Defer: Taming asynchronous javascript with coffeescript - <AUTHOR> http://gfxmonk.net/2010/07/04/defer-taming-asynchronous-javascript-with-coffeescript.html

<comment><USER2> Nitpick: the beautiful thing about Smalltalk's continuation support is that it's _not_ provided by the compiler. (As far as I know, Squeak still doesn't ship with continuation support built-in.)

Despite this, because stack frames are first class objects in Smalltalk, it's very easy for the user to implement continuations. You just traverse the stack to capture the continuation, and switch stack frames with the continuation's in order to invoke it. The resulting Continuation class is almost improbably literal in its implementation.

This is what frameworks like Seaside do.

<comment><AUTHOR> Thanks, good point. I actually meant to reference scheme, not smalltalk - as I believe that's where continuations were first done. I believe it is provided by the runtime in scheme (but still, not the compiler). I've corrected the post now.

</comment></comment><comment><USER3> For extra reading material for the curious, the history of the proposed implementation of "defer" in CoffeeScript:

Part I: <http://github.com/jashkenas/coffee-script/issues/issue/241>

Part II: <http://github.com/jashkenas/coffee-script/issues/issue/287>

Part III: <http://github.com/jashkenas/coffee-script/issues/issue/350>

If you have a suggestion for how to handle the bits of "defer" that are still undecided, such as how to handle the "return" statement, and enforce a callback parameter, please feel free to add it to the third ticket.

</comment><comment><USER4> Good intro to continuations, but just reinforces the reasons I dislike them and wouldn't use them.

Also disagree about "What is asynchronous programming, and why is it so damn awkward?"

It's not awkward in the least. Either you write your code to remember the things you need to remember, or you use something like continuations which will be pretty inefficient and ugly (IMHO).

<comment><USER5> Continuations can certainly be ugly (under some circumstances), and difficult, too. But there's no reason why this particular implementation of continuations needs to be inefficient—it has a one-to-one mapping with ordinary asynchronous JavaScript, and it generates exactly the code you'd otherwise write by hand.

Overall, I think this is a win for clarity. But I think the author should also transform functions that take a callback argument, and implicitly convert them to continuation style. Perhaps this could by adding the callback parameter automatically and transforming 'return' into a callback invocation?

async function (x) { return x; } =>

function (x, callback) { callback(x); }

<comment><AUTHOR> Regarding transformations of returns, the initial implementation added an anonymous callback argument and converted returns into using it. But that takes the option of using the callback out of the programmer's hands, and is entirely non-obvious for someone calling the function (the number of parameters required is one more than those listed in the function definition)

I plan to write a follow-up shortly that discusses possible approaches of doing this sort of thing, and your suggestion is one of the ideas I'm going to explore. Thanks for reading & commenting :)

</comment></comment></comment><comment><USER6> Apart from being a cool bit of tech, this is a really good writeup.

</comment><comment><USER7> Things like Coffeescript and Objective-J make me nervous. Javascript is flawed certainly but building a completely new language on top of it feels too radical. An abstraction like that seems bound to be leaky and it doesn't seem like you'll ever completely escape working with other native JS pieces so why not stick to a single, common syntax with good tool support, tutorials, docs, libraries etc? Javascript's not that bad a language once you establish some conventions.

<comment><USER3> CoffeeScript is just for fun -- it's a thought experiment that tries to see how far we can run with JavaScript semantics towards a more usable language.

Apart from the fact that both compile to JavaScript, CoffeeScript and Objective-J don't really sit together in the same boat. Objective-J is an actual runtime and interpreter: every single method you call is intercepted and handled by "objj_msgSend", so that things like method_missing are possible. See:

[http://ejohn.org/blog/javascript-language- abstractions/#comm...](http://ejohn.org/blog/javascript-language- abstractions/#comment-323770)

CoffeeScript limits itself to current common patterns of JavaScript in practice, and (in a perfect world) would compile 1-to-1 into the JavaScript you _would_ have written. Unlike an implementation of Ruby or Python in JavaScript, where even simple things like numbers work quite differently, the semantics of CoffeeScript are just JavaScript semantics -- so there shouldn't be anywhere for the abstraction to leak.

As to sticking to a single common syntax -- that's a very good argument, and I'd have hesitations introducing CoffeeScript into a team project. But if you just want to play around with a fun way to write JS. I encourage you to give it a spin. For an example, take a peek at this implementation of the Buddhabrot fractal (the render will peg your CPU, so use Chrome):

[http://jashkenas.s3.amazonaws.com/misc/buddhabrot/buddhabrot...](http://jashkenas.s3.amazonaws.com/misc/buddhabrot/buddhabrot.html)

Here's the CoffeeScript that runs it:

<http://gist.github.com/463880>

And here's the compiled JS (not too different):

<http://gist.github.com/463881>

<comment><USER7> Thanks for the explanation. It's definitely a cool hack. Looks like a fun project.

</comment></comment></comment><comment><USER8> Why not call it callCC instead of defer? Aside: great intro to continuations, I now understand them!

<comment><USER9> I think you almost answered your own question. callcc makes people have to understand continuations and is confusing, while "defer" fits better with the control flow that most people have in mind already.</comment></comment>


Photography and Design iPhone app – Mooz - <AUTHOR> http://getmooz.com/

<comment><AUTHOR> This is our first app and we are launching very soon. You will be able to do a lot of great staff with it and it's an unique app. Subscribe to get notified when we launch.</comment>


SpiderOak Encryptr – Zero-Knowledge Password Syncing - <AUTHOR> https://github.com/SpiderOak/Encryptr <comment><USER2>
        Requirements:
            Node and npm - http://nodejs.org/
                Node package manager for the Cordova CLI and Grunt
            Cordova CLI - https://github.com/apache/cordova-cli/
                Cordova / PhoneGap command line interface
                npm install -g cordova
            Grunt - http://gruntjs.com/
                Build tool for minimising, running and tests
                npm install -g grunt-cli
            PhantomJS - http://phantomjs.org/
                Headless webkit for running tests
            Cordova-icon and Cordova-splash - https://github.com/AlexDisler/cordova-icon/ and https://github.com/AlexDisler/cordova-splash/
                npm install -g cordova-icon and npm install cordova-splash

Nope. Nope nope nope.

<comment><USER3> I'm not clear on what exactly your problem is here.

<comment><USER4> Not that guy, but that's a ridiculously bloated set of requirements.

<comment><USER3> The language it's written in, the testing framework, and the support library that lets it target more platforms? That doesn't seem too bloated to me.

<comment><USER5> > That doesn't seem too bloated to me.

For a security software? It may not be too bloated for a web app, but for a piece of security software it is absolutely bloated.

Note: I'm not talking from a utility point-of-view, that "C'mon, writing a security-related app doesn't have to use so much stuff".

I'm talking from a safety point-of-view, that "Security stuff should absolutely not have such a large code footprint".

</comment></comment></comment></comment></comment><comment><USER6> I was slightly puzzled what they meant by "zero-knowledge encryption", but after looking around a bit it looks to be more of a buzzword than really related to zero-knowledge proofs (besides them using SRP for password validation). As far as I know, all password managers like Lastpass, 1Password, etc. use client-side encryption of data. Does this do anything new?

<comment><USER7> Yeah, it's puzzling why SpiderOak persists in using the term "zero knowledge" to mean something entirely different from ZKPs. As far as I can tell they're the only ones doing this too.

Especially with zkSNARKs and practical applications like Zcash, all I can think this will accomplish is confusing people.

<comment><USER8> They tried to coin a new (unrelated) sense of this term about two years ago in order to try to explain services where the service provider doesn't have access to your data. I agree that it's confusing because of the much more clearly established technical term with a different meaning, and I don't think SpiderOak's sense has caught on outside of the company.

Can anyone suggest a better term? Some people like "end-to-end encrypted" even in this context, but that doesn't really make sense for data at rest, which is almost all of what SpiderOak's products deal with.

Edit: SpiderOak has had a _super_ -hard time marketing their privacy features to people who aren't already familiar with the fairly stark distinctions in play in different access models. I'm sure they would appreciate if someone came up with a straightforward way to explain "products where the service provider doesn't have access to your data, and can't get access without your help in any circumstances because of technical constraints".

<comment><USER2> Steve Gibson calls this type of design "Trust No One" (TNO), which I quite like.

But I think "end-to-end encrypted" is fine and has caught on with the public to some extent.

<comment><USER9> Of course, you can't really get to "Trust No One" level unless you build your own computer by hand and write its entire software stack from scratch. It's kind of an arbitrary distinction, otherwise.

</comment></comment></comment></comment></comment><comment><USER10> I'm a little confused by this. The project page makes it sound like someone's weekend project, complete with a donation link, but in fact it seems to be the client for one of SpiderOak's products.

In any case, I'm having fun reading about some of the projects used to build this, including Crypton. Will this work with any Crypton server, or is it somehow tied to SpiderOak?

Edit: "I am happy to announce that SpiderOak has acquired Encryptr" (blogs.devgeeks.org).

<comment><USER11> Yes, Encryptr and Crypton (the framework and server) are both fully open, in that you can run with your own server. SpiderOak also provides a public free server. [https://github.com/SpiderOak/crypton](https://github.com/SpiderOak/crypton) \- Erin @ SpiderOak

</comment></comment><comment><USER12> I prefer pass, which uses GPG and regular bash scripts to store passwords. You can sync the directory of encrypted passwords via git too. No fancy stuff.

[https://www.passwordstore.org/](https://www.passwordstore.org/)

<comment><USER13> What is the easiest way to access such a store from a phone?

Assume I have synchronized the encrypted files myself.

<comment><USER14> For Android: Password Store! [https://github.com/zeapo/Android-Password- Store](https://github.com/zeapo/Android-Password-Store) It's on F-Droid (not sure about Google Play) and it works really well. You need another app to manage your keys, but there is OpenKeyChain for that (also on F-Droid).

</comment></comment></comment><comment><USER15>
        Latest commit 5fdc936  on Dec 18, 2015

Is this still an active project? 4 months is a long time to pass without a commit published.

<comment><USER16> Sometimes software is just "done", you know, or only needs updates every few years.

<comment><USER17> That there are 93 issues including what appear to be UI issues implies that this project is probably not in that category though.

</comment></comment></comment><comment><USER18> I am an academic who works on zero-knowledge proofs; as far as I can tell, this system has _nothing_ to do with the Turing-award winning concept of "zero-knowledge." Based on the information on the website, my opinion is that the author is gratuitously appropriating the term "zero-knowledge" here.

</comment><comment><USER19> WebPass ( [https://webpass.rkeene.org/](https://webpass.rkeene.org/) ) is similar -- its syncing is done by encrypting the list of sites (note that passwords are never stored or encrypted) and sending that from one client to another (no server ever stores the encrypteed list of sites).

It's also an iOS/Chrome webapp so it will act like a native app in some ways.

It's also a single JavaScript file which isn't too heavy. The sync'ing is done by a simple process that reads what another client writes implemented as a CGI talking over a FIFO.

</comment><comment><USER20> Previously: [https://news.ycombinator.com/item?id=9976158](https://news.ycombinator.com/item?id=9976158)</comment>


Oberon System, an OS Written in Oberon - <AUTHOR> https://en.wikipedia.org/wiki/Oberon_(operating_system) <comment><USER29> Anyone that likes Wirth line of OS's and languages should check out the Modula-2 revision:

[http://modula-2.info/m2r10/pmwiki.php/Project/FAQ](http://modula-2.info/m2r10/pmwiki.php/Project/FAQ)

FAQ asks good questions and with rational answers. I'm still going to fight them on uppercase just for sake of adoption and saving pinky fingers. Otherwise, Modula-2 makes a nice C replacement and a start on safer C++ alternative that's easy to grok. The language was originally used in Wirth's and Jurg's first homebrew system, Lilith. I have a link to that and many other Wirth works here:

[https://news.ycombinator.com/item?id=10479213](https://news.ycombinator.com/item?id=10479213)

Anyway, Modula and Oberon have already been used to build a number of maintainable, safer OS's and system software. Oberon did it with a GC for most of it while Modula-2 just tried to be safer about memory management. Very easy to compile & optimize. Adding macros for low-overhead abstractions and a solid stdlib to that would give a differentiator in systems programming without learning curve of Rust or C++.

Go achieved some of this already in application language space. It was a modern attempt on the Oberon programming experience. So, some precedent for my Modula-2 ideas being able to take off. I'll be fine if Modula-2R10 or an Oberon variant ends up a niche language with supported, constantly-enhanced compiler & decent community. It would be another secret weapon for startups like LISP, Ocaml, Haskell, and so on were. This time for systems or embedded use.

[http://www.astrobe.com/default.htm](http://www.astrobe.com/default.htm)

[https://www.cs.cmu.edu/~chuck/pubpg/luv95.pdf](https://www.cs.cmu.edu/~chuck/pubpg/luv95.pdf)

[http://www.algo- prog.info/ocapic/web/index.php?id=OCAPIC:OCA...](http://www.algo- prog.info/ocapic/web/index.php?id=OCAPIC:OCAPIC)

[https://hackage.haskell.org/package/atom](https://hackage.haskell.org/package/atom)

Ooops, maybe _again_ for embedded use. :)

<comment><USER30> Back in the '80s, I got tasked to implement a prototype distributed OS that a team at JPL had just spent all but a little less than a year of a 5 or 6 year DOD contract designing (with a bit more than 6 months to a big conference where it was supposed to be demoed). After I gave my estimate of what I could produce in the time remaining, the design team said that that was impossible. Modula-2 (embodied in a Logitech(!!) compiler and standard library) came through with flying colors. OS ran on 8 Vax 725's. Pull the plug on one running unique processes, they would restart on another. Ditto for splitting the net.

[0] [http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=ht...](http://oai.dtic.mil/oai/oai?verb=getRecord&metadataPrefix=html&identifier=ADA124379)

<comment><USER29> As in the Logitech mouse/keyboard company? If so, that makes them more awesome haha.

It's great that you used it to (rescue?) a distributed OS project. Thanks for the paper, too, as some of us collect these for any wisdom that might be lost to time. I'll read it when I have more time.

<comment><USER31> At that time, Logitech had great developer tools. Their debugger was well known.

</comment></comment></comment></comment><comment><USER32> Here's Niklaus Wirth's talk about his Project Oberon revival project at his birthday symposium: [http://www.multimedia.ethz.ch/conferences/2014/wirth/?doi=10...](http://www.multimedia.ethz.ch/conferences/2014/wirth/?doi=10.3930/ETHZ/AV-d40b0ce9-b9fa-4ba3-8dee- cf9d0c6f01a4&autostart=false)

I was at that symposium :)

<comment><USER33> Maybe you also know how to stretch this video full screen?

<comment><USER34> There are mp4 links in the sidebar: [http://replay- progressive.ethz.ch/h264-medium.http/10.3930/E...](http://replay- progressive.ethz.ch/h264-medium.http/10.3930/ETHZ/AV-d40b0ce9-b9fa-4ba3-8dee- cf9d0c6f01a4/20140220_1730_HGF30_WirthSym_Wirth-dm.m4v)

</comment></comment></comment><comment><USER35> Wirth is still tweaking its code, you can follow news here: [https://www.inf.ethz.ch/personal/wirth/news.txt](https://www.inf.ethz.ch/personal/wirth/news.txt)

</comment><comment><USER36> Our first year university computer science course was all done in Oberon. Had to write a small parser et al. I absolutely hated the Oberon interface.

<comment><USER29> It's a weird interface. Have you tried A2 Bluebottle? It's in that line but not as bad.

Regardless, I promote it for consistent, system design with safer language that's efficient, portable, compiles fast, and mostly GC'd. Good traits other systems should emulate even if not the extra-weird interface.

Note: One thing about the interface is how it was ahead of the curve on hyperlinks. You can click highlighted text to perform actions and move around in the system. Sound like something that became a ubiquitous interface? ;)

<comment><USER30> The Oberon interface that I loved was in Oberon microsystems's Oberon F/Component Pascal system, originally available on Mac OS and Windows. Unfortunately, they never brought it from classic Mac OS to OS X, only continuing the Windows development (and eventually abandoning further development of it [but they did open source it]).

<comment><USER29> Is that interface still preserved in the modern Blackbox on Windows? Found this great presentation on both it and all the concepts it uses for robustness:

[http://www.pas.rochester.edu/~skulski/Presentations/BB_Class...](http://www.pas.rochester.edu/~skulski/Presentations/BB_Class.pdf)

I keep thinking I need to play with it as it looks to be a great tool. Like an engineer's version of Visual Basic 6 I started on. Super easy to use, fast, and code-generating for GUI's without huge issues of C development. The complexity chart was nice while showing good old ALGOL and Turbo Pascal 2.0 fit nicely in the middle. I think the Oberon's are too simple but Component Pascal seems better.

Add Design-by-Contract and some more safety features to give Eiffel + Ada some nice competition in robust, OOP space. :)

<comment><USER37> What I liked about Component Pascal was that it extended Oberon-2 to have an OOP model more close to Object Pascal as exposed by Turbo Pascal.

Also their designers were pushing for programming with components, instead of pure OOP. Basically a type safe way of doing COM.

The first edition of "Component Software: Beyond Object-Oriented Programming" used mostly Component Pascal examples.

[http://www.amazon.com/Component-Software-Object-Oriented- Pro...](http://www.amazon.com/Component-Software-Object-Oriented-Programming- Addison-Wesley/dp/032175302X)

<comment><USER29> It sounds so good that I'd be ready to ditch the opportunity of Modula-2 revision for it if I was an OOP fan. I'm still not convinced it's necessary or even ideal for various tradeoffs. Besides, whether it is or isn't, Modula-2 might be worth reviving just as a C alternative for low-level stuff with more safety. I think investigations into and development of both simultaneously is justified.

<comment><USER37> You also have the Basic and Pascal compilers from Mikro Elektronika.

[http://www.mikroe.com/mikropascal/](http://www.mikroe.com/mikropascal/)

[http://www.mikroe.com/mikrobasic/](http://www.mikroe.com/mikrobasic/)

<comment><USER29> That's great. I didn't know about them. So, that's Pascal, BASIC, and Oberon available for microcontrollers with Mikro in the lead. The other links look like they're a one stop shop. Increases odds that everything integrates well.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER38> The best thing I got out of Oberon was the Syntax font (which was the default proportional typeface). It's a really nice font (it's essentially a sans serif font with classic details, hints of serifs, and subtly tapered strokes -- a great antidote to an overdose of Helvetica).

[https://www.myfonts.com/fonts/linotype/syntax/](https://www.myfonts.com/fonts/linotype/syntax/)

</comment><comment><USER39> There sure are some odd articles climbing to #1 on Christmas day on HN.

<comment><USER40> I think it relates to the audience still online today. It must say something about the interests of the offline people :)

<comment><USER29> Does that mean the people chasing fads are off chasing a long-lasting fad while mere rational people are still being rational? ;)

<comment><USER40> I can't tell.

My hypothesis is that there is a smaller presence of hype-oriented people (usually the majority), to skew off the first-page. Oberon submissions are in a niche that would be quickly overwhelmed on a normal day.

<comment><USER30> Actually, Oberon has a fairly strong support on HN. Here are scores for the last year's Oberon story submissions:

Project Oberon 417 points Fenume 6 months ago 87 comments ([http://www.projectoberon.com/](http://www.projectoberon.com/))

OberonStation, an Oberon RISC workstation 130 points sinrostro 2 months ago 96 comments ([http://oberonstation.x10.mx](http://oberonstation.x10.mx))

Oberon – The Overlooked Jewel (2000) [pdf] 78 points marsmxm 4 months ago 23 comments ([http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90....](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.7173&rep=rep1&type=pdf))

Oberon System, an OS Written in Oberon 46 points DiabloD3 3 hours ago 20 comments ([https://en.wikipedia.org/wiki/Oberon_(operating_system)](https://en.wikipedia.org/wiki/Oberon_\(operating_system\)))

Project Oberon Emulator in JavaScript and Java 38 points cylinder714 4 months ago 10 comments ([http://schierlm.github.io/OberonEmulator/](http://schierlm.github.io/OberonEmulator/))

Oberon vs. C++ (1994) 26 points networked 9 months ago 18 comments ([http://www.modulaware.com/mdlt49.htm](http://www.modulaware.com/mdlt49.htm))

Oberon operating systems 9 points networked 5 months ago 0 comments ([http://www.progtools.org/article.php?name=oberon§ion=compile...](http://www.progtools.org/article.php?name=oberon§ion=compilers&type=tutorial))

<comment><USER41> For perspective, count of stories submitted:

php - <USER2>

javascript - <USER3>

python - <USER4>

ruby - <USER5>

java - <USER6>

cobol - <USER7>

node.js - <USER8>

c++ - <USER9>

lisp - <USER10>

haskell - <USER11>

scala - <USER12>

perl - <USER13>

swift - <USER14>

c# - <USER15>

erlang - <USER16>

modula-2 - <USER17>

rust - <USER18>

object-c - <USER19>

coffeescript - <USER20>

lua - <USER21>

pascal - <USER22>

f# - <USER23>

ada - <USER24>

typescript - <USER25>

modula-3 - <USER26>

oberon - <USER27>

fortran - <USER28>

<comment><USER42> golang didn't show up? My thoughts are because of it's name makes it hard to identify correctly, possibly?

<comment><USER41> Yes, there was too much noise.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER43> I've written a fair amount of code drinking Oberon. So...

<comment><USER29> These?

[http://www.oberonwines.com/oberon-wines-napa- valley.html](http://www.oberonwines.com/oberon-wines-napa-valley.html)

<comment><USER44> Presumably this:

[http://www.beeradvocate.com/beer/profile/287/1094/](http://www.beeradvocate.com/beer/profile/287/1094/)

<comment><USER29> Another candidate. Due to simplicity focus, "Oberon Ale is brewed with the only the fewest ingredients." Haha.</comment></comment></comment></comment>


Source code of Polish electoral voting system? - <AUTHOR> https://github.com/wybory2014/Kalkulator1/blob/master/Kalkulator1/ClassMd5.cs <comment><USER2> The sourcecode wasn't leaked - an internal website (with the software, written in C#) [1] was leaked, and then the program was decompiled and pushed to GH.

EDIT: The website leak itself is actually pretty old news, but the decompilation and public shaming of the code itself is relatively new. "Zaufana Trzecia Strona" has more information [2] about the leak itself (in Polish).

[1] - [http://zapasdlakbw.home.pl/kalkulator- wyborczy/kalkulator/](http://zapasdlakbw.home.pl/kalkulator- wyborczy/kalkulator/)

[2] - [http://zaufanatrzeciastrona.pl/post/wersja-testowa- systemu-p...](http://zaufanatrzeciastrona.pl/post/wersja-testowa-systemu-pkw- dostepna-publicznie-w-trybie-debug/)

<comment><USER3> Aren't you talking about backend? The code on github is a client used by a polling place and it was publicly available (this is how they've it distributed)

</comment></comment><comment><USER4> Summary of the more interesting comments here[1]: \- the ITT (invitation to tender) had 26 pages \- questions from the contractors were answered with "this information is not required to define the price/scope of the feature but it has to be implemented anyway" \- huge scope (9 modules) + training + administering the system \- everything has to be finished in 1.5-2.5 months from when the results of the tender are published

It seems that only a single company has entered the auction for the tender because everyone else could see that the project was destined for failure. The company also allegedly employs three people and pays its programmers around 2000 zł/month (which is very low even by polish standards).

[1] - [http://www.poselska.nazwa.pl/wieczorna2/media/system-pkw- do-...](http://www.poselska.nazwa.pl/wieczorna2/media/system-pkw-do-zliczania- wynikow-wyborow-byl-modyfikowany-w-trakcie-ich-zliczania)

</comment><comment><USER5> Just to make it clear to everybody, this is not an electronic voting system. This is only a set of applications to accelerate vote counting before the official results. All of the votes must be counted and submitted the "old fashion way". You couldn't mess with the actual results by hacking this "appkenstein".

</comment><comment><USER6> [https://github.com/wybory2014/Kalkulator1/blob/master/Kalkul...](https://github.com/wybory2014/Kalkulator1/blob/master/Kalkulator1/Connection.cs) \- if you can't connect to [https://syswyb.kbw.gov.pl/](https://syswyb.kbw.gov.pl/), try an unencrypted connection to [http://klk.kbw.gov.pl/](http://klk.kbw.gov.pl/).

It also looks like (unless I am missing something) 'liceneses' (signatures of authorised officials as far as I can tell) are checked for common name / organisational unit, but there is no check that the certificate trust chain is anchored on a trusted certificate.

<comment><USER7> [https://github.com/wybory2014/Kalkulator1/blob/master/Kalkul...](https://github.com/wybory2014/Kalkulator1/blob/master/Kalkulator1/Certificate.cs#L257) Is this correct generation of salt? It looks like someone just c&p an example from [http://www.cprogramdevelop.com/1263984/](http://www.cprogramdevelop.com/1263984/)

</comment></comment><comment><USER8> Is the definition of a secure system, that it is still secure even if you have the source code?

<comment><USER9> By Kerckhoffs's principle, yes. [https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle](https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle)

</comment></comment><comment><AUTHOR> Context: State Electoral Commission declared a computer glitch is delaying the vote count. The problem persists, and election results are not yet available.

</comment><comment><USER10> Leaked? Is the source code not public anyway? I mean generally you'd want to know what method they are using to count votes.

<comment><USER11> Tens of millions of US voters use closed-source voting machines during our elections. The companies who make the machines are generally a little too friendly with the Republican party (Diebold, Premier Election Systems, or whatever they recently changed their name to).

I'm shocked at how few people care that so many votes are "counted" through Republican-friendly voting computers.

<comment><USER12> Funny, I googled "programmer testifies..." and the first autocomplete was "...about rigging elections": [https://www.youtube.com/watch?v=tjvtSquZkhs](https://www.youtube.com/watch?v=tjvtSquZkhs)

Journalist Greg Palast also has evidence of electronic voter in Ohio in 2004. (Disclaimer: I have not delved deep on his claims, but the mere fact of their plausibility is deeply concerning.)

[http://www.gregpalast.com/how-they-stole- ohio/](http://www.gregpalast.com/how-they-stole-ohio/)

</comment></comment></comment><comment><USER13> Here's a Google Translate of the README.md file:

 _Based on a cursory analysis of the executable file and application development can be concluded that the performance of the Election Calculator entrusted single Studénka, probably working for external contractors. Ms. Agnieszka, I really sympathize, we are with you!_

 _Poland is a country in which the fate of thousands of members of the committee rests on the shoulders of the novice programmer._

<comment><USER14> A "more English" translation could read:

 _Based on a cursory analysis of the executable and application development, it 's clear that the act of writing the Election Calculator was entrusted to a single (female) student, who was probably working for external contractors. Ms. Agnieszka, we really sympathize, we are with you!

Poland is a country in which the fate of thousands of committee members rests on the shoulders of a novice (female) programmer._

<comment><USER2> The fact that the programmer is female is mentioned implicitly - the female version of the "programmer" pronoun is used, the fact is not really stated anywhere.

So it should not to taken as "the shoulders of a novice, female programmer" (in which the fact that she is female is stated explicitly and could be used to further put down the person's programming abilities) but as "the shoulders of a novice programmer".

<comment><USER15> Uhm, no, it is not.

Did you miss the "Pani Agnieszko, naprawdę współczujemy, jesteśmy z panią!"("Ms. Agnes, we're really sorry too, we're here for you")(that's a terrible translation, but oh well) part? There's absolutely no ambiguity here.

<comment><USER2> I meant the "(female)" remarks in the grand-grandparent post.

<comment><USER16> There is no way to avoid that in the polish language, as someone else pointed out already. Nouns and sometimes even verbs or adjectives have gender, and you need to use either the male form or female form according to the situation

<comment><USER17> Right, but a translation to English should not include "(female)" unless it's essential information, which it isn't here.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> > And, decompiled or not; this is not the result of proper C#- or for that > matter any modern language- coding:

> r = r + "<code>" \+ this.hardErrors[i] + "</code>";

What's wrong with this?

<comment><USER19> Assuming that _r_ contains XML and _this.hardErrors[i]_ is already escaped for XML safety, that is probably what you'd expect to see a code-generated XML generator doing, as well as hand-generated XML (if generating text directly and not an intermediate abstract representation of the XML).

</comment></comment><comment><USER20> In few words - whole Polish voting system is dead now and the votes are counted by the people. What is more interesting: in the tender for the software started one company and of course won it - random case? I don't thing so.. greets from Poland:)

<comment><USER21> I like to believe it was the only company crazy (or inexperienced) enough to participate in a project of this scale on such a short notice. Which would be a sign of maturity of the Polish IT sector.

</comment></comment><comment><USER22> I'm still amazed that in the century of the Internet people still write stuff like that as a desktop app. Not to mention it was waaaaaay to late to do it in the first place (they picked the company to implement it in August 2014).

</comment><comment><USER23> Can anyone who knows about this recommend an accurate and neutral title for the post?

</comment><comment><USER24> The government messed up the public procurement. They wanted to have the system done in a very short time (one month?). Only one company submitted an offer.

<comment><USER20> LOL, really belive that? Sorry but IMO it was set - app costs was around $120k so..

</comment></comment><comment><USER25> Likely a fake. The company which wrote the system is recruiting just PHP developers, while this is written in C#.

Of course this is all speculation. It may be truth and someone reconstruct the original version by decompiling it. e.g.: [https://github.com/wybory2014/Kalkulator1/commit/cdff9cb67b8...](https://github.com/wybory2014/Kalkulator1/commit/cdff9cb67b8d75a080ff098c4acc23b330322c58)

<comment><USER26> Electoral voting system written in PHP. Sounds like a good idea.

<comment><USER27> Why not? WordPress runs 23% of the Internet. (WordPress is written in PHP of course.)

<comment><USER28> WordPress (and PHP) are not _bad_ things. They are things that have been designed for very specific purposes, and they actually excel at those things. Both are _extremely_ easy to get up and running. They can run practically anywhere etc.

There are entire languages written with the design goal being security. It's not a matter of whether or not something is a capable tool (ie: runs 23% of the internet), it's whether or not it's the right tool for the job. PHP clearly isn't.

<comment><USER29> I don't think an application written in PHP makes it inherently insecure. Maybe if you're talking about some 2004-style PHP with magicquotes and register globals enabled, but not in 2014 with a modern stack/framework. You could write a shitty ruby app just as easily as you can write a shitty php app.

<comment><USER28> Writing your code in PHP, no matter how good of a programmer you are, makes it more likely that your natural level of mistakes will insert security issues into the code, especially when compared to a language with even basic features like static typing. I'm not saying this as some idiot who thinks PHP is bullshit and for noobs, I've worked on pretty large sites using PHP and I have a pretty deep understanding of it.

Everyone likes to say security is mission critical, but for the vast majority of people it really isn't. And for those people the development speed advantage, massive developer market, libraries etc. you get working in Ruby or PHP are well worth it.

Everything is tradeoffs, and it seems to me that in writing voting software deployability, development speed etc., are not nearly as mission critical as security.

<comment><USER27> > Writing your code in PHP, no matter how good of a programmer you are, makes > it more likely that your natural level of mistakes will insert security > issues into the code

While I'm inclined to agree, this is a self-defeating premise. If you're "so good" of a programmer that you do not make security affecting mistakes (i.e. one of only a handful of PHP programmers I've met), then the probability of inserting "security issues" into your code is still zero, regardless of language.

> I'm not saying this as some idiot who thinks PHP is bullshit and for noobs, > I've worked on pretty large sites using PHP and I have a pretty deep > understanding of it.

Good. :)

<comment><USER28> I don't understand your reply. No one is good enough to write code without bugs.

<comment><USER27> > No one is good enough to write code without bugs.

This is congruent to saying, "Whitelists don't exist. Everyone implements poorly scoped black-lists."

<comment><USER28> I literally have no idea what you mean by this. Are you trying to imply there are people who write bug free code? If so please point me in their direction.

People make mistakes. Systems should be designed for this expectation. If mistakes are extremely costly it implies you should use certain tools and development methodologies, if not you can use others.

<comment><USER27> Code that is bug-free and code that is free of security-affecting bugs are not the same thing.

For an example of an application that is currently free of application-layer security bugs, see my blog. It's not a CMS, I wrote it myself. Go ahead and try to hack it. :P

<comment><USER28> I feel like you're arguing against a strawman that I don't think secure applications can be written in PHP. I don't think that.

Edit: put another way: if you are starting from scratch and your main focus is security, why _would_ you use PHP?

<comment><USER27> Familiarity. I know its quirks inside out and therefore know which mistakes not to do. If you point me to Python and say "build a secure web app," I'm going to need to spend a lot of time researching.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> Haven't we all frowned upon picking on females in tech industry just yesterday?! It is NOT okay to wildly imply that the author of this code is of certain age and gender.

EDIT: it was shown by the comment below that it was actually written by someone with a popular Polish female name. I was shaken by the article yesterday and thus oversensitive. Sorry about that.

<comment><USER2> Well, the implications are pretty well founded:

\- the binary has strings like `C:\Users\Agnieszka\\...\Visual Studio 2013\Projects\Kalkulator1`. Agnieszka is a female Polish name -> the programmer is female. Although nobody really is using this as a discussion point anywhere, but hey, the fact is there if it's interesting to you.

\- the code logic and layout is pretty convoluted and looks duct taped together, even considering it's decompiled from binary form -> the author is probably young and inexperienced, and/or this was extremely rushed.

Also, I'm not realy sure where anyone is "picking on females" here.

<comment><USER31> I don't know, I wouldn't judge a decompiled code.

Can you give a few examples why is it so bad?

<comment><USER2> Keep in mind this is decompiled from IL, so the class/method/object mapping and naming remains from the original binary.

Here are a few, in my opinion, ugly examples:

[https://github.com/wybory2014/Kalkulator1/blob/master/Kalkul...](https://github.com/wybory2014/Kalkulator1/blob/master/Kalkulator1/GetKlk.cs#L486) and [https://github.com/wybory2014/Kalkulator1/blob/master/Kalkul...](https://github.com/wybory2014/Kalkulator1/blob/master/Kalkulator1/GetKlk.cs#L152) and a few more instances of basically the same logic, copy-pasted (correct me if this might have been optimized from source code, as I'm a reverse engineer and not a C# programmer - but I'm pretty sure it's not)

[https://github.com/wybory2014/Kalkulator1/blob/master/Kalkul...](https://github.com/wybory2014/Kalkulator1/blob/master/Kalkulator1/GetKlk.cs#L152-467)

[https://github.com/wybory2014/Kalkulator1/blob/master/Kalkul...](https://github.com/wybory2014/Kalkulator1/blob/master/Kalkulator1/Commit.cs#L85-124)

[https://github.com/wybory2014/Kalkulator1/blob/master/Kalkul...](https://github.com/wybory2014/Kalkulator1/blob/master/Kalkulator1/codeBar.cs#L24-115)

[https://github.com/wybory2014/Kalkulator1/blob/master/Kalkul...](https://github.com/wybory2014/Kalkulator1/blob/master/Kalkulator1/printProtocol.cs#L407-442) and string-based HTML generation in general. Oh, and this method in general. It doesn't even fit on my screen without scrolling to the right.

I'm not saying it's a goldmine of DailyWTF-worth content - but it's still pretty bad. In general, it doesn't really follow any MVC-separation, the naming is arbitraty at best (and dictated by the IDE at worst - Kalkulator1, anyone?), and DRY principles are vastly ignored.</comment></comment></comment></comment>


On Manufacturing Your Own Serendipity - <AUTHOR> http://nobulb.com/2011/10/on-manufacturing-your-own-serendipity/

<comment><USER2> When opportunities are often the difference between success and failure, being able to create your own are a valuable skill in highly competitive environments... technical entrepreneurship being the most currently prevalent. Thank you for sharing this! :)</comment>


Carmack on ffmpeg - <AUTHOR> https://twitter.com/id_aa_carmack/status/1258531455220609025 <comment><USER2> Indeed. Why reinvent the wrench?

Ffmpeg is just awesome. Incredibly powerful with a huge community of people sharing tips on its use for a huge variety of use-cases.

</comment><comment><USER3> Also I can't think of a browser that supports video that isn't using FFmpeg.</comment>


Makani source code released - <AUTHOR> https://github.com/google/makani <comment><USER3> From [https://x.company/projects/makani/](https://x.company/projects/makani/):

> _In 2020 Makani's journey as a company came to an end [0]. To share the > lessons and insights the Makani team gained from their 13 year journey > developing an entirely new kind of wind energy technology, the team created > The Energy Kite Collection, a portfolio of resources including a technical > report, Makani's entire avionics, flight controls and simulation code > repositories [1], flight logs [2] for every crosswind flight of the M600 > prototype, technical videos [3], a new simulation tool called KiteFAST [4] > created with the National Renewable Energy Laboratory, and a non-assertion > pledge [5] for the free use of Makani's worldwide patent portfolio._

I just wanna say that this -- all of it, the entire paragraph! -- is absolutely amazing (well, except for the end of the company, of course).

\---

[0]: [https://blog.x.company/a-long-and-windy- road-f8e09d02c9e1](https://blog.x.company/a-long-and-windy-road-f8e09d02c9e1)

[1]: [https://github.com/google/makani](https://github.com/google/makani)

[2]: [https://console.cloud.google.com/marketplace/product/bigquer...](https://console.cloud.google.com/marketplace/product/bigquery- public-datasets/makani-logs)

[3]: [https://www.youtube.com/playlist?list=PL7og_3Jqea4VRCZmMNK4L...](https://www.youtube.com/playlist?list=PL7og_3Jqea4VRCZmMNK4LDH64sYgkLZzv)

[4]: [https://github.com/rafmudaf/openfast/tree/kitefast](https://github.com/rafmudaf/openfast/tree/kitefast)

[5]: [https://storage.googleapis.com/x-prod.appspot.com/files/Maka...](https://storage.googleapis.com/x-prod.appspot.com/files/Makani%20Non- Assertion%20Pledge.pdf)

<comment><USER4> X is what Google used to be.

<comment><USER5> X is still X and Google is still Google.

Outside of X, Google was never known for crazy moonshots. Google was always an ad platform with a search engine.

<comment><USER6> X was Google X, now it's Alphabet X. Google was Google, now it's Alphabet Google.

Google was the name of the search engine and the company. Now the company name has changed, everything is restructured and Google is an ad platform with a search engine.

"X Development LLC. is an American semi-secret research and development facility and organization founded by Google in January 2010, which now operates as a subsidiary of Alphabet Inc. X has its headquarters about a mile and a half from Alphabet's corporate headquarters, the Googleplex, in Mountain View, California."[0]

[0]: [https://en.wikipedia.org/wiki/X_(company)](https://en.wikipedia.org/wiki/X_\(company\))

<comment><USER5> "X is what Google used to be." didn't strike me as a comment about the paperwork of corporate restructuring, but rather a comment on how Google isn't doing interesting things anymore. And I don't think anything changed in that regard. They just pulled non-core businesses such as X into Alphabet Inc. That doesn't mean that what X is doing used to be more important to Google than it is to Alphabet now, it's just paperwork.

<comment><USER6> > Google isn't doing interesting things anymore.

I think they've founded X because Google's interesting ideas got too big for a single department, so they spun it off.

We don't know how many smaller X inventions get into Google ecosystem. I'm sure that some of that research got integrated back into their data centers or networking hardware, etc.

</comment></comment></comment></comment></comment></comment><comment><USER7> There's also (quite surprisingly!) a feature-length film that talks about Makani's work over the last 13 years: [https://www.youtube.com/watch?v=qd_hEja6bzE](https://www.youtube.com/watch?v=qd_hEja6bzE)

<comment><USER8> Beautiful documentary, thanks for sharing.

<comment><USER9> Amazing stuff. Just made my Saturday night.

</comment></comment></comment><comment><USER10> All of their assets were liquidated in their Alameda location. I bought some power tools from the auction went to pick it up and saw this really long wing span in a hangar. I asked the people with the liquidators what it was and they told me it was used for power. Then I remembered reading about this company in Wired many years ago and felt it would be something cool. Well I own some power tools they used to use so that's as close to having their history with me.

<comment><USER11> How do you find out about these auctions, generally speaking?

<comment><USER12> There's websites for disposition of company assets when they go under. The Makani auction was advertised on the Silicon Valley Disposition website [0] for a while.

[0] [https://svdisposition.com/](https://svdisposition.com/)

<comment><USER13> This site is fascinating, thanks!

</comment></comment></comment></comment><comment><USER14> I guess this means that this project is dead or not viable for some reason, and they're being nice and releasing their work. Good job Google!

As an aside, it should be law to release any firmware, code, and backend services code for any device that is no longer fully supported by the manufacturer.

Let other people play with your dead things and reduce the barrier for new innovation on top of them.

<comment><USER15> Google stopped funding Makani several months back.

I'm not sure how applicable most of this code will be for other kite power companies. The Makani "kite" turbine was 2000 lbs. It definitely required Google-level funding to develop which is now gone. None of the remaining kite power companies that I'm aware of have the kind of significant funding required to develop this - ours ran out of money late last year.

<comment><USER16> > The Makani "kite" turbine was 2000 lbs.

Essentially the same code could run Makani's smaller machine, the 20 kilowatt "Wing 7", with a 7.8 meter wingspan and a mass of 60 kg. Many of the existing kite power companies are working on machines of this scale.

But we did have the luxury to design and build the system from the ground up, whereas scrappier startups might have to cobble together existing components. Hopefully they will be able to utilize some of the materials we've just released.

<comment><USER17> So what's to stop me cobbling together something like the Wing 7 and just leaving it unattended in a field to launch and generate whenever the wind conditions are suitable?

If I did, and I got typical government subsidies for wind power, I might earn $10k/year. That ought to pay for all the machines parts if I buy everything hobby grade from AliExpress. The 2nd year is pure profit assuming the craft lasts that long.

So that leads me to suspect the key issue is the various control algorithms can't be made reliable enough to run for years and years without crashing under any combination of gusts and wind conditions. Am I along the right lines of the issues?

<comment><USER18> The FAA (or your local alternative) might want to check your paperwork and licensing too.

<comment><USER17> While it stays tethered to the ground, I don't believe the FAA would be interested? Am I mistaken?

<comment><USER16> Makani engaged early with FAA and we had a great working relationship. This enabled us to move out of China Lake (where we were using the military's restricted airspace, which didn't require FAA approval) and out into the public airspace in Hawaii. We did several test flights in close collaboration with FAA observers, developing a color scheme for the tether and a lighting system for the kite and ground station that were deemed adequately conspicuous. We also held a round-table with local pilots to get their input. Ultimately we operated under a "determination of no hazard" that classified the Makani system as an obstruction, something like a large radio tower.

Our COO gave a talk on the FAA approval process at the Airborne Wind Energy Conference (AWEC) a few years ago: [https://repository.tudelft.nl/islandora/object/uuid:ea8256a2...](https://repository.tudelft.nl/islandora/object/uuid:ea8256a2-2c52-402e-a72f-fd60b0794c6b/datastream/OBJ/download)

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Neat! If I'm reading the repository right, it looks like the avionics firmware ran on a TMS570 Cortex-R microcontroller made by TI:

[https://processors.wiki.ti.com/index.php/Category:TMS570](https://processors.wiki.ti.com/index.php/Category:TMS570)

I'm pleasantly surprised to see that instead of a big Cortex-A or x86/64 chip. It's cool to read well-funded code for a small realtime SoC.

you don't see them too often outside of things like memory controllers and safety-critical products, but Cortex-R chips can have some cool features like ECC memories and mirrored CPUs:

[https://developer.arm.com/ip- products/processors/cortex-r/co...](https://developer.arm.com/ip- products/processors/cortex-r/cortex-r5)

Apparently the next generation Cortex-R82s will also have 64-bit options with an MMU, which should make it easy to run a "real" OS.

Too bad that the company didn't work out, but it was nice of them to publish this stuff.

<comment><USER20> Not entirely true. The actual autopilot (the controller + estimator) runs on an imx6. The tms570 are the sensor / actuator nodes.

Edit: just to add some detail. The autopilot and aio (avionics io, i.e. the tmd570s) communicate over a ring ethernet topology.

<comment><USER19> Oh, that makes sense. It did seem like a lot for such a small processor to handle.

Still, that sounds even cooler; a reference for how to set up a local network of MCUs controlled by a big processor? Awesome.

<comment><USER21> This topology is very common. Hard real-time sensor nodes feeding softer real- time big iron that does the estimation and control.

</comment></comment></comment></comment><comment><USER20> Former Makanite, and current abc employee here. Happy to answer questions.

<comment><USER22> What sort of control methodologies were you using for the autopilot? Classic linear negative feedback or more modern techniques? How much of the autopilot problem was novel? Could you use existing designs from other aircraft or do these tend to be kept secret?

<comment><USER16> The top-level autopilot used a nonlinear path controller, which produced position, attitude, and rate commands for an inner-loop controller that used linear feedback and gains computed using LQR and a linearized model of the system.

Because the maneuver the kite must fly is very dynamic (always turning, but not at constant rates), control with feedback alone would lead to pretty sloppy flight, since feedback requires an error to develop before the system can respond to it. Good feed-forward was crucial to flying well; from the desired flight path, wind speed/direction, and desired aerodynamic quantities (airspeed, angle of attack, and angle of sideslip), we could compute the required rates and feed-forward actuator displacements needed to execute the trajectory.

For more details, check out my paper titled "The Makani Autopilot: A Critical Retrospective", available here: [https://storage.googleapis.com/x-prod.appspot.com/files/Maka...](https://storage.googleapis.com/x-prod.appspot.com/files/Makani_TheEnergyKiteReport_Part1.pdf)

</comment></comment></comment><comment><USER23> I ran the code and took some screenshots of the really nice web UI. Simple and inspiring since I've been working on a robot web UI recently. Here's some screenshots of the Makani interface: [https://imgur.com/gallery/NMjBJSY](https://imgur.com/gallery/NMjBJSY)

<comment><USER16> Awesome! You might be the first outside of Makani to run the code. :-) I'm glad you were able to get it up and running. Please let us know if you have any questions or run into any trouble.

<comment><USER23> Hah cool! Yeah I was hoping the simulator was a 3D sim environment I could use with my off road robot, but it was actually still really helpful even though it wasn't that. I have been making a robot web UI and all your graphs and debug data give me ideas on more data I want to pipe up to the UI, and some improvements I can make to allow automatic UI elements from certain data structures. :)

Here's one of my robots: [https://reboot.love/t/new-cameras-on- rover/](https://reboot.love/t/new-cameras-on-rover/)

<comment><USER16> That rover is super cool - good work!

We were just beginning to experiment with computer vision to augment/replace GPS at the time we were shut down.

<comment><USER23> Thank you! You can certainly get a lot done with RTK, but computer vision is a big fun technical whale.

</comment></comment></comment></comment></comment><comment><USER15> It's cool that they open sourced this, but as someone who worked at a kite power company (a much smaller company with a much smaller kite) I'm not sure much here will be transferable to other companies. Makani was making a huge 2000 lb "kite" turbine. That requires the kind of money that Google could back them with - and since Google isn't funding this anymore I just don't see where this can go as none of the remaining kite power companies have much funding (ours ran out of money late last year).

<comment><USER16> While our code might be too specialized to help out other crosswind kite power companies in particular, I think the technical document might be quite impactful:

[https://storage.googleapis.com/x-prod.appspot.com/files/Maka...](https://storage.googleapis.com/x-prod.appspot.com/files/Makani_TheEnergyKiteReport_Part1.pdf)

The chapter "Airborne Wind Turbine Performance" contains some sobering lessons for the field and deserves a close read.

<comment><USER24> Thank you so much for that document it's so interesting. Interesting lesson from the exec summary: The real world kite underperformed the model by nearly half, and from the numericals it seems like the main reasons we're that the turning radius was about double that what you were trying to get, and that the tether drag was a significant loss that was not accounted for. The next gen model would be the same span but with a larger area and with a shorter tether, the turning radius would be a lot smaller and it would effectively halve the drag and increase performance by 30% but it would still underperform the initial model by about 20%.

The general big conclusion as I get it is that because of these losses even though the kites are capable of getting more wind per kite, when area is constrained a conventional turbine seems to have better density.

The idea that the kites have lower installation cost offshore does seem interesting to me, but I only skimmed it so maybe that's offset by something else.

<comment><USER25> _> ...tether drag was a significant loss that was not accounted for..._

I wonder if some of the losses to tether drag could be made up for by re- purposing some of the wave energy tech to capture energy from the base of the tether as the kite pulls and slackens on the base, or if the tether could be made rigid on demand with some tech in the future.

<comment><USER26> There isn't a large amount of energy stored in the tether catenary or elasticity. Any hardware to recoup it probably wouldn't pay for itself.

Offshore, there can be a lot of energy stored in buoy motion, and utilizing this can help, but probably in a resonant way that doesn't require additional hardware.

"Rigid" is a relative term. The tether already utilized a carbon fiber core. It doesn't get much stiffer, short of going to exotic fibers or more of them, both of which degrade performance in other ways.

The optimum is going to be closer to a strength limited tether than an overly stiff one.

</comment></comment></comment></comment></comment><comment><USER27> Blog post from February when Alphabet withdrew funding: [https://blog.x.company/a-long-and-windy- road-f8e09d02c9e1](https://blog.x.company/a-long-and-windy-road-f8e09d02c9e1)

(Disclosure: I work for Google)

<comment><USER28> To be accurate, partner Shell choose not to re-up its investment after exactly one year, from 2019 Feb 12 to 2020 Feb 18 as indicated in the blog post you linked (actually [https://link.medium.com/KBxNNZGcK9](https://link.medium.com/KBxNNZGcK9) since your link didn't work for me). It seems unfair to blame Alphabet solely, or even Larry, as one comment below did.

</comment></comment><comment><USER29> Why this failed? I would love to learn more if anyone has more insider knowledge

<comment><USER30> The tether replaces one set of problems with a different set of problems. Some of the new problems had promising solutions, but others were more marginal.

1) Land use. The small props are loud, and the setbacks relative to populated areas are pretty high for tether and crash safety. Solution: offshore. Now you have two problems :)

2) The tether's weight is a factor. Its _hard_ to build in much margin on this component before it gets too heavy to fly. What happens if a gust temporarily reduces tension on the tether? Can it handle a shock load from the kite hits the end again if it comes off its sphere? How many conductors can you run down the tether? IIRC, they were running DC+ and DC-... with no ground. Now, what exactly happens during lightning strike? At the time they believed that they were just barely on the "feasible" side for this component on a feasible- infeasible axis, but it was pretty darned close.

3) The power system was complex. Tether weight biases you strongly towards a medium voltage power system (a few kV pole-to-pole) to cut down on the weight of the conductors. However, the size of the turbine was smaller than any medium voltage application I had ever heard of. Maybe the ground side could be COTS, but the flight side almost certainly couldn't. So now you are also in the business of building bespoke medium-voltage switching power converters and motor/generators. There's nothing fundamentally infeasable about this, its just a bunch of hard work that detracts somewhat from the main mission. A startup would much rather buy this tech, but they were forced to build it instead.

I mention the power system explicitly because that's particularly in my bailiwick, but I think it was really a microcosm of the project as a whole. They were building an airplane for the purpose of energy production. So they had to solve all of the problems that an airplane company has to solve. Also, since electricity is so cheap, you can't afford to pay human operators for all of the generators, so you also must solve many of the problems that an _autonomous_ airplane company has to solve. In salty air to boot.

Overall, there's just a staggering amount of NRE that must be spent chasing a market that is already commoditized. 50 USD/MW-hr is a typical benchmark for wholesale electricity. Meanwhile, solar panels are iterating and getting cheaper and traditional wind turbines are iterating and getting cheaper. Eventually, the bean-counters start to notice.

There's an alternative explanation: Makani (and Wing, and Titan, and the robotics initiative, and other things) were initiated when Larry was still young and excited about the technology itself. We used to morbidly joke that Ruth Porat (hired CFO) was going around the company asking questions like, "Airplanes, Larry? Really?" (taps clipboard, raises eyebrow). Eventually the long years of almost-but-not-quite-success wore them down past the point of endurance, and the projects started dying off when the leadership got bored of them.

IMO, both explanations are likely to be true.

<comment><USER15> Having worked in the industry a bit, yes, likely both are true. There are very complex engineering problems to solve and Makani was taking one of the more complicated approaches to the problem. Some other kite power companies (including the one I worked at) have the generator on the ground and use an ascending figure 8 pattern of flight to pull the tether thus generating power (at the top of the cycle the kite goes into a sort of controlled stall to lose altitude, the tether is rewound and the cycle continues) - that approach certainly has issues as well.

I often think that maybe most of us were taking a much more complicated approach than is actually needed. Perhaps (thinking out loud) something much simpler like a soft kite with a sort of trap-door which closes as it ascends and opens to let it fall to a lower altitude would be a much simpler approach - essentially a bag kite with an end that can be opened and closed - <USER2> it would be smaller scale, but most of the kite power companies are working at a much smaller scale than Makani was.

</comment></comment></comment><comment><USER31> Incredibly ambitious project. I watched the whole documentary.

I'm surprised they were 'unable to secure additional funding'.

Considering how many crackpot app-of-the-month companies have gotten cash thrown at them over the last decade, you would think a company doing real engineering would be drowning in money. It's a bummer to hear that they folded.

Speculation abounds, I suppose, as to why investors started (or kept) saying "no."

<comment><USER32> When investors look to invest, they want a fast ROI. Engineering company likes this typically takes many years to fruition or maybe not. It's much easier to justify dumping money on these "tech" companies like WeWork, AirBnb hoping to get another facebook unicorn than putting money into real engineering company like Makani.

<comment><USER33> Personally I find that troubling for the progress of humanity. We need big money (resources) to solve real challenging engineering problems.

Unfortunately it seems like a lot of the big money is going towards less critical 'problems' if problems at all, like social media companies.

</comment></comment></comment><comment><USER34> Any chance on board schematics, or even just some basic block diagram of the avionics hardware? It's hard to understand this firmware without having any idea what it ran on.

<comment><USER16> Ask away and I'll tell you what I can. :-)

You'll find some description here (but no schematics): [https://storage.googleapis.com/x-prod.appspot.com/files/Maka...](https://storage.googleapis.com/x-prod.appspot.com/files/Makani_TheEnergyKiteReport_Part2.pdf)

<comment><USER26> the system overview slides in... part II?

pretty sure there is a top level avionics layout in there.

</comment></comment></comment><comment><USER35> What happened to the Makani refugees at G?

<comment><USER16> Many found new positions in Alphabet/X, and others found new positions at outside companies. Yet others still are either taking a break or still looking.

<comment><USER35> And you?

<comment><USER16> I had the privilege of being part of the documentation team preparing some of the materials that were released yesterday (in particular: the code and the chapter on the autopilot/control system). Now I'm taking a little break but I hope to start something new around January. Definitely open to ideas. :-)

<comment><USER35> [https://observer.com/2019/12/apple-new-satellite-project- wir...](https://observer.com/2019/12/apple-new-satellite-project-wireless- service-spacex-starlink/)

</comment></comment></comment></comment></comment><comment><USER36> Some of the code for the tools is fun to read [https://github.com/google/makani/blob/c421e4497dd09c86b01725...](https://github.com/google/makani/blob/c421e4497dd09c86b0172521b54b9a7c81cc31c9/analysis/cfd- tools/cfd_aero_runner/AeroCFDRunner/WindTunnelAnalysis.java)

This is not proper Java, at all. But it's what a lot of Java code looks like because it's a good choice for inexperienced devs or rushed projects.

<comment><USER37> According to GitHub this project is less than 3% Java. It's mostly C++, C, and Python

<comment><USER16> That's right; the real-time autopilot is written in C, and the flight simulator is written in C++. We have a really slick configuration system written in Python that compiles down to a Python dict and then a C struct at build time.

Example production C code (the crosswind flight controller): [https://github.com/google/makani/tree/master/control/crosswi...](https://github.com/google/makani/tree/master/control/crosswind)

Example production C++ code (the "wing" model in the simulator): [https://github.com/google/makani/blob/master/sim/models/rigi...](https://github.com/google/makani/blob/master/sim/models/rigid_bodies/wing.cc)

</comment></comment></comment><comment><USER38> I wonder if this could be repurposed to kite sail large cargo ships.

<comment><USER16> That was indeed an application investigated by Makani! I think some companies are still pursuing this.

<comment><USER38> I wonder why it didn't go anywhere. But maybe a difficult industry to interrupt. Google or an org with that kind of money should buy an cargo ship and just make it happen.

</comment></comment></comment><comment><USER39> What was the back of the envelope calculation that suggested this would work?

<comment><USER16> To be clear: crosswind kite power does work. The question is whether it is economical or competitive.

The paper that started it all is this one by Miles Loyd from 1980. It's short enough it could fit on the back of a large envelope. :-)

[http://edge.rit.edu/edge/P15462/public/CAD/crosswind_kite.pd...](http://edge.rit.edu/edge/P15462/public/CAD/crosswind_kite.pdf)

</comment></comment><comment><USER40> I am waiting for them to release the google earth source.

</comment><comment><USER41> Self Flying Energy Kite Self Flying Energy Drone

Interesting stuff.

</comment><comment><USER42> Larry cancelled Makani meanwhile he lands his helicopter on his yacht?</comment>


Land of the Free: A brief history of early American nudists - <AUTHOR> https://www.laphamsquarterly.org/roundtable/land-free <comment><USER2> TFA doesn't mention that Quakers ran some nudist camps etc. Or the historical association of Quakers and nudism.[0]

> EARLY QUAKERS AND "GOING NAKED AS A SIGN" By Kenneth L. Carroll One of the > least understood aspects of early Quakerism was the widespread appearance of > "going naked as a sign," a practice that was increasingly accompanied by > other "signs and wonders" throughout the 1650s and the beginning of the > 1660s. Later Quaker writers, either out of embarrassment or lack of > comprehension , tended either to ignore these shortlived acts or to dismiss > them as the expressions of unbalanced persons. When the religious mind and > outlook of seventeenth century England are fully understood, however, it > becomes clear that these manifestations can neither be ignored nor dismissed > simply as the behavior of abnormal people. What is viewed as abnormal or > unacceptable in the twentieth century may not always have been so > interpreted (and may not continue to be so interpreted in future ages). > There even appears to be a certain degree of kinship between these striking > acts of certain seventeenth-century Quakers and the attitudes and > expressions of many of today's youth who are protesting today's hypocrisy > and social ills.

0) [https://muse.jhu.edu/article/393815](https://muse.jhu.edu/article/393815)</comment>


radEventListener: Client-side Framework Performance - <AUTHOR> https://css-tricks.com/radeventlistener-a-tale-of-client-side-framework-performance/ <comment><USER2> Cool experiment, but what was learned? We already knew that:

      1. Vanilla JS is faster than Preact's diff/render.
      2. Preact's diff/render is faster than React's.
      3. Preact's concurrency model is extremely weak/non-existent.
      4. Preact has worse third-party library support than React.
      5. Preact is not that much smaller (min-gzip) than React 16.

The conclusion is still the same: use React for UI, don't bother with React- family libraries. Use vanilla JS for games, canvas, and other web APIs that aren't UI.

<comment><USER3> I wonder how Svelte/lit-html and others without vdom would have compared.

</comment></comment><comment><USER4> I'd love to know _why_ there is such a significant difference in performance between Preact and React here. It's not like the React team doesn't profile it. They must be optimizing for other features over this performance metric.

<comment><USER5> One thing preact does differently is ditch React's "synthetic events" system. React creates its own middleman wrapper objects for every single browser event that goes through it. This is where most of preact's size difference comes from, and I'd bet it has an impact on speed too.

More info: [https://preactjs.com/guide/v10/differences-to-react/#main- di...](https://preactjs.com/guide/v10/differences-to-react/#main-differences)

</comment></comment><comment><USER6> You'd think that choosing a stack based on your target audiences computing needs would be more common.

Choosing React over vanilla JS is not only required for simple state things imho - for complex state I'd even say some may use something like Redux/MobX. The development experience and speed vs vanilla JS is just unmatched. The amount you need to worry about adding / removing classes, with implicit state all over the place will soon slow you down soon much because of all the edge cases you haven't thought of.

I hope nobody starts off development for new apps in 2020 based on pure JS - even if you explicit target ultra-low-end devices, maybe try a lighter framework like preact (et al).

</comment><comment><USER7> In other news: if you walk around with weights attached to your body, you will walk slower.

</comment><comment><USER5> This is a good article, but the HN title is highly editorialized. Can we get it changed?

<comment><USER8> At your service.

(Submitted title was 'Vanilla JavaScript renders 5-10x faster than Preact, 30x faster than React'.)

<comment><USER5> Thanks dang!

</comment></comment></comment><comment><USER9> preact is usually slower than react actually. Initial load may be slow, but not overall performance.

Also preact are very often simply not work, i can't explain, but it is always something really creepy happening in random places. Event listeners also behave somehow different.

Also React 17 sets only a single listener to a document, not everywhere and adding a lot of listeners is much cheaper now.

At the same time most of the react slowness is not from react, but from awful libraries, usually css-in-js. And concept of css-in-js is actually very good, but implementations are simply awful.</comment>


Pablo Escobar's hippos: A growing problem (2014) - <AUTHOR> http://www.bbc.com/news/magazine-27905743 <comment><USER2> Reading this as an Australian, where managing invasive species is a multi- million dollar problem, this is just...extraordinary.

> "It's just like this crazy wildlife experiment that we're left with," says > San Diego University ecologist Rebecca Lewison. "Gosh! I hope this goes > well."

You...hope this goes well? How about you shoot them all, while there's still a countable number of them? It's not like there's a conservation question here. There's almost no genetic diversity in the herd, and hippos aren't threatened in Africa.

<comment><USER3> The difference is that in Australia you don't have whole towns worth of people coming out to protect their cute, floppy animals .. with guns and machetes. So, there's that.

</comment></comment><comment><USER4> Reminds me of another Hippo story, the U.S. Hippo Bill that was proposed to farm Hippos. [http://www.wired.com/2013/12/hippopotamus- ranching/](http://www.wired.com/2013/12/hippopotamus-ranching/)

</comment><comment><USER5> This points to the forms that truly effective terrorism will take in future. Why bomb a few places in your target country, when instead you could just plant a few hundred genetically-engineered Tyrannosaurus eggs? Mayhem for years! Way to make your mark Pablo!

<comment><USER6> You can also just release a few rabbits. They breed pretty quickly [1] and will destroy local ecosystems. See: Australia.

(Also, happy Straya Day)

[1] [http://www.bio.miami.edu/hare/scary.html](http://www.bio.miami.edu/hare/scary.html)

</comment></comment><comment><AUTHOR> Thought this would be an interesting thought experiment for engineering the best solution to the problem. I guess since Colombia isn't that rich it would have to be feasible economically, too.

</comment><comment><USER7> He put a ding in the universe.

</comment><comment><USER8> Two words: Hippo Bacon

<comment><USER9> FTA: _Valderrama doesn 't recommend eating the meat, in case it is infected with a transmittable disease - one dead hippo was found to be carrying leptospirosis which can cause meningitis_

<comment><USER10> As a former Tampa Bay Mutiney fan, no bacon just piles disappointment upon disappointment. This story would be hippos in World Cup wigs cooler if _the_ Carlos "Still the best player ever to play in the MLS" Valderramma had, in post footballing retirement, become a veterinarian managing Escobar's legacy.</comment></comment></comment>


Average age of StackExchange users for each tag - <AUTHOR> http://www.brianbondy.com/stackexchange/#expected-age

<comment><USER2> Excuse me for not being objective, but a bit more interesting statistics of tags from Stack Overflow is here [https://www.kaggle.com/c/predict-closed- questions-on-stack-o...](https://www.kaggle.com/c/predict-closed-questions-on- stack-overflow/prospector#211) (average and median reputation of persons posting questions, % of non-closed questions, average number of additional tags, median body length, freshness of the topic).

And my full project, Tag Graph Maps of Stack Exchange: [https://github.com/stared/tag-graph-map-of- stackexchange/wik...](https://github.com/stared/tag-graph-map-of- stackexchange/wiki)

<comment><USER3> It's cool, although you could have easily done without saying that yours is more interesting.

<comment><USER2> You are right, I shouldn't have said that. Sorry.

</comment></comment></comment><comment><USER4> _Each list includes only the users who have social networking links in their profile_

Well, that's going to skew the results beyond usefulness.

<comment><USER5> That comment is for a totally different study. The study only includes users with an age in their stack exchange profile. It is not related in any way to if they have a social media account.

</comment></comment><comment><USER6> To save some scrolling, the last tag listed for stackoverflow is war-stories at 35.91 years old.

<comment><USER7> And perceptions match up with reality, the oldest users are the ones with the COBOL, Delphi, ADO and Legacy Code tags :)

The young guys are working on Chrome extensions, JQuery animations, HTML5 and CSS3. There are also several young users of PHP so beware :) .

</comment></comment><comment><USER8> Under "Statistical Analysis" the "Weighted-Mean" tag expected age is 72. Under "Mathematics" the "Non-Standard Analysis" tag expected age is 19. I suspect samples of 1 for each of these tags.

This is fun to look at but I wouldn't base any conclusions on these averages. Providing histograms for each tag along with some summary statistics such as sample size, min, max, and median would give a lot more transparency into the dataset.

</comment><comment><USER9> The absense of detailed methodology makes me doubt the worth of this number dump. As a start it would be good to know the number of users that led to the average numbers. And anything about the representative quality.

</comment><comment><USER10> Yeah I too would be curious to see how the age is distributed among ALL the SO users and tags rather than the "top users" and their social media profiles.

<comment><USER5> Actually you are seeing what you want. The social media stuff is about a related study for mining the social media links for top users and not for the expected age study. The expected age study was for all users that have an age in their StackExchange profile.

<comment><USER11> I would be interested in seeing an age profile. I, for one, removed my birth date after being flamed about my age. I've been programming since 1962 :)

</comment></comment></comment><comment><USER12> Does anybody know how he actually knows the age of the SO members? He wrote "I call the statistic the Expectd Age because it is calculated using Expected Value from statistics" but that doesn't mean much to me.

<comment><USER13> It's explained higher up on the page:

"I mined the Stack Overflow (and related sites) data dumps to extract the social networking accounts of the top users. Each list includes only the users who have social networking links in their profile ..."

<comment><USER14> Would be interesting to know how he did it in detail.

Twitter does not contain age, neither does LinkedIn (or at least not show it) And in facebook you need to jump through loops like user_birthday and friends_birthday[1]. I don't know how to get the birthday of 3rd parties.

[1] [https://developers.facebook.com/tools/explorer?method=GET...](https://developers.facebook.com/tools/explorer?method=GET&path=me%3Ffields%3Did%2Cname%2Cbirthday)

<comment><USER15> You can input your age on a Stack Exchange profile.

<comment><USER14> ok that was too easy.

</comment></comment></comment></comment></comment><comment><USER16> Site is down for me(over quota), here's the google cache: [http://webcache.googleusercontent.com/search?q=cache:www.bri...](http://webcache.googleusercontent.com/search?q=cache:www.brianbondy.com/stackexchange/#expected- age)

To go to any page in google cache: [http://webcache.googleusercontent.com/search?q=cache:<UR...](http://webcache.googleusercontent.com/search?q=cache:<URL_WITHOUT_http://>);

</comment><comment><USER17> So by the looks of it as a 28 year old I'm pretty much the exact mean for stack overflow.

I love the fact that "war stories" has the highest average age (of 35).

<comment><USER18> I noticed that. I wonder if it's nudged a bit higher by younger generations not being as fond of the war analogy.

<comment><USER17> Well, I guess it's more to do with older people having more experience and seniority thus having more stories to share.

<comment><USER19> I agree and maybe young people are who are in college are the lurkers.

</comment></comment></comment></comment><comment><USER5> I'm the owner of the site, here is the associated blog post that summarizes some of that data: <http://www.brianbondy.com/blog/id/117/>

</comment><comment><USER20> would be a good indicator for some future estimates, but lisp, ruby, python etc are all around 30yrs.

<comment><USER21> \- as are c and c++. What gives?

<comment><USER22> That mostly younger generation uses Stack Overflow and thus age-over-languages cannot be extracted from the data analysis. We are just learning statistics and probability and i think this happens if the sample data is incorrect or not diverse enough.

</comment></comment></comment><comment><USER23> I would freain' love a "Wikipedia: age of people rapidly using automatic tools (such as rollback; twinkle; etc)", and then extend that to "How many of those were good changes vs how many of those were poor changes vs how many of those are discussable changes".

</comment><comment><USER24> The average age for COBOL doesn't seem right. I would expect it to be higher.

<comment><USER25> I wonder if that's because there are lots of younger folks who have to maintain old COBOL projects, and are looking for help on SO.

</comment></comment><comment><USER26> Average age? So who's the oldest user on SE, dragging all the numbers up?

<comment><USER5> I only considered acceptable ranges.

</comment></comment><comment><USER27> Nice job.

It's interesting as a list... and I think there's scope to do a visualization that is even more interesting (and also easier to read).

</comment><comment><USER28> Does anyone know which service he is running this on? There is no logo on the overload page. Ty

<comment><USER29> Headers say:

 _Server Google Frontend_

<comment><USER28> Thanks, didn't show on my android with opera mobile

</comment></comment></comment><comment><USER30> LaTeX -> thesis ~= 29. sounds about right.

</comment><comment><USER31> StackOverflow is almost a kindergarten.</comment>


Yet another call for a startup update site:  how about a collaborative blog on blogger? - <AUTHOR>

<comment><AUTHOR> Anyone interested in having a collaborative blog on blogger where you get to announce updates to your startup?

We could have a rule like at most one update per week.

Basically any founder would be allowed to post on the blog provided that the service is SFW.

</comment><comment><USER2> Thats a good idea. I would suggest to use something like Wordpress or Drupal, which is more suited for a service like this. What would you call it?

</comment><comment><USER3> I see no reason not to post such updates here. After all, this is a "Startup News" site.

</comment><comment><USER4> What's wrong with TechCrunch/Mashable/starting your own?</comment>


Nautilus Live – Channel 1 Stream – Exploring Canada's Endeavour Hydrotheral Vent - <AUTHOR> https://www.youtube.com/watch?v=WIdViC75CPI <comment><AUTHOR> The Hercules ROV is currently at the top of Godzilla vent, my favourite area. Tune in to see more biomass per square metre than anywhere in the Amazon rainforest!</comment>


Ask HN: Co-founder woes. Pl advice - <AUTHOR> I have a background in UX/UI and biz-dev, and my (technical) co-founder is a full stack developer with a focus on back-end.
I've known my co-founder for over 15 yrs now, and he is like family to me. A few years back we decided to work on a side project with a goal to launch it as a business. We failed. The reasons were typical - but mainly because we couldn't execute and develop a prototype to take to customers on time.
I learned about my shortcomings and continue to work on them. I also had a painful realization - I had overestimated my co-founder's tech skills, aptitude, attitude, and basic understanding of what it takes to build & launch a startup.
We decided to put the project on hold, and pursue another idea for which I have domain expertise. It also seemed more promising and d-able. We talked candidly about the lessons learned from the failed project, concerns, red flags etc. We also decided to keep our day jobs while we worked on building the prototype/ product - so we knew that it would take longer than usual.
Now we've been working on the product for over 2.5 years. And we are running into similar issues. We even outsourced some of the development - at the risk of delaying the project further. So far we've managed to build out 60% of the product (and validated the idea with several potential users/ customers), but I feel hopeless about completing the remaining 40%. It has been buggy/ incomplete since it was developed (some of it 1.5 yrs back). And my co-founder seems clueless.
After so many missteps, I've stopped bouncing product ideas off him (something that co-founders naturally do). I've stopped depending on him to help with custom/er demo's, and I'm finding it harder to trust his judgement & approach when it comes to solving problems.
I want to help him. And it is partly for this reason that I want this project to be successful. But trying to do so is taking a toll on my health, family life, and my general well being.
Please advice! <comment><USER2> It's difficult to give feedback without knowing what the product is.

That said, the tradeoff most startup developers have to deal with is how to balance quality vs time. At every stage of funding, this shifts more and more towards stability being important, but until you have users, you really just need to get the very basics working okay enough.

Not all developers are good at accepting this approach. I even know of _good developers_ that are not good at this approach, because it sometimes requires prioritizing product and instantaneous business needs over software engineering principles. However, it's really the best approach because most code you write today won't be there in 6 months or more as your understanding of the user and their problem(s) evolves.

It is not an insult to your co-founder, if he's choosing not to work under this style. Perhaps considering contracting out building the prototype or learning to code yourself.

</comment><comment><USER3> 2.5 years is a long time to be working on something with no tangible result that is bringing in money. Of course, I don't know what sort of product you're working on, but it is possible that you've simply picked something that will take too many man-hours to build for the size of your team.

I've launched my own products before, and they're usually something I can finish in 2-3 months working full-time with a part-time designer. If you only have weekends and holidays, even one of those could take as much as a year, if not more.

The only thing that is going to get you excited again is to get some tangible result from your work. Try to simplify the product down to a small prototype you can test on your target market. It doesn't even need to be an app. It could be an Invision or a 'fake' app that shows the navigation and what your app could do.

Get some people together and show them your prototype. Get feedback. Improve upon it.

If they really like what you're doing, it might give you a sense that you're on the right track. You need shorter feedback cycles to get energized about these sorts of things. That's my experience, at least.

</comment><comment><USER4> If you relayed these sentiments to your co-founder would he understand or take offense? If your co-founder is level-headed maybe the right approach would be to say, "Look, this product is on the fast track to nowhere and it isn't doing any of us any good. Honestly, it's taking a toll on my health and it's putting a strain on our relationship. You're like family to me and I don't want that to change. I've thought about this long and hard and the way I see it, there are only two options left: we both agree to shelf this product or one of us should buy out the other. What do you want to do?"

</comment><comment><USER5> "Jim, it's been 2.5 years. How do you feel about this project? You still have passion for it? If you could do a change anything about what we've done, what would it be?"

Then listen to what he "says".

</comment><comment><USER6> Sounds like you need a new technical co-founder with the skills and/or desire to make your product happen.

Since you guys are like family just bring it up with him, ask him if his heart is in continuing and pursuing this.

You can lead him toward shelving it or you continuing on without him if that's your desire.

The time frames seem really long. Apps start to feel dated after a couple years and this latest one you're saying is 1.5 yrs old and still not ready to demo.

Talk it over with him tell him you want to focus on remaining close friends and see what you can work out.

Good luck.

</comment><comment><USER7> _I want to help him. And it is partly for this reason that I want this project to be successful._

So, it sounds like some important information is missing. And it sounds like you are doing this as charity for him. That is not likely to result in a viable business.</comment>


Show HN: dingo - a Google DNS-over-HTTPS caching proxy in Go - <AUTHOR> https://github.com/pforemski/dingo <comment><USER3> DNSCrypt ([https://dnscrypt.org/](https://dnscrypt.org/)) would be more elegant here (DTLS also okay) and is in-band wrapper for DNS. It's what TLS is for HTTP but for DNS and keeps things UDP.

Worth pointing out, this is not a google project, it just uses Google's DNS over HTTP endpoint.

We have one we made at [https://www.openresolve.com/](https://www.openresolve.com/)

</comment><comment><AUTHOR> Thanks for all your comments. Below I put quick replies to some of them:

1/ I hope to update the project to use QUIC soon, so it will use encrypted UDP to fetch DNS data from Google Public DNS. It is somehow similar to the DNS over DTLS idea, developed under IETF dprive WG.

2/ dingo does not need to resolve dns.google.com. Providing the server IP address is enough (IPv4 or IPv6, make sure it is close to your location). dingo verifies the server certificate to make sure we talk to Google. It can even "spoof" the TLS SNI string to avoid HTTPS firewalls, too (by default it asks for www.google.com, which is pretty benign).

3/ Last but not least, it's just my first non-trivial Golang project - <USER2> for all your suggestions! :)

<comment><USER4> "It can even \"spoof\" the TLS SNI string to avoid HTTPS firewalls..."

Are you confirming SNI is being used for censorship?

<comment><USER5> Plenty of content blockers support blocking domains based on SNI. Here's just a couple of examples from a quick google search.

[https://wiki.untangle.com/index.php/Web_Filter#HTTPS_Options](https://wiki.untangle.com/index.php/Web_Filter#HTTPS_Options)

[http://www.watchguard.com/help/docs/wsm/xtm_11/en- us/content...](http://www.watchguard.com/help/docs/wsm/xtm_11/en- us/content/en-us/proxies/https/https_domain_names_c.html)

</comment></comment></comment><comment><USER6> The use of `go run` here makes adopting this very hard. The benefit of using Go for projects (in my experience) is that you can build for multiple OS/Arch super, super easy. I'd thin that having uploaded artefacts would be the first thing most people do when releasing Go code into the wild that is meant to be consumed by someone just wanting to run the program.

<comment><USER7> go get github.com/pforemski/dingo

<comment><USER8> I think the point wyattjoh was making is that having to install the go toolchain is hindering adoption and that giving downloadable binaries that you could run directly, like `./dingo` would be nicer.

<comment><USER9> Thats a great point. As a Go developer I always try to make sure that there's a linux and binary for my small projects released on github. I'm surprised more Go devs don't do this. The toolchain makes it very easy to update releases. You can also use ldflags to set the current git revision and branch into the project.

Here's an example release.sh I have in most of my projects [https://github.com/micromdm/scep/blob/master/cmd/scepclient/...](https://github.com/micromdm/scep/blob/master/cmd/scepclient/release.sh)

</comment></comment></comment></comment><comment><USER10> Encryption is nice, but does it have to be the overhead of HTTP? What would be a sensible alternative protocol?

<comment><USER11> DNSCrypt or RFC7858 (dprive) are probably closest equivalents.

<comment><USER12> I suppose it could also be implemented with DTLS [0] over UDP [1]. (Checking Wikipedia...) A 2013 paper [2] published some vulnerabilities; mostly implementation flaws, but it raised some questions about the core spec as well.

However you implement it, encrypting DNS probably has it's place, but it doesn't make a whole lot of sense for most applications.

[0] [https://en.wikipedia.org/wiki/Datagram_Transport_Layer_Secur...](https://en.wikipedia.org/wiki/Datagram_Transport_Layer_Security)

[1] [https://tools.ietf.org/html/rfc6347](https://tools.ietf.org/html/rfc6347)

[2] [http://www.isg.rhul.ac.uk/~kp/dtls.pdf](http://www.isg.rhul.ac.uk/~kp/dtls.pdf)

<comment><USER11> There are IETF drafts actively being worked on for DNS over DTLS:

[https://datatracker.ietf.org/doc/draft-ietf-dprive- dnsodtls/](https://datatracker.ietf.org/doc/draft-ietf-dprive-dnsodtls/)

[https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls- and-...](https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls-and-tls- profiles/)

</comment></comment></comment></comment><comment><USER13> Am I the only one who took a quick look at this and went "How can this DNS be 'secure' if it has to use normal DNS to look up dns.google.com?"

<comment><USER14> Because you validate the certificate presented so that you know the endpoint is really Google.

</comment></comment><comment><USER15> This is very cool. If you compile it into a go executable and run it with the -dbg 3 option it shows all the lookup information for the clients.

</comment><comment><USER16> My friend also wrote a similar tool in Go. This tool uses Taobao's API to detect your external IP address so edns will not be fixed string.

[https://github.com/ayanamist/gdns-go](https://github.com/ayanamist/gdns-go)

</comment><comment><USER17> What problem does this project solve?

It's not immediately obvious what the thing does from the description.

<comment><USER18> When you are out and about with your laptop you are usually making your DNS calls to the local router which many view as a big privacy concern. Even if you use something like google's 126.96.36.199 and 126.96.36.199 public DNS servers as your defaults the traffic is easily sniffable.

<comment><USER19> When you connect to any site, your browser sends the domain in clear-text (even for HTTPS - see SNI). The only way to avoid this is to use a VPN, but then you can route regular DNS over that too.

</comment></comment></comment><comment><USER20> This code needs a pass through gofmt, among many of the other Go linting technologies.</comment>