Show HN: I open-sourced my web app alternative to Illustrator - <AUTHOR> http://mondrian.io/contributing <comment><USER2> Great work Artur. I think this has potential, with enough contributors, to be a widely used tool. It's unfortunate that some people are getting really hung up on a specific interpretation of the submission title (that it currently has feature-parity with Illustrator), instead of talking about the seriously impressive amount of work you've put into this thing, or actual constructive criticism. Don't let it get to you, and keep up the great work :)

<comment><USER3> Agreed wholeheartedly, and this is as someone who's literally spent thousands of hours using Illustrator. I played with it for a few minutes and found the interaction to be very natural, and I only found a couple of bugs. I would suggest that if you avoid a lot of the print-specific aspects of Illustrator like color separations, supporting spot colors, screening options and a lot of their more gimmicky features, this could actually end up replacing it for a lot of people.

* one bug is here: [http://mondrian.io/?p=5xf0YH](http://mondrian.io/?p=5xf0YH) Somehow I created a piece of geometry that's a line segment that can't be filled or stroked. Hover around near the end of that arrow and you'll find it. It was created using the line tool.

edit: never mind, it turns out I just didn't completely grasp the selection model. If I click on the line segment, the endpoints get selected and I can move it, but the fill/stroke panels don't appear. However, if I drag-select it so I get the line's bounding box, they do. The selection model is a bit quirky, although I suppose you're probably trying to simplify Illustrator's weird assortment of selection modes. Good luck with that. :)

<comment><AUTHOR> The selection model used to work the way you expected - clicking on a line segment would select the whole shape.

I changed it to select only the two points that made up that line segment because I thought it made more sense, and there's usually plenty of hit-area on the inside of the shape for selecting the whole thing. In this case, I see how it was confusing.

I suppose I could revert back to the old selection model, or add an edge case where clicking on a line segment selects the whole shape if it consists of only two points. The current system would make more sense if there were more things you could do with selected points besides just moving them around with the arrow keys.

Either way, thanks for reporting this. If you catch any more problems, please log them in [https://github.com/artursapek/mondrian/issues](https://github.com/artursapek/mondrian/issues). :)

</comment></comment></comment><comment><USER4> Wow. Love it. Love the visual history. It feels quite snappy. The UI aesthetics are great. You've got most the pen tool features I used in Illustrator, and managed to do it without having multiple kinds of arrows to keep track of, which always bugged me.

<comment><AUTHOR> Thank you! Those are all things I focused on so it's a pleasure to hear that.

</comment></comment><comment><USER5> Played around a bit for a few minutes and threw a few of my usually handwritten SVGs at it with disastrous results. View boxes don't seem to work, dashed lines, symbols, any kind of shape reüse in general; groups are ungrouped automatically, but apparently properties defined on groups are not propagated to child elements when ungrouping. And it manages to lock up Firefox and IE completely.

Not terribly impressed so far, but then again, I'm not a designer or an artist and I manage to write SVGs that fail in various renderers due to implementation deficiencies. But those I tested were not even complex or used advanced features.

At the moment I'd guess this is aimed at the most trivial vector graphics possible, i.e. only basic shapes, stroke and fill. It might work for that, but that's well beyond what I use of SVG or Inkscape usually.

<comment><AUTHOR> You're right, it still chokes on a lot of SVG features. It is in no way spec- complete. All I can say is hopefully people contribute and it works better for everyone. The version I'm sharing is what I've been able to muster by myself in a year between school and work.

That said, if you opened issues on Github describing how to lock it up in Firefox and IE, and listing those SVG features that it doesn't render, that would be very helpful. Cheers.

<comment><USER5> Apologies, if that came across too negative. It's just a bit frustrating when you see »Oh, nice, it's based on SVG and compares itself to Illustrator and Inkscape« and try various things you have written in the past years only to notice that none of them work.

</comment></comment></comment><comment><USER6> I think that it's terrific but does a disservice to Illustrator. It's terrific because you've built it - and what's there, works, wonderfully - but does a disservice to Illustrator because the devil is in the million details that Illustrator has already implemented. But I know you want help to make and iron out those details, so really well done!

</comment><comment><USER7> Awesome! I'm really awful at drawing on my computer. Many failed attempts at trying to learn Illustrator, Gimp, etc. What's really cool about a web app of a drawing app is that you _could_ use all the open source product tour JS libraries to create interactive tutorials... So impressive, thank you!

<comment><USER8> If you failed at using Illustrator or Gimp effectively, then you didn't try hard enough. Follow video tutorials and try to recreate graphics, in time you'll get better.

Ugh, this entire thing is in coffeescript too, now I have to learn coffeescript to make sense of this library.

<comment><USER9> You might be shocked (shocked!) at how clean and readable some of the CoffeeScript source is. To pick an example at random:

[https://github.com/artursapek/mondrian/blob/master/src/geome...](https://github.com/artursapek/mondrian/blob/master/src/geometry/line- segment.coffee)

Artur really did a nice job with structuring this project...

<comment><USER8> Vanilla JS is easier for me. I don't have time to learn the workings of coffeescript just to read a library casually.

<comment><USER10> 'The golden rule of CoffeeScript is: "It's just JavaScript". The code compiles one-to-one into the equivalent JS, and there is no interpretation at runtime'

There really is very little magic with coffeescript. Most of it is syntactic sugar which can be learned at a glance of: [http://coffeescript.org/](http://coffeescript.org/) .

Don't mean to come off as pushy but I think it's well worth learning what coffeescript is. Especially if you are familiar with javascript, as it's a straight upgrade in your toolkit.

<comment><USER11> As an additional testimony, I've actually been learning coffeescript without really knowing JavasScript, and it has actually gone fairly well. For the most part it's intuitive, and if you're willing to be a little frustrated figuring out some of the syntax changes it can be rewarding.

</comment></comment></comment></comment></comment></comment><comment><USER12> This is terrific. Been fiddling around with the pen tool. So far, not much worse than Illustrator!

A few feature requests: having the shift-c tool (convert anchor point, I think) and being able to delete anchor points would be great. Much harder to work without that. Saving also didn't work the first several times I tried (but great to see auto-saving to ¿localStorage?)

</comment><comment><USER13> Congratulations! I know how difficult this kind of stuff can be - I tried something similar a few years back and ended up dropping the project before it got too far; although I learned a lot about object oriented programming. Great work!

</comment><comment><USER14> Very nice. Have you considered contacting the SVGEdit ([https://code.google.com/p/svg-edit/](https://code.google.com/p/svg-edit/)) team to see if there are some synergies?

</comment><comment><USER15> Is there a specific reason why you choose to implement most (all?) of the functionality yourself without building it on top of any existing libraries?

<comment><AUTHOR> For fun

</comment></comment><comment><USER16> Not much to say other than: Wow. Great Job.

</comment><comment><USER17> Can it be used to resurrect Aldus/Macromedia/Adobe FreeHand? I still can't use anything but it and I keep a windows VM on my Mac almost only for it.

</comment><comment> Michael-XCIX This is amazing. I could have really used something simple like this in the past, and really appreciate the ability to use it in the future. Seriously, thank you!

</comment><comment><USER18> Artur, the linked page is almost unreadable here (Chrome OSX):

[http://cl.ly/image/0F212f3X2h07](http://cl.ly/image/0F212f3X2h07)

The Maven Pro font appears to be infinitely thin at weight 300, it only starts being readable at 120px+. It doesn't have a version for that weight, so the browser is [failing at] simulating that.

<comment><USER19> Looks fine for me both in Canary and Stable on Snow Leopard.

</comment></comment><comment><USER20> As someone who struggles in general with javascript this is phenomenal and makes me feel like a programming goof. Good job.

</comment><comment><USER21> Nice simple editor web based editor, though I'd still use the fuller featured SVGEdit in most cases.

One thing that would really stand out would be an 'infinite zoom' I've seen implemented elsewhere.

</comment><comment><USER22> There is already a database product called Pentaho Mondrian. You may want to think about chosing another name, there are still 1-2 alternative famous artists left :-)

<comment><USER23> I recommend "Rietveld".

</comment></comment><comment><USER24> This is really beautiful. A few questions:

\- how do I add and delete points on a path?

\- how do I change the node type? Eg, if there are no handles, how do I get handles (antlers I think you call them in the code).

\- How do I go from colinear handles to "broken" handles: handles that form an angle at the node, so I can have two different curves joined at an acute angle at one node?

\- How do I do intersections, unions, groups, layers, etc?

But I gotta say it again, it's really beautiful...

</comment><comment><USER25> The is also [http://vectorpaint.yaks.co.nz](http://vectorpaint.yaks.co.nz) an online vector editor

</comment><comment><USER26> This is awesome! I'm going to encourage my students to use this in my web design class to draw basic mockups.

<comment><USER27> they could also try [http://schoolnotez.com/](http://schoolnotez.com/) :) it is also downloadable: [http://schoolnotez.com/schoolnotez.zip](http://schoolnotez.com/schoolnotez.zip)

</comment></comment><comment><USER28> Great job. One request: Make the CMD shortcuts work for the CTRL key too. They don't seem to fire.

</comment><comment><USER29> Nice. I have been thinking about building a web app similar to sketch ([http://www.bohemiancoding.com/sketch/](http://www.bohemiancoding.com/sketch/)). This is pretty good.

</comment><comment><USER30> Great job! Hope you find success with it and thank you for open sourcing it.

</comment><comment><USER31> Pixlr is very popular among young crowd. This one pales in comparison in the same category (free). I don't know about open-sourced though.

<comment><USER32> Pixl is definitely cool. I don't think it's a really fair comparison for one thing Pixl is more like Photoshop rather than Illustrator. Pixl is a Flash app which probably makes a difference to some people as well.

Both are really cool online tools though.

</comment></comment><comment><USER33> Fantastic effort, I'll play around with it as much as I can. I am not exactly a coffee script expert, but I might poke around internals.

</comment><comment><USER34> I love how this app is lay as a component base system, really great work. I think i will learn many thing through reading the source code.

</comment><comment><USER35> Cool, but I need separate object and direct selection arrows like Illustrator. And rulers and draggable guides and a square grid.

</comment><comment><USER36> Really really impressive, you roxx PS: [http://tutorsbox.com](http://tutorsbox.com) creator

<comment><USER27> are you actually making money off that? check my profile for a link to an open source project of mine that has similar functionality with a lot more content management features.

<comment><USER36> A little

<comment><USER37> Cool. Looks like every class room needs it.

Do users draw or write using figure or e-pen?

</comment></comment></comment></comment><comment><USER38> Since when did an alternative to something stop needing to do _at least_ as much as that something?

</comment><comment><USER39> Thank you for doing this. This may seem like an ignorant question but can your app open .ai files?

<comment><AUTHOR> Not yet.

AI, like PSD, is proprietary and unfriendly to developers because Adobe's software is really complex (and they don't want to share the market). I want to write a small backend that uses one of several AI->SVG converters out there so people can use AI files in Mondrian. Unfortunately I haven't had time yet.

</comment></comment><comment><USER40> This is awesome, thanks for this!

</comment><comment><USER41> Beautiful code. Love it.

</comment><comment><USER42> This is pretty awesome!

</comment><comment><USER43> It's unusable on IE but looks interesting none the less.

</comment><comment><USER27> don't know if you are interested in edtech but check out appynotebook.com ... it is an open source LMS with a vector graphics drawing layer and a lot more.

</comment><comment><USER44> You really did put a lot of work into this, great job.

</comment><comment><USER45> Artur this is pretty super dope wedep. Good job homey.

</comment><comment><USER46> you could check out [http://paperjs.org/](http://paperjs.org/) too, was originally a plugin for ai

</comment><comment><USER37> Nice try. What type of OSFS license are you using?

</comment><comment><USER47> Very cool, thanks.

</comment><comment><USER48> Cool. It seems very responsive, which is great.

</comment><comment><USER49> Didn't work at all for the MediaCrush logo.

[https://mediacru.sh/static/mediacrush_logo.svg](https://mediacru.sh/static/mediacrush_logo.svg)

<comment><USER50> Is this negativity really necessary? If you're going to leave a comment about something not working at least say what went wrong and what could fix the issues you had.

I'm sick of comments like this constantly polluting HN's community with negativity.

<comment><USER51> Don't bother. Parent commenter is your stereotypical programmer. Just take a look at: [https://github.com/Imdsm/AutoGfy/issues/5](https://github.com/Imdsm/AutoGfy/issues/5)

Some people just lack tact.

<comment><USER52> Wow, saying that he "lacks tact" is a bit of an understatement.

</comment></comment></comment></comment><comment><USER53> Condition of source code got my upvote.

</comment><comment><USER53> So did you just make this for fun?

</comment><comment><USER54> Congrats ! This looks great :D

</comment><comment><USER55> This is so sweet, Artur!

</comment><comment><USER56> Really nice.

I like it works with Dropbox

</comment><comment><USER57> Great job!

</comment><comment><USER58> yeah ... just like Illustrator .. hardly any noticeable difference in in features ...

</comment><comment><USER59> This is not an alternative to Illustrator.

It's a very very basic vector editor that doesn't even let you rotate things, import any standard vector formats (SVG, EPS, AI, PDF), have dotted outlines, distort, curve the text, etc etc etc.

I understand it was a lot of work, and you did a great job, but let's not pretend this implements even 1% of Illustrator.

<comment><USER60> Rotation is possible. Activate the (rotate indicating) tool and move the resize/move/rotate handles.

<comment><USER59> Ah, sorry. It works in such a non-obvious way, I missed it.

<comment><USER3> The rotation tool works exactly the way Illustrator's does.

<comment><USER59> In, it doesn't.

<comment><USER3> 1) Select an object

2) Select the rotate tool (whose icon is the universal symbol for "rotate" that can't possibly be confused with anything else)

3) Click once to define an origin

4) Click and drag to interactively rotate about that origin.

This is how the Illustrator rotate tool has worked since, literally, Illustrator 1.0.

<comment><USER59> In Illustrator you don't have to do step 1 or 3.</comment></comment></comment></comment></comment></comment></comment>


Daryl Bem and the Replication Crisis - <AUTHOR> https://redux.slate.com/cover-stories/2017/05/daryl-bem-proved-esp-is-real-showed-science-is-broken.html <comment><USER2> Please also see and consider: [https://en.wikipedia.org/wiki/Lawrence_LeShan](https://en.wikipedia.org/wiki/Lawrence_LeShan)

A particularly excellent work by Dr LeShan is: The Medium, the Mystic, and the Physicist: Toward a General Theory of the Paranormal (1974) - The appendix is excellent, if the unabridged version.

</comment><comment><USER3> Not "science" but "a science", psychology, which is notoriously problematic with regards to reproducibility.

</comment><comment><USER4> Perhaps ESP is actually proof that we live in a simulation/hologram. Seeing the future, is somehow tapping into the simulation and being able to on a subconscious level guess at what comes next.

<comment><USER5> branch prediction, you mean.

</comment></comment><comment><USER6> Why was this flagged?

<comment><USER7> Users flagged it. Hard to say why, but it might be because they don't think HN is able to sustain a high-quality discussion about this topic.

<comment><USER8> Users in this case were probably wrong; this is a straightforward article about the replication crisis, not a story about ESP.

Unfortunately, the title is so bad that the thread is swamped with people who'd rather discuss ESP.

A better title, synthesized from the last graf of the introduction, might be "Daryl Bem, ESP, and the Replication Crisis".

<comment><USER7> I agree completely but IMO the topic is still too triggery for HN to discuss it without losing it, and a title change may not be enough. We can send the submitter a repost invite, though, with a different title, and see if starting from scratch would help.

<comment><USER6> Would it be a good idea for people to have to state a short rationale for flagging? Just clicking a flag button is too cheap . . . I've even done it accidentally a number of times.

<comment><USER9> It's a toggle, so you can unflag submissions.

</comment></comment></comment></comment></comment></comment><comment><USER10> The Slate Star Codex has a good article on the same topic.

[http://slatestarcodex.com/2014/04/28/the-control-group-is- ou...](http://slatestarcodex.com/2014/04/28/the-control-group-is-out-of- control/)

</comment><comment><USER11> Has anyone called James Randi yet?

<comment><USER2> Before invoking that guy, have a glance at this first: [http://www.human.cornell.edu/hd/upload/CIWS- module_ESP.pdf](http://www.human.cornell.edu/hd/upload/CIWS-module_ESP.pdf)

The above is something I quickly found - one of many examples. It doesn't have any hallmarks of quackery that stand out to me. I've always wished Mr Randi would graduate to confronting more formidable scientists in the field, rather than picking on spoon benders[1] and other lunatics. He is a powerful thinker and has some great work behind him, but he's missed some important opportunities to challenge himself.

1\. Uri Geller

</comment></comment><comment><USER12> The title is clickbait. Bem didn't prove ESP is real. He (unknowingly) manipulated his data.

<comment><USER8> The article doesn't believe he did either: in fact, the whole premise of the story is the reality of ESP is a nonsense result. This is probably a case where the editors rewrote the title; it's mostly a story about how lack of rigor is sabotaging the social sciences.

<comment><USER12> If the article agreed with the title, I'd just say it's an uninformed article. In my opinion, the clickbait distinction requires the discrepancy.

<comment><USER8> The article itself is clearly _not_ clickbait --- it's long-form (more than 5000 words) _reported_ narrative journalism. It's an uncharacteristically deep piece for Slate.

<comment><USER12> That's why I said the title is clickbait.

Also, it's a misleading title. It has a false statement in it. The false statement is intended to get you to click something.

The quality of the article isn't relevant to my point. My point is just that people will click this link expecting a defense of ESP.

<comment><USER8> Oh, sorry! Yeah, we agree.

</comment></comment></comment></comment></comment></comment><comment><USER13> Stopped reading at the line: "A few students—all of them white guys, Wu remembers—would hang around to ask about the research and to probe for flaws in its design. Wu still didn't believe in ESP, but she found herself defending the experiments to these mansplaining guinea pigs."

Blatant sexism and rasicm against white males might be okay to idiot millennials but to me it's not okay. This is what a constant focus on "white injustice against minoritys everywhere!!" has done to our society. Casual sexism and racism is totally okay, as long as it's directed against the perpetrators of sexism and racism? Slate / Huffington Post / other outlets are full of this garbage.

<comment><USER6> I recommend this read, "White Fragility": [http://www.overcomingracism.org/resources/White- Fragility.pd...](http://www.overcomingracism.org/resources/White- Fragility.pdf)

<comment><USER14> I don't think it's fragility to fight against the slightest racist comments. I think it's the way every race should be. Nobody should have to 'endure' racist speech in the news articles they read, that's the goal any race should be striving to achieve. Just because it's not as bad as other hate speech doesn't mean it's not racist.

</comment></comment></comment><comment><USER15> Anyone care to give a tl;dr version?

<comment><USER16> It's about the replication crisis and it's well written so I'd consider reading the whole thing when/if you have the time. Here's a few of the most important parts.

 _Having served for a time as an associate editor of JPSP, Bem knew his methods would be up to snuff. With about 100 subjects in each experiment, his sample sizes were large. He'd used only the most conventional statistical analyses. He'd double- and triple-checked to make sure there were no glitches in the randomization of his stimuli.

Even with all that extra care, Bem would not have dared to send in such a controversial finding had he not been able to replicate the results in his lab, and replicate them again, and then replicate them five more times. His finished paper lists nine separate ministudies of ESP. Eight of those returned the same effect. _

...

 _But for most observers, at least the mainstream ones, the paper posed a very difficult dilemma. It was both methodologically sound and logically insane. Daryl Bem had seemed to prove that time can flow in two directions—that ESP is real. If you bought into those results, you'd be admitting that much of what you understood about the universe was wrong. If you rejected them, you'd be admitting something almost as momentous: that the standard methods of psychology cannot be trusted, and that much of what gets published in the field—and thus, much of what we think we understand about the mind—could be total bunk._

...

 _These dodgy methods were clearly rife in academic science. A 2011 survey of more than 2,000 university psychologists had found that more than half of those researchers admitted using them. But how badly could they really screw things up? By running 15,000 simulations, Simmons, Nelson, and Simonsohn showed that a researcher could almost double her false-positive rate (often treated as if it were 5 percent) with just a single, seemingly innocuous manipulation. And if a researcher combined several questionable (but common) research practices—fiddling with the sample size and choosing among dependent variables after the fact, for instance—the false-positive rate might soar to more than 60 percent._

...

 _That's more or less Bem's position. "The critics said that I put psychologists in an uncomfortable position and that they'd have to revise their views of the physical world or their views on research practice," he told me. "I think both are true. I still believe in psi, but I also think that methods in the field need to be cleaned up."_

<comment><USER17> _> If you rejected them, you'd be admitting something almost as momentous: that the standard methods of psychology cannot be trusted, and that much of what gets published in the field—and thus, much of what we think we understand about the mind—could be total bunk._

That's... not really difficult to admit.

<comment><USER16> It is if you've dedicated your life to academic psychology.

</comment></comment></comment></comment><comment><USER18> This is a great article. Why is it flagged?

<comment><USER19> Clickbaity headline, takes too long to take up speed ...

Also, why can't I vouch for it like with flagged comments?</comment></comment>


FCC commissioner: U.S. tradition of free expression slipping away - <AUTHOR> http://www.washingtonexaminer.com/fcc-commissioner-u.s.-tradition-of-free-expression-slipping-away/article/2583354 <comment><USER2> Our freedoms and rights seem to end were the people who get offended and have hurt feelings begin.

Have an opinion that is not in the majority and you might get censored?

Free expression and free speech means you can have your opinions even if the majority does not agree with you. Without it there can be no honest debates that lead to learning.

The majority is not always right. Like when the majority supported slavery or killing Native-Americans. Things have changed since then, but censoring the minority opinions is just censorchip and has no place in a free society.

<comment><USER3> This 1000 times. We are also doing our college students a disservice by creating 'safe spaces'.

This is just a continuation of the mentality that 'everyone should get a trophy' that started in the early 90s.

I still remember when I was in school (which is when all of this started) and we would be required to end kickball games early, so we could 'tie'.

If you can't handle being offended, you won't ever learn how to overcome it.</comment></comment>


Ask HN: Transferring large (over 100GB) files? - <AUTHOR> How do you transfer very large files? Things like raw video footage or datasets. Ideally something suitable for non-technical users. <comment><USER2> Whats your internet speed like? In most place in the world your best bet is going to be to buy some hard drives and ship them.</comment>


iOS 11 Horror Story: The Rise and Fall of iOS Security - <AUTHOR> https://blog.elcomsoft.com/2017/11/ios-11-horror-story-the-rise-and-fall-of-ios-security/ <comment><USER2> Prior to iOS 11, the OS would quite often ask for your Apple ID username/password by showing a popup regardless of whether you were in another app or Springboard. Since you don't know what the hell's prompted that request, it was noted that this opens a vector for phishing [1] and it conditions users to blindly put their password into anything that asks.

I wonder if this is an attempt to fix that gone wrong.

1: [https://9to5mac.com/2017/10/10/psa-apple-id-phishing- attempt...](https://9to5mac.com/2017/10/10/psa-apple-id-phishing-attempt/)

<comment><USER3> Not a great solution, but if iOS itself is asking for your password pressing the home button when the dialog is up will be a nop instead of returning you to the home screen.

<comment><USER4> Please clarify if "nop" is a typo, slang, etc.

<comment><USER5> Why can't people google things anymore?

<comment><USER6> What;s the National Organic Program got to do with it?

</comment></comment></comment></comment></comment><comment><USER7> So the TLDR; is that Apple allows a trusted device (your iPhone) and PIN/passcode to be the identification required to reset a lost iCloud password.

I honestly think this is a reasonable security model, as every other 'forgot password' workflow that I see services use is already vulnerable to my phone and passcode being in the wrong hands.

Think about the common options here. Apple could send out a rest link via email, but bad guy already has my email. They could send a verification code via SMS - oh wait, this is MY PHONE we're talking about. How about they send a push notification to... nevermind.

About 3 seconds worth of thought brings one to the conclusion that with my phone _and_ pin/passcode, a bad actor could reset the passwords for pretty much every service I use - it's not just iCloud.

So someone explain to me in non hand-wavy terms how you'd expect this to be any different/better?

<comment><USER8> > So someone explain to me in non hand-wavy terms how you'd expect this to be > any different/better?

From the article:

 _Any attempt to change or remove that password must pass through iOS, which would require to provide the old password first. Forgot the original password? There's no going back, you're stuck with what you have unless you are willing to factory reset the device and lose all data in the process._

Apparently, there was no password recovery. Now there is, and as a convenience it even skips the whole email step. This has implications for accessing the data present on the device, which is the whole point of the article.

<comment><USER7> I will clarify - I'm referring to the iCloud password reset, not the ability to create a new backup with a different password. You're rebutting my arguments about the former with quotes about the latter.

</comment></comment></comment><comment><USER9> This article can be summed up as "Apple relaxed the security model to that if you have physical access with password authentication, you have full access to everything else".

I don't entirely agree with this - if my iPhone PIN is compromised, I do not want my 2FA iCloud account to be compromised.

<comment><USER10> Agree, the old model was fine. I've been using iPhone because IMO it's a more secure device than the alternative. Surely they could make this an option?

<comment><USER11> > I've been using iPhone because IMO it's a more secure device than the > alternative.

There are some alternatives that are absolutely more secure. Now the trade off might not what you want, but the iPhone and iOS isn't the most secure smart phone available.

[https://www.silentcircle.com/products-and- solutions/devices/](https://www.silentcircle.com/products-and- solutions/devices/)

<comment><USER12> Yeah that phone is so NOT secure. Like horribly not secure. I blame google/android. See: [https://charlescarrollsociety.com/2016/01/22/silentcircle- bl...](https://charlescarrollsociety.com/2016/01/22/silentcircle- blackphone2-review-privacy-from-whom-part-1/)

Things have not gotten better. So no, there are not alternatives that are "absolutely more secure."

<comment><USER13> That link is about privacy, not security, and horribly misunderstands some fundamental basics. Like that you can disable google applications just fine. Sure you have to trust the OS to actually disable like it says it will, but you also have to trust that iOS does what Apple says it does, too. But you don't have to trust anything Google on that phone.

I think the phone is silly for other reasons, but that link is nonsense and largely unrelated to the discussion at hand.

</comment></comment></comment></comment></comment><comment><USER14> While this is less secure than before, I'm not sure if I agree with there premise that events such as San Bernardino perpetuated this change. This would not have helped the FBI decrypt that iPhone if it had been running iOS 11, since they were not able to effectively guess that phones 4 digit passcode, let alone a 6 digit or alphanumeric passcode.

Their entire claim of a horror story relies on having physical access and the passcode, which would be game over on basically any device anyway.

It does point out a problem with most sms and app based 2fa systems in that all accounts that are protected as such essentially rely on your devices passcode to keep those accounts safe.

<comment><USER15> I'm still on iOS 10. If you get my PIN code (say you're a friend, you find it somehow, repair shop - work at one and need the PIN, etc.) then you can't do a whole lot. You still need my password or thumbprint to buy apps or change passwords.

In iOS 11 it changes, now you can for example access all passwords in the keystore. So you know my 4 digit pin for my phone, not to mention my Google password, Apple iCloud password, etc. Those should not be accessible with just the access code.

<comment><USER16> iOS has had 6+ digit codes for a while. You shouldn't be using just 4.

The way I go is have a long 10-14 digit code, and Face ID/Touch ID saves me the trouble of having to key it in all the time.

<comment><USER17> I have always used an alphanumeric password instead of a PIN. Since Touch ID my password is really long and complicated. I can't remember it. I have a matrix of hex numbers in the phone case to be used as memento to help recreate the password in case of reboot. Actually two. So I can throw one away and escape RIPA key disclosure law. The back of the matrix explains you need two, and if one is missing then there is no way to retrieve the password.

</comment></comment></comment></comment><comment><USER18> iOS's 2FA model confuses the hell out of me. I'm sure if I sat down and worked it all out I could figure out what all Apple is using for 2FA on my iDevices, but I haven't been arsed to do that and it shouldn't be this complicated.

With iOS's 2FA system : I've had to click buttons on other devices. Enter codes on other devices. Enter codes from other devices. Click links in emails. Type my passcode on other devices. I just ... don't have a grasp on it at all.

That's not good.

With regards to the backup issues outlined in the article, it's hard to say if the backup leak is a major issue.

Take the casual user: They won't be making iTunes backups. Most casual users are probably just doing iCloud backups. In fact, they don't do backups at all; iCloud backups are automatic so they don't think about it (it just works).

Take the security hard user: They'll have a password instead of a passcode on the device. So adversaries probably won't get access anyway. Of course, it's possible they shoulder-skim your password, whereas they probably won't be able to ever shoulder-skim your backup password. So certainly Apple's change here _does_ objectively make the system weaker.

It's hard to say if what Apple did here was the right thing. Like I said, I don't think most casual users are doing iTunes backups, so why even bother making iTunes backups more user friendly?

Regardless, it could certainly be improved. Maybe require 2FA to reset backup password?

The issue where you can reset the iCloud password is certainly troubling. It's a hard issue to balance, as Apple doesn't want to set up a system where the average user gets locked out of their account because they forgot their password. But it really shouldn't be possible to take a single iDevice and password and take over a user's iCloud account.

<comment><USER19> Maybe it's just me but I've tried and failed several times to restore an iCloud backup. A backup isn't a real backup unless the restoration is tested. Unfortunately iCloud backups would just never finish restoring for my device, whereas restoring iTunes backups just works. So I usually set up a recurring calendar item to remind myself to backup to my computer (which then get backed up again using Time Machine and CCC). It's sad that I have to do this.

<comment><USER20> They're just very slow, and at least until iOS 10, apps that were in the "restoring" state displayed no indication of such. I was told by an Apple retail employee that in most cases WhatsApp was always the last app to finish restoring, which was exactly the app that was "stuck" for me.

I assume it is because the iPhone is decrypting the backup, but it's just that it is doing it very slowly for some reason.

</comment></comment></comment><comment><USER21> Haha, this is too funny. I have an iPhone 5s that I encrypted years ago with a password that I have unfortunately forgotten. Had to start from scratch with my iPhone 6s, because of this. I stopped updating the 5s, hoping that one day there will be an exploit that makes it possible to break in and pull the data. Who would have thought that instead I will be happily upgrading to iOS 11, because apple made it a feature.

I know this is bad, but for me it is awesome right now.

<comment><USER21> So I reset my forgotten password with this method and now cannot set a new password. Every time I get

> The password you entered to protect your iPhone backup could not be set. > Please try again.

What happens then is: the password i set is actually active, becuse to back up i have to enter that password - but as soon as i unplug the iPhone and plug it back in, I can/have to set e new password.

I updated iTunes to the newest version, restarted the iPhone, reset the iPhone settings multiple times, but I cannot encrypt the backup anymore. Weird.

edit: (the solutions to this problem that google offers did not solve the problem)

<comment><USER22> I would try contacting apple support. They are pretty helpful.

<comment><USER21> Seems to be a bug. You set a password, get told that it could not be set, but then just ignore that dialog because it turns out to be set.

</comment></comment></comment></comment><comment><USER23> I started skimming towards the end. It sounds like there's some genuine weakness introduced here. But I'm also getting the impression there's some of the "security people" mindset Linus was ranting about:

"Forgot the original password? There's no going back, you're stuck with what you have unless you are willing to factory reset the device and lose all data in the process. If you ask me, this was a perfect and carefully thought through solution."

I'm not sure how you can consider it a perfect solution that users are losing their backups and hammering Apple for support about the issue. The suggestion to make another backup via iCloud is not terribly useful to those who have lost their phone.

<comment><USER24> The end was the most significant part. They can take over your icloud account with the _phone_ password.

I don't care much about the phone backups on some secondary devices. I do care whether those devices can hijack my icloud account with just that phone's pin.

That seems terribly broken, to be able to change icloud without having the password or without 2FA.

<comment><USER25> I agree. The first part about the backup seems like a side show because once an attacker has logged into the device they already have access to everything that would be in a device backup (usually).

<comment><USER26> The attacker with physical access to the phone does not have direct access to the data, only to UI of applications that use that data, which is often something significantly different.

</comment></comment></comment></comment><comment><USER27> Site is down at the moment, archived version available at [http://archive.is/PtBr6](http://archive.is/PtBr6)

</comment><comment><USER28> PS: Actually I was wrong, I just checked and it seem very weird that you can change the password without a confirmation from another trusted device or trusted number. Meanwhile to mitigate a little the threat you can delete your mobile phone number from trusted number so someone hijacking the SIM card cannot receive a confirmation code if he put your sim card into another phone.

——————-

I don't really get their point it's like if someone told us « Linux have weakened their threat assessment level, if you got the password of a sudoer user you can access evrything on the system »

The only difference being that it extend to what you putted in the cloud. But loosing the passcode on iOS was always the equivalent of giving full admin right on the machine.

That's the whole point of TouchID/FaceID/SecureEnclave teach user to have a strong passcode while keeping a smooth UX because they don't have to type them regularly.

So yes this is a single point of failure which come with pros and cons.

\- The bad news is that if you give your passcode you can loose everything

\- The good news is that the only way to crack your device is to guess in ten attempts what is the passcode from 1000000 possibilities by default (maybe less cause you can't decently use some combination like 123456)

<comment><USER29> You can also use a full-blown keyboard password. That's what I do, since it's so rare that I actually have to type it in.

</comment></comment><comment><USER30> I've been bit by setting a secure iTunes backup password, and then forgetting it, and having to go through an iCloud backup followed by device wipe and restore just to get the old forgotten iTunes Backup Password off of the device. It was painful.

But in the end I was able to remove the password and keep the keychain data all in place and instill a new iTunes Backup Password which I knew.

So what's actually changed other than not having to go through the whole iCloud Backup/Wipe/Restore in order to reset the iTunes Backup Password?

Maybe I am misremembering and it didn't actually restore my keychain back onto the same device when I did the restore?

<comment><USER18> > So what's actually changed other than not having to go through the whole > iCloud Backup/Wipe/Restore in order to reset the iTunes Backup Password?

Prior to iOS 11, to get access to a backup of an iDevice (and that backup allows you to view all data on the device, keychain etc):

        1) iCloud Backup
        2) Wipe
        3) Restore [requires iCloud password]
        4) Perform iTunes Backup

Now under iOS 11 it's (according to the article):

        1) Reset Settings [requires pin code]
        2) Perform iTunes Backup

So the difference is that now you don't need the iCloud password.

<comment><USER31> If an attacker has access to the device and passcode, they already can view all the data on it including the keychain. Right? So the concern here is just that Apple has made it easier for attackers with access to a device and passcode to exfiltrate in bulk instead of piece by piece via the UI.

In exchange for letting people reset their encrypted backup password without losing data.

How is that a "horror story"?

<comment><USER18> No I don't believe you can view the keychain on an iPhone. Hence why the backup is necessary.

<comment><USER31> Oh you sure can.

Settings > Accounts & Passwords > App & Website Passwords

Settings > Safari > Autofill > Saved Credit Cards

<comment><USER18> I stand corrected.

To nitpick, there is more data in the keychain than passwords and credit cards. But I think having all your passwords and credit cards exposed is probably bad enough.

</comment></comment></comment></comment></comment></comment><comment><USER32> Here's the Archive.org link for anyone else having trouble getting to the site: [https://web.archive.org/web/20171130210154/https://blog.elco...](https://web.archive.org/web/20171130210154/https://blog.elcomsoft.com/2017/11/ios-11-horror- story-the-rise-and-fall-of-ios-security/)

</comment><comment><USER33> Who will complain louder?

The security experts or the people who lost everything because they lost their passcodes?

<comment><USER34> You mean the people who haven't synced to iCloud or a computer?

If you carry your fortune in your wallet is it okay to blame the wallet manufacturer for your financial crisis when you misplace it?

You are right though, those people are the loudest to complain. :)

</comment></comment><comment><USER35> If you look in the password and security menu in iCloud settings, there's an option to set a recovery key: "Using a recovery key increases the security of your account. When you create one, the only way to _reset your password_ [emphasis mine] is by using _another device_ [edit: emphasis mine] already signed in with your Apple ID or by entering your recovery key."

I can find no mention of this feature in the article. It would seem that it would mitigate the core problem described by preventing someone in possession of your phone and passcode (but not the recovery key) from taking over your iCloud account.

<comment><USER24> This is on ios 11? I just looked, and didn't see it.

Settings --> user thing at top --> password and security

Perhaps I'm in the wrong place.

<comment><USER35> I am on iOS 11. Here is an Apple knowledge base article about it: [https://support.apple.com/en-us/HT208072](https://support.apple.com/en- us/HT208072)

<comment><USER24> Thanks. Curious, I don't see it. I just have change password, two factor, phone number, get verification code

<comment><USER35> Also see the reply I just made to my comment. It's no bueno.

<comment><USER24> Yikes. This seems a serious weakness. I get why they would make it easier to do backups, but not why they would make it so easy to get icloud.

I guess the only consolation is that eventually the phone will logout, so the attack would have to be done soon after getting the phone?

Update: It's much worse than that. I just got a login notification on my ipad for my apple id. So I'm not signed in. But, I went to reset the password, and it said I can do it with a passcode since I'm signed in to icloud.

So icloud signin lasts far longer than apple ID signin for the app store.

This seems like a _serious_ vulnerability. Makes me rethink having multiple idevices, or putting _anything_ in icloud keychain. Any one of them gives access to everything.

I am not a security expert though, so take this with a grain of salt.

</comment></comment></comment></comment></comment></comment><comment><USER36> As a crude, but workable safety precaution, the Apple Configurator[1] can prevent your phone from pairing with other devices, so even if someone resets the backup password, they would still not be able to recover its content. Keep in mind, that once enabled, the only way to disable it is to wipe your phone.

[1] [https://itunes.apple.com/us/app/apple- configurator-2/id10371...](https://itunes.apple.com/us/app/apple- configurator-2/id1037126344?mt=12)

</comment><comment><USER37> Somewhat related: There's currently an article on the front page of an Indianapolis TV station's web site entitled "Technology advancements lead to crack in IMPD officer evidence tampering investigation" [0].

It doesn't mention what type of phone they're talking about in this case (or go into much technical detail at all, of course) but I'm very curious just what "advancements" enable law enforcement to bypass the encryption that is, by now, enabled by default on most phones, AFAIK.

I'd be even more interested if this was an iPhone, as that's what I have. This wouldn't have been iOS 11, however, as the original event (the setting of a passcode) occurred on 2015-11-02.

Regardless, these "advancements" discussed in this article sound more like "regressions" to me.

[0]: [http://fox59.com/2017/11/30/technology-advancements-lead- to-...](http://fox59.com/2017/11/30/technology-advancements-lead-to-crack-in- impd-officer-evidence-tampering-investigation/)

</comment><comment><USER38> While this is obviously less secure than iOS 10 - I can't help but think this is a minor issue. If you treated your iPhone as a standalone device (something that has been supported since iOS 5, I haven't touched iTunes in years), you are vulnerable to this exploit. In other words, if you never set your iTunes backup password, you were always vulnerable to everything in the article. I didn't even know about the iTunes backup password feature and I've always assumed passcode lost = full compromise.

I will admit though the data available to access in a backup is far deeper than I had expected, and definitely far deeper than you can get through iOS alone. I'm not a security nut, but I'm surprised I didn't know about this option (again, probably because I don't use iTunes).

<comment><USER39> You're referencing the first section of this post.

The other security relaxation allows you to change your Apple ID's password without knowing what the old one was. To me, that's a much larger problem.

<comment><USER40> "Forgot Password" flow, by definition, lets you reset the password without knowing the old password. That's how it works in every "Forgot Password" flow ever invented.

So my question is (having never gone through that flow with Apple ID), what was the "Forgot Password" flow in iOS 10? If the answer is it sends you an email, how does that work for people that use icloud.com mail (because, if they don't know their password, they can't get their mail)?

<comment><USER41> > what was the "Forgot Password" flow in iOS 10?

The same, apparently; I just tried it on this phone, which I haven't updated, and it didn't ask for anything but the passcode.

<comment><USER24> You reset your icloud password, or your phone password? The part that seems new is that you can reset your _icloud_ password with phone access.

<comment><USER41> I didn't reset either, but it gave me the same prompt described in the article as an iOS-11-exclusive flow.

Perhaps the behavior of a completed reset differs; I'm not about to mess with it just for kicks. But the fact that everything up to that point is identical makes me doubt that somewhat.

<comment><USER24> But which one did you try to reset: icloud password, or phone passcode?

<comment><USER41> iCloud.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> Interested in knowing idlewords response to this since their "Security Guidelines for Congressional Campaigns" recommendation is to use the most recent iPhone with the most recent updates:

[https://news.ycombinator.com/item?id=15777387](https://news.ycombinator.com/item?id=15777387)

</comment><comment><USER24> Is this accurate?

Anyone who has your passcode and access to your device can takeover your iCloud account by resetting the account, lock your other devices, and access any passwords you have stored in iCloud keychain

If so, this seems like a _massive_ security liabilty, and grounds for deleting all icloud keychain passwords.

</comment><comment><USER42> This story needs just as big an attention as the recent root blank password MacOS X disaster.

<comment><USER43> No it doesn't. Protected with a six digit passcode is still quite secure.

<comment><USER44> Do you know how many people use 4 digit passcodes, or no passcodes at all?

Do you know how many people share that passcode with others, intentionally or unintentionally? Family members, spouses, etc. repair people who do screen replacements. Their buddy, who can text for them while they drive.

I'm sitting on a plane and saw the person next to me enter her passcode. It's 258085.

That is not a secure 6 digit passcode, it's a vertical Tetris shape. Humans are great at pattern recognition, particularly when it's in a grid format and leaves finger smudges.

I could easily pick pocket this woman's phone and ruin her weekend without much effort at all, just from reading this article.

But you say her 6 digit passcode is quite secure?

<comment><USER43> I think deep inside you do understand the difference between immediate root access to a system without knowing anything at all and spying on somebody to learn their passcode. And even if I do agree it's definitely a change for the worst it doesn't deserve they same hysterical response the root no password required bug deservedly got.

<comment><USER44> the root password hack also required physical access, or some sort of proximity access on a network LAN, to be able to work. It's really not that much different than snooping on someone sitting a few seats away from you at the bar

</comment></comment></comment></comment></comment><comment><USER45> > _While there, look for their Google Account password. If it is there in the > keychain (and I don't see why not), you'll gain access to a whole lot of > highly interesting information_

This is exactly why my google account password is the only one I do _not_ keep saved anywhere. Not in keychain, not in 1password. It's a strong password, plus 2FA (not that 2FA matters if someone has my phone).

</comment><comment><USER46> I've never understood why health data is assumed to be something people want hidden and kept private.

If something happened to me, I'd like a stranger to be able to access it. It's not particularly embarrassing information for people to see - for some people, yes. But there should be a way to make your health data unencrypted for those that prefer it very accessible.

<comment><USER47> Your opinion amounts to "if you're doing nothing wrong, what is there to hide?".

Privacy by default should be the norm, not the other way around - lots to be inferred/exposed from even the smallest bit of info.

<comment><USER46> I made no mention of defaults. "there should be a way to make your health data unencrypted for those that prefer it very accessible."

I don't see the relationship to mass spying.

</comment></comment></comment><comment><USER48> If you want security: don't put your life into a device that you carry with you. Better still: don't put it in _any_ device.

<comment><USER44> This argument pops up all the time, and has for years.

I recall seeing it when Eric Schmidt at Google said something like "don't have anything worth hiding, and then you won't care if you are hacked". Excuse my brevity, but you argument and his are dumb arguments. These devices are incredibly powerful, and allow us to interact with one another in ways pen, paper, snail mail, and landlines never could (let alone the security risks those mediums have, which cannot be mitigated).

Devices _can_ be incredibly secure. Manufacturers and service providers should prioritize that over mindless convenience.

I would agree with you, however, that you should not put your entire life into _any insecure_ device. And it seems the iPhone is not an _insecure_ device (I'm frustrated, and I have a 20+ character keyboard passphrase! Let alone 4-6 digit code)

<comment><USER48> The problem - in my opinion, probably going against wiser and smarter people - is that today's secure stuff is tomorrow's insecure stuff. So if you don't want to be locked into an eternal cycle of upgrades or worry about what level of security you should assign to the stuff you use everyday you are far better off by simply not taking the risk.

I understand that for many people this is problematic because they need these goodies for their day-to-day functioning. But so far I've managed to do without them and I don't feel particularly handicapped.

</comment></comment></comment><comment><USER49> And on the flip side, every time I add a new device to my Apple ID, iCloud flips out totally, detects "suspicious" activity, and locks my account (and requires me to both verify it with one or more devices and changing my password).

So: Inconvenience where there should be convenience, convenience where there should be inconvenience.

</comment><comment><USER50> What does this say?

 _Do not interconnect services_

Specifically, I:

1\. don't use iCloud backup.

2\. Backup to my own computer

3\. Have a backup program to a different provider than Apple

4\. Do not interconnect accounts with iPhone/Mac.

Only annoying thing is the iphone telling me that iCloud backup is full because I haven't upgraded.

</comment><comment><USER51> Everybody seems to forget you need 2FA, Ios 11, and the 4,6 digit pin or alpha password in order to access the icloud password reset. Don't use 2FA with the iphone.

<comment><USER24> Apple forces 2FA enrollment now. And someone who steals the phone and asks for the pin now has access to icloud reset.

<comment><USER51> Is that a fact? Many may disagree.

[https://ios.gadgethacks.com/how-to/enable-disable-two- factor...](https://ios.gadgethacks.com/how-to/enable-disable-two-factor- authentication-your-iphone-ios-11-0180350/)

<comment><USER24> Yeah, looks like I was wrong: [http://mashable.com/2017/06/06/apple-high- sierra-ios11-2fa-s...](http://mashable.com/2017/06/06/apple-high-sierra- ios11-2fa-security/#4xGMrt_hIqq8)

</comment></comment></comment></comment><comment><USER28> TL;DR; If it's truly a 2 factors security why the hell can you reset the iCloud password with a single factor since iOS 11 ?!

</comment><comment><USER52> You should be angry after you read this. The trust model is weakened and changed to our detriment.

</comment><comment><USER53> From deleloper point Apple have very low quality lifecycle and distribution process

</comment><comment><USER54> Suddenly my 12-digit passcode doesn't seem so paranoid.

</comment><comment><USER55> What is up with Apple lately? Could not believe they were not able to get the Homepod out for the holiday. The Mac root security issue getting the door is insane.

<comment><USER9> Homepod, plus all the missing iOS 11 features: iMessages in the cloud, Apple Pay Cash (just launched)...

</comment></comment><comment><USER56> Great title, can't get article to load.

<comment><USER57> I'm interested to know if you still think the title is great after you get the article to load. Of course it caught my attention, but after reading it I was left with a, "wait this is a horror story?" feeling. I suppose to many this seems like a huge vulnerability, but if we treat everything with these extreme sentiments, then nothing will _actually_ be treated with special attention. Conversely, if no articles are given these sorts of titles, maybe no one will click them.

</comment></comment><comment><USER58> This sounds tailor made for Law Enforcement.

</comment><comment><USER59> Between this and the Mac root login, looks like Apple has got 'an offer they can't refuse' from Uncle Sam, and are establishing plausible deniability by intentionally introducing security failures.

<comment><USER44> But they patched the Mac root login within 48 hours of it becoming "a story"? I don't buy the conspiracy.

More likely, Apple wants to ease user adoption.

Did you buy an iPhone X? It was awesome to setup. There was this nifty feature to use NFC/the cameras on my new phone to authenticate myself, and it was a breeze. Huge fan of this type of improvement and convenience.

You know what I'm not a fan of? My iPhone being a gateway to hijack the rest of my digital life. It's a key to my little kingdom that didn't exist before, and my only protection is (figuratively speaking) locking my phone to me like the Nuclear Football, and continuing to use a 20+ character passphrase with enough entropy I can't be brute forced.

<comment><USER59> I meant that they are 'introducing' security fails so that once there'll be indications they're giving data to Uncle Sam they can claim they were hax'd.

But I'm not really serious with this 'conspiracy theory', it's just some food for thought/shitpostin'.</comment></comment></comment>


Intel's next-gen iPhone mockup - <AUTHOR> http://anandtech.com/cpuchipsets/intel/showdoc.aspx?i=3103&p=2

<comment><USER2> I've always wanted someone to create a touch screen device that was the size of a pad of paper. I don't even care how much storage it has, although you can fit more into the form factor then something the size of a phone.

So if it had a touch screen the size of a pad of paper, had an iPhone(ish) interface, had some decent productivity apps, could play music and most importantly surf the web, I'd pay $1,000 to $1,500 for it.

<comment><AUTHOR> I have a Lenovo X41 tablet that cost me $1000. It's an inch smaller on each side than an 8.5"x11" piece of paper. It has some very decent productivity apps, some of the best, even. It plays music very well and definitely surfs the web. Unfortunately, it runs Windows and GNU's Tomboy doesn't come close to Microsoft's Onenote.

</comment></comment><comment><USER3> The proportions seem wrong.

<comment><AUTHOR> 2.25:1 aspect ratio maybe?

it would be fine if you had an 640 pixel width or higher, though I personally would rather have a physically smaller phone with high DPI.

</comment></comment><comment><USER4> Its huge!</comment>


Ask HN: WebAssembly  JavaScript Overhead? - <AUTHOR> Is there some good data about the overhead in JS<->WebGL communication?
Specifically, I'm interested in using JS to handle the view (whether WebGL or DOM) and as like a broker between worker threads, as well as general gluey things and simple app logic - and WebAssembly for some heavy lifting and number crunching.
Not sure _exactly_ where the balance of all that would land - but I am curious about the overhead of passing messages between the JS and WebAssembly layers, so that I can consider things a bit more carefully.
To pre-empt some answers - I do get that it might make more sense to split that balance more heavily one way or the other, but at this point I'm just wondering about hard data on what the communication costs.
Thanks! <comment><USER2> I recently experimented with this [0] - there is some overhead but it's acceptable. I noticed that the more arguments you pass over into a Wasm function, the slower things get (see _.set_ test).

Note: I'm either bad at doing correct benchmarks or the Javascript compiler is pretty sneaky at optimizing things.

[0] - [https://maierfelix.github.io/glmw/mat4/](https://maierfelix.github.io/glmw/mat4/)</comment>


Laughing at Others' Code - <AUTHOR> http://bjk5.com/post/14265572563/laughing-at-others-code

<comment><USER2> There is only one thing that makes "bad code" acceptable, and that is _accountability_. The article hints at it, the author clearly recognizes it, but it should be emphasized more.

Bad code without accountability, without a reason why the quality has been compromised, and no one to take responsibility for both the choice and the consequences of that choice, is a just crap that doesn't deserve respect.

Most bad code doesn't have the excuse that it works (it usually doesn't, at least not for long), or that shipping it was an overriding priority. Most bad code is just plain laziness or incompetence. Very few of us fall under the heading of Spolsky's mythical duct tape programmers. Most of us merely competent developers can only do one of two things: write decent code that works well, or bad code that doesn't. And the fact that we are actually able to do the former already puts us in the top 20% of people that get paid to code.

As long the majority of programmers either produce bad code or spend most of their time trying to clean up that crap (or rather, just keep it running), I don't see why people feel the need to keep writing apologies for the very few cases in which "bad" code was the best possible option.

</comment><comment><USER3> A single main.py file might actually be more maintainable than a dozen files that try to hide many levels of abstraction. Certainly things need to be separated into files, but just enough to keep the project simple.

And when you're in the business of "getting shit done", most of the time delivering the feature is much more important than writing "clean code".</comment>


Show HN: Brandseen - A logo coloring game built in 24h - <AUTHOR> http://brandseenapp.com/ <comment><USER2> I really love this idea, but I have a big problem with colour selectors. I'm not sure if it's unique to me or a common problem, but I can _visualise_ the right colour (and could pick it out of a line up) but when playing with a colour selector all colours blur into one and it becomes very difficult for me to differentiate colours effectively.

I could look at 100 different Coca Cola logos and point out which has the right red, but trying to colour it myself is an impossible task. Even now I played the Coca Cola logo 3 times, even after seeing _exactly_ the right colour I can't get it right on the selector (my score every time was between 73 and 77).

Anyway, actual feedback: For some reason some of the logos don't load, although checking the console I see the following errors so I assume it's server issues:

Failed to load resource: the server responded with a status of 500 (INTERNAL SERVER ERROR) [http://brandseenapp.com/success?score=0&game=Basic&l...](http://brandseenapp.com/success?score=0&game=Basic&level=yahoo) Uncaught TypeError: Property 'width' of object #<HTMLImageElement> is not a function

<comment><USER3> I also saw quite a few errors, such as the logo I was supposed to be coloring being very out of place from the center of the page, or off to the side. Also, my "average" score seems to have been calculated in a very odd way. It looks like this: <http://puu.sh/LniU>

<comment><AUTHOR> I just did the math, your average was 77.11 (total/9) which rounds to 77% :)

Aware of the centering issue, looking into it thanks!

<comment><USER3> Ah, I thought the 3.14 was a joke score. NVM then.

<comment><AUTHOR> Haha if you get a 0 it's either 0 or 3.14 you get.

<comment><USER4> * I picked a color for IBM that was almost perfect (it barely darkened just a bit when I submitted), but it gave me a 3.14. * Dropbox's logo is colored pretty differently depending on where it's displayed (I colored mine lighter, like the system tray icon, rather than darker like the logo on their homepage). * For Apple, I tried just submitting without making any changes because it looked pretty close to correct already. I was given a 0%, even though it only barely changed.

</comment></comment></comment></comment></comment></comment><comment><USER5> I'm willing to bet I'm not the only one here who had no idea Yahoo's logo is now purple. How the mighty have fallen.

<comment><USER6> Indeed. I was familiar with the purple but I went straight red and got 3.14/100. Turns out, the color was changed in June 2008: <http://www.thewwwblog.com/yahoo-logo-changes.html>

</comment></comment><comment><USER7> This is a cool idea but I don't think it works quite right, matching RGB color is a perceptual thing, there's no absolute "starbucks green" that you could display on a monitor. Even a calibrated monitor in controlled lighting conditions is still calibrated to something (like a film stock or a certain printer profile).

I think a better way to present this would be to show a photograph which incorporated the logo (e.g. a Coca-Cola billboard in a city on a sunny day) with the grey logo, and then have the user color-correct the logo until it matched the perceptual reference of the context that it was in. The "coca cola red" in RGB values would not be pure red but I think the user would probably have a better chance of making it "look correct" in the photo (thus matching the color values in the original photograph) than trying to match it without any context. Would make a neat experiment, too.

<comment><AUTHOR> Great thought! Context truly is important, the idea we were going for was that you might be used to seeing a certain logo/color on your monitor so you would just try to guess that color hue again. Also we tried to make the algorithm somewhat lenient to take into account the different calibrated monitors.

Also keep in mind this was just built in 24 hours at a hackathon, tons of things we can and will do better! Thanks again!

</comment></comment><comment><USER8> Fun! I left Apple where it was in the middle because it looked about right to me (silver) and got a 0. Other than that, I was between 75-98 every time.

<comment><AUTHOR> Yeah the gradients are an interesting one because by default it's just the alpha channel so "Black" is technically the 100 pointer but the algorithm needs to be more lenient along the gray scale. Sorry about that, will correct.

<comment><USER9> Yeah, even when I got the right "colour" if my colour was too dark, or too light, it really punished me. Like downwards of 30/100 for the wrong shade. :(

<comment><AUTHOR> Yeah we'll be making that more lenient since it's really just the "brightness" part of HSB

</comment></comment></comment></comment><comment><USER10> Seems like moving the brightness slider up and down should also change the color wheel. As it is, you have to pick a full intensity color then adjust it to a lighter one that may not be very similar at all.

</comment><comment><USER11> I did this all by memory. First and only try.

Here are my results (and my very brief feedback follows):

coca-cola: 96 batman: 100 Yahoo!: 85 Dropbox: 83 McDonald's: 82 Starbucks: 85 IBM: 94 Shell: 89 Apple: 100

Avg Score: 90%

The only one I seemed to really have a problem with is Shell. The red seemed way too vibrant/bright. The Apple one I think can throw people off because of Apple's love with a glossy, "transparent" look. My intuition told me it was a lot lighter, but then on second thought, I decided to go way darker, thinking of the logo as separate from what Apple puts on their actual products.

I'm using a cheap CRT monitor, by the way.

<comment><USER12> coca-cola: 86 batman: 96 Yahoo!: 99 Dropbox: 76 McDonald's: 92 Starbucks: 80 IBM: 3 Shell: 67 Apple: 24

I found the Apple one the hardest.

<comment><USER13> I found it the easiest. I got 100 on that after about 2.5 seconds. Dropbox 96 - everything else 50-80.

</comment></comment></comment><comment><USER14> Tried it with Chrome on Windows. About half of the logos were not visible at all.

<comment><USER15> Since an upvote alone won't help OP gauge how many people experienced your problem, I'm saying "me too" here.

Loved the game though. Quick, easy, worth a few minutes playing around.

<comment><AUTHOR> thanks a bunch! definitely aware :)

</comment></comment></comment><comment><USER16> Minor quibble, but having lived in Atlanta for a decade I feel like I need to mention that the Coca-Cola logo is more typically white text with red background. (for example, at the world of coca-cola: [http://upload.wikimedia.org/wikipedia/en/9/9c/Wc_spectacular...](http://upload.wikimedia.org/wikipedia/en/9/9c/Wc_spectacular.jpg))

<comment><AUTHOR> Good point, most brands have multiple versions of their logos so we used the one off their Wikipedia page <http://en.wikipedia.org/wiki/Coca-Cola>

</comment></comment><comment><USER17> Cool project! But I must say, the algorithm that computes the percentage score seems rather poor, at least if the goal is to score the percent _visual_ difference between the selected color and the actual. It gave me 100% on Coca- Cola (and I replicated the 100% with a slightly different shade in a different browser tab), yet I got only 3.14% for leaving Apple the default color, which looks almost the same as the correct color. Some of my other answers were similarly penalized heavily for brightness being a little off even if the hue was almost exact. The visual difference between those colors and the correct colors was far less than the visual difference between some of my higher scoring answers and the correct color.

<comment><AUTHOR> Thanks for the feedback. Definitely aware of the algorithm problem and how it penalizes for brightness difference more than hue difference which doesn't make that much sense for the end user. This has been a great day of testing and tweaking and we will be trying to make it better, thanks so much!

</comment></comment><comment><USER18> Pretty neat, I did surprisingly well. Would be nice if you could see just how far you were off besides the color changing after you hit the button. A different circle on the color wheel, for example, showing where you picked and where the color actually is.

<comment><AUTHOR> Great idea! Definite feature coming next

</comment></comment><comment><USER19> I like this game. Here are some suggestions. I would prefer to only have to select the hue (the angle in the circle). That is, the game would prepare the correct saturation (distance from the center) and brightness (the vertical bar) for me. My score would be the difference in degrees between my answer and the correct answer. It would make the game more enjoyable to a wide audience. It would also make the score easier to understand than a percentage (the percentage means nothing to me). Finally, I would like to have the name of the company written in text under the logo for cases where I want to know who it belongs to.

<comment><AUTHOR> Great suggestions! \- Making the game only one parameter sounds great for an "Easy" mode but the scoring algorithm would also make a lot more sense, true that. \- Name of company makes sense, will put it in soon!

</comment></comment><comment><USER20> Was pretty fun. I was totally wrong on Coke, though. And I somehow got a 3.14 for Apple? :P Would be cool if the answers were given at the end as well, perhaps side by side with your guesses?

<comment><AUTHOR> Haha small easter egg. The correct image should fade on top of your guess after clicking "Compare". Would side by side comparison be nicer? The main concern was screen real estate.

<comment><USER21> Either a side-by side comparison, or at least show on the color selector where the right color was.

<comment><AUTHOR> thats a pretty good idea, thanks!

</comment></comment></comment></comment><comment><USER22> I'm color deficient --- failed the tests at school where you pick out the letters/numbers from the bubbles --- and I got a 100% on apple and a 0% on Batman...:(

<comment><USER23> Same here. Colour games can be frustrating for us differently-coloured people. :P I can imagine how this is really fun for someone who can see colour properly. Maybe as a challenge the author could include colour blind mode?

</comment></comment><comment><USER24> Super fun, thanks for building this! Had an issue where my Dropbox logo was only showing up at 50% opacity or so, so my final color was off by a lot more than I was expecting. My Shell logo was also just slightly darker red and I got a 58. There was a weird transition of the color I chose and the actual logo, so not sure if that had anything to do with it.

</comment><comment><USER25> Pretty fun. It'd be neat to be able to see your choice next to the correct version so you can visually see how "far" you were off.

</comment><comment><USER26> 1) I had the same problem that citricsquid mentions below. I would say provide the user with a select option from like 5-7 colors. 2) Add game mechanics to show a leaderboard to see where you stand 3) This idea could be pretty attractive to brands -- helps in brand engagement and brand building without the negative connotation of advertising

</comment><comment><USER27> My only complaint is about the mermaid one. I didn't recognize it at all.

Maybe cause starbucks is that that popular in Europe?

<comment><USER9> You mean Shell? It's a gas and oil company.

<comment><USER28> It's a _European_ gas and oil company

edit: just went through this again and the "mermaid" logo referred to is the Starbucks one. I never really thought about it being a mermaid before

<comment><USER9> Me neither... I figured Shell would be the closest thing to a "mermaid" related logo, but I guess I was wrong.

Also, Shell is multi-national, even if it's based in Europe. There's tons of Shell gas stations around Canada.

</comment></comment></comment></comment><comment><USER29> It'd be interesting if the statistics on this are being kept. You could answer questions like which brands don't have strong color identities, whether people tend to err on the side of lightness/darkness with certain logos, etc. You never know what unexpected things you might discover.

<comment><AUTHOR> It is ;)

</comment></comment><comment><USER30> Bit scary how well I actually did for brands that I don't know that well (in my case, Starbucks and Batman). Surprisingly internet companies like Yahoo and Dropbox got me worst scores, although I don't use either which may explain that as they don't do as much advertising.

</comment><comment><USER31> Great and surprisingly addictive game!

I don't have much of a memory for color names, so was surprised at how well the human brain can remember colors even without a vocabulary to describe them. It really goes to show you that a good logo really does help sear the brand into your mind.

</comment><comment><AUTHOR> Thanks everyone for all the support, comments, and letting me know about some bugs! One of the biggest challenges I had was finding an algorithm to determine the "difference" between two hex codes. Anyone have any tips on that?

<comment><USER32> Hey I've done similar games! check <http://color.method.ac>. You need to convert hex to CIELab, and then apply a color difference formula <http://en.wikipedia.org/wiki/Color_difference>

Don't let the complex versions put you down, the simplest formula is good enough, just Math.sqrt( Math.pow(L1-L2, 2) + Math.pow(a1-a2, 2) + Math.pow(b1-b2, 2) ).

<comment><USER33> Awesome, thanks for the advice. We were looking into alternatives for algorithms that better reflected human color interpretation, and that looks very helpful. And yeah, your games are awesome, we basically modeled this as "the Kerning Game/Color Game, but for brands."

</comment></comment></comment><comment><USER34> Very cool, although I have some issues (latest Chrome on Win7) : <http://i.imgur.com/KYWjk.png> It doesn't do this on every logo though...

PS: nice cats. And is Pi here on purpose ?

<comment><AUTHOR> Thanks for the screencap, it's a small bug that should resolve itself once you click on the colorpicker. Will look more into.

Everyone loves cats! And 3.14 is just an easter egg haha

<comment><USER35> I saw the same issue in Safari 5.1.7 on OS X 10.7.4. Nudging the colorpicker fixed it for me.

PS: I vote for keeping the cats :D

</comment></comment></comment><comment><USER36> Really addictive game. It can easily be extended to include cartoon characters or comic book superheroes! One suggestion, please add a nice 404 page so users don't see the raw message.

<comment><AUTHOR> Oops, sorry! leftover from the hackathon

</comment></comment><comment><USER37> I like this, hope to see more examples. I was surprised to find I was quite wrong on brands I thought I knew well (e.g. Yahoo). Fun little game.

<comment><AUTHOR> Haha one level we really wanted to build was Google, 4 colors! Actually the hardest challenge would be remembering the order of the colors lol

</comment></comment><comment><USER38> Lots of fun! Occasionally, whatever color I guess, it gives me a 0. Happened twice, on Dropbox and on Apple. I tried the game 3 times.

<comment><USER39> Dropbox and Apple are the hardest because of gradients, so try guessing the average color. Thanks for the feedback!

</comment></comment><comment><USER40> A very fun game, indeed. Like "drharris" said, it would be neat to see more examples! It's a really awesome game, regardless, though!

<comment><AUTHOR> Yeah those were the best 9 we could make during the hackathon! Would love to make "startup" levels and "sport" levels or something lol

<comment><USER40> Some good ones I thought of are: Spotify, Adobe products, Office/PC products, more restaurants/fast food places, sports teams, etc.

</comment></comment></comment><comment><USER41> Very cool idea and well implemented! While I'm sure people will criticize the matching logic and such, it was definitely fun.

</comment><comment><USER42> Very nicely made!

I seem to misremember a lot of logos as having red in them, when they don't. Anyone else have this problem?

</comment><comment><USER43> I thought the coca cola logo was white lettering on a red field. Batman logo coloring is dubious at best

</comment><comment><USER44> Awesome game, get rid of the cats tho

</comment><comment><USER45> Lawsuit!

Cool stuff, mate, but seriously, you could get in trouble for that, especially if you're in America!

A lot of trademarks have rules and regulations about what can be done to them, that includes changing their color, using them without consent from the owner, etc...

I just thought I should warn you, I don't want fellow hackers to go to jail because of stupid laws.

</comment><comment><USER46> Great game, was amazingly close in a few, horribly far off on others. Thanks!

<comment><AUTHOR> Still tweaking with the scoring algorithm, it got really hard to test against myself cause I knew the colors so well lol but this is a good data set!

</comment></comment><comment><USER47> What's the accuracy needed to obtain 100%? Matching color codes or what?

<comment><USER48> I actually scored 100% on coca-cola on first try </brag>.

Admittedly that was probably more luck than skill, though.

</comment></comment><comment><USER49> Great little game! 81% on average, how sad.

</comment><comment><USER50> Nice! Got two 100s and an average of 78%

</comment><comment><USER51> It was developed at Greylock Hackfest.

</comment><comment><USER52> Great. 16%. Yes, I'm colorblind.

<comment><USER53> Me too. 40%

</comment></comment><comment><USER54> Interesting. I got 69%.

</comment><comment><USER55> This was cool!</comment>


Apps that Track Stolen Smartphones Are Pretty Worthless - <AUTHOR> http://thenerfherder.blogspot.com/2013/06/apps-that-track-stolen-smartphones-are.html

<comment><USER2> Bullshit. Being able to remotely nuke my data when my phone was lost (and found, but not returned) was an immense load off my mind. I don't care about the phone, I care about my data.</comment>


Ask HN: What do I do about Health Insurance after quitting my job? - <AUTHOR>

As the title states, I'm thinking of leaving my job to pursue my personal projects for 3 months, but my biggest uncertainty and apprehension is health insurance.
I'm pretty lost in this: there's a lot of literature but no clear answer, and I'm not sure what the new regulations are under obamacare...
What's a simple, affordable way to make sure I'm covered?
Thanks! <comment><USER2> Where are you located?

COBRA is the standard answer. The ACA provides for coverage, though the general enrollment period has closed for this year. I'm not sure if a job transition counts as a qualifying event for a new enrollment, but there are counsellors (free of charge) in some states who can answer your questions on that.

My experience is that there tend to be a few tiers of coverage, and that you'll want to balance your anticipated healthcare needs with the dues. From what I've seen, middle-tier coverage tends to be the best bet.

<comment><AUTHOR> I'm 24, male, living in the bay area. Any rough estimates on how much COBRA would cost?

<comment><USER3> My guess is you'll find plans in the 200-300/month range unless you have hereditary boneitis.

One thing to watch out for is that teeth and eyes are often covered seperately, for some unknown reason.

<comment><USER4> Pedantry:

That's because teeth and eyes have predictable and often high maintenance costs that general medicine doesn't. It's hard to cost-effectively insure teeth, for instance, because you're almost certain to incur routine and expensive costs. Expensive general medical interventions are much less predictable and frequent and so that risk pools nicely.

That's also why private dental insurance is often not a good deal.

<comment><USER3> This is one reason why I think the concept of private insurance, vs state- provided health care, is insane. It's not like teeth and eyes are fancy upgrades that some of us blinged out on.

Clearly the first step towards nationalized health care is me commenting on a message board. Avanti!

<comment><USER4> I agree that it's a stark illustration of the limits of the insurance model. Nationalizing the health care industry is itself fraught, though.

I remember a Gladwell New Yorker essay that related dental care to poverty and economic mobility, so I'll add right away that this isn't a small problem.

<comment><USER5> _Nationalizing the health care industry is itself fraught, though._

I wonder: How much would our national dental health improve if we merely offered universal coverage for the simple stuff: cleanings, photographs, and X-rays?

The standard of care for these things doesn't seem like it varies wildly: Everyone should get a cleaning and inspection from a dental hygienist every six or twelve months. Obviously, once we get into treatments the judgement calls begin, and then it does become fraught.

But speaking as someone who might have saved a small fortune on fillings, crowns, and root canals if he hadn't just _stopped going to the dentist regularly_ for several years – because, by the time your teeth start hurting, it is way too late for the inexpensive interventions – I wish we had national dental coverage for checkups, such that it was economical to station people in malls and on street corners _begging_ passersby to step inside a door and spend thirty minutes getting their "free" dental cleaning. Yes, the hygienists would probably try to up-sell you. But that's a relatively nice problem to have.

<comment><USER6> > The board has given me detailed instructions in how I should talk about Code > Club sponsors. For instance, if someone asks me about x's involvement in > corporate mass surveillance where x is a Code Club sponsor (eg Google), I > should answer: "I do not want to get into the specifics of any particular > corporation. Nonetheless, it's worth restating that the Code Club board > believe X are a tremendous partner. As a member of the board I am completely > aligned with that view."

>I'm not comfortable with lying and so it is in my best interest to resign.

I fail to see how she would be "lying" here, in any capacity.

She may know more but refrained from stating it? As the Director, you are supposed to make a statement like this and not harm your sponsors. For her to speak out against them would be counter productive to her organization's goals.

Seems to me she just has some moral issues with some companies in particular and therefore was not comfortable working in any capacity with them. So, it was an appropriate choice to resign imho.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> If you can afford it, COBRA. That saves you quite a bit of time and energy finding a new plan and minimizes or eliminates surprises like changes in coverage or needing to change doctors. For only a 3 month window, as long as you're relatively healthy (and are certain you will not get pregnant) I'd take the gamble and go without insurance, but I'm a gambler. From my experiences, the stress of not having coverage is pretty comparable to the stress of enrolling in a new ACA plan.

Depending on your work, you can also inquire about taking a leave of absence. I've worked with a couple of people that have done that. Most never returned but some did.

<comment><USER8> If you are going without health insurance check on your car insurance policy. Mine does not cover my own injuries because I have a good health insurance plan right now, but you might want to add $100k of driver/passenger coverage to your plan.

</comment></comment><comment><USER9> You first might want to start investigating COBRA. A good place to start is [http://www.dol.gov/ebsa/faqs/faq-consumer- cobra.html](http://www.dol.gov/ebsa/faqs/faq-consumer-cobra.html).

</comment><comment><USER10> The simplest option is to pay for the plan you currently are on through COBRA. This guarantees you 18 months of coverage at whatever rate your employer currently pays for you. This what my founders and I did for our last startup. It does require you have enough saved up to cover the cost yourself, but it's very simple and easy, and you keep everything the same.

You could also see if you qualify for a cheaper plan. Go to HealthCare.gov and enter your information and you'll get a list of plans and what they cost.

</comment><comment><USER11> I can help you as I sell health insurance...You may be eligible for a subsidy...I am a Licensed and bonded agent. I can answer many questions for you if you want to talk. You will not want Cobra as it will be more expensive then you need to pay. Remember Cobra is the full cost of your Insurance with no help from your employer. email@example.com

</comment><comment><USER12> Kaiser offers some reasonable plans for simple coverage. Depending on your age and health you could get it for less than 250 a month.

<comment><USER3> Same goes for Blue Cross/Blue Shield (though I like Kaiser a whole lot). All these places have websites with various plan options. If you devote an afternoon to nerding out about the technicalities, you'll find a decent plan.

The important thing is to have _some_ kind of catastrophic coverage.

If you don't go the Kaiser route, I would recommend One Medical as a nerd- friendly place to get health care in the Bay Area. You can do most stuff via website and they take a variety of insurers. ([https://www.onemedical.com/sf/](https://www.onemedical.com/sf/))

</comment></comment><comment><USER13> If you are located in California and do not have any income then contact your County Office. You may be eligible for Medicare California which provides coverage without charging any premium. (Not a professional advice).

</comment><comment><AUTHOR> thanks for the Comment guys. I'm concerned because I'm reasonably active and do get minor injuries sometimes at BJJ, which is my main outlet for exercise.

I'm 24, male, living in the bay area. Any rough estimates on how much COBRA would cost?

</comment><comment><USER14> If you're young and fit just forgo it. It's very unlikely a basement dwelling neck beard would get hurt writing javascript and refreshing the browser a million times.</comment>