chinese fractional ownership of all the software and data that Palantir holds and processes, not much good could come of that.

<comment><USER3> I don't think we have the details to paint one side worse than the other.

Also don't see why a Chinese company can't buy shares in a company. Financial products, just like other products, are purchasable by any nationality.

If Palantir is doing something that risks national security then they ought to work with the government on that. I don't think we know enough about Palantir to make a judgement there.

<comment><USER2> > I don't think we have the details to paint one side worse than the other.

Are you kidding?

By any measure that is available China is a country that is inferior to a vast chunk of the world when it comes to civil liberties and political freedom.

Palantir or a substantial portion of it in the hands of the Chinese (and, by extension in the hands of the Chinese authorities, direct or indirect) is something that you simply should not want.

<comment><USER3> > By any measure that is available China is a country that is inferior to a > vast chunk of the world when it comes to civil liberties and political > freedom.

Seriously? What does that have to do with investing in the stock market?

Palantir isn't the Manhattan Project. Plus, the US is on friendly terms with China. Most of our computer hardware is made there. I don't see how Chinese investing in Palantir somehow hurts our national security. No need to spread FUD or build walls in the stock market.

Your comments seem to be in line with Thiel and Trump, who fear other countries, so I can see where you're coming from, I just think it's 1950's style thinking and not reflective of 2017 reality.

<comment><USER2> > Palantir isn't the Manhattan Project.

It isn't Coca Cola either.

</comment></comment></comment></comment></comment><comment><USER4> tldr: Investor lawsuit with private company Palantir. Title is misleading. Not very interesting article.

<comment><USER5> Agreed. The article also shoves Peter Thiel's name into the title for unknown reasons.

<comment><USER2> It's 'Thiel', and he's the chairman, so it's not like we don't know why that name is there.

<comment><USER5> He isn't a particularly central figure in the story. It's there, I suppose, to leverage animosity.

<comment><USER2> No more than mentioning any other CEO in an article about their business would. What is it about Peter Thiel that you feel would raise animosity?

It's just a statement of fact.

<comment><USER5> He's not the CEO.

>What is it about Peter Thiel that you feel would raise animosity?

The article makes sure to highlight that for anyone that might have missed it :) _" It's well-positioned to cash in on more government work thanks to Thiel's relationship with President Donald Trump."_

Edit: Mentioned, sure. In the article title when he's not central to the story? Click bait.

<comment><USER2> No, he's the chairman. Like John Thompson for MS and so on. Regardless, Thiel and Palantir are joined at the hip, so expect the one to be mentioned alongside the other without attributing it immediately to malicious intent.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> It's almost like the company is allergic to receiving external market validation of its claimed valuation. They're happy to hold internal company "liquidation events" where employees can sell to employees, and take on massive yearly fund raising events to hush hush funds, but they never seem to want to let on in any public way what they're actually worth on the real market.

</comment><comment><USER7> At the point a single venture is worth billions, they should be required to disclose their core financials, stockholders, holders, risks, etc.

<comment><USER8> This is problematic. Who gets to say it's worth billions? Private appraisals are notoriously inaccurate and can be easily biased.

Who should they disclose this information to? Shareholders can negotiate this right when they make their investment, just as founders can. Why should someone who isn't an owner have access to private information about someone elses business?

Lets say you and a friend develop an innovative new startup (let's call it "Instawham"). Some friends join you and very quickly you become successful enough to have a bunch of customers and strong VC funding, but you are still a small company with a few dozen employees. You are a forward thinking CEO so you share information about the business with all of your employees, but caution them it's all proprietary and that sharing with competitors could hurt the business, so you are confident they won't share.

A big company, say Facebook, offers to buy you for a few billion dollars. But besides not wanting to work for Zuckerberg, you think they are just trying to get access to your financials and business plans to compete with you and will pull the offer as soon as you disclose. So you say no.

Now TechCrunch approaches you, and reminds you that by the newly passed "saycheese law" any multibillion dollar valued startup must release it's financials, shareholder lists, risk assessments, etc. They demand all of that information so they can publish it and sue you when you decline. Your lawyer tells you because of "saycheese law" you will lose, so you turn it over and Facebook launches their competitor soon after the TechCrunch article.

</comment></comment><comment><USER9> I'm confused. Seems like they have been trying to sell shares directly to parties in order to use their preferred agreements in regards to financial disclosures and annual reports? Yet if they're looking into an IPO they would be obliged to do that exact thing right?

</comment><comment><USER10> If you resist going public for over a decade despite doing billions in revenue you are going to have investors who are upset about their inability to cash out.

</comment><comment><USER11> In terms of Palantir's activities and impact on society: Palantir is selling out to authoritarians. Not a company we should be very proud of.

[http://www.ibtimes.com/trump-adviser-peter-thiels- palantir-t...](http://www.ibtimes.com/trump-adviser-peter-thiels-palantir- technologies-aid-ice-immigration-raids-using-2501431)

Trump Adviser Peter Thiel's Palantir Technologies To Aid ICE In Immigration Raids Using Surveillance And Data Analysis

<comment><USER12> Alternate Title:

Trump Adviser Peter Thiel's Palantir Technologies To Aid ICE in enforcing Country's Immigration Statutes Using Data Analysis & Available Metadata

<comment><USER13> So... Should Google be reporting the addresses of people who search for drugs? Should Facebook be informing the TSA about people's religion? Do you really want corporations spying on you for the government even more than they currently do?

<comment><USER14> > Should Google be reporting the addresses of people who search for drugs? > Should Facebook be informing the TSA about people's religion?

This is a false equivalence, as searching for drugs is not actually illegal, nor is believing in a certain faith.

A better analogy would be "Should Google be reporting the addresses of people who are distributing child pornography? Should Facebook be informing the TSA of people who are planning to bomb a plane?" In both cases, the answers is yes, and they are almost legally obligated to if they have clear evidence of wrong-doing.

<comment><USER8> Yea the reality is should Google report the addresses of people googling for "sexy teens"? Should Facebook inform the TSA of people who watch plane explosion videos? Whatif their profiles indicate they are Muslims?

Very very rarely does someone type into their browser that they want to rape a child, or share on Facebook their plans to bomb a plane. Instead the authorities make inferences, inferences that often lead to the harassment, even prosecution, of innocent people.

<comment><USER14> I guess you missed the main point, which is "false equivalence". The two examples you're using have absolutely no bearing on this case.

This is a technology licensing case. Would you be angry at Google for licensing its search technology to help run background checks on childcare providers? Would you care if Facebook licensed its social graph technology to see if you should be eligible for a drivers' license based on your medical history?

<comment><USER8> I don't think you understand "false equivalence". You responded to someone concerned about corporations turning people into the government because of things in their private web histories.

Your response was they should, if those people were clearly committing crimes.

My response was, it's very rarely clear whether some is committing a crime or not from their web history, and that companies can be easily coerced into sharing information that is just indicative of a possible crime, which can lead to innocent people being harassed or charged.

Specifically thousands of crimes a day (if not more) are committed by Facebook users, and some of those users leave traces of those crimes on Facebook. Facebook is heavily incented to help turn in those criminals to show they are good corporate citizens, and to head off extensive regulation and even civil penalties that could be created by grand standing lawmakers. Facebook has little to no incentive to protect my rights.

Now my kid posts "I love weed" on their FB profile, and it's caught the massive dragnet of data being turned over to authorities every day from Facebook. Police get a warrant, bust down my door, and arrest my child if they find weed in their room. If my kid had a couple ounces of pot and the cops think I'm a jerk, they may seize my home.

[http://www.cnn.com/2014/09/03/us/philadelphia-drug-bust- hous...](http://www.cnn.com/2014/09/03/us/philadelphia-drug-bust-house- seizure/)

If they don't find weed but find painkillers in my wife's purse not accompanied by her legal prescription for them, they will arrest her to justify the raid.

Or a dozen other bad things could happen, like they could shoot my barking 60 lb dog (who has never bitten anyone in her life), or worse.

So no, I don't want web service providers who have access to my personal information sharing that information with law enforcement. The police can do real police work to catch real criminals, most of their time they seem to abuse the constitution to arrest people for victimless crimes, I don't think they need more tools for that.

<comment><USER14> > So no, I don't want web service providers

Thanks for proving the example false equivalence. Palantir is not a service provider to you, it is a data analysis company.

If Google or Facebook performed data mining on data it owned, that'd be one thing. Palantir is providing tools that analyze publicly available information.

> Or a dozen other bad things could happen

Yes, that's life. At any point any bad things can happen that's out of your control.

If somebody in your family posted "I love weed" on a public billboard, you might expect increased police attention.

Extrapolating a dead dog and painkiller arrests (both vanishingly rare events) are hysterical statements not based in fact.

<comment><USER8> No knock warrants are not "vanishing rare events" and having nervous cops point weapons at you is not pleasant. And people get arrested for prescription drug abuse all the time, and plocue have the "discretion" to arrest you if you are carrying certain drugs without your prescriptions on you (don't worry if you work in the DAs office, warning only).

So you might not be concerned about getting trapped in the maw of our now enormous law enforcement machine, but plenty of people are given virtually every adult in the US has committed a felony at one point or another because of one crazy law or another. Not only do I not want Google or Facebook using automated algorithms to pit me in the maw, I don't want them sharing that data with Palantir so it can do it either. That gives for Chase Bank, Verizon, etc.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> The naivety that only western countries with stable histories can afford

Or maybe just a throwaway created by a part interested in the transaction

<comment><USER16> Accusations of shilling without evidence aren't allowed here, because they take the threads into hell. Please don't do that.

Another commenter holding different views from you, or even posting a bad comment and being wrong, is not evidence of astroturfing or shillage.

[https://hn.algolia.com/?query=by:dang%20shill&sort=byDate&pr...](https://hn.algolia.com/?query=by:dang%20shill&sort=byDate&prefix=true&page=0&dateRange=all&type=comment)

We detached this subthread from [https://news.ycombinator.com/item?id=13901243](https://news.ycombinator.com/item?id=13901243) and marked it off-topic.

<comment><USER15> I agree with what you're saying, however the fact that those were throwaway accounts and the pattern of their answers (not only to me) weigh heavily towards some kind of coordinated commenting.

I see there are official ways of reporting suspected shilling, at a time where astroturfing is having an important impact on the real world it's important that the administration keep these in check in this space.

<comment><USER16> You can always construct this kind of argument, and they almost always turn out to be wrong when investigated, but in the meantime have toxic side effects. That's why we have to be strict about this.

Most of us are orders of magnitude too quick to interpret our own cognitive bias as abuse by others (e.g. X seems obvious to me so anyone arguing ~X must be a shill). This places the threshold for useless, nasty arguments ('you're a shill. no, you're the shill') dangerously low. Combine that with the evil catnip power of meta and you get a strain of offtopicness that's especially malignant.

<comment><USER15> Thanks for the explanation.</comment></comment></comment></comment></comment>


Show HN: Yova – Groupon for small businesses - <AUTHOR> http://www.yova.io
YOVA offers a unique B2B platform where buyers can take advantage of volume-based discounts for their everyday purchase needs. <comment><USER2> Honest feedback: I don't like videos, I prefer textual explanation!

<comment><USER3> We've built the first collective procurement application for businesses making it possible for a group of businesses to combine their purchase orders in order to unlock volume based discounts. The concept was created to support high volume low margin products and services where buying together makes sense. So think paper cups and utensils for a restaurant business or sugar packets for a coffee business. The beautiful part is that your purchase requests is aggregated with other businesses without you having to expose any competitive information to your peers. The entire platform is designed around what we call transactional group buying. Essentially, a group deal/promotion is created not based on location or region of the buyers but instead the actual product itself. Once a deal is unlocked through a predefined discount tier set by the seller, the entire procurement process is handled at an individual business level. In other words, we procure our requests together to unlock a discount but we actually order the products individually! So shipping, handling, tax, etc. is handled separately for each business giving you your own personal order but for a cheaper price!

Check us out! Any feedback is greatly appreciated!

<comment><USER4> It sounds a lot like groupon as described. The main issue with groupon is it didn't offer much value to the supplier - in this case the knife and plate maker - what have you done to help with that issue? Is it simply because the nature of these kind of purchases means they happen more often? Wouldn't a small business just choose whichever is cheapest each time, meaning the supplier doesn't get a loyal buyer but just loses money in a fight to the bottom price?

<comment><USER5> That's a valid point. Unlike Groupon, we focus on helping suppliers reach a broader group of businesses who are looking to unlock volume discounts but can't individually meet the minimum purchase requirements set by the supplier. Through bulk selling, they can offer the advantage of basic economies of scale to a set of new customers that are on our platform. As you mentioned, Groupon hasn't really brought much of new sales to suppliers through bulk discounting at the B2C level. We instead target B2B reducing purchase costs for small businesses by combining their discount requests at the product level and making the data available to suppliers who can use the information to run customized tiered based promotions.</comment></comment></comment></comment>


Ask HN: How to differentiate a work email id from a personal email id? - <AUTHOR> <comment><USER2> It's a hard problem, since (1) there are lots of personal email hosting providers all over the world that you've probably never heard of, (2) there are lots of companies all over the world that you've never heard of, and (3) anyone can register their own domain and look like a company.

Also, some people, such as business owners or academics, may use their work email for both work and non-work communications. And lots of small businesses that don't have IT support will just create a Gmail account for business use.

Why would you need to distinguish between them?

<comment><AUTHOR> So I am building a product where there is this concept of teams and a team is a group of people from the same organization. Now when a new user signs up with his work email I want to show this team, that he can request to join.

If you see "Organization Members" section of [https://asana.com/guide/help/organizations/basics#gl- people](https://asana.com/guide/help/organizations/basics#gl-people) they automatically join you to an existing team from your organization (if there is one)

<comment><USER2> What if people want to form a team based on an organization that doesn't have its own e-mail domain, such as an open source project or a community volunteer group?

<comment><AUTHOR> This feature will not restrict team creation. It is meant for team discovery if you are signing up using work email

</comment></comment></comment></comment><comment><USER3> In Brazil, evertyhing which is not @gmail or @ hotmail is considered work email, until further notice

</comment><comment><USER4> I can't imagine there's any way to do this. Anyone can register a new domain at any time, that could be almost anything. I think you'll have to rethink your way around this problem.</comment>


Terrorism in the U.S. Since 9/11 - <AUTHOR> http://www.schneier.com/blog/archives/2011/08/terrorism_in_th.html <comment><USER2> This is a terrible analysis. The author looks at attempted terrorism numbers and concludes that terrorism isn't something that happens all that much. No consideration is given to any determent effect from law enforcement or the possible effectiveness of our anti-terrorism activities. It's entirely possible that the $1tn we've spent has reduced the quantity and effectiveness of terrorist activities. I'm open to data analysis proving or refuting this possibility, but the author doesn't even mention it.

Also,

 _"...that's sixteen deaths in the U.S. to terrorism in the past ten years. Given the credible estimate that we've spent $1 trillion on anti-terrorism security (this does not include our many foreign wars), that's $62.5 billion per life saved."_

What purpose does this number serve? That's 16 deaths, not 16 people who didn't die. The actual number would be $3,333 per American who is not dead.

I think this man is just upset about the cost of war and mad at Bush. This is a rant, not an analysis.

A contrary analysis could say that in the 10 years up to and including 9/11, we've lost thousands of lives from terrorist activities, and in the 10 years since, we've lost 16 (not including our military). Therefor, our policies have drastically reduced terrorism.

Either argument is ridiculous without thorough analysis and supporting data showing a direct relationship to terrorism levels.

<comment><USER3> Agreed, the calculation that

($ spent on anti-terrorism) / (# of people killed in terrorism) = ($/citizen saved from terrorism)

makes me think that this article was not very well thought-out.

</comment></comment><comment><USER4> Fewer than dog bites and lightning strikes! [http://thinkprogress.org/security/2011/08/25/304113/chart- on...](http://thinkprogress.org/security/2011/08/25/304113/chart- only-15-americans-died-from-terrorism-last-year-less-than-from-dog-bites-or- lightning-strikes/)

<comment><USER5> We must pour $1T into dog bite prevention immediately!</comment></comment>


China set to introduce low glyphosate residue limits in food imports - <AUTHOR> https://sustainablepulse.com/2018/12/11/china-set-to-shock-markets-with-low-glyphosate-residue-limits-in-food-imports/ <comment><USER2> Searched the Chinese term for glyphosate, absolutely no information on this limit on either Google News[0] or Baidu News[1].

[0] [https://www.google.com/search?q=%E8%8D%89%E7%94%98%E8%86%A6&...](https://www.google.com/search?q=%E8%8D%89%E7%94%98%E8%86%A6&client=ms- unknown&source=lnms&tbm=nws&sa=X&ved=0ahUKEwjp35_J- JzfAhXGEbwKHTGCB3MQ_AUIDigB&biw=1440&bih=709)

[1] [http://news.baidu.com/ns?word=%E8%8D%89%E7%94%98%E8%86%A6&tn...](http://news.baidu.com/ns?word=%E8%8D%89%E7%94%98%E8%86%A6&tn=news&from=news&cl=2&rn=20&ct=1)

Edit: another commenter _elliekelly_ has linked an old source for WTO filing from April 2018, which is for 107 pesticides, including glyphosate.

[https://docs.wto.org/dol2fe/Pages/FE_Search/FE_S_S009-DP.asp...](https://docs.wto.org/dol2fe/Pages/FE_Search/FE_S_S009-DP.aspx?language=E&CatalogueIdList=243831,243830,243827,243826,243217,241490,241497,241496,241019,240195&CurrentCatalogueIdIndex=4&FullTextHash=1&HasEnglishRecord=True&HasFrenchRecord=True&HasSpanishRecord=True)

[https://members.wto.org/crnattachments/2018/SPS/CHN/18_0894_...](https://members.wto.org/crnattachments/2018/SPS/CHN/18_0894_00_x.pdf)

<comment><USER3> [https://mediabiasfactcheck.com/sustainable- pulse/](https://mediabiasfactcheck.com/sustainable-pulse/)

The linked source is literally fabricated news and has no place on HN. The people upvoting this should stick to Alex Jones message boards.

<comment><USER2> Oh nice website. Is there list of verdicts on mainstream media by this website?

The homepage has a list but it seems to be missing some big names because the website is not featured in them.

</comment></comment></comment><comment><USER3> I can't find any reputable source on this. The linked site is terrible and on the same plane as "natural news" or "Infowars." Can we please try to do a little better?

<comment><USER4> I agree the site isn't the best but it's based in fact. I'm a regulatory attorney in the investment industry but moonlight as a legal journalist for a publication about environmental regulations. This isn't news to most of the industry. China filed notice of their intention to revise the limits with the WTO in April without specifying an effective date. This "article" just says China _might_ announce the effective date of the regulation soon and the effective date _might_ be before year-end. I would be surprised if the new limits go into effect in the next 2.5 weeks but given the politics of the U.S.-Chinese trade war I won't say it's impossible.

Here's the WTO filing but the attached schedule of MRL's isn't translated: [https://docs.wto.org/dol2fe/Pages/FE_Search/FE_S_S009-DP.asp...](https://docs.wto.org/dol2fe/Pages/FE_Search/FE_S_S009-DP.aspx?language=E&CatalogueIdList=243831,243830,243827,243826,243217,241490,241497,241496,241019,240195&CurrentCatalogueIdIndex=4&FullTextHash=1&HasEnglishRecord=True&HasFrenchRecord=True&HasSpanishRecord=True)

Edit - Here's the fully-translated filing from the USDA's site[1] though the MRLs are expressed as mg/kg. I _believe_ 2 mg/kg is approximately equivalent to 2000 parts per billion which is significantly higher than the 200 parts per million reported in OP's article.

[1][https://gain.fas.usda.gov/Recent%20GAIN%20Publications/China...](https://gain.fas.usda.gov/Recent%20GAIN%20Publications/China%20Notifies%20Draft%20Maximum%20Residue%20Limits%20for%20Pesticides%20in%20Food%20_Beijing_China%20-%20Peoples%20Republic%20of_3-20-2018.pdf)

<comment><USER2> NH is weird again with the downvotes. I see nothing wrong with your comment or linked source.

<comment><USER4> Some anecdata: my work computer is logged into HN with a username thats gender-neutral. I'm about 3 times more likely to be downvoted on this account. I've also noticed a lot more replies on this account tend to flat out tell me I'm wrong or don't know what I'm talking about (my favorite was the time someone told me it's against HN's rules to be dumb in the comments) while replies on my other account tend to be more constructive ("have you considered XYZ..."). I've been thinking about getting both sets of comment replies and running them through Watson's tone analyzer or something but I'm not sure any good would come of it.

And of course, it's entirely possible I'm just a complete moron when I'm on this computer.

<comment><USER3> You defended a NaturalNews / Infowars offspring site, but think you were downvoted because your username is female?

<comment><USER5> What? Because the original site is "bad" providing a better source is somehow not acceptable? _After_ you've complained you can't find a better source?

<comment><USER3> Uh no, saying a pseudoscience site is "based in fact" is not acceptable, champ.

<comment><USER4> What part of "China is introducing Glyphosate MRLs" is pseudoscience, specifically? And for that matter, what part _isn 't_ a fact?

<comment><USER3> The source is pseudoscience, not every single line that they write. Go look at their other articles. Go look at the crap they sell.

<comment><USER4> >The source is pseudoscience...

I _agreed_ with you that it's a shit source.

> ... not every single line that they write.

Exactly. I pointed out that _this_ particular headline was based in fact _and_ provided a reliable source for that fact _and_ pointed out where the "facts" stated by the article differed from the reliable source I provided.

I fail to understand the egregious offense I've allegedly committed.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> > China is set to introduce maximum residue limits (MRLs) of 200 parts per > billion (ppb) or lower for glyphosate in all imported final food products > and raw materials including grains, soybeans and other legumes before the > end of 2019, according to Sustainable Pulse sources.

For comparison, in the U.S. the EPA's current glyphosate limit for soybeans ranges from 20-200 parts per _million_.[1]

China's motivations are certainly trade related but what does it say about our regulatory structure when China will have more rigorous health and safety standards than the EPA by a large margin?

Glyphosate is the pesticide in Monsanto's Roundup that was at the center of the recent $289 million jury verdict in California.[2]

[1] [https://www.law.cornell.edu/cfr/text/40/180.364](https://www.law.cornell.edu/cfr/text/40/180.364)

[2] [https://www.reuters.com/article/us-monsanto-cancer- lawsuit/m...](https://www.reuters.com/article/us-monsanto-cancer- lawsuit/monsanto-ordered-to-pay-289-million-in-worlds-first-roundup-cancer- trial-idUSKBN1KV2HB)

</comment><comment><USER6> How to screw over America while being in the moral right and not actually putting up tariff barriers :-D

<comment><USER7> It's screwing themselves a bit as well. I guess it's just fine to export it. Just don't let it come back.

> China is a major glyphosate exporter in the world. Over 80% of China-made > glyphosate is exported to account for over 60% of the global supply. The > output of glyphosate in China increased from 316,000 tons in 2010 to about > 505,000 tons in 2017.

</comment></comment><comment><USER8> My impression is that glyphosate is safe, but that the inactive ingredients, which are loosely regulated, are carcinogenic in some formulations of the herbicide. Of course, Monsanto won't admit this and open themselves up to lawsuits.

If there's a lesson to be learned here, it's that the United States needs stronger protections against the use of potentially dangerous inactive ingredients</comment>


Apple released a new ad for Mac Pro - <AUTHOR> http://mashable.com/2013/08/23/mac-pro-trailer/

<comment><USER2> I saw Elysium on Monday and this was shown before the film. That's why they are calling it a trailer.

</comment><comment><USER3> [http://tubelor.neocities.org/](http://tubelor.neocities.org/)

<comment><USER4> I get it, it's hilarious because some trash cans are cylindrical too. Well done! That's far funnier than noting that it's cylindrical for practical reasons.

</comment></comment><comment><USER5> I don't know about how affective the ad will be for sales, but, from a purely aesthetic point of view, I love how abstract most of the imagery is. Almost every shot is made up of only a few lines or gradients. Someone had a lot of fun with those renderings.

</comment><comment><USER6> Isn't this the same one that was shown at WWDC when the Mac Pro was introduced?

<comment><AUTHOR> No, as i remember it was another one

<comment><USER6> I just watched the two side-by-side ([http://www.theverge.com/2013/6/10/4412350/apple-new-mac- pro-...](http://www.theverge.com/2013/6/10/4412350/apple-new-mac-pro- wwdc-2013)) They're exactly the same aside from a 3 second full-product shot at the end of the WWDC one that's omitted from the new Cinema one.</comment></comment></comment>