Linux touchpad like a Macbook: progress and a call for help - <AUTHOR> https://public.amplenote.com/4wdQRLmYVU6wAHo1V9yKgaJK <comment><USER3> Apple has put a lot of work and polish into its touchpad drivers, and it makes a huge difference; it's probably the largest single differentiator Macbooks have over other manufacturers. Part of it is latency (which will probably also require some work on the graphics stack), part of it is handling all the corner cases correctly. (Improving latency probably also requires some work on the graphics stack, not just the touchpad drivers.)

A simple test which Macbooks pass, but Windows and Linux laptops fail: fling scroll down a web page, then press Cmd/Ctrl+W to close the tab before the fling scroll has stopped moving. On Macs this works correctly; everywhere else, it acts as though you're spinning an old-style wheel mouse while holding Ctrl, and zooms in repeatedly.

<comment><USER4> I agree 100%, and I also think Force Touch doesn't get the attention it deserves. To me the 2015 Macbook Pro is the pinnacle of laptop engineering because it added the Force Touch touchpad. Being able to click anywhere on the pad and configure the strength of the haptic feedback is huge. Not having haptic feedback, or having to use a separate button, or having it vary from top to bottom depending on how far I am from the hinge, is no longer acceptable to me.

Without Force Touch-like trackpad hardware, other laptops are still too far behind.

<comment><USER5> Force touch is so good I had to switch the laptop off to convince myself it wasn't actually moving.

<comment><USER6> It definitely moves - the whole pad is kind of springy - it just doesn't tap back with an impulse without power.

<comment><USER7> On the > 2015 MacBooks the touchpad definitely does not move when powered off. It's just a piece of glass.

<comment><USER6> I can only speak for my mid-2015 15" Retina MacBook Pro, and the whole pad is clearly flexible and very slightly sprung (and yes, it's made of glass - <USER2> glass is quite flexible). You can see it flex and bend by looking across it while deflecting it - it's most easily seen by looking at the gap around the edge of the pad, between the pad and the laptop casing, while deflecting it close to the edge. The gap varies as the pad is deflected.

What it doesn't do is haptic feedback when it's turned off. There's no click. I infer that's because the click works by applying a mechanical kick back close to the point of deflection. Your finger wouldn't feel it as a click if there was no mechanical movement at all. A bit like a speaker: speakers are mechanical devices too.

[https://ifixit.org/blog/7084/force-touch-track- pad/](https://ifixit.org/blog/7084/force-touch-track-pad/)

> _we're pretty sure the magic pressure sensors in the new Force Touch > trackpad are tiny strain gauges. Mounted on flexing metal supports, they > detect the amount of flex on each—and based on that, the force from above._

Flexing = movement.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Wow, this community is so good. Three hours after posting and I've already got a few interested emails from experienced devs looking to lend a hand here. So, it _looks_ like we should have the opp to move forward with something in the weeks to come. Would still be nice to get a couple more emails from knowledge- heavy Linux devs, since that's not a strength of mine. (bill -at- staticobject.com)

I also haven't heard from anyone with connections to OSS projects at Google/MS. I've assumed (perhaps incorrectly) there are departments at smart tech cos that selectively contribute to high impact OSS projects (dev resources or other)? Even if not for contributing resources, would be valuable to get a bit of talk time from those that have successfully executed a project like this before.

<comment><USER8> Hi,

Thank you for your efforts. Could you explain what exactly is better about the MacOS touchpad?

Just to warn I've used Linux on a cheap PC notebook for the last ten years. I have only very occasionally used a macbook and generally found the touchpad unpleasant due a relatively slow movement (which also might make it more accurate but still doesn't enthrall me). I never particularly had a problem with the touchpad until recently - the current drivers get the location "lost" and needs a reboot about once a week (unloading and reloading with modprobe doesn't work. Also, the current touchpad simulates a three button mouse on a pad with no visible buttons, an effect that generally makes both the center and right buttons hard to use plus the keyboard has no right click button, complain-complain, minor stuff altogether and machine remains usable).

Which is to say that you may be confronted with continual Linux desktop problem the your ideal of UI performance not being everyone's ideal (remember how everyone hated on the Gnome Shell? I still hate on the Gnome Shell). My own idiosyncratic UI ideal is more like older-Windows than Mac (I use Ubuntu Mate).

Still, best of luck.

<comment><USER9> I find the MacBook precision remains just as good at higher pointer acceleration settings. In addition the same precision is normally present with all the various gestures with no loss of precision using multitouch inputs. Did you adjust any of the MacBooks you used to better fit your preferences? The slow default is the first setting I adjust because I agree the default pointer acceleration is far to slow for my tastes.

<comment><USER10> I crank it all the way up, myself.

But I wanted to point out that this is a spot to be careful about decisions. The natural choice is to pick a default that you like yourself, but that's probably a choice that would ultimately hinder adoption of Linux as a desktop OS.

Geeks like a faster setting, but geeks also universally know that this sort of thing can be customized, and can easily figure out how to change it. Non-geeks are more likely to find a fast setting to be frustrating or unusable, and are also less likely to know that they have an option to slow it down.

</comment></comment></comment></comment><comment><USER11> The idea of forking libinput, vs. simply generating ~$95-150k p/annum for the guy behind libinput to go full-time, is a silly one. He was the same guy behind synaptics, and understands all of this far better than the OP.

Let's get him some bounties! :)

<comment><USER12> Or just contribute to the project directly, unless the current maintainer has demonstrated a lack of willingness to cooperate.

<comment><USER13> My interpretation was that the fork is to be a temporary one, with the results of this endeavour to be merged back in when the time is right. This allows them to make mistakes and drastic changes without regard for the release cycle or backward-compatibility promises of libinput, and if everything is successful then they can bundle up the results into a mergable form and get it into libinput.

</comment></comment></comment><comment><USER14> > Visual or terminal-based means to configure rudimentary touchpad settings. > The fewest options I could imagine supporting for v1 would be: scroll > speed/acceleration, scroll speed, natural scrolling toggle, hopefully > support for gestures.

You gave up on libinput after an inability to configure scroll speed, but the rest of those are all configurable with libinput and libinput-gestures[1].

I don't use gestures yet and default scroll speed has always been fine, and the following tiny libinput configuration hits the rest of your points.

      $ cat /etc/X11/xorg.conf.d/30-touchpad.conf

      Section "InputClass"
          Identifier "touchpad"
          Driver "libinput"
          MatchIsTouchpad "on"
          Option "Tapping" "on"
          Option "TappingButtonMap" "lrm"
          Option "NaturalScrolling" "true"
      EndSection

Is there a reason you haven't asked the libinput maintainer about whether configurable scroll speed would be welcome upstream (in the prior post, it comes across like your question was far more open ended)? Forking it just to add scroll speed configuration and replicate work that's already been done elsewhere seems a little excessive.

[1] [https://github.com/bulletmark/libinput- gestures](https://github.com/bulletmark/libinput-gestures)

<comment><AUTHOR> Appreciate the actionable ideas re: config file.

As far as the broader configurability questions, it's not so much that I want options libinput doesn't have (though that's a little bit of it).

It's more that I want the default behavior to be good enough where accessing the options aren't necessary (e.g., Macbook). In the event that the default options aren't that good, I want visual settings to tune the experience. Gnome 3 with libinput currently provides two options. Neither is pointer acceleration.

Since much of what I hope to improve the "feel" of default behavior, I don't think this could be as straightforward as "submit a PR to libinput." I think it could end up being a lot of work to get the default experience feeling great. The number of folks with interest in this esoteric subject seems to me like evidence of that.

<comment><USER15> Why not just create a gnome-widget that does libinput configuration under the hood?

The purpose of the fork cannot be just to provide sane defaults.

</comment></comment></comment><comment><USER16> It would be great to see this happen. Being curious, a couple years ago I read the ChromeOS touchpad driver ("CMT") to see why it worked so much better than other Linux distros. I don't have the reference handy but the short version is they bypass X11 due to the need for high frequency and subpixel scroll events. The highest fidelity technical answer is probably to bake scrolling into the UI toolkit and compositor, and you likely have to do this to match Mac / iOS performance. You can see Apple's approach reflected in the NSScrollview documentation [1] and elaborated in [2].

1\. [https://developer.apple.com/documentation/appkit/nsscrollvie...](https://developer.apple.com/documentation/appkit/nsscrollview)

2\. [https://gist.github.com/zwaldowski/8710fddc8b0b39d2c152#10_9...](https://gist.github.com/zwaldowski/8710fddc8b0b39d2c152#10_9Scrolling)

<comment><USER17> Which components on a typical (say Ubuntu 16.04 desktop) are the toolkit and the compositor? GTK and Gnome?

<comment><USER16> With the caveat that I don't know a lot about Linux GUI infrastructure but I would bucket GTK and the X11 client library into "toolkit", and the compositor would live in the X server and probably to some extent in the display and HID drivers. If you wanted to dig in I would look at doing an analysis of everything between physical finger movement and that movement being reflected on the physical screen, and how to reduce the latency and jitter. Anything about the Firefox APZ implementation [1] and that John Carmack has written about VR latency [2] would give a feel for the problem.

1\. [https://hacks.mozilla.org/2016/02/smoother-scrolling-in- fire...](https://hacks.mozilla.org/2016/02/smoother-scrolling-in- firefox-46-with-apz/)

2\. Original article is broken but this is good: [https://danluu.com/latency- mitigation/](https://danluu.com/latency-mitigation/)

</comment></comment></comment><comment><USER18> I remember once upon a time, I had a PC mouse with a PS/2 connector, that was physically a great mouse, but I preferred using a Mac, which not only had no PS/2 interface but had a very different acceleration curve than anything else. So I connected the mouse to a PC running Linux, and made a little program to communicate with a simple driver on the Mac over an ethernet crossover cable. I started out with TCP/IP, but then thought, well, I don't really need this overhead, maybe UDP will work. And then I thought, well, do I really need the overhead of UDP, maybe raw ethernet will work. It turned out that no error correction was needed at all. Anyway, it wasn't fundamentally that hard to emulate the Mac feel, you just had to go to the effort to figure out the function that maps the movements. It was kind of a sigmoid curve. One of many things that made me wonder why nobody cared but me about certain things.

</comment><comment><USER19> My solution is to use macbook pro as a terminal and editor, and do most of developments on remotely accessed linux machines. I really tried to transition to Linux but UX is so inferior, and there's very little hope that it improves.

<comment><USER20> I find the UX on a Mac to be vastly inferior to Mate or Cinnamon on Linux. The first thing I do when an employer gives me a Macbook is to install Linux on it so I have an usable UI.

<comment><USER19> Another problem which I include in UX is sleep mode. On Mac it works flawlessly. On XPS13 + Ubuntu/Fedora (I tried both) which I used, there's non zero probability that when I open laptop again, the battery is almost empty.

<comment><USER21> Check the logs, is it waking, sleeping, waking, sleeping, waking, sleeping? Power management bugs are super annoying because they are tedious to dig into.

In my very obscure case, I got lucky in that suspend was working, then stopped working after a kernel update. Since it was a regression, kernel developers were more interested in tracking down the problem and I was able to find a work around: write PWRB to /proc/acpi/wakeup

The gory details are here, which I expect is so obscure it's not your problem, but shows as tedious as it is, filing bugs with a decently good bug report and willingness to do the work devs need you to do can be worth it. [https://bugzilla.kernel.org/show_bug.cgi?id=185521](https://bugzilla.kernel.org/show_bug.cgi?id=185521)

<comment><USER19> I honestly tried my best to debug it. I installed different tools, and at some point it seemed to work, but after some time, due to some updates, it broke down. Some time after this, I just stopped using sleep mode. It was easier to turn on/off the whole machine.

XPS13 which I have is one of the most widely used linux laptops, and it a symptomatic that it doesn't work well.

<comment><USER22> Known problem. Here's the workarounds I use:

[https://ubuntu-mate.community/t/xps-13-9370-wakes-from- sleep...](https://ubuntu-mate.community/t/xps-13-9370-wakes-from-sleep- randomly/17877/2) and

[https://askubuntu.com/questions/1029474/ubuntu-18-04-dell- xp...](https://askubuntu.com/questions/1029474/ubuntu-18-04-dell- xps13-9370-no-longer-suspends-on-lid-close)

In addition, I always use a pre-sleep script that disables bluetooth. And enables it afterwards.

Hope it helps!

</comment></comment></comment></comment></comment></comment><comment> saverio-murgia Website seems down. Here is a copy: [https://web.archive.org/web/20190325183108/https://bill.hard...](https://web.archive.org/web/20190325183108/https://bill.harding.blog/2019/03/25/linux- touchpad-like-a-macbook-progress-and-a-call-for-help/#content)

</comment><comment><USER23> I have a question regarding Apple's touchpad palm rejection. Or, maybe my question is regarding touchpads in general.

How much raw data is sent from the device to the computer? Or, to what extent is the information preprocessed before sending?

I could see palm rejection being implemented either in hardware or in software. When a user's palm is resting on the pad, there's a large area of slight capacitance change (i.e. hand is either just barely in contact with the surface, or very very close above it), which is not normal when the user is intentionally dragging their fingertip across the surface.

Does the touchpad report a real-time capacitance map across the whole surface? Or does it do some interpretation onboard and send to the machine what it thinks are the separate touch points and pressure values for each?

<comment><USER24> Regarding apple trackpads - For raw data, you get enough to do ellipsoid tracking, paired with 'state' information to help with palm rejection. This is my experience from working with the multitouch private framework on macos - it's generally been enough to good enough work with and arguably prefer it rather than attempting to do any raw pixel-level tracking (which would tax the CPU)

See:

[https://github.com/jnordberg/FingerMgmt](https://github.com/jnordberg/FingerMgmt)

[https://web.archive.org/web/20120323025118/http://www.steike...](https://web.archive.org/web/20120323025118/http://www.steike.com/code/multitouch/)

I haven't had time but should try to open-source whatever bits I've had over the years when I was bootstrapping thimblemac.com

previous hn discussion on this: [https://news.ycombinator.com/item?id=17547817](https://news.ycombinator.com/item?id=17547817) (where I also commented here: [https://news.ycombinator.com/item?id=17551984](https://news.ycombinator.com/item?id=17551984) )

I haven't kept up with the windows ecosystem to look into the 'precision touchpad' data, assume it's something similar just delivered ~8 years later.

</comment></comment><comment><USER25> I am too lazy to RTFM and debug things, but does anyone know why libinput does not have the same behaviour as the old xorg synaptic driver ? I have a *30 thinkpad, and the synaptic driver is great, but libinput is terrible. It's too imprecise and jumpy. This is a fairly popular generation of thinkpads (the actual touchpad goes back even further). So I thought that it would eventually be fixed, but it looks like so far it hasn't. How does one make libinput act like synaptic ? I don't need gestures or anything fancy. I just want the pointer to work well, which the synaptic driver does an admirable job of handling. It's even better than windows.

<comment><USER21> I'd say it should just work or it's a bug. And I know it's tedious to file bugs and report required information but that's really the only way it's going to get fixed. You could start by asking on the list, just to see if this is a known problem that's already fixed in a later version.

[https://lists.freedesktop.org/mailman/listinfo/wayland- devel](https://lists.freedesktop.org/mailman/listinfo/wayland-devel)

For testing, you don't have to install if you don't want. I suggest installing the latest Fedora 30 beta test candidate. It's more reliable than Rawhide, and yet has the latest libinput so you won't be asked to build a newer version from git. Download the workstation live file, image to a USB stick, and do the testing from the live environment. Software installation is supported, it uses the RAM overlay.

[https://fedoraproject.org/wiki/Test_Results:Fedora_30_Beta_1...](https://fedoraproject.org/wiki/Test_Results:Fedora_30_Beta_1.7_Summary?rd=Test_Results:Current_Summary)

While it's tedious to have to file such detailed bug reports, they make it pretty straightforward to figure out what is needed and how to get it. The devs have no way of guessing what the problem is. Plus, the fix eventually finds its way to all distributions, so people just get the fix rather than you having to maintain a local hack.

[https://wayland.freedesktop.org/libinput/doc/latest/reportin...](https://wayland.freedesktop.org/libinput/doc/latest/reporting- bugs.html)

[https://gitlab.freedesktop.org/libinput/libinput/issues](https://gitlab.freedesktop.org/libinput/libinput/issues)

<comment><USER26> Filing detailed bug reports is still easier than fixing it myself.

I don't have the time or the skill to hack on most open source software, but I do file detailed bug reports, feature requests, and documentation updates whenever I run into an issue.

"It ain't much but it's honest work"

</comment></comment></comment><comment><USER27> My XPS-13 9350 does great (Ubuntu 18.04, Xorg). I just got a score of 292 (156+136 bonus) on that mouse accuracy site on small/hard.

Then again, when a relative ordered one of these laptops, the mousepad was dead on arrival, so ymmv.

<comment><AUTHOR> Wow, that's impressive! I wonder if screen size impacts score on that test? Both my test laptops were 15", which probably means more space between the bubbles.

At any rate, I'd be curious to know if libinput is your driver in use? If you don't know, `cat /var/log/Xorg.0.log | grep "input driver"` should indicate the answer

<comment><USER27> Yep, looks libinput is the driver in use (it says, "Using input driver 'libinput' for 'SynPS/2 Synaptics TouchPad'").

I caution you against using just my anecdote to determine anything concrete, of course.

</comment></comment></comment><comment><USER28> Does anyone know of a good material to simulate a hand, for objectively testing a touchpad?

I've got a 2011 MacBook Pro and a logic analyser, which I'd be willing to use for a bit of touchpad driver testing/development. But, it seems like the missing link is a way to generate consistent signals that cause problems on Linux but not MacOS - I cuss my XPS15 w/ Ubuntu daily, but haven't figured out how to intentionally generate the touchpad issues.

<comment><USER29> Maybe a pair of gloves that work with touchscreens?

<comment><USER28> Just tinkering with a pair of those - the glove itself doesn't activate the XPS 15's touchpad unless my hand is in it. There doesn't appear to be any conduction between my hand and the contact point on the outside of the glove according to the resistance measurement function on a good handheld multimeter, so it's not clear to me how the gloves work. But, I have managed to get a piece of copper foil, kapton, and some wire to activate it. I guess the touchpad uses some kind of RF, which makes sense...

Will try to make a test jig that consistently triggers one of the irritating behaviours, but my touchpad R&D period (aka conference call) is wrapping up, so it'll be a while.

<comment><USER30> Usually capacitive touchscreens sense a capacitance difference, which is set by the dielectric permittivity (ε) of the material above. Ours is close to water's, but an insulating layer from another material will yield different measurements.

I am guessing that touchpads use similar tech.

A fun fact is that capacitive sensors such as the one used on touchscreens are fully 3D-capable, but that seems to be rarely used (I've seen it once or twice on Samsung phones, and Sony's "glove mode").

</comment></comment></comment></comment><comment><USER31> I finally made the switch over from 11 years of macbooks, and I bought a Dell XPS and put Manjaro on it. This was a good decision, in every way _except_ for the touch pad. The touch pad is utter garbage compared to the mac touchpad, and several nights worth of pouring over linux blog posts and trying experimental input processing packages has not changed this.

I really, really hope that this project is successful.

</comment><comment><USER32> On actual macbooks libinput feels like a significant downgrade to synaptics, the mouse speed + acceleration is way off and not configurable via a gui, and other things you'd expect to work, like three-finger-click, don't. I actually downgraded back to Xorg after trying Wayland for a while. Just getting up to par with synaptics (that has natural scrolling on) would be great.

</comment><comment><USER33> > turns out, a niche OS with a subjective quality issue is -- in this case -- > a topic that's important to thousands

I would argue that it is less a quality issue, and more that experienced GNU/Linux users tend not have a strong preference for touchpads. There's no collective desire to improve them.

Away from my desktop (where a touchpad is irrelevant) my X200 doesn't even have a touchpad. I have an X250 thinkpad with touchpad, but it sees minimal use and performs just fine. I tend to use it when the laptop is at arms reach and it's easier to select a file that way than lean over and use the keyboard.

When I'm working I use i3wm (tiling window manager) and most GNU/Linux application make huge use of keyboard bindings. Using a mouse, or worse a trackpad, is massively inefficient.

'OMG, I wish my new MacBook Pro enormous trackpad functioned better when I'm using Ubuntu' is not a phrase I hear often.

<comment><USER34> Sounds like you've never used a good trackpad. When the trackpad driver is abysmal like it is on Linux, of course you prefer using a mouse.

<comment><USER33> Yes, as with so many hackers in the GNU/Linux universe I have been painfully waiting all my life for someone to come along and develop a really nice trackpad so I can use it with my tiling window manager, Emacs, and CLI tools.

</comment></comment></comment><comment><USER35> I can report that the touchpad on a Dell XPS 13 under FreeBSD is absolutely horrendous (at least by default, and I haven't figure out how to tune it better yet). I hope all this talk about X and libinput really means "the open source ecosphere" and not really actually "Linux", because I want this too.

</comment><comment><USER36> It's probably worth comparing notes with Bingxing Wang, who has a similar project to provide an open source Apple Touchpad driver for Windows:

[https://github.com/imbushuo/mac-precision- touchpad/](https://github.com/imbushuo/mac-precision-touchpad/)

</comment><comment><USER37> If the author and others haven't seen "BetterTouchTool" for Mac, there might be some useful code or inspiration to come from it.

It has a "multitouch live view" debug window that displays exact pixel touch locations and shapes.

The homepage showing this (third screenshot) is here: [https://blog.boastr.net/](https://blog.boastr.net/)

</comment><comment><USER38> I'd love to see this happen. I know Windows's support of the touch pad is not as magical as macOS's when running on a MacBook.

That said, I don't know if your request will be quite fruitful. It comes across as too "I'd like to run this project if you want to help out and here's how we will run it". Instead, I think what you need to do (if you could) is start the technical work yourself and get others to help out.

If I knew how to fix the touch pad issue, I'd probably just do it independently or else find someone else technical who can help out and we could do it together. I wouldn't be looking for a PM (and the timeline or project plans is kind of a turn off for a side project). Anyway, I hope you're able to find someone who can help you out.

<comment><AUTHOR> > It comes across as too "I'd like to run this project if you want to help out > and here's how we will run it". Instead, I think what you need to do (if you > could) is start the technical work yourself and get others to help out.

I so wish that I had the time to start the technical work myself. But I'm currently experiencing the misfortune of trying to run three products at the same time for my day job (as a CEO/developer).

But I care about touchpads (or at least, not relying on Macbook) too much to do nothing. So even though it sucks that I can't just make time to work on setting up the project myself, at least this effort holds the possibility that like-minded folks will join me to make that happen.

</comment></comment><comment><USER39> How do you intend on performing your tests? Just by continuously testing your own mouse precision performance?

Would it be possible to emulate touchpad input? Maybe see if you can record enough touchpad data on macOS to be able to make a replay driver on Linux, or maybe with an arduino emulating a touchpad with synthetic input.

That way, testing could become a set of test cases along the lines of "given this input and a cursor at position 0,0, the cursor should end up at position X, Y", and you'd be able to see how big the current error is. A bunch of those tests with various recorded movements should be a lot more stable than a human test.

</comment><comment><USER40> I'm not sure that comparing trackpads on mouseaccuracy.com may be a good idea... I am using a Dell E7270, and I'm able to get a [244 score]([https://vgy.me/UJ7LW4.png](https://vgy.me/UJ7LW4.png)) on it (and I never complained about my touchpad). Of course, I would love it to improve even further, but I don't feel it to be so bad after all, but I see people complaining when what we (or, at least I) have is pretty good...

</comment><comment><USER41> Doesn't Apple have some sort of patent on the hardware part of things, such as the glass in the trackpad? I can't read the site as it's being hugged to death...

</comment><comment><USER42> So, are there any affordable Windows/Linux laptops not made by Apple that carry touchpads that are even _remotely_ compareable to a MBP2015 in terms of hardware?

When I go to the nearest computer store all I see is shitty 4cm-wide black plastic stuff with a depth of easily 2mm. The plastic will get "shiny" from fat fingers (dito for the keyboard), and the tiny-ness makes any kind of gestures ... weird if not impossible at all.

<comment><USER13> Dell xps15/xps13/precision 5520/5530? The xps15 and precision models have a 4 x 3.1 inch touchpad, the 13 inch might be smaller, I'm not sure. I don't know what it's made out of but it has a matte finish and is not going shiny with use. My experience with it has been very nice.

Edit: oh, you said affordable. I think the answer is probably "no" then, but macbooks are not cheap either. These dells are comparable in price to macbooks.

</comment></comment><comment><USER43> > Linux touchpad scores on par with Macbook touchpad per mouseaccuracy.com > testing. As of today, I can consistently score twice as high on macOS > (average score 250 with "Hard" + "Small" options) vs Linux (average score > ~100).

I've never tried Linux on a MacBook, but those must be some _really_ bad drivers. I used my trackpoint on the same size/difficulty settings and scored 160. I'd probably do better with practice.

<comment><USER44> > _I 've never tried Linux on a MacBook, but those must be some really bad > drivers._

Or a really bad trackpad. It's not just the drivers.

> _I used my trackpoint on the same size /difficulty settings and scored 160._

Still nowhere close to 250.

<comment><USER45> I've scored 345 on my first try ever with xf86-input-synaptics and Lenovo Yoga 2 Pro.

See [https://news.ycombinator.com/item?id=19486081](https://news.ycombinator.com/item?id=19486081)

</comment></comment></comment><comment><USER46> Seeing as people have mentioned libinput, xorg.conf and other manual things and seeing as this is Hacker News.. the way I get around this is by using cwm as a window manager with its rudimentary tiling, tmux in st/alacritty/xterm and either Firefox or Chromium with vimium. Often I don't reach for the touchpad or mouse for hours.

</comment><comment><USER47> Honestly, the trackpad is the one thing that a Macbook still has over a laptop with Ubuntu or Elementary installed on it. IMHO.

<comment><USER48> I absolutely love the Macbook touchpad, the keyboard has gotten subjectively worse since around 2010 though imho. The only reason I bought my macbook (around 2015) is because of the touchpad (and screen) and while some laptops had equally good screens or mildly better keyboards the touchpad was lacking. Still hoping for a better hardware alternative in the future (that doesn't cost an arm and a leg) I don't think I'll throw down $3500 on a laptop again either.

</comment></comment><comment><USER23> Any mirrors for this? Just from the headline, I'd love to see what is being done to match Apple's touchpad quality.

<comment><USER49> [http://archive.is/uxh3z](http://archive.is/uxh3z)

</comment></comment><comment><USER50> As a long Mac user I am looking at non-Apple laptop computers for a while now (mainly because of dongle-madness, reduced build quality in the newer MacBook Pros, and the bad keyboard). The trackpad is the biggest reason for me to keep using my 2014 MacBook Pro and not buy a Laptop from another manufacturer to put Linux on.

</comment><comment><USER51> How much of PC laptops' touchpad quality is due to hardware limitations? I seem to recall back when I owned an Apple laptop (circa 2010) that its trackpad was connected internally via USB. Meanwhile, PC touchpads almost universally used PS/2 which provided far lower bandwidth. Is this still the case?

<comment><USER52> The Microsoft Precision Touchpad[1] devices are interfaced over I2C or USB. Bandwidth for I2C depends on implementation AFAIK, but should be plenty for a responsive touchpad.

[1] [https://docs.microsoft.com/en-us/windows- hardware/design/com...](https://docs.microsoft.com/en-us/windows- hardware/design/component-guidelines/windows-precision-touchpad- implementation-guide)

</comment></comment><comment><USER53> When reading stuff like this I wonder if maybe a MacBook would be a cure for my hate (ok, distaste?) of touchpads or if it's too late or if it would change anything (so far trying out macs for short amount of time didn't help).

\-- someone carrying a mouse or using the red thinkpad button thingy since 2004.

<comment><USER54> Coming from Linux and Windows: the Mac touch pad works well. Once you learn the strokes and finger combinations, no mouse is needed. It becomes natural in use. And the control panel has various knobs if you don't like some of the defaults.

</comment></comment><comment><USER55> It's really cool to see this get legs. Thanks OP for spearheading the effort. It would go a long way towards getting Linux competitive on desktop.

I can't donate dev time but I'm happy to donate testing time and to throw in some cash too.

</comment><comment><USER45> As a exclusive touchpad user for years, "Feels like a Macbook" isn't really the best idea for me. When it comes to drivers, MacBook gives you an okay experience. Windows often gives you terrible one ("precision drivers" helped a lot there - no such drivers for my touchpad though). GNU/Linux can give you variety depending on configuration, although there are some pitfalls and compromises. For instance, I definitely wouldn't trade my xf86-input-synaptics experience with the MacBook one, however, it has a trouble of kinetic scrolling being implemented very naively and the "thumb detection" is a bit worse than with libinput (which is actually too aggressive in this regard and it negatively affects things like two-finger scrolling for me).

I'm using both the integrated touchpad of my Lenovo Yoga 2 Pro (produced in 2014) and Apple Magic Trackpad 2. The former with xf86-input-synaptics driver, the latter with libinput. My partner has a MacBook Pro which I sometimes lend to test some stuff on macOS. Overall my touchpads on GNU/Linux feel somewhat better; macOS however wins when it comes to application support and integration. I've tried Windows once on my Yoga and it was completely unbearable.

IMO the main thing GNU/Linux needs in this regard aren't the drivers. libinput will get there eventually (it improved a lot over past few years; initially it was pretty much just as unusable as Windows). The main thing that's dramatically needed is application support. You get an absolutely awful touchpad experience with Firefox on X11 until you set MOZ_USE_XINPUT2=1 environment variable, for instance. However, if you enable it, there's a bug somewhere that's triggered by KWin[0] that sometimes makes scrolling unbearable until you refocus the window. I don't even have to mention missing out-of-the-box touchpad gestures support and the fact that macOS implements them smoothly (say, the transition progresses exactly as you move your fingers), while all of the solutions I've seen on GNU/Linux work as simple triggers.

Let's back it up with some data. I've never seen mouseaccuracy.com in my life before, fun stuff. Tried it with the same settings as the author ("hard", "small"; for 30 seconds):

Yoga 2 Pro touchpad on GNU/Linux (synaptics): "TOTAL SCORE: 345; TARGET EFFICIENCY: 69%; CLICK ACCURACY: 96%"

Apple Magic Trackpad 2 on GNU/Linux (libinput): "TOTAL SCORE: 299; TARGET EFFICIENCY: 63%; CLICK ACCURACY: 87%"

MacBook Pro 13 Mid-2012 touchpad on macOS: "TOTAL SCORE: 286; TARGET EFFICIENCY: 58%; CLICK ACCURACY: 93%"

Apple Magic Trackpad 2 on macOS: "TOTAL SCORE: 262; TARGET EFFICIENCY: 56%; CLICK ACCURACY: 82%"

It was definitely harder to do those fast clicks on the Magic Trackpad, because it only emulates a clickpad, while all the other touchpads can be physically clicked (this is a feature that actually made me buy the Magic Trackpad as it makes it exceptionally quiet, but it doesn't really help with accuracy and agility). When it comes to "personal feeling" during the game, the Yoga touchpad handled by synaptics driver definitely felt the best, while all the other runs felt kinda similar (libinput won with macOS in numbers, but I didn't really "feel" it).

[0] [https://bugs.kde.org/show_bug.cgi?id=348270](https://bugs.kde.org/show_bug.cgi?id=348270)

<comment><USER56> And here is a comparison with an actual mouse (first try on a Logitech Master MX 2s):

TOTAL SCORE: 386; TARGET EFFICIENCY: 80%; CLICK ACCURACY: 89%

Am I the only one who uses a mouse whenever possible, no matter how 'good' the trackpad is?

The Logitech Master Anywhere 2s (the smaller version of the mouse I used above) is very portable, very accurate (even on glass), has excellent battery life and works well with bluetooth. It really isn't much of a hassle to bring it along anywhere you go.

<comment><USER57> I tried it with a "actual mouse" too --- a Microsoft Wheel Mouse Optical (the "classic" one that apparently a lot of gamers use, but I'm not much of a gamer myself --- it's just a cheap and comfortable mouse):

TOTAL SCORE: 574; TARGET EFFICIENCY: 91%; CLICK ACCURACY: 98%

I would definitely use a mouse over a trackpad; in fact I have an IBM X60 but it is not on hand at the moment, and I'd rather use the "clitmouse" on that than a trackpad. All the trackpads I've tried, including the Macbook ones, induce an unpleasant sticky feeling on the fingers.

<comment><USER58> source on the gamer reference? nearly every tournament i see either razer or logitech. haven't seen any ms mouses in the past 3 years and i see all the major tourneys(cs,overwatch,dota etc)

googling returns no results apart from a forum link from 2013 about quake

</comment></comment></comment></comment><comment><USER59> libinput works pretty much perfectly for me, both on a Thinkpad X240 (Synaptics PS/2, FreeBSD psm(4)) and a Magic Trackpad 1st gen.

The _only_ issue I have is that it's too conservative about starting to recognize gestures. On macOS, you can quickly transition from scrolling to pinching/rotating and it knows what you want. On libinput, you have to very deliberately stop scrolling, put two fingers into a pinch position, and start pinching.

<comment><USER60> I would love that deliberateness. There are so many times I unintentionally do a gesture using the built in ones on OS X that I had to turn it off.

</comment></comment><comment><USER61> My 2017 Hp Omen notebook has linux mint and nvidia drivers installed. Touchpad feels and works exactly like MacBook pro's. Very satisfied with it.

</comment><comment><USER62> I'm using a Logitech one, external and my Asus has an ELAN one. Got them both to work after a bunch of fiddling, would like better docs.

</comment><comment><USER63> I can't read the article because the site is hosed. I have a Lenovo ThinkPad X1 Extreme, and the touchpad is as good as any MacBook I've ever owned. It's the only non-MacBook that I've encountered where the touchpad is even usable.

I don't usually run Linux on it, but I have, and I don't recall it behaving any differently than it does in Windows. Maybe the pinch gesture doesn't work in Linux; I'm not going to reboot to test.

<comment><USER64> How does the X1's trackpad compare in size to a MBP? Trackpad is probably the showstopper that kept me from switching to some Linux in the past.

<comment><USER63> It's a fair bit smaller than the current MBP touchpad. More like older MBP models. I don't like how gigantic the current MBP one is. Apple does a good job of ignoring rogue palm touches, via software, but in a way that makes it unresponsive when you want to do keyboard+touchpad combinations (which are rare, but important in some drawing apps and some games). Overall I find that I don't need that much touchpad real estate.

</comment></comment></comment><comment><USER65> My current solution is to use a 2013 BMP streaming trackpad events to linux via Synergy. I have to use a specific old (1.8.8) version that has been patched for smooth scrolling though. Having a laptop setting in my lap while I use my desktop is not ideal though.

<comment><USER66> You can connect a Bluetooth Magic Trackpad 2 to your MBP :)

<comment><USER45> ...or to any GNU/Linux PCs since 4.20 kernel.

(spoiler: it a good touchpad, but not really exceptional)

<comment><USER67> Attached to a Linux PC, it's pretty abysmal. Attached to a Mac it's much better.

<comment><USER45> I'm using it with both and aside of poor touchpad support in applications (which is of course a big thing, but it applies to every touchpad out there), there's not much difference. Driver is fine, it's apps and toolkits that need a lot of work. When the app supports it well, it works really well.

</comment></comment></comment></comment></comment><comment><USER68> Getting a 404 page

</comment><comment><USER69> Here I am using Macbook with a good old mouse.

</comment><comment><USER70> Please please make this work!

</comment><comment><AUTHOR> Looks like a bit of HN was too much for my web host to handle (investigating). In the meantime, here's the note that I wrote the update in and copy/pasted to the blog: [https://public.amplenote.com/4wdQRLmYVU6wAHo1V9yKgaJK](https://public.amplenote.com/4wdQRLmYVU6wAHo1V9yKgaJK)

<comment><AUTHOR> According to the chat rep at Porkbun (the web host for this site), "it appears the site may have received spam complaints." Which I think is their way of saying they can't handle this much traffic. Actively working all possible angles to get the blog restored with them, but this backup version seems to be holding up so far.

</comment></comment><comment><USER71> Very good article. Can someone explain me the pop culture reference to [https://images.amplenote.com/35bd7d80-eabc-11e8-8f1b-0a54dd3...](https://images.amplenote.com/35bd7d80-eabc-11e8-8f1b-0a54dd353f78/1fdc4191-c0ff-4829-aeab- fe4c7cf561d5) that is present at the end of the article under the hypertext "pragmatist at heart".

How does the phrase "pragmatist at heart" relate to "Good Old Grateful Dead" and what is "Good Old Grateful Dead"?

<comment><USER72> If you scroll down, it's a jerry garcia quote, "somebody has to do something, it's just incredibly pathetic that it has to be us."

</comment></comment><comment><USER73> Just use neural networks to train. You're welcome.

edit: this isn't a joke

<comment><USER58> be sure to play eye of the tiger while training ;)

</comment></comment><comment><USER74> Synaptics touchpads have multiple "APIs." Very likely, linux drivers simply don't get the same input as Mac's that may use Synaptics non-hid data format.

A task for a logic analyser as much as for software dev.

</comment><comment><USER75> I don't see why you'd need to fork libinput. I'm fine with my cursor movements, what I want is gestures, and libinput already delivers those. It is up to the desktop environment to implement them (PROPERLY).

I have taken a look at the libinput-debug sample code and my main DE (Gala, written in Vala, which is a frontend for C), with the resulting opinion that for someone decently-experienced it should be fairly easy to do. Unfortunately I am not that person (yet).

<comment><USER76> >I don't see why you'd need to fork libinput. I'm fine with my cursor movements

You may be (and I agree on gestures), but I'm not. Apple's touch pad is literally the only thing that keeps me using a Mac.</comment></comment>


The Mobile Telephone in Bell System Service, 1946-1993 - <AUTHOR> http://www.wb6nvh.com/Carphone.htm

<comment><USER2> Hidden in here are some old telephone bills. If you missed them, [http://www.wb6nvh.com/MTSmisc/Bills.htm](http://www.wb6nvh.com/MTSmisc/Bills.htm)

<comment><AUTHOR> $19.50 in 1969 dollars is about $122 in today's dollars, so those calls were pretty pricey.

<comment><USER3> Wow, looks like they were typed manually, rather than printed out on a dot- matrix. Wonder what kind system that information was transcribed from? Operators keeping a handwritten ledger?</comment></comment></comment>


Show HN: FayeSwift – A Faye client written in swift - <AUTHOR> http://github.com/hamin/FayeSwift

<comment><AUTHOR> For those who don't know what Faye is, its a PubSub server built on top of the Bayeux/Comet protocol. [http://faye.jcoglan.com/](http://faye.jcoglan.com/)

Right now only supporting websocket transport but have plans to add long polling support soon too. Just refactored the library so this would be easier to do now

</comment><comment><USER2> Great to see this! We are implementing a Bayeux server and will have to try it out.

<comment><AUTHOR> that's awesome! What language/environment are you guys building the Bayeux server for? Link? Would love to help out if possible. I helped implement part of this with my ex-colleage/friend [https://github.com/pcrawfor/fayego](https://github.com/pcrawfor/fayego) Also feel free to open any issues/pull-requests on the swift library :)

<comment><USER2> Our Bayeux server is written in python, which sits behind our general-purpose realtime server called Pushpin ( [https://github.com/fanout/pushpin](https://github.com/fanout/pushpin) ). Pushpin is written in a combination of C++ and python.

The Bayeux code itself is not public, but this may change in the future after I make the project more presentable. I'll let you know when it's live on our cloud service if you want to try testing your client with it. Should happen in the next day or so, hopefully.</comment></comment></comment>


Why No HTTPS? - <AUTHOR> https://whynohttps.com <comment><USER3> When I'm on free airport wifi they'll often limit the session to half an hour and then start MITMing your traffic to try to bounce you back out to the sign- in page to agree to the terms and conditions again. When that happens, the redirect won't work if you're trying to browse to an HTTPS URL. Worse, for many sites you can't tell your browser to "just go along with the MITM" because of HSTS.

So in airports I rack my brain for a website that might serve content over HTTP, not HTTPS. Alas, they're getting harder to find, and it's getting harder to keep those airport wifi sessions going. I half considered registering "alwaysinsecure.com" or "alwayshttp.com" so I could reliably find one... Now I'll probably just use qq.com, it's short and easy to remember.

EDIT: Thanks all :-)

<comment><USER4> [http://neverssl.com/](http://neverssl.com/) is what you're looking for here.

<comment><USER5> Interesting. What the prescription here - to simply use [http://neverssl.com](http://neverssl.com) in order to see if you need to re- authenticate to the captive portal? Is that correct?

<comment><USER6> That's my interpretation of what [http://neverssl.com](http://neverssl.com) says. (Did you click-through to read it?)

</comment></comment></comment></comment><comment><USER7> I have public content that I'm willing to share over the web. To offer it over HTTP, I only need a few thousand lines of code on top of TCP. It's realistic to prove that that code has no memory-safety problems. To offer it over HTTPS, I need to add tens of thousands of lines of extra code related to cryptography. No existing implementation is known to be correct. The popular implementations don't have a strong history of code quality. It's completely reasonable to expect that, over time, new vulnerabilities will be found that will allow attackers to read or write to unintended memory locations on my server.

I totally understand that, by adding a popular but historically unsafe cryptography implementation, I can help web clients to avoid MITM shenanigans while reading my content. MITM indeed is a problem. But, I'm not willing to make that my problem. The vast majority of my customers don't experience MITM data modification while reading my content. The vast majority of my customers wouldn't care if the whole world knew that they have read my content.

Perhaps in the future, code for all the required cryptography layers will be just as provably correct as code for reading the cleartext HTTP protocol. When that day comes, I will add HTTPS. Not before.

<comment><USER8> I don't follow.

1\. You don't have to write any code to use HTTPS, it has already been written.

2\. Are you saying that since HTTPS isn't perfectly secure you're gonna use the definitely insecure HTTP? What kind of logic is that?

<comment><USER9> From a purely selfish perspective:

HTTP worst case: your reader is harmed.

HTTPS worst case: you yourself are harmed (e.g., if someone finds a zero-day in a cryptography library and uses it to run arbitrary code on your server)

<comment><USER10> Yeah because nobody has ever found rce bugs in other parts of the http server infra. The only way people get rce on your box is by exploiting tls libs. Right.

<comment><USER9> HTTP is simple enough I can literally create a barebones semi-compliant HTTP server from scratch. If all it has to do is serve some static pages, I can do this in ~1000 lines or less. I don't need any infrastructure beyond basic TCP/IP. Can't say the same about HTTPS.

<comment><USER11> I'd say you should be counting the lines of code needed to implement TCP/IP – as well as DHCP, ARP, Ethernet, maybe DNS, and anything else I've forgotten that your server needs to speak. Consider lwIP, the most common implementation of those protocols on microcontrollers: it's meant to be minimalistic, but it's still some ~35,000 SLoC, not including tests. For comparison, a minimalistic implementation of TLS is Amazon's s2n, which is ~12,000 SLoC. Adding s2n to lwIP would only represent an increase in code size of about one third.

Of course, a more typical HTTP/HTTPS server will be using the Linux kernel for networking (with some userland bits for DHCP and DNS), and OpenSSL for TLS – overall representing multiple orders of magnitude more code. But I suspect the proportion between TLS and non-TLS would be somewhere in the same ballpark, depending on how you count.

The problem is that on Linux, the TCP/IP stack is in-kernel, universal for everything on the system, and overall unobtrusive – it mostly 'just works' – while OpenSSL is in userland, has an unwieldy API and unstable ABI, can be linked in many different ways, requires a lot of configuration, and is overall a pain in the neck. So as a developer, the complexity of TLS weighs heavily on you, while the complexity of TCP/IP is something you can largely forget about.

Personally, I think TLS adoption would have been quicker if it had been implemented in the kernel and it just became a switch you could flip in the socket API; something like:

        socket(AF_INET, SOCK_STREAM, PF_TLS)

But for better or worse, that's not how things panned out.

</comment></comment></comment></comment></comment></comment><comment><USER12> It's worth noting that HTTP->HTTPS redirect is, in some sense, game-over already. A malicious actor upstream can mitm by blocking the redirect and providing an HTTP version to the client while communicating HTTPS to the server. sslstrip is one implementation.

<comment><USER13> A quick solution that solves many cases is to also use HTTP Strict Transport Security (HSTS), and declare it for at least a year. Then once the user visits the site (say from home) and gets the HSTS header, later visits in that time will always use HTTPS. This solves the problem in many cases.

The best solution is to get your site into the HSTS preload list. You can do that here: [https://hstspreload.org/](https://hstspreload.org/) \- this adds the site to the Chrome list, and most other major browsers (Firefox, Opera, Safari, IE 11 and Edge) have an HSTS preload list based on the Chrome list. Once that happens and the browser updates, users will always use https, even if they ask for http.

<comment><USER14> Even simpler, just use a domain on an HSTS-preloaded TLD, like .app. And stay tuned for more options coming soon ;)

</comment></comment></comment><comment><USER15> The 'web' is kind of for the commons, but HTTPS is just a few steps away from being 'easy'. The steps required are frankly just a little too weird and ugly.

Most people making web sites, even many devs, don't necessarily want to, or have the wherewithal to deal with SSL.

Setting up SSL on AWS recently was a monster pain the rear for our little nothing project site, granted a lot of that was AWS oriented.

It needs to be easier, if it were easy, everyone would be doing it.

<comment><USER16> > _many devs, don 't [...] have the wherewithal to deal with SSL._

I can buy this for a non-dev clicking "Install Wordpress" in a legacy cpanel of a cheap shared web host (though in that case the web host should be setting up certs automatically for them), but what exactly is complicated about setting up certs for a dev? [https://certbot.eff.org/](https://certbot.eff.org/) holds your hand through the entire ~30 second process. It's simpler than most other tasks a dev needs to do while setting up a website.

<comment><USER17> Sometimes it comes down to whether user-generated content with externally linked resources is allowed on the site. E.g. forums often allows embedding images by users and because users don't care about HTTP or HTTPS and only copy the image link from somewhere, you will end up with "mixed content" warnings and broken "locks" in the browser address bar all over the place.

The current alternative is to simply use HTTP, which doesn't yield any warnings. When Chrome will mark all non-HTTPS sites as insecure this will change, hopefully.

<comment><USER16> This is a very good point, but as you say and the article states, the lack of warnings for this is changing.

There's also the obvious question of having user login/signup on a non-HTTPS site in the first place (pseudo-anonymous user accounts or otherwise).

</comment></comment></comment></comment><comment><USER18> That's weird. If I browse some of the sites in the list, I do see them secure....

Example : [http://www.leboncoin.fr/](http://www.leboncoin.fr/) redirects to [https://www.leboncoin.fr/](https://www.leboncoin.fr/)

<comment><USER19> Our accuracy rate is currently around 99.6% so we're doing pretty well but of course I don't think it can ever be 100% either.

The biggest thing we've come across so far is geo-sensitive handling of requests. Some sites will redirect you to HTTPS or not based on where you are making the request from! This of course means you might see HTTPS and we see HTTP.

I think it's still fair to include those sites in this case because they aren't serving all traffic securely.

<comment><USER18> Hey, thanks for the extra insight, I do appreciate. Interesting to know that those sites show these behaviours too. Why could geo-location based redirect be interesting?

<comment><USER19> My guess would be that maybe sites have different infrastructure in different regions and maybe they aren't completely aligned on their progress. I really don't know why you'd intentionally have it like that.

<comment><USER18> I thought about country restrictions as well. I noticed most of the offending websites were in China. Wondering is having SSL there is not allowed or something.

</comment></comment></comment></comment></comment><comment><USER20> Judging by the contents of the list for the Netherlands, we are doing quite well: [https://whynohttps.com/country/nl](https://whynohttps.com/country/nl)

Most pressing ones are uva.nl (major University) and at5.nl (local but relatively large news site).

<comment><USER21> In Germany I thought if kind of sad, that a major automotive forum isn't https secured (motortalk.de). I was asking myself, how they manage their user's logins.

Then I checked. The are secured. Not sure since when, but maybe the data from whynohttps isn't as fresh as one might think.

And lot of bigger press sites (spiegel.de, faz.net. computerbild.de) aren't secured still. Kind of a shame imho.

<comment><USER22> The main reason for big media sites and forums not being https secured is the interest of the advertising community. There was a huge community discussion on sites like golem.de and Heise.de, which only recently switched to https. Login pages are protected almost all the time.

<comment><USER23> That still keeps the session and login cookie vulnerable right?

</comment></comment></comment></comment><comment><USER24> I can recommend another site a just used yesterday for finding all the broken ([http://](http://)) image references is [https://www.whynopadlock.com](https://www.whynopadlock.com)

The site I was debugging was a WordPress site that had somehow gotten the images in its opening carousel set to [http://](http://) despite the fact that the "header" module had a default of [https://](https://). Very useful to just feed it the URL and notice these were the broken images; I could have grep'd through a "show source" page, but whynopadlock.com made it easy for me to identify that it was the header module of a site for which I had little familiarity.

</comment><comment><USER25> Nice to know that a bank, Sberbank, doesn't bother to use HTTPS.

</comment><comment><USER26> BBC.com does have HTTPS, they support http for older clients I assume. They still had a WAP site as far as I recall.

<comment><USER27> The https request gets redirected to http:

      curl -IL https://www.bbc.com
      HTTP/2 302
      content-type: text/html
      date: Tue, 24 Jul 2018 08:55:34 GMT
      location: http://www.bbc.com/
      content-length: 0

      HTTP/1.1 200 OK
      Server: Apache
      Content-Type: text/html
      Expires: Tue, 24 Jul 2018 08:56:35 GMT
      Content-Language: en
      …

<comment><USER28> bbc.com redirects to bbc.co.uk in the UK, which is served over HTTPS. They just flipped that switch a couple of months ago, so I'd assume that it won't be long before bbc.com is also HTTPS.

</comment></comment></comment><comment><USER29> I know nothing of https.

I put my sites on free cloudflare and i get https without having to do anything, is that enough or?

<comment><USER30> Note that the "Flexible SSL" and even the "Full SSL" options don't protect the traffic between your server and Cloudflare. You you need to enable "Full SSL (strict)" as your SSL setting for that.

<comment><USER31> However, he is getting quite a sizable portion of all the security benefits on HTTPS even with the current setup. I think it's quite a bit better than plaintext http all the way. Troy Hunt has written well about this: [https://www.troyhunt.com/cloudflare-ssl-and-unhealthy- securi...](https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security- absolutism/)

<comment><USER32> You get a few benefits (protection against local interception) but it comes with a significant downside as it takes away the ability for an end user to identify if the connection is actually secure. For example I wouldn't enter my card details or other personal info on a HTTP site, but when CF is in front of it, I have no way of knowing if that's strict HTTPS to the origin or if most of the connection goes insecurely over the internet. The other problem is that CF makes it very easy for less technical website owners to click a button, see a green lock and assume everything is fine.

</comment></comment></comment></comment><comment><USER33> [https://whynohttps.com/country/tw](https://whynohttps.com/country/tw). Taiwan, Province of China. Taiwan is a country. This would be the correct wording: Republic of China.

China used its influence at the UN to have that included in ISO: [https://en.wikipedia.org/wiki/ISO_3166-1#Naming_and_dispute](https://en.wikipedia.org/wiki/ISO_3166-1#Naming_and_dispute)

<comment><USER34> its not just the UN. Almost no country recognizes Taiwan as a sovereign state. No embassies in Taiwan. That is really weird but that is the current diplomatic situation.

<comment><USER35> Simply not true. Most countries recognise Taiwan. But you cannot deal with China if you say that out loud.

<comment><USER34> What is your source for your claim?

<comment><USER35> [https://en.m.wikipedia.org/wiki/One- China_policy](https://en.m.wikipedia.org/wiki/One-China_policy)

It's called the one China policy. I.e strong arm governments to not recognise Taiwan in order to do business with China.

</comment></comment></comment></comment></comment><comment><USER36> What's the point of encrypting the sites in China anyway? I mean obviously everything you do online in China is tracked and not only that but shared - <USER2> is it maybe better in China to just not encrypt to safe on the additional power consumption? Really good green policy in China :D

<comment><USER37> State actors are not the only threats

<comment><USER36> I means it's more about local corruption in China right which is driven by perverse economic pressures that come from an overbearing centerialized government power.

</comment></comment></comment><comment><USER38> Another (very) bad news:

only 17.7% of HTTPS sites support HTTP Strict Transport Security (HSTS) == 82.3% of HTTPS sites are HTTP!!!

[https://www.ssllabs.com/ssl-pulse/](https://www.ssllabs.com/ssl-pulse/)

</comment><comment><USER39> baidu and google.cn are high up on the list of non-HTTPS sites.

google.cn is an interesting one though: It redirects HTTPS to http, but the site consists of an image that redirects to google.com.hk which is https-only.

Who knows what you see in China when accessing google.cn...

</comment><comment><USER40> He he, this is quite funny: [https://whynohttps.com/country/ro](https://whynohttps.com/country/ro)

Sites 1, 2, 3 are for pirating movies and TV shows :))))

</comment><comment><USER41> [https://whynohttps.com/country/nz](https://whynohttps.com/country/nz)

Ouch number 5 in NZ is a Credit card payment gateway

<comment><USER42> In their defense, they don't offer payments through the site. Their actual payment gateway (sec.paymentexpress.com) is secured with https [1].

I'd be more concerned with the ecommerce sites on the list, like Rebel Sport. Kmart at least does seem to redirect to HTTPS.

[1] [http://paymentexpress.com/merchant-ecommerce- pxpay.html](http://paymentexpress.com/merchant-ecommerce-pxpay.html)

<comment><USER23> Yes, but if you can midm the http connection you can appear the main site however you like. Including some login format or other way to obtain sensitive data.

</comment></comment></comment><comment><USER43> You can figure out your own certs or manage the cert request/verification cycle via Let's Encrypt...or you can let someone else do it for you. I recently joined a company that offers HTTPS out of the box for any domain you own: [https://blog.backplane.io/how-to-get- https-80e1b28b878c](https://blog.backplane.io/how-to-get-https-80e1b28b878c)

I'm biased, but I do think it's a pretty painless way to enable HTTPS for sites both big and small. No uploading of certs, no modifications to your web app are necessary, it just works.

</comment><comment><USER44> t.co is an unusual one. It's a link shortener that produces an https link if you give it an https link, or an http link if you give it an http link. At least I think that's how it worked but I'm having a hard time testing it now.

</comment><comment><USER45> A nice list of sites to avoid.

</comment><comment><USER46> I expected more porn.

<comment><USER19> I expected less to be honest. The adult entertainment industry has been on a huge drive to encryption recently. It makes sense if you think about the content they serve, I guess people want more privacy there!

</comment></comment><comment><USER47> Why is Puerto Rico marked as a country at the bottom?

</comment><comment><USER48> I mean on some sites I make, I just don't care if its encrypted. I hate that I have to just because all you mofo's have forced me.

<comment><USER49> > I hate that I have to just because all you mofo's have forced me.

I can't empathize with this perspective.

"Encrypt every packet with strong cryptography" is the mission statement of the information security community ever since Edward Snowden went public.

The "mofos" have "forced" you to protect your users from attacks like QUANTUMINSERT.

The "mofos" have "forced" you to protect your users from abusive ISPs injecting advertisements that track them into web pages that gain no revenue from these ads.

The "mofos" have "forced" you to protect your users from being hit with increased malvertising and watering hole attacks because ISPs generally cannot secure their own systems.

I think the wins here far outweigh the temporary inconvenience of having to install/use certbot.

<comment><USER50> Okay, I'll bite.

Why would strong-encryption be necessary for a video game guide web-page? Say, one about Factorio?

Some game communities are toxic. IE: Minecraft guides I'd host with https due to the threat of scumbags and hackers. But Factorio's community is incredibly lax and laid-back. So I would consider HTTPS to be a waste of effort and resources.

<comment><USER51> You're asking the wrong question, like many others who are resistant to HTTPS everywhere. HTTPS isn't for you, the site owner (although you gain the not insignificant benefit of knowing your content and traffic is untampered with). It's for the people that visit your site, so when you say HTTPS is a waste of effort and resources what you're inadvartently saying is that you don't give a fuck about your visitors - or at least, not enough of one to do the least you can to protect them from people who want to track and/or tamper with their browsing activity[1]. Especially since solutions like Let's Encrypt with certbot are free and take a couple of commands to set up.

[1] Unencrypted, pretty much everything about your internet traffic is laid bare for any middleman - your ISP, the person who controls the router you're connected to, some script kiddie on the same network as you - to both read _and write_. Injecting ads or cryptominers, tracking what pages you visit, changing what a page says, even straight up serving a different page. Why let your site/server be a (potential) vehicle for exploitation, disinformation and privacy invasion?

<comment><USER50> If the user is so paranoid about this sort of stuff, then they can go get a VPS and control a large chunk of the network for themselves.

For everyone else, its a game guide. The worst that can happen is that they get the wrong information about how Trains work in Factorio. There wouldn't be a need for me to track users or clicks or whatever in a hypothetical game guide community website.

As I stated before: I know some game communities (ie: Minecraft or Eve Online) can be toxic. But the Factorio community isn't like that. So I'd be comfortable hosting a Factorio webpage under HTTP.

If I were hosting a Minecraft or Eve webpage however (warning: toxic community ahead), then I'd host it under HTTPS due to the dastards who troll and harass others in that community.

\</comment></comment></comment></comment></comment><comment>----

That's the more important part btw: understanding your audience. Some game communities are toxic and full of harassers, trolls and so forth. But other communities are lax, friendly, and can get away with lesser amounts of security.

<comment><USER52> > If the user is so paranoid about this sort of stuff, then they can go get a > VPS and control a large chunk of the network for themselves.

And the last mile is still going to be just as unencrypted, non-private, and tamperable as before.

You literally _cannot_ get end-to-end encryption/privacy without the host supporting TLS.

It's really not an optional thing to support for you as an operator, and especially now that Let's Encrypt is a thing, there's really no excuse for not doing it.

(Now that we're on the subject of toxicity anyway: I'd say that depriving your users from the ability to secure their network traffic, just because you're trying to die on a weird hill, is pretty toxic behaviour.)

<comment><USER50> If I had usernames / passwords, then I'd use TLS.

But some webpages are simple, static one-off projects that I put out on behalf of a community. I don't believe in ads and would rather pay for all the bandwidth that my users would use. Consider it a donation "for the love of the game".

Very, very simple, nearly static webpages, close to "neocities" level of web design. No users, no passwords, just information I'm publishing to help a game community out.

Nothing to steal, nothing to phish, nothing. Pure text, maybe a few images and videos to elaborate on specific points.

[http://factorioguide.nfshost.com](http://factorioguide.nfshost.com)

\</comment></comment></comment><comment>----

I understand that TLS is important for any website with interactivity for privacy reasons. But the above webpage is completely static and non- interactive. Its old-school Web 1.0 stuff. There's nothing to steal, phish, or cheat here. Literally nothing.

I just don't see the point in HTTPS-ing this site.

<comment><USER52> > I understand that TLS is important for any website with interactivity for > privacy reasons.

Then you understand wrong. It's important for _any_ website, interactive or not, for privacy reasons. Reader privacy is a thing regardless of whether something is interactive. I don't know where you're getting the idea from that 'static' sites are somehow special.

<comment><USER50> I understand the importance of privacy in CERTAIN settings. Even if they're static.

For example, Eve Online would 100% be under HTTPS. Period. That online community is incredibly secretive, incredibly untrustworthy, full of scammers and requires every bit of security on EVERY webpage.

Factorio's community? Erm... no. Trolls just don't exist in that community. Unlike Eve Online, there's no warring factions of spies trying to take over each other's online turfs "outside of the game". Factorio is a lax community without any trolls or hackers.

A lot of it is understanding the userbase and general security posture. If I were a serious Eve Online player, I'd give 100% secure settings, as much as possible, due to the shennanigans that community is known for pulling.

<comment><USER49> Protecting users from malicious ISPs (or the criminals that hack malicious ISPs) is a huge win for anyone.

> Factorio's community? Erm... no. Trolls just don't exist in that community.

HTTPS isn't about protecting "secretive" shitty people. It's about protecting everyone.

<comment><USER50> From my understanding, Eve Online gamers transcend the game itself and stalk your habits to the "real world" settings. Infiltrating forums and such. So yes, I'd expect Eve Online players (the serious ones at least) to be very privacy sensitive.

But ultimately, I don't think that this vague concept of "privacy" when applied to a game guide really matters. People normally don't shuffle books and anonymize themselves as they put books back onto the library cart for example.

And I'm old enough to remember physical library cards with the names of everyone who checked out a book. I don't recall any privacy concerns about that. But maybe I'm just old-skool or something.

\</comment></comment></comment></comment></comment><comment></comment><comment>-

With regards to malicious ISPs MITMing their users: they kinda control your DNS requests, so good luck with that. I'm not sure if there really is a way to fully secure against an ISP-level attack against the users.

An ISP can always inject into the HTTP -> HTTPS redirection, and serve HTTP right there and then. HSTS assumes that the user has visited a clean version of your site before, if a new user comes in without ever seeing the HSTS, then the ISP still "wins" and captures your users on a fake HTTP version of your site.

So no, the level of attacks you've described, I don't believe HTTPS solves the problem.

<comment><USER49> > With regards to malicious ISPs MITMing their users: they kinda control your > DNS requests, so good luck with that.

HTTPS security doesn't depend on DNS.

[https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Ex...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Expect-CT)

Please keep in mind: I do app security for a living.

> An ISP can always inject into the HTTP -> HTTPS redirection, and serve HTTP > right there and then.

...they said, in a thread about a popular browser marking HTTP insecure.

Do you really think HTTPS-by-default is out of the question in the future, especially if adoption rates exceed 99%?

</comment></comment><comment><USER53> tldr: China

</comment><comment><USER54> Google is the major player pushing everyone to encrypt with HTTPS with other companies hopping on board. They argued a populist viewpoint with what Snowden revelaled they need to protect the public, but the real reason they pushed HTTPS so hard has more to do with protecting their business and getting more metadata.

It's no secret ISP's are consolidating and being bought up by media conglomerates who want to secure the distribution method for their product and exclude competitors in a new market. Those companies view the internet like they view cable TV; it exists to deploy entertainment and advertising to the public and to convert people into products for companies. But they need a mechanism to figure out what is engaging, e.g. Nielsen Ratings.

There's only one thing more accurate than the traditional web bug or javascript running on a webpage, and that's actually MITMing the traffic and extracting the data raw. If you own the ISP you can do this. You can also inject ad's. Ad's and Rating websites is something Google has built their business on.

I'm really sure they have a sour taste in their mouth left over from from google fiber due to the politics of ILECs trying to protect their literal state-granted monopoly. And in all seriousness, with POTS being retired, the government is granting monopolies over last-mile wire to cable co's.

So Google decided on the nuclear option: they've decided we're just going to get everyone to encrypt their traffic and not just with easily SSLStrip able stuff. We're going to push the standards organizations to deploy SSL\TLS in a way nobody can crack it, then we're going to provide resources like Lets Encrypt to make getting keys cheap, and then we're going to be beligerant whenever the government complains about not being able to get at the traffic.

Now all the ISP's can see are HTTPS connections to AWS, Azure and Google on their equipment; using IP's to try to figure out what site is what doesn't work. They can still attempt to MITM the traffic and replace keys and impersonate key repo's and I'm sure in a lot of cases they do, however, that opens them up to class action lawsuits and criminal hacking charges. You don't want a citizen organization charging your network architect with violating the wiretap act; Network Architects are hard enough to work with, give them a reason to tell their employer they are not going to commit a crime, and they'll end up fighting their employers tooth and nail. Both of which I'm sure Google would be more than happy to fund to protect its business.

The other advantage you get out of HTTPS is the session re-use feature. When someone re-connects to your webpage, instead of establishing a new connection, they can re-use the session they had before; this reliably tags a device and allows you to identify connections from a device even when IP's are changing, and would be more accurate than a browser fingerprint. This is not a new technology or mechanism; IPSEC IKE sessions can last years.

In all candor, we've got military-grade encryption protecting general internet traffic at this point and everyone on this forum is going to argue about privacy without understanding where the market is at or why. That speaks volumes to the times we live in and how effective astroturfing and misinformation campaigns are.

<comment><USER55> > using IP's to try to figure out what site is what doesn't work.

Every mainstream browser sends the server's domain name in plaintext at the start of the TLS connection,[0] so (short of domain-fronting, which browsers don't do) it's generally not a mystery what site clients are talking to, even if they used DNS-over-TLS. ISPs still have that metadata.

TLS session resumption could theoretically be used for tracking users, but why would Google benefit from doing that when it already uses HTTP cookies? The actual benefit is one fewer round trip, making the web, and all of their sites, faster to load.

It's far more plausible that they're pushing to secure the web with HTTPS and Certificate Transparency because an insecure web ecosystem is just plain bad for business, and makes us all more insecure. It doesn't require spite or a zero-sum game of tearing down the competition to explain pushing HTTPS and Certificate Transparency, which lack real nefarious downsides for users.

[0] [https://en.wikipedia.org/wiki/Server_Name_Indication](https://en.wikipedia.org/wiki/Server_Name_Indication)

<comment><USER54> First, thanks for the link. I didn't know they implimented SNI after TLS 1.0. I had always thought TLS would initiate a connection to the server infrastructure first, then establish another tunnel in a tunnel for sites that are hosted off of the same IP. It seemed like a more sane explination to what I saw in wireshark and firewall logs. That also explains why older firewall firmware had issues with getting sites out of TLS connections but newer firmware doesn't. Looks like I have more studying to do.

I'll agree with you that there are substantial ancillary benefits to added browser security well beyond the scope of this discussion and to continuously hardening any infrastructure in general. From a business perspective, those are always worthwhile investments in of themselves simply from the standpoint good security means you have a discplined, well-thought-out system in place. But, you cannot discount the fact that Traditional Television is a direct competitor to Google and the internet in general and that is not a primary motivating factor in their decision to enforce encryption. Large companies simply do not mess with their core products for the good of the public, doing so shows the company is not loyal to employee or stockholder interests both of which shouldn't be disregarded for a variety of reasons. I'll agree companies can decide not to take things too far, but they won't disregard their own interests either. Assuming as such is a naieve belief.

</comment></comment></comment><comment><USER56> Why no https ? I think we know why...

<comment><USER57> Why?

<comment><USER58> They probably meant that the reason is malicious, to spy on traffic. Especially since a good chunk of the top sites on that list are Chinese which is known to have generalised spying on internet users.

<comment><USER45> However, in a shitty regime like China, surely the government can ask the websites to just hand over the private keys and disable prefect forward secrecy, allowing government spying while preventing anyone else from doing so.

<comment><USER19> Which is insanely difficult to do at scale and would take a considerable amount of time and resources. Not to mention being really obvious! I'm happy with making things crazy hard for the bad actors out there.

</comment></comment></comment></comment></comment><comment><USER59> There is a good dissection of these popular arguments in favor of HTTPS on static websites that don't have any forms:

[http://webcache.googleusercontent.com/search?q=cache:Ka_e9-V...](http://webcache.googleusercontent.com/search?q=cache:Ka_e9-V0fB8J:n-gate.com/software/2017/07/12/0/)

In short: I have yet to see a really convincing argument in favor of HTTPS in these scenarios.

<comment><USER19> Have a look at this post: [https://www.troyhunt.com/heres-why-your-static- website-needs...](https://www.troyhunt.com/heres-why-your-static-website- needs-https/)

<comment><USER60> Please put yourself in the shoes of someone actually operating a site. Every single issue mentioned in that post only affects end-users. Not a single issue for the operator, who has many other issues that are more urgent such as turning a profit, securing that database that got wiped last week, and writing actual content. Point being that the incentive to force https for a static site for an individual site operator is just not that great.

The sad reality is that http->https redirects are like vaccination. In some specific cases they are needed (such as login pages), but for some it's more about herd-immunity (normalizing https usage and ensuring availability). Mind you that there's a solid argument for allowing self-signed certs to allow encrypted but unauthenticated transfer. This mode allows MitM, yet does protect against the threat model of a passive eavesdropper.

<comment><USER19> "Please put yourself in the shoes of someone actually operating a site." \- I run 8 sites right now and one of them is processing 10,000,000,000+ requests a month. I speak from a position of experience on this topic.

"Every single issue mentioned in that post only affects end-users. Not a single issue for the operator" \- so don't care about the user and the risks we expose them to, only ourselves? This isn't really an approach I'm happy taking.

<comment><USER60> With 10B monthly requests, you speak from a position of having an operations team who spend 40+ hours a week on keeping your site secure (possibly even a dedicated security team?). Most sites do not have that luxury. If you're doing that on your own, then you're far from the average site operator that I'm referring to here. In fact, most everyone on HN is not the average site operator I'm talking about here.

My poorly communicated point is that by using extreme language like "I'm going to hack your static site" dilutes the message and makes average operators less receptive to more advice in the future. Troy does a lot of good work on reducing friction and advocacy, but sometimes he puts out more extreme content like this which makes me worry that it may have the opposite effect.

PS - Do you think the vaccine analogy works? I'd appreciate some advice on how to improve it

</comment></comment></comment></comment></comment><comment><USER61> I'm opposed to HTTPS everywhere because it comes with a lot of code (like openssl) and a complicated paradigm (pki). We can do better and simpler at the same time.

<comment><USER39> > We can do better and simpler at the same time.

How?

<comment><USER61> I'm not into crypto but I found that method: [https://en.wikipedia.org/wiki/One- time_pad](https://en.wikipedia.org/wiki/One-time_pad)

<comment><USER62> One-time pad requires a pre-shared key of the enomorous length to be effective in the World Wide Web. An impossible plan can be vacuously better and simpler at the same time, guaranteed.

<comment><USER61> Only the length of the message.

<comment><USER63> The issue with one time pads isn't their security. That's fine.

The issue is key management. Both parties need the same key and it has to be at least as large as the data you want to send. Each set of parties needs a different key.

If you had a method to securely transmit such keys then you could just transmit your data over it instead.

This is why one time pads are only used by countries to communicate with staff overseas. You can send the pads by diplomatic courier for use in communication later. There is no equivalent mechanism for your web activity and every site on earth.

<comment><USER61> Yes there are. The two parties need to agree on a common source. It can be a file somewhere on the web (an image) or a something that doesn't exist yet.

That's what happens with passwords.

<comment><USER64> How are the two parties supposed to agree when they've never talked to each other before?

If I connect to [https://www.SomeWebsiteIveNeverVisited.com/](https://www.SomeWebsiteIveNeverVisited.com/), how is the web server supposed to tell me where to get the key? Or if I, the client, am choosing where to get the key, how do I securely tell the server where to get it?

Passwords work because they're being sent over TLS which we've decided is "good enough".

<comment><USER61> Those problems exist with current systems. There is a phase where the two parties must recognize themselves and agree they are legit.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Free Logo Generating Tools - <AUTHOR> http://sitenoob.com/?p=56

<comment><USER2> Not free, but still a great tool is MarketSplash. They let you pick between multiple designs, and you customize it. You can check out their demo at [http://www.marketsplash.com/res/packageSubmitSelection.html?...](http://www.marketsplash.com/res/packageSubmitSelection.html?selectedProductId=182)

Their prices are competitive, and they generate very nice logos.

<comment><AUTHOR> That service does look pretty nice, thanks for the information.</comment></comment>


Earth's magnetic field is acting up and geologists don't know why - <AUTHOR> https://www.nature.com/articles/d41586-019-00007-1 <comment><USER2> I remember seeing an article about this several years back. There was a similar diagram showing magnetic north moving towards Russia and the wobble was getting bigger with time.

</comment><comment><USER3> Is this a natural process that's been happening for eons (the speed of magnetic north changing accelerating rapidly) or is this due to man-made interference?

<comment><USER4> there is a "natural" phenomenon known as chandler wobble. its just part of a bigger scene. basicaly the earth doesnt spin on a perfect axis related to angular momentum. this axis "sputters" like a top that has slowed down and is succumbing to chaotic interferences before it falls. [https://en.wikipedia.org/wiki/Chandler_wobble](https://en.wikipedia.org/wiki/Chandler_wobble)</comment></comment>


More than half of OkCupid users like bondage, kink - <AUTHOR> https://theblog.okcupid.com/bdsm-is-more-popular-than-you-think-890de1c634f1 <comment><USER2> Having picked up dating apps and Okcupid recently after ending a 4 year relationship, my guess is that Okcupid has become particularly friendly to people seeking BDSM and non-monogamous relationships. I had used it before and at least anecdotally what I see OKC users looking for is different from before. A lot of people have moved to swipe dating apps like Tinder and Bumble where the focus is almost entirely on photographs and not what users write about themselves. Maybe Okcupid is drawing users into BDSM and other non- traditional relationships because they can talk about it in their profiles and potential dates may actually pay attention rather than just swiping.

</comment><comment><USER3> Clicking on yes i like to be tied up in a 100 questions survey is veeery far from actually liking it IRL

</comment><comment><USER4> You would have to be to get through all their surveys!

</comment><comment><USER5> Better hurry up and fire all of them from their work and open source projects! /s</comment>


Stanford students vie to be 'Entrepreneur Idol' - <AUTHOR> http://www.latimes.com/business/la-fi-vcidol14may14,1,4650729.story?coll=la-headlines-business&ctrack=2&cset=true <comment><USER2> I posted this story yesterday....nothing came of it.

<comment><AUTHOR> Oops, didn't see it - sorry.</comment></comment>


Trogdor: Burninatingly fast search using Yahoo BOSS - <AUTHOR> http://wonko.com/post/fast-search-using-yahoo-boss

<comment><USER2> This is really good. That may be the best new search engine/Google competitor that I have seen!

</comment><comment><AUTHOR> Apologies if it was sent before, I didn't see it mentioned and found it interesting :)</comment>


Best Tools to Make Easy CSS3 Development - <AUTHOR> http://webinsightlab.com/design/8-best-tools-to-make-easy-css3-development/ CSS or cascading style sheet is basically a style sheet language that is used to describe the presentation semantics or the looks and formatting of a document. <comment><USER2> Might I also suggest nib, and excellent set of Stylus extensions for working with CSS3. One of the most useful features is image inlining, especially for gradients. While they end up being a fixed size, they also work crossbrowser (at least with any browser that supports data URIs).

<http://visionmedia.github.com/nib/> <http://learnboost.github.com/stylus/>

All the examples show how to integrate it within your Node project, but you can just as easily use it from the command like with the `u` flag.

      stylus -u nib <file>

<comment><USER3> For some reason I've had a preference against using CSS frameworks like this because they often take you away from the pure CSS code. My reasoning being if you end up in an environment where do not have access to the framework can you complete the task at hand?

I guess I would say it's like learning Javascript before using jQuery (which I did) so that you have the basics down.

I suppose I'll have to try a few of them out to see how I feel about it.

Also, I'm quite partial to ColorZilla's Gradient Editor. <http://www.colorzilla.com/gradient-editor/>

<comment><USER4> Checkout Bourbon–a library of SASS mixins and variables. It aims to be very vanilla, so you'll write the mixins similar to plain CSS. <http://thoughtbot.com/bourbon/>

<comment><USER5> Thanks for the heads up on this. I'm really tired of using compass just for the css3 mixins.

</comment></comment></comment></comment><comment><USER6> I'll just drop a little tool I put together here some time ago: <http://ippa.se/base64-image-encoder/>

</comment><comment><USER7> Less CSS is a great tool regardless of how you initially craft the CSS because it allows you to express the CSS in a more readable and maintainable way. You can abstract away the various cross-browser complexities and concentrate on what you are doing.

</comment><comment><USER8> Good list, though I prefer colorzilla for Gradients: <http://www.colorzilla.com/gradient-editor/></comment>