Mac sandbox escape - <AUTHOR> https://lapcatsoftware.com/articles/sandbox-escape.html <comment><USER2> Just the ability to access the rest of the file system I think I wish was on a folder by folder basis.

My text editor for example, I personally wouldn't mind if once per project I had to give it permission to access a project's folder.

I also wish there was a way to edit a file without giving access to the folder. For example Photoshop, I can select from the finder "Open In Photoshop" which is enough intent to give the app permission to access that file without having to give it access to the other files in the same folder.

I get that would require API changes and that Apple doing that overnight would break apps but basically going forward I wish OS makers would work toward something like that.

Even on iPhone I hate that apps either get permission to read all photos or none. Yes I get you can send a photo to an app but many apps can not receive them for every use. I get the apps want to present their own UI for the photos. Maybe some kind of OS run sandboxed process where the app can provide a limited function to present thumbnails but can't actually read any data and all they get out of that process from the OS is the user selected files? Oh well, I can dream.

<comment><USER3> The problem is not the viewing, but editing. When you say "Open In Photoshop" does this mean you can make changes and then save the "file"? What if Photoshop doesn't just "save" a file, but writes several intermediate files onto the filesystem and does a bunch of file renames to create a "backup" of the original image. Those operations are no longer just operating on a single file any more. From the perspective of a security system implementor, how can you understand such intent from sequences of raw POSIX filesystem calls -- because that is all the sandbox enforcement code in the OS kernel gets to see and approve or deny.

For code that uses Apple's Cocoa frameworks, when you ask at a high level to work on a file (or a bundle) a "Powerbox" is used -- it runs out of process and hands back the App permission to make modifications to that file (or bundle) based on the way Cocoa manipulates objects. If the app doesn't use Cocoa, the best that can be done is delegate permission to a directory.

The iPhone allowed a different security model to be created as there was no direct access to "files" and "folders". There were and still are problematic APIs that are based on a give me full access or nothing model. It is quite a challenge to retrofit a security model onto something that ultimately doesn't break something major in an unexpected way.

<comment><USER4> > What if Photoshop doesn't just "save" a file, but writes several > intermediate files onto the filesystem and does a bunch of file renames to > create a "backup" of the original image.

Powerbox actually has support for this.

<comment><USER5> Surely it can store files in a working folder of its own, and keep a reference to the original file. The other files don't need to live side-by-side

<comment><USER6> There is official support for auxiliary files in macOS/sandbox. A prime example is the use of SQLite in WAL mode which requires write access to $dir/my_db.sqlite + a bunch of other files in the same directory (for transaction handling etc). But this problem was solved years ago already because Core Data (an apple framework) actually uses SQLite under the hood.

</comment></comment></comment></comment></comment><comment><USER7> Putting on the other hat for a minute, I'm curious what the author things a good resolution for this would be.

Perhaps that any time you use a text editor to create, edit, or save a shell script, that script should be treated as a freshly downloaded and untrusted script? Or that it should be impossible to control a text editor from another application, even when given explicit permission from the operator? Both of those sound awful. Is there a third option I'm missing here?

I'm with Apple on this one.

\-----

Also, who would think controlling a text editor is innocuous? A text editor's modus operandi is literally to create, read, update, or delete any file to which your user has access.

<comment><USER8> My takeaway is more that the entire security model that Apple is pushing for the Mac just doesn't really make sense. E.g., here's a quick list of apps that aren't sandboxed: Logic Pro, Final Cut, most of Adobe Creative Cloud, Visual Studio Code/Atom/TextMate, Xcode, and Sketch. If I were to make a list of the main apps people buy Macs to run, it's pretty much the same list.

The particular case highlighted in the blog post is specific to code editors, but similar types of problems arise in all of the most important app categories for Macs.

<comment><USER9> This issue goes beyond MacOS too. The traditional model of allowing any process to read and write anything created by the same user, send IPC messages (unix sockets, mach ports, window messages etc.) to most processes, and execute any subprocess has serious security and privacy implications. iOS, Android, and to a lesser extent ChromeOS offer a different, more intuitive, security model, but one which is difficult to retrofit to traditional OSs.

Attempts to retrofit a sandbox to older OSs are full of holes, and it's interesting to see how different ecosystems attempt to do this, with containers, AppArmor, the seatbelt sandbox, and other things brewing in Redmond.

<comment><USER10> Snap / Flatpack are probably the most promising attempts in this area.

Personally I think it will be incredibly hard and tedious to morph the Linux desktop into a properly sandboxed environment, exactly because you are fighting long established conventions and norms in just about every aspect of development and application usage.

Fuchsia (Googles new OS) might prove very interesting in this regard.

<comment><USER11> I find most of the time when I'm installing snaps I need to use —dangerous. I'm not sure what exactly it does, but my guess is that it renders whatever security snaps are supposed to provide moot.

</comment></comment></comment></comment></comment><comment><USER12> The key part seems to be this:

> Then click to allow when the system dialog asks if the sample app can > control TextEdit via Apple Events.

The author argues,

> This should appear very innocuous to the user, because nobody thinks that > TextEdit is dangerous, so one would think it's not much of a risk to allow > TextEdit to be controlled.

This is what the dialog looks like: [https://imgur.com/a/HRXDG0x](https://imgur.com/a/HRXDG0x)

The smaller text is where the app developer provides an explanation for why they are requesting the permission.

<comment><USER13> And to explain his argument he explained

> However, when an app such as TextEdit with the > "com.apple.security.files.user-selected.executable" entitlement saves a > file, it removes the quarantine extended attribute!

</comment></comment><comment><USER14> The latest version of Zoom (released yesterday) also has the entitlement to send Events to other applications. It's unclear why it requires this entitlement. Anyone know?

      [>] codesign -d --entitlements :- /Applications/zoom.us.app

      ...
      <key>com.apple.security.automation.apple-events</key>
      <true/>

<comment><USER15> I believe there's a feature that allows others to take control of the screen. It could be related to this

<comment><USER16> I had the same thought, but that feature is [https://support.zoom.us/hc/en- us/articles/201362673-Request-...](https://support.zoom.us/hc/en- us/articles/201362673-Request-or-Give-Remote-Control) and needs permissions under Accessibility.

<comment><USER17> Maybe they also intend to allow controlling single applications at some point.

</comment></comment></comment></comment><comment><USER18> I'm not sure this is necessarily a security issue, it is perhaps more of a social engineering issue. The user IS shown a suspicious dialogue "App wants access to control TextEdit".

What apple could do is perhaps add some sort of indication or extra step to help users make the informed choice.

<comment><USER19> You have the problem that too much information will just get skipped over by the user too. It has to be the right length of text if you want to try and get them to read it.

</comment></comment><comment><USER20> I just don't known what to make of OP last sentence :

> Note that I chose the directory /Users/Shared to avoid macOS "privacy > protections" that prevent interaction with various other directories such as > Desktop, Documents, and Downloads.

If the script can't access protected locations did it actually break the sandbox? Can you actually run the file in /Users/Shared scripts afterward and access those locations from there on? On Catalina the shell is kinda sandboxed when run interactively, does this exploit bypass by tuning as TextEdit?

<comment><USER21> There is a bit of confusion because macOS has two sandboxes: app store app isolation and permissions and file system isolation. Think of the latter as everything on the file system except /Users and a few other cherry picked directories being mounted from a read-only CD-ROM.

<comment><USER4> The latter usually goes by the name "Data Vaults" and actually extends to a blacklist of directories (and at a technical level is enforced in a different manner). Things like ~/Documents, ~/Downloads and ~/Desktop are inaccessible to applications without permission.

</comment></comment></comment><comment><USER22> > Then click to allow when the system dialog asks if the sample app can > control TextEdit via Apple Events.

Seems to require the user to explicitly give the application permission to escape the sandbox?

<comment><USER23> The author is right that controlling TextEdit seems harmless. It could be done in the context of showing the user release notes or something. AppleEvents must be a nightmare for Apple's security auditors.

<comment><USER12> You can tell another app to open a document without having permissions to send arbitrary Apple Events (which effectively let you act as a user interacting with the app).

Even if TextEdit files were quarantined so you could not execute them, you would still be able to do harm, such as snooping on the user's recent documents, or trashing the disk by overwriting files that TextEdit has access to. Likely it could even install a LaunchAgent to run arbitrary code outside of the sandbox as well.

There's already a security dialog here that warns the user. Maybe the user's imagination doesn't run wild with all the ways that the access could be abused, but they _were_ warned.

</comment></comment></comment><comment><USER24> It looks like the core problem here is not that the TextEdit entitlement gives arbitrary code execution, but rather that sandboxing is not transitive. If application X has its actions restricted in some way, it should not be able to bypass that by running application Y, for any Y.

</comment><comment><USER25> Is it just me or is the MacOS security often not fully thought through.

I mean this isn't the first vulnerabilities of it's kind.

</comment><comment><USER26> This is cool because it shows Apple built a castle on a foundation of sand.

The author points to the sand, and Apple says "we're only interested in the castle."

In one sense, to agree with most of the comments here, thats the practical answer for Apple! Show us the problem with _what we 've built!_

In another sense, I scooped the sand away from the foundation of your castle, and now I'm inside.</comment>


Microsoft launches Google-is-evil campaign targeted at Safari users - <AUTHOR> http://blogs.computerworld.com/windows/21033/microsoft-launches-google-evil-campaign-targeted-safari-users

<comment><USER2> I guess the best ad campaigns are the obvious ones, but I tried using Bing and was not really all that happy... I switched to DDG which basically searches all engines and actually gives me a lot more useful results than googling/binging does anyways. They're also pretty privacy happy so thats a big win for me.

Now if I could only convince people to ditch gmail...

</comment><comment><USER3> Original story is here: [http://thenextweb.com/microsoft/2012/09/20/microsoft- tells-s...](http://thenextweb.com/microsoft/2012/09/20/microsoft-tells-safari- users-use-bing-since-google-fined-22-5m-breaching-privacy/)

</comment><comment><USER4> Dick move by Microsoft taking advantage of a dick move by Google. This is major news if you weren't already aware that giant corporations are giant dicks.

</comment><comment><USER5> Microsoft doing what it does best: attacking others instead of focusing on their own stuff.

<comment><AUTHOR> Totally agree to you, By doing this we now know who the "REAL_EVIL" is...</comment></comment>


The Decline of 'Big Soda' (2015) - <AUTHOR> https://www.nytimes.com/2015/10/04/upshot/soda-industry-struggles-as-consumer-tastes-change.html <comment><USER2> This article is from 2015.

Since then, Philly was able to pass a "soda tax" which went into effect Jan 2017. In it's first year, it raised $78.8M.

[https://www.bizjournals.com/philadelphia/news/2018/01/26/phi...](https://www.bizjournals.com/philadelphia/news/2018/01/26/philly- beverage-tax-soda-tax-pbt-2017-year-revenue.html)

<comment><USER3> I was in Chicago last summer and they had the now-repealed soda tax, or whatever they called it. A penny per ounce. So my fountain drink was something like an extra 16 cents.

Why? 16 cents on a $2.99 drink isn't going to make anyone think twice. It even applied to diet soft drinks that contained no sugar!

</comment></comment><comment><USER4> Coke reentered my life with their new Coke Zero formula. I sincerely love it, I just hope science will come up with a cure for the horrible disease this will eventually induce in me.

<comment><USER5> Relevant Onion article:

[https://www.theonion.com/man-who-drinks-5-diet-cokes-per- day...](https://www.theonion.com/man-who-drinks-5-diet-cokes-per-day-hoping- doctors-work-1819575868/amp)

<comment><USER6> That's a great article. Really describes how we Americans really are, and how we expect some modern marvel for whatever ails us. Really explains how snake oil salesman are allowed to exist.

<comment><USER7> Snake oil salesmen are documented as far back as history goes, and in preliterate societies. I wouldn't look to "American culture" or "modern marvels" for explanations.

</comment></comment></comment></comment><comment><USER8> I gave up soda, it was tough, I've tried it a few times but finally did it this year.

I did it with a combo of green tea and the soda water + lemon/lime flavoring drinks. I'll also drink water and add lemon or lime juice.

I feel a lot better not drinking soda. If I need a pick me up I'll drink green tea. If I need something carbonated I drink a soda water/citrus drink.

Now if I take a taste of soda, it tastes awful, I don't think I'll ever go back to drinking it.

<comment><USER9> How is it giving up soda, if you replace it with soda water/citrus drink? I am a little confused. I guess your reduced your soda intake mostly by replacing it with green tea though.

<comment><USER10> I think this is a clash of use of American-isms. Soda (stand-alone) is sugared soft drink. Soda Water, is usually carbonated water (sugar free, sometimes flavored)

<comment><USER11> > I think this is a clash of use of American-isms. Soda (stand-alone) is > sugared soft drink. Soda Water, is usually carbonated water (sugar free, > sometimes flavored)

IME, consistently, for my while life in the US, "Soda" (standalone) is (in general use, there are contexts where it means something else) a carbonated and flavored soft drink, whether or not it is sugared, while "soda water" is carbonated water without additional flavor.

</comment></comment></comment></comment><comment><USER12> One thing that I didn't see mentioned in the article are drinks like La Croix. Those seem to be taking the place of soda for a lot of people.

<comment><USER13> Agreed. I drink diet soda during the afternoon, but during the evening I switch to La Croix, because no caffeine. While there are some sodas that are caffeine free, they've always tasted off to me.

</comment></comment><comment><USER14> Sadly it was replaced by "bottled flavored sweetened water".

<comment><USER15> Some certainly has, but not all flavoured waters are sweetened. Particularly, La Croix seems to have picked up a national following in the last few years, alongside Perrier/San Pellegrino waters, cold brew coffee, and kombucha. And even those waters have way less sugar than soda.

</comment></comment><comment><USER16> I imagine that in the future giving a child any significant quantity of a super sugar liquid like soda might be seen as child abuse. The way it triggers the human brain isn't much different than illegal drugs.

<comment><USER3> Or the health effects will be held in the same regard as cigarettes. My dad started smoking when he was 12, it wasn't uncommon for kids to do that.

</comment></comment><comment><USER6> How bad is fresca for me? It's low calorie, and sugar free. It's got to be bad for me.

<comment><USER17> Good call:

[https://www.scientificamerican.com/article/artificial- sweete...](https://www.scientificamerican.com/article/artificial-sweeteners- confound-the-brain/)

[https://www.scientificamerican.com/article/how-artificial- sw...](https://www.scientificamerican.com/article/how-artificial-sweeteners- may-cause-us-to-eat-more/)

</comment></comment><comment><USER18> Even if it's 2015 not a moment too soon, there are 7 teaspoons of pure refined sugar in a 33cl can. The ascorbic acid is the only thing that makes us not throw up immediately after drinking it.

Sooner or later the 3 major addictive components that the food industry uses to grab customers need to be regulated: sugar, fat and salt.

Without regulation it results in an arms race, a new brand comes along and how do they grab customers? More salt, more fat and more sugar than the established brands.

For any progress to be made, there should a tax on these big 3 at once and not going after one product at a time.

<comment><USER19> My life is filled with pro salt anecdata, so I'm not convinced it's on the same level as sugar.

I'd be interested in seeing your anti salt sources.

<comment><USER20> Not salt per se, as much as the combination of salt, fat, and sugar leading to over-consumption of food.

</comment></comment></comment><comment><USER21> If you're looking for a long-term investment trend that will last for many more decades to come, invest in companies that produce water, coffee, and tea. All the displaced soda sales are going to them.

<comment><USER22> In many (most?) cases, that company making water, coffee, and tea is Coca-Cola or Pepsi.

Coke has been particularly prolific in this area.

<comment><USER21> Yes, true - Vitamin Water, Dasani, etc. have been good for them.

</comment></comment></comment><comment><USER23> (2015)

</comment><comment><USER24> Are there any robust results about the potential long term health effects of artificial sweeteners yet? Last time I looked I had a hard time finding conclusive takeaways.

</comment><comment><USER25> The rise of energy drinks, then low sugar / sugar free energy drinks killed soda for me. 160 calories of Sprite is just empty calories vs a 60 calorie Kickstart that has caffeine.

<comment><USER26> Most "energy drinks" are both functionally "soda" (though more expensive) and owned by "Big Soda". Kickstart is a Mountain Dew brand, which is a PepsiCo property. I'm not criticizing, mind--I really like the zero-calorie Monsters and I drink a lot of Diet Pepsi, though I seem to be the only person who likes the sucralose Diet Pepsi formulation whenever the topic comes up.

The only time sugared soda ends up in my house is at parties for mixed drinks, 'cause I still can't countenance Diet Coke in a drink. (Diet ginger ale is pretty okay with Jameson's, though.)</comment></comment>


Show HN: Trippy tetris-alike in Phaser.io: high score so far is 13 - <AUTHOR> http://sunshower.pro/ <comment><AUTHOR> Sorry; not mobile ready yet!</comment>


Carlos Slim calls for a three-day working week - T-A http://www.cnbc.com/id/101851828

<comment><AUTHOR> Having personally worked directly on international telecom projects in Mexico in the 90s with his tel mex company I assure you that due to bribery / corruption issues we had severe difficulty getting 3 days of work done on our installs per week. But that's not what he meant.

(For the youngsters, 90s Mexico was like 10s China, all manufacturing had moved to or was moving to .mx)

The other problem is a bit of headline bait, he was talking about what most people would call "part time jobs for supposedly retired people". We already have those.</comment>


"The Great Plate Count Anomaly" that is no more - <AUTHOR> http://schaechter.asmblog.org/schaechter/2014/12/the-great-plate-count-anomaly-that-is-no-more.html#re <comment><USER2> Autoclaving components of the medium separately has been done since the 1970s. Here's a paper published by my dad in 1975 in the Proceedings of the National Academy of Sciences. Look under Materials and Methods, Media. It's mentioned like it's no big deal. They had tried a number of combinations, this is what worked best for them.

[http://authors.library.caltech.edu/11146/1/SUTpnas75.pdf](http://authors.library.caltech.edu/11146/1/SUTpnas75.pdf)

EDIT: My dad has Parkinsons now. It's great to see him light up and talk about his work.

</comment><comment><USER3> That is an awesome find. It has to feel pretty amazing to figure out that something that has been "the standard" for so long is broken in a fairly simple way.

<comment><USER4> Yeah. Like, how embarrassing.

</comment></comment><comment><USER5> I read somewhere else a theory of how buildup of hydrogen peroxide in the body is what kills victims of septic shock.

<comment><USER6> The only published reference I can find to that idea is [http://www.ncbi.nlm.nih.gov/pmc/articles/PMC4038812/](http://www.ncbi.nlm.nih.gov/pmc/articles/PMC4038812/) which was published earlier this year. It doesn't seem to have evidence based on actually measuring H2O2 buildup, only an observation that various aspects of sepsis, when seen elsewhere, are correlated with H2O2.

</comment></comment><comment><USER7> Amazing to know how little we knew and experimented with such a popular process used for so long. It makes me wonder what's undiscovered about other processes we take for granted.

</comment><comment><USER8> I am no expert on this topic, but this story has a strong "bad science journalism" smell. The pattern is (1) longstanding complex open problem (2) stupidly simple "solution" claimed as a panacea. Generally with this pattern, the simple solution turns out to be well known among the top experts, and really isn't a solution to the whole problem, just a tiny part of it.</comment>


Ask HN: Choosing between a programming language you like and one you don't - vanilla-almond Scenario: You're building a software product and you can choose the programming language to build the product.
You can choose a programming language from two options:
Option 1. A language you like and you're fairly sure you'll enjoy using. You'd be happy to build and maintain the code as it grows in this language. However, this language lacks some of the completeness of libraries and documentation compared with other languages.
Option 2. A language you don't particularly like but it has wide-ranging libraries, extensive documentation and many prior examples/tutorials that will help you out when you inevitably get stuck. Despite that, you don't particularly enjoy writing in this language.
Given that ultimately you want to successfully launch a product, is option 2 the only choice? Or is there a case for choosing option 1? <comment><AUTHOR> I see this as a continuum, not a binary dichotomy. I mean, quantify _how much_ language A is short on, say libraries, compared to language B. Surely A has _some_ libraries, and surely there is _something_ that B does not have a library for, no? Similar notions apply to the other dimensions.

So I don't think there's an easy answer to this. You might just have to define some baselines that represent minimum criteria a language must meet in order to be selected, and then satisfice[1] with anything that passes those baseline measures.

For example, maybe you say "anything that doesn't at least have a library for making HTTP requests is out". Or maybe it's "anything that doesn't have an easy to use C FFI is out", or whatever.

[1]: [https://en.wikipedia.org/wiki/Satisficing](https://en.wikipedia.org/wiki/Satisficing)

</comment><comment><USER2> The real question is how are you basing your liking a language? You don't like having wide-ranging libraries, extensive documentation and many prior examples/tutorials that will help you out when you inevitably get stuck? Are you a glutton for punishment? :)

All snark aside, the only sound business case for going with option (1) is if the language is typically only used by high-caliber developers so that when recruiting help it sets the bar for ensuring you're getting good help. Clojure comes to mind as an example of such a language. Too bad it has wide-ranging libraries, extensive documentation and many prior examples/tutorials! ;)

Hope that helps.

<comment><USER3> Another factor would be accounting for newness- if a language has a better foundation than other languages and just hasn't been around long enough to have developed those "wide-ranging libraries, extensive documentation and many prior examples/tutorials", it could still be a good long-term investment. Rust comes to mind, and to an extent Clojure (at least if you exclude the Java ecosystem).

</comment></comment><comment><USER3> As others have noted, putting these into two opposing buckets removes a lot from the equation. That said, I would tend towards #2 for a professional project and #1 for a hobby project. I've definitely made things for fun in a less practical language, just because I knew I would get more enjoyment out of describing things that way than from having a bulletproof end result.</comment>


Has Dell Dropped Ubuntu Linux? - <AUTHOR> http://www.pcmag.com/article2/0,2817,2366953,00.asp

<comment><USER2> It was always really half-assed. I bought one of the Ubuntu edition laptops a couple of years ago, and on the two occasions I spoke to Dell's tech support (for hardware issues) they had the machine down as having Vista and they had no idea what I was talking about when I tried to explain that I had _bought_ one of their machines with Ubuntu.

A properly configured Ubuntu installation absolutely beats the pants off Windows for typical netbook tasks. Fast, stable, no viruses, no freaking installers adding crapware and "toolbars" to your browser. All the software you could ever need on a netbook: Chrome, Rhythmbox, VLC, Skype, Spotify, OpenOffice (if Google Docs doesn't do it for you).

I don't know why they've dropped it, why they never gave it a proper shot. They could have really set themselves apart from the sea of netbook manufacturers. I'm waiting for someone to come along and happily eat their lunch.

<comment><USER3> I think once you're at "properly configured" the same can be said for Windows (most likely XP).

<comment><USER4> Not really. Windows still lacks one of Ubuntu's killer features (package management), and virus scanners don't always work.

That and a Linux terminal is much nicer to work with than Command Prompt.

<comment><USER3> How many end-users have you ever heard say 'I wish my computer had better (or any) package management/terminal'.

<comment><USER5> How many users have you seen saying "I need a better firewall, and upto date antivirus patches and I dont want drivers in my kernel taking my entire system down"? But most of them expect a well functioning secure computer whose speed does not go down over time and one which doesnt crash often. Users might not ask for package management but once they discover it they will appreciate "i dont have to go looking for software on twenty different websites and I dont have to bother to check websites for updates" - updates via windows update center for non microsoft software is an idea that should be much farther along than it is right now - have you ever been annoyed by flash, google products, adobe products, itune all having their own update listeners prompting you for updates all the time ? Well if package management and integrated updates were in place you would have just one update center.

<comment><USER3> Integrated updates are built into both Windows and OS X. Have been for a long time. Both of these rather popular consumer OS's surely have their problems. But the idea that a Linux desktop is somehow more user-friendly or accessible because it has 'package management' or an awesome terminal is absurd. I somewhat suspect that sort of dreadful idea is part of the reason why there is no competitive Linux-based consumer OS, to date.

<comment><USER5> How many non apple updates have you seen in the apple update center ? How many non microsoft updates have you seen in the microsoft update center ?

<comment><USER6> As of Mac OS X Snow Leopard, installation and updating of printer drivers get handled by Apple's Software Update.

[http://www.appleinsider.com/articles/09/02/09/apples_snow_le...](http://www.appleinsider.com/articles/09/02/09/apples_snow_leopard_to_load_printer_drivers_on_demand.html)

Ofcourse, those drivers are still curated by Apple. Back in 2004, Apple flirted with the idea of opening up Software Update for third parties, but has since decided against it.

"The computer company fears that third party developers could accidently release buggy or infected software updates, which would ultimately effect the Mac OS X operating system, causing customers to fault Apple."

[http://www.appleinsider.com/articles/04/07/13/apple_nixes_th...](http://www.appleinsider.com/articles/04/07/13/apple_nixes_third_party_software_update_plans.html)

<comment><USER5> Btw thanks for including links! Maybe the feature could be added as an opt-in for the user. This is what ubuntu does - [https://help.ubuntu.com/community/Repositories/Ubuntu#Adding...](https://help.ubuntu.com/community/Repositories/Ubuntu#Adding%20Canonical%20Partner%20Repositories) , works great. Also the fact that random regular company can actually host their own apt repo and ask their users to add it to their apt configuration and then receive updates via the System Updater is kind of neat. There are several companies which do this - cloudera being among one of them, virtualbox being another.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Are there any good current options for something that comes preinstalled with a reasonably normal version of Ubuntu or Debian and works well? It seems a lot of the preinstalled-Linux netbooks come with some sort of manufacturer- customized version of Linux, which I'm worried will cause problems down the line for upgrades. I'm confident that I can upgrade a standard Ubuntu or Debian install for years, but if it has some manufacturer-hacked install, I'm much less confident how long the support and updates will last (worse if it's a manufacturer-customized kernel, in which case I'm not even confident that it'll _boot_ after an upgrade).

<comment><USER8> System76 specializes in Linux machines:

<http://www.system76.com/index.php?cPath=28>

</comment></comment><comment><USER5> Five years later we will discover 70% of this quarters Dell revenue came from payments from Microsoft for being Windows exclusive.

<comment><USER9> I know you're just trying to be funny. Hopefully. But it is hard for me to imagine that selling laptops with Ubuntu was ever a profitable endeavor.

<comment><USER5> Yes I meant it as a joke. I do realise that if many people dont buy a particular configuration it would be less profitable because the expenditure involved in keeping a particular configuration alive is amortized over fewer units sold. That being said - there is a case where its more profitable in the long run for a company like dell to sell an upstart like AMD / ubuntu which is not pulling in the margins yet - the case where the upstart is starting to gain traction.

<comment><USER9> Sure. But I don't think in this case the upstart has been gaining any traction.

<comment><USER5> Search google trends to compare osx,fedora,ubuntu. You will be surprised. I would paste a link but am on a mobile device which lacks cut and paste.

<comment><USER9> There are all kinds of problems with this. For one, it could just indicate that Ubuntu has more problems than other OSen and thus needs more searches. The very fact that Ubuntu has a higher number on the trend lines indicates that there are some serious problems with using this method to do the comparison.

This (<http://www.netmarketshare.com/os-market-share.aspx?qprid=11>) seems a more direct way to compare the shares and seem to indicate Linux is basically flat over the last couple of years. It certainly doesn't indicate any imminent opportunity that Dell might miss here. Even your trend graph shows a substantial decline in Ubuntu searches over the last year.

</comment></comment></comment></comment></comment></comment><comment><USER10> I think near all of the time Linux sales are chalked up as "Windows sales" anyhow.

In my current job, and in my previous job as well, all the tech staff PCs are corporate order Dells/Acers/whatever. They all come with Windows, and the first thing the developer/ops person does is installs Linux.

It's basically easier to do it that way than to communicate the Linux requirement back through to whoever is actually ordering the PC.

I think the only time either organisation doesn't preorder with Windows by default is for servers.

</comment><comment><USER11> Just over a year ago I got a dell mini 9 with linux for my dad. There was no way he was going to use linux. It just confused him and nothing worked without first taking some action or involved explanation. It was all just too much for him.

I installed OSX 10.5 [1]. I told him the only rule is no Apple Software Updates (until I had a chance to patch it). It was my nth attempt to get him to leave Windows and it finally worked. After some massaging by me - Everything just worked. Maybe not the same way - but it worked. And it was more productive than using his old borked windows install. When linux can provide a similar experience they will gain (more) traction. I don't agree with Dell dropping Linux but I understand it. I can just imagine all the confused users calling in because they can't install some windows game or windows program.

There was another reason the Mac didn't happen sooner. Price. There was no way he was going to shell out for a mac. He had the money. He just couldn't justify spending 3x to get a Mac. We'll see if price is still an obstacle now that he's a daily Mac user. And this is another (obvious) strong point for Ubuntu. In my opinion they've done a good job leveraging "being free" in the netbook market where 25% of the cost can be the OS (/cough Windows).

[1] <http://www.mydellmini.com/forum/mac-os-x/>

</comment><comment><USER12> Ubuntu from Dell was only there to put a little pressure on Microsoft (probably to call their bluff).

<comment><USER13> Did it work?

</comment></comment><comment><USER14> The 'elephant in the room' is the TOTAL lack of interest from governmental departments that deal with competition issues (in the UK, the Office of Fair Trading). If a manufacturer wants to recommend - and support - only Windows, that's OK. But it's illegal to tie Windows to their computer products. They must offer, on demand, a machine without a pre-installed OS.

I'm still trying to get a refund for the Windows Tax on my Samsung laptop. But when even the OFT seems to have been subverted, what does one do?

I know what I'M going to do. Corruption must be crushed, utterly.

</comment><comment><USER15> I wonder how much money they're getting from Intel for this?

</comment><comment><USER16> Canonical should SELL their product to newbies: but a CD, it costs you less than your anti-virus software, we give you 30 days of support and you get an office suice for free, too. All for $49.99 - it's a great deal!

</comment><comment><USER17> Hell with Dell.</comment>


HTC, You Loser - <AUTHOR> https://www.bloomberg.com/gadfly/articles/2016-10-05/htc-you-loser <comment><USER2> I find it highly unlikely that HTC is simply a manufacturing partner. The Pixels look too much like HTC phones, even the ones they're selling right now.

<comment><USER3> And I don't see how making phones for someone else is a bad thing. It shows you know what you are doing.

<comment><USER4> The great profit margins tend to be in branding though, not OEM work. This is a huge hurdle Taiwan's industries in general have to overcome (HTC and Foxconn are Taiwanese), and probably part of the reason Foxconn bought Sharp.

<comment><USER5> Not that it cannot be done. Acer is a prime example of an OEM turning into a full blown brand name. HTC seems to be focusing on too many thing and for the last ten years have been feeling like they were missing something to match the line up of other phone manufacturers.

</comment></comment></comment></comment><comment><USER6> I used to live next to a HTC office building in New Taipei City. I saw the engineers coming out at 8pm to grab some food and head back to the office. Im sure everyone at HTC is wondering how to work the staff more than already normal 14h a day to curb the downfall (;

</comment><comment><USER7> Saying that HTC phones were ugly until the 1 series is judging past design by todays environment.

Back in the early smartphone days the HTC "chin" was the talk of the town. A bold design move that had people on the street talk about your phone. You could recognize it from a mile away, and the owner would always be happy to tell you that they love their chins.

The back of the HTC diamond is something we today will consider ugly and corny, but back then it was a really cool design.

Today's HTCs are pretty, but boring and don't stand out.

</comment><comment><USER8> It's a sad reality of modern business that marketing and brand are al. In principle it's laudable that HTC seems to be brilliantly engineering (AND UX) - led company, and doesn't value marketing and brand, but such is the world as it stands.

I hope we don't lose the expertise-set of this company if it doesn't recover or is taken over by, say Samsung.

</comment><comment><USER9> I still haven't been able to find a high-end Android smartphone that is actually any good. I returned an HTC One after multiple repairs failed to fix the broken microphone. Maybe marketing is the real problem with HTC, but I'm also disappointed with the quality of the engineering of most manufacturers.</comment>


Elon Musk's Funding for Tesla Wasn't So Secure - <AUTHOR> https://www.bloomberg.com/view/articles/2018-08-13/funding-for-elon-musk-s-tesla-buyout-wasn-t-so-secure <comment><USER2> > [Cost of compliance] is a more common complaint from small companies than > from giants like Tesla, though; Tesla can afford some lawyers. Also I am > sorry to be rude but given Musk's Twitter proclivities I feel like they are > maybe not spending all that much on securities lawyers?

Laughed out loud at this.

</comment><comment><USER3> Maybe they're running out of money faster than anyone realizes and this is a desperate Hail Mary? That would explain the erratic and possibly illegal nature of the announcement.

<comment><USER4> I think a more likely explanation is Elon's ongoing annoyance and anger toward anyone who questions the eventual success of Tesla, and especially anyone shorting the stock.

There's no way he would ever admit this, but I bet one of his motivations for posting that tweet was to move the stock and hurt the shorts.

Musk seems to be one of those classic "force of nature" founders, whose will to overcome obstacles and prove everyone wrong is essential to getting off the ground, but could be a liability in a mature company.

"Oh, yeah? Try and stop me!" works great until you run up against someone who can actually stop you (often, the government).

<comment><USER5> >I bet one of his motivations for posting that tweet was to move the stock and hurt the shorts

Sounds like a violation of SEC rule 10b-5 and possibly illegal.

<comment><USER4> Only if you prove intent. Which is why Musk would never admit it.

<comment><USER6> Intent is not required for regulatory violations. Moreover, the text of 10b-5 does not require any specific intent, only that the false statement or omission be made in connection with the transaction of a regulated security.

<comment><USER4> > John Reed Stark, a former longtime lawyer at the S.E.C. who specialized in > investigating internet fraud cases, said that commenting online about the > prospects of taking the company private was inadvisable at best. But he said > that a case of market manipulation would come down to Mr. Musk's intent.

> "These are very difficult cases to prove," said Mr. Stark, who runs a > cybersecurity consulting business.

[https://www.nytimes.com/2018/08/13/business/dealbook/tesla-e...](https://www.nytimes.com/2018/08/13/business/dealbook/tesla- elon-musk-saudi-arabia.html)

<comment><USER7> That is a seperate crime which he may also be guilty of.

<comment><USER4> Thanks.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I highly recommend reading "The Paypal Wars" \- I think Musk learned a lot from his mistakes at Paypal, but I also think there are elements of his personality that are still problematic for managing a going concern.

Nonetheless, I personally like the guy and wish him the best, we need more like him.

<comment><USER9> > we need more like him.

Not Musk bashing, I am genuinely curious as to why you think that?

<comment><USER10> Not many billionaires putting their money on space exploration and renewable energy? Sounds like a good reason.

<comment><USER11> Lots of billionaires are. They just tend to keep to themselves.

Also, Bezos has Blue Origin.

<comment><USER12> Which one are landing orbital class rockets again?

FYI, Blue Origin has been at it longer that spaceX has existed. But SpaceX, spending at least 5X less money is landing orbital class rockets and whilst Blue Origin is doing suborbital flights.

<comment><USER13> >SpaceX, spending at least 5X less money

not to argue, but both Blue Origin and SpaceX are private and don't disclose ther financial information, to my best knowledge. So where is this number coming from?

<comment><USER14> For Blue Origin, they don't have any customers yet, so no income there. And it is public that Bezos just sold what, about a gigadollars worth of Amazon stock, presumably to dump into Blue Origin (which I think he's done about once a year?).

<comment><USER11> > For Blue Origin, they don't have any customers yet, so no income there.

You couldn't be more wrong. They've had payload customers for their test flights. They also have 4 large customers signed up for their New Glenn rocket (in development).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> TSLA market cap is like 3 years of Toyota's net income. Toyota also has enough liquid assets that it could take Tesla private with cash using Musk's plan. It would be no sweat decision if they would value the business $420 per share.

:)

</comment><comment><USER16> I bought shares after elon's tweet. Gonna sue him now.

</comment><comment><USER17> darn they put a paywall

<comment><USER18> I think any paywall based on # articles read can be bypassed with incognito mode

<comment><USER19> You can't get around Bloomberg's with just incognito, but if you block cookies from bloomberg.com it can't count how many articles you read and gets stuck at 9 articles left.

<comment><USER20> incognito doesn't allow cookies to be stored after exiting incognito, so in fact it does allow you to read as many articles as you wish simply by closing and re-opening the incognito tab. As another poster noted, FF incognito doesn't track cookies across tabs.

</comment></comment></comment></comment><comment><USER21> I find it hilarious that Bloomberg thinks it knows whats going on at Tesla. They are desperately trying to give tesla one last black eye before it goes private.

<comment><USER22> This isn't 'Bloomberg'. It's Matt Levine's Opinion, and his opinions (which always come with ample justification, unlike yours) are very highly regarded.

<comment><USER23> The problem is he doesn't provide a reasonable explanation for why Musk made his comments.

It doesn't take a genius to think, as the CEO of a public company, saying you have funding confirmed when you don't might land you in hot water.

So the most likely scenario is he understood all of this and said it anyway.

Why?

<comment><USER20> It's not knowable at this time why Musk made his comments. As a writer the best Levine can do is contextualize the situation and how it compares to norms of corporate finance, try to probe at possible plausible explanations for Musk's behavior, and evaluate the relative likelihood of each as well as the potential pitfalls. Of course none of the proposed explanations are really tenable. It isn't Levine's task to explain why Musk made the comments -- that falls rather squarely on Musk, or, perhaps, the SEC.

</comment></comment></comment></comment><comment><USER24> Just in the first paragraph, author mis-represents "considering" as "planning to".

No, he would not need to buy all the shares.

No, he was not suggesting a "firm offer to the board" was imminent.

No, he did not imply "having agreements".

<comment><USER25> If he had just left it at "considering," this would be a very different conversation. Funding "secured" means that it definitively exists, i.e., there is an actual agreement from some investor(s) to fund the operation.

<comment><USER12> The only accusation here, then can be that he wrongly assumed the should be able to parse him saying "Am considering taking Tesla private at $420. Funding secured." to not mean Tesla the company has already finish due diligence and agreed to sell and that Tesla the company has secured funds from the buyers already.

The only reasonable interpretation of the above tweet, is to qualify the second sentence with the first, i.e he personally is only considering a buy offer and that he is secure in the funding ability of the buyer.

Choosing your interpretation, what he said in the second sentence, clearly contradicts the first sentence in the same tweet. So why are you choosing the clearly inaccurate, as due diligence is now taking place, narrowly legal interpretation of two words, over all the other context that suggests your narrow legal reading of those 2 words are not what could possibly have been meant by him.

<comment><USER25> You are the one taking it out of context. You are forgetting the rest of his tweet stream where he says "the only" thing in the way is a shareholder vote. High level discussions about possible billion dollar business deals happen every day. Without an agreement (e.g., term sheet), they mean nothing and certainly don't mean "funding secured." If Musk had come back immediately and said "I meant funding to be secured." It would have been a much smaller deal, but instead he doubled and tripled and quadrupled down. And now we know for certain that funding was most definitely NOT secured.</comment></comment></comment></comment>


Cisco To Shut Down For 4 Days At Year End - <AUTHOR> http://gigaom.com/2008/11/25/cisco-to-shut-down-for-4-days-at-year-end/ <comment><USER2> Cisco has _always_ virtually shut down between Christmas and New Years IIRC. People always take time off during the holidays: it isn't worthwhile to keep the whole business running. It's always been their unofficial policy, if not official to do so.

IMHO this is a silly attempt to cause panic.

<comment><USER3> This is of a piece with the WebGuild's recent "Google layoffs may affect 10,000." Hyping negative news. Cisco had shutdowns over the holidays for years. The cost savings come from reducing deferred vacation pay (most people will take vacation days to avoid going without pay) and cutting expenses related to keeping buildings open. It also sends a message to employees to become more cost conscious.

</comment></comment><comment><USER4> There is very little information in this article. In fact, the headline pretty much sums it all up. A quote or two to put this in context would have been nice. The article implies the shutdown is a cost saving measure, but provides absolutely nothing to back this up. It doesn't even mention whether or not employees will be paid for the four days. For all we know, they could just be giving employees a little more time off to enjoy the holidays.

[EDIT] There's a better article on Reuters that least attributes the news to an email from a Cisco spokesperson.

[http://us.rd.yahoo.com/finance/external/reuters/SIG=1165jh9e...](http://us.rd.yahoo.com/finance/external/reuters/SIG=1165jh9eu/*http://www.reuters.com/legacyArticle?duid=mtfh42372_2008-11-25_18-55-20_n25270787_newsml&rpc=44&type=marketsNews)

<comment><USER5> Raise your hands if you believe Cisco is closing to "give employees a little more time off to enjoy the holidays". Anyone?

<comment><USER4> You don't have to be a jerk about it. My point was that there was almost no substance to this article and nothing to back up its claims. It's simply bad journalism. That's a valid point no matter what the reason is for the shutdown. We should expect more from stories submitted here.

<comment><USER6> i have a "friend" who "works" there. this really is a cost saving effort.

<comment><USER4> I had my doubts after reading the gigaom article, but the Reuters article I found mentioned a statement from a Cisco person saying it is a cost saving measure.

I guess it's a safe assumption that employees will not be paid for these days. Can your "friend" share a little more information? So far, there seems to be very little information available.

<comment><USER7> If what you say is true, this measure doesn't seem to make any sense.

If their employees cost more than what they produce every day, doing nothing for 4 days is similar to closing your eyes and wishing the problem away.

<comment><USER5> If they're losing money every day, closing down for 4 days makes sense.

<comment><USER7> Yes, as much as closing down for the whole year.

<comment><USER5> While that's an oversimplification to be sure, what you just described is also known as "returning the money to the stockholders".

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Cisco is the closest thing technology has to an industrial company. At least a few regulars here have to have worked on Tasman before. It's not what you'd call an "agile" place.</comment>


Show HN: My first iOS 7 Sprite Kit game - <AUTHOR> http://fruitjamgame.com

<comment><AUTHOR> First of all, I realize this game is very similar to some existing games out there - I drew inspiration from puzzle games such as Candy Crush

Secondly, this game was developed from start to finish in just 2 months' time, owing to Sprite Kit's simplicity and elegance. Though there's not much example code out there for Sprite Kit given how new the framework is, it only took a short time to start drawing some graphics and animations. However, for more advanced things, such as sync'ing and sequencing several groups of actions/animations/sounds on multiple on-screen sprites, that required more custom work on my end (which could be worthwhile to explain in a blog post later on).

Anyway, try it out and let me know what you think. And if there are any other developers out there using Sprite Kit as well, I'd love to chat or get in touch! (especially if anybody has experience porting a Sprite Kit app to Android!)</comment>


Show HN: Pub Sub Abstraction Layer for Go (WIP) - <AUTHOR> https://github.com/jakoblorz/brokerutil <comment><AUTHOR> Hey there! I recently implemented a pub sub backend but had to switch the pub sub broker at some point. I compiled the non-trivial parts such as subscription management into this package so that others do not have to do this work as well.

I am always open for tipps and PRs, especially if more broker drivers are PR'd. brokerutil currently supports redis and a loopback driver, a kafka driver is on its way!</comment>


CEOs or CTOs that still write code - <AUTHOR> Do you know talented engineers who became CTOs / CEOs / etc. and still very much into coding, technology? I am very interested to read about them, their blogs, Twitter, get inspiration and understanding on how they manage to lead teams, think about big picture, define technical strategy for companies, and, at the same time go deep into tech, coding? Say, people like John Carmack? <comment><USER2> I heard that Anthony Casalena, CEO of Squarespace, was quite involved on the technical aspects even as of some years ago.

I saw some interview somewhere and he was talking about a DB sharing operation that was ongoing and had him busy. I can't remember the year of the interview; maybe around 2013? Seems like a long time ago but Squarespace was founded in 2003.

He doesn't have much on GitHub but he did update his dotfiles as of a year ago.

[https://github.com/acasalena/dotfiles](https://github.com/acasalena/dotfiles)

</comment><comment><USER3> I am pretty sure the CEO of FastMail still digs in pretty deep, given the content of blog posts he pens and a response to a support request I got once. He's also active on HN, so perhaps he will confirm/deny. :P

I am trying to think of anyone else I can think of who I could comfortably say is "a CEO" and who I'm confident still "writes code".

</comment><comment><USER4> DHH (creator of Ruby on Rails) is the CTO of Basecamp and an overall fascinating person. He writes on Medium about coding and has mentioned in interviews that he still enjoys "writing code"

[https://twitter.com/dhh](https://twitter.com/dhh)</comment>


The Worst Things You Can Call Yourself on LinkedIn - <AUTHOR> http://www.inc.com/chris-matyszczyk/the-worst-things-you-can-call-yourself-on-linkedin-part-2.html?cid=sf01001 <comment><USER2> I personally like "(retired)", for I am, and I don't want to hear from clueless recruiters, and I by and large don't.</comment>


Ask HN:Facebook Application - <AUTHOR>

Hi,
Question is pretty simple but way to confusing to me.
Which is the best place to outsource a facebook application ? I can not code and need some one to do it for me. I check out site like freelaner.com but not very impressed
Cheers<AUTHOR> <comment><USER2> HN Contractors - [https://spreadsheets.google.com/ccc?key=0AlD_6iEb8Ed9dGs3clV...](https://spreadsheets.google.com/ccc?key=0AlD_6iEb8Ed9dGs3clVJYi0yYVBka181Z0ZKRW9kQ0E&hl=en)</comment>


Bitcoin giant Coinbase accused of spying on a Dark Net researcher - <AUTHOR> http://www.dailydot.com/politics/coinbase-bitcion-dark-net-researcher/

<comment><AUTHOR> More links:

[https://twitter.com/gwern/status/595641266664275968](https://twitter.com/gwern/status/595641266664275968)

[https://www.reddit.com/r/DarkNetMarkets/comments/34mw6c/comp...](https://www.reddit.com/r/DarkNetMarkets/comments/34mw6c/complaintwarning_coinbase_is_watching_donations/)

[https://www.reddit.com/r/DarkNetMarkets/comments/34vohm/psaa...](https://www.reddit.com/r/DarkNetMarkets/comments/34vohm/psaarticle_gwerns_btc_address_flagged_by_coinbase/)

About a month ago gwern and some others got their reddit accounts subpoenaed:

[https://www.reddit.com/r/DarkNetMarkets/comments/30tudk/psa_...](https://www.reddit.com/r/DarkNetMarkets/comments/30tudk/psa_5_reddit_accounts_subpoenaed_by_ice/)

</comment><comment><USER2> I like how the internet immediately knows that a blacklisted address is related to spying.

(For example, perhaps Coinbase chooses to stop doing business with people that make transfers to a list of addresses that is provided by some third party...)</comment>


Maze.cafe - <AUTHOR> http://maze.cafe/ <comment><USER2> Nifty. But is there any purpose beyond nifty?</comment>


Ask HN: Dead-simple shared hosting provider? - <AUTHOR>

Hi there. This is a somewhat low-tech question for HN, but i will give it a shot anyway.
I have a bunch (50+) websites i made for various small businesses when i was younger. All of them simple static HTML with a tiny bit of PHP. No databases. I have them scattered over a bunch of different shared webhosting plans and i am looking to pull them all together to save money and have a single place for maintenance.
They are all low-traffic (100hits/day).
Any recommendations for this setup? <comment><USER2> I personally use webfaction to host several low traffic blog. Webfaction have good customer support. If you want to host static site you might want to try put it on AWS S3 or github pages ([https://pages.github.com](https://pages.github.com))

</comment><comment><USER3> Rackspace CloudSites. Great for static sites and PHP sites. [http://www.rackspace.com/cloud/sites](http://www.rackspace.com/cloud/sites)</comment>


Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do? - <AUTHOR> I've got a VPS which I use for small programming projects and college assignments. Two weeks ago I received an e-mail from my provider, stating that "your VPS has been transmitting a lot of outgoing traffic which results in a very large traffic usage bill". In September on my 500 GB data-limit VPS, it had been transmitting 27 TB of data traffic. This resulted in a € 3300 extra charge on my € 15 VPS. I'm expecting a similar bill for this month.
Of course I immediately shut down my VPS after the notice two weeks ago, but by then it had been using these amounts of traffic for a month and a half.
What are my options here? I can't afford to pay > € 5000 unfortunately. Does anyone have similar experiences? <comment><USER2> Incidentally, since many HNers probably come at this from a mental model of "Anything which appears on an invoice is non-negotiable and simply must be paid": a B2B service provider which collects payment after services are rendered is _knowingly taking on credit risk_ and has already priced non- collectability of some accounts into their services. You may be overestimating how much drama is required for someone at their company to say "Wow, really? OK, sorry about that. I'll write it off."

This is one of many, many, many reasons why we don't generally do cost-based pricing and, when we do do cost-based pricing, the markup is absolutely phenomenal. It has to include risk premiums. As long as it do include risk premiums, you don't have to sweat the small stuff like e.g. an uncollectable $4k invoice. (n.b. Small stuff! $4k hiccups are utterly routine events and largely dealt with by processes rather than by treating them as sudden emergencies, even if they feel like that to natural humans.)

<comment><USER3> Also OP, if they don't write it off make sure to tell us all who it was so we can avoid them.

The same thing happened to me with amazon. Amazon pid for it. It's highly unreasonable in my opinion to ask the customer of a VPS to pay for damages caused by a malicious attacker. It's tantamount to a landlord expecting you to pay after an arsonist comes along and burns down your apartment, just because you happened to be renting it at the time.

<comment><USER4> May I propose another analogy:

\- a landlord* expecting you to pay after a squatter came along and opened a faucet in the basement (where OP rarely goes) to fill its own super tanker

* or the water company ?

</comment></comment></comment><comment><USER5> 1\. Report the incident to the police. Right now.

2\. Report it to the VPS provider. Explain that you've reported it to the police. Ask for their cooperation in investigating the problem.

You do not have to pay. If they try to force you to pay, depending on your country, you'll probably end up in small claims court where you'll find judges are very reasonable people who usually side with the little guy. (IANAL)

<comment><USER6> I hope cyber crime police has improved their working in recent years. 5-6 years ago a Ebay seller defrauded me. I filed a complaint with all the information I had since everything is online and involved bank transactions there had to be a money trail. I never heard back from cyber crime cell. I don't know how many folks were defrauded by that person before and after the incident with me.

<comment><USER7> Doubtful. I got a call from someone about a month after my GF's iPhone was stolen. He'd bought it on eBay and asked if I'd got a new one yet - her phone gave a number to call and was activation locked.

He wanted to know so maybe I'd give the password so "he wouldn't be ripped off, too". I'll give him credit for having the balls to ask. But (as I later found out) he knew he was buying an "activation locked" iPhone.

I said a few things like how do I know you're not the thief, etc. He pointed me to the eBay listing which, sure enough even had the IMEI with two digits transposed (plausible deniability, I'm sure).

He contacted the seller and said "Tell me why I shouldn't give this phone to its rightful owner and then file a fraud complaint with eBay and get a refund?" Unsurprisingly the seller offered to take the phone back. So he sent it (I didn't care, and while I knew the insurance company was about as unlikely to care as the police were, I didn't want to do anything that might trigger insurance fraud questions - "This phone was reported stolen, unlocked using your credentials. Explain.") and got me the seller's home address.

I contacted the insurance company. They didn't care, just told me to file a police report and send them the case number.

Looked at the seller's profile, quite possibly the sketchiest thing I've ever seen.

Bunches of phones, all "activation locked, no charger". Tablets, no charger. Laptops, no accessories or charger. At least 50 or so.

Gave that info to my local PD. Their response, "We won't investigate. He probably bought it from someone and is selling them. Could have gone through a few people first."

I didn't want the original thief caught but this guy was openly selling stolen gear. Hell, the message on my GFs phone said "I don't care about stealing the phone. Will trade cash for it.".

They weren't interested. Bear in mind, this isn't someone complaining about their car at the impound lot in LA, a la Big Lebowski, this is town of about 40,000 with a well-funded PD (I work for Fire in the same town).

The urge to drive to this jokers house in the middle of the night and pour sugar in his gas tank was one I avoided, but only just.

</comment></comment></comment><comment><USER8> I've been in the exact same situation with AWS ( [http://cl.ly/SHOu](http://cl.ly/SHOu) ).

It was a nerve recking couple of days but I contacted AWS support and they were extremely good. They helped me secure my machine and then cancelled the 1.4K payment they were going to take from my account.

In all the whole process took 2.5 weeks and I only had to pay $15 for the I/O requests.

The best thing I can recommend is to talk to your host and tell them honestly you can't pay that much and you weren't the cause of the charges either.

<comment><USER9> In aws, you can set up billing alerts, so they will email you if you go over X per month. It's a good idea to set that up, so at least you'll be alerted as soon as possible if you get hacked.

<comment><USER10> Hacked account => billing alarms get turned off. So you won't find out.

<comment><USER9> Yes, it's not foolproof, but you might get hacked by someone who forgets. It's another lawer of protection.

</comment></comment></comment></comment><comment><USER11> I work for a VPS provider in the US. These situations are common and we usually just issue a credit and give a reminder to the customer to please secure their server

That brings me to my point. How did the hack occur? When you get a VPS you are fully responsible for what goes on in there. It is your responsibility to secure it and keep it updated. It's not the provider's fault you did not apply the latest security updates. It's not the provider's fault your Java application was using outdated and vulnerable libraries nor is it their fault you didn't set a CAPTCHA in front of your submission forms. Either hire a competent sysadmin if you can't take care of that yourself or find a provider that offeres managed hosting instead of a VPS, as that's what you'd most likely need.

There are some cases where it's the provider's fault such as the Linode BitCoin hack a few years back but mostly it's just poor server maintenance

<comment><USER12> People that rent a $15/year VPS use it to run an IRC bouncer or a small web log, something you don't need to know a whole lot of sysadmin stuff for. They just need a machine that's always on.

It's hardly worth hiring a sysadmin for (I find that suggestion laughable, to be frank). Managed hosting doesn't allow you to do much else besides hosting a website in PHP, which is not enough for plenty of use-cases, including OPs.

<comment><USER13> > $15/year VPS

Do tell, where do I get one of those? Cheapest I know of is $60 ($5 a month).

<comment><USER14> Here's one that I know of: [http://ramnode.com/vps.php](http://ramnode.com/vps.php)

Other than that, I'm sure you can find something on webhostingtalk forums.

</comment></comment></comment></comment><comment><USER15> I work for a company that provides VPSes. In a situation like this, they can see the usage is aberrant and they can see it's not normal based on past bills. They'd likely offer a large credit if you say you didn't intend to do this, and it doesn't look like a fraudulent account. That being said, they themselves probably have bandwidth costs, and are not at all likely to forget all of the charge, perhaps half at best.

</comment><comment><USER16> Stop using providers which charge a ridiculous price for bandwidth (like AWS). There are many excellent alternatives where a TB costs only a few dollars/euros.

<comment><USER17> like?

<comment><USER18> Hetzner has the first 20 TB free and then charges 2 euros per TB.

<comment><USER19> Beware: [https://news.ycombinator.com/item?id=6577465](https://news.ycombinator.com/item?id=6577465)

<comment><USER20> Any sane provider with no DDoS protection will nullroute you on incoming DDoS, that's not Hetzner specific.

If you expect to get DDoSed, buy protection or go with OVH.

<comment><USER21> The problem wasn't the nullrouting, it was 'contact support to re-enable... and support isn't open until Monday'.

</comment></comment></comment></comment></comment></comment><comment><USER2> I would begin by contacting your VPS provider, explaining the circumstances which caused the bill, and asking "What are our options?"

</comment><comment><USER22> Have you talked to your VPS provider? They should be able to cut you a break; after all, that 40TB of traffic cost them only a small fraction of what they're charging you, so if they're reasonable you should at least be able to get them to reduce the charges to their actual cost.

You might also offer to suggest writing up a post mortem for them, that they can provide to their customers as a lesson/tutorial on how to protect a VPS.

Finally, you can suggest that they might want to implement (and perhaps help them implement it) some kind of warning system, i.e., if a VPS suddenly begins using exorbitant amounts of bandwidth, and far more bandwidth than it ever has before, they really should email/text the owner an alert within 24 hours — not let it go on for 6 weeks. I'm surprised that they don't cap/throttle the bandwidth once you go over your plan's limit, to go along with sending you alerts. It borders on negligence on their part that they don't already have such a system in place.

<comment><USER23> In my opinion, it is negligence to an extent that OP should not have to pay for this, and he should find a new VPS provider.

<comment><USER24> Why? He failed to secure his server. Why is that the fault of the VPS Provider?

</comment></comment></comment><comment><USER25> Depends on your provider. Amazon AWS is known to have waived such bills in the past, see for example [http://readwrite.com/2014/04/15/amazon-web-services- hack-bit...](http://readwrite.com/2014/04/15/amazon-web-services-hack-bitcoin- miners-github)

</comment><comment><USER26> To prevent such incidents Linode have alerts of traffic/cpu/disk thresholds. For example you can configure notification if your bandwidth utilization more than N Mbit/s in duration more than N minutes. Very useful for DDoS prevention.

<comment><USER27> And look at your dashboards once in a while. I'd find it unusual if I saw my toy VPS cranking out 100mbs for a week straight!

</comment></comment><comment><USER28> I had something similar happen with AWS but the bill wasn't as high since they ended up flagging my box as spam-producing and shut off all outbound traffic. I'd just ask them and see if they can remove the charges, it worked in my case.

</comment><comment><USER29> I had the same thing happen to me. I wrote about it on my blog [http://mattarkin.com/protect-your-azure-linux-vm-aka-how- to-...](http://mattarkin.com/protect-your-azure-linux-vm-aka-how-to- avoid-a-1500-charge/). Basically I complained to Microsoft, they said they'd waive the charge but since it was for a linux vm they said they couldn't cover it. Then I complained to American Express claiming it was an unauthorized and fraudulent charge. Amex sent the dispute to Microsoft and they never responded so I wont the chargeback.

</comment><comment><USER30> I can understand how that could happen and what a problem it would be. I had an experience with a telephone bill myself, but the story is not going to help you.

I would suppose your first and best resort is to consult your lawyer, advocate, solicitor, barrister, Anwalt. I wonder what your relevant legal jurisdiction is.

I wonder whether it would help if you can account for your own whereabouts and your own usage of endpoint data services. I wonder if your method of payment to your VPS provider is mediated by a financial service that can help you dispute the bill.

I am not a lawyer.

</comment><comment><USER31> I assume you are in europe. I'd suggest simply talking with your provider, explaining the issue and asking them to investigate. I honestly expect them to cooperate and be understanding.

If they insist for you to pay: simply don't. State the truth: You can't afford it. Tell them the only way they will see this money is by taking legal action against you and even in that case you won't be able to comply - as you don't have the money.

Hope it helps :(

</comment><comment><USER32> Just in addition to some other helpful comments: based on posting I assume that your are Dutch or Belgian, located in Europe and are buying this VPS as a private consumer, not a company.

Which means your case is probably covered by consumer protection rules when it comes to informing you about data usage, and I seriously doubt a VPS provider has covered their ass as well as mobile providers tend to do.

</comment><comment><USER33> Anyone have tips on how to secure their Linux VPS? I just set one up and disabled SSH password login, locked down all the ports with iptables (using ufw), and enabled fail2ban. Anything else I should install or configure to make myself a little more secure? Was considering tripwire but I dunno how much a headache it would be with false positives as I change things on the server.

<comment><USER34> A very common attack vector is through installed web applications. Especially if you run wordpress with a lot of plugins installed, be sure to enable correct read/write settings for /var/www, and update your application frequently.

Malicious entities runs 24/7 scans towards indexed URL's attempting to exploit various vulnerabilities, and many of the vulnerabilities allows remote code execution, upload of php files etc. This can be used to upload malicious code, simple php-webshells, and then your VPS is suddenly a part of a DDoS/Scanning network.

Exploited Wordpress sites are a problem, Zeus/Zbot-Trojan is often seen downloading updates/configs from these, and they are also often used to redirect users to Exploit Kits.

<comment><USER35> I came across these two tools recently that seem interesting: [http://www.rfxn.com/projects/linux-malware- detect/](http://www.rfxn.com/projects/linux-malware-detect/) [https://github.com/emposha/PHP-Shell- Detector](https://github.com/emposha/PHP-Shell-Detector)

Not installed either yet (LMD could really use some .deb packages) but could be a useful alternative to Tripwire

</comment></comment></comment><comment><USER36> PSA: Set up billing alerts! You should always have a notification sent to you when your monthly bill exceeds one or more dollar amounts. For example, if you're using AWS, Amazon CloudWatch lets you set an alarm on a billing metric to notify you automatically.

</comment><comment><USER37> Post on WebHostingTalk.com - just do it. You'll get attention from the host, other hosts who will sympathize, and you'll see that they'll just write it off.

Post the link when you do and I'll be sure to comment on it (I'm somewhat very-active at WHT)

</comment><comment><USER38> I seem to be missing something. You knew it was happening when you got the first bill, but let it continue for another half month before shutting it down?

</comment><comment><USER39> In addition to the other comments, make it absolutely clear to them (with proof if needed) that you're a student.

</comment><comment><USER40> Make sure Elastic Search is not accessible from a public IP address (this is what likely got you in the mess to begin)

</comment><comment><USER41> Do you know how you got hacked?

</comment><comment><USER42> cut your credit card report it as stolen tell the host that it wasn't u :p

</comment><comment><USER43> I feel really sorry for you situation. I first suggest talking to the hosting provider and explain what happened. Any decent service will give some discount in this case.

Unfortunately, I can't think of anything else. I wish it was realistic to tell you to go to the police.

Also, if you would give your email, I would definitely consider sending a donation through paypal... Hopefully other readers here will do the same.

<comment><USER2> There is one _great_ reason to go to the police: it establishes a paper trail documenting that a crime was committed. It isn't necessary that the police catch the bad guys for that paper trail to be advantageous.

(Examples: police reports make CC disputes and legal declarations much easier and more likely to be given weight as other than self-serving explanations of a deadbeat. It may also trigger insurance policies either for you or for the VPS company.)</comment></comment>


An Entrepreneurial Fix for the U.S. Economy - <AUTHOR> http://online.wsj.com/article/SB10001424053111903480904576512683292295492.html

<comment><USER2> This is superficially interesting, but the article is too short to explore the ramifications of the proposed changes. I'm looking at the Kauffman foundation report now (<http://www.kauffman.org/research-and-policy/startup-act.aspx>), but my seat-of-the-pants reaction to the proposals goes like this:

 _Letting in immigrant entrepreneurs who hire American workers._

Sure...but why not just open up the labor market and have done with it, rather than trying to predict in advance which immigrants will adjust the demand side? I think this is a necessity given the US's demographic problem (ie making sure there are enough workers to fund social security in the coming years), but it won't lead to endless expansion since both demographics and regional wage competition are projected to even out during the 2030s.

 _Reducing the cost of capital through capital gains tax relief for early stage investments._

I'd like to see numbers on this. The startup world appears to be awash in cheap capital already and that taxes are on capital gains rather than capital investments - in other words, you're not paying that tax unless your investment make a profit. Capital gains tax is already fairly low compared to income taxes, and many would argue that the problem is not early stage access to seed capital but mid-stage access to revolving capital during a period of slack demand. ISTM that demand is going to remain slack until the housing market is more predictable and the consumer debt overhang is gone.

 _Reducing barriers to IPOs by allowing shareholders to opt out of Sarbanes- Oxley._

This seems sensible, since the cost of compliance for SarbOx is high. But if large firms already have that priced in, how does one avoid a two-tier system whereby opted-out companies are unable to get an 'investment grade' rating for their commercial paper? Again, it would help to have some numbers quantifying the cost of compliance, and some kind of strategy for dealing with the corner cases where bad faith or incompetence result in serious losses.

 _Charging higher fees for patent applicants who want quick decisions to remove the backlog of applications at the Patent Office._

Wouldn't it be better for Congress to just let the patent office keep its own fees? Selling access just raises the barrier to entry and effectively cedes control of the patent landscape to big players like IV or various large corporations that already devote $$$ to patent litigation. If anything, this change would reduce the negotiating power of entrepreneurs with patentable ideas during pre-IPO funding rounds.

 _Giving licensing freedom to academic entrepreneurs at universities to accelerate the commercialization of their ideas._

That one went over my head - I thought this was already allowed under the Bayh-Dole act, and with relatively low transaction costs.

 _Having the government provide data to permit rankings of startup friendliness of states and localities._

Surely this is better provided by someone like Gartner group or some other entity. Assigning bureaucrats to the task of measuring bureaucracy seems perverse. Information about incorporation fees, median wait times, and tax regimes is already available on state websites, and evaluating it is exactly the sort of thing one pays lawyers and accountants for. That falls under 'due diligence' from an investment standpoint.

 _Regular sunsets for regulations and a consistent policy of putting new ones in place only if their benefits exceed their costs._

I'm for sunsets, legislative performance targets, and empirical microeconomics in general. But again, more specificity is needed here: what sort of regulations do the authors consider wasteful? There are pointless regulations like excess credentialism, but many regulations exist to address real problems. I was sort of happy to see the FDA requiring the recall of turkey meat a week or two back, since I'd rather not consume _e. coli_ -tainted food.

EDIT: the pdf on the startup bill (at the link above) addresses quite a few of my objections, is well-argued in many respects, and is moderate rather than partisan. Still, I stand by my basic contention that much of the problem stems from economic uncertainty on the demand side, rather than a paralyzing excess of red tape on producers.

To take the HN community as an example, when did you last see people complaining about the inability to procure a business license or the complexity of buying worker's comp insurance? Has anyone actually thrown up their hands and moved their firm across state lines to reduce their fixed or marginal cost of doing business, or shut a firm down and handed the money back because the administrative costs didn't make economic sense?

</comment><comment><USER3> Ah, yes...the usual conservative shopping list: de-regulation (eliminate Sarbanes-Oxley! Sunset regulations!), tax cuts for the rich (Who likes capital gains taxes? Certainly not the hard-scrabble "entrepreneur" managers of "small-company" hedge funds!), privatize shared knowledge (Make it easier for rich people to get patents, and commercialize academic research!). But somewhat unsurprisingly, the WSJ omitted an extremely important bullet:

* single-payer health care.

It's a huge problem. Gigantic. How many people in the US are putting off their entrepreneurial dreams because they're afraid of being waylaid by the costs of unexpected health problems? I'm not that old, and it worries me. It has to be terrifying to people with families.

Dear WSJ: if you want me to take your opinions about "entrepreneurship" seriously, you have to stop proposing things that benefit the old economic guard (I've yet to meet an entrepreneur who would start a business _but for_ the capital gains tax), and start proposing things that benefit _actual entrepreneurs_. (And by "entrepreneur", of course, I mean _"someone starting a business"_ \-- not _"someone managing a hedge fund"._ )

But, of course...I'm being willfully naïve. The WSJ doesn't _really_ want to benefit entrepreneurs. They want to help the rich people who read the WSJ, and dress it up to _look_ like they're helping entrepreneurs. Big difference.

<comment><USER4> I'll ignore your partisan bile and address your salient point (Yes, regulations do have costs. Sorry.).

My friend's startup was offering health insurance within 6 months after it was initially incorporated. Most of the founders had some sort of individual plan or COBRA before then. Are you telling me that there are many people out there resourceful enough to be successful entrepreneurs but not resourceful enough to cover that gap? Count me among the skeptical of the idea that government health care will unlock a torrent of entrepreneurial energy.

If government support is necessary for entrepreneurs, why isn't Silicon Valley located in old Europe?

I have to admit that the idea that government provided health care is necessary for entrepreneurship has been a successful meme. I see it repeated everywhere even though I haven't heard a convincing case for it. You gotta admire the persistence and message discipline if nothing else.

<comment><USER5> partisan bile? Sounds more like the poster is an independent who's tired of Big-C vs. Big-L politics and really wants pragmatic change, not partisan line- toeing.

Look, I don't know what age you are, but health care at upper-30s is no easy street, and from what I hear, it gets much, much worse. Just in the past year, I dropped 10K on health care expenses, and that is _with_ fantastic insurance.

Edit: and, seriously - I'm no slouch. I'm an extremely healthy upper-30s guy who runs, weight-trains, eats like godliness. I'm guessing the audience of HN is probably lower-middle 20s. Well, trust me, health problems still creep up (on some of us), even with uber lifestyle.

<comment><USER3> _"partisan bile? Sounds more like the poster is an independent who's tired of Big-C vs. Big-L politics and really wants pragmatic change, not partisan line- toeing."_

I think I'm an independent, but it's probably objectively possible to look at my position here, and claim that I'm siding with the Democrats. So be it: if the Democrats want single-payer health care, then I'm on their side, and I guess it makes me "partisan" in the eyes of people who disagree.

There's nothing inherently wrong with being partisan -- the problem comes when people are partisan without reasons beyond party affiliation. Demonizing "partisanship" is a rhetorical trick that dresses up _ad hominem_ attacks as legitimate debate.

<comment><USER4> "Partisan bile" refers to your snarky dismissal of the case for deregulation. There are real problems with regulation, including Sarbox. The law has encouraged cartelization of the economy by pushing firms towards acquisitions instead of IPOs. Most regulation punishes startups and protects incumbents. Sometimes the benefits are worth it but often they are not.

<comment><USER3> I said that degregulation was part of the usual conservative shopping list (which it is). That particular remark was no more or less snarky than the rest. But if your primary objection is that I'm snarky...well, that's great. My argument remains.

In any case, I'm the first person to admit that there are problems with Sarbanes Oxley. I think that parts of the law were a total over-reaction to the situation, solving nothing. But I'd rather see _ammendments_ to the law than a wholesale _retraction_. And that's where I differ from most conservatives.

</comment></comment></comment></comment></comment></comment><comment><USER6> Somehow I doubt startup founders have been desperately waiting for a new government bureaucracy that will finally give them a way of finding out good locations to start a new company.

<comment><USER7> Yeah, this part of the article is a waste of space...</comment></comment>


CSS Triggers - <AUTHOR> https://csstriggers.com/ <comment><USER2> Let's talk data vis for a minute. The three values are sequential, so there's no need for tic-tac bar charts on every item. There's also no need for two colors in the same chart, that's just more cognitive load. Something like this is crying out for a heat map, so you can quickly scan.

Here's my take after some quick hacking: [https://i.imgur.com/w4AkvQb.png](https://i.imgur.com/w4AkvQb.png)

<comment><USER3> Accessibility guy here. Don't forget that color blind/low vision users are going to have a tough time parsing meaning from that table. Color shouldn't be solely responsible for conveying informational meaning. Consider pairing color with another visual indicator like an icon.

<comment><USER2> Hi Accessibility guy! I haven't had a chance to work directly with someone in this field, so this'll be fun.

Quick experiment - changing border-size, border-radius, and intensity. Basically things get darker and more filled in the higher the level of consequence. Would this fly for the vision impaired?

[https://imgur.com/V4J3B8V](https://imgur.com/V4J3B8V)

<comment><USER3> I think the problem is how subtle the gradation/intensity can be between steps. Icons may not honor the aesthetic you are aiming for, but they manage (with a labelled legend) to get the job done of explaining this table for every user.

<comment><USER2> My concern is scan-ability. Introducing icons introduces shapes, which in turn increase cognitive load. On a layout like this, simplicity is key in order for users to process all the information. I did experiment with Gestalt principles (I've always wanted to say that!) and created a flat black line that rotates in 45 degrees increments for levels of difficulty. Seemed to tick off the basic vision impaired requirement - single color, no intensity changes, and works in B&W (Something all data vis is supposed to do).

This has been fun!

</comment></comment></comment></comment></comment><comment><USER4> Two things to keep in mind:

\- This is a google chrome project

\- Hasn't been updated in 2 years [gecko ~1 year] (which is a LOOONG way ago in browsers time)

[https://github.com/GoogleChrome/css- triggers/tree/master/dat...](https://github.com/GoogleChrome/css- triggers/tree/master/data)

<comment><USER5> It's under GoogleChrome on Github but readme mentions it's not a Google project.

> Please note: this is not a Google product

<comment><USER6> Virtually every tool produced by individual Google teams has that disclaimer unless it is actually marketed as a Google product.

<comment><USER7> Also individual Googlers who want to open source their work without going through the copyright assignment paperwork.

A lot of the projects bearing that disclaimer are passion projects done 100% outside of work hours.

</comment></comment></comment></comment><comment><USER8> Why is this important: [https://developers.google.com/web/fundamentals/performance/r...](https://developers.google.com/web/fundamentals/performance/rendering/)

TL;DR rendering performance

<comment><USER9> You should take these advices with a grain of salt because it refers to the _legacy_ rendering pipeline used by current web browers.

There is not absolute rule stating that layout and painting must be slow while compositing is not. In fact Mozillians are currently working on a new rendering pipeline[1] based on state of the art rendering tools[2]. This new pipeline should be deployed in firefox in 2018 as a part of the ongoing Quantum project.

[1] [https://github.com/servo/webrender](https://github.com/servo/webrender)

[2] [https://m.youtube.com/watch?v=BTURkjYJ_uk](https://m.youtube.com/watch?v=BTURkjYJ_uk)

<comment><USER10> Yeah, but it makes sense to follow it now, as it affects us now and will continue to do so through at least 2018, until everyone has updated their renderer.

</comment></comment></comment><comment><USER11> Looks like a nice reference for optimizing layout - haven't done much of that but I'll save this if I ever need to.

One note - the color scheme/presentation on the bars is kind of confusing (what do white bars mean vs. faded out bars ? I'm assuming one is no results and the other is not triggered ?)

<comment><USER12> Wondering the same. Is gecko just very good or is it no data?

A few sentences on top explaining what one is looking at and what it means would be a good idea.

</comment></comment><comment><USER13> An explanation of what this is would be good.

<comment><AUTHOR> Using certain CSS properties will trigger various phases of rendering in browsers. For performance reasons you want to do the minimum amount of work possible.

An example: adjusting the width of an object will understandably cause the browser to relayout the page in every browser. But what if you just wanted an animated bounce effect? You could animate the width of the object, but in practice a scale transform would perform much better in most browsers as it typically doesn't trigger a relayout.

So this page just gives you information about which phases are triggered by which properties in which rendering engines.

<comment><USER14> I believe blue1 meant that the page could do with a short explanation at the top… I was wondering the same thing until I realised what it was about.

</comment></comment></comment><comment><USER8> What is the method of collecting this information? Lecture of [https://github.com/GoogleChrome/css- triggers/issues/21](https://github.com/GoogleChrome/css-triggers/issues/21) shows that it might not be accurate.

</comment><comment><USER15> I would be interested in finding a way to include this information when I edit css/sass in Emacs. Is there something I could use or would I need to write a new minor mode myself? (I have been using Emacs for some time now but rarely write any elisp myself.)

</comment><comment><USER16> When you tap the header status bar on mobile safari this site doesn't scroll back to top. Why?

</comment><comment><USER17> That would be useful if integrated with caniuse.com.

Overall you'll learn everything will trigger everything.

</comment><comment><USER18> Cool website. I just wish it didn't break my back button.

<comment><USER19> Yeah, it completely abuses history.pushState...

</comment></comment><comment><USER20> If you're spending time worrying about this you're either working on an incredibly mature product with nothing other than micro-optimisations left as business requirements, or you don't understand opportunity cost.

<comment><USER21> Per-frame layout (and sometimes paint) is the main cause of janky animation in browsers, especially mobile.</comment></comment>