Show HN: My 2-Hour Twilio App - <AUTHOR> http://txt2ping.com

<comment><USER2> Twilio has an SMS app contest going on, and the deadline is midnight tonight

[http://blog.twilio.com/2010/02/resources-for-getting- started...](http://blog.twilio.com/2010/02/resources-for-getting-started-with- twilio-sms.html)

-danielle @ Twilio

</comment><comment><USER3> Very cool, worked as advertised. Two things:

1) It sent me a text letting me know the message had been received, and another with the result. The confirmation was nice, but since the messages came 2 seconds apart you could skip the first one and save 3 cents.

2) Would be nice if it followed 301 redirects.

<comment><USER4> I agree about not needing the confirmation. I actually got the confirmation 5 seconds after the result.

<comment><USER5> SMS msgs are not guaranteed to be received in the same order sent.

</comment></comment></comment><comment><USER6> Good showcase. Are you paying for the SMS out of pocket? FYI Couldn't check https adress.

<comment><AUTHOR> Yep, but it's cheap so I don't mind.

Just pushed HTTPS support :)

<comment><USER7> Where do you get them for cheap?

<comment><USER8> twilio?

</comment></comment></comment></comment><comment><USER9> You should add an example url and specify users not include "<http://> because <http://example.com> doesn't work.

<comment><AUTHOR> Fixed!

</comment></comment><comment><USER10> I created a similar app, but primarily for India (using India local number). But it should work internationally also if you are willing to pay international SMS charges (don't know at what premium). I've hosted at appengine first to see the response <http://sms2ping.appspot.com> Do let me know if someone tries it. BTW I get a response message free so am not paying to send out messages as response

</comment><comment><USER11> Very Cute. How are you keeping this free ? I am not familiar with Twilio pricing models, so your answer will educate me as well.

<comment><USER12> The problem is Twilio provides no way of billing end users. In this case it comes down to a micropayments problem (which still haven't been solved sufficiently). So you either have to charge up-front for a monthly service fee of a reasonable sum, or stick adverts everywhere which will hopefully cover your costs. It's a major flaw for the platform if you want to build a business off of it (I've been playing around with a per-monthly-fee service concept recently).

</comment></comment><comment><USER13> pretty fast as well. Good Job!

</comment><comment><USER14> Pure uberness.

</comment><comment><USER15> my contest idea was chatroulette for twilio. i wrote some php code but am too lazy to finish it and make a whole nice sheeny website.

<comment><USER16> I did that: <http://www.happyfunline.com/>

Didn't know there was a contest though!

<comment><USER2> sorry, meant to reply to this thread - contest info is here: <http://contests.twilio.com>

danielle @twilio

</comment></comment></comment><comment><USER17> Android please.

<comment><USER18> It just uses your text messaging app. Should work on any mobile phone.</comment></comment>


Ask HN: Learning iOS development beginners level - <AUTHOR>

Hi guys, can someone suggest books, blogs and screencasts on learning how to program for iOS from a begineer (little to no programming knowledge).
I'm trying to grab as many resources and hopes to develop my first iPhone app.
Thanks in advance HN :) <comment><USER2> I really liked this book. The author gives not too much, but not too little info.. there are pictures to illustrate the steps, and he cuts out all the BS that you find in alot of places and emphasizes practical applications.

[http://www.amazon.com/Beginning-iOS-4-Application- Developmen...](http://www.amazon.com/Beginning-iOS-4-Application- Development/dp/0470918020/ref=sr_1_1?ie=UTF8&s=books&qid=1293580512&sr=8-1)

</comment><comment><USER3> It would help reduce dupication of effort if you described what you've found so far, what appeals to you, and just a basic level of at least attempting to do your own legwork before shouting HELP. There is certainly no shortage of iOS tutorials out there: <http://www.google.com/search?q=ios+tutorial+ipad>

Without anything else, your trailing smiley looks more like a smirk saying "gimme" under its breath (not to mention "TIA").</comment>


A radio station that no one claims to run (2017) - <AUTHOR> http://www.bbc.com/future/story/20170801-the-ghostly-radio-station-that-no-one-claims-to-run <comment><USER2> Related: North Korea has a secret diplomacy network which transmits messages from Pyongyang to North Korea embassies worldwide. Radio hobbyists have successfully reverse-engineered its modem and protocol. This is quite unusual, we don't know the internal workings of any similar systems used by other governments, so reading about the North Korean system can give us a idea about what a typical, sophisticated shortwave digital communication system used by a government might look like.

Another fascinating fact is the system sometimes transmits cleartext messages! The system allows two types of messages to be sent. The first type is fully encrypted normal messages, but one can also send "chat" messages, which allows the operators of two systems to communicate about their working schedule, system maintenance, etc, and they are unencrypted plaintext, which revealed a lot of about the internal of this system. Opsec failure? They should really just use a hardcoded symmetric key for this purpose...

Network Structure:

* The North Korean diplomatic shortwave network follows a forwarding tree structure, as they limit contacts between their stations to hops of usually no more than 5000 kilometers. Pyongyang sits at the root at the tree structure, as ultimate origin or recipient of all messages between it and embassies. Messages from Pyongyang are transmitted and relayed by North Korean embassies across the world, hop by hop along each branch of the distribution tree, until they are received by their final recipients. Messages from embassies are relayed and forwarded back to Pyongyang in the reverse way.

[http://priyom.org/diplomatic-stations/north- korea/network](http://priyom.org/diplomatic-stations/north-korea/network)

Protocol:

* North Korean diplomatic communications utilize a proprietary ARQ modem of unknown name, unofficially known as DPRK-ARQ. The modem is based on BFSK bursts transmitted in lower sideband mode. There are two possible waveforms: 600Bd/600Hz as the default, and 1200Bd/600Hz as an option.

A complete protocol analysis is given by: [http://priyom.org/diplomatic- stations/north-korea/dprk-arq-p...](http://priyom.org/diplomatic- stations/north-korea/dprk-arq-protocol)

Message Format:

[http://priyom.org/diplomatic-stations/north-korea/message- fo...](http://priyom.org/diplomatic-stations/north-korea/message-format)

</comment><comment><USER3> According to the Wikipedia article some urban explorers found this logbook from one of its previous transmission sites.

[http://www.numbers-stations.com/media/sample- uvb76-logbook.p...](http://www.numbers-stations.com/media/sample- uvb76-logbook.pdf)

</comment><comment><USER4> Because the article never mentions it, many people probably know this as "UVB-76".

More info:

[https://en.wikipedia.org/wiki/UVB-76](https://en.wikipedia.org/wiki/UVB-76)

[https://www.sigidwiki.com/wiki/The_Buzzer_(ZhUOZ_MDZhB_UZB76...](https://www.sigidwiki.com/wiki/The_Buzzer_\(ZhUOZ_MDZhB_UZB76\))

<comment><USER5> The second link leads to [http://priyom.org/military-stations/russia/message- format](http://priyom.org/military-stations/russia/message-format), which reveals a fairly simple format that relies on one-time pads. Each military unit has envelopes with unique word grids, e.g. [https://i.imgur.com/ItpKnNy.png](https://i.imgur.com/ItpKnNy.png) The radio station transmits messages as envelope identifiers and line/column numbers of those grids, and recipients piece them together.

Simple and impossible to break unless envelope contents leak. Given how rarely the system is used, it probably serves as a low-tech backup for high-tech radio systems.

</comment></comment><comment><USER6> [https://en.wikipedia.org/wiki/The_Conet_Project](https://en.wikipedia.org/wiki/The_Conet_Project) is a great compliation of numbers station samples

</comment><comment><USER7> Here's a BBC radio documentary from 2005 on the Lincolnshire Poacher

[https://youtu.be/Wvr6o7fBcTY](https://youtu.be/Wvr6o7fBcTY)

</comment><comment><USER8> Discussed at the time: [https://news.ycombinator.com/item?id=14988362](https://news.ycombinator.com/item?id=14988362)

</comment><comment><USER9> [http://priyom.org/](http://priyom.org/)

</comment><comment><USER10> Ha-ha I had to check whether this was the place where I served in 87-88. No, my unit work location was about 10 miles south along the same road. Also a bunch truck based radio stations, buildings, huge antenna fields, etc. We did radio surveillance on NATO countries in northern Europe, Unit 75752. Our transmitters were yet a few miles south of that location (you normally want to separate the transmitting and receiving as far as practical).

<comment><USER11> Any theory what this one might've been?

</comment></comment><comment><USER12> Number Stations (and similar like the station described in the article here) have a place in my heart. One of the items on my "hobby projects list" is to make a small version of one -- nothing the FCC would knock on my door about, clearly -- since the topic fascinates me so.

</comment><comment><USER13> COMMAND 135 ISSUED

<comment><USER14> If that command really were used as the article suggests then you'd think it would be followed by a bunch of other sigint derived from an increase in activity by the units that received the command.

<comment><USER15> Maybe that is how they arrived at the suggested of the command? The article is short on attributions for these claims though.

</comment></comment></comment><comment><USER16> deadman snitch.</comment>


Show HN: Light weight CoinMarketCap.com alternative with additional insights - <AUTHOR> https://chainswap.io <comment><USER2> Looks good but is really confusing.

What does this mean:

= $2,054.37 to reach marketcap

<comment><AUTHOR> Thanks for the feedback! It means that a single unit of the currency you are looking at must reach 2,054.37$ to obtain the same market cap as your selected base currency.

</comment></comment><comment><USER3> I've heard that crypto market caps are extremely misleading. Any take on this?

<comment><USER4> Misleading in what way? The Korean exchanges definitely artificially inflate the value so I'm glad coinmarketcap.com and livecoinwatch.com allow excluding them from the average.

<comment><USER5> Market cap and Korean exchanges are two problems, though they share a bit.

Ideally, you should be able to specify _exact_ exchanges you want to see, and what algorithm to apply to it (i.e. give more weight to daily volume) to produce a single-dimension value. As you can see, that's always going to be lossy. And then you get into UX challenges actual presentation of all that data with all the knobs and switches.

We at Live Coin Watch[1] make it our daily fight to be as far off as possible from _misleading_ or _incorrect_ and it's a never-ending fight.

[1] [https://www.livecoinwatch.com](https://www.livecoinwatch.com)</comment></comment></comment>


Mini.css – Minimal, responsive, style-agnostic CSS framework - <AUTHOR> http://minicss.org/ <comment><USER2> One of the reasons I've switched to a microframework (Milligram) is that the source is extremely easy to read and understand.

Compare mini.css ([https://github.com/Chalarangelo/mini.css/blob/master/src/min...](https://github.com/Chalarangelo/mini.css/blob/master/src/mini/_input_control.scss#L83)) to Milligram ([https://github.com/milligram/milligram/blob/master/src/_Form...](https://github.com/milligram/milligram/blob/master/src/_Form.sass)).

Unless you're planning on inlining your CSS in the head tag, IMO the network difference between 7kb and 20kb of CSS is just splitting hairs. I've gotten far more out of optimizing my CSS for programmer understanding than network size (though the two tend to be correlated!).

<comment><USER3> Milligram sounds great for my blog, which i want to keep minimal.

Are there any examples of sites(gallery) of sites built with milligram? I'd like to see some real-world examples.

<comment><USER2> Not sure. My blog uses Milligram inlined into the head tag: [https://www.speedshop.co/blog/](https://www.speedshop.co/blog/)

</comment></comment></comment><comment><USER4> This looks nice. I like the name. But poking through the code it seems to be more of a slimmed-down Bootstrap rather than a fresh/new approach to minimalist CSS. Which has it's uses no doubt.

I personally love [http://basscss.com/](http://basscss.com/) for a minimal and side-effect free (the real goal) CSS framework, as it has one of the best class naming schemes I've seen.

Each component is focused on doing one thing and one thing well. You basically build up the styles with each class you add to an element. Composed via a combinations of smaller pieces, unix style, rather than complex multi-layered components with deep nesting. Which is an interesting approach when you try to apply the same idea to your own CSS. See the Design Principles for more: [http://basscss.com/v7/docs/reference/principles/](http://basscss.com/v7/docs/reference/principles/)

The code is also very readable and integrates perfectly with PostCSS. They also have a React version.

<comment><USER5> I liked basscss in principle, but I feel like the following examples from the homepage are missing the point/ will lead to un-maintainable code.

Larger than default h2 style, but semantically correct

... why not just use a h1?

I also don't see how

Bold

is a big step up from doing

Bold

Am I missing the appeal here?

<comment><USER6> >

wow, i just threw up in my mouth

<comment><USER7> Yea, it should be:

or something. Using elements as class names is insane.

</comment></comment></comment></comment><comment><USER8> Offtopic but honest question: Is submitting something daily until you get enough points to get to the front page something that is acceptable in HN?

Are there any rough guidelines about how often can one submit something?

PS: Only asking for my own education for my future submissions.

[https://news.ycombinator.com/item?id=14255809](https://news.ycombinator.com/item?id=14255809)

[https://news.ycombinator.com/item?id=14244693](https://news.ycombinator.com/item?id=14244693)

[https://news.ycombinator.com/item?id=14227177](https://news.ycombinator.com/item?id=14227177)

[https://news.ycombinator.com/item?id=14218777](https://news.ycombinator.com/item?id=14218777)

[https://news.ycombinator.com/item?id=14163754](https://news.ycombinator.com/item?id=14163754)

<comment><USER9> This even had a discussion already 2.5 weeks ago... [https://news.ycombinator.com/item?id=14120796](https://news.ycombinator.com/item?id=14120796)

No, that's not ok.

(Things that don't get attention can be reposted, but 5 times within a week feels a bit much to me)

</comment></comment><comment><USER10> I love stuff like this and it looks fantastic, but without support for at _least_ IE10 I would be loath to use it. IMHO the value proposition of a CSS framework is that it saves time and looks good without having to think about it. If I have to spend time fighting browser bugs and writing CSS hacks to deal with incompatibilities and/or layout issues, that's the opposite of that. Hopefully the developers will add support for some legacy browsers perhaps as an optional addition similar to how JQuery does it.

Fantastic work so far to the developers that said. I will be keeping an eye on this. Good luck!

<comment><USER11> With automatic windows update there aren't really that many users left who are using IE version lower than 11. Browser stats metrics show that only 0.1% of all users are on IE < version 11.

<comment><USER12> What really matters are the stats for one's own users but who's stats say <IE11 is less than 0.1%? NetMarketShare reports of global desktop browsers for April [0] says:

IE11 13.62% IE8 2.25% IE9 1.32% IE10 1.06%

Wikimedia global all-device browsing for April says:

IE11 4.8% IE7 3.0% IE9 0.43% IE6 0.38% IE8 0.25% IE10 0.23% IE4 0.22% (! I don't know what this is about, maybe an old mobile version?)

[0] [https://www.netmarketshare.com/browser-market- share.aspx?qpr...](https://www.netmarketshare.com/browser-market- share.aspx?qprid=2&qpcustomd=0)

[1] [https://analytics.wikimedia.org/dashboards/browsers/#all- sit...](https://analytics.wikimedia.org/dashboards/browsers/#all-sites-by- browser)

<comment><USER13> Yes exactly, I know I'm late to the discussion but I hate when people state you font have to support a browser because it only has x% market share.

It's all about your own users. I'm doing UX and front-end for a company that deals with a lot of IE8 users... -_-

The ongoing theory is that they are on hacked XP copies since that traffic is coming out of China.

<comment><USER12> I wish they could somehow learn about Firefox, which is still supported on Windows XP. Then it would basically be just the people with old phones and 6-7+ year-old Macs that would require fallbacks.

</comment></comment></comment></comment></comment><comment><USER14> Interesting. The promise of making a small CSS is a bit overblown. With a build step or module mechanism, most frameworks can be smaller than this.

On another note, we had a great blast using [http://tachyons.io/](http://tachyons.io/) It was a game changer for me, and made me remarry CSS. And spoiler alert, it was way smaller after a build step than 7KB, while not feeling like working in tight pants.

<comment><USER15> I just logged in just to upvote this.

Tachyons is where you go when you finally want to be happy with CSS.

I ported it for react-native, so you can style mobile-apps with it as well: [https://github.com/tachyons-css/react-native-style- tachyons](https://github.com/tachyons-css/react-native-style-tachyons)

</comment></comment><comment><USER16> "So far, the Infinite monkey theorem is just giving us an infinite number of CSS frameworks, and no Shakespeare"

</comment><comment><USER17> People interested in minimal CSS frameworks might want to check out [https://github.com/dohliam/dropin-minimal- css](https://github.com/dohliam/dropin-minimal-css)

It's a CSS switcher for previewing minimal frameworks, which you can drop in to any page or site to quickly preview what it would look like in 50 or 60 different CSS frameworks (including mini, pavilion, basscss, milligram, and others mentioned in this thread). There's even a bookmarklet to preview switching the css on any site.

<comment><USER18> This is a great tool, thanks for posting this! I had not seen this before, and I will find it very useful for prototyping.

</comment></comment><comment><USER19> I feel this is wrong way to optimize: First, bootstrap gzipped is <100KB after removing font. Check any reasonable site from youtube to amazon, they download ~ 1MB gzipped data on load and do just fine. Second, if you are really concerned, you can just remove a lot of components from bootstrap to reduce its size. I do it for my project where i don't need for example the glyphicon, carousel, etc.

When using a framework, you want it to just work on all platforms. When I look at bootstrap issues, I see so many issues of the form X does not work on Y and then it gets fixed. These little kinks are hard to get right and I am not sure its worth reinventing the wheel unless there is a clear benefit other than size.

<comment><USER20> >Check any reasonable site from youtube to amazon, they download ~ 1MB gzipped data on load and do just fine.

For users with high-speed connections on computers or newer phones. In normal first-world conditions. Your users are not everyone else's users.

</comment></comment><comment><USER21> Ah, this will be a nice addition to [https://www.lightentheweb.com/libraries/](https://www.lightentheweb.com/libraries/), thanks. You can also find other libraries like this one on that page.

<comment><USER22> Could I suggest adding 'use bootstrap properly' to this list (and perhaps link to [1] and/or the LESS/Sass source). Bootstrap is modular. There's no need for a 'light' alternative, and in many cases I believe using Bootstrap 3 from Sass/LESS source is still the better option compared to the majority of these mini CSS frameworks. More comprehensive, better browser compat, likely 1000s more hours of dev braincycles (just go take a look at all the Github issues for Bootstrap to see all the work that has gone into it).

(Edited to be nicer/more-helpful).

[1] [http://getbootstrap.com/customize/](http://getbootstrap.com/customize/)

<comment><USER23> This is what saved bootstrap as our goto framework in our shop. Every new project starts with most modules commented out and some early attention to setting the global variables and using the mixing. This keeps things small while new modules are a simple uncomment away.

Edit: examples

[https://github.com/greenriver/boston- cas/blob/master/app/ass...](https://github.com/greenriver/boston- cas/blob/master/app/assets/stylesheets/helpers/_variables.scss)

[https://github.com/greenriver/boston- cas/blob/master/app/ass...](https://github.com/greenriver/boston- cas/blob/master/app/assets/stylesheets/_bootstrap-custom.scss)

<comment><USER22> Yep, exactly what I do, +1 for using bootstrap's variables as much as possible too, I don't think a lot of people realise how powerful bootstrap's variables are, and can greatly cut down the amount of CSS you write.

</comment></comment></comment></comment><comment><USER24> This would be great for a static, CSS-only site I'm developing ([http://www.nothingofvalue.org](http://www.nothingofvalue.org)).

However, the framework says its responsive, yet the navigation menu doesn't resize on small screens. That's a bit disappointing. I'd like to have something that will give a chevron or hamburger navigation menu without resorting to Javascript.

<comment><USER25> Take a look at PicnicCSS. It does what you want.

</comment></comment><comment><USER26> At first I got this confused with mincss [1], which is my go-to for quick and dirty sites. This looks like it could be a good option too!

[1] [http://mincss.com/](http://mincss.com/)

<comment><USER27> That's great to see! I'm the creator of Min. I'm working on a new version, any suggestions?

<comment><USER26> Not sure if it's already possible, but it would be nice to have nested navigation (like with drop-down sections).

Even without that, though, Min is really exactly what I think of when I need a lightweight framework that gets out of my way.

Maybe some better sea monster repellent? ;-)

</comment></comment></comment><comment><USER28> Why is IE missing from the support diagram? Are makers of new libraries not expected anymore to support it?

<comment><USER29> Should they always have to?

<comment><USER28> No, and that's what I was asking. Have we reached the point where we can ignore IE?

<comment><USER30> IE8/9/10 for most purposes, yep. IE11, no (IE11 is used more than Edge as far as I've seen)

<comment><USER28> Which means the answer is no, we can't ignore IE yet and that means I won't be touching this library with a 10 foot pole.

</comment></comment></comment></comment></comment><comment><USER31> The time of CSS frameworks has really come and gone. There were four use cases, and all of those are more and more obsolete:

\- "The Grid", which at this point has migrated to the browsers with Flexbox and (soon) Flex Grids

\- A pretty skin replacing the browsers' default rendering of elements. These have improved, albeit only slightly. CSS has also become easier and you can easily do this yourself in 50 lines or so

\- Fixing browser bugs/inconsistencies, which have diminished to a fraction of where we used to be

\- "Components", which may the last remaining use case, but which have also become much easier to do yourself due to sane grid layouts

<comment><USER32> > and (soon) Flex Grids

If you mean CSS Grid, and you can afford to target only modern browsers (with usable fallback CSS for the others) then you're good to go right now. Even Edge is working on bringing their implementation up to the spec right now[2].

I agree with your other points too. CSS frameworks don't bring that much, and end up clouding your ability to write and understand raw css IMO.

[1] [http://caniuse.com/#search=grid](http://caniuse.com/#search=grid) [2] [https://wpdev.uservoice.com/forums/257854-microsoft-edge- dev...](https://wpdev.uservoice.com/forums/257854-microsoft-edge- developer/suggestions/6514853-update-css-grid)

</comment></comment><comment><USER33> It looks neat but I'm left wondering what sets this one apart from the many others in what seems like a flavor of the week.

It's minimal indeed, but almost too minimal. In my experience working with CSS frameworks, the "there's a class for that" pattern is almost always not enough and it's much easier to write rules to handle customization. That leaves out both developers that aren't designers and designers that develop.

Applications aside, the semantics of some of the content is not up to date (for example
 vs
).

<comment><AUTHOR> The semantics are reasonably outdated, but I wonder if part of this is due to certain things like using
 might affect content placement and/or nesting (section classes are used only for cards so what if a card is inside a
?).

</comment></comment><comment><USER34> I am convinced now that these micro frameworks are not the way to go (in my very humble experience). CSS is super easy and simple. And unless you want to support IE, it's not nearly the main pain point, especially in contrast with JS which has room for much more trouble.

A week of genuine effort in learning the small nits and bits of CSS will go a long way.

<comment><USER35> What would you recommend as a learning resource? If you had a week, and wanted to dig in and learn CSS in the way you describe, what would your ideal curriculum look like?

<comment><USER34> A static website I think is a good way. The most important part is layout. Once you master flex and css selectors, everything else is a derivative one way or another.

It's probably not a good idea to focus an entire week on CSS alone. It's more economical and practical to spend a week's worth of hours in an otherwise broader project. That gives you real, practical experience in building real- world UI.

</comment></comment></comment><comment><USER36> It looks great at first glance. A big problem though is that it styles basic elements. If for example you want to use a
,  or  where it would make sense in a custom element you'll have to reset all the styles of the library before adding your own.

<comment><USER37> If your custom elements put their internals in shadow roots they'll be protected from page styling.

<comment><USER36> Sorry custom elements might have been the wrong term to use. I mean custom interfaces, say an image gallery or a realtime search box where you would use elements like buttons and input's in a different way then the usage this framework defines for you. Using a nav both in your header and sidebar is a different example where these are not good defaults

</comment></comment></comment><comment><USER38> IE EDGE 12 for Minimum Support ? Thanks but no thanks !

<comment><USER39> Edge 12 is the first version of Edge. I'm guessing it's due to modern Flexbox support.

<comment><AUTHOR> Older browsers like IE are supported, just not fully. So they say at least...

</comment></comment></comment><comment><USER40> I use bourbon.io with Sass

Tyson, one of the contributors, helped me get setup.

My css is now a compressed 4k for the entire project.

<comment><USER41> +1 for bourbon; been using it for a little over a year now, and love it over Bootstrap

</comment></comment><comment><USER42> I've switched to Pavilion([http://www.pavilion.io/](http://www.pavilion.io/)), it's very easy to figure out, small and SASS-based. Cannot recommend enough!

</comment><comment><USER43> It looks great, except one nitpick.

Exploiting `radio` input for things like Tabs and Accordions [0] is surely a sweet trick, but I don't think it's a great idea to use it where more than a few people would maintain the code.

Not only that, it also breaks completely in anything below "modern browsers". I get that this framework doesn't target those browsers, but I think these are the kind of things Javascript is for. It shouldn't be done by CSS.

[0] [http://minicss.org/tab.html#tab-title](http://minicss.org/tab.html#tab- title)

<comment><USER44> I have actually pulled that trick off a few times for things like nav drawers and in over a year we have never gotten a single complaint around one of those elements not working. Of course it's entirely dependent on your audience and what you are trying to achieve, but I have found it very safe to use radio buttons for this purpose in our content.

</comment></comment><comment><USER45> Has anybody here any experience with/opinions on/ W3.CSS ? [https://www.w3schools.com/w3css/default.asp](https://www.w3schools.com/w3css/default.asp) . It seems like the obvious first choice to me and has pretty much everything I might ever need.

How does it compare to the above and the other css frameworks mentioned here?

<comment><USER6> > obvious first choice

why?

People tend to start with bootstrap, and move from there to a more specific framework with minimal code.

Also i don't trust w3schools, they just took advantage of the name w3 and people often thing they are related to w3 but they are not.

<comment><USER45> Ah, thanks for that information! I was one of those who thought that w3schools were w3 and that was my mistaken reason as to your question "why?".

That skullduggery aside, their css seems comparable to the rest discussed here.

</comment></comment></comment><comment><USER46> Very well done! Just tried it, and like it a lot.

I created a little screencast of the core concepts of Mini.css here, in case anyone is interested in quickly grasping how it works:

[https://scrimba.com/casts/cast-1945](https://scrimba.com/casts/cast-1945)

[Edit: there was an issue with the audio in the previous screencast, so I created a new one]

</comment><comment><USER47> I like it, but I personally like microframeworks that just style everything, and maybe provide a grid, like Wing [1]. (Disclaimer: I'm the author).

Having some styles provided by default, instead of having more classes to remember would be nicer. That's just my style.

Overall, it looks great!

[1] [http://usewing.ml](http://usewing.ml)

<comment><USER48> Wing's landing page has some big layout problems on mobile, at least on iOS: [http://i.imgur.com/2R9USMM.jpg](http://i.imgur.com/2R9USMM.jpg)

It's not a great first impression for a layout framework.

<comment><USER47> You're right. I'll get that fixed up. What iOS device and browser are you using?

By the way, that is a problem in the implementation of the site, not Wing :)

</comment></comment></comment><comment><USER49> i really like bulma, makes most sense to me. any bulma fans in here?

<comment><USER50> I guess I'm the only one...

</comment></comment><comment><USER51> The website doesn't feel well on iPhone. What's you guys recommendations for CSS franwork nowdays?

</comment><comment><USER52> I really love how many things seem to be compatible with Bootstrap.

Most sites I've made in the past few years use Bootstrap—specially the grid, so I'd image this will really ease adoption if I'm not the only one who's used Bootstrap extensively.

</comment><comment><USER53> The site uses its own framework, but the menu isn't responsive?

</comment><comment><USER54> Why would I use this over Bootstrap 4 (if it's ever released)?

BS4 seems to include everything here and more (I can comment out what I don't need before building). BS4 also supports IE10+, where a non-trivial amount of my conversions come from. The flexbox grid/naming convention seems identical at a glance.

</comment><comment><USER55> I can't take this seriously when their style is broken in the docs: [https://postimg.org/image/k13bpu1hn/](https://postimg.org/image/k13bpu1hn/)

</comment><comment><USER56> the other browser images don't collapse on mobile. the page expands leaving white space :/

</comment><comment><USER57> Eh, I'll stick with Pure.

</comment><comment><USER58> what is the difference between this and bootstrap?

<comment><USER39> Without reading the docs in depth, there's a difference of about 142KB of render-blocking CSS. I'm sure the API and functionality depth is very different too.

<comment><USER58> Well, I meant why should one use this over bootstrap.

<comment><AUTHOR> Faster loading times on mobile come to mind.

</comment></comment></comment></comment><comment><USER59> I don't think I can use software that is "built with <3"

<comment><USER21> I, too, exclusively use software that is built with >=3.</comment></comment>


How to Become More Successful - <AUTHOR> http://www.stevepavlina.com/blog/2009/07/how-to-become-more-successful/

<comment><USER2> I first thought this was some business advice crap. However, the article repeated lots of good points.

What you think of life is what you will get from life.

<comment><USER3> I believe it's called confirmation bias. It affects pretty much all religious people but also many people like Pavlina.

</comment></comment><comment><USER4> As I read this article I _felt_ the truth of it, a very strange and infrequent feeling for me.

I feel like my capacity for introspection has been expanded.</comment>


Announcing Keyless SSL - <AUTHOR> http://blog.cloudflare.com/announcing-keyless-ssl-all-the-benefits-of-cloudflare-without-having-to-turn-over-your-private-ssl-keys/ <comment><USER2> For those who want to understand how it works (it took me a minute, so I'll try to explain it simpler):

In simplified terms, the server usually stores a public and private key, and sends the public key to the client. The client generates a random password, encrypts it with the server's public key, and sends it to the server. Only anyone with the private key can decrypt the message, and that should only be the server.

Now you don't want to hand over this private key to Cloudflare if you don't need to, because then they can read all traffic. Up until now, you needed to.

What they did was take the private key and move it to a keyserver, owned by your bank or whomever. Every time the Cloudflare server receives a random password (which is encrypted with the public key) it just asks the keyserver "what does this encrypted message say?" After that it has the password to the connection and can read what the client (the browser) is sending, and write data back over the same encrypted connection. Without ever knowing what the private key was.

The connection from Cloudflare to your bank's webserver and keyserver can be encrypted in whatever way. It could be a fixed key for AES, it could be another long-lasting TLS connection (the overhead is mostly in the connection setup)... this isn't the interesting part and can be solved in a hundred fine ways.

Edit: Removed my opinion from this post. Any downvotes for my opinion would also push the explanation down (which I hope is useful to some). I mostly agree with the other comments anyway.

<comment><USER3> _Now you don 't want to hand over this private key to Cloudflare if you don't need to, because then they can read all traffic._

Generally the key you would give them is for, and limited to, the resources that they cache/reverse proxy, so the same "read all traffic" concern exists.

What Cloudflare did is essentially, as others have mentioned, PKCS11 over the internet. PKCS11 is an existing, very well proven technique of sequestering the key in a hardware device, that hardware device doing what Cloudflare is moving to the client location here. It's neat enough, but they seem to kind of exaggerating the innovation a bit.

<comment><USER4> It is very obvious... In hindsight?

<comment><USER5> Not sure why all the negative reactions here... Was anyone else doing or providing this type of "Keyless SSL" setup?

You'd think if this was a known technique, the mentioned banks would already have been asking for it, implementing it, or doing it.

Personally, I think CloudFlare is one of the few companies on here doing innovating stuff, and solving real issues.

And if not - if they've pulled the wool over my eyes - then at least I can respect their marketing.

<comment><USER6> PKCS11 and Hardware Security Modules (HSM) have been around for a long time. There's in wide use in companies like NetFlix and Square including "over the network". This is not new.

</comment></comment></comment></comment></comment><comment><USER7> And my patch for OpenSSL that does the same thing: [https://gist.github.com/indutny/1bda1561254f2d133b18](https://gist.github.com/indutny/1bda1561254f2d133b18) , ping me on email if you want to find out how to use it in your setup.

<comment><USER8> No disrespect meant, but from a security perspective the idea of patching security-critical software with a patch from a stranger on the Internet is kind of crazy, isn't it?

<comment><USER9> All open source software is made up of patches from strangers on the internet.

<comment><USER8> Not really. Gatekeepers of important open-source software are usually people who are known in the community and often employed by companies who work in the area.

</comment></comment></comment></comment><comment><USER10> Instead of keeping the key in a potentially vulnerable place, they're putting it in an oracle: pass ciphertext to the oracle, get plaintext back. I'm interested in the authentication between CloudFlare and the oracle. Cryptographic examples involving an oracle tend to refer to the oracle as a black box that just blindly accepts data, transforms it, and replies. Of course, then the oracle's content (a key, an algorithm) risks exposure through deduction if an attacker can submit limitless requests. See [http://en.wikipedia.org/wiki/Chosen- plaintext_attack](http://en.wikipedia.org/wiki/Chosen-plaintext_attack)

I'm not at all suggesting that CF hasn't thought of this; rather I want to see their mitigation of the risk.

<comment><USER11> Would it be enough to simply only allow connections from Cloudflare IP addresses?

<comment><USER12> As Google and Yahoo will tell you after they found out the US government broke into their dedicated lines between data centers... No. It must be encrypted at every transfer without exception.

<comment><USER13> There's a huge difference between passively tapping a fiber optic cable and infiltrating a network to inject malicious traffic. All we've ever seen evidence of is NSA's passive tapping of Google & others.

<comment><USER14> We know the NSA targets routers. They have rootkits and remote exploits for them. They can do packet injection or anything else with the traffic passing through routers they take over.

</comment></comment></comment></comment></comment><comment><USER15> This seems to only slightly reduce the threat to the banks.

Currently, if someone compromises the Cloudfare servers, they gain the bank's private key and can impersonate the bank until the bank revokes their keys.

With this solution, if someone compromises the Cloudfare servers, they can impersonate the bank by relaying the decryption of the premaster secret through Cloudfare's compromised servers back to the bank. They can do this until Cloudfare notices and closes the security hole.

It's not clear that the difference is all that great in reality, as most of the damage will be done in the first 24 hours of either compromise.

<comment><USER16> > Currently, if someone compromises the Cloudfare servers, they gain the > bank's private key

This is not strictly true, is it? My interpretation is that at best they get temporary access to a server that will sign for them using the key, but the bank can terminate their signing servers at any time and then safely resume using their key without having to revoke it, since it never left their server.

This does somewhat increase the attack surface, but it lets the bank keep control over their keys and is better than having their keys get compromised and thus having to revoke them.

<comment><USER17> Here, "currently" is the status quo, which is contrasted to "this solution". So "currently" means "without this solution".

</comment></comment></comment><comment><USER18> So the communication between Cloudflare and the actual SSL key holder is secured by… what? Another key? In that case, any compromise of Cloudflare's key is the same as a compromise of the original SSL key (at least in the short term).

<comment><USER19> A notable difference is that a compromise of Cloudflare's key wouldn't [edit: might not] require the bank to notify the Federal Reserve.

It may be pretty cynical to call that situation a "feature". But I'm sure it came up. And I'm sure they noticed.

It certainly wouldn't be the first time "trivial functional difference" translated to "massive legal difference."

<comment><USER20> You should probably say "might not", because although we know a key compromise would require notification, you'd have to have an actual lawyer tell you if a compromise of CloudFlare would not. Unless the lawyers are on board with this as a solution to the notification problem, the whole solution doesn't do anything (legally).

<comment><USER19> It gets a little cumbersome to hedge casual conversation the way attorneys do, but sure, it would have been more accurate to have said:

"might not, under the current rules, which are always subject to change"

</comment></comment></comment></comment><comment><USER21> Keyless SSL is basically an analogue of ssh-agent(1) for OpenSSL. It's a nice feature that you no longer have to trust CloudFlare with your private key, but there's a huge tradeoff: if your keyserver is unavailable (ironically, due to any of the things CloudFlare is supposed to protect you from or buffer you against -- DDoS, network/server issues, etc.), they can no longer authenticate requests served on your behalf and properly serve traffic.

<comment><USER22> Please remember that CloudFlare is a sort of reverse proxy with some network protections and enhancements.

If your infrastructure is unavailable, users won't get content anyway, SSL or not.

<comment><USER21> CloudFlare can serve cached responses in the event that your origin server is unavailable. This is particularly useful for static websites, but that's not the most common use case.

<comment><USER9> If your origin server can be found on the internet, it can be DDoS'd/attacked, and your (dynamic) site will go down. This is true of all CDNs. The way to avoid this is to either have the CDN host your app servers or provide a private connection from your origin to the CDN.

I guess technically the TLS-secured _static_ content would now be at more risk than it was before, when the cached content would have been served. But existing session tickets would probably be honored, so only new clients would get rejected. Still, it's a tradeoff some people would probably be fine with.

</comment></comment></comment></comment><comment><USER23> All other technicalities aside it's rather interesting. From an HSM perspective it either makes that hardware now very useful or very useless.

Think of a large organization - you've been there (or not), there are 30 internal applications with self-signed certificates. Fail. The organization had purchased an HSM, but never really got it deployed because - well, that was too complex and it didn't integrate well with 3rd party network hardware and failed miserably in your *nix web stack.

This could be interesting - and I'm not commenting with regard to the efficacy or security concerns around this, but mainly the workflow simplicity it provides to large organizations who end up in self-signed-cert-hell because HSMs don't interoperate easily in a lot of use cases.

But to my original statement - this is a very good thing or a very bad thing for Thales and the like. The only requirement for an actually certified HSM, really, is certification against some hardware and software standard you have a checkbox to fulfill. Beyond that this would be a killer in the middleground for those who want an HSM like functionality but don't have any requirements to meet other than housing a secure segment where key management can be done in a more controlled manner.

<comment><USER24> That's Hardware Security Module.

<comment><USER23> HSM = Hardware Security Module, yes, that was implied and my point.

</comment></comment></comment><comment><USER25> While this is a cool feature, I wouldn't say the improvement is more than marginal: all potentially sensitive customer data is still available to Cloudflare in plain text. And after all, with a Business plan you can already use your own ("custom") SSL certificate which you can then revoke at any time.

Why not offer a "pass through" mode where the proxying is done on the network layer rather than the application layer? Of course in such a modus all CDN- like functionality could no longer be offered, but it could still do a fair amount of DDOS protection, no?

<comment><USER26> Well, for the use case given, with "Keyless SSL", if Cloudflare is compromised, then the bank doesn't need to report the incident to the Federal Reserve.

But yes, users' plaintexts would still be compromised.

"Security theatre" indeed.

<comment><USER27> I am not sure that a Cloudflare compromise would not rise to the level of a reportable event. In my experience/opinion "users' plaintext compromise" is certainly an instance of unauthorized access to customer information. I understand the whole framework here is risk-based so it is a matter of interpretation; but I do not want to be the person who has to explain to the nice folks from the OCC the intricacies of Cloudflare's implementation and why I deemed the compromise low risk.

      >  An institution should notify its primary Federal regulator as soon
      >  as it becomes aware of the unauthorized access to or misuse of
      >  sensitive customer information or customer information systems.

FDIC: Supervisory Insights [https://www.fdic.gov/regulations/examinations/supervisory/in...](https://www.fdic.gov/regulations/examinations/supervisory/insights/siwin06/article01_incident.html)

</comment></comment></comment><comment><USER28> So, this is not actually keyless SSL but SSL using something like a Hardware Security Module over networked PKCS#11. Did I miss something?

</comment><comment><USER29> So CloudFlare won't get your private key, but will still get to see unencrypted plaintext for all traffic? Sounds like a huge improvement...

<comment><AUTHOR> What threat are you concerned about?

<comment><USER29> I don't really see the security improvement. Actually the key server would be an new attack vector, although one that could be firewalled pretty well.

<comment><USER30> Using CloudFlare implicitly requires trusting CloudFlare.

With this, CloudFlare cannot impersonate you without your endpoint's active consent. As soon as you terminate the service that solves this puzzle for CF, they cannot impersonate you any longer.

So, yes, it is better. Maybe not "great" if your threat model includes CF getting 0wned, but definitely better than giving over your RSA key. ;)

<comment><USER31> And that's why regulations make it almost impossible for banks to use CloudFare. But CloudFare sees that as a problem, and makes some effort to create a loophole.

You can't claim that this improves the bank clients' security. It's clearly worse than doing nothing.

<comment><USER30> Think of it as a compromise: You can leverage CloudFlare's CDN to mitigate DDoS and other sorts of nasty attacks AND assure TLS is used with every connection, without giving up your RSA key.

"It's clearly worse than doing nothing." It's not very clear to me. Please explain.

<comment><USER32> I think "It's clearly worse than doing nothing" is from a purely security perspective. This opens up a larger attack surface, so it's worse in terms of security. But it's better than doing nothing from a business perspective, since it allows for better performance and better handling of DDOS attacks. It's a comprimise. Potentially it is slightly worse in security, but it is much better for performance and uptime.

</comment></comment></comment></comment></comment></comment></comment><comment><USER33> See: Secure session capability using public-key cryptography without access to the private key.

[https://www.google.com/patents/US8782774](https://www.google.com/patents/US8782774)

<comment><USER34> And here's a similar patent from Akamai (via @cloudpundit) [http://www.google.com/patents/US20130156189](http://www.google.com/patents/US20130156189)

<comment><USER33> Looks like the Akamai patent for basically the exact same process, filed 2012-12-14, priority date 2011-12-16 is still being examined... yet the CloudFlare patent filed 2013-03-07 was granted 2014-07-14.

That's a really fast turnaround for CloudFlare, and not sure how the Akamai filing isn't prior art. Actually, the Akamai filing is _referenced_ in the CloudFlare patent.

<comment><USER35> From what I can tell, the main difference is that the claims in CloudFlare's patent describe more of the SSL handshaking process and the subsequent handling of requests (all of which is exactly the same as in standard HTTPS proxying). They both claim exactly the same technique for a web proxy to handle SSL connections without having the private key, but I guess the USPTO decided the fact that CloudFlare described more of that process in their patent claims constituted a improvement on Akamai's invention for some weird reason.

</comment></comment></comment></comment><comment><USER36> The article is somewhat light on content. There are standard protocols for HSM use. What is the reason you didn't use these? There are clear risks involved with inventing your own security related protocols.

<comment><AUTHOR> We have a really long technical blog post coming tomorrow. Agree that inventing protocols is dangerous so we got iSEC Partners/Matasano to evaluate.

</comment></comment><comment><USER37> Are we reinventing Kerberos again?

</comment><comment><USER38> isn't this completely missing the point, i.e. banks being able to say 'no third parties can see our clients identifying information/balances/etc?'

yes, the SSL key doesn't leave the bank, but everything it is protecting is..

<comment><USER7> It only protects one thing - server identity. The best ciphers do you use DHE for negotiating the key, so the conversation between bank and the client is secure anyway.

<comment><USER39> Under this scheme, the DHE is between the client and CloudFlare, not the client and the true end-point. CloudFlare still sees the full plaintext of the HTTPS session (as it must in order to do it's magic). The encryption is not end-to-end.

</comment></comment></comment><comment><USER40> > World-renowned security experts Jon Callas and Phil Zimmermann support > CloudFlare's latest announcement sharing, "One of the core principles of > computer security is to limit access to cryptographic keys to as few parties > as possible, ideally only the endpoints. Application such as PGP, Silent > Circle, and now Keyless SSL implement this principle and are correspondingly > more secure."

Ehh... I'd say Keyless SSL implements the _opposite_ of that principle: encryption terminates with CloudFlare but authentication terminates in some bank.

</comment><comment><USER41> So the problem is, how to get a cloud in the middle while keeping the green lock in the browser? Just yesterday I read Douglas Adam's phrase "technologies biggest success over itself."

</comment><comment><USER42> Interesting, but what about the latency issues of having to always contact the key server?

<comment><AUTHOR> There's a very technical blog post coming on this tomorrow, but that problem is addressed by session tickets and by the fact that most of the TLS handshake is occurring with a CloudFlare server typically nearer the web browser than before.

<comment><USER43> Do you guys have a "global" session ticket cache shared amongst endpoints? Or do you ensure the same user gets routed back to the same termination node? I'm quite curious about this.

<comment><USER44> Session Tickets are shared globally. Session IDs are shared intra-data center (so regionally). The former works with Chrome/Firefox. The latter with all other browsers.

<comment><USER43> That's really cool, thanks for responding. I imagined that possibility but never heard of anyone actually doing it(not to say they don't). Maybe I'll need to experiment around with Golang's TLS package :)

</comment></comment></comment></comment></comment><comment><USER30> That is amazing. I can't wait to play with this code :D

</comment><comment><USER45> How does this architecture address PFS? I'm guessing a future version would require the exchange of DH private key to make it work...

<comment><USER46> Nothing that complicated is required. When the server needs to sign the DH handshake, it sends the value to be signed over to the key server, and the key server replies with the signature.

Although the diagrams in the blog post show the non-PFS RSA handshake, I'm sure the architecture already supports the PFS DH handshake too.

</comment></comment><comment><USER47> I don't like to sound hateful, but this is an obvious solution that any competent person knowing how TLS works would find. If someone tried to patent it, I suppose every smart card would be considered prior art. The only "novelty" is that the connection to the "smart card" is the network.

Not to say that it's not useful, but the article describes it as some grand invention.

<comment><USER48> Then again, do you know of anyone else who has actually implemented and are using this commercially, at scale? They say it themselves in the article, a prototype is one thing but actually making it into a commercially viable product is something else.

</comment></comment><comment><USER49> Well, cloudfare can still read all the traffic. I thought that problem had been solved somehow.

</comment><comment><USER50> Is this the free SSL announcement that CloudFlare said it was going to announce in October?

<comment><AUTHOR> No.

<comment><USER30> Is it related? ;)

<comment><USER51> not really -- only in that they are both SSL-related.

Free SSL is still in the works. More info soon-ish.

<comment><USER30> My question was more to the point of: will Keyless SSL work with Free SSL? :)

<comment><USER44> Not how you're likely thinking. That said, we will use the Keyless technology to expand our data center footprint into locations that we wouldn't feel comfortable storing customers' keys. That will end up benefiting even Free customers who will be faster around the world.

</comment></comment></comment></comment></comment></comment><comment><USER52> Wow, what a great read!

</comment><comment><USER53> It seems that the correct title should have been "all your keys are belong to us".

</comment><comment><USER3> After reading the beginning of the piece, I was expected something more...profound. Some deep mathematical breakthrough or something.

Instead they separate the actual key signing, delegating it to the customer's device. That's nice and useful, but isn't quite what I was expecting.

<comment><USER54> "Tomorrow, we'll publish a full post on the nitty, gritty techical details of how, what has come to be called Keyless SSL™, works."

<comment><USER55> But it's already fairly obvious how it works. They essentially MITM with the keyserver to receive the SSL nonce. Of course, it's pretty silly to expect cloudflare to have some special mathematical revolution to solve the stated problem. In fact I figure if you could terminate SSL without an online private key, the encryption scheme is simply broken.

<comment><USER3> _But it 's already fairly obvious how it works._

It is obvious, and they effectively implemented a custom approach for PKCS11/ssh-agent. Yet the narrative implies some brilliant period of insight and innovation, when really it kind of isn't.

Which is where the "silly" notion that they must have did something novel came from -- their narrative claims it.

<comment><USER56> Innovation means different things to different people. To you, it seems to mean a mathematical or algorithmic breakthrough. To me, it also means getting an existing idea or technology, and deploying it in a new, real-world context, solving the UX / scalability / security / policy issues that arise in the new context, and make it commercially viable.

The fact that Cloudflare is the first global-level CDN to implement this kind of keyless SSL termination to me _is_ innovation, even though it's based on pulling PKCS11 at the IP level. It's solving a real-world problem in their context, which nobody has solved before, and customers pay for it.

</comment></comment></comment></comment></comment><comment><USER57> Sounds like Elliptic Curve Diffie-Hellman is used between client/server to establish a private key. Not sure how this is new.

<comment><USER30> At a glance, it appears that the non-ephemeral RSA signature is handled in the network, but the key exchange occurs at the endpoint.

What's new is the whole "edge calls home with a signing request" piece.

</comment></comment><comment><USER58> This is a discussion about cyberwarfare in a literal sense. The technical discussion shouldn't really be separated from the economic, political, social and human health concerns because all of those parts of the system interact deeply and directly.

A goal of total political cooperation or submission leads to economic sanctions leading to serious human health effects leading to defensive denial of service attacks. This accelerates the need to decentralize the financial network systems to make them more robust.

How can we imagine though that even after a complete transition to next generation systems that are ground-up distributed designs (not just stop-gap tweaks like this) that we won't have new types of attacks to deal with.

The starting point is the belief system that provides such fertile ground for conflict. We have to promote the idea that human lives have value and that lethal force is not an acceptable way to resolve conflict.

As long as decision makers are living in a sort of 1960s James Bond fantasy world we will all be subject to the insecurity of that type of world. Its largely built upon a type of primitive Social Darwinism that is still much more prevalent than most will acknowledge.

Its much easier to accept a compartmentalization of these problems and focus on a narrow technical aspect, but that does not integrate nearly enough information.

<comment><USER58> Would be interested to hear from people who are burying my comment if they have any kind of explanation for why they are doing it, such as counterpoints to my statements. In case there is some insight that I might gain from them, since apparently there is a strong disagreement.

<comment><USER59> GP comment is too generalized to be constructive. That is especially so in this discussion of a specific network security platform, which presumably has specific faults that may be discussed instead of generalities like "belief systems" and "human lives".

<comment><USER58> You're right, I'm sure none of my general concerns about completely false belief systems and human lives are worth being viewed by any readers in this thread. My comment also may be a little bit difficult to contextualize or disconcerting for readers. Best to keep downvoting it so that it disappears.

<comment><USER60> Passive-aggressiveness is not an effective persuasion technique.</comment></comment></comment></comment></comment>


Show HN: Sokuji – point to translate Japanese-English browser for iOS - <AUTHOR> https://itunes.apple.com/app/sokuji-japanese-dictionary/id1176427250 <comment><AUTHOR> OP here, made this as what I thought was a good mobile equivalent to those mouseover dictionary browser extensions I used to use for studying Japanese on Firefox like Rikai-chan.</comment>


How to beat the CAP theorem - <AUTHOR> http://nathanmarz.com/blog/how-to-beat-the-cap-theorem.html <comment><USER2> This doesn't beat the CAP theorem. The approach can be quickly described as a log-based append-only database with read-repair code based on last-write-wins.

The system will have inconsistent views for the whole time a netsplit lasts. If I have two nodes, A and B, and that they both hold a piece of data related to a meeting M0 at 11 on Monday, then a netsplit happens, the strategy suggested won't help with the following case:

Jim and Peter have access to node A, and Mary and Julie have access to the node B. Because there is a netsplit between A and B, communication is impossible there. However, Jim and Peter agree to move the meeting M0 to 3PM on Monday, and we call it {A,M1}. Mary and Julie, however, agree to move the meeting to 1PM on Tuesday. We call it {B,M1}. Now, the M1 record on A and B is no longer the same. If the netsplit isn't resolved before Monday, then inconsistent data will have caused the loss of our team meeting!

When the netsplit is resolved and we consult the meeting, the approach of the blog post will pick either B's version of M1 or A's version of M1 based on the map-reduce we've had. To the reader, we'll have discarded either of them. This is why the last write wins -- it's the latest state in the log of events, the other one is ignored.

Last-write-wins is a default mode to be used on read-repair, and nothing solving the problem of losing consistency. During the netsplit, views of the data remain inconsistent.

The way to keep them consistent would have been to have A and B blocking writes. As such, we would have kept Jim, Peter, Julie and Mary from writing new meeting times and made sure that they all had the same hour presented.

An easy way to test whether you beat the CAP theorem or not is to imagine your system functional during a week-long netsplit. Either it keeps on working with inconsistent data, or it has a way to keep it consistent. The CAP theorem tells us it's impossible to do both at once, and the blog post didn't disprove that, but merely provided a way to resolve conflicts in data in an automatic way.

I would expect someone to 'beat' the CAP theorem as much as I would expect someone to 'beat' the Pythagorean theorem. The blog is interesting in its own approach to make the CAP theorem simpler to handle, but misses its own point of beating it.

</comment><comment><USER3> I'm not sure if you're trolling here:

> The CAP theorem has been beaten.

> As you are about to see, a system like this not only beats the CAP theorem, > but annihilates it.

The CAP theorem states that you can't have all three of strong consistency, partition tolerance, and availability at once. This is a proven fact ([http://www.cs.cornell.edu/courses/cs6464/2009sp/papers/brewe...](http://www.cs.cornell.edu/courses/cs6464/2009sp/papers/brewer.pdf)).

I don't see how your proposed system provides strong consistency. Eventual consistency is not strong consistency. Let's pretend the HDFS deployment in your batch workflow is partitioned from the rest of the system: sorry, but you won't be able to get strongly consistent data from it, and you'll have to either read stale data or simply block until the partition ends. This is pedantic, the CAP theorem is pretty specific.

Now, if you're saying something about the eventual consistency of logically monotonic facts in the system (see the CALM conjecture, now theorem: [http://databeta.wordpress.com/2010/10/28/the-calm- conjecture...](http://databeta.wordpress.com/2010/10/28/the-calm-conjecture- reasoning-about-consistency/)), which I think you are, then I agree that you have a system providing (even provable) eventual consistency. The basic idea is that if code is logically monotonic, meaning the set of facts it operates on continues to grow over time, then it will obey eventual consistency properties. If I'm not mistaken, your notion of "immutable data" is equivalent to restricting programs to operate on logically monotonic data (in your examples, this is accomplished by making data take the form "fact X is true at time T").

<comment><USER4> I never said anywhere that it provides strong consistency. You still choose between availability and consistency. What you beat is the complexity the CAP theorem normally causes. You regain the ability to easily reason about your systems.

"There is another way. You can't avoid the CAP theorem, but you can isolate its complexity and prevent it from sabotaging your ability to reason about your systems."

"What caused complexity before was the interaction between incremental updates and the CAP theorem. Incremental updates and the CAP theorem really don't play well together; mutable values require read-repair in an eventually consistent system. By rejecting incremental updates, embracing immutable data, and computing queries from scratch each time, you avoid that complexity. The CAP theorem has been beaten."

<comment><USER5> > What you beat is the complexity the CAP theorem normally causes. You regain > the ability to easily reason about your systems.

So instead of saying "The CAP theorem, while still being completely valid, doesn't have to as annoying as you might think," you said "The CAP theorem [has been] annihilated."

Gotta love blogging.

<comment><USER4> Wow. This is one of the most blatant examples of taking things out of context I've ever seen. The "annihilated" sentence you're referencing is part of a thought experiment in the post about an ideal system that's infeasible but instructive!

Here's the proper context for that statement:

"The simplest way to compute a query is to literally run a function on the complete dataset. If you could do this within your latency constraints, then you'd be done. There would be nothing else to build.

Of course, it's infeasible to expect a function on a complete dataset to finish quickly. Many queries, such as those that serve a website, require millisecond response times. However, let's pretend for a moment that you can compute these functions quickly, and let's see how a system like this interacts with the CAP theorem. As you are about to see, a system like this not only beats the CAP theorem, but annihilates it.

The CAP theorem still applies, so you need to make a choice between consistency and availability. The beauty is that once you decide on the tradeoff you want to make, you're done. The complexity the CAP theorem normally causes is avoided by using immutable data and computing queries from scratch."

</comment></comment></comment></comment><comment><USER6> Good write up, Nathan. Nonetheless, you started by saying you were going to challenge the basic assumptions of how data systems should be built, but the resulting system architecture is in fact very similar to a lot of data streaming systems that the academia and industry have proposed and built for a number of years. An example of such system is Google's Percolator [1].

In essence, you separate the system into two parts, a read-only part and a real-time part. CAP explains fundamental trade-offs in OLTP type of queries, whereas this system design is catered towards streaming, analytical queries. These are two very different contexts.

[1] <http://research.google.com/pubs/pub36726.html>

<comment><USER4> I was under the impression that Percolator was a purely incremental system. I'll have to give the paper another read to see if they're using a hybrid batch/realtime approach.

The system I described isn't limited to any particular "type" of query. It's a way of supporting arbitrary queries on arbitrary data, which encapsulates everything.

Most people assume mutable state and incremental updates when building data systems. This is in fact the approach that almost all databases take. These are the assumptions I challenged.

<comment><USER7> >Most people assume mutable state and incremental updates when building data systems. This is in fact the approach that almost all databases take. These are the assumptions I challenged.

it isn't assumptions. It is requirements for some systems. You drop requirements - you get a breathing room and can build a different system.

<comment><USER4> Mutability and incremental updates are never requirements. Requirements have to do with performance and resource usage: X amount of space, Y amount of memory, Z amount of latency, etc.

Mutability and incremental updates are approaches. I showed a different approach with immutability at the core which leads to a system with some amazing properties.

<comment><USER8> I hope that examples like this and git make more people see the value of immutability. In the context of functional programming the same concept is called purity.

</comment></comment></comment></comment></comment><comment><USER9> > The key is that data is immutable. Immutable data means there's no such > thing as an update, so it's impossible for different replicas of a piece of > data to become inconsistent.

I'm not following that point.

Suppose you have an event-souring data store as the OP suggests, and some nodes go out of sync. So one of the nodes records that Sally now lives in Atlanta, the other doesn't.

The query for Sally's location asks for the last update. One node says Atlanta, the other still says Chicago. What's that, if not inconsistent?

Only appending data means you don't corrupt old data, but you still can get conflicting responses from different parts of your system.

<comment><USER4> What you're describing is a query. "What is Sally's current location?"

Queries can be inconsistent during partitions. This is what eventual consistency means. But once the partition clears, the queries will be consistent again.

The data is immutable. Both "Sally lives in Atlanta as of time X" and "Sally lives in Chicago as of time Y" are true.

This is far, far different from databases based on mutable state. In order for a database like that to be eventually consistent, you need to do read-repair to enforce consistency. This is besides the other problems I brought up with mutable databses, such as a lack of human fault-tolerance.

<comment><USER10> If I only have one antique pocket watch and, during a partition, Alan buys the pocket watch while communicating with partition A and Bob buys the pocket watch while communicating with partition B, how do we get back to a consistent state without application code?

<comment><USER4> A good example to look at is banks. Banks are eventually consistent systems. An ATM allows you to withdrawal funds (to a set limit) even if it can't communicate with the bank. However, because banks keep full audit logs of all transactions (immutable data), they eventually discover that you took out too much money and charge you an overdraft fee.

<http://en.wikipedia.org/wiki/Overdraft>

<comment><USER11> This isn't really relevant to the pocket watch problem. This only works because the bank doesn't care about over-committing a finite resource (mostly because they can charge you that fee). My company processes transactions for prepaid credit cards, so any money that is overdrawn is essentially lost - it's important to understand the characteristics of the problem and that there really is no magic anti-CAP bullet.

<comment><USER4> Exactly right. The bank example just demonstrates an alternative approach to full consistency.

</comment></comment></comment></comment></comment></comment><comment><USER12> OP adds confusion by calling data immutable. Data has a well accepted common usage of being updatable. Event is the term what OP wants. Event is a snapshot of fact happened in time and cannot be changed and it's immutable.

What OP described in general is the append-log based approach to storing and querying data. There are a whole bunch databases and file systems built on the append-log idea. It's well worth the time to check out the research in this area to see the benefits and pitfalls of the approach.

Also check out the Complex Event Processing topic which bears similarity to what OP described.

<comment><USER13> Sorry, no. It is calling data mutable that is the confusion.

Try this exercise:

Identify something you consider a datum. Write it down. Note that it has more than one part. Now imagine it 'changing' and write that datum down. Now, identify the 'it' that (you would say) changed. Note that the 'it' part is _the same_ in the 2 datum. Let's call this 'it' part the identity. Now look at the part that is different. For discussion's sake let's say that part was 42 in the first case and 99 in the second. Did 42 change into 99, or was it replaced by it? Let's call 42 and 99 values. You'll not be able to describe something that 'changed', that incorporates _both_ the identity and value, that doesn't involve some memory/disk/system that had a (just one!) 'place' for storing information about 'it', and it is that place that has had it's contents replaced/changed, not the datum/fact.

Did Obama becoming president _change_ the fact that Bush had been president? No. Could you make an information system that forgot Bush was president? Sure, but that's your fault, not a characteristic of data.

Finally, check out this 30 year old paper that contains this interesting section: UPDATE IN PLACE: A poison apple?

[http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.108....](http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.108.7810)

As long as we continue to use lax language like mutable/updateable data we will be without the tools to describe, think about, and build better systems that independently manipulate identity, value and place, and correctly handle time.

<comment><USER12> I'm sorry. I don't understand the point of the exercise.

First, what kind of data are you talking about? Are you talking about data value? Data record? Data object with identity?

Second, are you saying database records being mutable cannot model Bush was a president once Obama has become president?

I don't know the reason for the aversion to mutable data record/object. Both mutable and immutable data record/objects have their places in modeling real world objects.

<comment><USER14> > I don't know the reason for the aversion to mutable data record/object.

I've found that mutable data is a root of all kinds of evil. In fact, I'd guess that _most_ bugs stem from a mis-management of mutable state.

I know that pretty much all of the bugs I see every day are the result of failure to coordinate state changes, or poorly-designed state changes.

<comment><USER12> Can you give some specific examples of bugs stemming from mismanagement of mutable state? Some examples on bugs resulted from the failure to coordinate state changes or poorly-designed state changes? And how the immutable data solve the problems?

<comment><USER14> I'm not sure why you don't believe me :)

There are literally too many to list. But if I just had to pick some recent ones:

* A dropdown on a web form that displays a different value than is returned (failure to coordinate the displayed value and the "actual" value)

* Logins remain locked after resetting a password (failure to change a value from "locked" to "not locked", instead of "is the user locked?" being a function of history)

* If you navigate to a business object from a list, and perform an action (via HTTP POST) on that object, you can accidentally perform the same action on other objects from that list through refreshing or clicking multiple times (since the "current" object is in the session state)

* Bugs that only happen when you navigate to a page from a certain other page (because the destination page depends on certain session state that was not set, instead of being a simple function of URL parameters)

<comment><USER12> Not that I don't believe you. It's just that I want to learn from specific examples on what kind of problems people encounter when dealing with mutable data and how would immutable data solve the problems.

So how would immutable data solve the above problems? Thanks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> If I am not completely mistaken, the pattern that's being hinted is called Command-Query Responsibility Segregation(CQRS) in certain circles:

<http://cqrsinfo.com/documents/cqrs-introduction/>

While making the problem easier, I do not know if this actually "solves" the CAP theorem issues.

<comment><USER16> At a high level, CQRS is simply separating your reads from your writes. It follows the observation that most web-related DB queries are in the form of reads and much fewer writes. I don't know about solving the CAP theorem, but it does a very nice job of scaling horizontally.

</comment></comment><comment><USER17> In practice, beating the CAP theorem inside the data center is achieved by using a 2-tiered system.

Have a set of lightweight controller processes which use a consistent majority voting algorithm (Paxos) to replicate the state of the cluster. Since it's lightweight, you can run 5 or 7 of them, meaning 2 or 3 can die. This is enough Availability in practice, per customer input.

Have a set of data nodes which actually store the data. Put groups of 3 of these in replica sets and use consistent replication (Paxos). If one or two of them goes down, the controllers reconfigure the replica set, so you get Availability even if 2 of 3 goes down. (Customers love that they get Consistency but 2 of 3 can go down.)

This scheme is used in my company's product. The idea comes from academic/Google papers, and is used in other products, too.

The scheme does not work for multi-datacenter use-cases. If you want that, you have to give up consistent replication (Paxos) inside the replica sets and use some kind of eventual consistency. This variation of the 2-layered scheme is used by one of the popular competing NoSQL systems.

<comment><USER7> >Beating the CAP theorem inside the data center is fairly easy in practice by using a 2-tiered system.

>Have a set of lightweight controller processes which use a consistent majority voting algorithm (Paxos, Consistency, Partition Tolerance) to replicate the state of the cluster. Since it's lightweight, you can run 5 or 7 of them, meaning 2 or 3 can die. This is more than enough Availability in practice, per customer input.

it isn't beating of the CAP theorem. It is decreasing the Partition Tolerance and thus getting more Availability while preserving Consistency in full accordance with CAP.

</comment></comment><comment><USER18> I wrote my thesis on an immutable data store as a means to beat CAP. I didn't get quite as far as your other observations though, as mine was in the context of continuation web frameworks.

Very nice write-up however.

<comment><USER4> Thank you. Got a link to your thesis anywhere? Would love to read it.

<comment><USER18> It's not in a state I would like to make public yet. Sufficient to get my degree, but the quality is poor due to personal circumstances. However I sent you a link via your contact form.

</comment></comment></comment><comment><USER19> Beating the CAP theorem by proofing it by dropping the requirement for consistency? Sorry to be conservative and following Aristotelean logic, but this title does not make sense.

<comment><USER20> Indeed, it's not quite "beating". "How to get full availability and eventual consistency (the best you can do under CAP) with no effort in the application layer" might have been a truer title. Nevertheless, this is something useful.

</comment></comment><comment><USER21> A few days ago I posted my frustration with Cassandra counters, this article articulates a solution elegantly:

'if you make a mistake or something goes wrong in the realtime layer, the batch layer will correct it.'

The resiliency of this protection however is limited by the time it takes to do a full re-processing of the historical data. If there is a processing mistake in your real-time layer, it is likely to exist in your batch layer as well, thus invalidating the pre-computed results as well.

<comment><USER4> But you can always correct the mistake and recompute things. Unlike systems based on mutable data, mistakes aren't permanent.

<comment><USER12> If the transaction log is kept for the mutable system, you can always replay the transaction to arrive at the correct state. Most systems truncate the transaction log after a checkpoint to save space. If space is not an issue, you can always keep the transaction log since the beginning.

</comment></comment></comment><comment><USER22> How does the system deal with real-world data that has cross-datum consistency requirements? Many system mnodeling real-world have this issue: accounting, inventory, ...

I'm also annoyed by the repeated mantra that you must have partition tolerance. In fact, most naïve systems are designed without it, with some central authority that must always be accessible. (Any system that is stricly a tree with an essential root node is like that. Any partition that does not include the root node cannot do any work, thus the system is not partition tolerant.) You can then have CA (by requiring that all requests and updates must propagate to the root.)

<comment><USER23> You then do not have the A part of CA. Your root node is not accessible => your entire system is not accessible.

</comment></comment><comment><USER24> 'How to _tolerate_ CAP, according to application / system specifications..'

</comment><comment><USER25> Great write up. You really nail the essence of a true data driven approach (DDA) to solving problems. Simplification of the data world view can lead to great things. The key to your batch computation example is proper data modeling IMO. This leads to flexibility which is crucial for a design to be successful. I feel people will stumble with the content of this post because of the lack of proper understanding of DDA.

</comment><comment><USER26> This looks like Event Sourcing / CQRS. Is that correct?

<comment><USER4> There are similarities. It's really closer to functional programming than anything else.

</comment></comment><comment><USER27> Nice post! To me, the logical next step is a mathematical framework for proving that all major relational operators (and in partition intolerant mode, ACID) can be implemented using this approach -- if such a model can be cleanly laid out it could drive the future of database systems.

</comment><comment><USER28> Thanks for the long and interesting article. Two comments, one an observation I'd be interested in hearing your response to, the second a bit of a devil's advocate question.

First, in your write-up, you describe data as singular, but of course, it's often a tuple. To take a concrete example, let's say that Sally, in order to make her move from Atlanta to Chicago, goes to U-Haul's website and reserves a 14' truck for Monday. She thinks a bit more and decides that she needs a bigger truck, so she goes to the site and changes her reservation to a 17' truck. After even more thinking, she decides she really won't be ready by Monday, so she changes her reservation date to Tuesday.

Let's call these three moments t0, t1 and t2. So her order has changed from:

t0: 14' truck, Monday

t1: 17' truck, Monday

t2: 17' truck, Tuesday

BUT, it so happens that U-Haul has implemented a datastore like you suggest, one that is only "eventually consistent", and when Sally made her change at t2, the node she was talking to hadn't heard yet about the switch from a 14' to a 17' truck. So the actual tuples that were recorded were:

t0: 14' truck, Monday

t1: 17' truck, Monday

t2: 14' truck, Tuesday

Now you're in a pickle: how can you tell that the record stored at t2 was partially out of date, verses the possibility that maybe Sally really did want to change back to a 14' truck at the same time she changed the date to Tuesday.

To solve this, you need to do two things: the table that records new items is different from the ones that record updates, in that the new item tables contain full tuples, while the update tables are radically normalized, to the extent that they'll usually have just two columns: a key and an atomic replacement value. So what we'd actually record is:

t0: 14' truck, Monday in the "new reservation" table

t1: 17' truck in the "reservation item change" table

t2: Tuesday in the "reservation date change" table

I don't have any knee-jerk opposition to a schema like that, but it seems to me you'll run into two issues:

\- all the usual issues with extreme normalization, like performance and massive and complicated joins. And since, as I understand it, your realtime iterative db is consuming the same data stream as your main store, it will face this same performance penalty, at least in its input.

\- your schema darn well better be in BCNF, or enforcing data constraints across the hyper-normalized update tables is going to get very hairy very fast. Like here, let's say that U-Haul has a policy that it never rents 17' trucks on Tuesdays (I don't know why, maybe they wash them on Tuesdays). Since when Sally made her switch to Tuesday, the node she was talking to thought she was still renting a 14' truck, it was happy to record the change. But when your batch process comes along and tries to resolve the two updates, what does it do? There's no obvious answer (going with the last consistent state -- 17' for Monday -- is certainly wrong, as we know that's no longer what Sally wants). In other words, you're back in the "read repair" complexity and hell you thought you'd avoided.

Second point ... eh, I think I've well overspent my word budget. In summary: a devil's advocate would say that the realtime db you've called just an "optimization" is, in fact, the real db, since if the realtime and batch dbs differ, at least at any time other than when a new batch update lands, then you'll go with the value from the realtime db (if, during normal operation, batch says a count is 4 but realtime says 5, you report 5). So what you've really done is attached a fairly massive auditing system onto the same-old database design. Its job is to periodically check that no inconsistencies have been introduced between nodes. It's a clever auditing system, in that the immutable model means it may have a leg up on deciding what the right result is, but still just an auditing system.

tl;dr: won't this lead to hyper-normalization, and is it really a new db design or just a new kind of auditing system

edit: formatting, tl;dr

<comment><USER4> I would store the reservation date and truck length as separate data objects in the batch layer. You would tie them together with the reservation id. It isn't a big deal to do those joins since the batch system is good at that kind of large-scale computation and you've already accepted high latency in the batch layer.

I wrote an article about graph schemas on the batch layer here: [http://nathanmarz.com/blog/thrift-graphs-strong-flexible- sch...](http://nathanmarz.com/blog/thrift-graphs-strong-flexible-schemas-on- hadoop.html)

The realtime db only accounts for the last few hours of data. Unless you're doing a query that only needs the last few hours of data, you need to do a merge between the batch view and the realtime view. We constantly flush old data out of our realtime db so as to keep it small and fast.

</comment></comment><comment><USER29> While I don't have an answer on how to beat CAP theorem...I know someone who is working on it as we speak, as well as many other issues associated with the cloud. View his tweet below:

@eric_brewer Eric Brewer I will be leading the design of the next gen of infrastructure at Google. The cloud is young: much to do, many left to reach. 10 May via web

</comment><comment><USER30> Wow, this article is full of clear, coherent, well thought out points... and references!

</comment><comment><USER31> I love that research is going into disproving already superseded theories.</comment>


One salary experiment at iwantmyname - <AUTHOR> https://iwantmyname.com/blog/culture-at-iwmn-part-one <comment><USER2> I think it's intriguing, and love that they're trying this out. It does seem to imply the following to make this work, as the blog post didn't delve into the dynamics:

a) Salary might have to be at least market average, if not above-market- average, or offer a _very_ compelling reason to the contrary;

b) To provide a means to differentiate experience or equity ownership, perhaps a bonus or profit sharing could be implemented, which may or may not be transparent to the entire company;

c) Implies junior staff can't be hired without at least some people feeling said junior staff are getting a bit of a free ride.

If your team is small, and you can afford to hire great mid/senior talent, I could see this working and increasing team cohesiveness. I'm not sure how to handle point (c) above in this structure as the company grows.</comment>


Google Says Malicious Websites Have Been Quietly Hacking iPhones for Years - <AUTHOR> https://www.vice.com/en_us/article/bjwne5/malicious-websites-hacked-iphones-for-years <comment><AUTHOR> Blog post from Project Zero: [https://googleprojectzero.blogspot.com/2019/08/a-very- deep-d...](https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive- into-ios-exploit.html)

"TAG was able to collect five separate, complete and unique iPhone exploit chains, covering almost every version from iOS 10 through to the latest version of iOS 12. This indicated a group making a sustained effort to hack the users of iPhones in certain communities over a period of at least two years."</comment>


Show HN: Bit – Python Bitcoin library now 10x faster than OpenSSL - <AUTHOR> https://github.com/ofek/bit#readme <comment><AUTHOR> Author here!

Bit now uses libsecp256k1 for all elliptic curve operations, which is the heavily optimized C library used by Bitcoin Core.

Here are some benchmarks: [https://ofek.github.io/bit/guide/intro.html#why- bit](https://ofek.github.io/bit/guide/intro.html#why-bit)

This also gives Bit deterministic signatures via RFC 6979.</comment>


Former Walmart US CEO says Congress should consider splitting up Amazon - <AUTHOR> https://www.cnbc.com/2018/03/29/former-walmart-us-ceo-congress-consider-splitting-up-amazon.html <comment><USER2> > He said the e-commerce giant has operated its retail segment at a loss for > decades, subsidizing the retail portion of its business with profits from > other areas, such as web services.

Amazon made losses for a long, long time. At that time AWS was not significant. Amazon's expansion was financed by investors.

> "That's because Amazon sells below cost and continues to do that," said > Simon, who serves on the board of directors for Darden Restaurants. "It's > destroying jobs, and it's destroying value in the sector," he said on > "Closing Bell" on Thursday.

Right, Amazon is selling at scale at loss. That would be a recipe to go bankrupt real fast. Not true.

> "Unlike others, they pay little or no taxes to state & local governments, > use our Postal System as their Delivery Boy (causing tremendous loss to the > U.S.), and are putting many thousands of retailers out of business!" Trump > wrote on Twitter.

Incremental revenue to the postal service will only improve their bottom line. Effects on other retailers is result of a more competitive business model.

The sales tax argument is moot, Amazon has changed a lot here in the US ([https://en.wikipedia.org/wiki/Amazon_tax](https://en.wikipedia.org/wiki/Amazon_tax) ) and in Europe.

Abuse of market power is a concern indeed. Big players can bulldoze markets e.g. Walmart squeezing suppliers. Amazon's power is a concern here but Amazon's power vs. their suppliers in a lot of places is be still way smaller than Walmart's. For some items (and I suspect higher paying items) Amazon may have taken over the leadership position.

Amazon is causing problems for cities, this is truly a big concern. But listening to someone who brings false and outdated arguments is not wise.

<comment><USER3> I don't think we'd have a USPS at this point if not for Amazon and other online retailers.

Anecdotally I haven't bought a stamp since I was a child, I pay all my bills online and opt-in for paperless billing, and at this point 95% of my mail is direct-to-recycling spam mailers.

If I'm understanding the USPS FY 2017 Revenue & Weight report ([http://about.usps.com/who-we-are/financials/revenue- pieces-w...](http://about.usps.com/who-we-are/financials/revenue-pieces- weight-reports/fy2017.pdf)) properly, it would appear that shipping packages is their only area of growth with nearly ever other parcel type going the way of the dodo.

</comment></comment><comment><USER4> Gluttonous fox suggests farmer should consider removing fence around chicken coop

<comment><USER5> He's former ceo. And what's wrong with splitting up amazon? Assuming the selling business remains a single entity?

I'm not in favor of splitting, I want them taxed fairly but that's it.

<comment><USER6> He has a massive conflict of interest because he was compensated heavily in Walmart shares, a direct competitor to Amazon.</comment></comment></comment>